xmrig | 5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-12-2024 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
Size

1.5MB
MD5

0ca5fb7e6aac437cf55411141932b809
SHA1

bdb6b74ea3dda8e0a6f57d04e67a7c06a210d656
SHA256

5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb
SHA512

739656fc1f9e6386bcf4ab6801c2e92d7f7482b1cb77c8719987c157d10ddba62a4c1f9bd10803f1c32cd7d6f4b1bc6d4913e5c45665f964277c49b50b4ff582
SSDEEP

49152:EnCbL83y9FdfE0pZ0zCa4wI156uL3pgrCEX:EniLf9FdfE0pZB156utgz

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2640-0-0x000000013F890000-0x000000013FBE4000-memory.dmp	xmrig
behavioral1/files/0x00090000000120fb-3.dat	xmrig
behavioral1/memory/2640-6-0x000000013FD30000-0x0000000140084000-memory.dmp	xmrig
behavioral1/files/0x0005000000019bf2-62.dat	xmrig
behavioral1/files/0x0007000000017447-70.dat	xmrig
behavioral1/files/0x0006000000018636-74.dat	xmrig
behavioral1/files/0x0006000000018634-33.dat	xmrig
behavioral1/files/0x0005000000019bf0-56.dat	xmrig
behavioral1/memory/2696-80-0x000000013FCF0000-0x0000000140044000-memory.dmp	xmrig
behavioral1/memory/2784-44-0x000000013FA70000-0x000000013FDC4000-memory.dmp	xmrig
behavioral1/files/0x0006000000019931-39.dat	xmrig
behavioral1/memory/2688-78-0x000000013FEB0000-0x0000000140204000-memory.dmp	xmrig
behavioral1/files/0x0008000000017467-32.dat	xmrig
behavioral1/memory/2824-31-0x000000013FD30000-0x0000000140084000-memory.dmp	xmrig
behavioral1/memory/2784-88-0x000000013FA70000-0x000000013FDC4000-memory.dmp	xmrig
behavioral1/memory/2824-87-0x000000013FD30000-0x0000000140084000-memory.dmp	xmrig
behavioral1/files/0x000a000000018617-20.dat	xmrig
behavioral1/files/0x0008000000017429-12.dat	xmrig
behavioral1/memory/2640-77-0x000000013F890000-0x000000013FBE4000-memory.dmp	xmrig
behavioral1/memory/2812-75-0x000000013F860000-0x000000013FBB4000-memory.dmp	xmrig
behavioral1/memory/2212-73-0x000000013F620000-0x000000013F974000-memory.dmp	xmrig
behavioral1/memory/2388-71-0x000000013FB90000-0x000000013FEE4000-memory.dmp	xmrig
behavioral1/memory/2616-69-0x000000013F9D0000-0x000000013FD24000-memory.dmp	xmrig
behavioral1/memory/2780-64-0x000000013F940000-0x000000013FC94000-memory.dmp	xmrig
behavioral1/memory/2848-63-0x000000013FD40000-0x0000000140094000-memory.dmp	xmrig
behavioral1/files/0x0005000000019c0b-93.dat	xmrig
behavioral1/memory/3028-98-0x000000013F750000-0x000000013FAA4000-memory.dmp	xmrig
behavioral1/memory/2640-101-0x0000000001EA0000-0x00000000021F4000-memory.dmp	xmrig
behavioral1/memory/2640-104-0x0000000001EA0000-0x00000000021F4000-memory.dmp	xmrig
behavioral1/files/0x0005000000019cfc-117.dat	xmrig
behavioral1/files/0x0005000000019d5c-111.dat	xmrig
behavioral1/memory/2616-115-0x000000013F9D0000-0x000000013FD24000-memory.dmp	xmrig
behavioral1/memory/2620-107-0x000000013FA40000-0x000000013FD94000-memory.dmp	xmrig
behavioral1/files/0x0005000000019cd5-106.dat	xmrig
behavioral1/files/0x0005000000019d69-116.dat	xmrig
behavioral1/files/0x000800000001739f-94.dat	xmrig
behavioral1/memory/2388-122-0x000000013FB90000-0x000000013FEE4000-memory.dmp	xmrig
behavioral1/memory/2652-54-0x000000013F570000-0x000000013F8C4000-memory.dmp	xmrig
behavioral1/memory/1668-51-0x000000013FAD0000-0x000000013FE24000-memory.dmp	xmrig
behavioral1/files/0x0005000000019bec-50.dat	xmrig
behavioral1/files/0x00060000000196a0-49.dat	xmrig
behavioral1/memory/2212-123-0x000000013F620000-0x000000013F974000-memory.dmp	xmrig
behavioral1/files/0x0005000000019f57-128.dat	xmrig
behavioral1/files/0x0005000000019f71-134.dat	xmrig
behavioral1/files/0x000500000001a020-136.dat	xmrig
behavioral1/files/0x000500000001a033-145.dat	xmrig
behavioral1/files/0x000500000001a05a-147.dat	xmrig
behavioral1/files/0x000500000001a2b9-154.dat	xmrig
behavioral1/files/0x000500000001a3e4-162.dat	xmrig
behavioral1/memory/2696-545-0x000000013FCF0000-0x0000000140044000-memory.dmp	xmrig
behavioral1/memory/2688-355-0x000000013FEB0000-0x0000000140204000-memory.dmp	xmrig
behavioral1/memory/2812-216-0x000000013F860000-0x000000013FBB4000-memory.dmp	xmrig
behavioral1/files/0x000500000001a445-196.dat	xmrig
behavioral1/files/0x000500000001a423-190.dat	xmrig
behavioral1/files/0x000500000001a3ea-179.dat	xmrig
behavioral1/files/0x000500000001a3ed-185.dat	xmrig
behavioral1/files/0x000500000001a3e6-169.dat	xmrig
behavioral1/files/0x000500000001a3e8-175.dat	xmrig
behavioral1/files/0x000500000001a2fc-161.dat	xmrig
behavioral1/memory/3028-1593-0x000000013F750000-0x000000013FAA4000-memory.dmp	xmrig
behavioral1/memory/2640-2369-0x000000013F0C0000-0x000000013F414000-memory.dmp	xmrig
behavioral1/memory/1668-3999-0x000000013FAD0000-0x000000013FE24000-memory.dmp	xmrig
behavioral1/memory/2824-4000-0x000000013FD30000-0x0000000140084000-memory.dmp	xmrig
behavioral1/memory/2652-4001-0x000000013F570000-0x000000013F8C4000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1668	iCfuEwZ.exe
2824	ufbKOzc.exe
2652	EQXegXy.exe
2784	MJgWRGJ.exe
2780	EXMUAME.exe
2848	uWYmLUV.exe
2616	xlCzMes.exe
2388	WzBrBbm.exe
2212	RFteXgH.exe
2812	FieUYcv.exe
2688	oAWPBII.exe
2696	uimUanY.exe
3028	lijTeUH.exe
2620	SXFdHlf.exe
2840	DyqevrB.exe
1236	dtgrAzU.exe
2628	fxSYCwD.exe
2864	vAHeqMj.exe
1340	ixacgcp.exe
1884	nwSpSyI.exe
1752	mPWTARH.exe
1648	uSYVzuT.exe
1576	nqCuduQ.exe
264	JUGoqNP.exe
2428	KYgDJwN.exe
2520	EzKaPVE.exe
2736	LCeQgRk.exe
2024	qDcufjp.exe
2304	LNklsdz.exe
1924	CKTEqCZ.exe
1620	mMIGxbH.exe
1732	jYCqlec.exe
1608	PUpgBzd.exe
664	MnGxMGZ.exe
1944	AMJbAbn.exe
1372	GYNmSlE.exe
1724	sahYljF.exe
1748	JEvRrsb.exe
1100	dGkeSze.exe
2264	LDVHIek.exe
984	ZdYmPce.exe
2200	wIAFMvI.exe
2476	xWtzjdj.exe
568	bbfBvMU.exe
1388	HuwgdlB.exe
1652	bPDXnac.exe
304	aBGyLhX.exe
1744	lVWmysT.exe
880	ElVWQBK.exe
1728	deIupGD.exe
3008	haJleBn.exe
1592	tofrYPy.exe
2464	dUgrVpk.exe
2668	vgNckeD.exe
2772	XBmiTCz.exe
2576	EOmronT.exe
2984	FZqLlzP.exe
2676	bruydQJ.exe
2068	PQCgLQl.exe
2452	bpIFHTa.exe
2472	BPMweet.exe
2764	vRQFmnR.exe
1264	IeJfQvO.exe
2868	qflDugm.exe

Loads dropped DLL 64 IoCs

pid	Process
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2640-0-0x000000013F890000-0x000000013FBE4000-memory.dmp	upx
behavioral1/files/0x00090000000120fb-3.dat	upx
behavioral1/memory/2640-6-0x000000013FD30000-0x0000000140084000-memory.dmp	upx
behavioral1/files/0x0005000000019bf2-62.dat	upx
behavioral1/files/0x0007000000017447-70.dat	upx
behavioral1/files/0x0006000000018636-74.dat	upx
behavioral1/files/0x0006000000018634-33.dat	upx
behavioral1/files/0x0005000000019bf0-56.dat	upx
behavioral1/memory/2696-80-0x000000013FCF0000-0x0000000140044000-memory.dmp	upx
behavioral1/memory/2784-44-0x000000013FA70000-0x000000013FDC4000-memory.dmp	upx
behavioral1/files/0x0006000000019931-39.dat	upx
behavioral1/memory/2688-78-0x000000013FEB0000-0x0000000140204000-memory.dmp	upx
behavioral1/files/0x0008000000017467-32.dat	upx
behavioral1/memory/2824-31-0x000000013FD30000-0x0000000140084000-memory.dmp	upx
behavioral1/memory/2784-88-0x000000013FA70000-0x000000013FDC4000-memory.dmp	upx
behavioral1/memory/2824-87-0x000000013FD30000-0x0000000140084000-memory.dmp	upx
behavioral1/files/0x000a000000018617-20.dat	upx
behavioral1/files/0x0008000000017429-12.dat	upx
behavioral1/memory/2640-77-0x000000013F890000-0x000000013FBE4000-memory.dmp	upx
behavioral1/memory/2812-75-0x000000013F860000-0x000000013FBB4000-memory.dmp	upx
behavioral1/memory/2212-73-0x000000013F620000-0x000000013F974000-memory.dmp	upx
behavioral1/memory/2388-71-0x000000013FB90000-0x000000013FEE4000-memory.dmp	upx
behavioral1/memory/2616-69-0x000000013F9D0000-0x000000013FD24000-memory.dmp	upx
behavioral1/memory/2780-64-0x000000013F940000-0x000000013FC94000-memory.dmp	upx
behavioral1/memory/2848-63-0x000000013FD40000-0x0000000140094000-memory.dmp	upx
behavioral1/files/0x0005000000019c0b-93.dat	upx
behavioral1/memory/3028-98-0x000000013F750000-0x000000013FAA4000-memory.dmp	upx
behavioral1/files/0x0005000000019cfc-117.dat	upx
behavioral1/files/0x0005000000019d5c-111.dat	upx
behavioral1/memory/2616-115-0x000000013F9D0000-0x000000013FD24000-memory.dmp	upx
behavioral1/memory/2620-107-0x000000013FA40000-0x000000013FD94000-memory.dmp	upx
behavioral1/files/0x0005000000019cd5-106.dat	upx
behavioral1/files/0x0005000000019d69-116.dat	upx
behavioral1/files/0x000800000001739f-94.dat	upx
behavioral1/memory/2388-122-0x000000013FB90000-0x000000013FEE4000-memory.dmp	upx
behavioral1/memory/2652-54-0x000000013F570000-0x000000013F8C4000-memory.dmp	upx
behavioral1/memory/1668-51-0x000000013FAD0000-0x000000013FE24000-memory.dmp	upx
behavioral1/files/0x0005000000019bec-50.dat	upx
behavioral1/files/0x00060000000196a0-49.dat	upx
behavioral1/memory/2640-10-0x0000000001EA0000-0x00000000021F4000-memory.dmp	upx
behavioral1/memory/2212-123-0x000000013F620000-0x000000013F974000-memory.dmp	upx
behavioral1/files/0x0005000000019f57-128.dat	upx
behavioral1/files/0x0005000000019f71-134.dat	upx
behavioral1/files/0x000500000001a020-136.dat	upx
behavioral1/files/0x000500000001a033-145.dat	upx
behavioral1/files/0x000500000001a05a-147.dat	upx
behavioral1/files/0x000500000001a2b9-154.dat	upx
behavioral1/files/0x000500000001a3e4-162.dat	upx
behavioral1/memory/2696-545-0x000000013FCF0000-0x0000000140044000-memory.dmp	upx
behavioral1/memory/2688-355-0x000000013FEB0000-0x0000000140204000-memory.dmp	upx
behavioral1/memory/2812-216-0x000000013F860000-0x000000013FBB4000-memory.dmp	upx
behavioral1/files/0x000500000001a445-196.dat	upx
behavioral1/files/0x000500000001a423-190.dat	upx
behavioral1/files/0x000500000001a3ea-179.dat	upx
behavioral1/files/0x000500000001a3ed-185.dat	upx
behavioral1/files/0x000500000001a3e6-169.dat	upx
behavioral1/files/0x000500000001a3e8-175.dat	upx
behavioral1/files/0x000500000001a2fc-161.dat	upx
behavioral1/memory/3028-1593-0x000000013F750000-0x000000013FAA4000-memory.dmp	upx
behavioral1/memory/1668-3999-0x000000013FAD0000-0x000000013FE24000-memory.dmp	upx
behavioral1/memory/2824-4000-0x000000013FD30000-0x0000000140084000-memory.dmp	upx
behavioral1/memory/2652-4001-0x000000013F570000-0x000000013F8C4000-memory.dmp	upx
behavioral1/memory/2784-4002-0x000000013FA70000-0x000000013FDC4000-memory.dmp	upx
behavioral1/memory/2848-4003-0x000000013FD40000-0x0000000140094000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dSPRlza.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\ZXBUNTo.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\PcRDZwU.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\gFzsxtd.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\CkahsTl.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\YAxkAIl.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\wcXMhII.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\JhTiAKb.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\dxNRBXD.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\urnuHUt.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\QECsFkg.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\HETcJOh.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\cFPgHLF.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\phauYHM.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\kGSGSLc.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\wSbmyvk.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\LjBraDR.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\xLKMHwm.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\AdKEbmF.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\GSIjnXy.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\GgHBurD.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\qicLgKL.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\dCOPArz.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\sGoigyF.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\QPeHZzR.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\SNJCCSJ.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\esSruJN.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\tofrYPy.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\vgNckeD.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\xqsOjsh.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\SSnNPlG.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\LtQVGHp.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\WtjCCfa.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\JYzmbBm.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\bHpngvi.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\rkcfcfd.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\EXMUAME.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\IeJfQvO.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\fgdueJx.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\NcqPMpF.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\SXrmmGq.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\fnXdpUh.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\VkmvHAw.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\QCFqzkS.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\jRiYFCw.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\oPRlosf.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\snpohbj.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\LYlSVbm.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\WbXMPMi.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\YvnpVHu.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\Tpzwkft.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\qKtwrVE.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\cLDrNDY.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\hcNFAKX.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\ILrAoir.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\oVLprfL.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\UDARXRn.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\zLdYXnr.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\OGzTwTb.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\RjCEAcK.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\PnXXcka.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\FCdXEQy.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\NfbqOwF.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
File created	C:\Windows\System\aZosLpZ.exe	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2824	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	31
PID 2640 wrote to memory of 2824	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	31
PID 2640 wrote to memory of 2824	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	31
PID 2640 wrote to memory of 1668	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	32
PID 2640 wrote to memory of 1668	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	32
PID 2640 wrote to memory of 1668	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	32
PID 2640 wrote to memory of 2388	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	33
PID 2640 wrote to memory of 2388	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	33
PID 2640 wrote to memory of 2388	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	33
PID 2640 wrote to memory of 2652	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	34
PID 2640 wrote to memory of 2652	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	34
PID 2640 wrote to memory of 2652	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	34
PID 2640 wrote to memory of 2212	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	35
PID 2640 wrote to memory of 2212	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	35
PID 2640 wrote to memory of 2212	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	35
PID 2640 wrote to memory of 2784	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	36
PID 2640 wrote to memory of 2784	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	36
PID 2640 wrote to memory of 2784	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	36
PID 2640 wrote to memory of 2812	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	37
PID 2640 wrote to memory of 2812	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	37
PID 2640 wrote to memory of 2812	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	37
PID 2640 wrote to memory of 2780	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	38
PID 2640 wrote to memory of 2780	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	38
PID 2640 wrote to memory of 2780	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	38
PID 2640 wrote to memory of 2688	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	39
PID 2640 wrote to memory of 2688	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	39
PID 2640 wrote to memory of 2688	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	39
PID 2640 wrote to memory of 2848	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	40
PID 2640 wrote to memory of 2848	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	40
PID 2640 wrote to memory of 2848	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	40
PID 2640 wrote to memory of 2696	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	41
PID 2640 wrote to memory of 2696	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	41
PID 2640 wrote to memory of 2696	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	41
PID 2640 wrote to memory of 2616	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	42
PID 2640 wrote to memory of 2616	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	42
PID 2640 wrote to memory of 2616	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	42
PID 2640 wrote to memory of 3028	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	43
PID 2640 wrote to memory of 3028	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	43
PID 2640 wrote to memory of 3028	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	43
PID 2640 wrote to memory of 2620	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	44
PID 2640 wrote to memory of 2620	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	44
PID 2640 wrote to memory of 2620	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	44
PID 2640 wrote to memory of 2840	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	45
PID 2640 wrote to memory of 2840	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	45
PID 2640 wrote to memory of 2840	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	45
PID 2640 wrote to memory of 1236	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	46
PID 2640 wrote to memory of 1236	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	46
PID 2640 wrote to memory of 1236	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	46
PID 2640 wrote to memory of 2628	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	47
PID 2640 wrote to memory of 2628	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	47
PID 2640 wrote to memory of 2628	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	47
PID 2640 wrote to memory of 2864	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	48
PID 2640 wrote to memory of 2864	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	48
PID 2640 wrote to memory of 2864	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	48
PID 2640 wrote to memory of 1340	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	49
PID 2640 wrote to memory of 1340	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	49
PID 2640 wrote to memory of 1340	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	49
PID 2640 wrote to memory of 1884	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	50
PID 2640 wrote to memory of 1884	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	50
PID 2640 wrote to memory of 1884	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	50
PID 2640 wrote to memory of 1752	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	51
PID 2640 wrote to memory of 1752	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	51
PID 2640 wrote to memory of 1752	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	51
PID 2640 wrote to memory of 1648	2640	JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe	52

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5b3fa6b672bf7ef0c39a8d316b051ef985065f23a24b6412434fd87ca3c369cb.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\System\ufbKOzc.exe
  C:\Windows\System\ufbKOzc.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\iCfuEwZ.exe
  C:\Windows\System\iCfuEwZ.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\WzBrBbm.exe
  C:\Windows\System\WzBrBbm.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\EQXegXy.exe
  C:\Windows\System\EQXegXy.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\RFteXgH.exe
  C:\Windows\System\RFteXgH.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\MJgWRGJ.exe
  C:\Windows\System\MJgWRGJ.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\FieUYcv.exe
  C:\Windows\System\FieUYcv.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\EXMUAME.exe
  C:\Windows\System\EXMUAME.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\oAWPBII.exe
  C:\Windows\System\oAWPBII.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\uWYmLUV.exe
  C:\Windows\System\uWYmLUV.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\uimUanY.exe
  C:\Windows\System\uimUanY.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\xlCzMes.exe
  C:\Windows\System\xlCzMes.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\lijTeUH.exe
  C:\Windows\System\lijTeUH.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\SXFdHlf.exe
  C:\Windows\System\SXFdHlf.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\DyqevrB.exe
  C:\Windows\System\DyqevrB.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\dtgrAzU.exe
  C:\Windows\System\dtgrAzU.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\fxSYCwD.exe
  C:\Windows\System\fxSYCwD.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\vAHeqMj.exe
  C:\Windows\System\vAHeqMj.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\ixacgcp.exe
  C:\Windows\System\ixacgcp.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\nwSpSyI.exe
  C:\Windows\System\nwSpSyI.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\mPWTARH.exe
  C:\Windows\System\mPWTARH.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\uSYVzuT.exe
  C:\Windows\System\uSYVzuT.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\nqCuduQ.exe
  C:\Windows\System\nqCuduQ.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\JUGoqNP.exe
  C:\Windows\System\JUGoqNP.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\KYgDJwN.exe
  C:\Windows\System\KYgDJwN.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\EzKaPVE.exe
  C:\Windows\System\EzKaPVE.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\LCeQgRk.exe
  C:\Windows\System\LCeQgRk.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\qDcufjp.exe
  C:\Windows\System\qDcufjp.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\LNklsdz.exe
  C:\Windows\System\LNklsdz.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\CKTEqCZ.exe
  C:\Windows\System\CKTEqCZ.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\mMIGxbH.exe
  C:\Windows\System\mMIGxbH.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\jYCqlec.exe
  C:\Windows\System\jYCqlec.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\PUpgBzd.exe
  C:\Windows\System\PUpgBzd.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\MnGxMGZ.exe
  C:\Windows\System\MnGxMGZ.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\AMJbAbn.exe
  C:\Windows\System\AMJbAbn.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\GYNmSlE.exe
  C:\Windows\System\GYNmSlE.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\sahYljF.exe
  C:\Windows\System\sahYljF.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\JEvRrsb.exe
  C:\Windows\System\JEvRrsb.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\dGkeSze.exe
  C:\Windows\System\dGkeSze.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\LDVHIek.exe
  C:\Windows\System\LDVHIek.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\ZdYmPce.exe
  C:\Windows\System\ZdYmPce.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\wIAFMvI.exe
  C:\Windows\System\wIAFMvI.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\xWtzjdj.exe
  C:\Windows\System\xWtzjdj.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\bbfBvMU.exe
  C:\Windows\System\bbfBvMU.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\HuwgdlB.exe
  C:\Windows\System\HuwgdlB.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\bPDXnac.exe
  C:\Windows\System\bPDXnac.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\aBGyLhX.exe
  C:\Windows\System\aBGyLhX.exe
  2⤵
  - Executes dropped EXE
  PID:304
- C:\Windows\System\lVWmysT.exe
  C:\Windows\System\lVWmysT.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\ElVWQBK.exe
  C:\Windows\System\ElVWQBK.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\deIupGD.exe
  C:\Windows\System\deIupGD.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\haJleBn.exe
  C:\Windows\System\haJleBn.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\tofrYPy.exe
  C:\Windows\System\tofrYPy.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\dUgrVpk.exe
  C:\Windows\System\dUgrVpk.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\vgNckeD.exe
  C:\Windows\System\vgNckeD.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\XBmiTCz.exe
  C:\Windows\System\XBmiTCz.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\EOmronT.exe
  C:\Windows\System\EOmronT.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\FZqLlzP.exe
  C:\Windows\System\FZqLlzP.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\bruydQJ.exe
  C:\Windows\System\bruydQJ.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\PQCgLQl.exe
  C:\Windows\System\PQCgLQl.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\bpIFHTa.exe
  C:\Windows\System\bpIFHTa.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\BPMweet.exe
  C:\Windows\System\BPMweet.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\vRQFmnR.exe
  C:\Windows\System\vRQFmnR.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\IeJfQvO.exe
  C:\Windows\System\IeJfQvO.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\qflDugm.exe
  C:\Windows\System\qflDugm.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\xynHPuo.exe
  C:\Windows\System\xynHPuo.exe
  2⤵
  PID:2548
- C:\Windows\System\SXrmmGq.exe
  C:\Windows\System\SXrmmGq.exe
  2⤵
  PID:2836
- C:\Windows\System\jLvwKIB.exe
  C:\Windows\System\jLvwKIB.exe
  2⤵
  PID:2664
- C:\Windows\System\RkXgEkU.exe
  C:\Windows\System\RkXgEkU.exe
  2⤵
  PID:2844
- C:\Windows\System\KSyuuub.exe
  C:\Windows\System\KSyuuub.exe
  2⤵
  PID:1716
- C:\Windows\System\sLqVszS.exe
  C:\Windows\System\sLqVszS.exe
  2⤵
  PID:1852
- C:\Windows\System\OKYUref.exe
  C:\Windows\System\OKYUref.exe
  2⤵
  PID:316
- C:\Windows\System\QmHZMHT.exe
  C:\Windows\System\QmHZMHT.exe
  2⤵
  PID:1312
- C:\Windows\System\okCIWeK.exe
  C:\Windows\System\okCIWeK.exe
  2⤵
  PID:2916
- C:\Windows\System\efKnxgQ.exe
  C:\Windows\System\efKnxgQ.exe
  2⤵
  PID:2584
- C:\Windows\System\WOhvuTF.exe
  C:\Windows\System\WOhvuTF.exe
  2⤵
  PID:2580
- C:\Windows\System\GkdXAxm.exe
  C:\Windows\System\GkdXAxm.exe
  2⤵
  PID:2524
- C:\Windows\System\ZTQkHYo.exe
  C:\Windows\System\ZTQkHYo.exe
  2⤵
  PID:2624
- C:\Windows\System\GxiTlZc.exe
  C:\Windows\System\GxiTlZc.exe
  2⤵
  PID:572
- C:\Windows\System\PyTzUWA.exe
  C:\Windows\System\PyTzUWA.exe
  2⤵
  PID:2504
- C:\Windows\System\yrmocvH.exe
  C:\Windows\System\yrmocvH.exe
  2⤵
  PID:2144
- C:\Windows\System\QgPjsFq.exe
  C:\Windows\System\QgPjsFq.exe
  2⤵
  PID:2720
- C:\Windows\System\oWiJAEq.exe
  C:\Windows\System\oWiJAEq.exe
  2⤵
  PID:548
- C:\Windows\System\ytFCGBP.exe
  C:\Windows\System\ytFCGBP.exe
  2⤵
  PID:2288
- C:\Windows\System\PjYgcnH.exe
  C:\Windows\System\PjYgcnH.exe
  2⤵
  PID:2064
- C:\Windows\System\EZRCtcL.exe
  C:\Windows\System\EZRCtcL.exe
  2⤵
  PID:944
- C:\Windows\System\stDeLZv.exe
  C:\Windows\System\stDeLZv.exe
  2⤵
  PID:1092
- C:\Windows\System\yhWhWvE.exe
  C:\Windows\System\yhWhWvE.exe
  2⤵
  PID:1708
- C:\Windows\System\WpQwIno.exe
  C:\Windows\System\WpQwIno.exe
  2⤵
  PID:1712
- C:\Windows\System\FSqPgFu.exe
  C:\Windows\System\FSqPgFu.exe
  2⤵
  PID:2152
- C:\Windows\System\GObjJoC.exe
  C:\Windows\System\GObjJoC.exe
  2⤵
  PID:2056
- C:\Windows\System\xJVDkgI.exe
  C:\Windows\System\xJVDkgI.exe
  2⤵
  PID:3012
- C:\Windows\System\eEVOswH.exe
  C:\Windows\System\eEVOswH.exe
  2⤵
  PID:2404
- C:\Windows\System\RMHuUnm.exe
  C:\Windows\System\RMHuUnm.exe
  2⤵
  PID:760
- C:\Windows\System\JHyORgG.exe
  C:\Windows\System\JHyORgG.exe
  2⤵
  PID:2328
- C:\Windows\System\UdRBXMc.exe
  C:\Windows\System\UdRBXMc.exe
  2⤵
  PID:2312
- C:\Windows\System\DmJpQvH.exe
  C:\Windows\System\DmJpQvH.exe
  2⤵
  PID:2320
- C:\Windows\System\kXFUKzt.exe
  C:\Windows\System\kXFUKzt.exe
  2⤵
  PID:1568
- C:\Windows\System\wBmVfvP.exe
  C:\Windows\System\wBmVfvP.exe
  2⤵
  PID:2484
- C:\Windows\System\phXIhaD.exe
  C:\Windows\System\phXIhaD.exe
  2⤵
  PID:1060
- C:\Windows\System\lpkkdYy.exe
  C:\Windows\System\lpkkdYy.exe
  2⤵
  PID:2684
- C:\Windows\System\nScWLRM.exe
  C:\Windows\System\nScWLRM.exe
  2⤵
  PID:2672
- C:\Windows\System\LSZbVqL.exe
  C:\Windows\System\LSZbVqL.exe
  2⤵
  PID:2872
- C:\Windows\System\DlbaHQI.exe
  C:\Windows\System\DlbaHQI.exe
  2⤵
  PID:2928
- C:\Windows\System\CXEQALw.exe
  C:\Windows\System\CXEQALw.exe
  2⤵
  PID:2876
- C:\Windows\System\hDxEOad.exe
  C:\Windows\System\hDxEOad.exe
  2⤵
  PID:1856
- C:\Windows\System\WgbPJvW.exe
  C:\Windows\System\WgbPJvW.exe
  2⤵
  PID:3048
- C:\Windows\System\rmhMCVH.exe
  C:\Windows\System\rmhMCVH.exe
  2⤵
  PID:2096
- C:\Windows\System\EkjSoyN.exe
  C:\Windows\System\EkjSoyN.exe
  2⤵
  PID:2904
- C:\Windows\System\rpJprnb.exe
  C:\Windows\System\rpJprnb.exe
  2⤵
  PID:2316
- C:\Windows\System\jDqZXpn.exe
  C:\Windows\System\jDqZXpn.exe
  2⤵
  PID:2420
- C:\Windows\System\ciBGDOp.exe
  C:\Windows\System\ciBGDOp.exe
  2⤵
  PID:1784
- C:\Windows\System\wKlJhIR.exe
  C:\Windows\System\wKlJhIR.exe
  2⤵
  PID:784
- C:\Windows\System\oCKQFLx.exe
  C:\Windows\System\oCKQFLx.exe
  2⤵
  PID:3052
- C:\Windows\System\hqkVXJz.exe
  C:\Windows\System\hqkVXJz.exe
  2⤵
  PID:828
- C:\Windows\System\kGkLRoi.exe
  C:\Windows\System\kGkLRoi.exe
  2⤵
  PID:1888
- C:\Windows\System\RoMceah.exe
  C:\Windows\System\RoMceah.exe
  2⤵
  PID:1548
- C:\Windows\System\MxpvFws.exe
  C:\Windows\System\MxpvFws.exe
  2⤵
  PID:2272
- C:\Windows\System\gzKQHSr.exe
  C:\Windows\System\gzKQHSr.exe
  2⤵
  PID:1220
- C:\Windows\System\YGvqKVQ.exe
  C:\Windows\System\YGvqKVQ.exe
  2⤵
  PID:860
- C:\Windows\System\IMkDTfl.exe
  C:\Windows\System\IMkDTfl.exe
  2⤵
  PID:3068
- C:\Windows\System\piZcCbn.exe
  C:\Windows\System\piZcCbn.exe
  2⤵
  PID:3004
- C:\Windows\System\PFaIGza.exe
  C:\Windows\System\PFaIGza.exe
  2⤵
  PID:884
- C:\Windows\System\LfqVxPE.exe
  C:\Windows\System\LfqVxPE.exe
  2⤵
  PID:2432
- C:\Windows\System\klOZacX.exe
  C:\Windows\System\klOZacX.exe
  2⤵
  PID:1076
- C:\Windows\System\KrTvOCR.exe
  C:\Windows\System\KrTvOCR.exe
  2⤵
  PID:2892
- C:\Windows\System\zEjTvpU.exe
  C:\Windows\System\zEjTvpU.exe
  2⤵
  PID:2816
- C:\Windows\System\kgtNqNE.exe
  C:\Windows\System\kgtNqNE.exe
  2⤵
  PID:2596
- C:\Windows\System\sFXkbiQ.exe
  C:\Windows\System\sFXkbiQ.exe
  2⤵
  PID:2948
- C:\Windows\System\wdqmQoU.exe
  C:\Windows\System\wdqmQoU.exe
  2⤵
  PID:2860
- C:\Windows\System\FfgGORN.exe
  C:\Windows\System\FfgGORN.exe
  2⤵
  PID:2956
- C:\Windows\System\PxNhIJW.exe
  C:\Windows\System\PxNhIJW.exe
  2⤵
  PID:1632
- C:\Windows\System\WpccHxS.exe
  C:\Windows\System\WpccHxS.exe
  2⤵
  PID:2636
- C:\Windows\System\fGDKKwV.exe
  C:\Windows\System\fGDKKwV.exe
  2⤵
  PID:1692
- C:\Windows\System\hNKWuGf.exe
  C:\Windows\System\hNKWuGf.exe
  2⤵
  PID:2376
- C:\Windows\System\gANMBSe.exe
  C:\Windows\System\gANMBSe.exe
  2⤵
  PID:1948
- C:\Windows\System\vTaegKz.exe
  C:\Windows\System\vTaegKz.exe
  2⤵
  PID:1904
- C:\Windows\System\wIRzTXT.exe
  C:\Windows\System\wIRzTXT.exe
  2⤵
  PID:904
- C:\Windows\System\mKcrUsy.exe
  C:\Windows\System\mKcrUsy.exe
  2⤵
  PID:2060
- C:\Windows\System\SODiOPE.exe
  C:\Windows\System\SODiOPE.exe
  2⤵
  PID:1804
- C:\Windows\System\cbjxaLl.exe
  C:\Windows\System\cbjxaLl.exe
  2⤵
  PID:1364
- C:\Windows\System\gzsJFcf.exe
  C:\Windows\System\gzsJFcf.exe
  2⤵
  PID:344
- C:\Windows\System\vzmeuLh.exe
  C:\Windows\System\vzmeuLh.exe
  2⤵
  PID:1680
- C:\Windows\System\oPRlosf.exe
  C:\Windows\System\oPRlosf.exe
  2⤵
  PID:2808
- C:\Windows\System\yjAdeQo.exe
  C:\Windows\System\yjAdeQo.exe
  2⤵
  PID:1600
- C:\Windows\System\aRGcJsh.exe
  C:\Windows\System\aRGcJsh.exe
  2⤵
  PID:2608
- C:\Windows\System\AEuUTtW.exe
  C:\Windows\System\AEuUTtW.exe
  2⤵
  PID:2700
- C:\Windows\System\diYUJeo.exe
  C:\Windows\System\diYUJeo.exe
  2⤵
  PID:1880
- C:\Windows\System\hyRoeHK.exe
  C:\Windows\System\hyRoeHK.exe
  2⤵
  PID:1604
- C:\Windows\System\cOgcQDO.exe
  C:\Windows\System\cOgcQDO.exe
  2⤵
  PID:1992
- C:\Windows\System\TEcBByS.exe
  C:\Windows\System\TEcBByS.exe
  2⤵
  PID:1052
- C:\Windows\System\DtYVyyj.exe
  C:\Windows\System\DtYVyyj.exe
  2⤵
  PID:1488
- C:\Windows\System\VcOQAEy.exe
  C:\Windows\System\VcOQAEy.exe
  2⤵
  PID:1484
- C:\Windows\System\RhqlKVI.exe
  C:\Windows\System\RhqlKVI.exe
  2⤵
  PID:480
- C:\Windows\System\vAdHMDW.exe
  C:\Windows\System\vAdHMDW.exe
  2⤵
  PID:604
- C:\Windows\System\fnXdpUh.exe
  C:\Windows\System\fnXdpUh.exe
  2⤵
  PID:1136
- C:\Windows\System\AiYXZBC.exe
  C:\Windows\System\AiYXZBC.exe
  2⤵
  PID:2228
- C:\Windows\System\VJjhJNm.exe
  C:\Windows\System\VJjhJNm.exe
  2⤵
  PID:1612
- C:\Windows\System\hcrpgRb.exe
  C:\Windows\System\hcrpgRb.exe
  2⤵
  PID:1868
- C:\Windows\System\PvQnUzm.exe
  C:\Windows\System\PvQnUzm.exe
  2⤵
  PID:2400
- C:\Windows\System\EAJAsNZ.exe
  C:\Windows\System\EAJAsNZ.exe
  2⤵
  PID:2588
- C:\Windows\System\uzGpmtB.exe
  C:\Windows\System\uzGpmtB.exe
  2⤵
  PID:1248
- C:\Windows\System\nODNbMz.exe
  C:\Windows\System\nODNbMz.exe
  2⤵
  PID:2216
- C:\Windows\System\FRpoARt.exe
  C:\Windows\System\FRpoARt.exe
  2⤵
  PID:2544
- C:\Windows\System\FGlmYKA.exe
  C:\Windows\System\FGlmYKA.exe
  2⤵
  PID:2540
- C:\Windows\System\CNvUSjZ.exe
  C:\Windows\System\CNvUSjZ.exe
  2⤵
  PID:600
- C:\Windows\System\HRgKXfQ.exe
  C:\Windows\System\HRgKXfQ.exe
  2⤵
  PID:1504
- C:\Windows\System\FNJXusN.exe
  C:\Windows\System\FNJXusN.exe
  2⤵
  PID:2648
- C:\Windows\System\hqDIlZm.exe
  C:\Windows\System\hqDIlZm.exe
  2⤵
  PID:2600
- C:\Windows\System\qCNMYmF.exe
  C:\Windows\System\qCNMYmF.exe
  2⤵
  PID:2340
- C:\Windows\System\LeTROQj.exe
  C:\Windows\System\LeTROQj.exe
  2⤵
  PID:2256
- C:\Windows\System\wdapleB.exe
  C:\Windows\System\wdapleB.exe
  2⤵
  PID:1696
- C:\Windows\System\zuVcwby.exe
  C:\Windows\System\zuVcwby.exe
  2⤵
  PID:296
- C:\Windows\System\KeSSNmb.exe
  C:\Windows\System\KeSSNmb.exe
  2⤵
  PID:524
- C:\Windows\System\BtiuJPK.exe
  C:\Windows\System\BtiuJPK.exe
  2⤵
  PID:3088
- C:\Windows\System\jTzAjNc.exe
  C:\Windows\System\jTzAjNc.exe
  2⤵
  PID:3108
- C:\Windows\System\mONYSaF.exe
  C:\Windows\System\mONYSaF.exe
  2⤵
  PID:3132
- C:\Windows\System\wyEcCrB.exe
  C:\Windows\System\wyEcCrB.exe
  2⤵
  PID:3148
- C:\Windows\System\ZAngzct.exe
  C:\Windows\System\ZAngzct.exe
  2⤵
  PID:3168
- C:\Windows\System\zVngBso.exe
  C:\Windows\System\zVngBso.exe
  2⤵
  PID:3196
- C:\Windows\System\RkvEwDg.exe
  C:\Windows\System\RkvEwDg.exe
  2⤵
  PID:3220
- C:\Windows\System\WBGPeEy.exe
  C:\Windows\System\WBGPeEy.exe
  2⤵
  PID:3236
- C:\Windows\System\Obmappi.exe
  C:\Windows\System\Obmappi.exe
  2⤵
  PID:3252
- C:\Windows\System\ZgCznAO.exe
  C:\Windows\System\ZgCznAO.exe
  2⤵
  PID:3276
- C:\Windows\System\qwazwbA.exe
  C:\Windows\System\qwazwbA.exe
  2⤵
  PID:3292
- C:\Windows\System\BrKHCGW.exe
  C:\Windows\System\BrKHCGW.exe
  2⤵
  PID:3320
- C:\Windows\System\KvqycHi.exe
  C:\Windows\System\KvqycHi.exe
  2⤵
  PID:3352
- C:\Windows\System\yAzdFDA.exe
  C:\Windows\System\yAzdFDA.exe
  2⤵
  PID:3368
- C:\Windows\System\KwWvgvo.exe
  C:\Windows\System\KwWvgvo.exe
  2⤵
  PID:3384
- C:\Windows\System\OGzTwTb.exe
  C:\Windows\System\OGzTwTb.exe
  2⤵
  PID:3400
- C:\Windows\System\gTZfMlj.exe
  C:\Windows\System\gTZfMlj.exe
  2⤵
  PID:3420
- C:\Windows\System\SKzxGyW.exe
  C:\Windows\System\SKzxGyW.exe
  2⤵
  PID:3436
- C:\Windows\System\mucIZsF.exe
  C:\Windows\System\mucIZsF.exe
  2⤵
  PID:3452
- C:\Windows\System\VRSmPsU.exe
  C:\Windows\System\VRSmPsU.exe
  2⤵
  PID:3472
- C:\Windows\System\AhUiiMC.exe
  C:\Windows\System\AhUiiMC.exe
  2⤵
  PID:3492
- C:\Windows\System\KObGmnx.exe
  C:\Windows\System\KObGmnx.exe
  2⤵
  PID:3508
- C:\Windows\System\VKUuJcg.exe
  C:\Windows\System\VKUuJcg.exe
  2⤵
  PID:3528
- C:\Windows\System\zIMOnbB.exe
  C:\Windows\System\zIMOnbB.exe
  2⤵
  PID:3544
- C:\Windows\System\PcRwzIc.exe
  C:\Windows\System\PcRwzIc.exe
  2⤵
  PID:3564
- C:\Windows\System\OSEbOlS.exe
  C:\Windows\System\OSEbOlS.exe
  2⤵
  PID:3580
- C:\Windows\System\AXpPCiu.exe
  C:\Windows\System\AXpPCiu.exe
  2⤵
  PID:3600
- C:\Windows\System\aaGnOjx.exe
  C:\Windows\System\aaGnOjx.exe
  2⤵
  PID:3628
- C:\Windows\System\UUmTUdu.exe
  C:\Windows\System\UUmTUdu.exe
  2⤵
  PID:3644
- C:\Windows\System\RjCEAcK.exe
  C:\Windows\System\RjCEAcK.exe
  2⤵
  PID:3664
- C:\Windows\System\rHyksLs.exe
  C:\Windows\System\rHyksLs.exe
  2⤵
  PID:3684
- C:\Windows\System\vWJdkFE.exe
  C:\Windows\System\vWJdkFE.exe
  2⤵
  PID:3700
- C:\Windows\System\pDvouEO.exe
  C:\Windows\System\pDvouEO.exe
  2⤵
  PID:3720
- C:\Windows\System\NMaakRl.exe
  C:\Windows\System\NMaakRl.exe
  2⤵
  PID:3736
- C:\Windows\System\qyNdwFT.exe
  C:\Windows\System\qyNdwFT.exe
  2⤵
  PID:3752
- C:\Windows\System\NSvzFZB.exe
  C:\Windows\System\NSvzFZB.exe
  2⤵
  PID:3768
- C:\Windows\System\MwFjraR.exe
  C:\Windows\System\MwFjraR.exe
  2⤵
  PID:3784
- C:\Windows\System\zTfJxUz.exe
  C:\Windows\System\zTfJxUz.exe
  2⤵
  PID:3804
- C:\Windows\System\ETzDjWx.exe
  C:\Windows\System\ETzDjWx.exe
  2⤵
  PID:3824
- C:\Windows\System\oVLprfL.exe
  C:\Windows\System\oVLprfL.exe
  2⤵
  PID:3840
- C:\Windows\System\gcHizaW.exe
  C:\Windows\System\gcHizaW.exe
  2⤵
  PID:3856
- C:\Windows\System\ypALRvH.exe
  C:\Windows\System\ypALRvH.exe
  2⤵
  PID:3876
- C:\Windows\System\AiAUNbC.exe
  C:\Windows\System\AiAUNbC.exe
  2⤵
  PID:3900
- C:\Windows\System\SANtsbO.exe
  C:\Windows\System\SANtsbO.exe
  2⤵
  PID:3916
- C:\Windows\System\jNbWUIp.exe
  C:\Windows\System\jNbWUIp.exe
  2⤵
  PID:3932
- C:\Windows\System\LzKfnwx.exe
  C:\Windows\System\LzKfnwx.exe
  2⤵
  PID:3948
- C:\Windows\System\yIxJAMN.exe
  C:\Windows\System\yIxJAMN.exe
  2⤵
  PID:3964
- C:\Windows\System\MGjhbkV.exe
  C:\Windows\System\MGjhbkV.exe
  2⤵
  PID:3988
- C:\Windows\System\Xpexqoo.exe
  C:\Windows\System\Xpexqoo.exe
  2⤵
  PID:4004
- C:\Windows\System\PtFpExk.exe
  C:\Windows\System\PtFpExk.exe
  2⤵
  PID:4024
- C:\Windows\System\DklykIQ.exe
  C:\Windows\System\DklykIQ.exe
  2⤵
  PID:4044
- C:\Windows\System\VLGJdzK.exe
  C:\Windows\System\VLGJdzK.exe
  2⤵
  PID:4060
- C:\Windows\System\hCENEZO.exe
  C:\Windows\System\hCENEZO.exe
  2⤵
  PID:4084
- C:\Windows\System\bXntbJR.exe
  C:\Windows\System\bXntbJR.exe
  2⤵
  PID:1404
- C:\Windows\System\WDfPRjX.exe
  C:\Windows\System\WDfPRjX.exe
  2⤵
  PID:3100
- C:\Windows\System\TzWhqyp.exe
  C:\Windows\System\TzWhqyp.exe
  2⤵
  PID:3128
- C:\Windows\System\oolvHPB.exe
  C:\Windows\System\oolvHPB.exe
  2⤵
  PID:3188
- C:\Windows\System\glFHBij.exe
  C:\Windows\System\glFHBij.exe
  2⤵
  PID:3228
- C:\Windows\System\mjapLHO.exe
  C:\Windows\System\mjapLHO.exe
  2⤵
  PID:2368
- C:\Windows\System\JazpRpY.exe
  C:\Windows\System\JazpRpY.exe
  2⤵
  PID:3300
- C:\Windows\System\HTXPVRC.exe
  C:\Windows\System\HTXPVRC.exe
  2⤵
  PID:3212
- C:\Windows\System\dSPRlza.exe
  C:\Windows\System\dSPRlza.exe
  2⤵
  PID:3160
- C:\Windows\System\XwegHvj.exe
  C:\Windows\System\XwegHvj.exe
  2⤵
  PID:3656
- C:\Windows\System\giqaRpt.exe
  C:\Windows\System\giqaRpt.exe
  2⤵
  PID:3344
- C:\Windows\System\HyJIbbV.exe
  C:\Windows\System\HyJIbbV.exe
  2⤵
  PID:3760
- C:\Windows\System\PAGrmzb.exe
  C:\Windows\System\PAGrmzb.exe
  2⤵
  PID:3864
- C:\Windows\System\nlhKnDn.exe
  C:\Windows\System\nlhKnDn.exe
  2⤵
  PID:3912
- C:\Windows\System\qIcdqeY.exe
  C:\Windows\System\qIcdqeY.exe
  2⤵
  PID:3976
- C:\Windows\System\MeLODYg.exe
  C:\Windows\System\MeLODYg.exe
  2⤵
  PID:3376
- C:\Windows\System\UXGSNUs.exe
  C:\Windows\System\UXGSNUs.exe
  2⤵
  PID:1800
- C:\Windows\System\LYpBwDb.exe
  C:\Windows\System\LYpBwDb.exe
  2⤵
  PID:3040
- C:\Windows\System\PnXXcka.exe
  C:\Windows\System\PnXXcka.exe
  2⤵
  PID:3408
- C:\Windows\System\RYopnqu.exe
  C:\Windows\System\RYopnqu.exe
  2⤵
  PID:3164
- C:\Windows\System\snnBUBT.exe
  C:\Windows\System\snnBUBT.exe
  2⤵
  PID:3744
- C:\Windows\System\dIsmBYR.exe
  C:\Windows\System\dIsmBYR.exe
  2⤵
  PID:3956
- C:\Windows\System\XpBQRfO.exe
  C:\Windows\System\XpBQRfO.exe
  2⤵
  PID:4040
- C:\Windows\System\DyqYfsb.exe
  C:\Windows\System\DyqYfsb.exe
  2⤵
  PID:3484
- C:\Windows\System\lgQFRHj.exe
  C:\Windows\System\lgQFRHj.exe
  2⤵
  PID:3560
- C:\Windows\System\ZdQudVF.exe
  C:\Windows\System\ZdQudVF.exe
  2⤵
  PID:3676
- C:\Windows\System\JYzmbBm.exe
  C:\Windows\System\JYzmbBm.exe
  2⤵
  PID:3396
- C:\Windows\System\Cnxozcz.exe
  C:\Windows\System\Cnxozcz.exe
  2⤵
  PID:3888
- C:\Windows\System\wRLHiVw.exe
  C:\Windows\System\wRLHiVw.exe
  2⤵
  PID:3468
- C:\Windows\System\jVawxrL.exe
  C:\Windows\System\jVawxrL.exe
  2⤵
  PID:4072
- C:\Windows\System\LCJAeyV.exe
  C:\Windows\System\LCJAeyV.exe
  2⤵
  PID:2408
- C:\Windows\System\hKpBYUW.exe
  C:\Windows\System\hKpBYUW.exe
  2⤵
  PID:3176
- C:\Windows\System\kVFqSdm.exe
  C:\Windows\System\kVFqSdm.exe
  2⤵
  PID:3304
- C:\Windows\System\FkqVeGX.exe
  C:\Windows\System\FkqVeGX.exe
  2⤵
  PID:3284
- C:\Windows\System\GyVRJGI.exe
  C:\Windows\System\GyVRJGI.exe
  2⤵
  PID:3360
- C:\Windows\System\qcOknBZ.exe
  C:\Windows\System\qcOknBZ.exe
  2⤵
  PID:3464
- C:\Windows\System\WkIfezR.exe
  C:\Windows\System\WkIfezR.exe
  2⤵
  PID:3616
- C:\Windows\System\lmQrxbz.exe
  C:\Windows\System\lmQrxbz.exe
  2⤵
  PID:3696
- C:\Windows\System\NPZtRxf.exe
  C:\Windows\System\NPZtRxf.exe
  2⤵
  PID:3832
- C:\Windows\System\SgkqZXo.exe
  C:\Windows\System\SgkqZXo.exe
  2⤵
  PID:3980
- C:\Windows\System\vsdmDmp.exe
  C:\Windows\System\vsdmDmp.exe
  2⤵
  PID:4012
- C:\Windows\System\PQUJZGj.exe
  C:\Windows\System\PQUJZGj.exe
  2⤵
  PID:3892
- C:\Windows\System\ZzaFEHr.exe
  C:\Windows\System\ZzaFEHr.exe
  2⤵
  PID:3716
- C:\Windows\System\YjbWNrb.exe
  C:\Windows\System\YjbWNrb.exe
  2⤵
  PID:3928
- C:\Windows\System\gCtAmkI.exe
  C:\Windows\System\gCtAmkI.exe
  2⤵
  PID:4080
- C:\Windows\System\MQXxMfU.exe
  C:\Windows\System\MQXxMfU.exe
  2⤵
  PID:3332
- C:\Windows\System\igbXByo.exe
  C:\Windows\System\igbXByo.exe
  2⤵
  PID:3576
- C:\Windows\System\OmVFcwu.exe
  C:\Windows\System\OmVFcwu.exe
  2⤵
  PID:4000
- C:\Windows\System\kGSGSLc.exe
  C:\Windows\System\kGSGSLc.exe
  2⤵
  PID:3480
- C:\Windows\System\xoQmLXR.exe
  C:\Windows\System\xoQmLXR.exe
  2⤵
  PID:3204
- C:\Windows\System\HPuDgca.exe
  C:\Windows\System\HPuDgca.exe
  2⤵
  PID:3640
- C:\Windows\System\ttYwsBK.exe
  C:\Windows\System\ttYwsBK.exe
  2⤵
  PID:4092
- C:\Windows\System\JWeuzsz.exe
  C:\Windows\System\JWeuzsz.exe
  2⤵
  PID:4032
- C:\Windows\System\ViKDoyl.exe
  C:\Windows\System\ViKDoyl.exe
  2⤵
  PID:3728
- C:\Windows\System\soprQYT.exe
  C:\Windows\System\soprQYT.exe
  2⤵
  PID:3556
- C:\Windows\System\fgdueJx.exe
  C:\Windows\System\fgdueJx.exe
  2⤵
  PID:3608
- C:\Windows\System\LHdljVX.exe
  C:\Windows\System\LHdljVX.exe
  2⤵
  PID:3540
- C:\Windows\System\SnkGTJw.exe
  C:\Windows\System\SnkGTJw.exe
  2⤵
  PID:3244
- C:\Windows\System\jZKYrcG.exe
  C:\Windows\System\jZKYrcG.exe
  2⤵
  PID:3572
- C:\Windows\System\RfLXDuu.exe
  C:\Windows\System\RfLXDuu.exe
  2⤵
  PID:3428
- C:\Windows\System\cANCQyi.exe
  C:\Windows\System\cANCQyi.exe
  2⤵
  PID:4056
- C:\Windows\System\hOBkDPi.exe
  C:\Windows\System\hOBkDPi.exe
  2⤵
  PID:3800
- C:\Windows\System\yUUBvLu.exe
  C:\Windows\System\yUUBvLu.exe
  2⤵
  PID:3636
- C:\Windows\System\mkYkPEi.exe
  C:\Windows\System\mkYkPEi.exe
  2⤵
  PID:3796
- C:\Windows\System\FsphMmw.exe
  C:\Windows\System\FsphMmw.exe
  2⤵
  PID:3524
- C:\Windows\System\xdhpKeN.exe
  C:\Windows\System\xdhpKeN.exe
  2⤵
  PID:3124
- C:\Windows\System\UMNLqeS.exe
  C:\Windows\System\UMNLqeS.exe
  2⤵
  PID:3944
- C:\Windows\System\OkdavVW.exe
  C:\Windows\System\OkdavVW.exe
  2⤵
  PID:4016
- C:\Windows\System\ZivojDx.exe
  C:\Windows\System\ZivojDx.exe
  2⤵
  PID:3884
- C:\Windows\System\uflVbaE.exe
  C:\Windows\System\uflVbaE.exe
  2⤵
  PID:3144
- C:\Windows\System\UWbnuuw.exe
  C:\Windows\System\UWbnuuw.exe
  2⤵
  PID:3872
- C:\Windows\System\ePHkRDf.exe
  C:\Windows\System\ePHkRDf.exe
  2⤵
  PID:4104
- C:\Windows\System\kugovBs.exe
  C:\Windows\System\kugovBs.exe
  2⤵
  PID:4132
- C:\Windows\System\IrAiCNY.exe
  C:\Windows\System\IrAiCNY.exe
  2⤵
  PID:4152
- C:\Windows\System\lhPquRq.exe
  C:\Windows\System\lhPquRq.exe
  2⤵
  PID:4168
- C:\Windows\System\bcFTIiI.exe
  C:\Windows\System\bcFTIiI.exe
  2⤵
  PID:4200
- C:\Windows\System\FaIwMgG.exe
  C:\Windows\System\FaIwMgG.exe
  2⤵
  PID:4216
- C:\Windows\System\zytPNOn.exe
  C:\Windows\System\zytPNOn.exe
  2⤵
  PID:4232
- C:\Windows\System\RardlQQ.exe
  C:\Windows\System\RardlQQ.exe
  2⤵
  PID:4248
- C:\Windows\System\etvMpUT.exe
  C:\Windows\System\etvMpUT.exe
  2⤵
  PID:4268
- C:\Windows\System\VAJTnBG.exe
  C:\Windows\System\VAJTnBG.exe
  2⤵
  PID:4288
- C:\Windows\System\qicLgKL.exe
  C:\Windows\System\qicLgKL.exe
  2⤵
  PID:4308
- C:\Windows\System\YUYSnpL.exe
  C:\Windows\System\YUYSnpL.exe
  2⤵
  PID:4324
- C:\Windows\System\VZYmTaa.exe
  C:\Windows\System\VZYmTaa.exe
  2⤵
  PID:4340
- C:\Windows\System\IiCyToB.exe
  C:\Windows\System\IiCyToB.exe
  2⤵
  PID:4368
- C:\Windows\System\eBWdoBZ.exe
  C:\Windows\System\eBWdoBZ.exe
  2⤵
  PID:4388
- C:\Windows\System\ODHCjsa.exe
  C:\Windows\System\ODHCjsa.exe
  2⤵
  PID:4408
- C:\Windows\System\sFChfZn.exe
  C:\Windows\System\sFChfZn.exe
  2⤵
  PID:4424
- C:\Windows\System\OjdEfZk.exe
  C:\Windows\System\OjdEfZk.exe
  2⤵
  PID:4444
- C:\Windows\System\laUjVaq.exe
  C:\Windows\System\laUjVaq.exe
  2⤵
  PID:4468
- C:\Windows\System\TcONrjY.exe
  C:\Windows\System\TcONrjY.exe
  2⤵
  PID:4484
- C:\Windows\System\VbsnilO.exe
  C:\Windows\System\VbsnilO.exe
  2⤵
  PID:4500
- C:\Windows\System\EoiedYe.exe
  C:\Windows\System\EoiedYe.exe
  2⤵
  PID:4516
- C:\Windows\System\ijgURXA.exe
  C:\Windows\System\ijgURXA.exe
  2⤵
  PID:4532
- C:\Windows\System\ebiwAAW.exe
  C:\Windows\System\ebiwAAW.exe
  2⤵
  PID:4548
- C:\Windows\System\CeCUfJj.exe
  C:\Windows\System\CeCUfJj.exe
  2⤵
  PID:4572
- C:\Windows\System\qzDtogm.exe
  C:\Windows\System\qzDtogm.exe
  2⤵
  PID:4596
- C:\Windows\System\uSWfOyd.exe
  C:\Windows\System\uSWfOyd.exe
  2⤵
  PID:4612
- C:\Windows\System\hRaoBeA.exe
  C:\Windows\System\hRaoBeA.exe
  2⤵
  PID:4632
- C:\Windows\System\KIoJrJO.exe
  C:\Windows\System\KIoJrJO.exe
  2⤵
  PID:4648
- C:\Windows\System\HvnlyrF.exe
  C:\Windows\System\HvnlyrF.exe
  2⤵
  PID:4668
- C:\Windows\System\JLDnlpT.exe
  C:\Windows\System\JLDnlpT.exe
  2⤵
  PID:4684
- C:\Windows\System\NOyojqN.exe
  C:\Windows\System\NOyojqN.exe
  2⤵
  PID:4704
- C:\Windows\System\PvWFIyo.exe
  C:\Windows\System\PvWFIyo.exe
  2⤵
  PID:4728
- C:\Windows\System\MbUnjlX.exe
  C:\Windows\System\MbUnjlX.exe
  2⤵
  PID:4744
- C:\Windows\System\MVvDtTi.exe
  C:\Windows\System\MVvDtTi.exe
  2⤵
  PID:4764
- C:\Windows\System\yvbhKtt.exe
  C:\Windows\System\yvbhKtt.exe
  2⤵
  PID:4780
- C:\Windows\System\ojMzIht.exe
  C:\Windows\System\ojMzIht.exe
  2⤵
  PID:4800
- C:\Windows\System\cJqEAWf.exe
  C:\Windows\System\cJqEAWf.exe
  2⤵
  PID:4824
- C:\Windows\System\KRFddqv.exe
  C:\Windows\System\KRFddqv.exe
  2⤵
  PID:4844
- C:\Windows\System\vCsZjRM.exe
  C:\Windows\System\vCsZjRM.exe
  2⤵
  PID:4860
- C:\Windows\System\LjBraDR.exe
  C:\Windows\System\LjBraDR.exe
  2⤵
  PID:4880
- C:\Windows\System\AgZbBuz.exe
  C:\Windows\System\AgZbBuz.exe
  2⤵
  PID:4896
- C:\Windows\System\SBKcOHY.exe
  C:\Windows\System\SBKcOHY.exe
  2⤵
  PID:4912
- C:\Windows\System\xHlsCRP.exe
  C:\Windows\System\xHlsCRP.exe
  2⤵
  PID:4928
- C:\Windows\System\MfLIEKG.exe
  C:\Windows\System\MfLIEKG.exe
  2⤵
  PID:4944
- C:\Windows\System\dvrQcHO.exe
  C:\Windows\System\dvrQcHO.exe
  2⤵
  PID:4960
- C:\Windows\System\uRUFzVq.exe
  C:\Windows\System\uRUFzVq.exe
  2⤵
  PID:4976
- C:\Windows\System\jNvJwTN.exe
  C:\Windows\System\jNvJwTN.exe
  2⤵
  PID:4992
- C:\Windows\System\hmjBpOE.exe
  C:\Windows\System\hmjBpOE.exe
  2⤵
  PID:5008
- C:\Windows\System\moYLXyr.exe
  C:\Windows\System\moYLXyr.exe
  2⤵
  PID:5024
- C:\Windows\System\umZfhFk.exe
  C:\Windows\System\umZfhFk.exe
  2⤵
  PID:5040
- C:\Windows\System\BKuiMRF.exe
  C:\Windows\System\BKuiMRF.exe
  2⤵
  PID:5068
- C:\Windows\System\dCOPArz.exe
  C:\Windows\System\dCOPArz.exe
  2⤵
  PID:5088
- C:\Windows\System\agSAOaM.exe
  C:\Windows\System\agSAOaM.exe
  2⤵
  PID:5108
- C:\Windows\System\bPRZGzp.exe
  C:\Windows\System\bPRZGzp.exe
  2⤵
  PID:3460
- C:\Windows\System\wukYkFH.exe
  C:\Windows\System\wukYkFH.exe
  2⤵
  PID:3432
- C:\Windows\System\uZlCibR.exe
  C:\Windows\System\uZlCibR.exe
  2⤵
  PID:4128
- C:\Windows\System\CbbUirc.exe
  C:\Windows\System\CbbUirc.exe
  2⤵
  PID:3792
- C:\Windows\System\gAYFSXD.exe
  C:\Windows\System\gAYFSXD.exe
  2⤵
  PID:4148
- C:\Windows\System\ojErViy.exe
  C:\Windows\System\ojErViy.exe
  2⤵
  PID:4196
- C:\Windows\System\FUXCeVr.exe
  C:\Windows\System\FUXCeVr.exe
  2⤵
  PID:4276
- C:\Windows\System\aEHWIrX.exe
  C:\Windows\System\aEHWIrX.exe
  2⤵
  PID:4264
- C:\Windows\System\eCtlbiI.exe
  C:\Windows\System\eCtlbiI.exe
  2⤵
  PID:4356
- C:\Windows\System\ZXBUNTo.exe
  C:\Windows\System\ZXBUNTo.exe
  2⤵
  PID:4364
- C:\Windows\System\AKXJaOn.exe
  C:\Windows\System\AKXJaOn.exe
  2⤵
  PID:4432
- C:\Windows\System\XYxsBgB.exe
  C:\Windows\System\XYxsBgB.exe
  2⤵
  PID:4300
- C:\Windows\System\uLtFDRa.exe
  C:\Windows\System\uLtFDRa.exe
  2⤵
  PID:4476
- C:\Windows\System\eyAyEeU.exe
  C:\Windows\System\eyAyEeU.exe
  2⤵
  PID:4544
- C:\Windows\System\cDoEcTY.exe
  C:\Windows\System\cDoEcTY.exe
  2⤵
  PID:4592
- C:\Windows\System\LNYuRjZ.exe
  C:\Windows\System\LNYuRjZ.exe
  2⤵
  PID:4656
- C:\Windows\System\CCdRVdB.exe
  C:\Windows\System\CCdRVdB.exe
  2⤵
  PID:4416
- C:\Windows\System\dMLlXQg.exe
  C:\Windows\System\dMLlXQg.exe
  2⤵
  PID:4808
- C:\Windows\System\HIfpYdL.exe
  C:\Windows\System\HIfpYdL.exe
  2⤵
  PID:4820
- C:\Windows\System\dHpPumq.exe
  C:\Windows\System\dHpPumq.exe
  2⤵
  PID:5016
- C:\Windows\System\dTCwyzy.exe
  C:\Windows\System\dTCwyzy.exe
  2⤵
  PID:4924
- C:\Windows\System\DsRMwXI.exe
  C:\Windows\System\DsRMwXI.exe
  2⤵
  PID:4988
- C:\Windows\System\eaTljIe.exe
  C:\Windows\System\eaTljIe.exe
  2⤵
  PID:5056
- C:\Windows\System\ZpYQySr.exe
  C:\Windows\System\ZpYQySr.exe
  2⤵
  PID:5104
- C:\Windows\System\KqxcQvL.exe
  C:\Windows\System\KqxcQvL.exe
  2⤵
  PID:3972
- C:\Windows\System\xKWOUeu.exe
  C:\Windows\System\xKWOUeu.exe
  2⤵
  PID:4208
- C:\Windows\System\JeWFUjB.exe
  C:\Windows\System\JeWFUjB.exe
  2⤵
  PID:4352
- C:\Windows\System\WgWUCGr.exe
  C:\Windows\System\WgWUCGr.exe
  2⤵
  PID:4560
- C:\Windows\System\KgXWxuM.exe
  C:\Windows\System\KgXWxuM.exe
  2⤵
  PID:4512
- C:\Windows\System\gPyPMul.exe
  C:\Windows\System\gPyPMul.exe
  2⤵
  PID:4624
- C:\Windows\System\tMQbspF.exe
  C:\Windows\System\tMQbspF.exe
  2⤵
  PID:4452
- C:\Windows\System\VkmvHAw.exe
  C:\Windows\System\VkmvHAw.exe
  2⤵
  PID:4644
- C:\Windows\System\hvCvbvf.exe
  C:\Windows\System\hvCvbvf.exe
  2⤵
  PID:4556
- C:\Windows\System\KZVNcjC.exe
  C:\Windows\System\KZVNcjC.exe
  2⤵
  PID:4756
- C:\Windows\System\OgryTir.exe
  C:\Windows\System\OgryTir.exe
  2⤵
  PID:4904
- C:\Windows\System\HoVpGQj.exe
  C:\Windows\System\HoVpGQj.exe
  2⤵
  PID:4972
- C:\Windows\System\QmhxaBo.exe
  C:\Windows\System\QmhxaBo.exe
  2⤵
  PID:5032
- C:\Windows\System\GMHfdjL.exe
  C:\Windows\System\GMHfdjL.exe
  2⤵
  PID:5116
- C:\Windows\System\MldcxTb.exe
  C:\Windows\System\MldcxTb.exe
  2⤵
  PID:4124
- C:\Windows\System\KfAEAeV.exe
  C:\Windows\System\KfAEAeV.exe
  2⤵
  PID:4192
- C:\Windows\System\IAKuiTQ.exe
  C:\Windows\System\IAKuiTQ.exe
  2⤵
  PID:4396
- C:\Windows\System\yxZhQdX.exe
  C:\Windows\System\yxZhQdX.exe
  2⤵
  PID:4336
- C:\Windows\System\fNgMbZK.exe
  C:\Windows\System\fNgMbZK.exe
  2⤵
  PID:4752
- C:\Windows\System\ItXFoXy.exe
  C:\Windows\System\ItXFoXy.exe
  2⤵
  PID:4840
- C:\Windows\System\bHpngvi.exe
  C:\Windows\System\bHpngvi.exe
  2⤵
  PID:4712
- C:\Windows\System\SFYQcwg.exe
  C:\Windows\System\SFYQcwg.exe
  2⤵
  PID:4604
- C:\Windows\System\CJkZtGG.exe
  C:\Windows\System\CJkZtGG.exe
  2⤵
  PID:4384
- C:\Windows\System\hcNFAKX.exe
  C:\Windows\System\hcNFAKX.exe
  2⤵
  PID:4856
- C:\Windows\System\zMXAbyM.exe
  C:\Windows\System\zMXAbyM.exe
  2⤵
  PID:4956
- C:\Windows\System\iJQJlGw.exe
  C:\Windows\System\iJQJlGw.exe
  2⤵
  PID:5048
- C:\Windows\System\snpohbj.exe
  C:\Windows\System\snpohbj.exe
  2⤵
  PID:764
- C:\Windows\System\zkgnEus.exe
  C:\Windows\System\zkgnEus.exe
  2⤵
  PID:3444
- C:\Windows\System\AQDLweY.exe
  C:\Windows\System\AQDLweY.exe
  2⤵
  PID:3084
- C:\Windows\System\eWAIprK.exe
  C:\Windows\System\eWAIprK.exe
  2⤵
  PID:4736
- C:\Windows\System\odgpvyD.exe
  C:\Windows\System\odgpvyD.exe
  2⤵
  PID:4724
- C:\Windows\System\XZtqNUK.exe
  C:\Windows\System\XZtqNUK.exe
  2⤵
  PID:4420
- C:\Windows\System\arPMnNA.exe
  C:\Windows\System\arPMnNA.exe
  2⤵
  PID:4792
- C:\Windows\System\sSAqPRE.exe
  C:\Windows\System\sSAqPRE.exe
  2⤵
  PID:5004
- C:\Windows\System\vCazMBh.exe
  C:\Windows\System\vCazMBh.exe
  2⤵
  PID:4404
- C:\Windows\System\YJngwhV.exe
  C:\Windows\System\YJngwhV.exe
  2⤵
  PID:4832
- C:\Windows\System\sCsnWUL.exe
  C:\Windows\System\sCsnWUL.exe
  2⤵
  PID:4640
- C:\Windows\System\xarwhqW.exe
  C:\Windows\System\xarwhqW.exe
  2⤵
  PID:660
- C:\Windows\System\JhUsjbt.exe
  C:\Windows\System\JhUsjbt.exe
  2⤵
  PID:4376
- C:\Windows\System\FMmTbom.exe
  C:\Windows\System\FMmTbom.exe
  2⤵
  PID:4872
- C:\Windows\System\rrlqCUf.exe
  C:\Windows\System\rrlqCUf.exe
  2⤵
  PID:5124
- C:\Windows\System\iIuwluI.exe
  C:\Windows\System\iIuwluI.exe
  2⤵
  PID:5140
- C:\Windows\System\lIuJXmu.exe
  C:\Windows\System\lIuJXmu.exe
  2⤵
  PID:5156
- C:\Windows\System\PtmDdtf.exe
  C:\Windows\System\PtmDdtf.exe
  2⤵
  PID:5172
- C:\Windows\System\dvJvhQe.exe
  C:\Windows\System\dvJvhQe.exe
  2⤵
  PID:5188
- C:\Windows\System\jwfgADL.exe
  C:\Windows\System\jwfgADL.exe
  2⤵
  PID:5204
- C:\Windows\System\BenEIBw.exe
  C:\Windows\System\BenEIBw.exe
  2⤵
  PID:5220
- C:\Windows\System\tKdaMhx.exe
  C:\Windows\System\tKdaMhx.exe
  2⤵
  PID:5236
- C:\Windows\System\JAoAFaC.exe
  C:\Windows\System\JAoAFaC.exe
  2⤵
  PID:5252
- C:\Windows\System\ygleQBE.exe
  C:\Windows\System\ygleQBE.exe
  2⤵
  PID:5272
- C:\Windows\System\mLUygtA.exe
  C:\Windows\System\mLUygtA.exe
  2⤵
  PID:5300
- C:\Windows\System\VViydzv.exe
  C:\Windows\System\VViydzv.exe
  2⤵
  PID:5316
- C:\Windows\System\BzkqUNb.exe
  C:\Windows\System\BzkqUNb.exe
  2⤵
  PID:5332
- C:\Windows\System\RCJVHjB.exe
  C:\Windows\System\RCJVHjB.exe
  2⤵
  PID:5348
- C:\Windows\System\enBTPjj.exe
  C:\Windows\System\enBTPjj.exe
  2⤵
  PID:5364
- C:\Windows\System\Htbbpkw.exe
  C:\Windows\System\Htbbpkw.exe
  2⤵
  PID:5384
- C:\Windows\System\YYVqFpl.exe
  C:\Windows\System\YYVqFpl.exe
  2⤵
  PID:5400
- C:\Windows\System\Owqssjw.exe
  C:\Windows\System\Owqssjw.exe
  2⤵
  PID:5420
- C:\Windows\System\bRDTwHt.exe
  C:\Windows\System\bRDTwHt.exe
  2⤵
  PID:5436
- C:\Windows\System\EIoPWkE.exe
  C:\Windows\System\EIoPWkE.exe
  2⤵
  PID:5452
- C:\Windows\System\CiqCIvK.exe
  C:\Windows\System\CiqCIvK.exe
  2⤵
  PID:5468
- C:\Windows\System\WGOvZNm.exe
  C:\Windows\System\WGOvZNm.exe
  2⤵
  PID:5484
- C:\Windows\System\NFLxGJX.exe
  C:\Windows\System\NFLxGJX.exe
  2⤵
  PID:5500
- C:\Windows\System\LKonUDh.exe
  C:\Windows\System\LKonUDh.exe
  2⤵
  PID:5516
- C:\Windows\System\SlnadJH.exe
  C:\Windows\System\SlnadJH.exe
  2⤵
  PID:5536
- C:\Windows\System\WSonEga.exe
  C:\Windows\System\WSonEga.exe
  2⤵
  PID:5552
- C:\Windows\System\kuWWCCs.exe
  C:\Windows\System\kuWWCCs.exe
  2⤵
  PID:5568
- C:\Windows\System\qcPfitY.exe
  C:\Windows\System\qcPfitY.exe
  2⤵
  PID:5588
- C:\Windows\System\oeDyDoV.exe
  C:\Windows\System\oeDyDoV.exe
  2⤵
  PID:5604
- C:\Windows\System\wQbtTNf.exe
  C:\Windows\System\wQbtTNf.exe
  2⤵
  PID:5620
- C:\Windows\System\CmuSxUF.exe
  C:\Windows\System\CmuSxUF.exe
  2⤵
  PID:5640
- C:\Windows\System\rdZNQom.exe
  C:\Windows\System\rdZNQom.exe
  2⤵
  PID:5656
- C:\Windows\System\YuxKaIs.exe
  C:\Windows\System\YuxKaIs.exe
  2⤵
  PID:5672
- C:\Windows\System\ILrAoir.exe
  C:\Windows\System\ILrAoir.exe
  2⤵
  PID:5688
- C:\Windows\System\FhIFQMh.exe
  C:\Windows\System\FhIFQMh.exe
  2⤵
  PID:5712
- C:\Windows\System\eTQExQP.exe
  C:\Windows\System\eTQExQP.exe
  2⤵
  PID:5728
- C:\Windows\System\vhldJja.exe
  C:\Windows\System\vhldJja.exe
  2⤵
  PID:5744
- C:\Windows\System\eNwFvsc.exe
  C:\Windows\System\eNwFvsc.exe
  2⤵
  PID:5764
- C:\Windows\System\HrAFbgs.exe
  C:\Windows\System\HrAFbgs.exe
  2⤵
  PID:5808
- C:\Windows\System\VIgpiXd.exe
  C:\Windows\System\VIgpiXd.exe
  2⤵
  PID:5856
- C:\Windows\System\jqedIln.exe
  C:\Windows\System\jqedIln.exe
  2⤵
  PID:5880
- C:\Windows\System\QhekoTh.exe
  C:\Windows\System\QhekoTh.exe
  2⤵
  PID:5896
- C:\Windows\System\KamGAAz.exe
  C:\Windows\System\KamGAAz.exe
  2⤵
  PID:5912
- C:\Windows\System\MByJDHA.exe
  C:\Windows\System\MByJDHA.exe
  2⤵
  PID:5928
- C:\Windows\System\Padlvih.exe
  C:\Windows\System\Padlvih.exe
  2⤵
  PID:5944
- C:\Windows\System\FCdXEQy.exe
  C:\Windows\System\FCdXEQy.exe
  2⤵
  PID:5960
- C:\Windows\System\AyaASpU.exe
  C:\Windows\System\AyaASpU.exe
  2⤵
  PID:5976
- C:\Windows\System\UAaYYhy.exe
  C:\Windows\System\UAaYYhy.exe
  2⤵
  PID:5992
- C:\Windows\System\bONTCKk.exe
  C:\Windows\System\bONTCKk.exe
  2⤵
  PID:6016
- C:\Windows\System\hlhyKSs.exe
  C:\Windows\System\hlhyKSs.exe
  2⤵
  PID:6108
- C:\Windows\System\IydpevK.exe
  C:\Windows\System\IydpevK.exe
  2⤵
  PID:4772
- C:\Windows\System\ufQPpuP.exe
  C:\Windows\System\ufQPpuP.exe
  2⤵
  PID:5164
- C:\Windows\System\ELqUqrs.exe
  C:\Windows\System\ELqUqrs.exe
  2⤵
  PID:4588
- C:\Windows\System\vskYFVL.exe
  C:\Windows\System\vskYFVL.exe
  2⤵
  PID:5180
- C:\Windows\System\RPQAmsD.exe
  C:\Windows\System\RPQAmsD.exe
  2⤵
  PID:4460
- C:\Windows\System\NfOHgIW.exe
  C:\Windows\System\NfOHgIW.exe
  2⤵
  PID:4244
- C:\Windows\System\ZjFOFOB.exe
  C:\Windows\System\ZjFOFOB.exe
  2⤵
  PID:5200
- C:\Windows\System\dYTwdGO.exe
  C:\Windows\System\dYTwdGO.exe
  2⤵
  PID:5228
- C:\Windows\System\stEltDk.exe
  C:\Windows\System\stEltDk.exe
  2⤵
  PID:5244
- C:\Windows\System\pgHEbLR.exe
  C:\Windows\System\pgHEbLR.exe
  2⤵
  PID:5264
- C:\Windows\System\PnWIqtG.exe
  C:\Windows\System\PnWIqtG.exe
  2⤵
  PID:5340
- C:\Windows\System\ZpXGwgK.exe
  C:\Windows\System\ZpXGwgK.exe
  2⤵
  PID:5376
- C:\Windows\System\LJjzSoO.exe
  C:\Windows\System\LJjzSoO.exe
  2⤵
  PID:5416
- C:\Windows\System\edvNwxd.exe
  C:\Windows\System\edvNwxd.exe
  2⤵
  PID:5432
- C:\Windows\System\ztNDXtD.exe
  C:\Windows\System\ztNDXtD.exe
  2⤵
  PID:5512
- C:\Windows\System\OLDFcux.exe
  C:\Windows\System\OLDFcux.exe
  2⤵
  PID:5576
- C:\Windows\System\sGoigyF.exe
  C:\Windows\System\sGoigyF.exe
  2⤵
  PID:5532
- C:\Windows\System\ymEqEUY.exe
  C:\Windows\System\ymEqEUY.exe
  2⤵
  PID:5632
- C:\Windows\System\PfhiEuV.exe
  C:\Windows\System\PfhiEuV.exe
  2⤵
  PID:5600
- C:\Windows\System\hRDMQBv.exe
  C:\Windows\System\hRDMQBv.exe
  2⤵
  PID:5652
- C:\Windows\System\OTdbdTi.exe
  C:\Windows\System\OTdbdTi.exe
  2⤵
  PID:5668
- C:\Windows\System\hdpozNH.exe
  C:\Windows\System\hdpozNH.exe
  2⤵
  PID:5700
- C:\Windows\System\rAPfkLP.exe
  C:\Windows\System\rAPfkLP.exe
  2⤵
  PID:5756
- C:\Windows\System\dSXBmzl.exe
  C:\Windows\System\dSXBmzl.exe
  2⤵
  PID:5780
- C:\Windows\System\qCkavZb.exe
  C:\Windows\System\qCkavZb.exe
  2⤵
  PID:5800
- C:\Windows\System\WlPlSfU.exe
  C:\Windows\System\WlPlSfU.exe
  2⤵
  PID:5832
- C:\Windows\System\JMpJQLU.exe
  C:\Windows\System\JMpJQLU.exe
  2⤵
  PID:5848
- C:\Windows\System\EELgLRQ.exe
  C:\Windows\System\EELgLRQ.exe
  2⤵
  PID:5920
- C:\Windows\System\hLgIKin.exe
  C:\Windows\System\hLgIKin.exe
  2⤵
  PID:5872
- C:\Windows\System\glHodxc.exe
  C:\Windows\System\glHodxc.exe
  2⤵
  PID:5936
- C:\Windows\System\mddCvtY.exe
  C:\Windows\System\mddCvtY.exe
  2⤵
  PID:5968
- C:\Windows\System\wcXMhII.exe
  C:\Windows\System\wcXMhII.exe
  2⤵
  PID:6000
- C:\Windows\System\ORbLVBG.exe
  C:\Windows\System\ORbLVBG.exe
  2⤵
  PID:6024
- C:\Windows\System\WlgrMfx.exe
  C:\Windows\System\WlgrMfx.exe
  2⤵
  PID:6040
- C:\Windows\System\MVcVtWS.exe
  C:\Windows\System\MVcVtWS.exe
  2⤵
  PID:6056
- C:\Windows\System\EnsRkTy.exe
  C:\Windows\System\EnsRkTy.exe
  2⤵
  PID:6072
- C:\Windows\System\MIaTINL.exe
  C:\Windows\System\MIaTINL.exe
  2⤵
  PID:6092
- C:\Windows\System\SXFcZTr.exe
  C:\Windows\System\SXFcZTr.exe
  2⤵
  PID:4224
- C:\Windows\System\AeOYLYl.exe
  C:\Windows\System\AeOYLYl.exe
  2⤵
  PID:4984
- C:\Windows\System\IyoSwQa.exe
  C:\Windows\System\IyoSwQa.exe
  2⤵
  PID:5548
- C:\Windows\System\yYPSuZm.exe
  C:\Windows\System\yYPSuZm.exe
  2⤵
  PID:5696
- C:\Windows\System\NCZlLoQ.exe
  C:\Windows\System\NCZlLoQ.exe
  2⤵
  PID:5828
- C:\Windows\System\YJlUVQT.exe
  C:\Windows\System\YJlUVQT.exe
  2⤵
  PID:5908
- C:\Windows\System\wQjHWhP.exe
  C:\Windows\System\wQjHWhP.exe
  2⤵
  PID:6068
- C:\Windows\System\sULlZVd.exe
  C:\Windows\System\sULlZVd.exe
  2⤵
  PID:5796
- C:\Windows\System\KCyOAat.exe
  C:\Windows\System\KCyOAat.exe
  2⤵
  PID:6052
- C:\Windows\System\dYHlyKn.exe
  C:\Windows\System\dYHlyKn.exe
  2⤵
  PID:6008
- C:\Windows\System\aKmkczE.exe
  C:\Windows\System\aKmkczE.exe
  2⤵
  PID:6124
- C:\Windows\System\bQJibaJ.exe
  C:\Windows\System\bQJibaJ.exe
  2⤵
  PID:4936
- C:\Windows\System\lVKDCBV.exe
  C:\Windows\System\lVKDCBV.exe
  2⤵
  PID:4720
- C:\Windows\System\oWonufd.exe
  C:\Windows\System\oWonufd.exe
  2⤵
  PID:4316
- C:\Windows\System\qEavKOW.exe
  C:\Windows\System\qEavKOW.exe
  2⤵
  PID:4876
- C:\Windows\System\yZdzcjy.exe
  C:\Windows\System\yZdzcjy.exe
  2⤵
  PID:4740
- C:\Windows\System\itZfHXd.exe
  C:\Windows\System\itZfHXd.exe
  2⤵
  PID:5232
- C:\Windows\System\AsBcwtt.exe
  C:\Windows\System\AsBcwtt.exe
  2⤵
  PID:5344
- C:\Windows\System\oxVtMYL.exe
  C:\Windows\System\oxVtMYL.exe
  2⤵
  PID:5284
- C:\Windows\System\whlQSFZ.exe
  C:\Windows\System\whlQSFZ.exe
  2⤵
  PID:5396
- C:\Windows\System\uQqSKPQ.exe
  C:\Windows\System\uQqSKPQ.exe
  2⤵
  PID:3288
- C:\Windows\System\Tpzwkft.exe
  C:\Windows\System\Tpzwkft.exe
  2⤵
  PID:5480
- C:\Windows\System\fOuqJMm.exe
  C:\Windows\System\fOuqJMm.exe
  2⤵
  PID:5704
- C:\Windows\System\oBKZqHF.exe
  C:\Windows\System\oBKZqHF.exe
  2⤵
  PID:5776
- C:\Windows\System\rYxUjrh.exe
  C:\Windows\System\rYxUjrh.exe
  2⤵
  PID:5492
- C:\Windows\System\iuYBPit.exe
  C:\Windows\System\iuYBPit.exe
  2⤵
  PID:5804
- C:\Windows\System\axFtVRU.exe
  C:\Windows\System\axFtVRU.exe
  2⤵
  PID:5892
- C:\Windows\System\aPqiAbc.exe
  C:\Windows\System\aPqiAbc.exe
  2⤵
  PID:5888
- C:\Windows\System\bJwvnDZ.exe
  C:\Windows\System\bJwvnDZ.exe
  2⤵
  PID:5792
- C:\Windows\System\wSbmyvk.exe
  C:\Windows\System\wSbmyvk.exe
  2⤵
  PID:6088
- C:\Windows\System\qovUacT.exe
  C:\Windows\System\qovUacT.exe
  2⤵
  PID:5196
- C:\Windows\System\fjVpTRv.exe
  C:\Windows\System\fjVpTRv.exe
  2⤵
  PID:4464
- C:\Windows\System\NDphbvD.exe
  C:\Windows\System\NDphbvD.exe
  2⤵
  PID:3504
- C:\Windows\System\PqMTkww.exe
  C:\Windows\System\PqMTkww.exe
  2⤵
  PID:5648
- C:\Windows\System\czMACVk.exe
  C:\Windows\System\czMACVk.exe
  2⤵
  PID:5216
- C:\Windows\System\gTrTjHZ.exe
  C:\Windows\System\gTrTjHZ.exe
  2⤵
  PID:5868
- C:\Windows\System\tuCdHXk.exe
  C:\Windows\System\tuCdHXk.exe
  2⤵
  PID:4212
- C:\Windows\System\rcdbFdy.exe
  C:\Windows\System\rcdbFdy.exe
  2⤵
  PID:2012
- C:\Windows\System\AabkAOP.exe
  C:\Windows\System\AabkAOP.exe
  2⤵
  PID:5824
- C:\Windows\System\qKtwrVE.exe
  C:\Windows\System\qKtwrVE.exe
  2⤵
  PID:6132
- C:\Windows\System\ozjIEMP.exe
  C:\Windows\System\ozjIEMP.exe
  2⤵
  PID:4852
- C:\Windows\System\qfuPKvt.exe
  C:\Windows\System\qfuPKvt.exe
  2⤵
  PID:5372
- C:\Windows\System\rGVFjVO.exe
  C:\Windows\System\rGVFjVO.exe
  2⤵
  PID:5356
- C:\Windows\System\prtwDzK.exe
  C:\Windows\System\prtwDzK.exe
  2⤵
  PID:5820
- C:\Windows\System\gRzFyvX.exe
  C:\Windows\System\gRzFyvX.exe
  2⤵
  PID:5152
- C:\Windows\System\mcOiJsw.exe
  C:\Windows\System\mcOiJsw.exe
  2⤵
  PID:6100
- C:\Windows\System\iMOMxrZ.exe
  C:\Windows\System\iMOMxrZ.exe
  2⤵
  PID:5288
- C:\Windows\System\UKJYWkf.exe
  C:\Windows\System\UKJYWkf.exe
  2⤵
  PID:5940
- C:\Windows\System\eMLHxNl.exe
  C:\Windows\System\eMLHxNl.exe
  2⤵
  PID:4496
- C:\Windows\System\XiPNkRN.exe
  C:\Windows\System\XiPNkRN.exe
  2⤵
  PID:5508
- C:\Windows\System\ZBIeKHl.exe
  C:\Windows\System\ZBIeKHl.exe
  2⤵
  PID:6164
- C:\Windows\System\SVJtjmZ.exe
  C:\Windows\System\SVJtjmZ.exe
  2⤵
  PID:6184
- C:\Windows\System\ubdLQUP.exe
  C:\Windows\System\ubdLQUP.exe
  2⤵
  PID:6208
- C:\Windows\System\OhMprDu.exe
  C:\Windows\System\OhMprDu.exe
  2⤵
  PID:6224
- C:\Windows\System\iFkiMYR.exe
  C:\Windows\System\iFkiMYR.exe
  2⤵
  PID:6240
- C:\Windows\System\lctSfHr.exe
  C:\Windows\System\lctSfHr.exe
  2⤵
  PID:6256
- C:\Windows\System\KxVAHEL.exe
  C:\Windows\System\KxVAHEL.exe
  2⤵
  PID:6284
- C:\Windows\System\KhujGmU.exe
  C:\Windows\System\KhujGmU.exe
  2⤵
  PID:6312
- C:\Windows\System\PkCyIRs.exe
  C:\Windows\System\PkCyIRs.exe
  2⤵
  PID:6328
- C:\Windows\System\gvcoTcc.exe
  C:\Windows\System\gvcoTcc.exe
  2⤵
  PID:6348
- C:\Windows\System\fMTWiWH.exe
  C:\Windows\System\fMTWiWH.exe
  2⤵
  PID:6368
- C:\Windows\System\kdImpXR.exe
  C:\Windows\System\kdImpXR.exe
  2⤵
  PID:6384
- C:\Windows\System\ZjeCrDl.exe
  C:\Windows\System\ZjeCrDl.exe
  2⤵
  PID:6408
- C:\Windows\System\lvuKlns.exe
  C:\Windows\System\lvuKlns.exe
  2⤵
  PID:6428
- C:\Windows\System\moJDxVJ.exe
  C:\Windows\System\moJDxVJ.exe
  2⤵
  PID:6444
- C:\Windows\System\yPctKYN.exe
  C:\Windows\System\yPctKYN.exe
  2⤵
  PID:6460
- C:\Windows\System\YjyPmTz.exe
  C:\Windows\System\YjyPmTz.exe
  2⤵
  PID:6484
- C:\Windows\System\QJcFuRr.exe
  C:\Windows\System\QJcFuRr.exe
  2⤵
  PID:6508
- C:\Windows\System\rXeDRYJ.exe
  C:\Windows\System\rXeDRYJ.exe
  2⤵
  PID:6528
- C:\Windows\System\xleIeAs.exe
  C:\Windows\System\xleIeAs.exe
  2⤵
  PID:6544
- C:\Windows\System\ObvcnWK.exe
  C:\Windows\System\ObvcnWK.exe
  2⤵
  PID:6568
- C:\Windows\System\kveLQRI.exe
  C:\Windows\System\kveLQRI.exe
  2⤵
  PID:6588
- C:\Windows\System\ugwvnWH.exe
  C:\Windows\System\ugwvnWH.exe
  2⤵
  PID:6604
- C:\Windows\System\hJZDvUk.exe
  C:\Windows\System\hJZDvUk.exe
  2⤵
  PID:6620
- C:\Windows\System\SiTyCbK.exe
  C:\Windows\System\SiTyCbK.exe
  2⤵
  PID:6636
- C:\Windows\System\EirUOlz.exe
  C:\Windows\System\EirUOlz.exe
  2⤵
  PID:6656
- C:\Windows\System\nKBFciB.exe
  C:\Windows\System\nKBFciB.exe
  2⤵
  PID:6684
- C:\Windows\System\xjMbXio.exe
  C:\Windows\System\xjMbXio.exe
  2⤵
  PID:6712
- C:\Windows\System\JzsxSkT.exe
  C:\Windows\System\JzsxSkT.exe
  2⤵
  PID:6732
- C:\Windows\System\nHUDrFv.exe
  C:\Windows\System\nHUDrFv.exe
  2⤵
  PID:6752
- C:\Windows\System\vyEQPqK.exe
  C:\Windows\System\vyEQPqK.exe
  2⤵
  PID:6768
- C:\Windows\System\tXNeItM.exe
  C:\Windows\System\tXNeItM.exe
  2⤵
  PID:6784
- C:\Windows\System\YabHuna.exe
  C:\Windows\System\YabHuna.exe
  2⤵
  PID:6816
- C:\Windows\System\RuQmsGG.exe
  C:\Windows\System\RuQmsGG.exe
  2⤵
  PID:6832
- C:\Windows\System\IexmrYi.exe
  C:\Windows\System\IexmrYi.exe
  2⤵
  PID:6856
- C:\Windows\System\ZFfhIPh.exe
  C:\Windows\System\ZFfhIPh.exe
  2⤵
  PID:6876
- C:\Windows\System\ItMgOZo.exe
  C:\Windows\System\ItMgOZo.exe
  2⤵
  PID:6892
- C:\Windows\System\tAtshkP.exe
  C:\Windows\System\tAtshkP.exe
  2⤵
  PID:6912
- C:\Windows\System\bZjONLV.exe
  C:\Windows\System\bZjONLV.exe
  2⤵
  PID:6932
- C:\Windows\System\QZGTIgx.exe
  C:\Windows\System\QZGTIgx.exe
  2⤵
  PID:6956
- C:\Windows\System\kazqsbU.exe
  C:\Windows\System\kazqsbU.exe
  2⤵
  PID:6972
- C:\Windows\System\cOWuGBf.exe
  C:\Windows\System\cOWuGBf.exe
  2⤵
  PID:6988
- C:\Windows\System\oZfmGpg.exe
  C:\Windows\System\oZfmGpg.exe
  2⤵
  PID:7008
- C:\Windows\System\eGiSmyL.exe
  C:\Windows\System\eGiSmyL.exe
  2⤵
  PID:7028
- C:\Windows\System\QbHPwcY.exe
  C:\Windows\System\QbHPwcY.exe
  2⤵
  PID:7048
- C:\Windows\System\KeBzIpg.exe
  C:\Windows\System\KeBzIpg.exe
  2⤵
  PID:7064
- C:\Windows\System\aruUEcT.exe
  C:\Windows\System\aruUEcT.exe
  2⤵
  PID:7084
- C:\Windows\System\JcfZLWO.exe
  C:\Windows\System\JcfZLWO.exe
  2⤵
  PID:7100
- C:\Windows\System\ACPJmwb.exe
  C:\Windows\System\ACPJmwb.exe
  2⤵
  PID:7120
- C:\Windows\System\XjVlSfs.exe
  C:\Windows\System\XjVlSfs.exe
  2⤵
  PID:7140
- C:\Windows\System\lOFIfrc.exe
  C:\Windows\System\lOFIfrc.exe
  2⤵
  PID:7156
- C:\Windows\System\UyfvvEu.exe
  C:\Windows\System\UyfvvEu.exe
  2⤵
  PID:5148
- C:\Windows\System\aaMdWtT.exe
  C:\Windows\System\aaMdWtT.exe
  2⤵
  PID:5324
- C:\Windows\System\erlCYwS.exe
  C:\Windows\System\erlCYwS.exe
  2⤵
  PID:6200
- C:\Windows\System\aRZsPKW.exe
  C:\Windows\System\aRZsPKW.exe
  2⤵
  PID:6176
- C:\Windows\System\cmCbuxm.exe
  C:\Windows\System\cmCbuxm.exe
  2⤵
  PID:6276
- C:\Windows\System\WydilKr.exe
  C:\Windows\System\WydilKr.exe
  2⤵
  PID:6220
- C:\Windows\System\qKSNrdt.exe
  C:\Windows\System\qKSNrdt.exe
  2⤵
  PID:6300
- C:\Windows\System\KvmDwLk.exe
  C:\Windows\System\KvmDwLk.exe
  2⤵
  PID:6324
- C:\Windows\System\ORqJZcP.exe
  C:\Windows\System\ORqJZcP.exe
  2⤵
  PID:6356
- C:\Windows\System\qdKvQaF.exe
  C:\Windows\System\qdKvQaF.exe
  2⤵
  PID:6344
- C:\Windows\System\cBXzFHZ.exe
  C:\Windows\System\cBXzFHZ.exe
  2⤵
  PID:6472
- C:\Windows\System\MgMMzDP.exe
  C:\Windows\System\MgMMzDP.exe
  2⤵
  PID:6520
- C:\Windows\System\UPPTlnK.exe
  C:\Windows\System\UPPTlnK.exe
  2⤵
  PID:6564
- C:\Windows\System\OEStOCS.exe
  C:\Windows\System\OEStOCS.exe
  2⤵
  PID:6416
- C:\Windows\System\RpRNxnx.exe
  C:\Windows\System\RpRNxnx.exe
  2⤵
  PID:6452
- C:\Windows\System\dsutvpw.exe
  C:\Windows\System\dsutvpw.exe
  2⤵
  PID:6668
- C:\Windows\System\FTtjxHU.exe
  C:\Windows\System\FTtjxHU.exe
  2⤵
  PID:6540
- C:\Windows\System\jxtwDjk.exe
  C:\Windows\System\jxtwDjk.exe
  2⤵
  PID:6616
- C:\Windows\System\vtglcDn.exe
  C:\Windows\System\vtglcDn.exe
  2⤵
  PID:6728
- C:\Windows\System\NjORNlj.exe
  C:\Windows\System\NjORNlj.exe
  2⤵
  PID:6704
- C:\Windows\System\CDCOOMj.exe
  C:\Windows\System\CDCOOMj.exe
  2⤵
  PID:6652
- C:\Windows\System\kBPVzHI.exe
  C:\Windows\System\kBPVzHI.exe
  2⤵
  PID:6744
- C:\Windows\System\usMkikd.exe
  C:\Windows\System\usMkikd.exe
  2⤵
  PID:6840
- C:\Windows\System\jBzViug.exe
  C:\Windows\System\jBzViug.exe
  2⤵
  PID:6864
- C:\Windows\System\whShZLS.exe
  C:\Windows\System\whShZLS.exe
  2⤵
  PID:6920
- C:\Windows\System\tJbTsvp.exe
  C:\Windows\System\tJbTsvp.exe
  2⤵
  PID:6924
- C:\Windows\System\PcRDZwU.exe
  C:\Windows\System\PcRDZwU.exe
  2⤵
  PID:6964
- C:\Windows\System\IyvkcZk.exe
  C:\Windows\System\IyvkcZk.exe
  2⤵
  PID:7004
- C:\Windows\System\vmbaDdv.exe
  C:\Windows\System\vmbaDdv.exe
  2⤵
  PID:7072
- C:\Windows\System\gsyRAgv.exe
  C:\Windows\System\gsyRAgv.exe
  2⤵
  PID:6980
- C:\Windows\System\ARABQBB.exe
  C:\Windows\System\ARABQBB.exe
  2⤵
  PID:6152
- C:\Windows\System\ATMttMd.exe
  C:\Windows\System\ATMttMd.exe
  2⤵
  PID:5972
- C:\Windows\System\mdVNtdm.exe
  C:\Windows\System\mdVNtdm.exe
  2⤵
  PID:6236
- C:\Windows\System\QUURNjO.exe
  C:\Windows\System\QUURNjO.exe
  2⤵
  PID:7096
- C:\Windows\System\NTiuDvc.exe
  C:\Windows\System\NTiuDvc.exe
  2⤵
  PID:5412
- C:\Windows\System\ciWTeCS.exe
  C:\Windows\System\ciWTeCS.exe
  2⤵
  PID:6196
- C:\Windows\System\JfcAdTb.exe
  C:\Windows\System\JfcAdTb.exe
  2⤵
  PID:6292
- C:\Windows\System\finWrFH.exe
  C:\Windows\System\finWrFH.exe
  2⤵
  PID:5684
- C:\Windows\System\UDARXRn.exe
  C:\Windows\System\UDARXRn.exe
  2⤵
  PID:6396
- C:\Windows\System\YtALOQn.exe
  C:\Windows\System\YtALOQn.exe
  2⤵
  PID:6440
- C:\Windows\System\kYfoPXD.exe
  C:\Windows\System\kYfoPXD.exe
  2⤵
  PID:6496
- C:\Windows\System\PkNeLDi.exe
  C:\Windows\System\PkNeLDi.exe
  2⤵
  PID:6456
- C:\Windows\System\ZjuIKRJ.exe
  C:\Windows\System\ZjuIKRJ.exe
  2⤵
  PID:6560
- C:\Windows\System\GhOhyDu.exe
  C:\Windows\System\GhOhyDu.exe
  2⤵
  PID:6500
- C:\Windows\System\kehUeZu.exe
  C:\Windows\System\kehUeZu.exe
  2⤵
  PID:6776
- C:\Windows\System\msuCXNc.exe
  C:\Windows\System\msuCXNc.exe
  2⤵
  PID:6796
- C:\Windows\System\Syafwft.exe
  C:\Windows\System\Syafwft.exe
  2⤵
  PID:6720
- C:\Windows\System\citpEau.exe
  C:\Windows\System\citpEau.exe
  2⤵
  PID:6900
- C:\Windows\System\IhugQak.exe
  C:\Windows\System\IhugQak.exe
  2⤵
  PID:7108
- C:\Windows\System\BGhWpSw.exe
  C:\Windows\System\BGhWpSw.exe
  2⤵
  PID:6884
- C:\Windows\System\zMpljfJ.exe
  C:\Windows\System\zMpljfJ.exe
  2⤵
  PID:7060
- C:\Windows\System\RrymGuJ.exe
  C:\Windows\System\RrymGuJ.exe
  2⤵
  PID:6272
- C:\Windows\System\tfVtTqf.exe
  C:\Windows\System\tfVtTqf.exe
  2⤵
  PID:6948
- C:\Windows\System\bHbUzHo.exe
  C:\Windows\System\bHbUzHo.exe
  2⤵
  PID:6436
- C:\Windows\System\lhbGeSF.exe
  C:\Windows\System\lhbGeSF.exe
  2⤵
  PID:6632
- C:\Windows\System\MwrlWDa.exe
  C:\Windows\System\MwrlWDa.exe
  2⤵
  PID:7024
- C:\Windows\System\FDQstPE.exe
  C:\Windows\System\FDQstPE.exe
  2⤵
  PID:6612
- C:\Windows\System\uNbOggM.exe
  C:\Windows\System\uNbOggM.exe
  2⤵
  PID:7076
- C:\Windows\System\mnDfcTF.exe
  C:\Windows\System\mnDfcTF.exe
  2⤵
  PID:6516
- C:\Windows\System\AjxhNMM.exe
  C:\Windows\System\AjxhNMM.exe
  2⤵
  PID:6764
- C:\Windows\System\FcWJEBF.exe
  C:\Windows\System\FcWJEBF.exe
  2⤵
  PID:6852
- C:\Windows\System\JyotZoV.exe
  C:\Windows\System\JyotZoV.exe
  2⤵
  PID:6808
- C:\Windows\System\xqsOjsh.exe
  C:\Windows\System\xqsOjsh.exe
  2⤵
  PID:6160
- C:\Windows\System\TVVkhnX.exe
  C:\Windows\System\TVVkhnX.exe
  2⤵
  PID:6676
- C:\Windows\System\PpfFlZG.exe
  C:\Windows\System\PpfFlZG.exe
  2⤵
  PID:7164
- C:\Windows\System\wJsqotI.exe
  C:\Windows\System\wJsqotI.exe
  2⤵
  PID:5448
- C:\Windows\System\PZbOcys.exe
  C:\Windows\System\PZbOcys.exe
  2⤵
  PID:6648
- C:\Windows\System\OUBexCY.exe
  C:\Windows\System\OUBexCY.exe
  2⤵
  PID:7016
- C:\Windows\System\lojnDUA.exe
  C:\Windows\System\lojnDUA.exe
  2⤵
  PID:6944
- C:\Windows\System\pOEYiSN.exe
  C:\Windows\System\pOEYiSN.exe
  2⤵
  PID:6600
- C:\Windows\System\KsUuNfy.exe
  C:\Windows\System\KsUuNfy.exe
  2⤵
  PID:6216
- C:\Windows\System\qsptXrz.exe
  C:\Windows\System\qsptXrz.exe
  2⤵
  PID:6780
- C:\Windows\System\jLUFlbC.exe
  C:\Windows\System\jLUFlbC.exe
  2⤵
  PID:6828
- C:\Windows\System\yqCucFL.exe
  C:\Windows\System\yqCucFL.exe
  2⤵
  PID:6308
- C:\Windows\System\sxIbYZT.exe
  C:\Windows\System\sxIbYZT.exe
  2⤵
  PID:6644
- C:\Windows\System\YRGjMwC.exe
  C:\Windows\System\YRGjMwC.exe
  2⤵
  PID:7148
- C:\Windows\System\LHjZrqJ.exe
  C:\Windows\System\LHjZrqJ.exe
  2⤵
  PID:6468
- C:\Windows\System\AAzCJLi.exe
  C:\Windows\System\AAzCJLi.exe
  2⤵
  PID:7172
- C:\Windows\System\HpecvBy.exe
  C:\Windows\System\HpecvBy.exe
  2⤵
  PID:7192
- C:\Windows\System\XUwSzPv.exe
  C:\Windows\System\XUwSzPv.exe
  2⤵
  PID:7208
- C:\Windows\System\wepKasS.exe
  C:\Windows\System\wepKasS.exe
  2⤵
  PID:7228
- C:\Windows\System\HrTGerB.exe
  C:\Windows\System\HrTGerB.exe
  2⤵
  PID:7244
- C:\Windows\System\pHGujxH.exe
  C:\Windows\System\pHGujxH.exe
  2⤵
  PID:7288
- C:\Windows\System\xJkfCWX.exe
  C:\Windows\System\xJkfCWX.exe
  2⤵
  PID:7304
- C:\Windows\System\RYfObmI.exe
  C:\Windows\System\RYfObmI.exe
  2⤵
  PID:7320
- C:\Windows\System\VfqWIpo.exe
  C:\Windows\System\VfqWIpo.exe
  2⤵
  PID:7340
- C:\Windows\System\voxEjwc.exe
  C:\Windows\System\voxEjwc.exe
  2⤵
  PID:7364
- C:\Windows\System\XFzQKTe.exe
  C:\Windows\System\XFzQKTe.exe
  2⤵
  PID:7380
- C:\Windows\System\SSnNPlG.exe
  C:\Windows\System\SSnNPlG.exe
  2⤵
  PID:7396
- C:\Windows\System\UixUCDE.exe
  C:\Windows\System\UixUCDE.exe
  2⤵
  PID:7412
- C:\Windows\System\CcOCAAd.exe
  C:\Windows\System\CcOCAAd.exe
  2⤵
  PID:7432
- C:\Windows\System\apXKLRu.exe
  C:\Windows\System\apXKLRu.exe
  2⤵
  PID:7448
- C:\Windows\System\XLeXEar.exe
  C:\Windows\System\XLeXEar.exe
  2⤵
  PID:7468
- C:\Windows\System\pCAZNkE.exe
  C:\Windows\System\pCAZNkE.exe
  2⤵
  PID:7484
- C:\Windows\System\InJQXul.exe
  C:\Windows\System\InJQXul.exe
  2⤵
  PID:7500
- C:\Windows\System\opqmtdT.exe
  C:\Windows\System\opqmtdT.exe
  2⤵
  PID:7520
- C:\Windows\System\dyWooyg.exe
  C:\Windows\System\dyWooyg.exe
  2⤵
  PID:7540
- C:\Windows\System\dwcmvNF.exe
  C:\Windows\System\dwcmvNF.exe
  2⤵
  PID:7560
- C:\Windows\System\izVrAJQ.exe
  C:\Windows\System\izVrAJQ.exe
  2⤵
  PID:7580
- C:\Windows\System\WRZQfkp.exe
  C:\Windows\System\WRZQfkp.exe
  2⤵
  PID:7600
- C:\Windows\System\LFHyheg.exe
  C:\Windows\System\LFHyheg.exe
  2⤵
  PID:7616
- C:\Windows\System\sDhPACA.exe
  C:\Windows\System\sDhPACA.exe
  2⤵
  PID:7632
- C:\Windows\System\oCOlxFa.exe
  C:\Windows\System\oCOlxFa.exe
  2⤵
  PID:7692
- C:\Windows\System\kXzYKLj.exe
  C:\Windows\System\kXzYKLj.exe
  2⤵
  PID:7712
- C:\Windows\System\gKAHuvr.exe
  C:\Windows\System\gKAHuvr.exe
  2⤵
  PID:7728
- C:\Windows\System\cLDrNDY.exe
  C:\Windows\System\cLDrNDY.exe
  2⤵
  PID:7748
- C:\Windows\System\pLpIMFX.exe
  C:\Windows\System\pLpIMFX.exe
  2⤵
  PID:7768
- C:\Windows\System\SgOFoPj.exe
  C:\Windows\System\SgOFoPj.exe
  2⤵
  PID:7784
- C:\Windows\System\fLlahmq.exe
  C:\Windows\System\fLlahmq.exe
  2⤵
  PID:7800
- C:\Windows\System\taokAab.exe
  C:\Windows\System\taokAab.exe
  2⤵
  PID:7820
- C:\Windows\System\FVlUhZK.exe
  C:\Windows\System\FVlUhZK.exe
  2⤵
  PID:7836
- C:\Windows\System\cNZwjQk.exe
  C:\Windows\System\cNZwjQk.exe
  2⤵
  PID:7852
- C:\Windows\System\FiCAbjw.exe
  C:\Windows\System\FiCAbjw.exe
  2⤵
  PID:7868
- C:\Windows\System\RtXTuEW.exe
  C:\Windows\System\RtXTuEW.exe
  2⤵
  PID:7888
- C:\Windows\System\OEHbcFb.exe
  C:\Windows\System\OEHbcFb.exe
  2⤵
  PID:7912
- C:\Windows\System\MlcsjcF.exe
  C:\Windows\System\MlcsjcF.exe
  2⤵
  PID:7932
- C:\Windows\System\FTMiiEH.exe
  C:\Windows\System\FTMiiEH.exe
  2⤵
  PID:7960
- C:\Windows\System\PNmXolV.exe
  C:\Windows\System\PNmXolV.exe
  2⤵
  PID:7980
- C:\Windows\System\GmfVbdV.exe
  C:\Windows\System\GmfVbdV.exe
  2⤵
  PID:8004
- C:\Windows\System\bVDTXyq.exe
  C:\Windows\System\bVDTXyq.exe
  2⤵
  PID:8020
- C:\Windows\System\BQfvbGY.exe
  C:\Windows\System\BQfvbGY.exe
  2⤵
  PID:8036
- C:\Windows\System\LJvZAdZ.exe
  C:\Windows\System\LJvZAdZ.exe
  2⤵
  PID:8052
- C:\Windows\System\gojQfQe.exe
  C:\Windows\System\gojQfQe.exe
  2⤵
  PID:8076
- C:\Windows\System\nQCQpDs.exe
  C:\Windows\System\nQCQpDs.exe
  2⤵
  PID:8096
- C:\Windows\System\JnZCysa.exe
  C:\Windows\System\JnZCysa.exe
  2⤵
  PID:8112
- C:\Windows\System\HaLhPnU.exe
  C:\Windows\System\HaLhPnU.exe
  2⤵
  PID:8132
- C:\Windows\System\OffqExZ.exe
  C:\Windows\System\OffqExZ.exe
  2⤵
  PID:8152
- C:\Windows\System\pHRrBwc.exe
  C:\Windows\System\pHRrBwc.exe
  2⤵
  PID:8168
- C:\Windows\System\GIlpRJq.exe
  C:\Windows\System\GIlpRJq.exe
  2⤵
  PID:8184
- C:\Windows\System\wqlyPFA.exe
  C:\Windows\System\wqlyPFA.exe
  2⤵
  PID:7236
- C:\Windows\System\SIzzzfe.exe
  C:\Windows\System\SIzzzfe.exe
  2⤵
  PID:6340
- C:\Windows\System\zjUyOST.exe
  C:\Windows\System\zjUyOST.exe
  2⤵
  PID:7216
- C:\Windows\System\VlEmAAU.exe
  C:\Windows\System\VlEmAAU.exe
  2⤵
  PID:6492
- C:\Windows\System\dExEyUC.exe
  C:\Windows\System\dExEyUC.exe
  2⤵
  PID:7268
- C:\Windows\System\FxeiPVy.exe
  C:\Windows\System\FxeiPVy.exe
  2⤵
  PID:7276
- C:\Windows\System\KDwKEUc.exe
  C:\Windows\System\KDwKEUc.exe
  2⤵
  PID:7372
- C:\Windows\System\eucmEol.exe
  C:\Windows\System\eucmEol.exe
  2⤵
  PID:7444
- C:\Windows\System\AYmEtdA.exe
  C:\Windows\System\AYmEtdA.exe
  2⤵
  PID:7516
- C:\Windows\System\GputRlt.exe
  C:\Windows\System\GputRlt.exe
  2⤵
  PID:7388
- C:\Windows\System\cmvvXzQ.exe
  C:\Windows\System\cmvvXzQ.exe
  2⤵
  PID:7428
- C:\Windows\System\hWzWLKO.exe
  C:\Windows\System\hWzWLKO.exe
  2⤵
  PID:7496
- C:\Windows\System\gNOoYHn.exe
  C:\Windows\System\gNOoYHn.exe
  2⤵
  PID:7572
- C:\Windows\System\sXLOLkG.exe
  C:\Windows\System\sXLOLkG.exe
  2⤵
  PID:7624
- C:\Windows\System\EqeDFJR.exe
  C:\Windows\System\EqeDFJR.exe
  2⤵
  PID:7652
- C:\Windows\System\VJiHSBs.exe
  C:\Windows\System\VJiHSBs.exe
  2⤵
  PID:7700
- C:\Windows\System\SwhbDro.exe
  C:\Windows\System\SwhbDro.exe
  2⤵
  PID:7664
- C:\Windows\System\xKhZyeX.exe
  C:\Windows\System\xKhZyeX.exe
  2⤵
  PID:7704
- C:\Windows\System\evxbxhX.exe
  C:\Windows\System\evxbxhX.exe
  2⤵
  PID:7740
- C:\Windows\System\DQERxtr.exe
  C:\Windows\System\DQERxtr.exe
  2⤵
  PID:7776
- C:\Windows\System\gFzsxtd.exe
  C:\Windows\System\gFzsxtd.exe
  2⤵
  PID:7284
- C:\Windows\System\uqOnAFh.exe
  C:\Windows\System\uqOnAFh.exe
  2⤵
  PID:7884
- C:\Windows\System\tgjGAcv.exe
  C:\Windows\System\tgjGAcv.exe
  2⤵
  PID:7764
- C:\Windows\System\QstPgqa.exe
  C:\Windows\System\QstPgqa.exe
  2⤵
  PID:7972
- C:\Windows\System\ySfltNx.exe
  C:\Windows\System\ySfltNx.exe
  2⤵
  PID:8044
- C:\Windows\System\uqdWfCu.exe
  C:\Windows\System\uqdWfCu.exe
  2⤵
  PID:8084
- C:\Windows\System\CkahsTl.exe
  C:\Windows\System\CkahsTl.exe
  2⤵
  PID:8124
- C:\Windows\System\qXBTrzK.exe
  C:\Windows\System\qXBTrzK.exe
  2⤵
  PID:7000
- C:\Windows\System\AFNGJLt.exe
  C:\Windows\System\AFNGJLt.exe
  2⤵
  PID:6700
- C:\Windows\System\bIiqfog.exe
  C:\Windows\System\bIiqfog.exe
  2⤵
  PID:8060
- C:\Windows\System\TCrfHub.exe
  C:\Windows\System\TCrfHub.exe
  2⤵
  PID:7988
- C:\Windows\System\pvVQPtC.exe
  C:\Windows\System\pvVQPtC.exe
  2⤵
  PID:8148
- C:\Windows\System\RbNWbku.exe
  C:\Windows\System\RbNWbku.exe
  2⤵
  PID:7328
- C:\Windows\System\dsGNdAB.exe
  C:\Windows\System\dsGNdAB.exe
  2⤵
  PID:7316
- C:\Windows\System\qlKmYUs.exe
  C:\Windows\System\qlKmYUs.exe
  2⤵
  PID:7508
- C:\Windows\System\FBRnJeM.exe
  C:\Windows\System\FBRnJeM.exe
  2⤵
  PID:7240
- C:\Windows\System\Dtdqfyy.exe
  C:\Windows\System\Dtdqfyy.exe
  2⤵
  PID:7260
- C:\Windows\System\eIYZbSG.exe
  C:\Windows\System\eIYZbSG.exe
  2⤵
  PID:7408
- C:\Windows\System\sLylfzC.exe
  C:\Windows\System\sLylfzC.exe
  2⤵
  PID:7392
- C:\Windows\System\hlDfVqi.exe
  C:\Windows\System\hlDfVqi.exe
  2⤵
  PID:7360
- C:\Windows\System\EhpjRLv.exe
  C:\Windows\System\EhpjRLv.exe
  2⤵
  PID:7644
- C:\Windows\System\dHHUSLV.exe
  C:\Windows\System\dHHUSLV.exe
  2⤵
  PID:7720
- C:\Windows\System\jvTGRmf.exe
  C:\Windows\System\jvTGRmf.exe
  2⤵
  PID:7808
- C:\Windows\System\tLlDRkA.exe
  C:\Windows\System\tLlDRkA.exe
  2⤵
  PID:7684
- C:\Windows\System\lhsDENK.exe
  C:\Windows\System\lhsDENK.exe
  2⤵
  PID:7900
- C:\Windows\System\AHcIIIl.exe
  C:\Windows\System\AHcIIIl.exe
  2⤵
  PID:7796
- C:\Windows\System\fDsfbeV.exe
  C:\Windows\System\fDsfbeV.exe
  2⤵
  PID:8016
- C:\Windows\System\SQVSpvM.exe
  C:\Windows\System\SQVSpvM.exe
  2⤵
  PID:7200
- C:\Windows\System\zLdYXnr.exe
  C:\Windows\System\zLdYXnr.exe
  2⤵
  PID:6680
- C:\Windows\System\aJkCdtJ.exe
  C:\Windows\System\aJkCdtJ.exe
  2⤵
  PID:7952
- C:\Windows\System\AgYbeUd.exe
  C:\Windows\System\AgYbeUd.exe
  2⤵
  PID:7256
- C:\Windows\System\FqvjfrF.exe
  C:\Windows\System\FqvjfrF.exe
  2⤵
  PID:7992
- C:\Windows\System\IkSdcrd.exe
  C:\Windows\System\IkSdcrd.exe
  2⤵
  PID:8028
- C:\Windows\System\xFkMJwz.exe
  C:\Windows\System\xFkMJwz.exe
  2⤵
  PID:7548
- C:\Windows\System\BBrRZJT.exe
  C:\Windows\System\BBrRZJT.exe
  2⤵
  PID:7356
- C:\Windows\System\WCZwIVk.exe
  C:\Windows\System\WCZwIVk.exe
  2⤵
  PID:7532
- C:\Windows\System\nwXLaih.exe
  C:\Windows\System\nwXLaih.exe
  2⤵
  PID:7592
- C:\Windows\System\vKFUdXf.exe
  C:\Windows\System\vKFUdXf.exe
  2⤵
  PID:7736
- C:\Windows\System\LSiREkd.exe
  C:\Windows\System\LSiREkd.exe
  2⤵
  PID:7812
- C:\Windows\System\LgUuioO.exe
  C:\Windows\System\LgUuioO.exe
  2⤵
  PID:7956
- C:\Windows\System\qvNclpb.exe
  C:\Windows\System\qvNclpb.exe
  2⤵
  PID:7904
- C:\Windows\System\jnmnzzy.exe
  C:\Windows\System\jnmnzzy.exe
  2⤵
  PID:7948
- C:\Windows\System\iftKJOz.exe
  C:\Windows\System\iftKJOz.exe
  2⤵
  PID:8160
- C:\Windows\System\LYlSVbm.exe
  C:\Windows\System\LYlSVbm.exe
  2⤵
  PID:7464
- C:\Windows\System\QeiuQqS.exe
  C:\Windows\System\QeiuQqS.exe
  2⤵
  PID:7596
- C:\Windows\System\VDJrJGo.exe
  C:\Windows\System\VDJrJGo.exe
  2⤵
  PID:7296
- C:\Windows\System\drkEGTW.exe
  C:\Windows\System\drkEGTW.exe
  2⤵
  PID:7440
- C:\Windows\System\ApkNIMz.exe
  C:\Windows\System\ApkNIMz.exe
  2⤵
  PID:7792
- C:\Windows\System\TaUqhRU.exe
  C:\Windows\System\TaUqhRU.exe
  2⤵
  PID:7480
- C:\Windows\System\XEzqCZf.exe
  C:\Windows\System\XEzqCZf.exe
  2⤵
  PID:8180
- C:\Windows\System\VYbLtqw.exe
  C:\Windows\System\VYbLtqw.exe
  2⤵
  PID:8120
- C:\Windows\System\BRGihgl.exe
  C:\Windows\System\BRGihgl.exe
  2⤵
  PID:7760
- C:\Windows\System\aiSvGmO.exe
  C:\Windows\System\aiSvGmO.exe
  2⤵
  PID:7336
- C:\Windows\System\dKbhSQr.exe
  C:\Windows\System\dKbhSQr.exe
  2⤵
  PID:7460
- C:\Windows\System\yQiVWJD.exe
  C:\Windows\System\yQiVWJD.exe
  2⤵
  PID:7648
- C:\Windows\System\PzHbvqV.exe
  C:\Windows\System\PzHbvqV.exe
  2⤵
  PID:7844
- C:\Windows\System\IabAJFE.exe
  C:\Windows\System\IabAJFE.exe
  2⤵
  PID:7348
- C:\Windows\System\gQcdknE.exe
  C:\Windows\System\gQcdknE.exe
  2⤵
  PID:8000
- C:\Windows\System\FbUUTgk.exe
  C:\Windows\System\FbUUTgk.exe
  2⤵
  PID:7252
- C:\Windows\System\jNGamAS.exe
  C:\Windows\System\jNGamAS.exe
  2⤵
  PID:7944
- C:\Windows\System\kUXYVQO.exe
  C:\Windows\System\kUXYVQO.exe
  2⤵
  PID:8204
- C:\Windows\System\JhTiAKb.exe
  C:\Windows\System\JhTiAKb.exe
  2⤵
  PID:8220
- C:\Windows\System\wuoFEer.exe
  C:\Windows\System\wuoFEer.exe
  2⤵
  PID:8240
- C:\Windows\System\sGdQcoM.exe
  C:\Windows\System\sGdQcoM.exe
  2⤵
  PID:8256
- C:\Windows\System\QMPhNPm.exe
  C:\Windows\System\QMPhNPm.exe
  2⤵
  PID:8280
- C:\Windows\System\RfWKrCA.exe
  C:\Windows\System\RfWKrCA.exe
  2⤵
  PID:8296
- C:\Windows\System\DOEwrSm.exe
  C:\Windows\System\DOEwrSm.exe
  2⤵
  PID:8312
- C:\Windows\System\omCjlyy.exe
  C:\Windows\System\omCjlyy.exe
  2⤵
  PID:8332
- C:\Windows\System\YkdBRuw.exe
  C:\Windows\System\YkdBRuw.exe
  2⤵
  PID:8368
- C:\Windows\System\zMOAkjz.exe
  C:\Windows\System\zMOAkjz.exe
  2⤵
  PID:8384
- C:\Windows\System\PQOjJjQ.exe
  C:\Windows\System\PQOjJjQ.exe
  2⤵
  PID:8404
- C:\Windows\System\YiwPPmb.exe
  C:\Windows\System\YiwPPmb.exe
  2⤵
  PID:8420
- C:\Windows\System\EQvBgMK.exe
  C:\Windows\System\EQvBgMK.exe
  2⤵
  PID:8436
- C:\Windows\System\VLTYsyc.exe
  C:\Windows\System\VLTYsyc.exe
  2⤵
  PID:8460
- C:\Windows\System\dxZYSVl.exe
  C:\Windows\System\dxZYSVl.exe
  2⤵
  PID:8480
- C:\Windows\System\ammuUHI.exe
  C:\Windows\System\ammuUHI.exe
  2⤵
  PID:8496
- C:\Windows\System\UgiWFDJ.exe
  C:\Windows\System\UgiWFDJ.exe
  2⤵
  PID:8524
- C:\Windows\System\dBahwrl.exe
  C:\Windows\System\dBahwrl.exe
  2⤵
  PID:8544
- C:\Windows\System\mpdKMLv.exe
  C:\Windows\System\mpdKMLv.exe
  2⤵
  PID:8560
- C:\Windows\System\mYcbnGl.exe
  C:\Windows\System\mYcbnGl.exe
  2⤵
  PID:8576
- C:\Windows\System\UrPHuEP.exe
  C:\Windows\System\UrPHuEP.exe
  2⤵
  PID:8592
- C:\Windows\System\whllvcN.exe
  C:\Windows\System\whllvcN.exe
  2⤵
  PID:8612
- C:\Windows\System\auNeJji.exe
  C:\Windows\System\auNeJji.exe
  2⤵
  PID:8632
- C:\Windows\System\LtQVGHp.exe
  C:\Windows\System\LtQVGHp.exe
  2⤵
  PID:8676
- C:\Windows\System\ruoftAl.exe
  C:\Windows\System\ruoftAl.exe
  2⤵
  PID:8692
- C:\Windows\System\KheXCDL.exe
  C:\Windows\System\KheXCDL.exe
  2⤵
  PID:8708
- C:\Windows\System\xzflCHI.exe
  C:\Windows\System\xzflCHI.exe
  2⤵
  PID:8724
- C:\Windows\System\eRlkiXQ.exe
  C:\Windows\System\eRlkiXQ.exe
  2⤵
  PID:8748
- C:\Windows\System\ycuzXHN.exe
  C:\Windows\System\ycuzXHN.exe
  2⤵
  PID:8772
- C:\Windows\System\WbXMPMi.exe
  C:\Windows\System\WbXMPMi.exe
  2⤵
  PID:8788
- C:\Windows\System\FXsCgGf.exe
  C:\Windows\System\FXsCgGf.exe
  2⤵
  PID:8812
- C:\Windows\System\YuBGalt.exe
  C:\Windows\System\YuBGalt.exe
  2⤵
  PID:8828
- C:\Windows\System\loPpZaR.exe
  C:\Windows\System\loPpZaR.exe
  2⤵
  PID:8844
- C:\Windows\System\XPTQEIk.exe
  C:\Windows\System\XPTQEIk.exe
  2⤵
  PID:8872
- C:\Windows\System\VfCDBjZ.exe
  C:\Windows\System\VfCDBjZ.exe
  2⤵
  PID:8888
- C:\Windows\System\QPeHZzR.exe
  C:\Windows\System\QPeHZzR.exe
  2⤵
  PID:8912
- C:\Windows\System\zPNQAfy.exe
  C:\Windows\System\zPNQAfy.exe
  2⤵
  PID:8940
- C:\Windows\System\TzxbIsH.exe
  C:\Windows\System\TzxbIsH.exe
  2⤵
  PID:8956
- C:\Windows\System\ycUHxqj.exe
  C:\Windows\System\ycUHxqj.exe
  2⤵
  PID:8972
- C:\Windows\System\dBYagyl.exe
  C:\Windows\System\dBYagyl.exe
  2⤵
  PID:8988
- C:\Windows\System\mpjpNRL.exe
  C:\Windows\System\mpjpNRL.exe
  2⤵
  PID:9004
- C:\Windows\System\mYVYOdI.exe
  C:\Windows\System\mYVYOdI.exe
  2⤵
  PID:9032
- C:\Windows\System\RIffGwa.exe
  C:\Windows\System\RIffGwa.exe
  2⤵
  PID:9052
- C:\Windows\System\BADeylY.exe
  C:\Windows\System\BADeylY.exe
  2⤵
  PID:9080
- C:\Windows\System\GVcMOOy.exe
  C:\Windows\System\GVcMOOy.exe
  2⤵
  PID:9096
- C:\Windows\System\CqJTWCi.exe
  C:\Windows\System\CqJTWCi.exe
  2⤵
  PID:9112
- C:\Windows\System\RqtIiBc.exe
  C:\Windows\System\RqtIiBc.exe
  2⤵
  PID:9128
- C:\Windows\System\kEXdYsm.exe
  C:\Windows\System\kEXdYsm.exe
  2⤵
  PID:9152
- C:\Windows\System\WtjCCfa.exe
  C:\Windows\System\WtjCCfa.exe
  2⤵
  PID:9172
- C:\Windows\System\SuNrinT.exe
  C:\Windows\System\SuNrinT.exe
  2⤵
  PID:9188
- C:\Windows\System\lMGLpAR.exe
  C:\Windows\System\lMGLpAR.exe
  2⤵
  PID:9208
- C:\Windows\System\HPlbgZs.exe
  C:\Windows\System\HPlbgZs.exe
  2⤵
  PID:7920
- C:\Windows\System\iQVpTQZ.exe
  C:\Windows\System\iQVpTQZ.exe
  2⤵
  PID:8252
- C:\Windows\System\AWBCPNr.exe
  C:\Windows\System\AWBCPNr.exe
  2⤵
  PID:8324
- C:\Windows\System\nByPQAx.exe
  C:\Windows\System\nByPQAx.exe
  2⤵
  PID:8212
- C:\Windows\System\SlSmizc.exe
  C:\Windows\System\SlSmizc.exe
  2⤵
  PID:8360
- C:\Windows\System\vqisOzv.exe
  C:\Windows\System\vqisOzv.exe
  2⤵
  PID:8376
- C:\Windows\System\VkOOGGp.exe
  C:\Windows\System\VkOOGGp.exe
  2⤵
  PID:8416
- C:\Windows\System\gqzJspm.exe
  C:\Windows\System\gqzJspm.exe
  2⤵
  PID:8504
- C:\Windows\System\brbkZHK.exe
  C:\Windows\System\brbkZHK.exe
  2⤵
  PID:8516
- C:\Windows\System\eAOBVSt.exe
  C:\Windows\System\eAOBVSt.exe
  2⤵
  PID:8600
- C:\Windows\System\QHafuDZ.exe
  C:\Windows\System\QHafuDZ.exe
  2⤵
  PID:8648
- C:\Windows\System\xLKMHwm.exe
  C:\Windows\System\xLKMHwm.exe
  2⤵
  PID:8664
- C:\Windows\System\CSbGQSo.exe
  C:\Windows\System\CSbGQSo.exe
  2⤵
  PID:8688
- C:\Windows\System\SOxskWp.exe
  C:\Windows\System\SOxskWp.exe
  2⤵
  PID:8720
- C:\Windows\System\bJLsBEX.exe
  C:\Windows\System\bJLsBEX.exe
  2⤵
  PID:8768
- C:\Windows\System\EmZljWH.exe
  C:\Windows\System\EmZljWH.exe
  2⤵
  PID:8804
- C:\Windows\System\UbeqNAT.exe
  C:\Windows\System\UbeqNAT.exe
  2⤵
  PID:8824
- C:\Windows\System\ZQoCAYO.exe
  C:\Windows\System\ZQoCAYO.exe
  2⤵
  PID:8860
- C:\Windows\System\TzrETpV.exe
  C:\Windows\System\TzrETpV.exe
  2⤵
  PID:8880
- C:\Windows\System\ECwezQT.exe
  C:\Windows\System\ECwezQT.exe
  2⤵
  PID:8908
- C:\Windows\System\FxZkZET.exe
  C:\Windows\System\FxZkZET.exe
  2⤵
  PID:8928
- C:\Windows\System\gFYBvhV.exe
  C:\Windows\System\gFYBvhV.exe
  2⤵
  PID:8968
- C:\Windows\System\trCoFGI.exe
  C:\Windows\System\trCoFGI.exe
  2⤵
  PID:9000
- C:\Windows\System\dxNRBXD.exe
  C:\Windows\System\dxNRBXD.exe
  2⤵
  PID:9016
- C:\Windows\System\aPgSbJh.exe
  C:\Windows\System\aPgSbJh.exe
  2⤵
  PID:9124
- C:\Windows\System\BYkaygP.exe
  C:\Windows\System\BYkaygP.exe
  2⤵
  PID:9144
- C:\Windows\System\KZtGyJz.exe
  C:\Windows\System\KZtGyJz.exe
  2⤵
  PID:9168
- C:\Windows\System\TjvUCnp.exe
  C:\Windows\System\TjvUCnp.exe
  2⤵
  PID:8248
- C:\Windows\System\FkVuMvb.exe
  C:\Windows\System\FkVuMvb.exe
  2⤵
  PID:8196
- C:\Windows\System\CcfZnbC.exe
  C:\Windows\System\CcfZnbC.exe
  2⤵
  PID:8348
- C:\Windows\System\urnuHUt.exe
  C:\Windows\System\urnuHUt.exe
  2⤵
  PID:8288
- C:\Windows\System\MSzMHtO.exe
  C:\Windows\System\MSzMHtO.exe
  2⤵
  PID:8400
- C:\Windows\System\OezgqcB.exe
  C:\Windows\System\OezgqcB.exe
  2⤵
  PID:8552
- C:\Windows\System\VeDFYpB.exe
  C:\Windows\System\VeDFYpB.exe
  2⤵
  PID:8584
- C:\Windows\System\xcblYyW.exe
  C:\Windows\System\xcblYyW.exe
  2⤵
  PID:8640
- C:\Windows\System\sIhvJfN.exe
  C:\Windows\System\sIhvJfN.exe
  2⤵
  PID:8704
- C:\Windows\System\GVLJCXl.exe
  C:\Windows\System\GVLJCXl.exe
  2⤵
  PID:8744
- C:\Windows\System\FyKbrek.exe
  C:\Windows\System\FyKbrek.exe
  2⤵
  PID:8800
- C:\Windows\System\FnwrZaB.exe
  C:\Windows\System\FnwrZaB.exe
  2⤵
  PID:8864
- C:\Windows\System\gkRZFnR.exe
  C:\Windows\System\gkRZFnR.exe
  2⤵
  PID:8984
- C:\Windows\System\OuyYIif.exe
  C:\Windows\System\OuyYIif.exe
  2⤵
  PID:8964
- C:\Windows\System\gtuVJMY.exe
  C:\Windows\System\gtuVJMY.exe
  2⤵
  PID:9060
- C:\Windows\System\TSbcHwV.exe
  C:\Windows\System\TSbcHwV.exe
  2⤵
  PID:9104
- C:\Windows\System\rqBUyGM.exe
  C:\Windows\System\rqBUyGM.exe
  2⤵
  PID:9140
- C:\Windows\System\UBgvCyd.exe
  C:\Windows\System\UBgvCyd.exe
  2⤵
  PID:9204
- C:\Windows\System\WMxxpCK.exe
  C:\Windows\System\WMxxpCK.exe
  2⤵
  PID:8356
- C:\Windows\System\idsfTSi.exe
  C:\Windows\System\idsfTSi.exe
  2⤵
  PID:8432
- C:\Windows\System\zrWNWYB.exe
  C:\Windows\System\zrWNWYB.exe
  2⤵
  PID:8392
- C:\Windows\System\pIVYcbL.exe
  C:\Windows\System\pIVYcbL.exe
  2⤵
  PID:8468
- C:\Windows\System\erBkGpv.exe
  C:\Windows\System\erBkGpv.exe
  2⤵
  PID:8540
- C:\Windows\System\xQOOhQp.exe
  C:\Windows\System\xQOOhQp.exe
  2⤵
  PID:9180
- C:\Windows\System\rmcEBCK.exe
  C:\Windows\System\rmcEBCK.exe
  2⤵
  PID:8980
- C:\Windows\System\QYiaDph.exe
  C:\Windows\System\QYiaDph.exe
  2⤵
  PID:8840
- C:\Windows\System\QBfXQfI.exe
  C:\Windows\System\QBfXQfI.exe
  2⤵
  PID:9064
- C:\Windows\System\Pjwzeid.exe
  C:\Windows\System\Pjwzeid.exe
  2⤵
  PID:9136
- C:\Windows\System\HvjXwPv.exe
  C:\Windows\System\HvjXwPv.exe
  2⤵
  PID:8232
- C:\Windows\System\GHitLGT.exe
  C:\Windows\System\GHitLGT.exe
  2⤵
  PID:8292
- C:\Windows\System\jHWhZlZ.exe
  C:\Windows\System\jHWhZlZ.exe
  2⤵
  PID:8716
- C:\Windows\System\dYpuDlo.exe
  C:\Windows\System\dYpuDlo.exe
  2⤵
  PID:8532
- C:\Windows\System\oXFKVwX.exe
  C:\Windows\System\oXFKVwX.exe
  2⤵
  PID:8852
- C:\Windows\System\ndcWhYf.exe
  C:\Windows\System\ndcWhYf.exe
  2⤵
  PID:9048
- C:\Windows\System\EWgtYZg.exe
  C:\Windows\System\EWgtYZg.exe
  2⤵
  PID:9088
- C:\Windows\System\vPLSPMR.exe
  C:\Windows\System\vPLSPMR.exe
  2⤵
  PID:8660
- C:\Windows\System\FJfroLJ.exe
  C:\Windows\System\FJfroLJ.exe
  2⤵
  PID:8448
- C:\Windows\System\scPVJrK.exe
  C:\Windows\System\scPVJrK.exe
  2⤵
  PID:8508
- C:\Windows\System\lfoeIzj.exe
  C:\Windows\System\lfoeIzj.exe
  2⤵
  PID:1564
- C:\Windows\System\pyTxcdZ.exe
  C:\Windows\System\pyTxcdZ.exe
  2⤵
  PID:8796
- C:\Windows\System\MIVQMPp.exe
  C:\Windows\System\MIVQMPp.exe
  2⤵
  PID:8952
- C:\Windows\System\zxEZCos.exe
  C:\Windows\System\zxEZCos.exe
  2⤵
  PID:8856
- C:\Windows\System\vZHWyFd.exe
  C:\Windows\System\vZHWyFd.exe
  2⤵
  PID:8924
- C:\Windows\System\iCmpBXL.exe
  C:\Windows\System\iCmpBXL.exe
  2⤵
  PID:9224
- C:\Windows\System\wVCaFJl.exe
  C:\Windows\System\wVCaFJl.exe
  2⤵
  PID:9240
- C:\Windows\System\rtEAHIV.exe
  C:\Windows\System\rtEAHIV.exe
  2⤵
  PID:9260
- C:\Windows\System\IuLkpyy.exe
  C:\Windows\System\IuLkpyy.exe
  2⤵
  PID:9276
- C:\Windows\System\iCPsdXn.exe
  C:\Windows\System\iCPsdXn.exe
  2⤵
  PID:9296
- C:\Windows\System\zpsAfgd.exe
  C:\Windows\System\zpsAfgd.exe
  2⤵
  PID:9324
- C:\Windows\System\SHTgKSr.exe
  C:\Windows\System\SHTgKSr.exe
  2⤵
  PID:9340
- C:\Windows\System\iCXEMMb.exe
  C:\Windows\System\iCXEMMb.exe
  2⤵
  PID:9360
- C:\Windows\System\WOxEdhc.exe
  C:\Windows\System\WOxEdhc.exe
  2⤵
  PID:9376
- C:\Windows\System\drYuUFH.exe
  C:\Windows\System\drYuUFH.exe
  2⤵
  PID:9392
- C:\Windows\System\gGDYeJR.exe
  C:\Windows\System\gGDYeJR.exe
  2⤵
  PID:9420
- C:\Windows\System\rEgyGEr.exe
  C:\Windows\System\rEgyGEr.exe
  2⤵
  PID:9436
- C:\Windows\System\ENYnbjE.exe
  C:\Windows\System\ENYnbjE.exe
  2⤵
  PID:9456
- C:\Windows\System\wQQzILn.exe
  C:\Windows\System\wQQzILn.exe
  2⤵
  PID:9472
- C:\Windows\System\nlRDsVs.exe
  C:\Windows\System\nlRDsVs.exe
  2⤵
  PID:9488
- C:\Windows\System\QECsFkg.exe
  C:\Windows\System\QECsFkg.exe
  2⤵
  PID:9512
- C:\Windows\System\YCjRRkq.exe
  C:\Windows\System\YCjRRkq.exe
  2⤵
  PID:9528
- C:\Windows\System\QCFqzkS.exe
  C:\Windows\System\QCFqzkS.exe
  2⤵
  PID:9544
- C:\Windows\System\CDjKtoO.exe
  C:\Windows\System\CDjKtoO.exe
  2⤵
  PID:9564
- C:\Windows\System\LhawfuY.exe
  C:\Windows\System\LhawfuY.exe
  2⤵
  PID:9584
- C:\Windows\System\iSqTFNc.exe
  C:\Windows\System\iSqTFNc.exe
  2⤵
  PID:9624
- C:\Windows\System\HgCwjPD.exe
  C:\Windows\System\HgCwjPD.exe
  2⤵
  PID:9644
- C:\Windows\System\QEbDUqx.exe
  C:\Windows\System\QEbDUqx.exe
  2⤵
  PID:9660
- C:\Windows\System\EagMSnV.exe
  C:\Windows\System\EagMSnV.exe
  2⤵
  PID:9676
- C:\Windows\System\ViCiRvS.exe
  C:\Windows\System\ViCiRvS.exe
  2⤵
  PID:9696
- C:\Windows\System\HETcJOh.exe
  C:\Windows\System\HETcJOh.exe
  2⤵
  PID:9716
- C:\Windows\System\JuvwCiL.exe
  C:\Windows\System\JuvwCiL.exe
  2⤵
  PID:9732
- C:\Windows\System\PZRhFxX.exe
  C:\Windows\System\PZRhFxX.exe
  2⤵
  PID:9748
- C:\Windows\System\YyGkjhJ.exe
  C:\Windows\System\YyGkjhJ.exe
  2⤵
  PID:9788
- C:\Windows\System\VkYHBcm.exe
  C:\Windows\System\VkYHBcm.exe
  2⤵
  PID:9804
- C:\Windows\System\SNJCCSJ.exe
  C:\Windows\System\SNJCCSJ.exe
  2⤵
  PID:9824
- C:\Windows\System\bUEqqYm.exe
  C:\Windows\System\bUEqqYm.exe
  2⤵
  PID:9844
- C:\Windows\System\cJgQAgL.exe
  C:\Windows\System\cJgQAgL.exe
  2⤵
  PID:9860
- C:\Windows\System\sSCHsmi.exe
  C:\Windows\System\sSCHsmi.exe
  2⤵
  PID:9876
- C:\Windows\System\JeKQrJD.exe
  C:\Windows\System\JeKQrJD.exe
  2⤵
  PID:9892
- C:\Windows\System\LFAhKLL.exe
  C:\Windows\System\LFAhKLL.exe
  2⤵
  PID:9928
- C:\Windows\System\bjGDttq.exe
  C:\Windows\System\bjGDttq.exe
  2⤵
  PID:9944
- C:\Windows\System\DTFeaSj.exe
  C:\Windows\System\DTFeaSj.exe
  2⤵
  PID:9964
- C:\Windows\System\AwNyhyd.exe
  C:\Windows\System\AwNyhyd.exe
  2⤵
  PID:9988
- C:\Windows\System\aGjpBHR.exe
  C:\Windows\System\aGjpBHR.exe
  2⤵
  PID:10012
- C:\Windows\System\ZwbvFSd.exe
  C:\Windows\System\ZwbvFSd.exe
  2⤵
  PID:10028
- C:\Windows\System\GEcVfst.exe
  C:\Windows\System\GEcVfst.exe
  2⤵
  PID:10044
- C:\Windows\System\eiUvEIY.exe
  C:\Windows\System\eiUvEIY.exe
  2⤵
  PID:10064
- C:\Windows\System\roUPYKo.exe
  C:\Windows\System\roUPYKo.exe
  2⤵
  PID:10088
- C:\Windows\System\uIfUOla.exe
  C:\Windows\System\uIfUOla.exe
  2⤵
  PID:10108
- C:\Windows\System\OCpdvkG.exe
  C:\Windows\System\OCpdvkG.exe
  2⤵
  PID:10128
- C:\Windows\System\hoGgSMO.exe
  C:\Windows\System\hoGgSMO.exe
  2⤵
  PID:10148
- C:\Windows\System\lcgUVjy.exe
  C:\Windows\System\lcgUVjy.exe
  2⤵
  PID:10168
- C:\Windows\System\RHArNJW.exe
  C:\Windows\System\RHArNJW.exe
  2⤵
  PID:10188
- C:\Windows\System\broYwMM.exe
  C:\Windows\System\broYwMM.exe
  2⤵
  PID:10208
- C:\Windows\System\GQycqsp.exe
  C:\Windows\System\GQycqsp.exe
  2⤵
  PID:10228
- C:\Windows\System\GOxogPo.exe
  C:\Windows\System\GOxogPo.exe
  2⤵
  PID:9220
- C:\Windows\System\vgUaVpY.exe
  C:\Windows\System\vgUaVpY.exe
  2⤵
  PID:9252
- C:\Windows\System\rbhMsEw.exe
  C:\Windows\System\rbhMsEw.exe
  2⤵
  PID:9308
- C:\Windows\System\LTaIbOj.exe
  C:\Windows\System\LTaIbOj.exe
  2⤵
  PID:9316
- C:\Windows\System\JOBgUkc.exe
  C:\Windows\System\JOBgUkc.exe
  2⤵
  PID:9356
- C:\Windows\System\eEQOqfM.exe
  C:\Windows\System\eEQOqfM.exe
  2⤵
  PID:9404
- C:\Windows\System\TnmexVc.exe
  C:\Windows\System\TnmexVc.exe
  2⤵
  PID:9432
- C:\Windows\System\hnMnrlj.exe
  C:\Windows\System\hnMnrlj.exe
  2⤵
  PID:9484
- C:\Windows\System\mnRxdTd.exe
  C:\Windows\System\mnRxdTd.exe
  2⤵
  PID:9464
- C:\Windows\System\AdKEbmF.exe
  C:\Windows\System\AdKEbmF.exe
  2⤵
  PID:9592
- C:\Windows\System\phJQtHD.exe
  C:\Windows\System\phJQtHD.exe
  2⤵
  PID:9500
- C:\Windows\System\OyxVmcY.exe
  C:\Windows\System\OyxVmcY.exe
  2⤵
  PID:9600
- C:\Windows\System\aCTfzMy.exe
  C:\Windows\System\aCTfzMy.exe
  2⤵
  PID:9616
- C:\Windows\System\YRhZXaF.exe
  C:\Windows\System\YRhZXaF.exe
  2⤵
  PID:9640
- C:\Windows\System\dBvEROE.exe
  C:\Windows\System\dBvEROE.exe
  2⤵
  PID:9724
- C:\Windows\System\OOckHiT.exe
  C:\Windows\System\OOckHiT.exe
  2⤵
  PID:9712
- C:\Windows\System\sRmpMpf.exe
  C:\Windows\System\sRmpMpf.exe
  2⤵
  PID:9760
- C:\Windows\System\QmQllgH.exe
  C:\Windows\System\QmQllgH.exe
  2⤵
  PID:9784
- C:\Windows\System\JpHQdtz.exe
  C:\Windows\System\JpHQdtz.exe
  2⤵
  PID:9852
- C:\Windows\System\nFtQvJd.exe
  C:\Windows\System\nFtQvJd.exe
  2⤵
  PID:9836
- C:\Windows\System\auFkFbH.exe
  C:\Windows\System\auFkFbH.exe
  2⤵
  PID:9888
- C:\Windows\System\GHdRxlh.exe
  C:\Windows\System\GHdRxlh.exe
  2⤵
  PID:9912
- C:\Windows\System\LYpsEmX.exe
  C:\Windows\System\LYpsEmX.exe
  2⤵
  PID:9940
- C:\Windows\System\egwSReg.exe
  C:\Windows\System\egwSReg.exe
  2⤵
  PID:9984
- C:\Windows\System\CRmfwXE.exe
  C:\Windows\System\CRmfwXE.exe
  2⤵
  PID:10008
- C:\Windows\System\VNacSPO.exe
  C:\Windows\System\VNacSPO.exe
  2⤵
  PID:10052
- C:\Windows\System\HyhjWHM.exe
  C:\Windows\System\HyhjWHM.exe
  2⤵
  PID:10056
- C:\Windows\System\ylckmZg.exe
  C:\Windows\System\ylckmZg.exe
  2⤵
  PID:10120
- C:\Windows\System\jyZHFYZ.exe
  C:\Windows\System\jyZHFYZ.exe
  2⤵
  PID:10140
- C:\Windows\System\VencEJr.exe
  C:\Windows\System\VencEJr.exe
  2⤵
  PID:10176
- C:\Windows\System\AIwkeRJ.exe
  C:\Windows\System\AIwkeRJ.exe
  2⤵
  PID:10204
- C:\Windows\System\CaXIgop.exe
  C:\Windows\System\CaXIgop.exe
  2⤵
  PID:10236
- C:\Windows\System\SCDUojp.exe
  C:\Windows\System\SCDUojp.exe
  2⤵
  PID:9248
- C:\Windows\System\OBTgilf.exe
  C:\Windows\System\OBTgilf.exe
  2⤵
  PID:9288
- C:\Windows\System\joordbH.exe
  C:\Windows\System\joordbH.exe
  2⤵
  PID:9348
- C:\Windows\System\MEKWiEk.exe
  C:\Windows\System\MEKWiEk.exe
  2⤵
  PID:9416
- C:\Windows\System\IXevvsa.exe
  C:\Windows\System\IXevvsa.exe
  2⤵
  PID:9480
- C:\Windows\System\wRkSyeK.exe
  C:\Windows\System\wRkSyeK.exe
  2⤵
  PID:9496
- C:\Windows\System\DmABKxF.exe
  C:\Windows\System\DmABKxF.exe
  2⤵
  PID:9540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CKTEqCZ.exe

Filesize
1.5MB

MD5
9914d770c597322717b830a1771a55db

SHA1
e4cd86bb34f2bf0090fd28499835d5fca0ee9c0e

SHA256
b3dd5bd38661f96f6b77005101179dbc0fdb5c1b965aab188aaea8cfedfe2b7b

SHA512
9e961fe0945eb7fa89fa39297e404b857b585cf8d773fe343b5928bd7f99de511c4b3c4cc1a8a39318613f3ee52510b9340ff758998ed96f57f456fe5f2eca25

Download Submit
C:\Windows\system\DyqevrB.exe

Filesize
1.5MB

MD5
b5ba6e048c2803dc0754cd1405eaf86f

SHA1
d467e0a1c795acb68a9385890fe0c40ecf0f76d7

SHA256
5e76738c058e45479803d51e19709d6be7ab268b544267c2042f0f32eae0d7f0

SHA512
1d36d3763edee699d953dbdcfeacfe814645315e393c83d9ec5b754d465cb3394e442523761aef401c33acf657aff50658162e8a34cc3518f5380b2d35175cf9

Download Submit
C:\Windows\system\EQXegXy.exe

Filesize
1.5MB

MD5
a971326069276e971d3b85418877845d

SHA1
d63f59340cd39065bd996f7037c9262a149ae452

SHA256
691679c54b1b6b017103d7db1044aab8c4a612c05eb7796005f5546b5f45de3d

SHA512
2a2bac34c62fba71a2fb08fb27c140ba6c3749e9329f688cf6be694931cbd7ea5a554196b32effd31c955628db4b6bc2716e84989ba15c27bb8d8a983186e70a

Download Submit
C:\Windows\system\EXMUAME.exe

Filesize
1.5MB

MD5
e011a5f32f89a8892f83afad13575037

SHA1
5333edb779dcf7a589b0ac9ca09175349777544d

SHA256
a1cf5dd12343ab4844f79c5d45272a9d9bdfe69abea24dca823092656c8f1bd0

SHA512
d5e32e42f62248cc1e140638f98af2a28efd8e799f29a437f4464821cbe1af19ce4685339847fc34fed75a8feccc28660dcb9215ce4f87ee4cdd4e9a845364cc

Download Submit
C:\Windows\system\FieUYcv.exe

Filesize
1.5MB

MD5
bb4ea17e596146ec260f5d793686086b

SHA1
e9118f75f0cee41c31b6460038a74e4c6bfe4cab

SHA256
b1985d66ade59f0aa011d40420129c259bdb4d35b3145871f9c30120ad9d8685

SHA512
928840f74ddb2d17f8c8932f4326963c22f3f30b7ba7891f6019fdfa68cc724eaac1d8195461c8ab0c0f4cab196c413ebefa24e2206e8d3af0b4f67fe90af4fe

Download Submit
C:\Windows\system\JUGoqNP.exe

Filesize
1.5MB

MD5
a83cd97d127ed46126e5b6248da49afc

SHA1
0bd8d3effb667ea8bd598f0f68cbb4c69c47d0c7

SHA256
229e161c625cbcbde8bf11dca621a2cb886af78b38ad47f9d1848aadd7ed527b

SHA512
eed29a576494cfc8e7649a240de584f14bbbf1029c40f7ff2f6ab033d074b56eac945c3b296425c7a5b5621f66a8e115992dec3d193f25c0dd10e145f341fe21

Download Submit
C:\Windows\system\KYgDJwN.exe

Filesize
1.5MB

MD5
d581a50052f964db998460e47b6a6398

SHA1
a421dc5ebb6a6f9f7b551fc2f03968e5e764d6dd

SHA256
c592053bc43c17540c457b2c4d85a2463d874e97675a7081234b649561f0f7ca

SHA512
48a90dc8ca2e3a8c019c1998641f60a9df59747ff24022d886ccea4645cfe8fc9081238ef861c22b8c2fc0f5ba392a8ff6672533fb2d34e06e9078fe929c635b

Download Submit
C:\Windows\system\LCeQgRk.exe

Filesize
1.5MB

MD5
977156397222ed40b0cfa47d8f1d0cd3

SHA1
4297b3e98d71a60d8c34cb0be2a6c025854f7cc0

SHA256
06f5c90bb6b1e4782ff7168be073ee131b726a9e2c52517ec91b312ff6df76a5

SHA512
e0ad773ce1a1c21f8f96dc47c9850430d2a6e3e38a09c26a364d192f0f21865ac9895edfc978b32154b21b19d1350eea6d50d651714aca6e126935fe09841f0c

Download Submit
C:\Windows\system\LNklsdz.exe

Filesize
1.5MB

MD5
b861d462dfc10f43d3773f28eab262bc

SHA1
e25fc94623a6b0a54446bbb1756beab420b6d121

SHA256
0a6602e02364cb954734855014d9d9495d32895635f34856c211d4115392729b

SHA512
562288a3617683d00e46deaf18029e70681ead9133f1c38c6250df740c91ab55f1ce318c3325b78f4921afca4d70169e566ab2ff7c90d15f950c4923ec75bb88

Download Submit
C:\Windows\system\MJgWRGJ.exe

Filesize
1.5MB

MD5
67f85d815e9ec80e2e814ee7b678831d

SHA1
2723dfacf52d4e20ce64c98400ee29281d1d4c99

SHA256
17f9823b996cf8ada9448bb73683079afe62ad6c04340b9ac5a551fc0fd0ec34

SHA512
3420aee93f1d39be081ac010fe586fdfdd34ed063ec1a3ff23cf7b667e516e3d9b4310799d421a013e3f428c528ca30d752ac98d27f8bd63bb52c860b84d893c

Download Submit
C:\Windows\system\WzBrBbm.exe

Filesize
1.5MB

MD5
9e3e167d0e2b610c004ad461308c63ec

SHA1
ab81e1dd823d6f039a6a3385895e7f41d3860ebe

SHA256
6ecdbbf6badf729b0fe26af13699084cd7fbc15f8ca6ffb362f08c20fd223a87

SHA512
143863194bd52049377b00e9210277b3b39a2ac44e0579c00c358d8875466c4992a134323db4d313cb657b7c95d400166e04e40f266d4de9e42a772d5e016ced

Download Submit
C:\Windows\system\dtgrAzU.exe

Filesize
1.5MB

MD5
ac9fb43213e0d416a81bf5e6188bbf52

SHA1
caf0bc96696fa2ec356b65fea2214af1a2c5a353

SHA256
9b406caabc6bebca9df92e0d15150415687446f49f1c9991d56eacbbb67fe21a

SHA512
5d337194c27f2dd8f53dc83b89fd43d31fe46faf08175ab8cce0cf0435cf7772789ce201e83ae3e28d34f6a400e183f1c4043254c497072fca7fa7a3b4574bf4

Download Submit
C:\Windows\system\iCfuEwZ.exe

Filesize
1.5MB

MD5
d6b786f2d5d15930a7ac2e1b7828715a

SHA1
1b321cb83f56f8f7a4d5b4363416f499af7777f3

SHA256
22d0482940f40c793534c463b2a2eaa74e7d173cfeb2084eb6f7324e9cec17c0

SHA512
8e48ac28eeb243a3f4c6f62234b7d97872d95bbda42d58254fd8c407fd98ed2a3af0d2e1afcf790dd8ec3fdc874dce98064f93b435af2f756261c8202e560364

Download Submit
C:\Windows\system\jYCqlec.exe

Filesize
1.5MB

MD5
ac9ea70acc8447ad5ea5378c709f6491

SHA1
49b4af579d7654fce54b8bc97f6e57c92304b049

SHA256
46fddab7b3459786e971f7da7017b0565be73042b45154c1052fd0a6922a97b4

SHA512
b0fe2ca7156133484ea177aa7ee0d6d510d9adf3981a6301f318c0b91ee896ee5025ee8df04143e36829b44c29236052f92b808ac34455fbb2a9809584b63b0c

Download Submit
C:\Windows\system\lijTeUH.exe

Filesize
1.5MB

MD5
cad1f6d0ce427b4c3db5b019033dc024

SHA1
838f1015487c682028605a859272762a3d09ab57

SHA256
7f700d2c5d0d3edf1d075ff942e2dc500838641c1ac23c91a5938d3462ccd2a2

SHA512
eb687f0fa3ef9ba82a58ba0284f2bcd61c50d4a8c1f1fa615ecef481ede0af48579beb729e0cabe331c391bcc340e0f2d7942668923a0d1c5f2320dda414dca1

Download Submit
C:\Windows\system\mMIGxbH.exe

Filesize
1.5MB

MD5
7f5426627324151cf5616677a4c6dbd9

SHA1
dbc45b6f4e2c7cfce74e270a331ecdfefb6295fb

SHA256
54b1cbc212c0f89c1975d38d8569184f426d56c831164202ff683a5270c63676

SHA512
af1d7e84969083a8f491446b86974b458aa2718dde1453353252dce6a010c484f8013486ba1f7ea22050ef3032c82a50966fa12145f09addffa1ddb04f80a9ee

Download Submit
C:\Windows\system\nwSpSyI.exe

Filesize
1.5MB

MD5
07442c3b4af8dd549719ed8b19abe511

SHA1
512eeb35b82901974cb04d43ed28e92254459049

SHA256
cf5318879dcbf699dc2cbc15a49024c70e3b28bb317c9ef4fb09de99e53caa55

SHA512
0f5d51096ffaab64dede3c8bb2a7afef957f3df34cc7d291c243332beb437d9bc9eb9a6170bf6e928e9c48c3e8cfd272bb5d3329cd405874dde3ab49febdb4e8

Download Submit
C:\Windows\system\qDcufjp.exe

Filesize
1.5MB

MD5
c937db893d256cef4ab25d4a99f3ac76

SHA1
6a2520de5645a6214b565a117fa1ffa6e8ae62d7

SHA256
81c5a497cc7ddde658706b315d2b4c15943dfbfef1ef55d699816072f7baa97b

SHA512
789d0b506c117405994da450ebef4eea10df759037ea6ae710281b8cb556d58d0ecd02e3bcca98c1c89084f591cc2b70d5a74caa2cdd2761d8a455a96f3ba418

Download Submit
C:\Windows\system\uSYVzuT.exe

Filesize
1.5MB

MD5
9500db9fb6faf9ef43d48ce57acc5c8e

SHA1
b08a3bda3356605c9d7dfbaf90b4cfb7ebabf8c5

SHA256
30c1fecfb4db193d93937fcd83c64e5b361c4210d1d2194e4cd911653955df76

SHA512
0d2d42fb345734ee89c23e361d2de608c3f0dd2d9260174895a6e5015e80e771ff22d86f3be8eb40ab13cccaae8f6a9c9f7df3cb6bf243372e42439ce15af4f8

Download Submit
C:\Windows\system\uWYmLUV.exe

Filesize
1.5MB

MD5
ad2ace0c8cf5fb4e0ea7e5106f40505c

SHA1
45cd46825257a49155653717ad5c4d60b1fceec0

SHA256
fd62c16949d78b286ee8fbb6c5158b0422b5241edec6afeb37be7e8828cee758

SHA512
3f8bb2e5b6a9bd40180f5979e77b30b55c3dd1635e4b8bf290fe7448dacb09c17e68c13141f204a830a36bdb59cc1860c2c4111cd6efbf7af6ad321f622126f4

Download Submit
\Windows\system\EzKaPVE.exe

Filesize
1.5MB

MD5
e52587294ef0c9fa94bf88ad8b1812a8

SHA1
8b1437d2cf4133e932023ae181e732ffae6f8eee

SHA256
6e9c2dad4062fab48ebac56c0043c0903513df523c6b11ddf08a156676c81a8b

SHA512
a807c591700cb0241b6fb25c3e53944e10e79f4ffdf2d666267cb82862a49d3bca706569136d75c7f84e89fb5e33e76eefe20cf69248e7beee9f73c25126b268

Download Submit
\Windows\system\RFteXgH.exe

Filesize
1.5MB

MD5
2cbf28e433a34e1dbad35ef8ba7fb060

SHA1
ebef1d40b1ac558ae151e4d77ccafde7d89f4ee8

SHA256
8d975590086f0ebf8cec5307ed4479ca32418f3a90d8e17b5a8cb4c41a23db1d

SHA512
dc524c1f1900228ce8fdca85bad14eae2cdd4c82c8a7b36f886c0f15109e41cdd5a11dc4ddc15b25c1f4b88d51c8e8d7b67a167d480334ac5d0a62dd4c425efe

Download Submit
\Windows\system\SXFdHlf.exe

Filesize
1.5MB

MD5
977f389c2c835197a2fa46a451fcf567

SHA1
51d02db7dc50ed92e321611b51fcee4fe5f9aca4

SHA256
bb3f657d95c2eda30803e0acf9533f5ecc490da6d86792b34aa0930707ecc5ac

SHA512
74d9ae40ae4c53fc100ab0d98603bea0bdae7e8eff16ff00b72b83725409b2dca964392626d3e23a0b7d50caf44cdf0b18b9933f3739ab83cf9e5d0b159833ae

Download Submit
\Windows\system\fxSYCwD.exe

Filesize
1.5MB

MD5
d65cd303bced88653edfee43c309096e

SHA1
3c8a796e7700ef96b1c53ab6ad0ecc72c1fcbfc1

SHA256
f5f6229d631f3ecd5c80c68bd87104205778d58de31329823b0aeebb3a745616

SHA512
abc89262efa97f42ad69a46b34c1cab3d8448d58b6615a06cec26d6fe5059897ec5fe9bfd0b16f90f9e39627dbaa680f512b8436b05640abab1982d4d7b735f2

Download Submit
\Windows\system\ixacgcp.exe

Filesize
1.5MB

MD5
a08634e863c684e731e7ac4db5bd66c1

SHA1
2d64b1f0217aea512b2cb303d59ed5a6a27eff10

SHA256
1d0bc6d379bfa6914c532c1f63d0220493b7dba1cd13591b21d908c26edaf0f1

SHA512
3ec2b70772a255c4ddfdabe7830c9f15464c3c2177df443d43fde39593e90e67481dd0cd9eefb8a5e6e30d30085ef5b0e9ca6b147ab7136d6e412e5992c1a7a2

Download Submit
\Windows\system\mPWTARH.exe

Filesize
1.5MB

MD5
da7f1ed59589b4caaa359a279f00e029

SHA1
c5fa8cddc875fad5324cf5e1332828bed6c37d86

SHA256
f84f64823e09b2ec58e711446e4fe826fb8305ee82b353289be5b33a10a22ccd

SHA512
082ebc6bf11a2d101f3ed3a891a723d65b0891b5b0817ead62f302114e1cadd17fb2544911ebbf803c49d69dc7a472337f6324bce1cd63a80c73e2c300f81a80

Download Submit
\Windows\system\nqCuduQ.exe

Filesize
1.5MB

MD5
6d966c41d1286be96b0690f5ce7d88ec

SHA1
41f2b9b5bc1fcdc44bc4f79861fa1da4e6d9cf38

SHA256
f1335ca980f1808ffdad35346c95baf59f2ff8059c8ad58fac1656246ec7ce05

SHA512
3fb2479f0c7be489c729abaaed71e516aeafd14bbb515d97353e3f23c133fee89d7baf8981d0a1f45136f9ca42d7b2f9eda1e39c3686307166b3a9e0f0f7108d

Download Submit
\Windows\system\oAWPBII.exe

Filesize
1.5MB

MD5
1b42727434cfffd26324614117448a48

SHA1
d56dbc8762571d78f2d271ff2047792a436ff8a9

SHA256
5c077134ae75aae697540e6a36e5bd23ffd956e6fab7664253228f40c6d25e9b

SHA512
a804f9639e2b7ad3b3a1748caa3ac18f0174efc3d6883725ae0d802915bd777bfb44c1b616109063d05e24d35ba0afb578cb9111fa5281e3dd804a75f3948ee0

Download Submit
\Windows\system\ufbKOzc.exe

Filesize
1.5MB

MD5
8b2f2da274b1e88afbd546e8cdb84cb2

SHA1
e1c21ff2ad739d803ac61dba46ca9173179bc58a

SHA256
0cd94a3a2543c352dc0aea214056479311fa89b5dc40a10c7d042207657a3c85

SHA512
2c995c662a6adf1a66c75a445eb0f1fe5bb4193baec6a194a11257be7fdff442c0748902b331659d58abe28651449cf9f38a594676976324b9d9ee4e0d99a3f6

Download Submit
\Windows\system\uimUanY.exe

Filesize
1.5MB

MD5
a3414718ff454a1961b8fa5c7e4d6acd

SHA1
1855a6394f276a4192798782954d3ca3ade180d2

SHA256
aed5822ad81f69cfc324eb8ab24eefe75fb90bd4a7898a9dd5025b5c220a7b10

SHA512
2a6862d03e5b6659771ee4eb6f75853d75dc971a372691707e3dd5719e422212c5ca20fe827eadd0b0516e33508b544be22ea7b510034cdf6f3ed0b5b44eeef6

Download Submit
\Windows\system\vAHeqMj.exe

Filesize
1.5MB

MD5
5140ea5df31ce382e17ab00b198931d4

SHA1
4bb876a6eac69aa12b858dee00936df1f9c57a17

SHA256
908256c667ac4bc698248a6acaffdfafa8f71ca3a41e88653a5988e4187ad4fd

SHA512
c17619463e45b2f005d7ba22897610d5eca77323fea63bf16531d74f7397cc479fa4fe56c556ad5ce7f1deacb1beac9b4c4e600ec687a2dd689da9e33d1da092

Download Submit
\Windows\system\xlCzMes.exe

Filesize
1.5MB

MD5
8eae34cb04bb0c8640f7bfdc2b00e70a

SHA1
6fc56b642a3436fc4dce26530bea43ddab3f8c45

SHA256
4df8601ffb0374110622d60c60774ef8c4e85f22526ff2c47a9d20883a51a6cc

SHA512
531666a7c0483146fde0431bf217c5f51e3d7c3eba5e002241fc7af8cd5b7f269159f079d40a9cf7c3c433393821a809fcb7f22f1b3bfdcde3bd134883c6de63

Download Submit
memory/1668-3999-0x000000013FAD0000-0x000000013FE24000-memory.dmp

Filesize
3.3MB

Download
memory/1668-51-0x000000013FAD0000-0x000000013FE24000-memory.dmp

Filesize
3.3MB

Download
memory/2212-73-0x000000013F620000-0x000000013F974000-memory.dmp

Filesize
3.3MB

Download
memory/2212-123-0x000000013F620000-0x000000013F974000-memory.dmp

Filesize
3.3MB

Download
memory/2212-4008-0x000000013F620000-0x000000013F974000-memory.dmp

Filesize
3.3MB

Download
memory/2388-71-0x000000013FB90000-0x000000013FEE4000-memory.dmp

Filesize
3.3MB

Download
memory/2388-122-0x000000013FB90000-0x000000013FEE4000-memory.dmp

Filesize
3.3MB

Download
memory/2388-4007-0x000000013FB90000-0x000000013FEE4000-memory.dmp

Filesize
3.3MB

Download
memory/2616-115-0x000000013F9D0000-0x000000013FD24000-memory.dmp

Filesize
3.3MB

Download
memory/2616-69-0x000000013F9D0000-0x000000013FD24000-memory.dmp

Filesize
3.3MB

Download
memory/2616-4005-0x000000013F9D0000-0x000000013FD24000-memory.dmp

Filesize
3.3MB

Download
memory/2620-4012-0x000000013FA40000-0x000000013FD94000-memory.dmp

Filesize
3.3MB

Download
memory/2620-107-0x000000013FA40000-0x000000013FD94000-memory.dmp

Filesize
3.3MB

Download
memory/2640-66-0x000000013FCF0000-0x0000000140044000-memory.dmp

Filesize
3.3MB

Download
memory/2640-104-0x0000000001EA0000-0x00000000021F4000-memory.dmp

Filesize
3.3MB

Download
memory/2640-52-0x0000000001EA0000-0x00000000021F4000-memory.dmp

Filesize
3.3MB

Download
memory/2640-53-0x0000000001EA0000-0x00000000021F4000-memory.dmp

Filesize
3.3MB

Download
memory/2640-2369-0x000000013F0C0000-0x000000013F414000-memory.dmp

Filesize
3.3MB

Download
memory/2640-101-0x0000000001EA0000-0x00000000021F4000-memory.dmp

Filesize
3.3MB

Download
memory/2640-48-0x0000000001EA0000-0x00000000021F4000-memory.dmp

Filesize
3.3MB

Download
memory/2640-38-0x0000000001EA0000-0x00000000021F4000-memory.dmp

Filesize
3.3MB

Download
memory/2640-10-0x0000000001EA0000-0x00000000021F4000-memory.dmp

Filesize
3.3MB

Download
memory/2640-118-0x000000013F0C0000-0x000000013F414000-memory.dmp

Filesize
3.3MB

Download
memory/2640-26-0x0000000001EA0000-0x00000000021F4000-memory.dmp

Filesize
3.3MB

Download
memory/2640-2161-0x0000000001EA0000-0x00000000021F4000-memory.dmp

Filesize
3.3MB

Download
memory/2640-55-0x000000013FEB0000-0x0000000140204000-memory.dmp

Filesize
3.3MB

Download
memory/2640-1893-0x0000000001EA0000-0x00000000021F4000-memory.dmp

Filesize
3.3MB

Download
memory/2640-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2640-0-0x000000013F890000-0x000000013FBE4000-memory.dmp

Filesize
3.3MB

Download
memory/2640-61-0x000000013FD40000-0x0000000140094000-memory.dmp

Filesize
3.3MB

Download
memory/2640-6-0x000000013FD30000-0x0000000140084000-memory.dmp

Filesize
3.3MB

Download
memory/2640-68-0x0000000001EA0000-0x00000000021F4000-memory.dmp

Filesize
3.3MB

Download
memory/2640-22-0x0000000001EA0000-0x00000000021F4000-memory.dmp

Filesize
3.3MB

Download
memory/2640-77-0x000000013F890000-0x000000013FBE4000-memory.dmp

Filesize
3.3MB

Download
memory/2652-4001-0x000000013F570000-0x000000013F8C4000-memory.dmp

Filesize
3.3MB

Download
memory/2652-54-0x000000013F570000-0x000000013F8C4000-memory.dmp

Filesize
3.3MB

Download
memory/2688-355-0x000000013FEB0000-0x0000000140204000-memory.dmp

Filesize
3.3MB

Download
memory/2688-4006-0x000000013FEB0000-0x0000000140204000-memory.dmp

Filesize
3.3MB

Download
memory/2688-78-0x000000013FEB0000-0x0000000140204000-memory.dmp

Filesize
3.3MB

Download
memory/2696-545-0x000000013FCF0000-0x0000000140044000-memory.dmp

Filesize
3.3MB

Download
memory/2696-80-0x000000013FCF0000-0x0000000140044000-memory.dmp

Filesize
3.3MB

Download
memory/2696-4009-0x000000013FCF0000-0x0000000140044000-memory.dmp

Filesize
3.3MB

Download
memory/2780-64-0x000000013F940000-0x000000013FC94000-memory.dmp

Filesize
3.3MB

Download
memory/2780-4004-0x000000013F940000-0x000000013FC94000-memory.dmp

Filesize
3.3MB

Download
memory/2784-4002-0x000000013FA70000-0x000000013FDC4000-memory.dmp

Filesize
3.3MB

Download
memory/2784-44-0x000000013FA70000-0x000000013FDC4000-memory.dmp

Filesize
3.3MB

Download
memory/2784-88-0x000000013FA70000-0x000000013FDC4000-memory.dmp

Filesize
3.3MB

Download
memory/2812-216-0x000000013F860000-0x000000013FBB4000-memory.dmp

Filesize
3.3MB

Download
memory/2812-75-0x000000013F860000-0x000000013FBB4000-memory.dmp

Filesize
3.3MB

Download
memory/2812-4010-0x000000013F860000-0x000000013FBB4000-memory.dmp

Filesize
3.3MB

Download
memory/2824-31-0x000000013FD30000-0x0000000140084000-memory.dmp

Filesize
3.3MB

Download
memory/2824-4000-0x000000013FD30000-0x0000000140084000-memory.dmp

Filesize
3.3MB

Download
memory/2824-87-0x000000013FD30000-0x0000000140084000-memory.dmp

Filesize
3.3MB

Download
memory/2848-63-0x000000013FD40000-0x0000000140094000-memory.dmp

Filesize
3.3MB

Download
memory/2848-4003-0x000000013FD40000-0x0000000140094000-memory.dmp

Filesize
3.3MB

Download
memory/3028-4011-0x000000013F750000-0x000000013FAA4000-memory.dmp

Filesize
3.3MB

Download
memory/3028-1593-0x000000013F750000-0x000000013FAA4000-memory.dmp

Filesize
3.3MB

Download
memory/3028-98-0x000000013F750000-0x000000013FAA4000-memory.dmp

Filesize
3.3MB

Download