xmrig | c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
27/12/2024, 08:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
Size

3.9MB
MD5

2306e98d0d7adb0657cd4d26381c680b
SHA1

a1375b5cd47a52a1fe22f597cfa996124a3d2d66
SHA256

c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6
SHA512

9974c70262b90bb39d0b0ce8976142edb7381b7954fee669870813e459505fb38621ef5d280f9afb2836e544cf499492f6c5efcaa356a7f04b9307eb43e34cbe
SSDEEP

49152:EnCbL83y9FdfE0pZ0zCa4wI156uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7pD:EniLf9FdfE0pZB156utgpPFotBER/2

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/3032-0-0x000000013FCF0000-0x0000000140044000-memory.dmp	xmrig
behavioral1/files/0x000d000000012263-3.dat	xmrig
behavioral1/files/0x00080000000186bb-12.dat	xmrig
behavioral1/files/0x00080000000186c3-9.dat	xmrig
behavioral1/memory/2168-10-0x000000013FA80000-0x000000013FDD4000-memory.dmp	xmrig
behavioral1/memory/2864-21-0x000000013F880000-0x000000013FBD4000-memory.dmp	xmrig
behavioral1/files/0x0008000000018b05-22.dat	xmrig
behavioral1/memory/2892-27-0x000000013F220000-0x000000013F574000-memory.dmp	xmrig
behavioral1/memory/3032-19-0x000000013F880000-0x000000013FBD4000-memory.dmp	xmrig
behavioral1/memory/2860-18-0x000000013F930000-0x000000013FC84000-memory.dmp	xmrig
behavioral1/memory/3032-37-0x000000013FCF0000-0x0000000140044000-memory.dmp	xmrig
behavioral1/files/0x001500000001756e-40.dat	xmrig
behavioral1/memory/2700-34-0x000000013FFB0000-0x0000000140304000-memory.dmp	xmrig
behavioral1/files/0x0007000000018b50-33.dat	xmrig
behavioral1/memory/2864-54-0x000000013F880000-0x000000013FBD4000-memory.dmp	xmrig
behavioral1/memory/2588-55-0x000000013F640000-0x000000013F994000-memory.dmp	xmrig
behavioral1/memory/2688-48-0x000000013F870000-0x000000013FBC4000-memory.dmp	xmrig
behavioral1/files/0x000500000001975a-68.dat	xmrig
behavioral1/memory/2908-73-0x000000013FC30000-0x000000013FF84000-memory.dmp	xmrig
behavioral1/memory/3032-84-0x000000013F870000-0x000000013FBC4000-memory.dmp	xmrig
behavioral1/memory/2608-89-0x000000013F6A0000-0x000000013F9F4000-memory.dmp	xmrig
behavioral1/memory/2588-96-0x000000013F640000-0x000000013F994000-memory.dmp	xmrig
behavioral1/files/0x0005000000019c3c-127.dat	xmrig
behavioral1/files/0x000500000001a3fd-197.dat	xmrig
behavioral1/memory/3032-450-0x000000013F3C0000-0x000000013F714000-memory.dmp	xmrig
behavioral1/memory/2952-386-0x000000013FEF0000-0x0000000140244000-memory.dmp	xmrig
behavioral1/memory/2412-282-0x000000013FDD0000-0x0000000140124000-memory.dmp	xmrig
behavioral1/memory/2608-242-0x000000013F6A0000-0x000000013F9F4000-memory.dmp	xmrig
behavioral1/memory/3032-224-0x000000013F6A0000-0x000000013F9F4000-memory.dmp	xmrig
behavioral1/memory/1500-205-0x000000013FC40000-0x000000013FF94000-memory.dmp	xmrig
behavioral1/files/0x000500000001a3f8-194.dat	xmrig
behavioral1/files/0x000500000001a3f6-189.dat	xmrig
behavioral1/files/0x000500000001a3ab-184.dat	xmrig
behavioral1/files/0x000500000001a309-179.dat	xmrig
behavioral1/files/0x000500000001a0b6-174.dat	xmrig
behavioral1/files/0x000500000001a049-169.dat	xmrig
behavioral1/files/0x000500000001a03c-164.dat	xmrig
behavioral1/files/0x0005000000019fdd-159.dat	xmrig
behavioral1/files/0x0005000000019fd4-154.dat	xmrig
behavioral1/files/0x0005000000019e92-149.dat	xmrig
behavioral1/files/0x0005000000019d6d-144.dat	xmrig
behavioral1/files/0x0005000000019d62-139.dat	xmrig
behavioral1/files/0x0005000000019d61-135.dat	xmrig
behavioral1/files/0x0005000000019bf9-124.dat	xmrig
behavioral1/files/0x0005000000019bf6-119.dat	xmrig
behavioral1/files/0x0005000000019bf5-115.dat	xmrig
behavioral1/memory/2908-111-0x000000013FC30000-0x000000013FF84000-memory.dmp	xmrig
behavioral1/memory/2412-97-0x000000013FDD0000-0x0000000140124000-memory.dmp	xmrig
behavioral1/memory/2952-106-0x000000013FEF0000-0x0000000140244000-memory.dmp	xmrig
behavioral1/memory/2508-105-0x000000013F890000-0x000000013FBE4000-memory.dmp	xmrig
behavioral1/files/0x0005000000019820-95.dat	xmrig
behavioral1/files/0x000500000001998d-103.dat	xmrig
behavioral1/memory/2688-88-0x000000013F870000-0x000000013FBC4000-memory.dmp	xmrig
behavioral1/memory/1500-80-0x000000013FC40000-0x000000013FF94000-memory.dmp	xmrig
behavioral1/memory/2724-79-0x000000013F880000-0x000000013FBD4000-memory.dmp	xmrig
behavioral1/files/0x0005000000019761-78.dat	xmrig
behavioral1/files/0x00050000000197fd-87.dat	xmrig
behavioral1/memory/3032-85-0x000000013F6A0000-0x000000013F9F4000-memory.dmp	xmrig
behavioral1/memory/2700-72-0x000000013FFB0000-0x0000000140304000-memory.dmp	xmrig
behavioral1/memory/2508-66-0x000000013F890000-0x000000013FBE4000-memory.dmp	xmrig
behavioral1/memory/2892-65-0x000000013F220000-0x000000013F574000-memory.dmp	xmrig
behavioral1/files/0x000600000001948c-64.dat	xmrig
behavioral1/files/0x0007000000018b54-46.dat	xmrig
behavioral1/files/0x0007000000018b59-53.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2168	pRtTxeX.exe
2860	nYNInWi.exe
2864	AzdxrHT.exe
2892	DpwoIRf.exe
2700	kcgcFhu.exe
2724	gbUUZTM.exe
2688	ecaAlLs.exe
2588	qGgnZBT.exe
2508	tprIhQG.exe
2908	ljRjpMO.exe
1500	ULHbMlB.exe
2608	PTsqAJk.exe
2412	FDLyYta.exe
2952	gSbBjOJ.exe
2208	NffDWUk.exe
2988	YiaUQFA.exe
1564	ulyAxHq.exe
2416	xvtZIvi.exe
1688	OxKdnQa.exe
780	KvkZUpB.exe
596	WfxzZiM.exe
2380	tyroizc.exe
2500	vtjWzCr.exe
2440	YTtnjve.exe
1840	hQLqVic.exe
1476	uTVVPFQ.exe
2392	MIKXayj.exe
1920	qsrftxF.exe
632	LtdhNMx.exe
908	YbjCQWz.exe
940	aWnPxvn.exe
772	oCtDjju.exe
1924	CGpRres.exe
1252	EhZdDzX.exe
1736	kCErGzy.exe
1964	nQCMgsF.exe
1864	bThGuaU.exe
2072	IsoPoNG.exe
2052	WdutnJN.exe
1648	DlsHHqy.exe
1692	KBRSdMC.exe
540	wIJtZYT.exe
1340	AgxHByL.exe
2156	eRTWPfN.exe
2492	ovrstun.exe
2316	tVGKlzE.exe
2252	PhLaEEL.exe
1440	ZomTKck.exe
1792	KkPptlM.exe
2604	UmydnQs.exe
2560	dQCXLBf.exe
1536	ocnoKgt.exe
2456	BgEvJvU.exe
2912	MzPKzsT.exe
2764	QYivKvv.exe
2676	PwNuukv.exe
2132	uJmtvvK.exe
1652	rdeAjbB.exe
2744	BbJUbaC.exe
2624	lFDZKIv.exe
3036	MQmypdM.exe
2776	EQQYjDN.exe
1756	riLBYme.exe
2408	cmDdHSQ.exe

Loads dropped DLL 64 IoCs

pid	Process
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3032-0-0x000000013FCF0000-0x0000000140044000-memory.dmp	upx
behavioral1/files/0x000d000000012263-3.dat	upx
behavioral1/files/0x00080000000186bb-12.dat	upx
behavioral1/files/0x00080000000186c3-9.dat	upx
behavioral1/memory/2168-10-0x000000013FA80000-0x000000013FDD4000-memory.dmp	upx
behavioral1/memory/2864-21-0x000000013F880000-0x000000013FBD4000-memory.dmp	upx
behavioral1/files/0x0008000000018b05-22.dat	upx
behavioral1/memory/2892-27-0x000000013F220000-0x000000013F574000-memory.dmp	upx
behavioral1/memory/2860-18-0x000000013F930000-0x000000013FC84000-memory.dmp	upx
behavioral1/memory/3032-37-0x000000013FCF0000-0x0000000140044000-memory.dmp	upx
behavioral1/files/0x001500000001756e-40.dat	upx
behavioral1/memory/2700-34-0x000000013FFB0000-0x0000000140304000-memory.dmp	upx
behavioral1/files/0x0007000000018b50-33.dat	upx
behavioral1/memory/2864-54-0x000000013F880000-0x000000013FBD4000-memory.dmp	upx
behavioral1/memory/2588-55-0x000000013F640000-0x000000013F994000-memory.dmp	upx
behavioral1/memory/2688-48-0x000000013F870000-0x000000013FBC4000-memory.dmp	upx
behavioral1/files/0x000500000001975a-68.dat	upx
behavioral1/memory/2908-73-0x000000013FC30000-0x000000013FF84000-memory.dmp	upx
behavioral1/memory/2608-89-0x000000013F6A0000-0x000000013F9F4000-memory.dmp	upx
behavioral1/memory/2588-96-0x000000013F640000-0x000000013F994000-memory.dmp	upx
behavioral1/files/0x0005000000019c3c-127.dat	upx
behavioral1/files/0x000500000001a3fd-197.dat	upx
behavioral1/memory/2952-386-0x000000013FEF0000-0x0000000140244000-memory.dmp	upx
behavioral1/memory/2412-282-0x000000013FDD0000-0x0000000140124000-memory.dmp	upx
behavioral1/memory/2608-242-0x000000013F6A0000-0x000000013F9F4000-memory.dmp	upx
behavioral1/memory/1500-205-0x000000013FC40000-0x000000013FF94000-memory.dmp	upx
behavioral1/files/0x000500000001a3f8-194.dat	upx
behavioral1/files/0x000500000001a3f6-189.dat	upx
behavioral1/files/0x000500000001a3ab-184.dat	upx
behavioral1/files/0x000500000001a309-179.dat	upx
behavioral1/files/0x000500000001a0b6-174.dat	upx
behavioral1/files/0x000500000001a049-169.dat	upx
behavioral1/files/0x000500000001a03c-164.dat	upx
behavioral1/files/0x0005000000019fdd-159.dat	upx
behavioral1/files/0x0005000000019fd4-154.dat	upx
behavioral1/files/0x0005000000019e92-149.dat	upx
behavioral1/files/0x0005000000019d6d-144.dat	upx
behavioral1/files/0x0005000000019d62-139.dat	upx
behavioral1/files/0x0005000000019d61-135.dat	upx
behavioral1/files/0x0005000000019bf9-124.dat	upx
behavioral1/files/0x0005000000019bf6-119.dat	upx
behavioral1/files/0x0005000000019bf5-115.dat	upx
behavioral1/memory/2908-111-0x000000013FC30000-0x000000013FF84000-memory.dmp	upx
behavioral1/memory/2412-97-0x000000013FDD0000-0x0000000140124000-memory.dmp	upx
behavioral1/memory/2952-106-0x000000013FEF0000-0x0000000140244000-memory.dmp	upx
behavioral1/memory/2508-105-0x000000013F890000-0x000000013FBE4000-memory.dmp	upx
behavioral1/files/0x0005000000019820-95.dat	upx
behavioral1/files/0x000500000001998d-103.dat	upx
behavioral1/memory/2688-88-0x000000013F870000-0x000000013FBC4000-memory.dmp	upx
behavioral1/memory/1500-80-0x000000013FC40000-0x000000013FF94000-memory.dmp	upx
behavioral1/memory/2724-79-0x000000013F880000-0x000000013FBD4000-memory.dmp	upx
behavioral1/files/0x0005000000019761-78.dat	upx
behavioral1/files/0x00050000000197fd-87.dat	upx
behavioral1/memory/2700-72-0x000000013FFB0000-0x0000000140304000-memory.dmp	upx
behavioral1/memory/2508-66-0x000000013F890000-0x000000013FBE4000-memory.dmp	upx
behavioral1/memory/2892-65-0x000000013F220000-0x000000013F574000-memory.dmp	upx
behavioral1/files/0x000600000001948c-64.dat	upx
behavioral1/files/0x0007000000018b54-46.dat	upx
behavioral1/files/0x0007000000018b59-53.dat	upx
behavioral1/memory/2168-38-0x000000013FA80000-0x000000013FDD4000-memory.dmp	upx
behavioral1/memory/2860-1573-0x000000013F930000-0x000000013FC84000-memory.dmp	upx
behavioral1/memory/2892-1727-0x000000013F220000-0x000000013F574000-memory.dmp	upx
behavioral1/memory/2608-1724-0x000000013F6A0000-0x000000013F9F4000-memory.dmp	upx
behavioral1/memory/2952-1733-0x000000013FEF0000-0x0000000140244000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jZqwyaz.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\MyXbukd.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\ojjhLpe.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\FRZiyuJ.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\xjhlzOc.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\pkLgimv.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\ZnjjVfX.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\qfRVpkr.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\XecLBlb.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\QAHbIES.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\esSYiCS.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\YPAvlhh.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\VRyNUtW.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\OQQBRRa.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\lTaLiUv.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\tDIcdYu.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\NkwhBpZ.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\cbELMqB.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\JbstBVG.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\pbShhio.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\fFbbQTH.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\KerKoQA.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\tQuLlkh.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\HEAyLHu.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\pKlwumd.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\GfpqGmk.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\vmHGdAd.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\NEzIzTm.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\pLHwbdI.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\PYlVOAE.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\oSWiOJk.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\rSeHUHN.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\oqTVcTg.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\qqJiirq.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\HCLafjf.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\EZPSnjZ.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\tprIhQG.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\XAJhDtQ.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\rwrTpZL.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\ieTjkVU.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\QCruAjD.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\jWwHRTN.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\CGILgGf.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\xSRhFmV.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\wlTCNOh.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\fIunKPK.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\yroTwbL.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\oLloKxH.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\gdHfzsI.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\sfkZcZN.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\CbLidZm.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\EbacISc.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\SfGPlgm.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\RczJXll.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\jOfLUJI.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\KQmwAeJ.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\fTSPKLV.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\xgilzGD.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\GOYabEa.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\uDycNIQ.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\qYoPjNE.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\kYFSwoB.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\ZmeYxmF.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
File created	C:\Windows\System\eCipMLT.exe	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2168	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	31
PID 3032 wrote to memory of 2168	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	31
PID 3032 wrote to memory of 2168	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	31
PID 3032 wrote to memory of 2860	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	32
PID 3032 wrote to memory of 2860	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	32
PID 3032 wrote to memory of 2860	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	32
PID 3032 wrote to memory of 2864	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	33
PID 3032 wrote to memory of 2864	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	33
PID 3032 wrote to memory of 2864	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	33
PID 3032 wrote to memory of 2892	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	34
PID 3032 wrote to memory of 2892	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	34
PID 3032 wrote to memory of 2892	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	34
PID 3032 wrote to memory of 2700	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	35
PID 3032 wrote to memory of 2700	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	35
PID 3032 wrote to memory of 2700	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	35
PID 3032 wrote to memory of 2724	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	36
PID 3032 wrote to memory of 2724	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	36
PID 3032 wrote to memory of 2724	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	36
PID 3032 wrote to memory of 2688	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	37
PID 3032 wrote to memory of 2688	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	37
PID 3032 wrote to memory of 2688	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	37
PID 3032 wrote to memory of 2588	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	38
PID 3032 wrote to memory of 2588	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	38
PID 3032 wrote to memory of 2588	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	38
PID 3032 wrote to memory of 2508	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	39
PID 3032 wrote to memory of 2508	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	39
PID 3032 wrote to memory of 2508	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	39
PID 3032 wrote to memory of 2908	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	40
PID 3032 wrote to memory of 2908	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	40
PID 3032 wrote to memory of 2908	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	40
PID 3032 wrote to memory of 1500	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	41
PID 3032 wrote to memory of 1500	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	41
PID 3032 wrote to memory of 1500	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	41
PID 3032 wrote to memory of 2608	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	42
PID 3032 wrote to memory of 2608	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	42
PID 3032 wrote to memory of 2608	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	42
PID 3032 wrote to memory of 2412	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	43
PID 3032 wrote to memory of 2412	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	43
PID 3032 wrote to memory of 2412	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	43
PID 3032 wrote to memory of 2952	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	44
PID 3032 wrote to memory of 2952	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	44
PID 3032 wrote to memory of 2952	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	44
PID 3032 wrote to memory of 2208	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	45
PID 3032 wrote to memory of 2208	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	45
PID 3032 wrote to memory of 2208	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	45
PID 3032 wrote to memory of 2988	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	46
PID 3032 wrote to memory of 2988	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	46
PID 3032 wrote to memory of 2988	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	46
PID 3032 wrote to memory of 1564	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	47
PID 3032 wrote to memory of 1564	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	47
PID 3032 wrote to memory of 1564	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	47
PID 3032 wrote to memory of 2416	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	48
PID 3032 wrote to memory of 2416	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	48
PID 3032 wrote to memory of 2416	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	48
PID 3032 wrote to memory of 1688	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	49
PID 3032 wrote to memory of 1688	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	49
PID 3032 wrote to memory of 1688	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	49
PID 3032 wrote to memory of 780	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	50
PID 3032 wrote to memory of 780	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	50
PID 3032 wrote to memory of 780	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	50
PID 3032 wrote to memory of 596	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	51
PID 3032 wrote to memory of 596	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	51
PID 3032 wrote to memory of 596	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	51
PID 3032 wrote to memory of 2380	3032	JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe	52

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c6b5a8900a142ff4f15b3b827c408f0daae728c7403c13c84fcdc8c94f0fd7b6.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\System\pRtTxeX.exe
  C:\Windows\System\pRtTxeX.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\nYNInWi.exe
  C:\Windows\System\nYNInWi.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\AzdxrHT.exe
  C:\Windows\System\AzdxrHT.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\DpwoIRf.exe
  C:\Windows\System\DpwoIRf.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\kcgcFhu.exe
  C:\Windows\System\kcgcFhu.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\gbUUZTM.exe
  C:\Windows\System\gbUUZTM.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\ecaAlLs.exe
  C:\Windows\System\ecaAlLs.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\qGgnZBT.exe
  C:\Windows\System\qGgnZBT.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\tprIhQG.exe
  C:\Windows\System\tprIhQG.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\ljRjpMO.exe
  C:\Windows\System\ljRjpMO.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\ULHbMlB.exe
  C:\Windows\System\ULHbMlB.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\PTsqAJk.exe
  C:\Windows\System\PTsqAJk.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\FDLyYta.exe
  C:\Windows\System\FDLyYta.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\gSbBjOJ.exe
  C:\Windows\System\gSbBjOJ.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\NffDWUk.exe
  C:\Windows\System\NffDWUk.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\YiaUQFA.exe
  C:\Windows\System\YiaUQFA.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\ulyAxHq.exe
  C:\Windows\System\ulyAxHq.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\xvtZIvi.exe
  C:\Windows\System\xvtZIvi.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\OxKdnQa.exe
  C:\Windows\System\OxKdnQa.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\KvkZUpB.exe
  C:\Windows\System\KvkZUpB.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\WfxzZiM.exe
  C:\Windows\System\WfxzZiM.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\tyroizc.exe
  C:\Windows\System\tyroizc.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\vtjWzCr.exe
  C:\Windows\System\vtjWzCr.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\YTtnjve.exe
  C:\Windows\System\YTtnjve.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\hQLqVic.exe
  C:\Windows\System\hQLqVic.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\uTVVPFQ.exe
  C:\Windows\System\uTVVPFQ.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\MIKXayj.exe
  C:\Windows\System\MIKXayj.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\qsrftxF.exe
  C:\Windows\System\qsrftxF.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\LtdhNMx.exe
  C:\Windows\System\LtdhNMx.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\YbjCQWz.exe
  C:\Windows\System\YbjCQWz.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\aWnPxvn.exe
  C:\Windows\System\aWnPxvn.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\oCtDjju.exe
  C:\Windows\System\oCtDjju.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\CGpRres.exe
  C:\Windows\System\CGpRres.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\EhZdDzX.exe
  C:\Windows\System\EhZdDzX.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\kCErGzy.exe
  C:\Windows\System\kCErGzy.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\nQCMgsF.exe
  C:\Windows\System\nQCMgsF.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\bThGuaU.exe
  C:\Windows\System\bThGuaU.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\IsoPoNG.exe
  C:\Windows\System\IsoPoNG.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\WdutnJN.exe
  C:\Windows\System\WdutnJN.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\DlsHHqy.exe
  C:\Windows\System\DlsHHqy.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\KBRSdMC.exe
  C:\Windows\System\KBRSdMC.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\wIJtZYT.exe
  C:\Windows\System\wIJtZYT.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\AgxHByL.exe
  C:\Windows\System\AgxHByL.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\eRTWPfN.exe
  C:\Windows\System\eRTWPfN.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\ovrstun.exe
  C:\Windows\System\ovrstun.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\tVGKlzE.exe
  C:\Windows\System\tVGKlzE.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\PhLaEEL.exe
  C:\Windows\System\PhLaEEL.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\ZomTKck.exe
  C:\Windows\System\ZomTKck.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\KkPptlM.exe
  C:\Windows\System\KkPptlM.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\UmydnQs.exe
  C:\Windows\System\UmydnQs.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\dQCXLBf.exe
  C:\Windows\System\dQCXLBf.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\ocnoKgt.exe
  C:\Windows\System\ocnoKgt.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\BgEvJvU.exe
  C:\Windows\System\BgEvJvU.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\MzPKzsT.exe
  C:\Windows\System\MzPKzsT.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\QYivKvv.exe
  C:\Windows\System\QYivKvv.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\PwNuukv.exe
  C:\Windows\System\PwNuukv.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\uJmtvvK.exe
  C:\Windows\System\uJmtvvK.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\rdeAjbB.exe
  C:\Windows\System\rdeAjbB.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\BbJUbaC.exe
  C:\Windows\System\BbJUbaC.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\lFDZKIv.exe
  C:\Windows\System\lFDZKIv.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\MQmypdM.exe
  C:\Windows\System\MQmypdM.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\EQQYjDN.exe
  C:\Windows\System\EQQYjDN.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\riLBYme.exe
  C:\Windows\System\riLBYme.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\cmDdHSQ.exe
  C:\Windows\System\cmDdHSQ.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\SfsiGEj.exe
  C:\Windows\System\SfsiGEj.exe
  2⤵
  PID:524
- C:\Windows\System\CrzMbBe.exe
  C:\Windows\System\CrzMbBe.exe
  2⤵
  PID:1844
- C:\Windows\System\VrBsNcb.exe
  C:\Windows\System\VrBsNcb.exe
  2⤵
  PID:1944
- C:\Windows\System\cKliMVN.exe
  C:\Windows\System\cKliMVN.exe
  2⤵
  PID:2360
- C:\Windows\System\LXrJAjz.exe
  C:\Windows\System\LXrJAjz.exe
  2⤵
  PID:1264
- C:\Windows\System\ksVhABS.exe
  C:\Windows\System\ksVhABS.exe
  2⤵
  PID:2104
- C:\Windows\System\ZxjkJQy.exe
  C:\Windows\System\ZxjkJQy.exe
  2⤵
  PID:988
- C:\Windows\System\nfIIdWy.exe
  C:\Windows\System\nfIIdWy.exe
  2⤵
  PID:1376
- C:\Windows\System\Prmcyrm.exe
  C:\Windows\System\Prmcyrm.exe
  2⤵
  PID:1712
- C:\Windows\System\kfMyzlj.exe
  C:\Windows\System\kfMyzlj.exe
  2⤵
  PID:2232
- C:\Windows\System\vjkVqQi.exe
  C:\Windows\System\vjkVqQi.exe
  2⤵
  PID:1880
- C:\Windows\System\sxCsBiP.exe
  C:\Windows\System\sxCsBiP.exe
  2⤵
  PID:3040
- C:\Windows\System\cyCJykr.exe
  C:\Windows\System\cyCJykr.exe
  2⤵
  PID:1708
- C:\Windows\System\IFzthwS.exe
  C:\Windows\System\IFzthwS.exe
  2⤵
  PID:2284
- C:\Windows\System\rNuyndV.exe
  C:\Windows\System\rNuyndV.exe
  2⤵
  PID:1776
- C:\Windows\System\QiFOySX.exe
  C:\Windows\System\QiFOySX.exe
  2⤵
  PID:880
- C:\Windows\System\EwbIIcJ.exe
  C:\Windows\System\EwbIIcJ.exe
  2⤵
  PID:1436
- C:\Windows\System\KoSNWkK.exe
  C:\Windows\System\KoSNWkK.exe
  2⤵
  PID:1580
- C:\Windows\System\rWWZGsf.exe
  C:\Windows\System\rWWZGsf.exe
  2⤵
  PID:1528
- C:\Windows\System\vLFVPSk.exe
  C:\Windows\System\vLFVPSk.exe
  2⤵
  PID:1532
- C:\Windows\System\SYBqedv.exe
  C:\Windows\System\SYBqedv.exe
  2⤵
  PID:2824
- C:\Windows\System\WfKqrUZ.exe
  C:\Windows\System\WfKqrUZ.exe
  2⤵
  PID:2060
- C:\Windows\System\fHIlmne.exe
  C:\Windows\System\fHIlmne.exe
  2⤵
  PID:2020
- C:\Windows\System\SXTTiFd.exe
  C:\Windows\System\SXTTiFd.exe
  2⤵
  PID:2188
- C:\Windows\System\pQJfoRk.exe
  C:\Windows\System\pQJfoRk.exe
  2⤵
  PID:3000
- C:\Windows\System\sfkZcZN.exe
  C:\Windows\System\sfkZcZN.exe
  2⤵
  PID:2212
- C:\Windows\System\RJPVXHg.exe
  C:\Windows\System\RJPVXHg.exe
  2⤵
  PID:2488
- C:\Windows\System\JLVftaI.exe
  C:\Windows\System\JLVftaI.exe
  2⤵
  PID:2452
- C:\Windows\System\srDrVku.exe
  C:\Windows\System\srDrVku.exe
  2⤵
  PID:3084
- C:\Windows\System\CfyAQVo.exe
  C:\Windows\System\CfyAQVo.exe
  2⤵
  PID:3104
- C:\Windows\System\ptoTcyP.exe
  C:\Windows\System\ptoTcyP.exe
  2⤵
  PID:3124
- C:\Windows\System\oAGAvss.exe
  C:\Windows\System\oAGAvss.exe
  2⤵
  PID:3144
- C:\Windows\System\TUrbNUg.exe
  C:\Windows\System\TUrbNUg.exe
  2⤵
  PID:3164
- C:\Windows\System\VPPGFYw.exe
  C:\Windows\System\VPPGFYw.exe
  2⤵
  PID:3184
- C:\Windows\System\XZTHWxy.exe
  C:\Windows\System\XZTHWxy.exe
  2⤵
  PID:3204
- C:\Windows\System\WFhZZYb.exe
  C:\Windows\System\WFhZZYb.exe
  2⤵
  PID:3224
- C:\Windows\System\akRFOLL.exe
  C:\Windows\System\akRFOLL.exe
  2⤵
  PID:3244
- C:\Windows\System\EXwLdsc.exe
  C:\Windows\System\EXwLdsc.exe
  2⤵
  PID:3264
- C:\Windows\System\zLYzKph.exe
  C:\Windows\System\zLYzKph.exe
  2⤵
  PID:3284
- C:\Windows\System\ZGrJPgH.exe
  C:\Windows\System\ZGrJPgH.exe
  2⤵
  PID:3304
- C:\Windows\System\yJVbQdY.exe
  C:\Windows\System\yJVbQdY.exe
  2⤵
  PID:3324
- C:\Windows\System\qlJnYYq.exe
  C:\Windows\System\qlJnYYq.exe
  2⤵
  PID:3344
- C:\Windows\System\CvLPvQr.exe
  C:\Windows\System\CvLPvQr.exe
  2⤵
  PID:3364
- C:\Windows\System\xntlbqT.exe
  C:\Windows\System\xntlbqT.exe
  2⤵
  PID:3380
- C:\Windows\System\tiictzV.exe
  C:\Windows\System\tiictzV.exe
  2⤵
  PID:3400
- C:\Windows\System\UdaMyYn.exe
  C:\Windows\System\UdaMyYn.exe
  2⤵
  PID:3424
- C:\Windows\System\ZjFRipX.exe
  C:\Windows\System\ZjFRipX.exe
  2⤵
  PID:3444
- C:\Windows\System\xanwMsO.exe
  C:\Windows\System\xanwMsO.exe
  2⤵
  PID:3464
- C:\Windows\System\AmrhRPe.exe
  C:\Windows\System\AmrhRPe.exe
  2⤵
  PID:3484
- C:\Windows\System\annhkaw.exe
  C:\Windows\System\annhkaw.exe
  2⤵
  PID:3512
- C:\Windows\System\DsiYQWc.exe
  C:\Windows\System\DsiYQWc.exe
  2⤵
  PID:3532
- C:\Windows\System\tLKQvJn.exe
  C:\Windows\System\tLKQvJn.exe
  2⤵
  PID:3552
- C:\Windows\System\EXaxKsS.exe
  C:\Windows\System\EXaxKsS.exe
  2⤵
  PID:3572
- C:\Windows\System\qHNzdhX.exe
  C:\Windows\System\qHNzdhX.exe
  2⤵
  PID:3588
- C:\Windows\System\svEMvCX.exe
  C:\Windows\System\svEMvCX.exe
  2⤵
  PID:3612
- C:\Windows\System\DsPjnzK.exe
  C:\Windows\System\DsPjnzK.exe
  2⤵
  PID:3632
- C:\Windows\System\wydcZAw.exe
  C:\Windows\System\wydcZAw.exe
  2⤵
  PID:3652
- C:\Windows\System\oqmvtDR.exe
  C:\Windows\System\oqmvtDR.exe
  2⤵
  PID:3672
- C:\Windows\System\KSMNJWv.exe
  C:\Windows\System\KSMNJWv.exe
  2⤵
  PID:3688
- C:\Windows\System\SFJhlrA.exe
  C:\Windows\System\SFJhlrA.exe
  2⤵
  PID:3712
- C:\Windows\System\iOYJrKl.exe
  C:\Windows\System\iOYJrKl.exe
  2⤵
  PID:3732
- C:\Windows\System\EiYDqEr.exe
  C:\Windows\System\EiYDqEr.exe
  2⤵
  PID:3748
- C:\Windows\System\nkLllNJ.exe
  C:\Windows\System\nkLllNJ.exe
  2⤵
  PID:3772
- C:\Windows\System\QCysHeB.exe
  C:\Windows\System\QCysHeB.exe
  2⤵
  PID:3792
- C:\Windows\System\HcwIlPr.exe
  C:\Windows\System\HcwIlPr.exe
  2⤵
  PID:3812
- C:\Windows\System\UBJmUiQ.exe
  C:\Windows\System\UBJmUiQ.exe
  2⤵
  PID:3828
- C:\Windows\System\xWsMIzY.exe
  C:\Windows\System\xWsMIzY.exe
  2⤵
  PID:3852
- C:\Windows\System\DWjDvhe.exe
  C:\Windows\System\DWjDvhe.exe
  2⤵
  PID:3872
- C:\Windows\System\pelHkLx.exe
  C:\Windows\System\pelHkLx.exe
  2⤵
  PID:3892
- C:\Windows\System\YCYZOME.exe
  C:\Windows\System\YCYZOME.exe
  2⤵
  PID:3912
- C:\Windows\System\szqMvyg.exe
  C:\Windows\System\szqMvyg.exe
  2⤵
  PID:3936
- C:\Windows\System\asPXnFU.exe
  C:\Windows\System\asPXnFU.exe
  2⤵
  PID:3952
- C:\Windows\System\mIHmVvq.exe
  C:\Windows\System\mIHmVvq.exe
  2⤵
  PID:3968
- C:\Windows\System\RrCnKxJ.exe
  C:\Windows\System\RrCnKxJ.exe
  2⤵
  PID:3992
- C:\Windows\System\YMIndNh.exe
  C:\Windows\System\YMIndNh.exe
  2⤵
  PID:4012
- C:\Windows\System\iIZEZfK.exe
  C:\Windows\System\iIZEZfK.exe
  2⤵
  PID:4036
- C:\Windows\System\aMZRdha.exe
  C:\Windows\System\aMZRdha.exe
  2⤵
  PID:4056
- C:\Windows\System\ZyMQNzu.exe
  C:\Windows\System\ZyMQNzu.exe
  2⤵
  PID:4072
- C:\Windows\System\dKbBbhN.exe
  C:\Windows\System\dKbBbhN.exe
  2⤵
  PID:4092
- C:\Windows\System\fJUVxQw.exe
  C:\Windows\System\fJUVxQw.exe
  2⤵
  PID:1956
- C:\Windows\System\OtKDVJg.exe
  C:\Windows\System\OtKDVJg.exe
  2⤵
  PID:2520
- C:\Windows\System\xiTtVCf.exe
  C:\Windows\System\xiTtVCf.exe
  2⤵
  PID:1700
- C:\Windows\System\nzOiRXy.exe
  C:\Windows\System\nzOiRXy.exe
  2⤵
  PID:1872
- C:\Windows\System\ZFzddXC.exe
  C:\Windows\System\ZFzddXC.exe
  2⤵
  PID:2092
- C:\Windows\System\kEpyzWs.exe
  C:\Windows\System\kEpyzWs.exe
  2⤵
  PID:1480
- C:\Windows\System\bNHTSKl.exe
  C:\Windows\System\bNHTSKl.exe
  2⤵
  PID:1048
- C:\Windows\System\hAuzndM.exe
  C:\Windows\System\hAuzndM.exe
  2⤵
  PID:108
- C:\Windows\System\EftReqa.exe
  C:\Windows\System\EftReqa.exe
  2⤵
  PID:896
- C:\Windows\System\WCdjqJw.exe
  C:\Windows\System\WCdjqJw.exe
  2⤵
  PID:2080
- C:\Windows\System\EvyKWIv.exe
  C:\Windows\System\EvyKWIv.exe
  2⤵
  PID:1508
- C:\Windows\System\dxrAtDY.exe
  C:\Windows\System\dxrAtDY.exe
  2⤵
  PID:2628
- C:\Windows\System\BsIFTzj.exe
  C:\Windows\System\BsIFTzj.exe
  2⤵
  PID:1280
- C:\Windows\System\MQpypTp.exe
  C:\Windows\System\MQpypTp.exe
  2⤵
  PID:2436
- C:\Windows\System\JuHBzcY.exe
  C:\Windows\System\JuHBzcY.exe
  2⤵
  PID:3112
- C:\Windows\System\xGnySGO.exe
  C:\Windows\System\xGnySGO.exe
  2⤵
  PID:3092
- C:\Windows\System\sRfaHEQ.exe
  C:\Windows\System\sRfaHEQ.exe
  2⤵
  PID:3140
- C:\Windows\System\QLrBCLr.exe
  C:\Windows\System\QLrBCLr.exe
  2⤵
  PID:3192
- C:\Windows\System\QONwgmD.exe
  C:\Windows\System\QONwgmD.exe
  2⤵
  PID:3176
- C:\Windows\System\NJWjkKc.exe
  C:\Windows\System\NJWjkKc.exe
  2⤵
  PID:3240
- C:\Windows\System\FXqapAc.exe
  C:\Windows\System\FXqapAc.exe
  2⤵
  PID:3320
- C:\Windows\System\DtBKLuI.exe
  C:\Windows\System\DtBKLuI.exe
  2⤵
  PID:3316
- C:\Windows\System\sYtjoyt.exe
  C:\Windows\System\sYtjoyt.exe
  2⤵
  PID:3388
- C:\Windows\System\VWgFUQB.exe
  C:\Windows\System\VWgFUQB.exe
  2⤵
  PID:3396
- C:\Windows\System\KHOgHEJ.exe
  C:\Windows\System\KHOgHEJ.exe
  2⤵
  PID:3472
- C:\Windows\System\PDjDvju.exe
  C:\Windows\System\PDjDvju.exe
  2⤵
  PID:3408
- C:\Windows\System\mztfqHj.exe
  C:\Windows\System\mztfqHj.exe
  2⤵
  PID:3456
- C:\Windows\System\GaaNqFR.exe
  C:\Windows\System\GaaNqFR.exe
  2⤵
  PID:3560
- C:\Windows\System\VvqfyxP.exe
  C:\Windows\System\VvqfyxP.exe
  2⤵
  PID:3540
- C:\Windows\System\Qhxwuhx.exe
  C:\Windows\System\Qhxwuhx.exe
  2⤵
  PID:3608
- C:\Windows\System\johRyll.exe
  C:\Windows\System\johRyll.exe
  2⤵
  PID:3640
- C:\Windows\System\ofIGLSX.exe
  C:\Windows\System\ofIGLSX.exe
  2⤵
  PID:3720
- C:\Windows\System\KsXyIym.exe
  C:\Windows\System\KsXyIym.exe
  2⤵
  PID:3620
- C:\Windows\System\XetbrYd.exe
  C:\Windows\System\XetbrYd.exe
  2⤵
  PID:3808
- C:\Windows\System\LpIGtWu.exe
  C:\Windows\System\LpIGtWu.exe
  2⤵
  PID:3848
- C:\Windows\System\tNGFiyI.exe
  C:\Windows\System\tNGFiyI.exe
  2⤵
  PID:3696
- C:\Windows\System\vpgQfSt.exe
  C:\Windows\System\vpgQfSt.exe
  2⤵
  PID:3744
- C:\Windows\System\ahMULgF.exe
  C:\Windows\System\ahMULgF.exe
  2⤵
  PID:3824
- C:\Windows\System\btFMWzP.exe
  C:\Windows\System\btFMWzP.exe
  2⤵
  PID:3860
- C:\Windows\System\rMvfMuz.exe
  C:\Windows\System\rMvfMuz.exe
  2⤵
  PID:3960
- C:\Windows\System\BEhOpRU.exe
  C:\Windows\System\BEhOpRU.exe
  2⤵
  PID:3900
- C:\Windows\System\ntmCaCZ.exe
  C:\Windows\System\ntmCaCZ.exe
  2⤵
  PID:3948
- C:\Windows\System\nQSXrcH.exe
  C:\Windows\System\nQSXrcH.exe
  2⤵
  PID:4052
- C:\Windows\System\BwSOnxh.exe
  C:\Windows\System\BwSOnxh.exe
  2⤵
  PID:4080
- C:\Windows\System\ULtlPWl.exe
  C:\Windows\System\ULtlPWl.exe
  2⤵
  PID:964
- C:\Windows\System\XHOAiSd.exe
  C:\Windows\System\XHOAiSd.exe
  2⤵
  PID:1848
- C:\Windows\System\VRyNUtW.exe
  C:\Windows\System\VRyNUtW.exe
  2⤵
  PID:2600
- C:\Windows\System\DANHEpl.exe
  C:\Windows\System\DANHEpl.exe
  2⤵
  PID:3064
- C:\Windows\System\vyVMPlj.exe
  C:\Windows\System\vyVMPlj.exe
  2⤵
  PID:1408
- C:\Windows\System\FyfmzJm.exe
  C:\Windows\System\FyfmzJm.exe
  2⤵
  PID:2140
- C:\Windows\System\UUXpJWX.exe
  C:\Windows\System\UUXpJWX.exe
  2⤵
  PID:2128
- C:\Windows\System\keuxcYL.exe
  C:\Windows\System\keuxcYL.exe
  2⤵
  PID:1548
- C:\Windows\System\ucLrcRn.exe
  C:\Windows\System\ucLrcRn.exe
  2⤵
  PID:2484
- C:\Windows\System\JRKOFJN.exe
  C:\Windows\System\JRKOFJN.exe
  2⤵
  PID:3156
- C:\Windows\System\hyYouXF.exe
  C:\Windows\System\hyYouXF.exe
  2⤵
  PID:764
- C:\Windows\System\ksuIovK.exe
  C:\Windows\System\ksuIovK.exe
  2⤵
  PID:3100
- C:\Windows\System\QZxWNyK.exe
  C:\Windows\System\QZxWNyK.exe
  2⤵
  PID:3256
- C:\Windows\System\pKlwumd.exe
  C:\Windows\System\pKlwumd.exe
  2⤵
  PID:3312
- C:\Windows\System\VzIulXp.exe
  C:\Windows\System\VzIulXp.exe
  2⤵
  PID:3336
- C:\Windows\System\AlQLwIa.exe
  C:\Windows\System\AlQLwIa.exe
  2⤵
  PID:3356
- C:\Windows\System\IRXALwF.exe
  C:\Windows\System\IRXALwF.exe
  2⤵
  PID:3436
- C:\Windows\System\uXnykRz.exe
  C:\Windows\System\uXnykRz.exe
  2⤵
  PID:3412
- C:\Windows\System\mKjmMGD.exe
  C:\Windows\System\mKjmMGD.exe
  2⤵
  PID:3496
- C:\Windows\System\FRZiyuJ.exe
  C:\Windows\System\FRZiyuJ.exe
  2⤵
  PID:3680
- C:\Windows\System\spmaRFj.exe
  C:\Windows\System\spmaRFj.exe
  2⤵
  PID:3756
- C:\Windows\System\xofpJrO.exe
  C:\Windows\System\xofpJrO.exe
  2⤵
  PID:3664
- C:\Windows\System\jAEHQfW.exe
  C:\Windows\System\jAEHQfW.exe
  2⤵
  PID:3820
- C:\Windows\System\JoRFJcC.exe
  C:\Windows\System\JoRFJcC.exe
  2⤵
  PID:3740
- C:\Windows\System\riQsCds.exe
  C:\Windows\System\riQsCds.exe
  2⤵
  PID:3924
- C:\Windows\System\qNJAdAK.exe
  C:\Windows\System\qNJAdAK.exe
  2⤵
  PID:4000
- C:\Windows\System\KuWeUwB.exe
  C:\Windows\System\KuWeUwB.exe
  2⤵
  PID:4028
- C:\Windows\System\nGCMamh.exe
  C:\Windows\System\nGCMamh.exe
  2⤵
  PID:2460
- C:\Windows\System\nzrUqIw.exe
  C:\Windows\System\nzrUqIw.exe
  2⤵
  PID:1608
- C:\Windows\System\MzDzKNT.exe
  C:\Windows\System\MzDzKNT.exe
  2⤵
  PID:1744
- C:\Windows\System\KjwoMoI.exe
  C:\Windows\System\KjwoMoI.exe
  2⤵
  PID:2056
- C:\Windows\System\HqnEDxN.exe
  C:\Windows\System\HqnEDxN.exe
  2⤵
  PID:2112
- C:\Windows\System\tikjUAN.exe
  C:\Windows\System\tikjUAN.exe
  2⤵
  PID:2804
- C:\Windows\System\muaTSYB.exe
  C:\Windows\System\muaTSYB.exe
  2⤵
  PID:1300
- C:\Windows\System\FzKFpnk.exe
  C:\Windows\System\FzKFpnk.exe
  2⤵
  PID:3120
- C:\Windows\System\lKUUGSt.exe
  C:\Windows\System\lKUUGSt.exe
  2⤵
  PID:3116
- C:\Windows\System\KXbxDRB.exe
  C:\Windows\System\KXbxDRB.exe
  2⤵
  PID:3216
- C:\Windows\System\qJwChZO.exe
  C:\Windows\System\qJwChZO.exe
  2⤵
  PID:3180
- C:\Windows\System\JEOvIaj.exe
  C:\Windows\System\JEOvIaj.exe
  2⤵
  PID:3196
- C:\Windows\System\xNkEuIE.exe
  C:\Windows\System\xNkEuIE.exe
  2⤵
  PID:3260
- C:\Windows\System\cUpVfMM.exe
  C:\Windows\System\cUpVfMM.exe
  2⤵
  PID:3332
- C:\Windows\System\rmVcUoj.exe
  C:\Windows\System\rmVcUoj.exe
  2⤵
  PID:4116
- C:\Windows\System\OQQBRRa.exe
  C:\Windows\System\OQQBRRa.exe
  2⤵
  PID:4132
- C:\Windows\System\zIdtkcs.exe
  C:\Windows\System\zIdtkcs.exe
  2⤵
  PID:4148
- C:\Windows\System\BMEdfuw.exe
  C:\Windows\System\BMEdfuw.exe
  2⤵
  PID:4164
- C:\Windows\System\BXmOrBL.exe
  C:\Windows\System\BXmOrBL.exe
  2⤵
  PID:4180
- C:\Windows\System\BtJwqwW.exe
  C:\Windows\System\BtJwqwW.exe
  2⤵
  PID:4196
- C:\Windows\System\ldgPNPk.exe
  C:\Windows\System\ldgPNPk.exe
  2⤵
  PID:4212
- C:\Windows\System\pekkogA.exe
  C:\Windows\System\pekkogA.exe
  2⤵
  PID:4228
- C:\Windows\System\STPqvdn.exe
  C:\Windows\System\STPqvdn.exe
  2⤵
  PID:4244
- C:\Windows\System\iclQEHz.exe
  C:\Windows\System\iclQEHz.exe
  2⤵
  PID:4260
- C:\Windows\System\zcRXHfr.exe
  C:\Windows\System\zcRXHfr.exe
  2⤵
  PID:4276
- C:\Windows\System\LVIZgqo.exe
  C:\Windows\System\LVIZgqo.exe
  2⤵
  PID:4292
- C:\Windows\System\GIIhwZX.exe
  C:\Windows\System\GIIhwZX.exe
  2⤵
  PID:4308
- C:\Windows\System\ubotTAi.exe
  C:\Windows\System\ubotTAi.exe
  2⤵
  PID:4324
- C:\Windows\System\kWZsscN.exe
  C:\Windows\System\kWZsscN.exe
  2⤵
  PID:4340
- C:\Windows\System\qkfCJvL.exe
  C:\Windows\System\qkfCJvL.exe
  2⤵
  PID:4356
- C:\Windows\System\zUNEtyq.exe
  C:\Windows\System\zUNEtyq.exe
  2⤵
  PID:4372
- C:\Windows\System\axSjBRj.exe
  C:\Windows\System\axSjBRj.exe
  2⤵
  PID:4388
- C:\Windows\System\cwzCjeH.exe
  C:\Windows\System\cwzCjeH.exe
  2⤵
  PID:4404
- C:\Windows\System\GQmxwgb.exe
  C:\Windows\System\GQmxwgb.exe
  2⤵
  PID:4420
- C:\Windows\System\njAHxYn.exe
  C:\Windows\System\njAHxYn.exe
  2⤵
  PID:4436
- C:\Windows\System\VeaLRYe.exe
  C:\Windows\System\VeaLRYe.exe
  2⤵
  PID:4456
- C:\Windows\System\nDcBZKx.exe
  C:\Windows\System\nDcBZKx.exe
  2⤵
  PID:4472
- C:\Windows\System\nzSpLVp.exe
  C:\Windows\System\nzSpLVp.exe
  2⤵
  PID:4488
- C:\Windows\System\nlvZugi.exe
  C:\Windows\System\nlvZugi.exe
  2⤵
  PID:4504
- C:\Windows\System\DghvVuA.exe
  C:\Windows\System\DghvVuA.exe
  2⤵
  PID:4520
- C:\Windows\System\vPNBZpX.exe
  C:\Windows\System\vPNBZpX.exe
  2⤵
  PID:4536
- C:\Windows\System\oOHeMRD.exe
  C:\Windows\System\oOHeMRD.exe
  2⤵
  PID:4564
- C:\Windows\System\QTrrwch.exe
  C:\Windows\System\QTrrwch.exe
  2⤵
  PID:4580
- C:\Windows\System\TzAEHrM.exe
  C:\Windows\System\TzAEHrM.exe
  2⤵
  PID:4596
- C:\Windows\System\eLULNIr.exe
  C:\Windows\System\eLULNIr.exe
  2⤵
  PID:4612
- C:\Windows\System\qMMDYRg.exe
  C:\Windows\System\qMMDYRg.exe
  2⤵
  PID:4628
- C:\Windows\System\BgUuTqi.exe
  C:\Windows\System\BgUuTqi.exe
  2⤵
  PID:4644
- C:\Windows\System\bltqFOZ.exe
  C:\Windows\System\bltqFOZ.exe
  2⤵
  PID:4660
- C:\Windows\System\ZDsGEZM.exe
  C:\Windows\System\ZDsGEZM.exe
  2⤵
  PID:4676
- C:\Windows\System\piLfUxj.exe
  C:\Windows\System\piLfUxj.exe
  2⤵
  PID:4692
- C:\Windows\System\VXtdqKI.exe
  C:\Windows\System\VXtdqKI.exe
  2⤵
  PID:4708
- C:\Windows\System\vftVlfO.exe
  C:\Windows\System\vftVlfO.exe
  2⤵
  PID:4724
- C:\Windows\System\qNUgvVM.exe
  C:\Windows\System\qNUgvVM.exe
  2⤵
  PID:4740
- C:\Windows\System\GdRbUZf.exe
  C:\Windows\System\GdRbUZf.exe
  2⤵
  PID:4760
- C:\Windows\System\mOFoTCB.exe
  C:\Windows\System\mOFoTCB.exe
  2⤵
  PID:4776
- C:\Windows\System\YfArxWX.exe
  C:\Windows\System\YfArxWX.exe
  2⤵
  PID:4792
- C:\Windows\System\hahiffp.exe
  C:\Windows\System\hahiffp.exe
  2⤵
  PID:4808
- C:\Windows\System\kBAIlQL.exe
  C:\Windows\System\kBAIlQL.exe
  2⤵
  PID:4824
- C:\Windows\System\lSRXLQD.exe
  C:\Windows\System\lSRXLQD.exe
  2⤵
  PID:4840
- C:\Windows\System\rtkTEWW.exe
  C:\Windows\System\rtkTEWW.exe
  2⤵
  PID:4856
- C:\Windows\System\GZQsqDE.exe
  C:\Windows\System\GZQsqDE.exe
  2⤵
  PID:4876
- C:\Windows\System\SsRiCul.exe
  C:\Windows\System\SsRiCul.exe
  2⤵
  PID:4892
- C:\Windows\System\JCMvcxO.exe
  C:\Windows\System\JCMvcxO.exe
  2⤵
  PID:4908
- C:\Windows\System\kGqhtqZ.exe
  C:\Windows\System\kGqhtqZ.exe
  2⤵
  PID:4924
- C:\Windows\System\SKPoZsv.exe
  C:\Windows\System\SKPoZsv.exe
  2⤵
  PID:4940
- C:\Windows\System\yPAMrJY.exe
  C:\Windows\System\yPAMrJY.exe
  2⤵
  PID:4956
- C:\Windows\System\SFmNpcC.exe
  C:\Windows\System\SFmNpcC.exe
  2⤵
  PID:4972
- C:\Windows\System\zntAzDN.exe
  C:\Windows\System\zntAzDN.exe
  2⤵
  PID:4988
- C:\Windows\System\tjPtStQ.exe
  C:\Windows\System\tjPtStQ.exe
  2⤵
  PID:5004
- C:\Windows\System\ucjLkBE.exe
  C:\Windows\System\ucjLkBE.exe
  2⤵
  PID:5020
- C:\Windows\System\XIHUUiv.exe
  C:\Windows\System\XIHUUiv.exe
  2⤵
  PID:5036
- C:\Windows\System\huqMpbk.exe
  C:\Windows\System\huqMpbk.exe
  2⤵
  PID:5052
- C:\Windows\System\iPaddCw.exe
  C:\Windows\System\iPaddCw.exe
  2⤵
  PID:5068
- C:\Windows\System\ytvhNFT.exe
  C:\Windows\System\ytvhNFT.exe
  2⤵
  PID:5084
- C:\Windows\System\FxzrzoF.exe
  C:\Windows\System\FxzrzoF.exe
  2⤵
  PID:5100
- C:\Windows\System\dvTUERt.exe
  C:\Windows\System\dvTUERt.exe
  2⤵
  PID:5116
- C:\Windows\System\TeeTtIB.exe
  C:\Windows\System\TeeTtIB.exe
  2⤵
  PID:3520
- C:\Windows\System\UXtsIJh.exe
  C:\Windows\System\UXtsIJh.exe
  2⤵
  PID:3604
- C:\Windows\System\iPwDmfz.exe
  C:\Windows\System\iPwDmfz.exe
  2⤵
  PID:3624
- C:\Windows\System\Augjxsi.exe
  C:\Windows\System\Augjxsi.exe
  2⤵
  PID:3840
- C:\Windows\System\yUsRrAo.exe
  C:\Windows\System\yUsRrAo.exe
  2⤵
  PID:3724
- C:\Windows\System\cNqycCm.exe
  C:\Windows\System\cNqycCm.exe
  2⤵
  PID:3932
- C:\Windows\System\XcPYTzQ.exe
  C:\Windows\System\XcPYTzQ.exe
  2⤵
  PID:3984
- C:\Windows\System\znopavO.exe
  C:\Windows\System\znopavO.exe
  2⤵
  PID:2880
- C:\Windows\System\fTSPKLV.exe
  C:\Windows\System\fTSPKLV.exe
  2⤵
  PID:2084
- C:\Windows\System\GGvZEvE.exe
  C:\Windows\System\GGvZEvE.exe
  2⤵
  PID:2976
- C:\Windows\System\CWllprG.exe
  C:\Windows\System\CWllprG.exe
  2⤵
  PID:2336
- C:\Windows\System\vrOnwYF.exe
  C:\Windows\System\vrOnwYF.exe
  2⤵
  PID:1240
- C:\Windows\System\EcMXegn.exe
  C:\Windows\System\EcMXegn.exe
  2⤵
  PID:1768
- C:\Windows\System\mbLmcAD.exe
  C:\Windows\System\mbLmcAD.exe
  2⤵
  PID:3272
- C:\Windows\System\GNWygLE.exe
  C:\Windows\System\GNWygLE.exe
  2⤵
  PID:3524
- C:\Windows\System\oEQwNoT.exe
  C:\Windows\System\oEQwNoT.exe
  2⤵
  PID:4124
- C:\Windows\System\rooknEf.exe
  C:\Windows\System\rooknEf.exe
  2⤵
  PID:4160
- C:\Windows\System\NKPkRdk.exe
  C:\Windows\System\NKPkRdk.exe
  2⤵
  PID:4204
- C:\Windows\System\uMupAKN.exe
  C:\Windows\System\uMupAKN.exe
  2⤵
  PID:4224
- C:\Windows\System\dTdSDLa.exe
  C:\Windows\System\dTdSDLa.exe
  2⤵
  PID:4256
- C:\Windows\System\xNCPMBK.exe
  C:\Windows\System\xNCPMBK.exe
  2⤵
  PID:4288
- C:\Windows\System\KMbynaH.exe
  C:\Windows\System\KMbynaH.exe
  2⤵
  PID:4332
- C:\Windows\System\rqwPkqD.exe
  C:\Windows\System\rqwPkqD.exe
  2⤵
  PID:4352
- C:\Windows\System\hoBehte.exe
  C:\Windows\System\hoBehte.exe
  2⤵
  PID:4396
- C:\Windows\System\IaBMYZG.exe
  C:\Windows\System\IaBMYZG.exe
  2⤵
  PID:4428
- C:\Windows\System\illneIF.exe
  C:\Windows\System\illneIF.exe
  2⤵
  PID:4452
- C:\Windows\System\NDYUKIw.exe
  C:\Windows\System\NDYUKIw.exe
  2⤵
  PID:4496
- C:\Windows\System\CMagQYV.exe
  C:\Windows\System\CMagQYV.exe
  2⤵
  PID:4516
- C:\Windows\System\VnqaFdG.exe
  C:\Windows\System\VnqaFdG.exe
  2⤵
  PID:2732
- C:\Windows\System\wNEhqgt.exe
  C:\Windows\System\wNEhqgt.exe
  2⤵
  PID:2852
- C:\Windows\System\zeAOLSP.exe
  C:\Windows\System\zeAOLSP.exe
  2⤵
  PID:4588
- C:\Windows\System\huZNqvz.exe
  C:\Windows\System\huZNqvz.exe
  2⤵
  PID:4620
- C:\Windows\System\aruGOxR.exe
  C:\Windows\System\aruGOxR.exe
  2⤵
  PID:4652
- C:\Windows\System\vqLpOio.exe
  C:\Windows\System\vqLpOio.exe
  2⤵
  PID:4700
- C:\Windows\System\iDpUZsV.exe
  C:\Windows\System\iDpUZsV.exe
  2⤵
  PID:4756
- C:\Windows\System\BmREuNa.exe
  C:\Windows\System\BmREuNa.exe
  2⤵
  PID:4768
- C:\Windows\System\SbUPaDF.exe
  C:\Windows\System\SbUPaDF.exe
  2⤵
  PID:4784
- C:\Windows\System\xbhRsyZ.exe
  C:\Windows\System\xbhRsyZ.exe
  2⤵
  PID:4816
- C:\Windows\System\OCCZtCX.exe
  C:\Windows\System\OCCZtCX.exe
  2⤵
  PID:4848
- C:\Windows\System\ALGVBtR.exe
  C:\Windows\System\ALGVBtR.exe
  2⤵
  PID:4884
- C:\Windows\System\cScSAdE.exe
  C:\Windows\System\cScSAdE.exe
  2⤵
  PID:4916
- C:\Windows\System\GrCFPmB.exe
  C:\Windows\System\GrCFPmB.exe
  2⤵
  PID:4948
- C:\Windows\System\cNLAkxl.exe
  C:\Windows\System\cNLAkxl.exe
  2⤵
  PID:4980
- C:\Windows\System\ivPgFBG.exe
  C:\Windows\System\ivPgFBG.exe
  2⤵
  PID:5012
- C:\Windows\System\RNbyLwE.exe
  C:\Windows\System\RNbyLwE.exe
  2⤵
  PID:5044
- C:\Windows\System\eFRfptV.exe
  C:\Windows\System\eFRfptV.exe
  2⤵
  PID:5076
- C:\Windows\System\qZxDoyp.exe
  C:\Windows\System\qZxDoyp.exe
  2⤵
  PID:5108
- C:\Windows\System\XbcbZLs.exe
  C:\Windows\System\XbcbZLs.exe
  2⤵
  PID:3780
- C:\Windows\System\WCbkbMT.exe
  C:\Windows\System\WCbkbMT.exe
  2⤵
  PID:3584
- C:\Windows\System\uZpLIPK.exe
  C:\Windows\System\uZpLIPK.exe
  2⤵
  PID:3904
- C:\Windows\System\EUjuTUz.exe
  C:\Windows\System\EUjuTUz.exe
  2⤵
  PID:3976
- C:\Windows\System\YnQYoQk.exe
  C:\Windows\System\YnQYoQk.exe
  2⤵
  PID:2400
- C:\Windows\System\ttSbRiU.exe
  C:\Windows\System\ttSbRiU.exe
  2⤵
  PID:2784
- C:\Windows\System\PDgixbV.exe
  C:\Windows\System\PDgixbV.exe
  2⤵
  PID:3296
- C:\Windows\System\MeDrKQl.exe
  C:\Windows\System\MeDrKQl.exe
  2⤵
  PID:4156
- C:\Windows\System\DXKtrHp.exe
  C:\Windows\System\DXKtrHp.exe
  2⤵
  PID:4236
- C:\Windows\System\wgSzljM.exe
  C:\Windows\System\wgSzljM.exe
  2⤵
  PID:4300
- C:\Windows\System\TbXjaap.exe
  C:\Windows\System\TbXjaap.exe
  2⤵
  PID:4316
- C:\Windows\System\qCoDHvO.exe
  C:\Windows\System\qCoDHvO.exe
  2⤵
  PID:4384
- C:\Windows\System\mAzSQaL.exe
  C:\Windows\System\mAzSQaL.exe
  2⤵
  PID:4480
- C:\Windows\System\MareqqO.exe
  C:\Windows\System\MareqqO.exe
  2⤵
  PID:4512
- C:\Windows\System\lbCizSo.exe
  C:\Windows\System\lbCizSo.exe
  2⤵
  PID:4576
- C:\Windows\System\BvnGQDb.exe
  C:\Windows\System\BvnGQDb.exe
  2⤵
  PID:4608
- C:\Windows\System\UCQlxSI.exe
  C:\Windows\System\UCQlxSI.exe
  2⤵
  PID:4684
- C:\Windows\System\lCEDQzw.exe
  C:\Windows\System\lCEDQzw.exe
  2⤵
  PID:4752
- C:\Windows\System\RRLaIdV.exe
  C:\Windows\System\RRLaIdV.exe
  2⤵
  PID:4736
- C:\Windows\System\LEbfcZZ.exe
  C:\Windows\System\LEbfcZZ.exe
  2⤵
  PID:4836
- C:\Windows\System\qJbQEbX.exe
  C:\Windows\System\qJbQEbX.exe
  2⤵
  PID:5128
- C:\Windows\System\ZyVotLf.exe
  C:\Windows\System\ZyVotLf.exe
  2⤵
  PID:5144
- C:\Windows\System\sqIhSUY.exe
  C:\Windows\System\sqIhSUY.exe
  2⤵
  PID:5160
- C:\Windows\System\uUtahdl.exe
  C:\Windows\System\uUtahdl.exe
  2⤵
  PID:5176
- C:\Windows\System\YpzkrQc.exe
  C:\Windows\System\YpzkrQc.exe
  2⤵
  PID:5192
- C:\Windows\System\EnbjyqI.exe
  C:\Windows\System\EnbjyqI.exe
  2⤵
  PID:5208
- C:\Windows\System\AJpciqb.exe
  C:\Windows\System\AJpciqb.exe
  2⤵
  PID:5224
- C:\Windows\System\dJnxAkv.exe
  C:\Windows\System\dJnxAkv.exe
  2⤵
  PID:5240
- C:\Windows\System\zoVFolC.exe
  C:\Windows\System\zoVFolC.exe
  2⤵
  PID:5256
- C:\Windows\System\VaROfJy.exe
  C:\Windows\System\VaROfJy.exe
  2⤵
  PID:5272
- C:\Windows\System\oJvLdIo.exe
  C:\Windows\System\oJvLdIo.exe
  2⤵
  PID:5288
- C:\Windows\System\TXQKKlt.exe
  C:\Windows\System\TXQKKlt.exe
  2⤵
  PID:5308
- C:\Windows\System\wyThIWy.exe
  C:\Windows\System\wyThIWy.exe
  2⤵
  PID:5324
- C:\Windows\System\sxKlyGn.exe
  C:\Windows\System\sxKlyGn.exe
  2⤵
  PID:5340
- C:\Windows\System\FVqNxmx.exe
  C:\Windows\System\FVqNxmx.exe
  2⤵
  PID:5356
- C:\Windows\System\HHTvkoZ.exe
  C:\Windows\System\HHTvkoZ.exe
  2⤵
  PID:5372
- C:\Windows\System\pIyfjBN.exe
  C:\Windows\System\pIyfjBN.exe
  2⤵
  PID:5388
- C:\Windows\System\ihuIYBR.exe
  C:\Windows\System\ihuIYBR.exe
  2⤵
  PID:5404
- C:\Windows\System\wVUQrCG.exe
  C:\Windows\System\wVUQrCG.exe
  2⤵
  PID:5420
- C:\Windows\System\AwmGYcU.exe
  C:\Windows\System\AwmGYcU.exe
  2⤵
  PID:5436
- C:\Windows\System\wTcZhBB.exe
  C:\Windows\System\wTcZhBB.exe
  2⤵
  PID:5452
- C:\Windows\System\HxbdwuV.exe
  C:\Windows\System\HxbdwuV.exe
  2⤵
  PID:5468
- C:\Windows\System\iZekXzt.exe
  C:\Windows\System\iZekXzt.exe
  2⤵
  PID:5484
- C:\Windows\System\KFYvzOw.exe
  C:\Windows\System\KFYvzOw.exe
  2⤵
  PID:5500
- C:\Windows\System\tSFAipK.exe
  C:\Windows\System\tSFAipK.exe
  2⤵
  PID:5520
- C:\Windows\System\DuNmkRc.exe
  C:\Windows\System\DuNmkRc.exe
  2⤵
  PID:5536
- C:\Windows\System\myxwUVo.exe
  C:\Windows\System\myxwUVo.exe
  2⤵
  PID:5552
- C:\Windows\System\XvnphFt.exe
  C:\Windows\System\XvnphFt.exe
  2⤵
  PID:5568
- C:\Windows\System\JpxfFpf.exe
  C:\Windows\System\JpxfFpf.exe
  2⤵
  PID:5584
- C:\Windows\System\NHzazhR.exe
  C:\Windows\System\NHzazhR.exe
  2⤵
  PID:5600
- C:\Windows\System\krcHvik.exe
  C:\Windows\System\krcHvik.exe
  2⤵
  PID:5616
- C:\Windows\System\beVTTVS.exe
  C:\Windows\System\beVTTVS.exe
  2⤵
  PID:5632
- C:\Windows\System\YIyoSIJ.exe
  C:\Windows\System\YIyoSIJ.exe
  2⤵
  PID:5648
- C:\Windows\System\gfNQTlt.exe
  C:\Windows\System\gfNQTlt.exe
  2⤵
  PID:5668
- C:\Windows\System\zNDpcpR.exe
  C:\Windows\System\zNDpcpR.exe
  2⤵
  PID:5684
- C:\Windows\System\vPesLiZ.exe
  C:\Windows\System\vPesLiZ.exe
  2⤵
  PID:5700
- C:\Windows\System\krDnqde.exe
  C:\Windows\System\krDnqde.exe
  2⤵
  PID:5716
- C:\Windows\System\XEzJtnC.exe
  C:\Windows\System\XEzJtnC.exe
  2⤵
  PID:5732
- C:\Windows\System\hKoCBED.exe
  C:\Windows\System\hKoCBED.exe
  2⤵
  PID:5748
- C:\Windows\System\UYEINTn.exe
  C:\Windows\System\UYEINTn.exe
  2⤵
  PID:5764
- C:\Windows\System\WBvTQwV.exe
  C:\Windows\System\WBvTQwV.exe
  2⤵
  PID:5780
- C:\Windows\System\OaiFhxr.exe
  C:\Windows\System\OaiFhxr.exe
  2⤵
  PID:5796
- C:\Windows\System\DFTHbFt.exe
  C:\Windows\System\DFTHbFt.exe
  2⤵
  PID:5812
- C:\Windows\System\WnbPTIy.exe
  C:\Windows\System\WnbPTIy.exe
  2⤵
  PID:5828
- C:\Windows\System\wZTcPrI.exe
  C:\Windows\System\wZTcPrI.exe
  2⤵
  PID:5844
- C:\Windows\System\gEZaZnk.exe
  C:\Windows\System\gEZaZnk.exe
  2⤵
  PID:5860
- C:\Windows\System\WEWYQtj.exe
  C:\Windows\System\WEWYQtj.exe
  2⤵
  PID:5876
- C:\Windows\System\xlaHvhm.exe
  C:\Windows\System\xlaHvhm.exe
  2⤵
  PID:5892
- C:\Windows\System\oujpeOr.exe
  C:\Windows\System\oujpeOr.exe
  2⤵
  PID:5908
- C:\Windows\System\dNDeBYY.exe
  C:\Windows\System\dNDeBYY.exe
  2⤵
  PID:5924
- C:\Windows\System\vkxAbwI.exe
  C:\Windows\System\vkxAbwI.exe
  2⤵
  PID:5940
- C:\Windows\System\kEmIuMr.exe
  C:\Windows\System\kEmIuMr.exe
  2⤵
  PID:5960
- C:\Windows\System\lTLmPiC.exe
  C:\Windows\System\lTLmPiC.exe
  2⤵
  PID:5976
- C:\Windows\System\zJufJTm.exe
  C:\Windows\System\zJufJTm.exe
  2⤵
  PID:5992
- C:\Windows\System\FAUGKHb.exe
  C:\Windows\System\FAUGKHb.exe
  2⤵
  PID:6008
- C:\Windows\System\cgMXqfv.exe
  C:\Windows\System\cgMXqfv.exe
  2⤵
  PID:6024
- C:\Windows\System\LLXMxpe.exe
  C:\Windows\System\LLXMxpe.exe
  2⤵
  PID:6040
- C:\Windows\System\akcFWqv.exe
  C:\Windows\System\akcFWqv.exe
  2⤵
  PID:6056
- C:\Windows\System\LxlIVWS.exe
  C:\Windows\System\LxlIVWS.exe
  2⤵
  PID:6072
- C:\Windows\System\dflkPdJ.exe
  C:\Windows\System\dflkPdJ.exe
  2⤵
  PID:6088
- C:\Windows\System\uNosbIt.exe
  C:\Windows\System\uNosbIt.exe
  2⤵
  PID:6104
- C:\Windows\System\JeVowIo.exe
  C:\Windows\System\JeVowIo.exe
  2⤵
  PID:6120
- C:\Windows\System\mwKbuGg.exe
  C:\Windows\System\mwKbuGg.exe
  2⤵
  PID:6136
- C:\Windows\System\OFxErsA.exe
  C:\Windows\System\OFxErsA.exe
  2⤵
  PID:4904
- C:\Windows\System\qDuEFbC.exe
  C:\Windows\System\qDuEFbC.exe
  2⤵
  PID:4952
- C:\Windows\System\ZqfqZjp.exe
  C:\Windows\System\ZqfqZjp.exe
  2⤵
  PID:5016
- C:\Windows\System\YXFdwQN.exe
  C:\Windows\System\YXFdwQN.exe
  2⤵
  PID:5096
- C:\Windows\System\dTNSyHR.exe
  C:\Windows\System\dTNSyHR.exe
  2⤵
  PID:3684
- C:\Windows\System\fshAckz.exe
  C:\Windows\System\fshAckz.exe
  2⤵
  PID:2228
- C:\Windows\System\PuYVLPV.exe
  C:\Windows\System\PuYVLPV.exe
  2⤵
  PID:888
- C:\Windows\System\CGILgGf.exe
  C:\Windows\System\CGILgGf.exe
  2⤵
  PID:2876
- C:\Windows\System\XAsePbR.exe
  C:\Windows\System\XAsePbR.exe
  2⤵
  PID:4192
- C:\Windows\System\hvaqmXT.exe
  C:\Windows\System\hvaqmXT.exe
  2⤵
  PID:4364
- C:\Windows\System\mKDdbyY.exe
  C:\Windows\System\mKDdbyY.exe
  2⤵
  PID:4544
- C:\Windows\System\UcuubvS.exe
  C:\Windows\System\UcuubvS.exe
  2⤵
  PID:4592
- C:\Windows\System\kkZRPrO.exe
  C:\Windows\System\kkZRPrO.exe
  2⤵
  PID:2684
- C:\Windows\System\nwLrsqy.exe
  C:\Windows\System\nwLrsqy.exe
  2⤵
  PID:2964
- C:\Windows\System\cyIjSSB.exe
  C:\Windows\System\cyIjSSB.exe
  2⤵
  PID:5136
- C:\Windows\System\inCczsZ.exe
  C:\Windows\System\inCczsZ.exe
  2⤵
  PID:5172
- C:\Windows\System\oqXDkkn.exe
  C:\Windows\System\oqXDkkn.exe
  2⤵
  PID:5200
- C:\Windows\System\lmoMHDU.exe
  C:\Windows\System\lmoMHDU.exe
  2⤵
  PID:5236
- C:\Windows\System\livsDVj.exe
  C:\Windows\System\livsDVj.exe
  2⤵
  PID:5264
- C:\Windows\System\NRADUbe.exe
  C:\Windows\System\NRADUbe.exe
  2⤵
  PID:5300
- C:\Windows\System\GzCwMCs.exe
  C:\Windows\System\GzCwMCs.exe
  2⤵
  PID:5320
- C:\Windows\System\WxulxvZ.exe
  C:\Windows\System\WxulxvZ.exe
  2⤵
  PID:5364
- C:\Windows\System\hwvbhpG.exe
  C:\Windows\System\hwvbhpG.exe
  2⤵
  PID:5396
- C:\Windows\System\mYQVbzk.exe
  C:\Windows\System\mYQVbzk.exe
  2⤵
  PID:5412
- C:\Windows\System\lfgrsyS.exe
  C:\Windows\System\lfgrsyS.exe
  2⤵
  PID:5460
- C:\Windows\System\sTNWvrD.exe
  C:\Windows\System\sTNWvrD.exe
  2⤵
  PID:5492
- C:\Windows\System\xSRhFmV.exe
  C:\Windows\System\xSRhFmV.exe
  2⤵
  PID:2960
- C:\Windows\System\bSWxnsh.exe
  C:\Windows\System\bSWxnsh.exe
  2⤵
  PID:5532
- C:\Windows\System\bmUTyYf.exe
  C:\Windows\System\bmUTyYf.exe
  2⤵
  PID:5564
- C:\Windows\System\IUlzdVF.exe
  C:\Windows\System\IUlzdVF.exe
  2⤵
  PID:5596
- C:\Windows\System\OQNExvi.exe
  C:\Windows\System\OQNExvi.exe
  2⤵
  PID:5608
- C:\Windows\System\JlezejD.exe
  C:\Windows\System\JlezejD.exe
  2⤵
  PID:5656
- C:\Windows\System\CiWuaoI.exe
  C:\Windows\System\CiWuaoI.exe
  2⤵
  PID:5692
- C:\Windows\System\fxEIZXZ.exe
  C:\Windows\System\fxEIZXZ.exe
  2⤵
  PID:5724
- C:\Windows\System\qwkMnnq.exe
  C:\Windows\System\qwkMnnq.exe
  2⤵
  PID:5756
- C:\Windows\System\jaoZMma.exe
  C:\Windows\System\jaoZMma.exe
  2⤵
  PID:5772
- C:\Windows\System\hDaaPqn.exe
  C:\Windows\System\hDaaPqn.exe
  2⤵
  PID:5792
- C:\Windows\System\rnXpYYc.exe
  C:\Windows\System\rnXpYYc.exe
  2⤵
  PID:5824
- C:\Windows\System\upmqaGJ.exe
  C:\Windows\System\upmqaGJ.exe
  2⤵
  PID:5856
- C:\Windows\System\ucIjixg.exe
  C:\Windows\System\ucIjixg.exe
  2⤵
  PID:5888
- C:\Windows\System\PPJKKXy.exe
  C:\Windows\System\PPJKKXy.exe
  2⤵
  PID:5920
- C:\Windows\System\eNwCVUM.exe
  C:\Windows\System\eNwCVUM.exe
  2⤵
  PID:5936
- C:\Windows\System\YNXuCHu.exe
  C:\Windows\System\YNXuCHu.exe
  2⤵
  PID:5972
- C:\Windows\System\LFHIheK.exe
  C:\Windows\System\LFHIheK.exe
  2⤵
  PID:6004
- C:\Windows\System\gnaCmCP.exe
  C:\Windows\System\gnaCmCP.exe
  2⤵
  PID:6036
- C:\Windows\System\BECvxcd.exe
  C:\Windows\System\BECvxcd.exe
  2⤵
  PID:6068
- C:\Windows\System\VxTZbov.exe
  C:\Windows\System\VxTZbov.exe
  2⤵
  PID:6116
- C:\Windows\System\fNlPEXf.exe
  C:\Windows\System\fNlPEXf.exe
  2⤵
  PID:4872
- C:\Windows\System\ZaAVbBn.exe
  C:\Windows\System\ZaAVbBn.exe
  2⤵
  PID:4996
- C:\Windows\System\tQgROhp.exe
  C:\Windows\System\tQgROhp.exe
  2⤵
  PID:5064
- C:\Windows\System\mwqPfGp.exe
  C:\Windows\System\mwqPfGp.exe
  2⤵
  PID:3668
- C:\Windows\System\Zsxoavp.exe
  C:\Windows\System\Zsxoavp.exe
  2⤵
  PID:4140
- C:\Windows\System\MhOkFxd.exe
  C:\Windows\System\MhOkFxd.exe
  2⤵
  PID:4380
- C:\Windows\System\eQjVUbF.exe
  C:\Windows\System\eQjVUbF.exe
  2⤵
  PID:4624
- C:\Windows\System\oLQDeVe.exe
  C:\Windows\System\oLQDeVe.exe
  2⤵
  PID:2708
- C:\Windows\System\QYjAalM.exe
  C:\Windows\System\QYjAalM.exe
  2⤵
  PID:2748
- C:\Windows\System\lSUcmYu.exe
  C:\Windows\System\lSUcmYu.exe
  2⤵
  PID:5168
- C:\Windows\System\ddUUttd.exe
  C:\Windows\System\ddUUttd.exe
  2⤵
  PID:5220
- C:\Windows\System\xkMAdfV.exe
  C:\Windows\System\xkMAdfV.exe
  2⤵
  PID:5248
- C:\Windows\System\DnAooAG.exe
  C:\Windows\System\DnAooAG.exe
  2⤵
  PID:5316
- C:\Windows\System\KFtSxAb.exe
  C:\Windows\System\KFtSxAb.exe
  2⤵
  PID:2728
- C:\Windows\System\GoMMJVk.exe
  C:\Windows\System\GoMMJVk.exe
  2⤵
  PID:5432
- C:\Windows\System\oXWyEKq.exe
  C:\Windows\System\oXWyEKq.exe
  2⤵
  PID:5476
- C:\Windows\System\EFfnjOf.exe
  C:\Windows\System\EFfnjOf.exe
  2⤵
  PID:5508
- C:\Windows\System\tfvuaid.exe
  C:\Windows\System\tfvuaid.exe
  2⤵
  PID:5592
- C:\Windows\System\lPAfaWG.exe
  C:\Windows\System\lPAfaWG.exe
  2⤵
  PID:5664
- C:\Windows\System\GESsYcL.exe
  C:\Windows\System\GESsYcL.exe
  2⤵
  PID:5708
- C:\Windows\System\eJGJXjX.exe
  C:\Windows\System\eJGJXjX.exe
  2⤵
  PID:5760
- C:\Windows\System\dPOupVA.exe
  C:\Windows\System\dPOupVA.exe
  2⤵
  PID:5820
- C:\Windows\System\EagNOJg.exe
  C:\Windows\System\EagNOJg.exe
  2⤵
  PID:5916
- C:\Windows\System\lRskBJb.exe
  C:\Windows\System\lRskBJb.exe
  2⤵
  PID:2656
- C:\Windows\System\pFcZIhB.exe
  C:\Windows\System\pFcZIhB.exe
  2⤵
  PID:5932
- C:\Windows\System\gsZwDwJ.exe
  C:\Windows\System\gsZwDwJ.exe
  2⤵
  PID:6048
- C:\Windows\System\rQQruMY.exe
  C:\Windows\System\rQQruMY.exe
  2⤵
  PID:6064
- C:\Windows\System\IRuKFbX.exe
  C:\Windows\System\IRuKFbX.exe
  2⤵
  PID:2332
- C:\Windows\System\UeQNhbu.exe
  C:\Windows\System\UeQNhbu.exe
  2⤵
  PID:3836
- C:\Windows\System\GzvEPJP.exe
  C:\Windows\System\GzvEPJP.exe
  2⤵
  PID:4104
- C:\Windows\System\tTFegdQ.exe
  C:\Windows\System\tTFegdQ.exe
  2⤵
  PID:2388
- C:\Windows\System\KQWmvVp.exe
  C:\Windows\System\KQWmvVp.exe
  2⤵
  PID:4888
- C:\Windows\System\jDrfDKt.exe
  C:\Windows\System\jDrfDKt.exe
  2⤵
  PID:2792
- C:\Windows\System\PajftHv.exe
  C:\Windows\System\PajftHv.exe
  2⤵
  PID:5336
- C:\Windows\System\yfUUMSK.exe
  C:\Windows\System\yfUUMSK.exe
  2⤵
  PID:5496
- C:\Windows\System\cqqTxlF.exe
  C:\Windows\System\cqqTxlF.exe
  2⤵
  PID:6156
- C:\Windows\System\JOMDtfH.exe
  C:\Windows\System\JOMDtfH.exe
  2⤵
  PID:6172
- C:\Windows\System\ghjCCQj.exe
  C:\Windows\System\ghjCCQj.exe
  2⤵
  PID:6188
- C:\Windows\System\mwUvKTy.exe
  C:\Windows\System\mwUvKTy.exe
  2⤵
  PID:6204
- C:\Windows\System\FgoLSfR.exe
  C:\Windows\System\FgoLSfR.exe
  2⤵
  PID:6220
- C:\Windows\System\LkQgyGn.exe
  C:\Windows\System\LkQgyGn.exe
  2⤵
  PID:6236
- C:\Windows\System\rBMVyES.exe
  C:\Windows\System\rBMVyES.exe
  2⤵
  PID:6252
- C:\Windows\System\pJTZOsc.exe
  C:\Windows\System\pJTZOsc.exe
  2⤵
  PID:6268
- C:\Windows\System\RlLXpKW.exe
  C:\Windows\System\RlLXpKW.exe
  2⤵
  PID:6284
- C:\Windows\System\ferDmhT.exe
  C:\Windows\System\ferDmhT.exe
  2⤵
  PID:6300
- C:\Windows\System\sEHcNnV.exe
  C:\Windows\System\sEHcNnV.exe
  2⤵
  PID:6316
- C:\Windows\System\VPlHqbd.exe
  C:\Windows\System\VPlHqbd.exe
  2⤵
  PID:6332
- C:\Windows\System\KwxWkXh.exe
  C:\Windows\System\KwxWkXh.exe
  2⤵
  PID:6348
- C:\Windows\System\claHBQy.exe
  C:\Windows\System\claHBQy.exe
  2⤵
  PID:6364
- C:\Windows\System\vlWzmkY.exe
  C:\Windows\System\vlWzmkY.exe
  2⤵
  PID:6380
- C:\Windows\System\IttCnzI.exe
  C:\Windows\System\IttCnzI.exe
  2⤵
  PID:6396
- C:\Windows\System\FfhyFta.exe
  C:\Windows\System\FfhyFta.exe
  2⤵
  PID:6412
- C:\Windows\System\DQdGiWx.exe
  C:\Windows\System\DQdGiWx.exe
  2⤵
  PID:6432
- C:\Windows\System\ngpzCnF.exe
  C:\Windows\System\ngpzCnF.exe
  2⤵
  PID:6448
- C:\Windows\System\MoHZawU.exe
  C:\Windows\System\MoHZawU.exe
  2⤵
  PID:6464
- C:\Windows\System\rCcvogC.exe
  C:\Windows\System\rCcvogC.exe
  2⤵
  PID:6480
- C:\Windows\System\PQtytfA.exe
  C:\Windows\System\PQtytfA.exe
  2⤵
  PID:6496
- C:\Windows\System\xiOYwlj.exe
  C:\Windows\System\xiOYwlj.exe
  2⤵
  PID:6512
- C:\Windows\System\CPHktcm.exe
  C:\Windows\System\CPHktcm.exe
  2⤵
  PID:6528
- C:\Windows\System\aKNjqoc.exe
  C:\Windows\System\aKNjqoc.exe
  2⤵
  PID:6544
- C:\Windows\System\SCoSAih.exe
  C:\Windows\System\SCoSAih.exe
  2⤵
  PID:6560
- C:\Windows\System\alfgWAL.exe
  C:\Windows\System\alfgWAL.exe
  2⤵
  PID:6576
- C:\Windows\System\kWRWLsw.exe
  C:\Windows\System\kWRWLsw.exe
  2⤵
  PID:6592
- C:\Windows\System\RLNciYv.exe
  C:\Windows\System\RLNciYv.exe
  2⤵
  PID:6608
- C:\Windows\System\BchSFhr.exe
  C:\Windows\System\BchSFhr.exe
  2⤵
  PID:6624
- C:\Windows\System\vcycsSR.exe
  C:\Windows\System\vcycsSR.exe
  2⤵
  PID:6640
- C:\Windows\System\WzfxtPX.exe
  C:\Windows\System\WzfxtPX.exe
  2⤵
  PID:6656
- C:\Windows\System\Phqsccc.exe
  C:\Windows\System\Phqsccc.exe
  2⤵
  PID:6672
- C:\Windows\System\qhwQtsP.exe
  C:\Windows\System\qhwQtsP.exe
  2⤵
  PID:6688
- C:\Windows\System\MgIfLNj.exe
  C:\Windows\System\MgIfLNj.exe
  2⤵
  PID:6704
- C:\Windows\System\iovtRGF.exe
  C:\Windows\System\iovtRGF.exe
  2⤵
  PID:6720
- C:\Windows\System\oQetfmP.exe
  C:\Windows\System\oQetfmP.exe
  2⤵
  PID:6736
- C:\Windows\System\TdIFkWE.exe
  C:\Windows\System\TdIFkWE.exe
  2⤵
  PID:6752
- C:\Windows\System\wlryefe.exe
  C:\Windows\System\wlryefe.exe
  2⤵
  PID:6768
- C:\Windows\System\QcicblX.exe
  C:\Windows\System\QcicblX.exe
  2⤵
  PID:6784
- C:\Windows\System\ROEdGnG.exe
  C:\Windows\System\ROEdGnG.exe
  2⤵
  PID:6800
- C:\Windows\System\yuGYIoz.exe
  C:\Windows\System\yuGYIoz.exe
  2⤵
  PID:6816
- C:\Windows\System\bqGbegg.exe
  C:\Windows\System\bqGbegg.exe
  2⤵
  PID:6832
- C:\Windows\System\lAUdcgo.exe
  C:\Windows\System\lAUdcgo.exe
  2⤵
  PID:6848
- C:\Windows\System\dYuBCzu.exe
  C:\Windows\System\dYuBCzu.exe
  2⤵
  PID:6868
- C:\Windows\System\TZOnffK.exe
  C:\Windows\System\TZOnffK.exe
  2⤵
  PID:6884
- C:\Windows\System\aFFiLKw.exe
  C:\Windows\System\aFFiLKw.exe
  2⤵
  PID:6900
- C:\Windows\System\aJvxYCV.exe
  C:\Windows\System\aJvxYCV.exe
  2⤵
  PID:6916
- C:\Windows\System\spYMZsl.exe
  C:\Windows\System\spYMZsl.exe
  2⤵
  PID:6932
- C:\Windows\System\qjzvXcD.exe
  C:\Windows\System\qjzvXcD.exe
  2⤵
  PID:6948
- C:\Windows\System\uxiZbXY.exe
  C:\Windows\System\uxiZbXY.exe
  2⤵
  PID:6964
- C:\Windows\System\htNgZNL.exe
  C:\Windows\System\htNgZNL.exe
  2⤵
  PID:6980
- C:\Windows\System\BwtwsKa.exe
  C:\Windows\System\BwtwsKa.exe
  2⤵
  PID:6996
- C:\Windows\System\oSWiOJk.exe
  C:\Windows\System\oSWiOJk.exe
  2⤵
  PID:7012
- C:\Windows\System\TnlvTyH.exe
  C:\Windows\System\TnlvTyH.exe
  2⤵
  PID:7028
- C:\Windows\System\GfpqGmk.exe
  C:\Windows\System\GfpqGmk.exe
  2⤵
  PID:7044
- C:\Windows\System\HFAvuJl.exe
  C:\Windows\System\HFAvuJl.exe
  2⤵
  PID:7060
- C:\Windows\System\lIyyUKg.exe
  C:\Windows\System\lIyyUKg.exe
  2⤵
  PID:7076
- C:\Windows\System\xMXhdPP.exe
  C:\Windows\System\xMXhdPP.exe
  2⤵
  PID:7092
- C:\Windows\System\JpQaxdM.exe
  C:\Windows\System\JpQaxdM.exe
  2⤵
  PID:7108
- C:\Windows\System\PubHQVK.exe
  C:\Windows\System\PubHQVK.exe
  2⤵
  PID:7124
- C:\Windows\System\NxeGOsl.exe
  C:\Windows\System\NxeGOsl.exe
  2⤵
  PID:7140
- C:\Windows\System\gdTleDE.exe
  C:\Windows\System\gdTleDE.exe
  2⤵
  PID:7156
- C:\Windows\System\wdVfFEA.exe
  C:\Windows\System\wdVfFEA.exe
  2⤵
  PID:5448
- C:\Windows\System\jYjlxef.exe
  C:\Windows\System\jYjlxef.exe
  2⤵
  PID:5560
- C:\Windows\System\LWrwPWu.exe
  C:\Windows\System\LWrwPWu.exe
  2⤵
  PID:5612
- C:\Windows\System\XdBWnXH.exe
  C:\Windows\System\XdBWnXH.exe
  2⤵
  PID:5808
- C:\Windows\System\tietAJh.exe
  C:\Windows\System\tietAJh.exe
  2⤵
  PID:5900
- C:\Windows\System\IXkLrWl.exe
  C:\Windows\System\IXkLrWl.exe
  2⤵
  PID:6032
- C:\Windows\System\tvubvSN.exe
  C:\Windows\System\tvubvSN.exe
  2⤵
  PID:3068
- C:\Windows\System\osvndhj.exe
  C:\Windows\System\osvndhj.exe
  2⤵
  PID:2068
- C:\Windows\System\iqqGEGk.exe
  C:\Windows\System\iqqGEGk.exe
  2⤵
  PID:4268
- C:\Windows\System\xODUYzz.exe
  C:\Windows\System\xODUYzz.exe
  2⤵
  PID:5124
- C:\Windows\System\JLvOCgY.exe
  C:\Windows\System\JLvOCgY.exe
  2⤵
  PID:5232
- C:\Windows\System\iznlLKe.exe
  C:\Windows\System\iznlLKe.exe
  2⤵
  PID:5296
- C:\Windows\System\hGocvrS.exe
  C:\Windows\System\hGocvrS.exe
  2⤵
  PID:6164
- C:\Windows\System\YxZCYVx.exe
  C:\Windows\System\YxZCYVx.exe
  2⤵
  PID:3020
- C:\Windows\System\TkzSSdl.exe
  C:\Windows\System\TkzSSdl.exe
  2⤵
  PID:6200
- C:\Windows\System\UFZdHjt.exe
  C:\Windows\System\UFZdHjt.exe
  2⤵
  PID:6232
- C:\Windows\System\ACzQHiz.exe
  C:\Windows\System\ACzQHiz.exe
  2⤵
  PID:6280
- C:\Windows\System\BorcBIB.exe
  C:\Windows\System\BorcBIB.exe
  2⤵
  PID:6292
- C:\Windows\System\hKRpIId.exe
  C:\Windows\System\hKRpIId.exe
  2⤵
  PID:6328
- C:\Windows\System\aTdzjnm.exe
  C:\Windows\System\aTdzjnm.exe
  2⤵
  PID:6376
- C:\Windows\System\fFfqpbS.exe
  C:\Windows\System\fFfqpbS.exe
  2⤵
  PID:6408
- C:\Windows\System\PIGGLIU.exe
  C:\Windows\System\PIGGLIU.exe
  2⤵
  PID:2264
- C:\Windows\System\hSgEbIF.exe
  C:\Windows\System\hSgEbIF.exe
  2⤵
  PID:6472
- C:\Windows\System\damYvRa.exe
  C:\Windows\System\damYvRa.exe
  2⤵
  PID:836
- C:\Windows\System\LLYBwkU.exe
  C:\Windows\System\LLYBwkU.exe
  2⤵
  PID:6508
- C:\Windows\System\VOuvMyR.exe
  C:\Windows\System\VOuvMyR.exe
  2⤵
  PID:6524
- C:\Windows\System\HaMyrPW.exe
  C:\Windows\System\HaMyrPW.exe
  2⤵
  PID:6552
- C:\Windows\System\lFJpymf.exe
  C:\Windows\System\lFJpymf.exe
  2⤵
  PID:6600
- C:\Windows\System\agnTHxI.exe
  C:\Windows\System\agnTHxI.exe
  2⤵
  PID:6428
- C:\Windows\System\XBGdetN.exe
  C:\Windows\System\XBGdetN.exe
  2⤵
  PID:6648
- C:\Windows\System\LxzTezn.exe
  C:\Windows\System\LxzTezn.exe
  2⤵
  PID:6680
- C:\Windows\System\AqXJuiZ.exe
  C:\Windows\System\AqXJuiZ.exe
  2⤵
  PID:6700
- C:\Windows\System\cBPfDGF.exe
  C:\Windows\System\cBPfDGF.exe
  2⤵
  PID:6728
- C:\Windows\System\VkfLvCc.exe
  C:\Windows\System\VkfLvCc.exe
  2⤵
  PID:6744
- C:\Windows\System\RGciJHj.exe
  C:\Windows\System\RGciJHj.exe
  2⤵
  PID:6776
- C:\Windows\System\tlTtDhE.exe
  C:\Windows\System\tlTtDhE.exe
  2⤵
  PID:6808
- C:\Windows\System\EZaqjzz.exe
  C:\Windows\System\EZaqjzz.exe
  2⤵
  PID:6840
- C:\Windows\System\eykYxcC.exe
  C:\Windows\System\eykYxcC.exe
  2⤵
  PID:6892
- C:\Windows\System\XZCuUol.exe
  C:\Windows\System\XZCuUol.exe
  2⤵
  PID:6880
- C:\Windows\System\vPKNPhc.exe
  C:\Windows\System\vPKNPhc.exe
  2⤵
  PID:6912
- C:\Windows\System\nGLrpdV.exe
  C:\Windows\System\nGLrpdV.exe
  2⤵
  PID:6940
- C:\Windows\System\pmDeGof.exe
  C:\Windows\System\pmDeGof.exe
  2⤵
  PID:6988
- C:\Windows\System\sMomNfC.exe
  C:\Windows\System\sMomNfC.exe
  2⤵
  PID:7020
- C:\Windows\System\pQNixnl.exe
  C:\Windows\System\pQNixnl.exe
  2⤵
  PID:7052
- C:\Windows\System\OvTnjKS.exe
  C:\Windows\System\OvTnjKS.exe
  2⤵
  PID:7068
- C:\Windows\System\xgilzGD.exe
  C:\Windows\System\xgilzGD.exe
  2⤵
  PID:7072
- C:\Windows\System\qfuRdMZ.exe
  C:\Windows\System\qfuRdMZ.exe
  2⤵
  PID:7104
- C:\Windows\System\NiimnoA.exe
  C:\Windows\System\NiimnoA.exe
  2⤵
  PID:7148
- C:\Windows\System\XecLBlb.exe
  C:\Windows\System\XecLBlb.exe
  2⤵
  PID:2064
- C:\Windows\System\arbrlkG.exe
  C:\Windows\System\arbrlkG.exe
  2⤵
  PID:2680
- C:\Windows\System\agDKjWM.exe
  C:\Windows\System\agDKjWM.exe
  2⤵
  PID:2424
- C:\Windows\System\bSzzUin.exe
  C:\Windows\System\bSzzUin.exe
  2⤵
  PID:6128
- C:\Windows\System\nQnDoiQ.exe
  C:\Windows\System\nQnDoiQ.exe
  2⤵
  PID:432
- C:\Windows\System\MscdXGn.exe
  C:\Windows\System\MscdXGn.exe
  2⤵
  PID:2832
- C:\Windows\System\BtqesFG.exe
  C:\Windows\System\BtqesFG.exe
  2⤵
  PID:5252
- C:\Windows\System\caxcsQu.exe
  C:\Windows\System\caxcsQu.exe
  2⤵
  PID:2996
- C:\Windows\System\RIqJPIQ.exe
  C:\Windows\System\RIqJPIQ.exe
  2⤵
  PID:6228
- C:\Windows\System\mQTKyTW.exe
  C:\Windows\System\mQTKyTW.exe
  2⤵
  PID:2992
- C:\Windows\System\yzQEoDL.exe
  C:\Windows\System\yzQEoDL.exe
  2⤵
  PID:6568
- C:\Windows\System\wrceypv.exe
  C:\Windows\System\wrceypv.exe
  2⤵
  PID:1784
- C:\Windows\System\YEyYHwJ.exe
  C:\Windows\System\YEyYHwJ.exe
  2⤵
  PID:6796
- C:\Windows\System\GgEgOgR.exe
  C:\Windows\System\GgEgOgR.exe
  2⤵
  PID:6860
- C:\Windows\System\feTXAyk.exe
  C:\Windows\System\feTXAyk.exe
  2⤵
  PID:2372
- C:\Windows\System\xVaYgSm.exe
  C:\Windows\System\xVaYgSm.exe
  2⤵
  PID:6960
- C:\Windows\System\CWwxTvq.exe
  C:\Windows\System\CWwxTvq.exe
  2⤵
  PID:2176
- C:\Windows\System\XcuKjyk.exe
  C:\Windows\System\XcuKjyk.exe
  2⤵
  PID:2344
- C:\Windows\System\ovWLlev.exe
  C:\Windows\System\ovWLlev.exe
  2⤵
  PID:7036
- C:\Windows\System\jDlOKVK.exe
  C:\Windows\System\jDlOKVK.exe
  2⤵
  PID:332
- C:\Windows\System\rBntjFu.exe
  C:\Windows\System\rBntjFu.exe
  2⤵
  PID:2116
- C:\Windows\System\GTEEeoS.exe
  C:\Windows\System\GTEEeoS.exe
  2⤵
  PID:1940
- C:\Windows\System\frBBHSz.exe
  C:\Windows\System\frBBHSz.exe
  2⤵
  PID:7136
- C:\Windows\System\rSeHUHN.exe
  C:\Windows\System\rSeHUHN.exe
  2⤵
  PID:1796
- C:\Windows\System\TNjaFsw.exe
  C:\Windows\System\TNjaFsw.exe
  2⤵
  PID:5984
- C:\Windows\System\BRsYVHY.exe
  C:\Windows\System\BRsYVHY.exe
  2⤵
  PID:320
- C:\Windows\System\KLPjPRd.exe
  C:\Windows\System\KLPjPRd.exe
  2⤵
  PID:5788
- C:\Windows\System\IZtEjxS.exe
  C:\Windows\System\IZtEjxS.exe
  2⤵
  PID:2404
- C:\Windows\System\kyjvZtV.exe
  C:\Windows\System\kyjvZtV.exe
  2⤵
  PID:6180
- C:\Windows\System\GmtXQdf.exe
  C:\Windows\System\GmtXQdf.exe
  2⤵
  PID:4772
- C:\Windows\System\ulfwtKP.exe
  C:\Windows\System\ulfwtKP.exe
  2⤵
  PID:1128
- C:\Windows\System\LxIQYkZ.exe
  C:\Windows\System\LxIQYkZ.exe
  2⤵
  PID:824
- C:\Windows\System\edetpGV.exe
  C:\Windows\System\edetpGV.exe
  2⤵
  PID:1724
- C:\Windows\System\NYnxdus.exe
  C:\Windows\System\NYnxdus.exe
  2⤵
  PID:3076
- C:\Windows\System\BrRQCvn.exe
  C:\Windows\System\BrRQCvn.exe
  2⤵
  PID:700
- C:\Windows\System\yJLvvEP.exe
  C:\Windows\System\yJLvvEP.exe
  2⤵
  PID:928
- C:\Windows\System\JFaYVEd.exe
  C:\Windows\System\JFaYVEd.exe
  2⤵
  PID:3528
- C:\Windows\System\FVMtLeg.exe
  C:\Windows\System\FVMtLeg.exe
  2⤵
  PID:6556
- C:\Windows\System\HrlCEOx.exe
  C:\Windows\System\HrlCEOx.exe
  2⤵
  PID:6584
- C:\Windows\System\QlGVXra.exe
  C:\Windows\System\QlGVXra.exe
  2⤵
  PID:2696
- C:\Windows\System\tabltwK.exe
  C:\Windows\System\tabltwK.exe
  2⤵
  PID:6716
- C:\Windows\System\ZnjjVfX.exe
  C:\Windows\System\ZnjjVfX.exe
  2⤵
  PID:6780
- C:\Windows\System\qPLavbc.exe
  C:\Windows\System\qPLavbc.exe
  2⤵
  PID:2096
- C:\Windows\System\JHmdcQG.exe
  C:\Windows\System\JHmdcQG.exe
  2⤵
  PID:6864
- C:\Windows\System\WfpRyNW.exe
  C:\Windows\System\WfpRyNW.exe
  2⤵
  PID:6956
- C:\Windows\System\QbnLqFd.exe
  C:\Windows\System\QbnLqFd.exe
  2⤵
  PID:3012
- C:\Windows\System\dASkFFy.exe
  C:\Windows\System\dASkFFy.exe
  2⤵
  PID:7056
- C:\Windows\System\PgIqIfH.exe
  C:\Windows\System\PgIqIfH.exe
  2⤵
  PID:688
- C:\Windows\System\CZlNzQm.exe
  C:\Windows\System\CZlNzQm.exe
  2⤵
  PID:368
- C:\Windows\System\ThGKBZD.exe
  C:\Windows\System\ThGKBZD.exe
  2⤵
  PID:6184
- C:\Windows\System\gbitild.exe
  C:\Windows\System\gbitild.exe
  2⤵
  PID:2220
- C:\Windows\System\PIQSxKY.exe
  C:\Windows\System\PIQSxKY.exe
  2⤵
  PID:980
- C:\Windows\System\teRJqWf.exe
  C:\Windows\System\teRJqWf.exe
  2⤵
  PID:2968
- C:\Windows\System\bLeMsNC.exe
  C:\Windows\System\bLeMsNC.exe
  2⤵
  PID:1900
- C:\Windows\System\kHypTqs.exe
  C:\Windows\System\kHypTqs.exe
  2⤵
  PID:6504
- C:\Windows\System\rOlJhIL.exe
  C:\Windows\System\rOlJhIL.exe
  2⤵
  PID:6632
- C:\Windows\System\PmUsoBv.exe
  C:\Windows\System\PmUsoBv.exe
  2⤵
  PID:6460
- C:\Windows\System\poTGRBv.exe
  C:\Windows\System\poTGRBv.exe
  2⤵
  PID:6748
- C:\Windows\System\IXeNurq.exe
  C:\Windows\System\IXeNurq.exe
  2⤵
  PID:3004
- C:\Windows\System\ktqFOKx.exe
  C:\Windows\System\ktqFOKx.exe
  2⤵
  PID:7116
- C:\Windows\System\mrOOLFN.exe
  C:\Windows\System\mrOOLFN.exe
  2⤵
  PID:6152
- C:\Windows\System\HVSqKMu.exe
  C:\Windows\System\HVSqKMu.exe
  2⤵
  PID:6216
- C:\Windows\System\SnEneev.exe
  C:\Windows\System\SnEneev.exe
  2⤵
  PID:2868
- C:\Windows\System\QkTQdku.exe
  C:\Windows\System\QkTQdku.exe
  2⤵
  PID:6924
- C:\Windows\System\ZUqTxJF.exe
  C:\Windows\System\ZUqTxJF.exe
  2⤵
  PID:1172
- C:\Windows\System\ckPqcFz.exe
  C:\Windows\System\ckPqcFz.exe
  2⤵
  PID:6972
- C:\Windows\System\HWvXgHf.exe
  C:\Windows\System\HWvXgHf.exe
  2⤵
  PID:1752
- C:\Windows\System\xpdYLht.exe
  C:\Windows\System\xpdYLht.exe
  2⤵
  PID:1224
- C:\Windows\System\tSkAISi.exe
  C:\Windows\System\tSkAISi.exe
  2⤵
  PID:2932
- C:\Windows\System\RAMXHDy.exe
  C:\Windows\System\RAMXHDy.exe
  2⤵
  PID:3500
- C:\Windows\System\xXEFftM.exe
  C:\Windows\System\xXEFftM.exe
  2⤵
  PID:2368
- C:\Windows\System\NKBNKbf.exe
  C:\Windows\System\NKBNKbf.exe
  2⤵
  PID:840
- C:\Windows\System\VMtKAeb.exe
  C:\Windows\System\VMtKAeb.exe
  2⤵
  PID:7188
- C:\Windows\System\ywzVcQz.exe
  C:\Windows\System\ywzVcQz.exe
  2⤵
  PID:7204
- C:\Windows\System\AmuvIFk.exe
  C:\Windows\System\AmuvIFk.exe
  2⤵
  PID:7224
- C:\Windows\System\QkjGhgO.exe
  C:\Windows\System\QkjGhgO.exe
  2⤵
  PID:7244
- C:\Windows\System\CykiRRU.exe
  C:\Windows\System\CykiRRU.exe
  2⤵
  PID:7276
- C:\Windows\System\taBTZUJ.exe
  C:\Windows\System\taBTZUJ.exe
  2⤵
  PID:7296
- C:\Windows\System\eMJHhIT.exe
  C:\Windows\System\eMJHhIT.exe
  2⤵
  PID:7316
- C:\Windows\System\wxtAGaz.exe
  C:\Windows\System\wxtAGaz.exe
  2⤵
  PID:7416
- C:\Windows\System\NhlPtqf.exe
  C:\Windows\System\NhlPtqf.exe
  2⤵
  PID:7432
- C:\Windows\System\EaKnlXN.exe
  C:\Windows\System\EaKnlXN.exe
  2⤵
  PID:7448
- C:\Windows\System\kYFSwoB.exe
  C:\Windows\System\kYFSwoB.exe
  2⤵
  PID:7468
- C:\Windows\System\rTnNsAc.exe
  C:\Windows\System\rTnNsAc.exe
  2⤵
  PID:7488
- C:\Windows\System\fYASSTB.exe
  C:\Windows\System\fYASSTB.exe
  2⤵
  PID:7552
- C:\Windows\System\OXDLtTi.exe
  C:\Windows\System\OXDLtTi.exe
  2⤵
  PID:7568
- C:\Windows\System\GKyyteF.exe
  C:\Windows\System\GKyyteF.exe
  2⤵
  PID:7656
- C:\Windows\System\JBgMoIS.exe
  C:\Windows\System\JBgMoIS.exe
  2⤵
  PID:7672
- C:\Windows\System\ZGCeQKH.exe
  C:\Windows\System\ZGCeQKH.exe
  2⤵
  PID:7688
- C:\Windows\System\myfslAw.exe
  C:\Windows\System\myfslAw.exe
  2⤵
  PID:7704
- C:\Windows\System\isiUpIF.exe
  C:\Windows\System\isiUpIF.exe
  2⤵
  PID:7720
- C:\Windows\System\DRkKGFy.exe
  C:\Windows\System\DRkKGFy.exe
  2⤵
  PID:7736
- C:\Windows\System\xKyXPFp.exe
  C:\Windows\System\xKyXPFp.exe
  2⤵
  PID:7752
- C:\Windows\System\NjRkJjz.exe
  C:\Windows\System\NjRkJjz.exe
  2⤵
  PID:7768
- C:\Windows\System\KgXRTnp.exe
  C:\Windows\System\KgXRTnp.exe
  2⤵
  PID:7784
- C:\Windows\System\MdzRWMp.exe
  C:\Windows\System\MdzRWMp.exe
  2⤵
  PID:7800
- C:\Windows\System\IaLJOKD.exe
  C:\Windows\System\IaLJOKD.exe
  2⤵
  PID:7816
- C:\Windows\System\CmIaXxn.exe
  C:\Windows\System\CmIaXxn.exe
  2⤵
  PID:7832
- C:\Windows\System\kZkRhJT.exe
  C:\Windows\System\kZkRhJT.exe
  2⤵
  PID:7848
- C:\Windows\System\iVqGmcv.exe
  C:\Windows\System\iVqGmcv.exe
  2⤵
  PID:7872
- C:\Windows\System\aqtTdKy.exe
  C:\Windows\System\aqtTdKy.exe
  2⤵
  PID:7888
- C:\Windows\System\ynVWXXS.exe
  C:\Windows\System\ynVWXXS.exe
  2⤵
  PID:7908
- C:\Windows\System\SFfTHMA.exe
  C:\Windows\System\SFfTHMA.exe
  2⤵
  PID:7936
- C:\Windows\System\KFFXDfD.exe
  C:\Windows\System\KFFXDfD.exe
  2⤵
  PID:7952
- C:\Windows\System\LqvUpAP.exe
  C:\Windows\System\LqvUpAP.exe
  2⤵
  PID:7968
- C:\Windows\System\NbXJRlU.exe
  C:\Windows\System\NbXJRlU.exe
  2⤵
  PID:7984
- C:\Windows\System\srboDZI.exe
  C:\Windows\System\srboDZI.exe
  2⤵
  PID:8000
- C:\Windows\System\FbLUNPd.exe
  C:\Windows\System\FbLUNPd.exe
  2⤵
  PID:8016
- C:\Windows\System\dByQnXC.exe
  C:\Windows\System\dByQnXC.exe
  2⤵
  PID:8032
- C:\Windows\System\kpzPDbC.exe
  C:\Windows\System\kpzPDbC.exe
  2⤵
  PID:8048
- C:\Windows\System\FWooXLZ.exe
  C:\Windows\System\FWooXLZ.exe
  2⤵
  PID:8064
- C:\Windows\System\aFhxXna.exe
  C:\Windows\System\aFhxXna.exe
  2⤵
  PID:8080
- C:\Windows\System\WTNiebT.exe
  C:\Windows\System\WTNiebT.exe
  2⤵
  PID:8096
- C:\Windows\System\SkPsqEC.exe
  C:\Windows\System\SkPsqEC.exe
  2⤵
  PID:8112
- C:\Windows\System\dYdhXok.exe
  C:\Windows\System\dYdhXok.exe
  2⤵
  PID:8128
- C:\Windows\System\dRfCaTV.exe
  C:\Windows\System\dRfCaTV.exe
  2⤵
  PID:8144
- C:\Windows\System\lTkExgU.exe
  C:\Windows\System\lTkExgU.exe
  2⤵
  PID:8160
- C:\Windows\System\nZnFzIh.exe
  C:\Windows\System\nZnFzIh.exe
  2⤵
  PID:8176
- C:\Windows\System\lrgsBcM.exe
  C:\Windows\System\lrgsBcM.exe
  2⤵
  PID:572
- C:\Windows\System\aoEzHqp.exe
  C:\Windows\System\aoEzHqp.exe
  2⤵
  PID:7324
- C:\Windows\System\DoIVLxY.exe
  C:\Windows\System\DoIVLxY.exe
  2⤵
  PID:7360
- C:\Windows\System\LYpVeVX.exe
  C:\Windows\System\LYpVeVX.exe
  2⤵
  PID:7384
- C:\Windows\System\DijJrts.exe
  C:\Windows\System\DijJrts.exe
  2⤵
  PID:7392
- C:\Windows\System\voYrHSt.exe
  C:\Windows\System\voYrHSt.exe
  2⤵
  PID:7404
- C:\Windows\System\NKUGgyf.exe
  C:\Windows\System\NKUGgyf.exe
  2⤵
  PID:7236
- C:\Windows\System\EmBdVbz.exe
  C:\Windows\System\EmBdVbz.exe
  2⤵
  PID:7460
- C:\Windows\System\jRYbJXQ.exe
  C:\Windows\System\jRYbJXQ.exe
  2⤵
  PID:7408
- C:\Windows\System\QyIfvHW.exe
  C:\Windows\System\QyIfvHW.exe
  2⤵
  PID:7336
- C:\Windows\System\PNCHUVX.exe
  C:\Windows\System\PNCHUVX.exe
  2⤵
  PID:7512
- C:\Windows\System\LKGwFds.exe
  C:\Windows\System\LKGwFds.exe
  2⤵
  PID:7532
- C:\Windows\System\cYaYquM.exe
  C:\Windows\System\cYaYquM.exe
  2⤵
  PID:7564
- C:\Windows\System\oxxYJDs.exe
  C:\Windows\System\oxxYJDs.exe
  2⤵
  PID:7664
- C:\Windows\System\ZBMlFIR.exe
  C:\Windows\System\ZBMlFIR.exe
  2⤵
  PID:7584
- C:\Windows\System\mIbiLeL.exe
  C:\Windows\System\mIbiLeL.exe
  2⤵
  PID:7600
- C:\Windows\System\DuHnalB.exe
  C:\Windows\System\DuHnalB.exe
  2⤵
  PID:7616
- C:\Windows\System\oywoZwK.exe
  C:\Windows\System\oywoZwK.exe
  2⤵
  PID:7632
- C:\Windows\System\SVeLrYO.exe
  C:\Windows\System\SVeLrYO.exe
  2⤵
  PID:7648
- C:\Windows\System\fLmzFqU.exe
  C:\Windows\System\fLmzFqU.exe
  2⤵
  PID:7684
- C:\Windows\System\mgTkJKb.exe
  C:\Windows\System\mgTkJKb.exe
  2⤵
  PID:7712
- C:\Windows\System\YLbQTKp.exe
  C:\Windows\System\YLbQTKp.exe
  2⤵
  PID:7716
- C:\Windows\System\SpZCcgJ.exe
  C:\Windows\System\SpZCcgJ.exe
  2⤵
  PID:7744
- C:\Windows\System\ZEpvIXj.exe
  C:\Windows\System\ZEpvIXj.exe
  2⤵
  PID:7860
- C:\Windows\System\iZlfgWS.exe
  C:\Windows\System\iZlfgWS.exe
  2⤵
  PID:7812
- C:\Windows\System\hNUpSVt.exe
  C:\Windows\System\hNUpSVt.exe
  2⤵
  PID:7216
- C:\Windows\System\sKUnxRM.exe
  C:\Windows\System\sKUnxRM.exe
  2⤵
  PID:7904
- C:\Windows\System\eCrWJvZ.exe
  C:\Windows\System\eCrWJvZ.exe
  2⤵
  PID:7312
- C:\Windows\System\GJbvwJV.exe
  C:\Windows\System\GJbvwJV.exe
  2⤵
  PID:7932
- C:\Windows\System\vyjLhnO.exe
  C:\Windows\System\vyjLhnO.exe
  2⤵
  PID:7980
- C:\Windows\System\ufRYRcF.exe
  C:\Windows\System\ufRYRcF.exe
  2⤵
  PID:8012
- C:\Windows\System\hiuCIJb.exe
  C:\Windows\System\hiuCIJb.exe
  2⤵
  PID:8024
- C:\Windows\System\NPJqbuO.exe
  C:\Windows\System\NPJqbuO.exe
  2⤵
  PID:8028
- C:\Windows\System\ucnGFLY.exe
  C:\Windows\System\ucnGFLY.exe
  2⤵
  PID:8088
- C:\Windows\System\otGMaAW.exe
  C:\Windows\System\otGMaAW.exe
  2⤵
  PID:8120
- C:\Windows\System\IxAXkxY.exe
  C:\Windows\System\IxAXkxY.exe
  2⤵
  PID:8168
- C:\Windows\System\MhVCvaC.exe
  C:\Windows\System\MhVCvaC.exe
  2⤵
  PID:7180
- C:\Windows\System\jSRsAYm.exe
  C:\Windows\System\jSRsAYm.exe
  2⤵
  PID:7256
- C:\Windows\System\hpMgisP.exe
  C:\Windows\System\hpMgisP.exe
  2⤵
  PID:8188
- C:\Windows\System\EwUzGHw.exe
  C:\Windows\System\EwUzGHw.exe
  2⤵
  PID:7376
- C:\Windows\System\PBmBEsq.exe
  C:\Windows\System\PBmBEsq.exe
  2⤵
  PID:7476
- C:\Windows\System\khFicNs.exe
  C:\Windows\System\khFicNs.exe
  2⤵
  PID:7496
- C:\Windows\System\OuWouGx.exe
  C:\Windows\System\OuWouGx.exe
  2⤵
  PID:7524
- C:\Windows\System\EKTFLjB.exe
  C:\Windows\System\EKTFLjB.exe
  2⤵
  PID:7548
- C:\Windows\System\CTQTBZd.exe
  C:\Windows\System\CTQTBZd.exe
  2⤵
  PID:7624
- C:\Windows\System\vnbrPFj.exe
  C:\Windows\System\vnbrPFj.exe
  2⤵
  PID:7612
- C:\Windows\System\qTLrSTU.exe
  C:\Windows\System\qTLrSTU.exe
  2⤵
  PID:7760
- C:\Windows\System\dVissBh.exe
  C:\Windows\System\dVissBh.exe
  2⤵
  PID:7796
- C:\Windows\System\GijfxSH.exe
  C:\Windows\System\GijfxSH.exe
  2⤵
  PID:7868
- C:\Windows\System\OxQrbKv.exe
  C:\Windows\System\OxQrbKv.exe
  2⤵
  PID:7264
- C:\Windows\System\mdMTjoU.exe
  C:\Windows\System\mdMTjoU.exe
  2⤵
  PID:7976
- C:\Windows\System\uZwOfrc.exe
  C:\Windows\System\uZwOfrc.exe
  2⤵
  PID:7924
- C:\Windows\System\FgmHsBB.exe
  C:\Windows\System\FgmHsBB.exe
  2⤵
  PID:8060
- C:\Windows\System\RRnHMVw.exe
  C:\Windows\System\RRnHMVw.exe
  2⤵
  PID:8156
- C:\Windows\System\WwQkYjs.exe
  C:\Windows\System\WwQkYjs.exe
  2⤵
  PID:7200
- C:\Windows\System\qnPvUPB.exe
  C:\Windows\System\qnPvUPB.exe
  2⤵
  PID:7240
- C:\Windows\System\NNWvrZr.exe
  C:\Windows\System\NNWvrZr.exe
  2⤵
  PID:7284
- C:\Windows\System\CsRgnpj.exe
  C:\Windows\System\CsRgnpj.exe
  2⤵
  PID:7400
- C:\Windows\System\RDmKHKc.exe
  C:\Windows\System\RDmKHKc.exe
  2⤵
  PID:7444
- C:\Windows\System\iJKVpOg.exe
  C:\Windows\System\iJKVpOg.exe
  2⤵
  PID:7592
- C:\Windows\System\wlTCNOh.exe
  C:\Windows\System\wlTCNOh.exe
  2⤵
  PID:7308
- C:\Windows\System\YRbaaEZ.exe
  C:\Windows\System\YRbaaEZ.exe
  2⤵
  PID:7508
- C:\Windows\System\foWUBfv.exe
  C:\Windows\System\foWUBfv.exe
  2⤵
  PID:7608
- C:\Windows\System\FfATPNk.exe
  C:\Windows\System\FfATPNk.exe
  2⤵
  PID:7792
- C:\Windows\System\nRjJCCD.exe
  C:\Windows\System\nRjJCCD.exe
  2⤵
  PID:7896
- C:\Windows\System\oryFKuX.exe
  C:\Windows\System\oryFKuX.exe
  2⤵
  PID:7948
- C:\Windows\System\sQVmwBV.exe
  C:\Windows\System\sQVmwBV.exe
  2⤵
  PID:7680
- C:\Windows\System\RGwgSWG.exe
  C:\Windows\System\RGwgSWG.exe
  2⤵
  PID:7344
- C:\Windows\System\RhAmGGY.exe
  C:\Windows\System\RhAmGGY.exe
  2⤵
  PID:8076
- C:\Windows\System\DFbASZd.exe
  C:\Windows\System\DFbASZd.exe
  2⤵
  PID:7964
- C:\Windows\System\WOaTJOJ.exe
  C:\Windows\System\WOaTJOJ.exe
  2⤵
  PID:7352
- C:\Windows\System\sAYIdUt.exe
  C:\Windows\System\sAYIdUt.exe
  2⤵
  PID:7372
- C:\Windows\System\oJNvHoG.exe
  C:\Windows\System\oJNvHoG.exe
  2⤵
  PID:7864
- C:\Windows\System\UcMfGvf.exe
  C:\Windows\System\UcMfGvf.exe
  2⤵
  PID:7700
- C:\Windows\System\qrsGpll.exe
  C:\Windows\System\qrsGpll.exe
  2⤵
  PID:7828
- C:\Windows\System\znWxRuw.exe
  C:\Windows\System\znWxRuw.exe
  2⤵
  PID:7996
- C:\Windows\System\rrBSYfS.exe
  C:\Windows\System\rrBSYfS.exe
  2⤵
  PID:8184
- C:\Windows\System\jADvuGW.exe
  C:\Windows\System\jADvuGW.exe
  2⤵
  PID:8208
- C:\Windows\System\cwlcWor.exe
  C:\Windows\System\cwlcWor.exe
  2⤵
  PID:8224
- C:\Windows\System\FrVzAnt.exe
  C:\Windows\System\FrVzAnt.exe
  2⤵
  PID:8240
- C:\Windows\System\lszVnpK.exe
  C:\Windows\System\lszVnpK.exe
  2⤵
  PID:8256
- C:\Windows\System\FeHcYIO.exe
  C:\Windows\System\FeHcYIO.exe
  2⤵
  PID:8272
- C:\Windows\System\nVNPRTJ.exe
  C:\Windows\System\nVNPRTJ.exe
  2⤵
  PID:8288
- C:\Windows\System\YMNsAAl.exe
  C:\Windows\System\YMNsAAl.exe
  2⤵
  PID:8304
- C:\Windows\System\yDfNGBP.exe
  C:\Windows\System\yDfNGBP.exe
  2⤵
  PID:8324
- C:\Windows\System\VdtWwhb.exe
  C:\Windows\System\VdtWwhb.exe
  2⤵
  PID:8344
- C:\Windows\System\twqWfFP.exe
  C:\Windows\System\twqWfFP.exe
  2⤵
  PID:8360
- C:\Windows\System\tyRQsoL.exe
  C:\Windows\System\tyRQsoL.exe
  2⤵
  PID:8376
- C:\Windows\System\ynvlNNo.exe
  C:\Windows\System\ynvlNNo.exe
  2⤵
  PID:8392
- C:\Windows\System\VNmrSOF.exe
  C:\Windows\System\VNmrSOF.exe
  2⤵
  PID:8408
- C:\Windows\System\oBMzMEU.exe
  C:\Windows\System\oBMzMEU.exe
  2⤵
  PID:8424
- C:\Windows\System\IFXFncp.exe
  C:\Windows\System\IFXFncp.exe
  2⤵
  PID:8440
- C:\Windows\System\zalswfb.exe
  C:\Windows\System\zalswfb.exe
  2⤵
  PID:8460
- C:\Windows\System\VmEsYOs.exe
  C:\Windows\System\VmEsYOs.exe
  2⤵
  PID:9180
- C:\Windows\System\UahPanG.exe
  C:\Windows\System\UahPanG.exe
  2⤵
  PID:9196
- C:\Windows\System\SmcngBB.exe
  C:\Windows\System\SmcngBB.exe
  2⤵
  PID:9212
- C:\Windows\System\BahdKOH.exe
  C:\Windows\System\BahdKOH.exe
  2⤵
  PID:7540
- C:\Windows\System\tTMROcD.exe
  C:\Windows\System\tTMROcD.exe
  2⤵
  PID:7640
- C:\Windows\System\QKcuSLc.exe
  C:\Windows\System\QKcuSLc.exe
  2⤵
  PID:8252
- C:\Windows\System\OfmsNKH.exe
  C:\Windows\System\OfmsNKH.exe
  2⤵
  PID:8236
- C:\Windows\System\tyAaldk.exe
  C:\Windows\System\tyAaldk.exe
  2⤵
  PID:8332
- C:\Windows\System\HuDNkAK.exe
  C:\Windows\System\HuDNkAK.exe
  2⤵
  PID:8368
- C:\Windows\System\PpuOuIq.exe
  C:\Windows\System\PpuOuIq.exe
  2⤵
  PID:8372
- C:\Windows\System\VFzQwib.exe
  C:\Windows\System\VFzQwib.exe
  2⤵
  PID:8404
- C:\Windows\System\JYitbmL.exe
  C:\Windows\System\JYitbmL.exe
  2⤵
  PID:8388
- C:\Windows\System\jBPEPhg.exe
  C:\Windows\System\jBPEPhg.exe
  2⤵
  PID:8456
- C:\Windows\System\yMmLlSS.exe
  C:\Windows\System\yMmLlSS.exe
  2⤵
  PID:8488
- C:\Windows\System\yjcrTWI.exe
  C:\Windows\System\yjcrTWI.exe
  2⤵
  PID:8508
- C:\Windows\System\HumuGrw.exe
  C:\Windows\System\HumuGrw.exe
  2⤵
  PID:8524
- C:\Windows\System\sHBIbeT.exe
  C:\Windows\System\sHBIbeT.exe
  2⤵
  PID:8540
- C:\Windows\System\IdlcrrY.exe
  C:\Windows\System\IdlcrrY.exe
  2⤵
  PID:8556
- C:\Windows\System\PniPhyi.exe
  C:\Windows\System\PniPhyi.exe
  2⤵
  PID:8576
- C:\Windows\System\mEcelZm.exe
  C:\Windows\System\mEcelZm.exe
  2⤵
  PID:8596
- C:\Windows\System\tlLTJqY.exe
  C:\Windows\System\tlLTJqY.exe
  2⤵
  PID:8612
- C:\Windows\System\SBcsYwg.exe
  C:\Windows\System\SBcsYwg.exe
  2⤵
  PID:8624
- C:\Windows\System\oNeHMth.exe
  C:\Windows\System\oNeHMth.exe
  2⤵
  PID:8644
- C:\Windows\System\pxMTCbw.exe
  C:\Windows\System\pxMTCbw.exe
  2⤵
  PID:8660
- C:\Windows\System\vWUwaMn.exe
  C:\Windows\System\vWUwaMn.exe
  2⤵
  PID:8676
- C:\Windows\System\PXsFGVz.exe
  C:\Windows\System\PXsFGVz.exe
  2⤵
  PID:8692
- C:\Windows\System\OxLoLdd.exe
  C:\Windows\System\OxLoLdd.exe
  2⤵
  PID:8708
- C:\Windows\System\hTrNyIh.exe
  C:\Windows\System\hTrNyIh.exe
  2⤵
  PID:8724
- C:\Windows\System\GytRnFh.exe
  C:\Windows\System\GytRnFh.exe
  2⤵
  PID:8740
- C:\Windows\System\yZVVHVM.exe
  C:\Windows\System\yZVVHVM.exe
  2⤵
  PID:8756
- C:\Windows\System\ihWtDxO.exe
  C:\Windows\System\ihWtDxO.exe
  2⤵
  PID:8772
- C:\Windows\System\GCphApn.exe
  C:\Windows\System\GCphApn.exe
  2⤵
  PID:8792
- C:\Windows\System\kKRNZZk.exe
  C:\Windows\System\kKRNZZk.exe
  2⤵
  PID:8808
- C:\Windows\System\oJcuyZv.exe
  C:\Windows\System\oJcuyZv.exe
  2⤵
  PID:8824
- C:\Windows\System\utcWAYG.exe
  C:\Windows\System\utcWAYG.exe
  2⤵
  PID:8836
- C:\Windows\System\tZYqVAq.exe
  C:\Windows\System\tZYqVAq.exe
  2⤵
  PID:8856
- C:\Windows\System\JOjRVkI.exe
  C:\Windows\System\JOjRVkI.exe
  2⤵
  PID:8864
- C:\Windows\System\iywZIlF.exe
  C:\Windows\System\iywZIlF.exe
  2⤵
  PID:8888
- C:\Windows\System\AnVdBol.exe
  C:\Windows\System\AnVdBol.exe
  2⤵
  PID:8904
- C:\Windows\System\tUEUlZO.exe
  C:\Windows\System\tUEUlZO.exe
  2⤵
  PID:8572
- C:\Windows\System\XAJhDtQ.exe
  C:\Windows\System\XAJhDtQ.exe
  2⤵
  PID:8940
- C:\Windows\System\GOYabEa.exe
  C:\Windows\System\GOYabEa.exe
  2⤵
  PID:8960
- C:\Windows\System\LVXFVst.exe
  C:\Windows\System\LVXFVst.exe
  2⤵
  PID:8976
- C:\Windows\System\yjciwWn.exe
  C:\Windows\System\yjciwWn.exe
  2⤵
  PID:8992
- C:\Windows\System\yCYEVCm.exe
  C:\Windows\System\yCYEVCm.exe
  2⤵
  PID:9008
- C:\Windows\System\dUrMlRK.exe
  C:\Windows\System\dUrMlRK.exe
  2⤵
  PID:9032
- C:\Windows\System\oqTVcTg.exe
  C:\Windows\System\oqTVcTg.exe
  2⤵
  PID:9048
- C:\Windows\System\BtUGnuy.exe
  C:\Windows\System\BtUGnuy.exe
  2⤵
  PID:9064
- C:\Windows\System\nJSCNtL.exe
  C:\Windows\System\nJSCNtL.exe
  2⤵
  PID:9080
- C:\Windows\System\NkwkziJ.exe
  C:\Windows\System\NkwkziJ.exe
  2⤵
  PID:9096
- C:\Windows\System\qokVafl.exe
  C:\Windows\System\qokVafl.exe
  2⤵
  PID:9112
- C:\Windows\System\XjKVvRT.exe
  C:\Windows\System\XjKVvRT.exe
  2⤵
  PID:9136
- C:\Windows\System\RalFrRU.exe
  C:\Windows\System\RalFrRU.exe
  2⤵
  PID:9160
- C:\Windows\System\RnJShZP.exe
  C:\Windows\System\RnJShZP.exe
  2⤵
  PID:9176
- C:\Windows\System\CrHUOWZ.exe
  C:\Windows\System\CrHUOWZ.exe
  2⤵
  PID:9192
- C:\Windows\System\ZWwbMXU.exe
  C:\Windows\System\ZWwbMXU.exe
  2⤵
  PID:8152
- C:\Windows\System\XMRDrfa.exe
  C:\Windows\System\XMRDrfa.exe
  2⤵
  PID:8008
- C:\Windows\System\fvSMUcn.exe
  C:\Windows\System\fvSMUcn.exe
  2⤵
  PID:8284
- C:\Windows\System\rgZeYrc.exe
  C:\Windows\System\rgZeYrc.exe
  2⤵
  PID:8436
- C:\Windows\System\fIunKPK.exe
  C:\Windows\System\fIunKPK.exe
  2⤵
  PID:8352
- C:\Windows\System\wlXmWZi.exe
  C:\Windows\System\wlXmWZi.exe
  2⤵
  PID:8472
- C:\Windows\System\lvtlpLY.exe
  C:\Windows\System\lvtlpLY.exe
  2⤵
  PID:8476
- C:\Windows\System\aFffIBV.exe
  C:\Windows\System\aFffIBV.exe
  2⤵
  PID:8532
- C:\Windows\System\mMrPBgy.exe
  C:\Windows\System\mMrPBgy.exe
  2⤵
  PID:8564
- C:\Windows\System\nlPUKFy.exe
  C:\Windows\System\nlPUKFy.exe
  2⤵
  PID:8588
- C:\Windows\System\gVgniXC.exe
  C:\Windows\System\gVgniXC.exe
  2⤵
  PID:8636
- C:\Windows\System\OyzVFfh.exe
  C:\Windows\System\OyzVFfh.exe
  2⤵
  PID:8668
- C:\Windows\System\SAuwpOH.exe
  C:\Windows\System\SAuwpOH.exe
  2⤵
  PID:8684
- C:\Windows\System\zuOZgbJ.exe
  C:\Windows\System\zuOZgbJ.exe
  2⤵
  PID:8716
- C:\Windows\System\kJMbRNH.exe
  C:\Windows\System\kJMbRNH.exe
  2⤵
  PID:8764
- C:\Windows\System\BGSpNDe.exe
  C:\Windows\System\BGSpNDe.exe
  2⤵
  PID:8780
- C:\Windows\System\dvmLUXI.exe
  C:\Windows\System\dvmLUXI.exe
  2⤵
  PID:8800
- C:\Windows\System\cZoJXEV.exe
  C:\Windows\System\cZoJXEV.exe
  2⤵
  PID:8868
- C:\Windows\System\txDhWPc.exe
  C:\Windows\System\txDhWPc.exe
  2⤵
  PID:8936
- C:\Windows\System\prpdLSY.exe
  C:\Windows\System\prpdLSY.exe
  2⤵
  PID:8912
- C:\Windows\System\XdjHlkU.exe
  C:\Windows\System\XdjHlkU.exe
  2⤵
  PID:8952
- C:\Windows\System\AlRszKl.exe
  C:\Windows\System\AlRszKl.exe
  2⤵
  PID:9004
- C:\Windows\System\FYcQuCX.exe
  C:\Windows\System\FYcQuCX.exe
  2⤵
  PID:9016
- C:\Windows\System\dYyNMRF.exe
  C:\Windows\System\dYyNMRF.exe
  2⤵
  PID:9072
- C:\Windows\System\OoxODwU.exe
  C:\Windows\System\OoxODwU.exe
  2⤵
  PID:9060
- C:\Windows\System\WFNAhfO.exe
  C:\Windows\System\WFNAhfO.exe
  2⤵
  PID:9132
- C:\Windows\System\hOzXqEm.exe
  C:\Windows\System\hOzXqEm.exe
  2⤵
  PID:9188
- C:\Windows\System\cFGfvYZ.exe
  C:\Windows\System\cFGfvYZ.exe
  2⤵
  PID:9168
- C:\Windows\System\HdbcgDF.exe
  C:\Windows\System\HdbcgDF.exe
  2⤵
  PID:7728
- C:\Windows\System\GtBlblu.exe
  C:\Windows\System\GtBlblu.exe
  2⤵
  PID:8420
- C:\Windows\System\KUNVsxV.exe
  C:\Windows\System\KUNVsxV.exe
  2⤵
  PID:8932
- C:\Windows\System\ubLvjrl.exe
  C:\Windows\System\ubLvjrl.exe
  2⤵
  PID:8548
- C:\Windows\System\TqWUhkV.exe
  C:\Windows\System\TqWUhkV.exe
  2⤵
  PID:8768
- C:\Windows\System\FNqRiDx.exe
  C:\Windows\System\FNqRiDx.exe
  2⤵
  PID:8832
- C:\Windows\System\JSpsMmz.exe
  C:\Windows\System\JSpsMmz.exe
  2⤵
  PID:8896
- C:\Windows\System\uLCjlFr.exe
  C:\Windows\System\uLCjlFr.exe
  2⤵
  PID:8552
- C:\Windows\System\jTFaAuD.exe
  C:\Windows\System\jTFaAuD.exe
  2⤵
  PID:8988
- C:\Windows\System\MAJzUvm.exe
  C:\Windows\System\MAJzUvm.exe
  2⤵
  PID:9092
- C:\Windows\System\jyhneFk.exe
  C:\Windows\System\jyhneFk.exe
  2⤵
  PID:8452
- C:\Windows\System\rWgNrYz.exe
  C:\Windows\System\rWgNrYz.exe
  2⤵
  PID:8704
- C:\Windows\System\bvWsXHM.exe
  C:\Windows\System\bvWsXHM.exe
  2⤵
  PID:8736
- C:\Windows\System\EeFqyag.exe
  C:\Windows\System\EeFqyag.exe
  2⤵
  PID:8972
- C:\Windows\System\DyOBjpR.exe
  C:\Windows\System\DyOBjpR.exe
  2⤵
  PID:9020
- C:\Windows\System\hnsbBlZ.exe
  C:\Windows\System\hnsbBlZ.exe
  2⤵
  PID:8812
- C:\Windows\System\EvHmmLo.exe
  C:\Windows\System\EvHmmLo.exe
  2⤵
  PID:9156
- C:\Windows\System\QFAyhMm.exe
  C:\Windows\System\QFAyhMm.exe
  2⤵
  PID:8744
- C:\Windows\System\EPYrCKV.exe
  C:\Windows\System\EPYrCKV.exe
  2⤵
  PID:8248
- C:\Windows\System\DNsBuZA.exe
  C:\Windows\System\DNsBuZA.exe
  2⤵
  PID:7184
- C:\Windows\System\cDYnUJR.exe
  C:\Windows\System\cDYnUJR.exe
  2⤵
  PID:9056
- C:\Windows\System\QFwMDhr.exe
  C:\Windows\System\QFwMDhr.exe
  2⤵
  PID:8516
- C:\Windows\System\gCtiaLE.exe
  C:\Windows\System\gCtiaLE.exe
  2⤵
  PID:8876
- C:\Windows\System\wOVLWCC.exe
  C:\Windows\System\wOVLWCC.exe
  2⤵
  PID:9224
- C:\Windows\System\sbgAnzT.exe
  C:\Windows\System\sbgAnzT.exe
  2⤵
  PID:9240
- C:\Windows\System\fVjudKC.exe
  C:\Windows\System\fVjudKC.exe
  2⤵
  PID:9256
- C:\Windows\System\CbAVnlf.exe
  C:\Windows\System\CbAVnlf.exe
  2⤵
  PID:9272
- C:\Windows\System\tLGABkH.exe
  C:\Windows\System\tLGABkH.exe
  2⤵
  PID:9288
- C:\Windows\System\lTaLiUv.exe
  C:\Windows\System\lTaLiUv.exe
  2⤵
  PID:9304
- C:\Windows\System\PpTfjgw.exe
  C:\Windows\System\PpTfjgw.exe
  2⤵
  PID:9320
- C:\Windows\System\WrMpiXW.exe
  C:\Windows\System\WrMpiXW.exe
  2⤵
  PID:9336
- C:\Windows\System\GEeHcFO.exe
  C:\Windows\System\GEeHcFO.exe
  2⤵
  PID:9352
- C:\Windows\System\ytitNuP.exe
  C:\Windows\System\ytitNuP.exe
  2⤵
  PID:9368
- C:\Windows\System\MmvfzZT.exe
  C:\Windows\System\MmvfzZT.exe
  2⤵
  PID:9384
- C:\Windows\System\cmTUAHx.exe
  C:\Windows\System\cmTUAHx.exe
  2⤵
  PID:9400
- C:\Windows\System\IkmzzJw.exe
  C:\Windows\System\IkmzzJw.exe
  2⤵
  PID:9416
- C:\Windows\System\eZMLfiU.exe
  C:\Windows\System\eZMLfiU.exe
  2⤵
  PID:9432
- C:\Windows\System\ByXAhKU.exe
  C:\Windows\System\ByXAhKU.exe
  2⤵
  PID:9448
- C:\Windows\System\jOfLUJI.exe
  C:\Windows\System\jOfLUJI.exe
  2⤵
  PID:9464
- C:\Windows\System\DXIdFlD.exe
  C:\Windows\System\DXIdFlD.exe
  2⤵
  PID:9480
- C:\Windows\System\wrboxuT.exe
  C:\Windows\System\wrboxuT.exe
  2⤵
  PID:9504
- C:\Windows\System\dytnrOJ.exe
  C:\Windows\System\dytnrOJ.exe
  2⤵
  PID:9524
- C:\Windows\System\faQTyOQ.exe
  C:\Windows\System\faQTyOQ.exe
  2⤵
  PID:9544
- C:\Windows\System\VwGEoGV.exe
  C:\Windows\System\VwGEoGV.exe
  2⤵
  PID:9568
- C:\Windows\System\MhgLDLP.exe
  C:\Windows\System\MhgLDLP.exe
  2⤵
  PID:9592
- C:\Windows\System\BZrTSMj.exe
  C:\Windows\System\BZrTSMj.exe
  2⤵
  PID:9608
- C:\Windows\System\yQwssOS.exe
  C:\Windows\System\yQwssOS.exe
  2⤵
  PID:9632
- C:\Windows\System\FPsoeMX.exe
  C:\Windows\System\FPsoeMX.exe
  2⤵
  PID:9656
- C:\Windows\System\rzeBKvA.exe
  C:\Windows\System\rzeBKvA.exe
  2⤵
  PID:9672
- C:\Windows\System\nFnzqwz.exe
  C:\Windows\System\nFnzqwz.exe
  2⤵
  PID:9688
- C:\Windows\System\APhPrso.exe
  C:\Windows\System\APhPrso.exe
  2⤵
  PID:9712
- C:\Windows\System\FgUpfUk.exe
  C:\Windows\System\FgUpfUk.exe
  2⤵
  PID:9728
- C:\Windows\System\HUUdwDS.exe
  C:\Windows\System\HUUdwDS.exe
  2⤵
  PID:9784
- C:\Windows\System\xVZUNYs.exe
  C:\Windows\System\xVZUNYs.exe
  2⤵
  PID:9804
- C:\Windows\System\cJAhPwT.exe
  C:\Windows\System\cJAhPwT.exe
  2⤵
  PID:9824
- C:\Windows\System\vIHTWdS.exe
  C:\Windows\System\vIHTWdS.exe
  2⤵
  PID:9840
- C:\Windows\System\BdHdqhE.exe
  C:\Windows\System\BdHdqhE.exe
  2⤵
  PID:9856
- C:\Windows\System\EyONziV.exe
  C:\Windows\System\EyONziV.exe
  2⤵
  PID:9888
- C:\Windows\System\umEltew.exe
  C:\Windows\System\umEltew.exe
  2⤵
  PID:9908
- C:\Windows\System\AOiSJYu.exe
  C:\Windows\System\AOiSJYu.exe
  2⤵
  PID:9924
- C:\Windows\System\HOHTEOL.exe
  C:\Windows\System\HOHTEOL.exe
  2⤵
  PID:9940
- C:\Windows\System\tNjPucp.exe
  C:\Windows\System\tNjPucp.exe
  2⤵
  PID:9956
- C:\Windows\System\InQGArx.exe
  C:\Windows\System\InQGArx.exe
  2⤵
  PID:9976
- C:\Windows\System\cXWldZF.exe
  C:\Windows\System\cXWldZF.exe
  2⤵
  PID:9992
- C:\Windows\System\NAIliJb.exe
  C:\Windows\System\NAIliJb.exe
  2⤵
  PID:10008
- C:\Windows\System\PdzjZpX.exe
  C:\Windows\System\PdzjZpX.exe
  2⤵
  PID:10024
- C:\Windows\System\DtTdeFU.exe
  C:\Windows\System\DtTdeFU.exe
  2⤵
  PID:10040
- C:\Windows\System\JbxhReI.exe
  C:\Windows\System\JbxhReI.exe
  2⤵
  PID:10060
- C:\Windows\System\IMYaQCz.exe
  C:\Windows\System\IMYaQCz.exe
  2⤵
  PID:10080
- C:\Windows\System\HZnQiyq.exe
  C:\Windows\System\HZnQiyq.exe
  2⤵
  PID:10100
- C:\Windows\System\LltHTkC.exe
  C:\Windows\System\LltHTkC.exe
  2⤵
  PID:10120
- C:\Windows\System\MuBLlrf.exe
  C:\Windows\System\MuBLlrf.exe
  2⤵
  PID:10144
- C:\Windows\System\cohzEpo.exe
  C:\Windows\System\cohzEpo.exe
  2⤵
  PID:10160
- C:\Windows\System\IbgWpHb.exe
  C:\Windows\System\IbgWpHb.exe
  2⤵
  PID:10184
- C:\Windows\System\gsjVEcP.exe
  C:\Windows\System\gsjVEcP.exe
  2⤵
  PID:10204
- C:\Windows\System\FuTznXp.exe
  C:\Windows\System\FuTznXp.exe
  2⤵
  PID:10220
- C:\Windows\System\mhTxPvZ.exe
  C:\Windows\System\mhTxPvZ.exe
  2⤵
  PID:10236
- C:\Windows\System\xcyXObz.exe
  C:\Windows\System\xcyXObz.exe
  2⤵
  PID:868
- C:\Windows\System\dIvhxjZ.exe
  C:\Windows\System\dIvhxjZ.exe
  2⤵
  PID:7900
- C:\Windows\System\DJQFOkh.exe
  C:\Windows\System\DJQFOkh.exe
  2⤵
  PID:8608
- C:\Windows\System\cIDZjJu.exe
  C:\Windows\System\cIDZjJu.exe
  2⤵
  PID:9268
- C:\Windows\System\KstwGbJ.exe
  C:\Windows\System\KstwGbJ.exe
  2⤵
  PID:9312
- C:\Windows\System\zZixDHt.exe
  C:\Windows\System\zZixDHt.exe
  2⤵
  PID:9332
- C:\Windows\System\nWcxJCn.exe
  C:\Windows\System\nWcxJCn.exe
  2⤵
  PID:9364
- C:\Windows\System\daAsgIl.exe
  C:\Windows\System\daAsgIl.exe
  2⤵
  PID:9408
- C:\Windows\System\CMUjWdS.exe
  C:\Windows\System\CMUjWdS.exe
  2⤵
  PID:9396
- C:\Windows\System\pmWCVNc.exe
  C:\Windows\System\pmWCVNc.exe
  2⤵
  PID:9476
- C:\Windows\System\PozWDlt.exe
  C:\Windows\System\PozWDlt.exe
  2⤵
  PID:9492
- C:\Windows\System\jaStJJT.exe
  C:\Windows\System\jaStJJT.exe
  2⤵
  PID:9552
- C:\Windows\System\qnihlxJ.exe
  C:\Windows\System\qnihlxJ.exe
  2⤵
  PID:9600
- C:\Windows\System\eEiRIKD.exe
  C:\Windows\System\eEiRIKD.exe
  2⤵
  PID:9652
- C:\Windows\System\vjbuppH.exe
  C:\Windows\System\vjbuppH.exe
  2⤵
  PID:9540
- C:\Windows\System\cGwYWjq.exe
  C:\Windows\System\cGwYWjq.exe
  2⤵
  PID:9584
- C:\Windows\System\gmSUjIh.exe
  C:\Windows\System\gmSUjIh.exe
  2⤵
  PID:9628
- C:\Windows\System\EerzNBY.exe
  C:\Windows\System\EerzNBY.exe
  2⤵
  PID:9724
- C:\Windows\System\NUjzHBt.exe
  C:\Windows\System\NUjzHBt.exe
  2⤵
  PID:9760
- C:\Windows\System\mhjQyaL.exe
  C:\Windows\System\mhjQyaL.exe
  2⤵
  PID:9700
- C:\Windows\System\aeFGkXE.exe
  C:\Windows\System\aeFGkXE.exe
  2⤵
  PID:9740
- C:\Windows\System\XcyGeam.exe
  C:\Windows\System\XcyGeam.exe
  2⤵
  PID:9796
- C:\Windows\System\rnXyybI.exe
  C:\Windows\System\rnXyybI.exe
  2⤵
  PID:9836
- C:\Windows\System\HhnoKEx.exe
  C:\Windows\System\HhnoKEx.exe
  2⤵
  PID:9852
- C:\Windows\System\UyWzhpx.exe
  C:\Windows\System\UyWzhpx.exe
  2⤵
  PID:9916
- C:\Windows\System\GZfjSNL.exe
  C:\Windows\System\GZfjSNL.exe
  2⤵
  PID:9896
- C:\Windows\System\zZvJrYL.exe
  C:\Windows\System\zZvJrYL.exe
  2⤵
  PID:9968
- C:\Windows\System\bkmMuFg.exe
  C:\Windows\System\bkmMuFg.exe
  2⤵
  PID:10016
- C:\Windows\System\ZmeYxmF.exe
  C:\Windows\System\ZmeYxmF.exe
  2⤵
  PID:10056
- C:\Windows\System\hUtYoKz.exe
  C:\Windows\System\hUtYoKz.exe
  2⤵
  PID:10092
- C:\Windows\System\dpWYHPs.exe
  C:\Windows\System\dpWYHPs.exe
  2⤵
  PID:10132
- C:\Windows\System\tDIcdYu.exe
  C:\Windows\System\tDIcdYu.exe
  2⤵
  PID:10156
- C:\Windows\System\pEhKVDf.exe
  C:\Windows\System\pEhKVDf.exe
  2⤵
  PID:10176
- C:\Windows\System\kMLzWPt.exe
  C:\Windows\System\kMLzWPt.exe
  2⤵
  PID:10196
- C:\Windows\System\bvyAFin.exe
  C:\Windows\System\bvyAFin.exe
  2⤵
  PID:9000
- C:\Windows\System\BRrGRDf.exe
  C:\Windows\System\BRrGRDf.exe
  2⤵
  PID:8848
- C:\Windows\System\HUEVpsY.exe
  C:\Windows\System\HUEVpsY.exe
  2⤵
  PID:9296
- C:\Windows\System\OaEqHSG.exe
  C:\Windows\System\OaEqHSG.exe
  2⤵
  PID:9380
- C:\Windows\System\xMDJkWz.exe
  C:\Windows\System\xMDJkWz.exe
  2⤵
  PID:9648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AzdxrHT.exe

Filesize
3.9MB

MD5
1f0ba494ec16017ccf1c60754d4772c7

SHA1
7998d632fd7149dfb3030e604e91a5c4ffba2eba

SHA256
6c8a9f486c3f034687a9d035f7448170737dad8f45834ec534893999a57d2df7

SHA512
e62beae4715d3e60dea097ecdce23058b8fd4be42ef35eca546bb17ae863fcbce9bb453d7d885a4e9cf292cdddcf1511c1bb79913ae3232b4869781a51cd4917

Download Submit
C:\Windows\system\FDLyYta.exe

Filesize
3.9MB

MD5
04eb25a98bee7e7d5701fa4322e5b50b

SHA1
a856edfa5ce43399ff2401ac4acc4d7395b8c6e7

SHA256
9258ef15beb92aeae74c2a944fdbeecfebb0ddf9c8d60fadba0c93893747e61c

SHA512
1f196a970cc04d24ff3e56fa8087f05fe216c54c94eba698ead04c68632c8c25b96ea820b67add0e13b844006e295130f1a3f0981584c547e537e44103f6da60

Download Submit
C:\Windows\system\KvkZUpB.exe

Filesize
3.9MB

MD5
93204e2accf2a1e9e5f48cd54c23ca88

SHA1
c91721acb2236d26b21bcdd84ff0dcce4bdb00ef

SHA256
dff02bbbc4ebd0db1d837f95f25277e21a475d1d386662871e6412cd608eae0e

SHA512
327f8e6de53e2f3bcfe1c6685af4a95eb76b1c4e50fb04d8ac4c40a0e8b86a8b655a4aa5164b030200e9c8d087bb8fd745bd07a22d480de1b9654c17a6e3704d

Download Submit
C:\Windows\system\LtdhNMx.exe

Filesize
3.9MB

MD5
491455dcf8f6fe5248423c8ba75be36a

SHA1
5f654797bd6d522cadf2c67c9e9d92ed0739c09e

SHA256
e09f36a2d4cc3deb7a68e26707b2a31bd22642b3483647d2b289c4edaece6b25

SHA512
3dee8a11fd91c67674fca8705babb75e1fad3ab4475725438be5278d58d3f21a1090e05264012f099142b8c19a0cb67df20a20092606ad7643b2a4ada299c367

Download Submit
C:\Windows\system\MIKXayj.exe

Filesize
3.9MB

MD5
96ddd9f5edc89c941b242cec2dfee157

SHA1
cfd0cc2393adad9a2f490ee888ea879df8c4f74f

SHA256
650c46178e4897de600f8bc1df785acc0a93ea1f2d0bf86eee1d752fca790071

SHA512
8139013d9d20bfbde809a4543a1fad99743c0d72f2e42fc737ba62c73d7099064c7854cfd942306b195feb9a84ce521edb952d6fb1311ceaefbabfce2c15688a

Download Submit
C:\Windows\system\NffDWUk.exe

Filesize
3.9MB

MD5
cacbcedd4ebe990d287cbe3d058b4882

SHA1
79d914187e981f7c549691690ad41625ae94e3f4

SHA256
f269799c6ba8e23c8fa97c9a23f5d498b8f3b16d33d8b1c33e12ff816f0aec1f

SHA512
e91fa61d503cfd59d62e091766408a624798d475a8d1040825d550695f4d8ad280a502e1b7dda63319f5f787dbbe11bc263c5f2df65ff73201b03d099c464e79

Download Submit
C:\Windows\system\OxKdnQa.exe

Filesize
3.9MB

MD5
f859a39fa22b7847b471ff35f339ca3e

SHA1
658c374e9bb46c8b51df7d41331c60082a84b4f2

SHA256
e586121dbc03ad42d6852ac79f64c2427452df8bd52722451f9c14ee96ab034e

SHA512
1945329db1dbe892f172a61f337fea6e11ef9f90acce660a7b20696df3670618f94bf6a452aab710a6ce2a87e4a27d1d64de20b066ac8da805ccaed4350875d0

Download Submit
C:\Windows\system\PTsqAJk.exe

Filesize
3.9MB

MD5
ccf1645a43ba8747cfc66df0b9c33ee6

SHA1
5496de14c7163977647273a88ac943dbe019d3c0

SHA256
5111082539f6fc3f43187a9de270fddc5abfbcfbe5c6db0cc6b2a6c0d2b544fa

SHA512
95093e0b94f5df24332c4a23a0898470fb4684da8c2c75108ccca57b54ebbebae5d441423c3f16fcbe18103a40b6e8d974bf889a013d6991d7f82001011cbbd5

Download Submit
C:\Windows\system\ULHbMlB.exe

Filesize
3.9MB

MD5
cc65415db8aee41752f26bca05337682

SHA1
4db92366ba540440606f46dc21d0a370bcd7074e

SHA256
3fa9825e4dda0c4e689ffc533e177ceec4f99185882ba738c3c7679e08fec7f5

SHA512
27918b1fc1a9b841be778524f780b0f55e061b73161cde3fadb0e52bf88a12f05c5d94dee8d3931501c3b6b3c6e78360c0f9a8f9141b91d0e63741dd48329a72

Download Submit
C:\Windows\system\WfxzZiM.exe

Filesize
3.9MB

MD5
fd2154c16a97efb4fea54ea54a0f07e4

SHA1
dd0fe4c1970c2c25a4760515276cc40afc1ea26c

SHA256
c5e386c66fa31a0ce9051b58a5d1d75b7a3b59b114cd34e652ad331a1304dbaa

SHA512
b54ce60e99626730e8e14f503815631ee373ff94a6b7e6c41ca2d27023fda57840eb35952da144c530ae1c855ed2d30d14500a43f52c2b3e7f33715ac3c8b574

Download Submit
C:\Windows\system\YTtnjve.exe

Filesize
3.9MB

MD5
e2791d18c153bb85e71090f5c198cb50

SHA1
7843734655536ea215c1052a23d8b8fb6be36949

SHA256
9d1accd1f5d22552f74763c742231633b216759171d9e446a1b7c5b5244fd188

SHA512
5c0bba7b3b0f1901ebdc381c6c86be7d90b2e0823827db47ef0074dfd73439df9b0560ccc135297bc07a383941c4293761a99d1f1400c9017e1804d01b25c003

Download Submit
C:\Windows\system\YbjCQWz.exe

Filesize
3.9MB

MD5
74933cf84564bcb65a8834ab9b36bf3c

SHA1
21bc648f801e9459a775f9bcbc424ee673d308eb

SHA256
90ec2ed780e882b67e6dddff7d3dad571e7d77a9fe3dbe5625d4d6d36d59d549

SHA512
e1b7460238c28087b6962cf04b0d8d51e927652acdff1e411dcbd6587fb1602707204d00945dd1c1e6fa5bd42a9b884881dabf58ec7ebb00568695dff20ea534

Download Submit
C:\Windows\system\YiaUQFA.exe

Filesize
3.9MB

MD5
d8ecb240a417a2e896eeb2ee05b44ad7

SHA1
1e5cc4d8309d0e468fdd1a88cfedb0923cd850c8

SHA256
401e4b8605a224e25dae13d7e3c30d268c2f27bfa95dc5a60dc6c4ab188aa745

SHA512
5f6d9581f69673f19e7fe31707a05b4717ebbe6a835a697d42e373e7604c6a9eb4d181aef420b7bc78a4215d2ac9d86841ffe1a4da8ccdaaed5e342e139489b3

Download Submit
C:\Windows\system\aWnPxvn.exe

Filesize
3.9MB

MD5
65f5b50a3f6d47b4e7e2cc9826cdaf55

SHA1
498fe4c36cf0554b655e8f127e7b9a48602f3da8

SHA256
78133df9a787ecd569e84d514d68b8298f0b4bc16bad587d44b8758efbae13a6

SHA512
7d347286bc1191c29874d5babcbfc01d8c0b05fea326cd04b5352a2aca50d39515bce8573b7efcd3c7aa50dc03822ba8f1566580e796b4c77f319c1ec0fca7fa

Download Submit
C:\Windows\system\ecaAlLs.exe

Filesize
3.9MB

MD5
7bf678d19303d6a78eebad75af903080

SHA1
2af8d724ba9d10235d090aa39456d8c706ab5b7c

SHA256
7451f9237813eab7fd835bfc8953602c13bcb00e14e425b1a4445ca7c767631a

SHA512
752942d0470b2a17c567674991ea833089d07628c360875ddeca575eee4e5a8b216f2f976333dcbad3e506d631b45135f4dec91ab8d9db693e3fbf4b175312fd

Download Submit
C:\Windows\system\gSbBjOJ.exe

Filesize
3.9MB

MD5
8c0739368b887d4aa0fa22acc5b4c489

SHA1
7ad7fbb2c942f729e78e9a6f702cb92d2c3754a7

SHA256
b1dc65132b603b7f5eca5a18264009bd1e48831f5c0ece1c03a3c48a9571058a

SHA512
ec82e3b71d238c75f934f0bc1f64a765f7908417e7d4c01542a669942ae74e3555b5b828534b08c279f8370f3e83b0ba974d48d1fee9b000ff8664f504110bc8

Download Submit
C:\Windows\system\gbUUZTM.exe

Filesize
3.9MB

MD5
ec8c4514da52fbc490d50e2ed34fd4f7

SHA1
25cf74922849f0ab8b1804c1ac354190f8352ed0

SHA256
80e1cafa396dd1fde496a850d8ec85e79df6ae9df9edfd4c9c27e751b8713ecd

SHA512
f7df1a556de9b961bcc3f2e97b766d015bc083c8aa3af2382b178f04b2ce607544ff460dcee3c921d8bd1568a15cc193ccb48f4135937e5b9a787601b2a77edc

Download Submit
C:\Windows\system\hQLqVic.exe

Filesize
3.9MB

MD5
1aeca0c47c589c9b5de0fd818ab71c36

SHA1
416394d285608b04875b85a58f7b7f05508a30ff

SHA256
b50ac57290fc601c5be394f5b5b60df948f9579c790f66b0006b845fb015e862

SHA512
2575d3c6183cfec1856c9368e1de5ed2353a6f4c8b862666a38a9945e50f6d69b3175decd0c5acfdd7ac390182db3779b5176ba0cd62de18100cdae5bb723a37

Download Submit
C:\Windows\system\kcgcFhu.exe

Filesize
3.9MB

MD5
5a81079495279ce47d29390bcf8f91d6

SHA1
74b064f6d90c241f0ff5b332a4fa89a65f2c7f9f

SHA256
b36b808b71ccede41a22d83637175b8b0183ecd649aaf5b042dad7f7b7115b8d

SHA512
4b8ca39fc2a5312c5d1d7c5f1cf7905c4ca86a3e2cea59e00ff4cc5827c8035c28f92ce4c8c8b17fdddcaa3c856e3639d4289771cc79ddcf13b70dbf86c33610

Download Submit
C:\Windows\system\nYNInWi.exe

Filesize
3.9MB

MD5
5a07b6c481b152c4e89912f21c321173

SHA1
491b93264a0b1f94480b39eb180a91dabc845f41

SHA256
3e6e1e963223bec3bbbfff9e0e43bc77ca994b51ba32661a1519e47acfb1c279

SHA512
0ed0ee789171609b2ced6851f0c0ee815d7b4b661fb1d03e2077033d4fa4a09e456aecf857cb994445233dd1fb0797e3914e26c72df8df8b01d971fff1a6dbc4

Download Submit
C:\Windows\system\qGgnZBT.exe

Filesize
3.9MB

MD5
324a9137546cf3c929cfd3991ebe9588

SHA1
5db887c373393794a99204044f19d141fcdc4923

SHA256
7f316d90eca1f94ed8209845520d17fe7f574ab998c0aead880a32dc2a0760e6

SHA512
79207ded3a60e87de77c6b40a7de66b3fa339b391fa029af5deba9c5f5331202db0d8a825122a9318c79d69f46ab3892bf6079b52d7e5d8f12613431dc6ab503

Download Submit
C:\Windows\system\qsrftxF.exe

Filesize
3.9MB

MD5
3c6fc396603927cdec2ce5bc6fbd6f7b

SHA1
32133c23559096693e780dcd3b440b756955f149

SHA256
bc7482442da3e52ca3d5a0fb4db2cb0a7de6ba59c4d7dc9cfe3f84fd1754c960

SHA512
43a0c7ee0223a20aaf5e80794f28d80509ef63a1db3d837f718453098330d77da3508cd3407675c09aafe16eb80ba077545e10071c2255467a08ec32f28035d0

Download Submit
C:\Windows\system\tprIhQG.exe

Filesize
3.9MB

MD5
21564755a23754d56a29e54089534f56

SHA1
c0161211fb6511075e01f17c586562adc0729f1a

SHA256
f7a6dc67e9ea46b38601fed9ba8e64a2c68490abd900cff9575d2553fc8db57a

SHA512
1e6e4aaec010c0e68cf0c7847f058e7c015b537c03be9f7a396b27250178e1ee2edca9577a3580ae1d78a400bcef60cf05ce0ae7470fe2d42d9d912ff3350dcd

Download Submit
C:\Windows\system\tyroizc.exe

Filesize
3.9MB

MD5
94a848df60ce081cc7c78cd726cbfcf9

SHA1
149354d858ea6f678b885efa69074552c9d667aa

SHA256
ef5ed628f0de87bb0bb8f0c12bb1019449e5b2a1c6a55d1d3af1f1ac508adbaf

SHA512
eb724fb44c2c32db6a818c057dcf95f5435a05f23158ea0610015b433bfe2c0a8830e94e4f4e183bc5017df4b4a99c0cc24517c4454150156206f3cbed5573e4

Download Submit
C:\Windows\system\uTVVPFQ.exe

Filesize
3.9MB

MD5
ddd85e31749fe551cb46a6e71e27deae

SHA1
262f83d77a066d5c02510c45f52eef48db06742d

SHA256
3286d43246fa5c7ebff6d9dbee28ecf07c3f51f86d955dc50e1b5db3e06e970f

SHA512
f81ea93b614cc09b23d57bcd67aae5f7cd9cc4872c8ad22bd9439690f1f718bea2984d7dfe5e0f7062910ef49a00b366bf5d7e049919eaeca43d024a9feec56c

Download Submit
C:\Windows\system\ulyAxHq.exe

Filesize
3.9MB

MD5
71196471e6db685220353e62fd0b8266

SHA1
c4d74d9e8b3791128393650913b8ee28a9aed431

SHA256
ec8a4615031fe6d892678313ff8e791a758c1a02f6d0ffb23c3dc234f3423258

SHA512
d6c76cabdde43e2a5d9cd1e0ea259ae6106720302629a4c4f18869da79728a1f3fba4e2cf8c62bc2316a963067d36b8377e08ba28cc790f68ec4c1de683559ad

Download Submit
C:\Windows\system\vtjWzCr.exe

Filesize
3.9MB

MD5
b5ab2b0c34e73b1e4aa4c744c0fb3f4c

SHA1
9232d1890439acb72ef9a2f4196a8a11f455b162

SHA256
a8aac41a3f0309d2d9ea64a893b8b101dc2c8aac246d1ba06d5e93ca247d376f

SHA512
c9c3da6a41a90b08177d8dac7be59ed925687a15c8fd790d0b15b211dbd552d159912005645bb4d49118b0cb01537128c041125c8659a0cf1fb8d3928a23c87c

Download Submit
\Windows\system\DpwoIRf.exe

Filesize
3.9MB

MD5
5ec315c35f872a6523d6d89c554800af

SHA1
f58b5e57d762d49e1ee05599e81d3cf0118122ff

SHA256
fff0c7c152a96bcb2921ac12a2f88b8d7196233585eb5a8157182bd692d7c8c6

SHA512
1dc9ee7797a472951a6a99a84f0ad3a133f4ed2fa85d3e14322fa0d78e47953de142d7e14f548bec493c51691dc3c97fef66718ac275c1912b25135e8ed4d15f

Download Submit
\Windows\system\ljRjpMO.exe

Filesize
3.9MB

MD5
59ff6e508c04c016077bf0888fe2a5e1

SHA1
7cbe75556886346e534c7a8db268277492e97feb

SHA256
16f01798627dde2a9ce5eac3191fc5b062e992577e89dad7b98c9529ef17ea8f

SHA512
f11415f5abd8ce29895c4dd86b4f9dd9bb0a046110f4c3d05e83968ceb0f16895944642d41c881e07786e55f2f127229913d863e32f4918d840f213f4583db78

Download Submit
\Windows\system\oCtDjju.exe

Filesize
3.9MB

MD5
62550cc59c0f292c8e7f630017204a62

SHA1
7dfc152740030bb5759f33989187aaa2ce3d1bfa

SHA256
827675958d1e0657816943cb6ea0f6622bde51e6342d04c3c75cfabbc1458b04

SHA512
0f67fd5271668de95a9317f6cbb3182105c34a661482429d38ee8564c3f840ecd38b3399c5a8a0a627f3eab175546bbacd88ca8ee23f0d0a87e6d312013b12a5

Download Submit
\Windows\system\pRtTxeX.exe

Filesize
3.9MB

MD5
489b5f2e6fbe70591139252d75fd1b1d

SHA1
171d0889435a59321ae1fb7857101efe9953de55

SHA256
8aad3ada3ed963ab45489061b171254be18f2951423d3c637b6da0ef8e340141

SHA512
9d8f6cb7b486c710afcb7a190b8bf750d22f3ca3e9955214e96a2ff9bcc582fb243abcc29e6411cdbdb6ff5924107e4f0c74a670cada22bb5a659c620fe16c98

Download Submit
\Windows\system\xvtZIvi.exe

Filesize
3.9MB

MD5
acc0835d9ec05aa3304de685ebf5725b

SHA1
b76ce7091fa68570bda7519e3428b0884890ae36

SHA256
ac3608ba558857f5e9da292b0f6008f31d876aa00cb0265fbe1509ac73313758

SHA512
a403f1075388ff6d3f906c33e8d3373bcd553c1d0ec106b563d2594b75bd05bf2cb51817d0f1346139381db7f40aaf7a72c8c314b7e3e294d6670d35932ceeda

Download Submit
memory/1500-1740-0x000000013FC40000-0x000000013FF94000-memory.dmp

Filesize
3.3MB

Download
memory/1500-205-0x000000013FC40000-0x000000013FF94000-memory.dmp

Filesize
3.3MB

Download
memory/1500-80-0x000000013FC40000-0x000000013FF94000-memory.dmp

Filesize
3.3MB

Download
memory/2168-10-0x000000013FA80000-0x000000013FDD4000-memory.dmp

Filesize
3.3MB

Download
memory/2168-38-0x000000013FA80000-0x000000013FDD4000-memory.dmp

Filesize
3.3MB

Download
memory/2168-1743-0x000000013FA80000-0x000000013FDD4000-memory.dmp

Filesize
3.3MB

Download
memory/2412-1742-0x000000013FDD0000-0x0000000140124000-memory.dmp

Filesize
3.3MB

Download
memory/2412-97-0x000000013FDD0000-0x0000000140124000-memory.dmp

Filesize
3.3MB

Download
memory/2412-282-0x000000013FDD0000-0x0000000140124000-memory.dmp

Filesize
3.3MB

Download
memory/2508-1746-0x000000013F890000-0x000000013FBE4000-memory.dmp

Filesize
3.3MB

Download
memory/2508-66-0x000000013F890000-0x000000013FBE4000-memory.dmp

Filesize
3.3MB

Download
memory/2508-105-0x000000013F890000-0x000000013FBE4000-memory.dmp

Filesize
3.3MB

Download
memory/2588-96-0x000000013F640000-0x000000013F994000-memory.dmp

Filesize
3.3MB

Download
memory/2588-55-0x000000013F640000-0x000000013F994000-memory.dmp

Filesize
3.3MB

Download
memory/2588-1734-0x000000013F640000-0x000000013F994000-memory.dmp

Filesize
3.3MB

Download
memory/2608-89-0x000000013F6A0000-0x000000013F9F4000-memory.dmp

Filesize
3.3MB

Download
memory/2608-242-0x000000013F6A0000-0x000000013F9F4000-memory.dmp

Filesize
3.3MB

Download
memory/2608-1724-0x000000013F6A0000-0x000000013F9F4000-memory.dmp

Filesize
3.3MB

Download
memory/2688-1745-0x000000013F870000-0x000000013FBC4000-memory.dmp

Filesize
3.3MB

Download
memory/2688-88-0x000000013F870000-0x000000013FBC4000-memory.dmp

Filesize
3.3MB

Download
memory/2688-48-0x000000013F870000-0x000000013FBC4000-memory.dmp

Filesize
3.3MB

Download
memory/2700-72-0x000000013FFB0000-0x0000000140304000-memory.dmp

Filesize
3.3MB

Download
memory/2700-34-0x000000013FFB0000-0x0000000140304000-memory.dmp

Filesize
3.3MB

Download
memory/2700-1737-0x000000013FFB0000-0x0000000140304000-memory.dmp

Filesize
3.3MB

Download
memory/2724-1731-0x000000013F880000-0x000000013FBD4000-memory.dmp

Filesize
3.3MB

Download
memory/2724-79-0x000000013F880000-0x000000013FBD4000-memory.dmp

Filesize
3.3MB

Download
memory/2860-18-0x000000013F930000-0x000000013FC84000-memory.dmp

Filesize
3.3MB

Download
memory/2860-1573-0x000000013F930000-0x000000013FC84000-memory.dmp

Filesize
3.3MB

Download
memory/2864-1744-0x000000013F880000-0x000000013FBD4000-memory.dmp

Filesize
3.3MB

Download
memory/2864-54-0x000000013F880000-0x000000013FBD4000-memory.dmp

Filesize
3.3MB

Download
memory/2864-21-0x000000013F880000-0x000000013FBD4000-memory.dmp

Filesize
3.3MB

Download
memory/2892-65-0x000000013F220000-0x000000013F574000-memory.dmp

Filesize
3.3MB

Download
memory/2892-1727-0x000000013F220000-0x000000013F574000-memory.dmp

Filesize
3.3MB

Download
memory/2892-27-0x000000013F220000-0x000000013F574000-memory.dmp

Filesize
3.3MB

Download
memory/2908-73-0x000000013FC30000-0x000000013FF84000-memory.dmp

Filesize
3.3MB

Download
memory/2908-1732-0x000000013FC30000-0x000000013FF84000-memory.dmp

Filesize
3.3MB

Download
memory/2908-111-0x000000013FC30000-0x000000013FF84000-memory.dmp

Filesize
3.3MB

Download
memory/2952-106-0x000000013FEF0000-0x0000000140244000-memory.dmp

Filesize
3.3MB

Download
memory/2952-1733-0x000000013FEF0000-0x0000000140244000-memory.dmp

Filesize
3.3MB

Download
memory/2952-386-0x000000013FEF0000-0x0000000140244000-memory.dmp

Filesize
3.3MB

Download
memory/3032-266-0x0000000002140000-0x0000000002494000-memory.dmp

Filesize
3.3MB

Download
memory/3032-69-0x0000000002140000-0x0000000002494000-memory.dmp

Filesize
3.3MB

Download
memory/3032-57-0x000000013F890000-0x000000013FBE4000-memory.dmp

Filesize
3.3MB

Download
memory/3032-47-0x000000013F930000-0x000000013FC84000-memory.dmp

Filesize
3.3MB

Download
memory/3032-104-0x0000000002140000-0x0000000002494000-memory.dmp

Filesize
3.3MB

Download
memory/3032-43-0x000000013F870000-0x000000013FBC4000-memory.dmp

Filesize
3.3MB

Download
memory/3032-112-0x000000013F3C0000-0x000000013F714000-memory.dmp

Filesize
3.3MB

Download
memory/3032-52-0x000000013F640000-0x000000013F994000-memory.dmp

Filesize
3.3MB

Download
memory/3032-224-0x000000013F6A0000-0x000000013F9F4000-memory.dmp

Filesize
3.3MB

Download
memory/3032-102-0x000000013F890000-0x000000013FBE4000-memory.dmp

Filesize
3.3MB

Download
memory/3032-320-0x0000000002140000-0x0000000002494000-memory.dmp

Filesize
3.3MB

Download
memory/3032-110-0x0000000002140000-0x0000000002494000-memory.dmp

Filesize
3.3MB

Download
memory/3032-93-0x0000000002140000-0x0000000002494000-memory.dmp

Filesize
3.3MB

Download
memory/3032-450-0x000000013F3C0000-0x000000013F714000-memory.dmp

Filesize
3.3MB

Download
memory/3032-85-0x000000013F6A0000-0x000000013F9F4000-memory.dmp

Filesize
3.3MB

Download
memory/3032-84-0x000000013F870000-0x000000013FBC4000-memory.dmp

Filesize
3.3MB

Download
memory/3032-0-0x000000013FCF0000-0x0000000140044000-memory.dmp

Filesize
3.3MB

Download
memory/3032-30-0x0000000002140000-0x0000000002494000-memory.dmp

Filesize
3.3MB

Download
memory/3032-37-0x000000013FCF0000-0x0000000140044000-memory.dmp

Filesize
3.3MB

Download
memory/3032-19-0x000000013F880000-0x000000013FBD4000-memory.dmp

Filesize
3.3MB

Download
memory/3032-23-0x000000013F220000-0x000000013F574000-memory.dmp

Filesize
3.3MB

Download
memory/3032-14-0x000000013F930000-0x000000013FC84000-memory.dmp

Filesize
3.3MB

Download
memory/3032-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download