xmrig | 2578a6fd8d72503741db4624d3d9c910e397bc20c8a8931f25878a12734b8fd3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
Size

1.5MB
MD5

02dec4afa89a45514fcad7f8e14302be
SHA1

6c434a18ad893ea97d10cdde66136c36160c4f43
SHA256

2578a6fd8d72503741db4624d3d9c910e397bc20c8a8931f25878a12734b8fd3
SHA512

ba7864af90aad198efda5dfe832d752b718a7eef11c64123d5805429ab58c2905aeca5b11a20fa63e3b30e4b839216946f5d15c642977fc4ded2bd3e5a89f217
SSDEEP

24576:RVIl/WDGCi7/qkatXBWelxqsfNMNrbgKn6gpaxpWeUPKbEPEkMfAsgSUNnn+BOcf:ROdWCCi7/raCaKnur6UdLUNnVu

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral1/memory/3048-1155-0x000000013F490000-0x000000013F7E1000-memory.dmp	xmrig
behavioral1/memory/2272-1418-0x000000013F970000-0x000000013FCC1000-memory.dmp	xmrig
behavioral1/memory/2400-364-0x000000013F5C0000-0x000000013F911000-memory.dmp	xmrig
behavioral1/memory/2400-110-0x000000013F940000-0x000000013FC91000-memory.dmp	xmrig
behavioral1/memory/1540-91-0x000000013F7E0000-0x000000013FB31000-memory.dmp	xmrig
behavioral1/memory/2728-104-0x000000013F320000-0x000000013F671000-memory.dmp	xmrig
behavioral1/memory/2132-78-0x000000013F6C0000-0x000000013FA11000-memory.dmp	xmrig
behavioral1/memory/1704-32-0x000000013F5A0000-0x000000013F8F1000-memory.dmp	xmrig
behavioral1/memory/2944-30-0x000000013FFD0000-0x0000000140321000-memory.dmp	xmrig
behavioral1/memory/2400-29-0x000000013FFD0000-0x0000000140321000-memory.dmp	xmrig
behavioral1/memory/2268-28-0x000000013F740000-0x000000013FA91000-memory.dmp	xmrig
behavioral1/memory/1900-27-0x000000013FD80000-0x00000001400D1000-memory.dmp	xmrig
behavioral1/memory/1540-4144-0x000000013F7E0000-0x000000013FB31000-memory.dmp	xmrig
behavioral1/memory/1704-4143-0x000000013F5A0000-0x000000013F8F1000-memory.dmp	xmrig
behavioral1/memory/2272-4148-0x000000013F970000-0x000000013FCC1000-memory.dmp	xmrig
behavioral1/memory/2268-4146-0x000000013F740000-0x000000013FA91000-memory.dmp	xmrig
behavioral1/memory/2132-4145-0x000000013F6C0000-0x000000013FA11000-memory.dmp	xmrig
behavioral1/memory/1900-4142-0x000000013FD80000-0x00000001400D1000-memory.dmp	xmrig
behavioral1/memory/2728-4137-0x000000013F320000-0x000000013F671000-memory.dmp	xmrig
behavioral1/memory/2944-4131-0x000000013FFD0000-0x0000000140321000-memory.dmp	xmrig
behavioral1/memory/2624-4166-0x000000013F2B0000-0x000000013F601000-memory.dmp	xmrig
behavioral1/memory/2784-4199-0x000000013FCC0000-0x0000000140011000-memory.dmp	xmrig
behavioral1/memory/3048-4266-0x000000013F490000-0x000000013F7E1000-memory.dmp	xmrig
behavioral1/memory/2624-4279-0x000000013F2B0000-0x000000013F601000-memory.dmp	xmrig
behavioral1/memory/2784-4282-0x000000013FCC0000-0x0000000140011000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1900	xSNoygt.exe
2268	JYiRtIU.exe
2944	yIPzkoL.exe
1704	GAAkwQq.exe
3048	IMsgVmW.exe
2272	bLkVTAO.exe
2132	lOTTRNB.exe
1540	wkTfpas.exe
2728	FoFsjKj.exe
2624	yxcaONa.exe
2784	TOkNICU.exe
2520	tCUPURH.exe
2612	BVEuDfb.exe
2572	ajNHWwb.exe
1728	AQLLtXR.exe
1648	JepjbDq.exe
540	sFggRMi.exe
884	UgUkYqd.exe
2772	IOYzSTP.exe
2028	RnZdSdG.exe
2008	yNcoOqn.exe
2240	EbvFGZR.exe
2780	UbglBjX.exe
2900	RFPNHiU.exe
2660	sfuCRwh.exe
2668	YPTWwYf.exe
2516	BVaQmBX.exe
2996	yEPXzdu.exe
584	BbXeEZW.exe
1264	ISXvhAw.exe
2484	nkdcClE.exe
868	UvsWTqS.exe
1312	TZOapHU.exe
1948	IEltaBb.exe
3008	wIORNRj.exe
2160	ceSuiRj.exe
1356	EQWtVYl.exe
1148	LhnYbfi.exe
1168	IuVDKVA.exe
1344	dJGPwiL.exe
2164	Iziywsh.exe
1424	WZyaOFV.exe
1532	aMPcJIg.exe
1844	BOiJaez.exe
1036	kzVAwcG.exe
1836	RZEOHyd.exe
1528	qvQgCBY.exe
1000	QJlRZSH.exe
2976	XyUQEUk.exe
2912	opPJmAj.exe
2076	rvAErPM.exe
2928	bzBGTiR.exe
1596	NwArKRE.exe
1656	TCOTbBG.exe
1604	XBkkBZm.exe
2348	YxilUPb.exe
1684	HQpwOWw.exe
2376	OorKnFa.exe
1756	NZKGGnU.exe
888	eivDXVJ.exe
2340	qwVFJjh.exe
2336	IALURIu.exe
1556	xzfXjEb.exe
1572	QPjYBuh.exe

Loads dropped DLL 64 IoCs

pid	Process
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2400-0-0x000000013F5C0000-0x000000013F911000-memory.dmp	upx
behavioral1/files/0x00090000000120d6-6.dat	upx
behavioral1/files/0x000800000001567f-16.dat	upx
behavioral1/files/0x000800000001506e-12.dat	upx
behavioral1/files/0x0008000000015685-17.dat	upx
behavioral1/memory/3048-36-0x000000013F490000-0x000000013F7E1000-memory.dmp	upx
behavioral1/files/0x00070000000156a8-39.dat	upx
behavioral1/files/0x0006000000016df5-156.dat	upx
behavioral1/memory/3048-1155-0x000000013F490000-0x000000013F7E1000-memory.dmp	upx
behavioral1/memory/2272-1418-0x000000013F970000-0x000000013FCC1000-memory.dmp	upx
behavioral1/memory/2400-364-0x000000013F5C0000-0x000000013F911000-memory.dmp	upx
behavioral1/files/0x0006000000016d4c-169.dat	upx
behavioral1/files/0x0006000000016cf0-168.dat	upx
behavioral1/files/0x0006000000016ca0-167.dat	upx
behavioral1/files/0x0006000000016b86-166.dat	upx
behavioral1/files/0x0006000000016689-165.dat	upx
behavioral1/files/0x00060000000164de-164.dat	upx
behavioral1/files/0x00060000000162e4-163.dat	upx
behavioral1/files/0x00060000000160da-162.dat	upx
behavioral1/files/0x0006000000015f4e-160.dat	upx
behavioral1/files/0x0007000000015cb9-159.dat	upx
behavioral1/files/0x0006000000016df8-157.dat	upx
behavioral1/files/0x0006000000016de9-147.dat	upx
behavioral1/files/0x0006000000016d73-140.dat	upx
behavioral1/files/0x0006000000016d68-139.dat	upx
behavioral1/files/0x0006000000016dd5-137.dat	upx
behavioral1/files/0x0006000000016d6f-131.dat	upx
behavioral1/files/0x0006000000016d22-126.dat	upx
behavioral1/files/0x0006000000016cab-124.dat	upx
behavioral1/memory/2624-116-0x000000013F2B0000-0x000000013F601000-memory.dmp	upx
behavioral1/files/0x0006000000016c89-109.dat	upx
behavioral1/files/0x0006000000016890-108.dat	upx
behavioral1/files/0x000600000001660e-92.dat	upx
behavioral1/memory/1540-91-0x000000013F7E0000-0x000000013FB31000-memory.dmp	upx
behavioral1/files/0x0006000000016399-83.dat	upx
behavioral1/files/0x0006000000016141-82.dat	upx
behavioral1/files/0x0006000000016dd9-154.dat	upx
behavioral1/memory/2272-41-0x000000013F970000-0x000000013FCC1000-memory.dmp	upx
behavioral1/memory/2784-121-0x000000013FCC0000-0x0000000140011000-memory.dmp	upx
behavioral1/memory/2728-104-0x000000013F320000-0x000000013F671000-memory.dmp	upx
behavioral1/memory/2132-78-0x000000013F6C0000-0x000000013FA11000-memory.dmp	upx
behavioral1/files/0x0006000000015fa6-62.dat	upx
behavioral1/files/0x0008000000015ce4-55.dat	upx
behavioral1/files/0x00070000000156b8-47.dat	upx
behavioral1/memory/1704-32-0x000000013F5A0000-0x000000013F8F1000-memory.dmp	upx
behavioral1/memory/2944-30-0x000000013FFD0000-0x0000000140321000-memory.dmp	upx
behavioral1/memory/2268-28-0x000000013F740000-0x000000013FA91000-memory.dmp	upx
behavioral1/memory/1900-27-0x000000013FD80000-0x00000001400D1000-memory.dmp	upx
behavioral1/files/0x0008000000015689-24.dat	upx
behavioral1/memory/1540-4144-0x000000013F7E0000-0x000000013FB31000-memory.dmp	upx
behavioral1/memory/1704-4143-0x000000013F5A0000-0x000000013F8F1000-memory.dmp	upx
behavioral1/memory/2272-4148-0x000000013F970000-0x000000013FCC1000-memory.dmp	upx
behavioral1/memory/2268-4146-0x000000013F740000-0x000000013FA91000-memory.dmp	upx
behavioral1/memory/2132-4145-0x000000013F6C0000-0x000000013FA11000-memory.dmp	upx
behavioral1/memory/1900-4142-0x000000013FD80000-0x00000001400D1000-memory.dmp	upx
behavioral1/memory/2728-4137-0x000000013F320000-0x000000013F671000-memory.dmp	upx
behavioral1/memory/2944-4131-0x000000013FFD0000-0x0000000140321000-memory.dmp	upx
behavioral1/memory/2624-4166-0x000000013F2B0000-0x000000013F601000-memory.dmp	upx
behavioral1/memory/2784-4199-0x000000013FCC0000-0x0000000140011000-memory.dmp	upx
behavioral1/memory/3048-4266-0x000000013F490000-0x000000013F7E1000-memory.dmp	upx
behavioral1/memory/2624-4279-0x000000013F2B0000-0x000000013F601000-memory.dmp	upx
behavioral1/memory/2784-4282-0x000000013FCC0000-0x0000000140011000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zGLdjFo.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\WOYVvaZ.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\gchiCtY.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\ibyUamq.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\StjAghB.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\bNsyNeO.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\xdgpmXz.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\iKoDnsa.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\QukgUVc.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\JSdnHXL.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\lfpQcvq.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\JcqgjKw.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\fQFIUmZ.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\pdRsFCT.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\AEaIXHF.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\agbgzXc.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\yYSjrnh.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\pwzeKil.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\hMfGcoO.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\tMDvkAH.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\QsvjRdl.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\KtvUfHt.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\eXLCVax.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\rLelTtc.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\rfLnZqK.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\EQWtVYl.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\txvhmNO.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\dQRVOzD.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\rVxQCqg.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\wSpPSkQ.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\LCBsvxZ.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\IuVDKVA.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\YrkACqd.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\KRRLODM.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\YCWoalw.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\TWgmLvu.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\XAZUfvs.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\MkFKsXe.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\GoNlrcB.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\dvwcuWe.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\sJDpCeu.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\nDGCFbq.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\flHxklO.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\dDuFEhl.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\eBgnspJ.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\PkZqvOJ.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\dySTgWj.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\XSDVZdf.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\vwcQCkF.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\eGHlsEU.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\IBzdMgK.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\KMKmPPb.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\LXkqGgF.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\fqORPab.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\EoeMyfu.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\WMfXWro.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\UmMzihx.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\OhFfIEA.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\dBGBluZ.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\gWgEtBE.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\jHBIDKX.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\RHYpXLd.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\NIhUaZp.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
File created	C:\Windows\System\AScyiml.exe	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 1900	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	29
PID 2400 wrote to memory of 1900	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	29
PID 2400 wrote to memory of 1900	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	29
PID 2400 wrote to memory of 2268	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	30
PID 2400 wrote to memory of 2268	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	30
PID 2400 wrote to memory of 2268	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	30
PID 2400 wrote to memory of 2944	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	31
PID 2400 wrote to memory of 2944	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	31
PID 2400 wrote to memory of 2944	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	31
PID 2400 wrote to memory of 3048	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	32
PID 2400 wrote to memory of 3048	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	32
PID 2400 wrote to memory of 3048	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	32
PID 2400 wrote to memory of 1704	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	33
PID 2400 wrote to memory of 1704	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	33
PID 2400 wrote to memory of 1704	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	33
PID 2400 wrote to memory of 2272	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	34
PID 2400 wrote to memory of 2272	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	34
PID 2400 wrote to memory of 2272	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	34
PID 2400 wrote to memory of 2132	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	35
PID 2400 wrote to memory of 2132	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	35
PID 2400 wrote to memory of 2132	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	35
PID 2400 wrote to memory of 2008	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	36
PID 2400 wrote to memory of 2008	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	36
PID 2400 wrote to memory of 2008	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	36
PID 2400 wrote to memory of 1540	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	37
PID 2400 wrote to memory of 1540	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	37
PID 2400 wrote to memory of 1540	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	37
PID 2400 wrote to memory of 2240	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	38
PID 2400 wrote to memory of 2240	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	38
PID 2400 wrote to memory of 2240	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	38
PID 2400 wrote to memory of 2728	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	39
PID 2400 wrote to memory of 2728	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	39
PID 2400 wrote to memory of 2728	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	39
PID 2400 wrote to memory of 2780	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	40
PID 2400 wrote to memory of 2780	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	40
PID 2400 wrote to memory of 2780	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	40
PID 2400 wrote to memory of 2624	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	41
PID 2400 wrote to memory of 2624	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	41
PID 2400 wrote to memory of 2624	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	41
PID 2400 wrote to memory of 2900	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	42
PID 2400 wrote to memory of 2900	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	42
PID 2400 wrote to memory of 2900	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	42
PID 2400 wrote to memory of 2784	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	43
PID 2400 wrote to memory of 2784	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	43
PID 2400 wrote to memory of 2784	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	43
PID 2400 wrote to memory of 2660	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	44
PID 2400 wrote to memory of 2660	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	44
PID 2400 wrote to memory of 2660	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	44
PID 2400 wrote to memory of 2520	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	45
PID 2400 wrote to memory of 2520	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	45
PID 2400 wrote to memory of 2520	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	45
PID 2400 wrote to memory of 2668	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	46
PID 2400 wrote to memory of 2668	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	46
PID 2400 wrote to memory of 2668	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	46
PID 2400 wrote to memory of 2612	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	47
PID 2400 wrote to memory of 2612	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	47
PID 2400 wrote to memory of 2612	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	47
PID 2400 wrote to memory of 2516	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	48
PID 2400 wrote to memory of 2516	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	48
PID 2400 wrote to memory of 2516	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	48
PID 2400 wrote to memory of 2572	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	49
PID 2400 wrote to memory of 2572	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	49
PID 2400 wrote to memory of 2572	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	49
PID 2400 wrote to memory of 2996	2400	02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02dec4afa89a45514fcad7f8e14302be_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\System\xSNoygt.exe
  C:\Windows\System\xSNoygt.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\JYiRtIU.exe
  C:\Windows\System\JYiRtIU.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\yIPzkoL.exe
  C:\Windows\System\yIPzkoL.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\IMsgVmW.exe
  C:\Windows\System\IMsgVmW.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\GAAkwQq.exe
  C:\Windows\System\GAAkwQq.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\bLkVTAO.exe
  C:\Windows\System\bLkVTAO.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\lOTTRNB.exe
  C:\Windows\System\lOTTRNB.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\yNcoOqn.exe
  C:\Windows\System\yNcoOqn.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\wkTfpas.exe
  C:\Windows\System\wkTfpas.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\EbvFGZR.exe
  C:\Windows\System\EbvFGZR.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\FoFsjKj.exe
  C:\Windows\System\FoFsjKj.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\UbglBjX.exe
  C:\Windows\System\UbglBjX.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\yxcaONa.exe
  C:\Windows\System\yxcaONa.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\RFPNHiU.exe
  C:\Windows\System\RFPNHiU.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\TOkNICU.exe
  C:\Windows\System\TOkNICU.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\sfuCRwh.exe
  C:\Windows\System\sfuCRwh.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\tCUPURH.exe
  C:\Windows\System\tCUPURH.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\YPTWwYf.exe
  C:\Windows\System\YPTWwYf.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\BVEuDfb.exe
  C:\Windows\System\BVEuDfb.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\BVaQmBX.exe
  C:\Windows\System\BVaQmBX.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\ajNHWwb.exe
  C:\Windows\System\ajNHWwb.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\yEPXzdu.exe
  C:\Windows\System\yEPXzdu.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\AQLLtXR.exe
  C:\Windows\System\AQLLtXR.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\BbXeEZW.exe
  C:\Windows\System\BbXeEZW.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\JepjbDq.exe
  C:\Windows\System\JepjbDq.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\ISXvhAw.exe
  C:\Windows\System\ISXvhAw.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\sFggRMi.exe
  C:\Windows\System\sFggRMi.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\nkdcClE.exe
  C:\Windows\System\nkdcClE.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\UgUkYqd.exe
  C:\Windows\System\UgUkYqd.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\UvsWTqS.exe
  C:\Windows\System\UvsWTqS.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\IOYzSTP.exe
  C:\Windows\System\IOYzSTP.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\TZOapHU.exe
  C:\Windows\System\TZOapHU.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\RnZdSdG.exe
  C:\Windows\System\RnZdSdG.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\IEltaBb.exe
  C:\Windows\System\IEltaBb.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\wIORNRj.exe
  C:\Windows\System\wIORNRj.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\ceSuiRj.exe
  C:\Windows\System\ceSuiRj.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\EQWtVYl.exe
  C:\Windows\System\EQWtVYl.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\LhnYbfi.exe
  C:\Windows\System\LhnYbfi.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\IuVDKVA.exe
  C:\Windows\System\IuVDKVA.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\dJGPwiL.exe
  C:\Windows\System\dJGPwiL.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\Iziywsh.exe
  C:\Windows\System\Iziywsh.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\WZyaOFV.exe
  C:\Windows\System\WZyaOFV.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\aMPcJIg.exe
  C:\Windows\System\aMPcJIg.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\BOiJaez.exe
  C:\Windows\System\BOiJaez.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\kzVAwcG.exe
  C:\Windows\System\kzVAwcG.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\RZEOHyd.exe
  C:\Windows\System\RZEOHyd.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\qvQgCBY.exe
  C:\Windows\System\qvQgCBY.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\QJlRZSH.exe
  C:\Windows\System\QJlRZSH.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\XyUQEUk.exe
  C:\Windows\System\XyUQEUk.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\opPJmAj.exe
  C:\Windows\System\opPJmAj.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\rvAErPM.exe
  C:\Windows\System\rvAErPM.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\bzBGTiR.exe
  C:\Windows\System\bzBGTiR.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\NwArKRE.exe
  C:\Windows\System\NwArKRE.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\TCOTbBG.exe
  C:\Windows\System\TCOTbBG.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\XBkkBZm.exe
  C:\Windows\System\XBkkBZm.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\YxilUPb.exe
  C:\Windows\System\YxilUPb.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\HQpwOWw.exe
  C:\Windows\System\HQpwOWw.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\OorKnFa.exe
  C:\Windows\System\OorKnFa.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\NZKGGnU.exe
  C:\Windows\System\NZKGGnU.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\eivDXVJ.exe
  C:\Windows\System\eivDXVJ.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\qwVFJjh.exe
  C:\Windows\System\qwVFJjh.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\IALURIu.exe
  C:\Windows\System\IALURIu.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\xzfXjEb.exe
  C:\Windows\System\xzfXjEb.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\QPjYBuh.exe
  C:\Windows\System\QPjYBuh.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\WZqLDqx.exe
  C:\Windows\System\WZqLDqx.exe
  2⤵
  PID:1932
- C:\Windows\System\EIOgrhA.exe
  C:\Windows\System\EIOgrhA.exe
  2⤵
  PID:2252
- C:\Windows\System\hbOKakc.exe
  C:\Windows\System\hbOKakc.exe
  2⤵
  PID:2300
- C:\Windows\System\YoNcjoR.exe
  C:\Windows\System\YoNcjoR.exe
  2⤵
  PID:2888
- C:\Windows\System\VizEuMA.exe
  C:\Windows\System\VizEuMA.exe
  2⤵
  PID:2148
- C:\Windows\System\OAYxnij.exe
  C:\Windows\System\OAYxnij.exe
  2⤵
  PID:2712
- C:\Windows\System\lfrPLEH.exe
  C:\Windows\System\lfrPLEH.exe
  2⤵
  PID:1668
- C:\Windows\System\HjscdZv.exe
  C:\Windows\System\HjscdZv.exe
  2⤵
  PID:2492
- C:\Windows\System\AMbfkMh.exe
  C:\Windows\System\AMbfkMh.exe
  2⤵
  PID:1104
- C:\Windows\System\FjzUgkV.exe
  C:\Windows\System\FjzUgkV.exe
  2⤵
  PID:2952
- C:\Windows\System\aTSiHjy.exe
  C:\Windows\System\aTSiHjy.exe
  2⤵
  PID:1448
- C:\Windows\System\wlfxigU.exe
  C:\Windows\System\wlfxigU.exe
  2⤵
  PID:812
- C:\Windows\System\zGLdjFo.exe
  C:\Windows\System\zGLdjFo.exe
  2⤵
  PID:1040
- C:\Windows\System\yXSRgSA.exe
  C:\Windows\System\yXSRgSA.exe
  2⤵
  PID:2716
- C:\Windows\System\cDOEtfH.exe
  C:\Windows\System\cDOEtfH.exe
  2⤵
  PID:2736
- C:\Windows\System\JnfxHOl.exe
  C:\Windows\System\JnfxHOl.exe
  2⤵
  PID:1516
- C:\Windows\System\jCGQmkR.exe
  C:\Windows\System\jCGQmkR.exe
  2⤵
  PID:2168
- C:\Windows\System\FIKKbZK.exe
  C:\Windows\System\FIKKbZK.exe
  2⤵
  PID:320
- C:\Windows\System\jzMXVEN.exe
  C:\Windows\System\jzMXVEN.exe
  2⤵
  PID:1792
- C:\Windows\System\TRrMHlC.exe
  C:\Windows\System\TRrMHlC.exe
  2⤵
  PID:708
- C:\Windows\System\tFpbYOD.exe
  C:\Windows\System\tFpbYOD.exe
  2⤵
  PID:1680
- C:\Windows\System\JzsGFrl.exe
  C:\Windows\System\JzsGFrl.exe
  2⤵
  PID:872
- C:\Windows\System\aAKrlnV.exe
  C:\Windows\System\aAKrlnV.exe
  2⤵
  PID:620
- C:\Windows\System\zhKEYrm.exe
  C:\Windows\System\zhKEYrm.exe
  2⤵
  PID:2096
- C:\Windows\System\rGEGcPG.exe
  C:\Windows\System\rGEGcPG.exe
  2⤵
  PID:1804
- C:\Windows\System\TgbwJPJ.exe
  C:\Windows\System\TgbwJPJ.exe
  2⤵
  PID:1368
- C:\Windows\System\cSoIciB.exe
  C:\Windows\System\cSoIciB.exe
  2⤵
  PID:112
- C:\Windows\System\FNnAtUk.exe
  C:\Windows\System\FNnAtUk.exe
  2⤵
  PID:844
- C:\Windows\System\DGBQQdK.exe
  C:\Windows\System\DGBQQdK.exe
  2⤵
  PID:1116
- C:\Windows\System\KtltOUB.exe
  C:\Windows\System\KtltOUB.exe
  2⤵
  PID:2212
- C:\Windows\System\WtQEUco.exe
  C:\Windows\System\WtQEUco.exe
  2⤵
  PID:2368
- C:\Windows\System\VUkhkfi.exe
  C:\Windows\System\VUkhkfi.exe
  2⤵
  PID:2452
- C:\Windows\System\VbPTvqp.exe
  C:\Windows\System\VbPTvqp.exe
  2⤵
  PID:2056
- C:\Windows\System\VcJTxDf.exe
  C:\Windows\System\VcJTxDf.exe
  2⤵
  PID:2356
- C:\Windows\System\rWMPZmw.exe
  C:\Windows\System\rWMPZmw.exe
  2⤵
  PID:1592
- C:\Windows\System\fQFIUmZ.exe
  C:\Windows\System\fQFIUmZ.exe
  2⤵
  PID:1904
- C:\Windows\System\ePtPemY.exe
  C:\Windows\System\ePtPemY.exe
  2⤵
  PID:1380
- C:\Windows\System\csdbkwW.exe
  C:\Windows\System\csdbkwW.exe
  2⤵
  PID:2124
- C:\Windows\System\JHpcbZe.exe
  C:\Windows\System\JHpcbZe.exe
  2⤵
  PID:2788
- C:\Windows\System\SWGUQRr.exe
  C:\Windows\System\SWGUQRr.exe
  2⤵
  PID:2992
- C:\Windows\System\BEKaAMm.exe
  C:\Windows\System\BEKaAMm.exe
  2⤵
  PID:1676
- C:\Windows\System\yyfCHao.exe
  C:\Windows\System\yyfCHao.exe
  2⤵
  PID:2648
- C:\Windows\System\uJVcBjt.exe
  C:\Windows\System\uJVcBjt.exe
  2⤵
  PID:2640
- C:\Windows\System\HJoSFtd.exe
  C:\Windows\System\HJoSFtd.exe
  2⤵
  PID:552
- C:\Windows\System\ewzufoA.exe
  C:\Windows\System\ewzufoA.exe
  2⤵
  PID:2764
- C:\Windows\System\zHSvSja.exe
  C:\Windows\System\zHSvSja.exe
  2⤵
  PID:2176
- C:\Windows\System\LLnufKS.exe
  C:\Windows\System\LLnufKS.exe
  2⤵
  PID:1068
- C:\Windows\System\YVilWKt.exe
  C:\Windows\System\YVilWKt.exe
  2⤵
  PID:1496
- C:\Windows\System\oAYQadW.exe
  C:\Windows\System\oAYQadW.exe
  2⤵
  PID:576
- C:\Windows\System\xpUYTFK.exe
  C:\Windows\System\xpUYTFK.exe
  2⤵
  PID:1296
- C:\Windows\System\txvhmNO.exe
  C:\Windows\System\txvhmNO.exe
  2⤵
  PID:2956
- C:\Windows\System\hVklFKr.exe
  C:\Windows\System\hVklFKr.exe
  2⤵
  PID:2324
- C:\Windows\System\TjFpXid.exe
  C:\Windows\System\TjFpXid.exe
  2⤵
  PID:2892
- C:\Windows\System\ZaSoNPg.exe
  C:\Windows\System\ZaSoNPg.exe
  2⤵
  PID:1588
- C:\Windows\System\ltjsvCf.exe
  C:\Windows\System\ltjsvCf.exe
  2⤵
  PID:2940
- C:\Windows\System\mKgOlhW.exe
  C:\Windows\System\mKgOlhW.exe
  2⤵
  PID:2868
- C:\Windows\System\GgUMkXg.exe
  C:\Windows\System\GgUMkXg.exe
  2⤵
  PID:1884
- C:\Windows\System\DjgITKU.exe
  C:\Windows\System\DjgITKU.exe
  2⤵
  PID:2656
- C:\Windows\System\XvrwHzZ.exe
  C:\Windows\System\XvrwHzZ.exe
  2⤵
  PID:3080
- C:\Windows\System\NfUfsBy.exe
  C:\Windows\System\NfUfsBy.exe
  2⤵
  PID:3096
- C:\Windows\System\pdRsFCT.exe
  C:\Windows\System\pdRsFCT.exe
  2⤵
  PID:3112
- C:\Windows\System\HNAMzTe.exe
  C:\Windows\System\HNAMzTe.exe
  2⤵
  PID:3128
- C:\Windows\System\uVJzWcj.exe
  C:\Windows\System\uVJzWcj.exe
  2⤵
  PID:3144
- C:\Windows\System\MPZcKow.exe
  C:\Windows\System\MPZcKow.exe
  2⤵
  PID:3160
- C:\Windows\System\BPeAEWz.exe
  C:\Windows\System\BPeAEWz.exe
  2⤵
  PID:3176
- C:\Windows\System\hjAyEXw.exe
  C:\Windows\System\hjAyEXw.exe
  2⤵
  PID:3192
- C:\Windows\System\lNbkgxh.exe
  C:\Windows\System\lNbkgxh.exe
  2⤵
  PID:3208
- C:\Windows\System\GRyxdYS.exe
  C:\Windows\System\GRyxdYS.exe
  2⤵
  PID:3228
- C:\Windows\System\BzcEqpR.exe
  C:\Windows\System\BzcEqpR.exe
  2⤵
  PID:3244
- C:\Windows\System\XxHvoiB.exe
  C:\Windows\System\XxHvoiB.exe
  2⤵
  PID:3260
- C:\Windows\System\zsjtxhq.exe
  C:\Windows\System\zsjtxhq.exe
  2⤵
  PID:3276
- C:\Windows\System\IOvMmAn.exe
  C:\Windows\System\IOvMmAn.exe
  2⤵
  PID:3292
- C:\Windows\System\PBHkCsu.exe
  C:\Windows\System\PBHkCsu.exe
  2⤵
  PID:3308
- C:\Windows\System\nOVZgjd.exe
  C:\Windows\System\nOVZgjd.exe
  2⤵
  PID:3324
- C:\Windows\System\RtIEeYo.exe
  C:\Windows\System\RtIEeYo.exe
  2⤵
  PID:3340
- C:\Windows\System\rohDDQu.exe
  C:\Windows\System\rohDDQu.exe
  2⤵
  PID:3356
- C:\Windows\System\BNkTHBG.exe
  C:\Windows\System\BNkTHBG.exe
  2⤵
  PID:3372
- C:\Windows\System\txwmdZG.exe
  C:\Windows\System\txwmdZG.exe
  2⤵
  PID:3388
- C:\Windows\System\XFEIzCk.exe
  C:\Windows\System\XFEIzCk.exe
  2⤵
  PID:3404
- C:\Windows\System\XghnvkY.exe
  C:\Windows\System\XghnvkY.exe
  2⤵
  PID:3420
- C:\Windows\System\bGQTkEa.exe
  C:\Windows\System\bGQTkEa.exe
  2⤵
  PID:3436
- C:\Windows\System\TTugpaJ.exe
  C:\Windows\System\TTugpaJ.exe
  2⤵
  PID:3452
- C:\Windows\System\yMZMSyj.exe
  C:\Windows\System\yMZMSyj.exe
  2⤵
  PID:3468
- C:\Windows\System\JJsxEQU.exe
  C:\Windows\System\JJsxEQU.exe
  2⤵
  PID:3484
- C:\Windows\System\ldrPJNG.exe
  C:\Windows\System\ldrPJNG.exe
  2⤵
  PID:3500
- C:\Windows\System\idiVrLO.exe
  C:\Windows\System\idiVrLO.exe
  2⤵
  PID:3516
- C:\Windows\System\uwdrKuw.exe
  C:\Windows\System\uwdrKuw.exe
  2⤵
  PID:3532
- C:\Windows\System\iijEbho.exe
  C:\Windows\System\iijEbho.exe
  2⤵
  PID:3548
- C:\Windows\System\fivLIJD.exe
  C:\Windows\System\fivLIJD.exe
  2⤵
  PID:3564
- C:\Windows\System\vEQnUep.exe
  C:\Windows\System\vEQnUep.exe
  2⤵
  PID:3580
- C:\Windows\System\YdRQpXc.exe
  C:\Windows\System\YdRQpXc.exe
  2⤵
  PID:3596
- C:\Windows\System\izkssOu.exe
  C:\Windows\System\izkssOu.exe
  2⤵
  PID:3612
- C:\Windows\System\hysDZkH.exe
  C:\Windows\System\hysDZkH.exe
  2⤵
  PID:3628
- C:\Windows\System\XWSmyIe.exe
  C:\Windows\System\XWSmyIe.exe
  2⤵
  PID:3644
- C:\Windows\System\WpbnDMQ.exe
  C:\Windows\System\WpbnDMQ.exe
  2⤵
  PID:3660
- C:\Windows\System\vlzSJDY.exe
  C:\Windows\System\vlzSJDY.exe
  2⤵
  PID:3676
- C:\Windows\System\IDlypRy.exe
  C:\Windows\System\IDlypRy.exe
  2⤵
  PID:3692
- C:\Windows\System\RtpwDhj.exe
  C:\Windows\System\RtpwDhj.exe
  2⤵
  PID:3708
- C:\Windows\System\jbnEvWZ.exe
  C:\Windows\System\jbnEvWZ.exe
  2⤵
  PID:3724
- C:\Windows\System\pqgwDhx.exe
  C:\Windows\System\pqgwDhx.exe
  2⤵
  PID:3740
- C:\Windows\System\MJSIBYH.exe
  C:\Windows\System\MJSIBYH.exe
  2⤵
  PID:3756
- C:\Windows\System\JLuTpjb.exe
  C:\Windows\System\JLuTpjb.exe
  2⤵
  PID:3772
- C:\Windows\System\FMBCfjG.exe
  C:\Windows\System\FMBCfjG.exe
  2⤵
  PID:3788
- C:\Windows\System\oZnvXkS.exe
  C:\Windows\System\oZnvXkS.exe
  2⤵
  PID:3804
- C:\Windows\System\thmYxtt.exe
  C:\Windows\System\thmYxtt.exe
  2⤵
  PID:3820
- C:\Windows\System\eOZKerp.exe
  C:\Windows\System\eOZKerp.exe
  2⤵
  PID:3836
- C:\Windows\System\zPsLGyl.exe
  C:\Windows\System\zPsLGyl.exe
  2⤵
  PID:3852
- C:\Windows\System\HnuUpCs.exe
  C:\Windows\System\HnuUpCs.exe
  2⤵
  PID:3868
- C:\Windows\System\geOUghG.exe
  C:\Windows\System\geOUghG.exe
  2⤵
  PID:3884
- C:\Windows\System\TiYByXQ.exe
  C:\Windows\System\TiYByXQ.exe
  2⤵
  PID:3900
- C:\Windows\System\OKHdtsy.exe
  C:\Windows\System\OKHdtsy.exe
  2⤵
  PID:3916
- C:\Windows\System\MvNJqSS.exe
  C:\Windows\System\MvNJqSS.exe
  2⤵
  PID:3932
- C:\Windows\System\vXMVBZR.exe
  C:\Windows\System\vXMVBZR.exe
  2⤵
  PID:3948
- C:\Windows\System\nLMuOqs.exe
  C:\Windows\System\nLMuOqs.exe
  2⤵
  PID:3964
- C:\Windows\System\YMfVRWk.exe
  C:\Windows\System\YMfVRWk.exe
  2⤵
  PID:3980
- C:\Windows\System\CovxeAs.exe
  C:\Windows\System\CovxeAs.exe
  2⤵
  PID:3996
- C:\Windows\System\JsvBvSy.exe
  C:\Windows\System\JsvBvSy.exe
  2⤵
  PID:4012
- C:\Windows\System\WPtCAKg.exe
  C:\Windows\System\WPtCAKg.exe
  2⤵
  PID:4028
- C:\Windows\System\jNdlqCr.exe
  C:\Windows\System\jNdlqCr.exe
  2⤵
  PID:4044
- C:\Windows\System\VVraKjZ.exe
  C:\Windows\System\VVraKjZ.exe
  2⤵
  PID:4060
- C:\Windows\System\LIutMxe.exe
  C:\Windows\System\LIutMxe.exe
  2⤵
  PID:4076
- C:\Windows\System\eEiFdLa.exe
  C:\Windows\System\eEiFdLa.exe
  2⤵
  PID:4092
- C:\Windows\System\yTGYUGS.exe
  C:\Windows\System\yTGYUGS.exe
  2⤵
  PID:2016
- C:\Windows\System\DtFoinB.exe
  C:\Windows\System\DtFoinB.exe
  2⤵
  PID:1952
- C:\Windows\System\EwzboWb.exe
  C:\Windows\System\EwzboWb.exe
  2⤵
  PID:1736
- C:\Windows\System\RbxlNob.exe
  C:\Windows\System\RbxlNob.exe
  2⤵
  PID:792
- C:\Windows\System\CvWMlHJ.exe
  C:\Windows\System\CvWMlHJ.exe
  2⤵
  PID:1820
- C:\Windows\System\tFOTbKo.exe
  C:\Windows\System\tFOTbKo.exe
  2⤵
  PID:776
- C:\Windows\System\zNmJakG.exe
  C:\Windows\System\zNmJakG.exe
  2⤵
  PID:2024
- C:\Windows\System\WXcGPtY.exe
  C:\Windows\System\WXcGPtY.exe
  2⤵
  PID:3076
- C:\Windows\System\NFxIUla.exe
  C:\Windows\System\NFxIUla.exe
  2⤵
  PID:3108
- C:\Windows\System\PlHzJCh.exe
  C:\Windows\System\PlHzJCh.exe
  2⤵
  PID:3140
- C:\Windows\System\OqpiAdG.exe
  C:\Windows\System\OqpiAdG.exe
  2⤵
  PID:3168
- C:\Windows\System\WeGRuLZ.exe
  C:\Windows\System\WeGRuLZ.exe
  2⤵
  PID:3204
- C:\Windows\System\ZhajIsC.exe
  C:\Windows\System\ZhajIsC.exe
  2⤵
  PID:3252
- C:\Windows\System\qALQbQS.exe
  C:\Windows\System\qALQbQS.exe
  2⤵
  PID:3272
- C:\Windows\System\QuKTCKK.exe
  C:\Windows\System\QuKTCKK.exe
  2⤵
  PID:3304
- C:\Windows\System\ljsKPnt.exe
  C:\Windows\System\ljsKPnt.exe
  2⤵
  PID:3336
- C:\Windows\System\cwQUTlv.exe
  C:\Windows\System\cwQUTlv.exe
  2⤵
  PID:3368
- C:\Windows\System\VPXpJiq.exe
  C:\Windows\System\VPXpJiq.exe
  2⤵
  PID:3400
- C:\Windows\System\bSeNqeA.exe
  C:\Windows\System\bSeNqeA.exe
  2⤵
  PID:3432
- C:\Windows\System\mkqNQSg.exe
  C:\Windows\System\mkqNQSg.exe
  2⤵
  PID:3480
- C:\Windows\System\JvNRdfb.exe
  C:\Windows\System\JvNRdfb.exe
  2⤵
  PID:3496
- C:\Windows\System\WPgPiCv.exe
  C:\Windows\System\WPgPiCv.exe
  2⤵
  PID:3528
- C:\Windows\System\SeuTYrw.exe
  C:\Windows\System\SeuTYrw.exe
  2⤵
  PID:3572
- C:\Windows\System\RAgCWjb.exe
  C:\Windows\System\RAgCWjb.exe
  2⤵
  PID:3604
- C:\Windows\System\pOsDijJ.exe
  C:\Windows\System\pOsDijJ.exe
  2⤵
  PID:3624
- C:\Windows\System\wtUTXZj.exe
  C:\Windows\System\wtUTXZj.exe
  2⤵
  PID:3656
- C:\Windows\System\ukyNcfB.exe
  C:\Windows\System\ukyNcfB.exe
  2⤵
  PID:3688
- C:\Windows\System\vUDmWaB.exe
  C:\Windows\System\vUDmWaB.exe
  2⤵
  PID:3720
- C:\Windows\System\hsjhLXA.exe
  C:\Windows\System\hsjhLXA.exe
  2⤵
  PID:3752
- C:\Windows\System\lQdwdDT.exe
  C:\Windows\System\lQdwdDT.exe
  2⤵
  PID:3800
- C:\Windows\System\eOlgyBW.exe
  C:\Windows\System\eOlgyBW.exe
  2⤵
  PID:3816
- C:\Windows\System\DSHmuqc.exe
  C:\Windows\System\DSHmuqc.exe
  2⤵
  PID:3864
- C:\Windows\System\laFuwkO.exe
  C:\Windows\System\laFuwkO.exe
  2⤵
  PID:3880
- C:\Windows\System\dsUOIlu.exe
  C:\Windows\System\dsUOIlu.exe
  2⤵
  PID:3928
- C:\Windows\System\dQRVOzD.exe
  C:\Windows\System\dQRVOzD.exe
  2⤵
  PID:3944
- C:\Windows\System\SQDkLHc.exe
  C:\Windows\System\SQDkLHc.exe
  2⤵
  PID:3976
- C:\Windows\System\lFeWnmB.exe
  C:\Windows\System\lFeWnmB.exe
  2⤵
  PID:4004
- C:\Windows\System\qHUHZDN.exe
  C:\Windows\System\qHUHZDN.exe
  2⤵
  PID:4072
- C:\Windows\System\egrmPfo.exe
  C:\Windows\System\egrmPfo.exe
  2⤵
  PID:4052
- C:\Windows\System\eJctXzK.exe
  C:\Windows\System\eJctXzK.exe
  2⤵
  PID:2768
- C:\Windows\System\jCZpRfx.exe
  C:\Windows\System\jCZpRfx.exe
  2⤵
  PID:1748
- C:\Windows\System\RdagCjv.exe
  C:\Windows\System\RdagCjv.exe
  2⤵
  PID:1300
- C:\Windows\System\zFBUnbW.exe
  C:\Windows\System\zFBUnbW.exe
  2⤵
  PID:3088
- C:\Windows\System\XCjcYwK.exe
  C:\Windows\System\XCjcYwK.exe
  2⤵
  PID:3152
- C:\Windows\System\jRodFMn.exe
  C:\Windows\System\jRodFMn.exe
  2⤵
  PID:3200
- C:\Windows\System\yJGOZzC.exe
  C:\Windows\System\yJGOZzC.exe
  2⤵
  PID:3236
- C:\Windows\System\LuhjrgJ.exe
  C:\Windows\System\LuhjrgJ.exe
  2⤵
  PID:3300
- C:\Windows\System\mAaQglH.exe
  C:\Windows\System\mAaQglH.exe
  2⤵
  PID:3396
- C:\Windows\System\cMdRXiZ.exe
  C:\Windows\System\cMdRXiZ.exe
  2⤵
  PID:3428
- C:\Windows\System\iSTXdoR.exe
  C:\Windows\System\iSTXdoR.exe
  2⤵
  PID:3508
- C:\Windows\System\ymAlwhL.exe
  C:\Windows\System\ymAlwhL.exe
  2⤵
  PID:3592
- C:\Windows\System\eQNQeBE.exe
  C:\Windows\System\eQNQeBE.exe
  2⤵
  PID:3620
- C:\Windows\System\LKWpAEr.exe
  C:\Windows\System\LKWpAEr.exe
  2⤵
  PID:3732
- C:\Windows\System\ZwNvZmz.exe
  C:\Windows\System\ZwNvZmz.exe
  2⤵
  PID:3844
- C:\Windows\System\KZbLgHW.exe
  C:\Windows\System\KZbLgHW.exe
  2⤵
  PID:3748
- C:\Windows\System\FPszVbG.exe
  C:\Windows\System\FPszVbG.exe
  2⤵
  PID:3876
- C:\Windows\System\UqhgOcB.exe
  C:\Windows\System\UqhgOcB.exe
  2⤵
  PID:3988
- C:\Windows\System\BqxutPW.exe
  C:\Windows\System\BqxutPW.exe
  2⤵
  PID:4084
- C:\Windows\System\IgbNyjq.exe
  C:\Windows\System\IgbNyjq.exe
  2⤵
  PID:1160
- C:\Windows\System\hkTuLDh.exe
  C:\Windows\System\hkTuLDh.exe
  2⤵
  PID:1796
- C:\Windows\System\PpjLVkH.exe
  C:\Windows\System\PpjLVkH.exe
  2⤵
  PID:2060
- C:\Windows\System\RGFCBWf.exe
  C:\Windows\System\RGFCBWf.exe
  2⤵
  PID:3120
- C:\Windows\System\jkIQPuy.exe
  C:\Windows\System\jkIQPuy.exe
  2⤵
  PID:4108
- C:\Windows\System\QzlxaVf.exe
  C:\Windows\System\QzlxaVf.exe
  2⤵
  PID:4124
- C:\Windows\System\GtukDFm.exe
  C:\Windows\System\GtukDFm.exe
  2⤵
  PID:4140
- C:\Windows\System\YilbUnJ.exe
  C:\Windows\System\YilbUnJ.exe
  2⤵
  PID:4156
- C:\Windows\System\YpvcCtg.exe
  C:\Windows\System\YpvcCtg.exe
  2⤵
  PID:4172
- C:\Windows\System\ulFXDAG.exe
  C:\Windows\System\ulFXDAG.exe
  2⤵
  PID:4188
- C:\Windows\System\sQriBQV.exe
  C:\Windows\System\sQriBQV.exe
  2⤵
  PID:4204
- C:\Windows\System\mNTJKNL.exe
  C:\Windows\System\mNTJKNL.exe
  2⤵
  PID:4220
- C:\Windows\System\snxsxpv.exe
  C:\Windows\System\snxsxpv.exe
  2⤵
  PID:4236
- C:\Windows\System\fuRGovb.exe
  C:\Windows\System\fuRGovb.exe
  2⤵
  PID:4252
- C:\Windows\System\ibyUamq.exe
  C:\Windows\System\ibyUamq.exe
  2⤵
  PID:4268
- C:\Windows\System\PtrHcjN.exe
  C:\Windows\System\PtrHcjN.exe
  2⤵
  PID:4284
- C:\Windows\System\LzFYSCH.exe
  C:\Windows\System\LzFYSCH.exe
  2⤵
  PID:4300
- C:\Windows\System\kzthVzL.exe
  C:\Windows\System\kzthVzL.exe
  2⤵
  PID:4316
- C:\Windows\System\YihbMmc.exe
  C:\Windows\System\YihbMmc.exe
  2⤵
  PID:4332
- C:\Windows\System\YYFexPl.exe
  C:\Windows\System\YYFexPl.exe
  2⤵
  PID:4348
- C:\Windows\System\gwhKGXH.exe
  C:\Windows\System\gwhKGXH.exe
  2⤵
  PID:4364
- C:\Windows\System\MlFiIqI.exe
  C:\Windows\System\MlFiIqI.exe
  2⤵
  PID:4380
- C:\Windows\System\HuuIWLh.exe
  C:\Windows\System\HuuIWLh.exe
  2⤵
  PID:4396
- C:\Windows\System\VxwNcSE.exe
  C:\Windows\System\VxwNcSE.exe
  2⤵
  PID:4412
- C:\Windows\System\eyilLaR.exe
  C:\Windows\System\eyilLaR.exe
  2⤵
  PID:4428
- C:\Windows\System\LjTgOZh.exe
  C:\Windows\System\LjTgOZh.exe
  2⤵
  PID:4444
- C:\Windows\System\ONpYQnn.exe
  C:\Windows\System\ONpYQnn.exe
  2⤵
  PID:4460
- C:\Windows\System\lAhjgQS.exe
  C:\Windows\System\lAhjgQS.exe
  2⤵
  PID:4476
- C:\Windows\System\zbXnrQX.exe
  C:\Windows\System\zbXnrQX.exe
  2⤵
  PID:4492
- C:\Windows\System\YvIqWIl.exe
  C:\Windows\System\YvIqWIl.exe
  2⤵
  PID:4508
- C:\Windows\System\hXVuolm.exe
  C:\Windows\System\hXVuolm.exe
  2⤵
  PID:4524
- C:\Windows\System\nqkPmUs.exe
  C:\Windows\System\nqkPmUs.exe
  2⤵
  PID:4540
- C:\Windows\System\fYXaaiT.exe
  C:\Windows\System\fYXaaiT.exe
  2⤵
  PID:4556
- C:\Windows\System\ZbXUmah.exe
  C:\Windows\System\ZbXUmah.exe
  2⤵
  PID:4572
- C:\Windows\System\GxFUFGN.exe
  C:\Windows\System\GxFUFGN.exe
  2⤵
  PID:4588
- C:\Windows\System\MwCrdel.exe
  C:\Windows\System\MwCrdel.exe
  2⤵
  PID:4604
- C:\Windows\System\zGvvQnO.exe
  C:\Windows\System\zGvvQnO.exe
  2⤵
  PID:4620
- C:\Windows\System\YLMAaZX.exe
  C:\Windows\System\YLMAaZX.exe
  2⤵
  PID:4636
- C:\Windows\System\vdiXTqU.exe
  C:\Windows\System\vdiXTqU.exe
  2⤵
  PID:4652
- C:\Windows\System\PaExNKn.exe
  C:\Windows\System\PaExNKn.exe
  2⤵
  PID:4668
- C:\Windows\System\VUceFng.exe
  C:\Windows\System\VUceFng.exe
  2⤵
  PID:4684
- C:\Windows\System\QybvcrQ.exe
  C:\Windows\System\QybvcrQ.exe
  2⤵
  PID:4700
- C:\Windows\System\uNFnXCL.exe
  C:\Windows\System\uNFnXCL.exe
  2⤵
  PID:4716
- C:\Windows\System\GEfCTvB.exe
  C:\Windows\System\GEfCTvB.exe
  2⤵
  PID:4732
- C:\Windows\System\ekgXCOA.exe
  C:\Windows\System\ekgXCOA.exe
  2⤵
  PID:4748
- C:\Windows\System\YrkACqd.exe
  C:\Windows\System\YrkACqd.exe
  2⤵
  PID:4764
- C:\Windows\System\ogQskIR.exe
  C:\Windows\System\ogQskIR.exe
  2⤵
  PID:4780
- C:\Windows\System\gvYOeaW.exe
  C:\Windows\System\gvYOeaW.exe
  2⤵
  PID:4796
- C:\Windows\System\inpPQGI.exe
  C:\Windows\System\inpPQGI.exe
  2⤵
  PID:4812
- C:\Windows\System\hJzOeHK.exe
  C:\Windows\System\hJzOeHK.exe
  2⤵
  PID:4828
- C:\Windows\System\IzHpzuC.exe
  C:\Windows\System\IzHpzuC.exe
  2⤵
  PID:4844
- C:\Windows\System\hEPQFbl.exe
  C:\Windows\System\hEPQFbl.exe
  2⤵
  PID:4860
- C:\Windows\System\oXAbheD.exe
  C:\Windows\System\oXAbheD.exe
  2⤵
  PID:4876
- C:\Windows\System\DMAKhCc.exe
  C:\Windows\System\DMAKhCc.exe
  2⤵
  PID:4892
- C:\Windows\System\qibSKZl.exe
  C:\Windows\System\qibSKZl.exe
  2⤵
  PID:4908
- C:\Windows\System\nBADKpc.exe
  C:\Windows\System\nBADKpc.exe
  2⤵
  PID:4924
- C:\Windows\System\OBPlzdU.exe
  C:\Windows\System\OBPlzdU.exe
  2⤵
  PID:4940
- C:\Windows\System\oXuEItl.exe
  C:\Windows\System\oXuEItl.exe
  2⤵
  PID:4956
- C:\Windows\System\TWgmLvu.exe
  C:\Windows\System\TWgmLvu.exe
  2⤵
  PID:4972
- C:\Windows\System\zKDcSyI.exe
  C:\Windows\System\zKDcSyI.exe
  2⤵
  PID:4988
- C:\Windows\System\SUWLpPU.exe
  C:\Windows\System\SUWLpPU.exe
  2⤵
  PID:5004
- C:\Windows\System\YJnjhpE.exe
  C:\Windows\System\YJnjhpE.exe
  2⤵
  PID:5020
- C:\Windows\System\EVYapGm.exe
  C:\Windows\System\EVYapGm.exe
  2⤵
  PID:5036
- C:\Windows\System\StjAghB.exe
  C:\Windows\System\StjAghB.exe
  2⤵
  PID:5052
- C:\Windows\System\YNtojIr.exe
  C:\Windows\System\YNtojIr.exe
  2⤵
  PID:5068
- C:\Windows\System\rNqeHXQ.exe
  C:\Windows\System\rNqeHXQ.exe
  2⤵
  PID:5084
- C:\Windows\System\KaZfBYe.exe
  C:\Windows\System\KaZfBYe.exe
  2⤵
  PID:5100
- C:\Windows\System\xCMtyQZ.exe
  C:\Windows\System\xCMtyQZ.exe
  2⤵
  PID:5116
- C:\Windows\System\mgOzkpr.exe
  C:\Windows\System\mgOzkpr.exe
  2⤵
  PID:3332
- C:\Windows\System\cVrhJyw.exe
  C:\Windows\System\cVrhJyw.exe
  2⤵
  PID:3524
- C:\Windows\System\eBgnspJ.exe
  C:\Windows\System\eBgnspJ.exe
  2⤵
  PID:3588
- C:\Windows\System\vYReXiz.exe
  C:\Windows\System\vYReXiz.exe
  2⤵
  PID:3828
- C:\Windows\System\kYMxyVD.exe
  C:\Windows\System\kYMxyVD.exe
  2⤵
  PID:3684
- C:\Windows\System\RWNGfRf.exe
  C:\Windows\System\RWNGfRf.exe
  2⤵
  PID:4040
- C:\Windows\System\xurRtXP.exe
  C:\Windows\System\xurRtXP.exe
  2⤵
  PID:2156
- C:\Windows\System\gzrucTp.exe
  C:\Windows\System\gzrucTp.exe
  2⤵
  PID:3136
- C:\Windows\System\fWILQfG.exe
  C:\Windows\System\fWILQfG.exe
  2⤵
  PID:4120
- C:\Windows\System\JLMRFaF.exe
  C:\Windows\System\JLMRFaF.exe
  2⤵
  PID:4132
- C:\Windows\System\bvXkLrm.exe
  C:\Windows\System\bvXkLrm.exe
  2⤵
  PID:4168
- C:\Windows\System\tiqLVdX.exe
  C:\Windows\System\tiqLVdX.exe
  2⤵
  PID:4244
- C:\Windows\System\pSKJJTH.exe
  C:\Windows\System\pSKJJTH.exe
  2⤵
  PID:4248
- C:\Windows\System\RQXigFC.exe
  C:\Windows\System\RQXigFC.exe
  2⤵
  PID:4232
- C:\Windows\System\vPMnQhY.exe
  C:\Windows\System\vPMnQhY.exe
  2⤵
  PID:4296
- C:\Windows\System\bysbaXk.exe
  C:\Windows\System\bysbaXk.exe
  2⤵
  PID:4344
- C:\Windows\System\KxwbKGC.exe
  C:\Windows\System\KxwbKGC.exe
  2⤵
  PID:4376
- C:\Windows\System\cmcWEyn.exe
  C:\Windows\System\cmcWEyn.exe
  2⤵
  PID:4360
- C:\Windows\System\ARZflBO.exe
  C:\Windows\System\ARZflBO.exe
  2⤵
  PID:4436
- C:\Windows\System\EUlCzsr.exe
  C:\Windows\System\EUlCzsr.exe
  2⤵
  PID:2188
- C:\Windows\System\GnAFfnK.exe
  C:\Windows\System\GnAFfnK.exe
  2⤵
  PID:4468
- C:\Windows\System\ZCElKOD.exe
  C:\Windows\System\ZCElKOD.exe
  2⤵
  PID:4500
- C:\Windows\System\irmzAYl.exe
  C:\Windows\System\irmzAYl.exe
  2⤵
  PID:4488
- C:\Windows\System\tUMWlLU.exe
  C:\Windows\System\tUMWlLU.exe
  2⤵
  PID:4564
- C:\Windows\System\PLkJorI.exe
  C:\Windows\System\PLkJorI.exe
  2⤵
  PID:4580
- C:\Windows\System\bFJWgtf.exe
  C:\Windows\System\bFJWgtf.exe
  2⤵
  PID:4632
- C:\Windows\System\yRzYtPP.exe
  C:\Windows\System\yRzYtPP.exe
  2⤵
  PID:4660
- C:\Windows\System\YXwAVdu.exe
  C:\Windows\System\YXwAVdu.exe
  2⤵
  PID:4692
- C:\Windows\System\RTavidd.exe
  C:\Windows\System\RTavidd.exe
  2⤵
  PID:4708
- C:\Windows\System\fyLTqpO.exe
  C:\Windows\System\fyLTqpO.exe
  2⤵
  PID:4740
- C:\Windows\System\KtvUfHt.exe
  C:\Windows\System\KtvUfHt.exe
  2⤵
  PID:4792
- C:\Windows\System\tHjVwIa.exe
  C:\Windows\System\tHjVwIa.exe
  2⤵
  PID:4776
- C:\Windows\System\bWVPTbI.exe
  C:\Windows\System\bWVPTbI.exe
  2⤵
  PID:4824
- C:\Windows\System\GtChkBW.exe
  C:\Windows\System\GtChkBW.exe
  2⤵
  PID:4856
- C:\Windows\System\FOpwgPq.exe
  C:\Windows\System\FOpwgPq.exe
  2⤵
  PID:4916
- C:\Windows\System\YwcVKqa.exe
  C:\Windows\System\YwcVKqa.exe
  2⤵
  PID:4920
- C:\Windows\System\iCcWieT.exe
  C:\Windows\System\iCcWieT.exe
  2⤵
  PID:4936
- C:\Windows\System\NTnGFSG.exe
  C:\Windows\System\NTnGFSG.exe
  2⤵
  PID:4964
- C:\Windows\System\CNThwcv.exe
  C:\Windows\System\CNThwcv.exe
  2⤵
  PID:5016
- C:\Windows\System\aoXFsAu.exe
  C:\Windows\System\aoXFsAu.exe
  2⤵
  PID:5032
- C:\Windows\System\MVFReAV.exe
  C:\Windows\System\MVFReAV.exe
  2⤵
  PID:5060
- C:\Windows\System\rLBXggM.exe
  C:\Windows\System\rLBXggM.exe
  2⤵
  PID:5108
- C:\Windows\System\uvcXrBV.exe
  C:\Windows\System\uvcXrBV.exe
  2⤵
  PID:3240
- C:\Windows\System\yKCJbgy.exe
  C:\Windows\System\yKCJbgy.exe
  2⤵
  PID:3796
- C:\Windows\System\yzPynhS.exe
  C:\Windows\System\yzPynhS.exe
  2⤵
  PID:3668
- C:\Windows\System\xkHmakg.exe
  C:\Windows\System\xkHmakg.exe
  2⤵
  PID:3924
- C:\Windows\System\AERalrz.exe
  C:\Windows\System\AERalrz.exe
  2⤵
  PID:4116
- C:\Windows\System\clNNjLj.exe
  C:\Windows\System\clNNjLj.exe
  2⤵
  PID:4212
- C:\Windows\System\sViMMGW.exe
  C:\Windows\System\sViMMGW.exe
  2⤵
  PID:1212
- C:\Windows\System\dSjyQEZ.exe
  C:\Windows\System\dSjyQEZ.exe
  2⤵
  PID:4308
- C:\Windows\System\NHLqPBd.exe
  C:\Windows\System\NHLqPBd.exe
  2⤵
  PID:4404
- C:\Windows\System\copMfYk.exe
  C:\Windows\System\copMfYk.exe
  2⤵
  PID:4456
- C:\Windows\System\WBXAYKt.exe
  C:\Windows\System\WBXAYKt.exe
  2⤵
  PID:4292
- C:\Windows\System\kWnxprI.exe
  C:\Windows\System\kWnxprI.exe
  2⤵
  PID:2200
- C:\Windows\System\yiWArHT.exe
  C:\Windows\System\yiWArHT.exe
  2⤵
  PID:4484
- C:\Windows\System\RjDttHk.exe
  C:\Windows\System\RjDttHk.exe
  2⤵
  PID:1612
- C:\Windows\System\hmdrNhA.exe
  C:\Windows\System\hmdrNhA.exe
  2⤵
  PID:2220
- C:\Windows\System\gCPfRee.exe
  C:\Windows\System\gCPfRee.exe
  2⤵
  PID:4644
- C:\Windows\System\lrJEHgb.exe
  C:\Windows\System\lrJEHgb.exe
  2⤵
  PID:4712
- C:\Windows\System\qrQvgqS.exe
  C:\Windows\System\qrQvgqS.exe
  2⤵
  PID:4772
- C:\Windows\System\IxorLtf.exe
  C:\Windows\System\IxorLtf.exe
  2⤵
  PID:4852
- C:\Windows\System\QukgUVc.exe
  C:\Windows\System\QukgUVc.exe
  2⤵
  PID:4900
- C:\Windows\System\DeqMKSe.exe
  C:\Windows\System\DeqMKSe.exe
  2⤵
  PID:2044
- C:\Windows\System\lbgWnTa.exe
  C:\Windows\System\lbgWnTa.exe
  2⤵
  PID:1076
- C:\Windows\System\LUzDhry.exe
  C:\Windows\System\LUzDhry.exe
  2⤵
  PID:5012
- C:\Windows\System\YgWrvMp.exe
  C:\Windows\System\YgWrvMp.exe
  2⤵
  PID:2012
- C:\Windows\System\uYABBtt.exe
  C:\Windows\System\uYABBtt.exe
  2⤵
  PID:5092
- C:\Windows\System\JSdnHXL.exe
  C:\Windows\System\JSdnHXL.exe
  2⤵
  PID:2468
- C:\Windows\System\alnlJor.exe
  C:\Windows\System\alnlJor.exe
  2⤵
  PID:604
- C:\Windows\System\TUJPfRS.exe
  C:\Windows\System\TUJPfRS.exe
  2⤵
  PID:2320
- C:\Windows\System\INfKegK.exe
  C:\Windows\System\INfKegK.exe
  2⤵
  PID:4100
- C:\Windows\System\yjgnMhr.exe
  C:\Windows\System\yjgnMhr.exe
  2⤵
  PID:4024
- C:\Windows\System\NRqEAIC.exe
  C:\Windows\System\NRqEAIC.exe
  2⤵
  PID:4228
- C:\Windows\System\YWUkwcs.exe
  C:\Windows\System\YWUkwcs.exe
  2⤵
  PID:4440
- C:\Windows\System\pijevQa.exe
  C:\Windows\System\pijevQa.exe
  2⤵
  PID:2328
- C:\Windows\System\GrycueD.exe
  C:\Windows\System\GrycueD.exe
  2⤵
  PID:2880
- C:\Windows\System\HXRxAAr.exe
  C:\Windows\System\HXRxAAr.exe
  2⤵
  PID:1440
- C:\Windows\System\RlJbEqz.exe
  C:\Windows\System\RlJbEqz.exe
  2⤵
  PID:592
- C:\Windows\System\QJexRLC.exe
  C:\Windows\System\QJexRLC.exe
  2⤵
  PID:2688
- C:\Windows\System\XGdcCbe.exe
  C:\Windows\System\XGdcCbe.exe
  2⤵
  PID:2128
- C:\Windows\System\jeSgkCO.exe
  C:\Windows\System\jeSgkCO.exe
  2⤵
  PID:1708
- C:\Windows\System\sBZwPdJ.exe
  C:\Windows\System\sBZwPdJ.exe
  2⤵
  PID:4616
- C:\Windows\System\ZDKsNic.exe
  C:\Windows\System\ZDKsNic.exe
  2⤵
  PID:4696
- C:\Windows\System\qrhobkw.exe
  C:\Windows\System\qrhobkw.exe
  2⤵
  PID:4820
- C:\Windows\System\WPXfOTO.exe
  C:\Windows\System\WPXfOTO.exe
  2⤵
  PID:4980
- C:\Windows\System\LdADitT.exe
  C:\Windows\System\LdADitT.exe
  2⤵
  PID:1956
- C:\Windows\System\cZesAIM.exe
  C:\Windows\System\cZesAIM.exe
  2⤵
  PID:3460
- C:\Windows\System\GSFQwNO.exe
  C:\Windows\System\GSFQwNO.exe
  2⤵
  PID:3972
- C:\Windows\System\mQsxtZr.exe
  C:\Windows\System\mQsxtZr.exe
  2⤵
  PID:4164
- C:\Windows\System\HAQRUDQ.exe
  C:\Windows\System\HAQRUDQ.exe
  2⤵
  PID:2796
- C:\Windows\System\vKLhEhr.exe
  C:\Windows\System\vKLhEhr.exe
  2⤵
  PID:4340
- C:\Windows\System\bXLNFAa.exe
  C:\Windows\System\bXLNFAa.exe
  2⤵
  PID:2244
- C:\Windows\System\UMyvKoj.exe
  C:\Windows\System\UMyvKoj.exe
  2⤵
  PID:4676
- C:\Windows\System\reHnLqi.exe
  C:\Windows\System\reHnLqi.exe
  2⤵
  PID:3364
- C:\Windows\System\FdIdeOx.exe
  C:\Windows\System\FdIdeOx.exe
  2⤵
  PID:5124
- C:\Windows\System\WMfXWro.exe
  C:\Windows\System\WMfXWro.exe
  2⤵
  PID:5140
- C:\Windows\System\CvaIWFo.exe
  C:\Windows\System\CvaIWFo.exe
  2⤵
  PID:5156
- C:\Windows\System\QCadJkR.exe
  C:\Windows\System\QCadJkR.exe
  2⤵
  PID:5172
- C:\Windows\System\xihfvJb.exe
  C:\Windows\System\xihfvJb.exe
  2⤵
  PID:5188
- C:\Windows\System\HeMawAi.exe
  C:\Windows\System\HeMawAi.exe
  2⤵
  PID:5204
- C:\Windows\System\biRtTin.exe
  C:\Windows\System\biRtTin.exe
  2⤵
  PID:5220
- C:\Windows\System\kFWIXqJ.exe
  C:\Windows\System\kFWIXqJ.exe
  2⤵
  PID:5236
- C:\Windows\System\pJdgBkN.exe
  C:\Windows\System\pJdgBkN.exe
  2⤵
  PID:5252
- C:\Windows\System\mVdvYAm.exe
  C:\Windows\System\mVdvYAm.exe
  2⤵
  PID:5268
- C:\Windows\System\yNJJGAs.exe
  C:\Windows\System\yNJJGAs.exe
  2⤵
  PID:5284
- C:\Windows\System\iZlYoCO.exe
  C:\Windows\System\iZlYoCO.exe
  2⤵
  PID:5300
- C:\Windows\System\oQrhkuc.exe
  C:\Windows\System\oQrhkuc.exe
  2⤵
  PID:5316
- C:\Windows\System\KRrBIbV.exe
  C:\Windows\System\KRrBIbV.exe
  2⤵
  PID:5332
- C:\Windows\System\bBLLVIg.exe
  C:\Windows\System\bBLLVIg.exe
  2⤵
  PID:5348
- C:\Windows\System\IvDSyzM.exe
  C:\Windows\System\IvDSyzM.exe
  2⤵
  PID:5368
- C:\Windows\System\WxXZlVx.exe
  C:\Windows\System\WxXZlVx.exe
  2⤵
  PID:5388
- C:\Windows\System\kJlpcSd.exe
  C:\Windows\System\kJlpcSd.exe
  2⤵
  PID:5408
- C:\Windows\System\DugvMHY.exe
  C:\Windows\System\DugvMHY.exe
  2⤵
  PID:5428
- C:\Windows\System\MugKKad.exe
  C:\Windows\System\MugKKad.exe
  2⤵
  PID:5444
- C:\Windows\System\oihyLho.exe
  C:\Windows\System\oihyLho.exe
  2⤵
  PID:5460
- C:\Windows\System\yTFTJSq.exe
  C:\Windows\System\yTFTJSq.exe
  2⤵
  PID:5476
- C:\Windows\System\yEVWYfR.exe
  C:\Windows\System\yEVWYfR.exe
  2⤵
  PID:5492
- C:\Windows\System\DtAzgsl.exe
  C:\Windows\System\DtAzgsl.exe
  2⤵
  PID:5508
- C:\Windows\System\bDcbgmR.exe
  C:\Windows\System\bDcbgmR.exe
  2⤵
  PID:5524
- C:\Windows\System\ExURwbw.exe
  C:\Windows\System\ExURwbw.exe
  2⤵
  PID:5540
- C:\Windows\System\fpvdHyd.exe
  C:\Windows\System\fpvdHyd.exe
  2⤵
  PID:5556
- C:\Windows\System\AgRdTTr.exe
  C:\Windows\System\AgRdTTr.exe
  2⤵
  PID:5576
- C:\Windows\System\vPEAcaT.exe
  C:\Windows\System\vPEAcaT.exe
  2⤵
  PID:5592
- C:\Windows\System\FeJnYgh.exe
  C:\Windows\System\FeJnYgh.exe
  2⤵
  PID:5608
- C:\Windows\System\trGUOCe.exe
  C:\Windows\System\trGUOCe.exe
  2⤵
  PID:5624
- C:\Windows\System\IwxuBUO.exe
  C:\Windows\System\IwxuBUO.exe
  2⤵
  PID:5640
- C:\Windows\System\LrzNwfz.exe
  C:\Windows\System\LrzNwfz.exe
  2⤵
  PID:5656
- C:\Windows\System\CjffueP.exe
  C:\Windows\System\CjffueP.exe
  2⤵
  PID:5672
- C:\Windows\System\fdAtjiT.exe
  C:\Windows\System\fdAtjiT.exe
  2⤵
  PID:5688
- C:\Windows\System\IWCFcKV.exe
  C:\Windows\System\IWCFcKV.exe
  2⤵
  PID:5704
- C:\Windows\System\wkJWEZQ.exe
  C:\Windows\System\wkJWEZQ.exe
  2⤵
  PID:5720
- C:\Windows\System\yYMQnVQ.exe
  C:\Windows\System\yYMQnVQ.exe
  2⤵
  PID:5736
- C:\Windows\System\DkvkjAW.exe
  C:\Windows\System\DkvkjAW.exe
  2⤵
  PID:5752
- C:\Windows\System\UagFfDO.exe
  C:\Windows\System\UagFfDO.exe
  2⤵
  PID:5768
- C:\Windows\System\OTPwcIm.exe
  C:\Windows\System\OTPwcIm.exe
  2⤵
  PID:5828
- C:\Windows\System\KVSujMR.exe
  C:\Windows\System\KVSujMR.exe
  2⤵
  PID:5844
- C:\Windows\System\efhKlTE.exe
  C:\Windows\System\efhKlTE.exe
  2⤵
  PID:5860
- C:\Windows\System\QrKJqnW.exe
  C:\Windows\System\QrKJqnW.exe
  2⤵
  PID:5880
- C:\Windows\System\UmMzihx.exe
  C:\Windows\System\UmMzihx.exe
  2⤵
  PID:5896
- C:\Windows\System\WohjHho.exe
  C:\Windows\System\WohjHho.exe
  2⤵
  PID:5916
- C:\Windows\System\qiCYxpu.exe
  C:\Windows\System\qiCYxpu.exe
  2⤵
  PID:5932
- C:\Windows\System\vGqeUsm.exe
  C:\Windows\System\vGqeUsm.exe
  2⤵
  PID:5948
- C:\Windows\System\XOcMPnF.exe
  C:\Windows\System\XOcMPnF.exe
  2⤵
  PID:5964
- C:\Windows\System\ExQvhiY.exe
  C:\Windows\System\ExQvhiY.exe
  2⤵
  PID:5980
- C:\Windows\System\jUsbFhg.exe
  C:\Windows\System\jUsbFhg.exe
  2⤵
  PID:5996
- C:\Windows\System\VaXpQhE.exe
  C:\Windows\System\VaXpQhE.exe
  2⤵
  PID:6012
- C:\Windows\System\efJhlAA.exe
  C:\Windows\System\efJhlAA.exe
  2⤵
  PID:6028
- C:\Windows\System\mmhvvKX.exe
  C:\Windows\System\mmhvvKX.exe
  2⤵
  PID:6044
- C:\Windows\System\vpsNvse.exe
  C:\Windows\System\vpsNvse.exe
  2⤵
  PID:6060
- C:\Windows\System\PkZqvOJ.exe
  C:\Windows\System\PkZqvOJ.exe
  2⤵
  PID:6076
- C:\Windows\System\djBOpWZ.exe
  C:\Windows\System\djBOpWZ.exe
  2⤵
  PID:6092
- C:\Windows\System\fSTepQM.exe
  C:\Windows\System\fSTepQM.exe
  2⤵
  PID:6112
- C:\Windows\System\vxkRjcP.exe
  C:\Windows\System\vxkRjcP.exe
  2⤵
  PID:6128
- C:\Windows\System\feEnYUd.exe
  C:\Windows\System\feEnYUd.exe
  2⤵
  PID:2260
- C:\Windows\System\xdgpmXz.exe
  C:\Windows\System\xdgpmXz.exe
  2⤵
  PID:2596
- C:\Windows\System\NsaMmxP.exe
  C:\Windows\System\NsaMmxP.exe
  2⤵
  PID:4788
- C:\Windows\System\jTsKHzA.exe
  C:\Windows\System\jTsKHzA.exe
  2⤵
  PID:4104
- C:\Windows\System\KVWhlBe.exe
  C:\Windows\System\KVWhlBe.exe
  2⤵
  PID:4328
- C:\Windows\System\iSwjibc.exe
  C:\Windows\System\iSwjibc.exe
  2⤵
  PID:2664
- C:\Windows\System\HaIvmew.exe
  C:\Windows\System\HaIvmew.exe
  2⤵
  PID:5168
- C:\Windows\System\zXnOGRd.exe
  C:\Windows\System\zXnOGRd.exe
  2⤵
  PID:5232
- C:\Windows\System\vkngxsP.exe
  C:\Windows\System\vkngxsP.exe
  2⤵
  PID:1608
- C:\Windows\System\kzjuZvA.exe
  C:\Windows\System\kzjuZvA.exe
  2⤵
  PID:2384
- C:\Windows\System\tALZXcI.exe
  C:\Windows\System\tALZXcI.exe
  2⤵
  PID:5212
- C:\Windows\System\FYpwiOG.exe
  C:\Windows\System\FYpwiOG.exe
  2⤵
  PID:5276
- C:\Windows\System\qEGKexe.exe
  C:\Windows\System\qEGKexe.exe
  2⤵
  PID:5280
- C:\Windows\System\vyiUTqx.exe
  C:\Windows\System\vyiUTqx.exe
  2⤵
  PID:5328
- C:\Windows\System\YMcgyhV.exe
  C:\Windows\System\YMcgyhV.exe
  2⤵
  PID:5396
- C:\Windows\System\VmRdjed.exe
  C:\Windows\System\VmRdjed.exe
  2⤵
  PID:5384
- C:\Windows\System\GNBFzdk.exe
  C:\Windows\System\GNBFzdk.exe
  2⤵
  PID:5420
- C:\Windows\System\LIzBIfL.exe
  C:\Windows\System\LIzBIfL.exe
  2⤵
  PID:5456
- C:\Windows\System\VYziGVp.exe
  C:\Windows\System\VYziGVp.exe
  2⤵
  PID:5516
- C:\Windows\System\YewshXJ.exe
  C:\Windows\System\YewshXJ.exe
  2⤵
  PID:5536
- C:\Windows\System\hymgHIh.exe
  C:\Windows\System\hymgHIh.exe
  2⤵
  PID:5604
- C:\Windows\System\XPdokeZ.exe
  C:\Windows\System\XPdokeZ.exe
  2⤵
  PID:1856
- C:\Windows\System\xiWckOP.exe
  C:\Windows\System\xiWckOP.exe
  2⤵
  PID:5700
- C:\Windows\System\XsimUvi.exe
  C:\Windows\System\XsimUvi.exe
  2⤵
  PID:2432
- C:\Windows\System\TATpbXh.exe
  C:\Windows\System\TATpbXh.exe
  2⤵
  PID:5684
- C:\Windows\System\cHMMCRi.exe
  C:\Windows\System\cHMMCRi.exe
  2⤵
  PID:5716
- C:\Windows\System\EaJqoRB.exe
  C:\Windows\System\EaJqoRB.exe
  2⤵
  PID:5548
- C:\Windows\System\PZFYXEF.exe
  C:\Windows\System\PZFYXEF.exe
  2⤵
  PID:5584
- C:\Windows\System\gEkfPiH.exe
  C:\Windows\System\gEkfPiH.exe
  2⤵
  PID:1452
- C:\Windows\System\PzZsdHV.exe
  C:\Windows\System\PzZsdHV.exe
  2⤵
  PID:5788
- C:\Windows\System\fabcdgP.exe
  C:\Windows\System\fabcdgP.exe
  2⤵
  PID:3064
- C:\Windows\System\MIVMFgZ.exe
  C:\Windows\System\MIVMFgZ.exe
  2⤵
  PID:5812
- C:\Windows\System\plobDpL.exe
  C:\Windows\System\plobDpL.exe
  2⤵
  PID:5852
- C:\Windows\System\ZhwUMkb.exe
  C:\Windows\System\ZhwUMkb.exe
  2⤵
  PID:5928
- C:\Windows\System\vtWJVMZ.exe
  C:\Windows\System\vtWJVMZ.exe
  2⤵
  PID:5992
- C:\Windows\System\unAkfnt.exe
  C:\Windows\System\unAkfnt.exe
  2⤵
  PID:6084
- C:\Windows\System\iJKqDOy.exe
  C:\Windows\System\iJKqDOy.exe
  2⤵
  PID:6052
- C:\Windows\System\CvssWxz.exe
  C:\Windows\System\CvssWxz.exe
  2⤵
  PID:5840
- C:\Windows\System\AtebHhI.exe
  C:\Windows\System\AtebHhI.exe
  2⤵
  PID:5904
- C:\Windows\System\SOBUpPV.exe
  C:\Windows\System\SOBUpPV.exe
  2⤵
  PID:6088
- C:\Windows\System\eJRKnoh.exe
  C:\Windows\System\eJRKnoh.exe
  2⤵
  PID:5976
- C:\Windows\System\CzTfxVa.exe
  C:\Windows\System\CzTfxVa.exe
  2⤵
  PID:6040
- C:\Windows\System\ZePnUOj.exe
  C:\Windows\System\ZePnUOj.exe
  2⤵
  PID:6104
- C:\Windows\System\CuVmjEV.exe
  C:\Windows\System\CuVmjEV.exe
  2⤵
  PID:5044
- C:\Windows\System\vVDHMjX.exe
  C:\Windows\System\vVDHMjX.exe
  2⤵
  PID:4888
- C:\Windows\System\rZCiets.exe
  C:\Windows\System\rZCiets.exe
  2⤵
  PID:3860
- C:\Windows\System\ROHlJnK.exe
  C:\Windows\System\ROHlJnK.exe
  2⤵
  PID:2756
- C:\Windows\System\hCiJewY.exe
  C:\Windows\System\hCiJewY.exe
  2⤵
  PID:2120
- C:\Windows\System\cuqZyhH.exe
  C:\Windows\System\cuqZyhH.exe
  2⤵
  PID:5292
- C:\Windows\System\fRLULKA.exe
  C:\Windows\System\fRLULKA.exe
  2⤵
  PID:5324
- C:\Windows\System\oFnfFNT.exe
  C:\Windows\System\oFnfFNT.exe
  2⤵
  PID:5296
- C:\Windows\System\WcIuNmR.exe
  C:\Windows\System\WcIuNmR.exe
  2⤵
  PID:5360
- C:\Windows\System\fQjDpci.exe
  C:\Windows\System\fQjDpci.exe
  2⤵
  PID:5520
- C:\Windows\System\CAxoNpl.exe
  C:\Windows\System\CAxoNpl.exe
  2⤵
  PID:5636
- C:\Windows\System\xlouuKG.exe
  C:\Windows\System\xlouuKG.exe
  2⤵
  PID:2416
- C:\Windows\System\dySTgWj.exe
  C:\Windows\System\dySTgWj.exe
  2⤵
  PID:2616
- C:\Windows\System\imWWURZ.exe
  C:\Windows\System\imWWURZ.exe
  2⤵
  PID:5680
- C:\Windows\System\cRRSjKF.exe
  C:\Windows\System\cRRSjKF.exe
  2⤵
  PID:5764
- C:\Windows\System\tJRnwXr.exe
  C:\Windows\System\tJRnwXr.exe
  2⤵
  PID:5924
- C:\Windows\System\YZbGnpG.exe
  C:\Windows\System\YZbGnpG.exe
  2⤵
  PID:5960
- C:\Windows\System\mfEucWw.exe
  C:\Windows\System\mfEucWw.exe
  2⤵
  PID:6036
- C:\Windows\System\omghnes.exe
  C:\Windows\System\omghnes.exe
  2⤵
  PID:820
- C:\Windows\System\ZrayOXN.exe
  C:\Windows\System\ZrayOXN.exe
  2⤵
  PID:5228
- C:\Windows\System\DWEKtix.exe
  C:\Windows\System\DWEKtix.exe
  2⤵
  PID:6072
- C:\Windows\System\FCzoCWK.exe
  C:\Windows\System\FCzoCWK.exe
  2⤵
  PID:4728
- C:\Windows\System\nHjkjBX.exe
  C:\Windows\System\nHjkjBX.exe
  2⤵
  PID:5440
- C:\Windows\System\mtlMjFv.exe
  C:\Windows\System\mtlMjFv.exe
  2⤵
  PID:5804
- C:\Windows\System\PIvMQad.exe
  C:\Windows\System\PIvMQad.exe
  2⤵
  PID:5136
- C:\Windows\System\rgtLriZ.exe
  C:\Windows\System\rgtLriZ.exe
  2⤵
  PID:5472
- C:\Windows\System\avBfSPQ.exe
  C:\Windows\System\avBfSPQ.exe
  2⤵
  PID:5808
- C:\Windows\System\hHmvdFZ.exe
  C:\Windows\System\hHmvdFZ.exe
  2⤵
  PID:5696
- C:\Windows\System\XoLlrss.exe
  C:\Windows\System\XoLlrss.exe
  2⤵
  PID:5552
- C:\Windows\System\DReSkcI.exe
  C:\Windows\System\DReSkcI.exe
  2⤵
  PID:2632
- C:\Windows\System\ITusedw.exe
  C:\Windows\System\ITusedw.exe
  2⤵
  PID:6056
- C:\Windows\System\hblkmVY.exe
  C:\Windows\System\hblkmVY.exe
  2⤵
  PID:6024
- C:\Windows\System\clSCrOY.exe
  C:\Windows\System\clSCrOY.exe
  2⤵
  PID:5184
- C:\Windows\System\GOIxWqF.exe
  C:\Windows\System\GOIxWqF.exe
  2⤵
  PID:5200
- C:\Windows\System\jWjOaHq.exe
  C:\Windows\System\jWjOaHq.exe
  2⤵
  PID:5652
- C:\Windows\System\CKZVjGg.exe
  C:\Windows\System\CKZVjGg.exe
  2⤵
  PID:6156
- C:\Windows\System\ETNzlqQ.exe
  C:\Windows\System\ETNzlqQ.exe
  2⤵
  PID:6172
- C:\Windows\System\eHsVVMd.exe
  C:\Windows\System\eHsVVMd.exe
  2⤵
  PID:6188
- C:\Windows\System\juwxaIq.exe
  C:\Windows\System\juwxaIq.exe
  2⤵
  PID:6204
- C:\Windows\System\TTwxJRu.exe
  C:\Windows\System\TTwxJRu.exe
  2⤵
  PID:6220
- C:\Windows\System\isvcsuy.exe
  C:\Windows\System\isvcsuy.exe
  2⤵
  PID:6236
- C:\Windows\System\dqxfYUQ.exe
  C:\Windows\System\dqxfYUQ.exe
  2⤵
  PID:6252
- C:\Windows\System\PRGFhZy.exe
  C:\Windows\System\PRGFhZy.exe
  2⤵
  PID:6268
- C:\Windows\System\KWtKTOE.exe
  C:\Windows\System\KWtKTOE.exe
  2⤵
  PID:6284
- C:\Windows\System\XVLjxtH.exe
  C:\Windows\System\XVLjxtH.exe
  2⤵
  PID:6300
- C:\Windows\System\aQcvaVZ.exe
  C:\Windows\System\aQcvaVZ.exe
  2⤵
  PID:6316
- C:\Windows\System\ACNSEll.exe
  C:\Windows\System\ACNSEll.exe
  2⤵
  PID:6332
- C:\Windows\System\QxtzTHO.exe
  C:\Windows\System\QxtzTHO.exe
  2⤵
  PID:6348
- C:\Windows\System\BUKYENZ.exe
  C:\Windows\System\BUKYENZ.exe
  2⤵
  PID:6364
- C:\Windows\System\ogbXmqf.exe
  C:\Windows\System\ogbXmqf.exe
  2⤵
  PID:6380
- C:\Windows\System\yMihXCS.exe
  C:\Windows\System\yMihXCS.exe
  2⤵
  PID:6396
- C:\Windows\System\UxwactK.exe
  C:\Windows\System\UxwactK.exe
  2⤵
  PID:6412
- C:\Windows\System\jfGIrxF.exe
  C:\Windows\System\jfGIrxF.exe
  2⤵
  PID:6428
- C:\Windows\System\XAZUfvs.exe
  C:\Windows\System\XAZUfvs.exe
  2⤵
  PID:6444
- C:\Windows\System\YluTiey.exe
  C:\Windows\System\YluTiey.exe
  2⤵
  PID:6460
- C:\Windows\System\LwOHzTn.exe
  C:\Windows\System\LwOHzTn.exe
  2⤵
  PID:6476
- C:\Windows\System\RVdYzgA.exe
  C:\Windows\System\RVdYzgA.exe
  2⤵
  PID:6492
- C:\Windows\System\efjvdGL.exe
  C:\Windows\System\efjvdGL.exe
  2⤵
  PID:6508
- C:\Windows\System\jcEgkVE.exe
  C:\Windows\System\jcEgkVE.exe
  2⤵
  PID:6524
- C:\Windows\System\vBkmTMA.exe
  C:\Windows\System\vBkmTMA.exe
  2⤵
  PID:6540
- C:\Windows\System\TWRYIrA.exe
  C:\Windows\System\TWRYIrA.exe
  2⤵
  PID:6556
- C:\Windows\System\XXRyFmV.exe
  C:\Windows\System\XXRyFmV.exe
  2⤵
  PID:6572
- C:\Windows\System\YXwmddc.exe
  C:\Windows\System\YXwmddc.exe
  2⤵
  PID:6588
- C:\Windows\System\KdaTxJb.exe
  C:\Windows\System\KdaTxJb.exe
  2⤵
  PID:6604
- C:\Windows\System\NNhDyIn.exe
  C:\Windows\System\NNhDyIn.exe
  2⤵
  PID:6620
- C:\Windows\System\cDqDCBr.exe
  C:\Windows\System\cDqDCBr.exe
  2⤵
  PID:6636
- C:\Windows\System\GUdWpsI.exe
  C:\Windows\System\GUdWpsI.exe
  2⤵
  PID:6652
- C:\Windows\System\mIBLlhb.exe
  C:\Windows\System\mIBLlhb.exe
  2⤵
  PID:6668
- C:\Windows\System\rZkiwHJ.exe
  C:\Windows\System\rZkiwHJ.exe
  2⤵
  PID:6684
- C:\Windows\System\dkPVpkl.exe
  C:\Windows\System\dkPVpkl.exe
  2⤵
  PID:6700
- C:\Windows\System\vufHqMa.exe
  C:\Windows\System\vufHqMa.exe
  2⤵
  PID:6716
- C:\Windows\System\ZmRsANH.exe
  C:\Windows\System\ZmRsANH.exe
  2⤵
  PID:6732
- C:\Windows\System\eHHIjrw.exe
  C:\Windows\System\eHHIjrw.exe
  2⤵
  PID:6748
- C:\Windows\System\LxwAPPY.exe
  C:\Windows\System\LxwAPPY.exe
  2⤵
  PID:6764
- C:\Windows\System\LyqagNg.exe
  C:\Windows\System\LyqagNg.exe
  2⤵
  PID:6780
- C:\Windows\System\aYyIqWT.exe
  C:\Windows\System\aYyIqWT.exe
  2⤵
  PID:6796
- C:\Windows\System\mTjsbhk.exe
  C:\Windows\System\mTjsbhk.exe
  2⤵
  PID:6812
- C:\Windows\System\sDUmeVX.exe
  C:\Windows\System\sDUmeVX.exe
  2⤵
  PID:6828
- C:\Windows\System\fWbVgkx.exe
  C:\Windows\System\fWbVgkx.exe
  2⤵
  PID:6844
- C:\Windows\System\yJtgGdx.exe
  C:\Windows\System\yJtgGdx.exe
  2⤵
  PID:6860
- C:\Windows\System\eXLCVax.exe
  C:\Windows\System\eXLCVax.exe
  2⤵
  PID:6876
- C:\Windows\System\nKIvSMw.exe
  C:\Windows\System\nKIvSMw.exe
  2⤵
  PID:6892
- C:\Windows\System\aIXFJkI.exe
  C:\Windows\System\aIXFJkI.exe
  2⤵
  PID:6908
- C:\Windows\System\rQoeYCa.exe
  C:\Windows\System\rQoeYCa.exe
  2⤵
  PID:6924
- C:\Windows\System\lXLlYhN.exe
  C:\Windows\System\lXLlYhN.exe
  2⤵
  PID:6940
- C:\Windows\System\voKdSom.exe
  C:\Windows\System\voKdSom.exe
  2⤵
  PID:6956
- C:\Windows\System\iKoDnsa.exe
  C:\Windows\System\iKoDnsa.exe
  2⤵
  PID:6972
- C:\Windows\System\SibWZSb.exe
  C:\Windows\System\SibWZSb.exe
  2⤵
  PID:6988
- C:\Windows\System\DnoNrly.exe
  C:\Windows\System\DnoNrly.exe
  2⤵
  PID:7004
- C:\Windows\System\PEEjuZl.exe
  C:\Windows\System\PEEjuZl.exe
  2⤵
  PID:7020
- C:\Windows\System\ZfBrHIW.exe
  C:\Windows\System\ZfBrHIW.exe
  2⤵
  PID:7036
- C:\Windows\System\wqrFaEp.exe
  C:\Windows\System\wqrFaEp.exe
  2⤵
  PID:7052
- C:\Windows\System\KRLewJB.exe
  C:\Windows\System\KRLewJB.exe
  2⤵
  PID:7068
- C:\Windows\System\HUjcxAO.exe
  C:\Windows\System\HUjcxAO.exe
  2⤵
  PID:7084
- C:\Windows\System\Rtnpyvo.exe
  C:\Windows\System\Rtnpyvo.exe
  2⤵
  PID:7104
- C:\Windows\System\gZwdyWF.exe
  C:\Windows\System\gZwdyWF.exe
  2⤵
  PID:7120
- C:\Windows\System\jgwuziy.exe
  C:\Windows\System\jgwuziy.exe
  2⤵
  PID:7136
- C:\Windows\System\ZUreylh.exe
  C:\Windows\System\ZUreylh.exe
  2⤵
  PID:7152
- C:\Windows\System\tzQctmc.exe
  C:\Windows\System\tzQctmc.exe
  2⤵
  PID:5748
- C:\Windows\System\ctEwGaj.exe
  C:\Windows\System\ctEwGaj.exe
  2⤵
  PID:6020
- C:\Windows\System\VQQKjkw.exe
  C:\Windows\System\VQQKjkw.exe
  2⤵
  PID:6164
- C:\Windows\System\vUgQJWe.exe
  C:\Windows\System\vUgQJWe.exe
  2⤵
  PID:5356
- C:\Windows\System\PFvRHSY.exe
  C:\Windows\System\PFvRHSY.exe
  2⤵
  PID:6148
- C:\Windows\System\fmMMsPe.exe
  C:\Windows\System\fmMMsPe.exe
  2⤵
  PID:5400
- C:\Windows\System\txYmKpG.exe
  C:\Windows\System\txYmKpG.exe
  2⤵
  PID:2552
- C:\Windows\System\AScyiml.exe
  C:\Windows\System\AScyiml.exe
  2⤵
  PID:5760
- C:\Windows\System\ZLLXqqh.exe
  C:\Windows\System\ZLLXqqh.exe
  2⤵
  PID:6200
- C:\Windows\System\oTeMIbx.exe
  C:\Windows\System\oTeMIbx.exe
  2⤵
  PID:6248
- C:\Windows\System\lDAYeOB.exe
  C:\Windows\System\lDAYeOB.exe
  2⤵
  PID:6244
- C:\Windows\System\bXaVEHg.exe
  C:\Windows\System\bXaVEHg.exe
  2⤵
  PID:6264
- C:\Windows\System\hoAbgdm.exe
  C:\Windows\System\hoAbgdm.exe
  2⤵
  PID:6328
- C:\Windows\System\XxApfCJ.exe
  C:\Windows\System\XxApfCJ.exe
  2⤵
  PID:6388
- C:\Windows\System\Ixdgoec.exe
  C:\Windows\System\Ixdgoec.exe
  2⤵
  PID:6344
- C:\Windows\System\rLelTtc.exe
  C:\Windows\System\rLelTtc.exe
  2⤵
  PID:6452
- C:\Windows\System\rMXwpbh.exe
  C:\Windows\System\rMXwpbh.exe
  2⤵
  PID:6516
- C:\Windows\System\MOqzmOl.exe
  C:\Windows\System\MOqzmOl.exe
  2⤵
  PID:6580
- C:\Windows\System\dGnBjzY.exe
  C:\Windows\System\dGnBjzY.exe
  2⤵
  PID:6408
- C:\Windows\System\pBTsMVo.exe
  C:\Windows\System\pBTsMVo.exe
  2⤵
  PID:6564
- C:\Windows\System\rIWxutq.exe
  C:\Windows\System\rIWxutq.exe
  2⤵
  PID:6596
- C:\Windows\System\ijKbBzr.exe
  C:\Windows\System\ijKbBzr.exe
  2⤵
  PID:6468
- C:\Windows\System\LZafpdi.exe
  C:\Windows\System\LZafpdi.exe
  2⤵
  PID:6628
- C:\Windows\System\xgkaMUK.exe
  C:\Windows\System\xgkaMUK.exe
  2⤵
  PID:6664
- C:\Windows\System\TZMpkcG.exe
  C:\Windows\System\TZMpkcG.exe
  2⤵
  PID:6660
- C:\Windows\System\ODzMWDM.exe
  C:\Windows\System\ODzMWDM.exe
  2⤵
  PID:6740
- C:\Windows\System\DTNokFS.exe
  C:\Windows\System\DTNokFS.exe
  2⤵
  PID:6776
- C:\Windows\System\WLSNVgk.exe
  C:\Windows\System\WLSNVgk.exe
  2⤵
  PID:6724
- C:\Windows\System\gOeNAZO.exe
  C:\Windows\System\gOeNAZO.exe
  2⤵
  PID:6904
- C:\Windows\System\XPkQQat.exe
  C:\Windows\System\XPkQQat.exe
  2⤵
  PID:6996
- C:\Windows\System\EzfsbEN.exe
  C:\Windows\System\EzfsbEN.exe
  2⤵
  PID:7060
- C:\Windows\System\RlAMJBz.exe
  C:\Windows\System\RlAMJBz.exe
  2⤵
  PID:7100
- C:\Windows\System\kDkPteO.exe
  C:\Windows\System\kDkPteO.exe
  2⤵
  PID:6296
- C:\Windows\System\TlsIcos.exe
  C:\Windows\System\TlsIcos.exe
  2⤵
  PID:6260
- C:\Windows\System\jsNnycU.exe
  C:\Windows\System\jsNnycU.exe
  2⤵
  PID:6324
- C:\Windows\System\KXaLaTN.exe
  C:\Windows\System\KXaLaTN.exe
  2⤵
  PID:6372
- C:\Windows\System\npZqxdw.exe
  C:\Windows\System\npZqxdw.exe
  2⤵
  PID:6312
- C:\Windows\System\AHvqEqx.exe
  C:\Windows\System\AHvqEqx.exe
  2⤵
  PID:6616
- C:\Windows\System\jlhUMgO.exe
  C:\Windows\System\jlhUMgO.exe
  2⤵
  PID:6680
- C:\Windows\System\NXcyFAL.exe
  C:\Windows\System\NXcyFAL.exe
  2⤵
  PID:6872
- C:\Windows\System\agbgzXc.exe
  C:\Windows\System\agbgzXc.exe
  2⤵
  PID:6612
- C:\Windows\System\pAJxoTw.exe
  C:\Windows\System\pAJxoTw.exe
  2⤵
  PID:2032
- C:\Windows\System\RxUjfaD.exe
  C:\Windows\System\RxUjfaD.exe
  2⤵
  PID:6836
- C:\Windows\System\PjOIzpA.exe
  C:\Windows\System\PjOIzpA.exe
  2⤵
  PID:7096
- C:\Windows\System\yYSjrnh.exe
  C:\Windows\System\yYSjrnh.exe
  2⤵
  PID:7164
- C:\Windows\System\OgIasSt.exe
  C:\Windows\System\OgIasSt.exe
  2⤵
  PID:5944
- C:\Windows\System\pfJZefs.exe
  C:\Windows\System\pfJZefs.exe
  2⤵
  PID:6280
- C:\Windows\System\DGrVZTb.exe
  C:\Windows\System\DGrVZTb.exe
  2⤵
  PID:2512
- C:\Windows\System\rvKisAy.exe
  C:\Windows\System\rvKisAy.exe
  2⤵
  PID:6984
- C:\Windows\System\OCDUGRX.exe
  C:\Windows\System\OCDUGRX.exe
  2⤵
  PID:6856
- C:\Windows\System\egCkwHa.exe
  C:\Windows\System\egCkwHa.exe
  2⤵
  PID:6948
- C:\Windows\System\BwgohCm.exe
  C:\Windows\System\BwgohCm.exe
  2⤵
  PID:5244
- C:\Windows\System\KLCkhql.exe
  C:\Windows\System\KLCkhql.exe
  2⤵
  PID:6008
- C:\Windows\System\gsYYgOW.exe
  C:\Windows\System\gsYYgOW.exe
  2⤵
  PID:7080
- C:\Windows\System\kUzVNhG.exe
  C:\Windows\System\kUzVNhG.exe
  2⤵
  PID:6212
- C:\Windows\System\usqPFyr.exe
  C:\Windows\System\usqPFyr.exe
  2⤵
  PID:6360
- C:\Windows\System\CgkBVYF.exe
  C:\Windows\System\CgkBVYF.exe
  2⤵
  PID:6488
- C:\Windows\System\ckdruwN.exe
  C:\Windows\System\ckdruwN.exe
  2⤵
  PID:6504
- C:\Windows\System\vafHOXz.exe
  C:\Windows\System\vafHOXz.exe
  2⤵
  PID:6472
- C:\Windows\System\sVhYNgb.exe
  C:\Windows\System\sVhYNgb.exe
  2⤵
  PID:7032
- C:\Windows\System\TladUqw.exe
  C:\Windows\System\TladUqw.exe
  2⤵
  PID:6936
- C:\Windows\System\eDSqKMI.exe
  C:\Windows\System\eDSqKMI.exe
  2⤵
  PID:6676
- C:\Windows\System\PogquGU.exe
  C:\Windows\System\PogquGU.exe
  2⤵
  PID:6196
- C:\Windows\System\PTZTrTr.exe
  C:\Windows\System\PTZTrTr.exe
  2⤵
  PID:6792
- C:\Windows\System\DTcPtOV.exe
  C:\Windows\System\DTcPtOV.exe
  2⤵
  PID:6756
- C:\Windows\System\gLBaNLK.exe
  C:\Windows\System\gLBaNLK.exe
  2⤵
  PID:6884
- C:\Windows\System\JhzKiIF.exe
  C:\Windows\System\JhzKiIF.exe
  2⤵
  PID:7044
- C:\Windows\System\ZaeSoBj.exe
  C:\Windows\System\ZaeSoBj.exe
  2⤵
  PID:6232
- C:\Windows\System\kDUTDDO.exe
  C:\Windows\System\kDUTDDO.exe
  2⤵
  PID:3224
- C:\Windows\System\xJTFkMS.exe
  C:\Windows\System\xJTFkMS.exe
  2⤵
  PID:6968
- C:\Windows\System\UwStiFS.exe
  C:\Windows\System\UwStiFS.exe
  2⤵
  PID:2752
- C:\Windows\System\FNifQhH.exe
  C:\Windows\System\FNifQhH.exe
  2⤵
  PID:6920
- C:\Windows\System\GxHyIaW.exe
  C:\Windows\System\GxHyIaW.exe
  2⤵
  PID:6852
- C:\Windows\System\bHosEre.exe
  C:\Windows\System\bHosEre.exe
  2⤵
  PID:7048
- C:\Windows\System\OhFfIEA.exe
  C:\Windows\System\OhFfIEA.exe
  2⤵
  PID:6436
- C:\Windows\System\wvuBIuT.exe
  C:\Windows\System\wvuBIuT.exe
  2⤵
  PID:7132
- C:\Windows\System\XzkSHpU.exe
  C:\Windows\System\XzkSHpU.exe
  2⤵
  PID:7176
- C:\Windows\System\sEjgMYd.exe
  C:\Windows\System\sEjgMYd.exe
  2⤵
  PID:7192
- C:\Windows\System\DtiGGLa.exe
  C:\Windows\System\DtiGGLa.exe
  2⤵
  PID:7208
- C:\Windows\System\ALNAgGA.exe
  C:\Windows\System\ALNAgGA.exe
  2⤵
  PID:7224
- C:\Windows\System\fdvQESu.exe
  C:\Windows\System\fdvQESu.exe
  2⤵
  PID:7240
- C:\Windows\System\eyeTTPj.exe
  C:\Windows\System\eyeTTPj.exe
  2⤵
  PID:7256
- C:\Windows\System\FpArLEc.exe
  C:\Windows\System\FpArLEc.exe
  2⤵
  PID:7272
- C:\Windows\System\sEbPBzv.exe
  C:\Windows\System\sEbPBzv.exe
  2⤵
  PID:7288
- C:\Windows\System\HcTCebc.exe
  C:\Windows\System\HcTCebc.exe
  2⤵
  PID:7304
- C:\Windows\System\HDagAKQ.exe
  C:\Windows\System\HDagAKQ.exe
  2⤵
  PID:7320
- C:\Windows\System\XTehWDA.exe
  C:\Windows\System\XTehWDA.exe
  2⤵
  PID:7336
- C:\Windows\System\bGstkNT.exe
  C:\Windows\System\bGstkNT.exe
  2⤵
  PID:7352
- C:\Windows\System\puHfwFi.exe
  C:\Windows\System\puHfwFi.exe
  2⤵
  PID:7368
- C:\Windows\System\SoIGvab.exe
  C:\Windows\System\SoIGvab.exe
  2⤵
  PID:7384
- C:\Windows\System\xkILIJp.exe
  C:\Windows\System\xkILIJp.exe
  2⤵
  PID:7400
- C:\Windows\System\FZZroGr.exe
  C:\Windows\System\FZZroGr.exe
  2⤵
  PID:7416
- C:\Windows\System\bbZOtdg.exe
  C:\Windows\System\bbZOtdg.exe
  2⤵
  PID:7436
- C:\Windows\System\yCVXWGt.exe
  C:\Windows\System\yCVXWGt.exe
  2⤵
  PID:7452
- C:\Windows\System\QfmjfUj.exe
  C:\Windows\System\QfmjfUj.exe
  2⤵
  PID:7468
- C:\Windows\System\MkFKsXe.exe
  C:\Windows\System\MkFKsXe.exe
  2⤵
  PID:7488
- C:\Windows\System\dBGBluZ.exe
  C:\Windows\System\dBGBluZ.exe
  2⤵
  PID:7560
- C:\Windows\System\AspUNYs.exe
  C:\Windows\System\AspUNYs.exe
  2⤵
  PID:7648
- C:\Windows\System\aklxhfs.exe
  C:\Windows\System\aklxhfs.exe
  2⤵
  PID:7672
- C:\Windows\System\sJDpCeu.exe
  C:\Windows\System\sJDpCeu.exe
  2⤵
  PID:7688
- C:\Windows\System\RFkcKTq.exe
  C:\Windows\System\RFkcKTq.exe
  2⤵
  PID:7704
- C:\Windows\System\WUNBYVd.exe
  C:\Windows\System\WUNBYVd.exe
  2⤵
  PID:7720
- C:\Windows\System\pJkUYio.exe
  C:\Windows\System\pJkUYio.exe
  2⤵
  PID:7736
- C:\Windows\System\RVsOEzY.exe
  C:\Windows\System\RVsOEzY.exe
  2⤵
  PID:7752
- C:\Windows\System\wCfbDvl.exe
  C:\Windows\System\wCfbDvl.exe
  2⤵
  PID:7768
- C:\Windows\System\PDKpNjE.exe
  C:\Windows\System\PDKpNjE.exe
  2⤵
  PID:7784
- C:\Windows\System\UnMiDqw.exe
  C:\Windows\System\UnMiDqw.exe
  2⤵
  PID:7812
- C:\Windows\System\mAvWbBB.exe
  C:\Windows\System\mAvWbBB.exe
  2⤵
  PID:7860
- C:\Windows\System\uFbVZdI.exe
  C:\Windows\System\uFbVZdI.exe
  2⤵
  PID:7876
- C:\Windows\System\tUOeXpS.exe
  C:\Windows\System\tUOeXpS.exe
  2⤵
  PID:7892
- C:\Windows\System\RCgPiFb.exe
  C:\Windows\System\RCgPiFb.exe
  2⤵
  PID:7912
- C:\Windows\System\GZWxANj.exe
  C:\Windows\System\GZWxANj.exe
  2⤵
  PID:7928
- C:\Windows\System\WOYVvaZ.exe
  C:\Windows\System\WOYVvaZ.exe
  2⤵
  PID:7944
- C:\Windows\System\qCDiGEH.exe
  C:\Windows\System\qCDiGEH.exe
  2⤵
  PID:7972
- C:\Windows\System\yBdBIjx.exe
  C:\Windows\System\yBdBIjx.exe
  2⤵
  PID:7992
- C:\Windows\System\QifbjQN.exe
  C:\Windows\System\QifbjQN.exe
  2⤵
  PID:8040
- C:\Windows\System\CXeFtBE.exe
  C:\Windows\System\CXeFtBE.exe
  2⤵
  PID:8056
- C:\Windows\System\sNKbLgu.exe
  C:\Windows\System\sNKbLgu.exe
  2⤵
  PID:8072
- C:\Windows\System\yfDFBgd.exe
  C:\Windows\System\yfDFBgd.exe
  2⤵
  PID:8088
- C:\Windows\System\rkMVhhu.exe
  C:\Windows\System\rkMVhhu.exe
  2⤵
  PID:8108
- C:\Windows\System\WpUQHeC.exe
  C:\Windows\System\WpUQHeC.exe
  2⤵
  PID:8124
- C:\Windows\System\wHAwNzk.exe
  C:\Windows\System\wHAwNzk.exe
  2⤵
  PID:8148
- C:\Windows\System\XfWSJUv.exe
  C:\Windows\System\XfWSJUv.exe
  2⤵
  PID:8164
- C:\Windows\System\BgBUzVD.exe
  C:\Windows\System\BgBUzVD.exe
  2⤵
  PID:8180
- C:\Windows\System\dLnEgET.exe
  C:\Windows\System\dLnEgET.exe
  2⤵
  PID:6548
- C:\Windows\System\OuLdTQx.exe
  C:\Windows\System\OuLdTQx.exe
  2⤵
  PID:7200
- C:\Windows\System\sHGRrbq.exe
  C:\Windows\System\sHGRrbq.exe
  2⤵
  PID:7232
- C:\Windows\System\LRKOkGO.exe
  C:\Windows\System\LRKOkGO.exe
  2⤵
  PID:7296
- C:\Windows\System\GwooSpv.exe
  C:\Windows\System\GwooSpv.exe
  2⤵
  PID:6696
- C:\Windows\System\wrnUZBU.exe
  C:\Windows\System\wrnUZBU.exe
  2⤵
  PID:7280
- C:\Windows\System\DjFPJmR.exe
  C:\Windows\System\DjFPJmR.exe
  2⤵
  PID:7444
- C:\Windows\System\jbJMmAD.exe
  C:\Windows\System\jbJMmAD.exe
  2⤵
  PID:7484
- C:\Windows\System\lfmEhlL.exe
  C:\Windows\System\lfmEhlL.exe
  2⤵
  PID:7396
- C:\Windows\System\XUvmkGt.exe
  C:\Windows\System\XUvmkGt.exe
  2⤵
  PID:7464
- C:\Windows\System\wlGSJEO.exe
  C:\Windows\System\wlGSJEO.exe
  2⤵
  PID:7504
- C:\Windows\System\hFIacHf.exe
  C:\Windows\System\hFIacHf.exe
  2⤵
  PID:7520
- C:\Windows\System\VnTeijd.exe
  C:\Windows\System\VnTeijd.exe
  2⤵
  PID:7536
- C:\Windows\System\ShoUiDm.exe
  C:\Windows\System\ShoUiDm.exe
  2⤵
  PID:7572
- C:\Windows\System\ufFzHcR.exe
  C:\Windows\System\ufFzHcR.exe
  2⤵
  PID:7576
- C:\Windows\System\NyXUrAF.exe
  C:\Windows\System\NyXUrAF.exe
  2⤵
  PID:7592
- C:\Windows\System\VdKmoOt.exe
  C:\Windows\System\VdKmoOt.exe
  2⤵
  PID:7612
- C:\Windows\System\wQuMhsj.exe
  C:\Windows\System\wQuMhsj.exe
  2⤵
  PID:7624
- C:\Windows\System\SGwAzIx.exe
  C:\Windows\System\SGwAzIx.exe
  2⤵
  PID:7016
- C:\Windows\System\gWgEtBE.exe
  C:\Windows\System\gWgEtBE.exe
  2⤵
  PID:7660
- C:\Windows\System\eGHlsEU.exe
  C:\Windows\System\eGHlsEU.exe
  2⤵
  PID:7728
- C:\Windows\System\szTGDYN.exe
  C:\Windows\System\szTGDYN.exe
  2⤵
  PID:7716
- C:\Windows\System\kJZGbzW.exe
  C:\Windows\System\kJZGbzW.exe
  2⤵
  PID:7760
- C:\Windows\System\XhtZwxC.exe
  C:\Windows\System\XhtZwxC.exe
  2⤵
  PID:7792
- C:\Windows\System\MHJGzCH.exe
  C:\Windows\System\MHJGzCH.exe
  2⤵
  PID:7808
- C:\Windows\System\vSVqUHb.exe
  C:\Windows\System\vSVqUHb.exe
  2⤵
  PID:7836
- C:\Windows\System\rgPtSlq.exe
  C:\Windows\System\rgPtSlq.exe
  2⤵
  PID:7856
- C:\Windows\System\kYYponl.exe
  C:\Windows\System\kYYponl.exe
  2⤵
  PID:7872
- C:\Windows\System\DHCDAME.exe
  C:\Windows\System\DHCDAME.exe
  2⤵
  PID:7904
- C:\Windows\System\euSKzqD.exe
  C:\Windows\System\euSKzqD.exe
  2⤵
  PID:7936
- C:\Windows\System\bNsyNeO.exe
  C:\Windows\System\bNsyNeO.exe
  2⤵
  PID:7960
- C:\Windows\System\FSesmkZ.exe
  C:\Windows\System\FSesmkZ.exe
  2⤵
  PID:7984
- C:\Windows\System\IyGrpOx.exe
  C:\Windows\System\IyGrpOx.exe
  2⤵
  PID:8012
- C:\Windows\System\zUHuaLO.exe
  C:\Windows\System\zUHuaLO.exe
  2⤵
  PID:8028
- C:\Windows\System\xNqWOpE.exe
  C:\Windows\System\xNqWOpE.exe
  2⤵
  PID:8048
- C:\Windows\System\xXryLAC.exe
  C:\Windows\System\xXryLAC.exe
  2⤵
  PID:8084
- C:\Windows\System\wMLQuAO.exe
  C:\Windows\System\wMLQuAO.exe
  2⤵
  PID:8156
- C:\Windows\System\WkIjJTs.exe
  C:\Windows\System\WkIjJTs.exe
  2⤵
  PID:6180
- C:\Windows\System\wPeNhVC.exe
  C:\Windows\System\wPeNhVC.exe
  2⤵
  PID:8132
- C:\Windows\System\mtxuRlW.exe
  C:\Windows\System\mtxuRlW.exe
  2⤵
  PID:8172
- C:\Windows\System\mtuJJFf.exe
  C:\Windows\System\mtuJJFf.exe
  2⤵
  PID:7480
- C:\Windows\System\zKqlIOe.exe
  C:\Windows\System\zKqlIOe.exe
  2⤵
  PID:7312
- C:\Windows\System\LXkqGgF.exe
  C:\Windows\System\LXkqGgF.exe
  2⤵
  PID:7380
- C:\Windows\System\czcLzgH.exe
  C:\Windows\System\czcLzgH.exe
  2⤵
  PID:7460
- C:\Windows\System\dYPMsmE.exe
  C:\Windows\System\dYPMsmE.exe
  2⤵
  PID:7392
- C:\Windows\System\zQNhdcg.exe
  C:\Windows\System\zQNhdcg.exe
  2⤵
  PID:7548
- C:\Windows\System\opULQvG.exe
  C:\Windows\System\opULQvG.exe
  2⤵
  PID:7216
- C:\Windows\System\akxfhaN.exe
  C:\Windows\System\akxfhaN.exe
  2⤵
  PID:7500
- C:\Windows\System\HbaJmkX.exe
  C:\Windows\System\HbaJmkX.exe
  2⤵
  PID:7604
- C:\Windows\System\mwxjKZF.exe
  C:\Windows\System\mwxjKZF.exe
  2⤵
  PID:7700
- C:\Windows\System\RKdpNyZ.exe
  C:\Windows\System\RKdpNyZ.exe
  2⤵
  PID:7640
- C:\Windows\System\ndohYZU.exe
  C:\Windows\System\ndohYZU.exe
  2⤵
  PID:7780
- C:\Windows\System\MxZEHnO.exe
  C:\Windows\System\MxZEHnO.exe
  2⤵
  PID:7680
- C:\Windows\System\jIFDxTz.exe
  C:\Windows\System\jIFDxTz.exe
  2⤵
  PID:7848
- C:\Windows\System\QrPvNla.exe
  C:\Windows\System\QrPvNla.exe
  2⤵
  PID:7956
- C:\Windows\System\YurwcqA.exe
  C:\Windows\System\YurwcqA.exe
  2⤵
  PID:8036
- C:\Windows\System\vMMlAQq.exe
  C:\Windows\System\vMMlAQq.exe
  2⤵
  PID:7832
- C:\Windows\System\MarIbgo.exe
  C:\Windows\System\MarIbgo.exe
  2⤵
  PID:7172
- C:\Windows\System\BptrgMB.exe
  C:\Windows\System\BptrgMB.exe
  2⤵
  PID:7516
- C:\Windows\System\HIyEefr.exe
  C:\Windows\System\HIyEefr.exe
  2⤵
  PID:7556
- C:\Windows\System\EjTEWWZ.exe
  C:\Windows\System\EjTEWWZ.exe
  2⤵
  PID:7616
- C:\Windows\System\cINkaaX.exe
  C:\Windows\System\cINkaaX.exe
  2⤵
  PID:7952
- C:\Windows\System\NsRaMjY.exe
  C:\Windows\System\NsRaMjY.exe
  2⤵
  PID:8024
- C:\Windows\System\fCPbMxI.exe
  C:\Windows\System\fCPbMxI.exe
  2⤵
  PID:6824
- C:\Windows\System\gTVHIDS.exe
  C:\Windows\System\gTVHIDS.exe
  2⤵
  PID:7284
- C:\Windows\System\FNklJDX.exe
  C:\Windows\System\FNklJDX.exe
  2⤵
  PID:7328
- C:\Windows\System\JgOQDDX.exe
  C:\Windows\System\JgOQDDX.exe
  2⤵
  PID:7588
- C:\Windows\System\uInSuYH.exe
  C:\Windows\System\uInSuYH.exe
  2⤵
  PID:8120
- C:\Windows\System\RtUibCG.exe
  C:\Windows\System\RtUibCG.exe
  2⤵
  PID:8116
- C:\Windows\System\cBmlVqh.exe
  C:\Windows\System\cBmlVqh.exe
  2⤵
  PID:7584
- C:\Windows\System\YALZxTu.exe
  C:\Windows\System\YALZxTu.exe
  2⤵
  PID:7744
- C:\Windows\System\meKcKAT.exe
  C:\Windows\System\meKcKAT.exe
  2⤵
  PID:7844
- C:\Windows\System\kNytWzE.exe
  C:\Windows\System\kNytWzE.exe
  2⤵
  PID:7884
- C:\Windows\System\jUeVhOF.exe
  C:\Windows\System\jUeVhOF.exe
  2⤵
  PID:7220
- C:\Windows\System\dMHGTMp.exe
  C:\Windows\System\dMHGTMp.exe
  2⤵
  PID:7532
- C:\Windows\System\XhBVnfM.exe
  C:\Windows\System\XhBVnfM.exe
  2⤵
  PID:7804
- C:\Windows\System\HFTDxTh.exe
  C:\Windows\System\HFTDxTh.exe
  2⤵
  PID:7696
- C:\Windows\System\uJWvTEK.exe
  C:\Windows\System\uJWvTEK.exe
  2⤵
  PID:7344
- C:\Windows\System\IKdoyLY.exe
  C:\Windows\System\IKdoyLY.exe
  2⤵
  PID:7988
- C:\Windows\System\oviDdqz.exe
  C:\Windows\System\oviDdqz.exe
  2⤵
  PID:8204
- C:\Windows\System\UwdIcaa.exe
  C:\Windows\System\UwdIcaa.exe
  2⤵
  PID:8220
- C:\Windows\System\qogNTGO.exe
  C:\Windows\System\qogNTGO.exe
  2⤵
  PID:8236
- C:\Windows\System\TOQJfmr.exe
  C:\Windows\System\TOQJfmr.exe
  2⤵
  PID:8252
- C:\Windows\System\fqORPab.exe
  C:\Windows\System\fqORPab.exe
  2⤵
  PID:8268
- C:\Windows\System\zTuTMLQ.exe
  C:\Windows\System\zTuTMLQ.exe
  2⤵
  PID:8284
- C:\Windows\System\KKChFpv.exe
  C:\Windows\System\KKChFpv.exe
  2⤵
  PID:8300
- C:\Windows\System\CARXAkd.exe
  C:\Windows\System\CARXAkd.exe
  2⤵
  PID:8316
- C:\Windows\System\PZZWinh.exe
  C:\Windows\System\PZZWinh.exe
  2⤵
  PID:8332
- C:\Windows\System\RXGRwJx.exe
  C:\Windows\System\RXGRwJx.exe
  2⤵
  PID:8348
- C:\Windows\System\aqsxUWc.exe
  C:\Windows\System\aqsxUWc.exe
  2⤵
  PID:8364
- C:\Windows\System\HOGCMij.exe
  C:\Windows\System\HOGCMij.exe
  2⤵
  PID:8380
- C:\Windows\System\DqzbpsN.exe
  C:\Windows\System\DqzbpsN.exe
  2⤵
  PID:8396
- C:\Windows\System\iQBHhZg.exe
  C:\Windows\System\iQBHhZg.exe
  2⤵
  PID:8412
- C:\Windows\System\jmueaJx.exe
  C:\Windows\System\jmueaJx.exe
  2⤵
  PID:8428
- C:\Windows\System\ubemizU.exe
  C:\Windows\System\ubemizU.exe
  2⤵
  PID:8444
- C:\Windows\System\VcUsSbz.exe
  C:\Windows\System\VcUsSbz.exe
  2⤵
  PID:8460
- C:\Windows\System\NQJrUCu.exe
  C:\Windows\System\NQJrUCu.exe
  2⤵
  PID:8476
- C:\Windows\System\EfIDObl.exe
  C:\Windows\System\EfIDObl.exe
  2⤵
  PID:8492
- C:\Windows\System\bRobjpR.exe
  C:\Windows\System\bRobjpR.exe
  2⤵
  PID:8508
- C:\Windows\System\auQqEms.exe
  C:\Windows\System\auQqEms.exe
  2⤵
  PID:8524
- C:\Windows\System\ajVBscg.exe
  C:\Windows\System\ajVBscg.exe
  2⤵
  PID:8540
- C:\Windows\System\RvtdMaQ.exe
  C:\Windows\System\RvtdMaQ.exe
  2⤵
  PID:8556
- C:\Windows\System\kDGixpG.exe
  C:\Windows\System\kDGixpG.exe
  2⤵
  PID:8572
- C:\Windows\System\yrZGzYy.exe
  C:\Windows\System\yrZGzYy.exe
  2⤵
  PID:8588
- C:\Windows\System\tCsFMjk.exe
  C:\Windows\System\tCsFMjk.exe
  2⤵
  PID:8604
- C:\Windows\System\afyrGOl.exe
  C:\Windows\System\afyrGOl.exe
  2⤵
  PID:8620
- C:\Windows\System\qzaIjdO.exe
  C:\Windows\System\qzaIjdO.exe
  2⤵
  PID:8636
- C:\Windows\System\SdHccPz.exe
  C:\Windows\System\SdHccPz.exe
  2⤵
  PID:8652
- C:\Windows\System\cuHulKN.exe
  C:\Windows\System\cuHulKN.exe
  2⤵
  PID:8668
- C:\Windows\System\jHmjDQY.exe
  C:\Windows\System\jHmjDQY.exe
  2⤵
  PID:8684
- C:\Windows\System\gsUcSHl.exe
  C:\Windows\System\gsUcSHl.exe
  2⤵
  PID:8700
- C:\Windows\System\uGlzOiV.exe
  C:\Windows\System\uGlzOiV.exe
  2⤵
  PID:8716
- C:\Windows\System\gQaBlWK.exe
  C:\Windows\System\gQaBlWK.exe
  2⤵
  PID:8732
- C:\Windows\System\CwrQLBh.exe
  C:\Windows\System\CwrQLBh.exe
  2⤵
  PID:8748
- C:\Windows\System\ptQRaML.exe
  C:\Windows\System\ptQRaML.exe
  2⤵
  PID:8784
- C:\Windows\System\HxuzYLL.exe
  C:\Windows\System\HxuzYLL.exe
  2⤵
  PID:8800
- C:\Windows\System\wsLNEpF.exe
  C:\Windows\System\wsLNEpF.exe
  2⤵
  PID:8816
- C:\Windows\System\gdZbOGa.exe
  C:\Windows\System\gdZbOGa.exe
  2⤵
  PID:8832
- C:\Windows\System\tMtKmZY.exe
  C:\Windows\System\tMtKmZY.exe
  2⤵
  PID:8848
- C:\Windows\System\IdxBrcX.exe
  C:\Windows\System\IdxBrcX.exe
  2⤵
  PID:8868
- C:\Windows\System\BAvDOaw.exe
  C:\Windows\System\BAvDOaw.exe
  2⤵
  PID:8884
- C:\Windows\System\qQnuXeH.exe
  C:\Windows\System\qQnuXeH.exe
  2⤵
  PID:8904
- C:\Windows\System\TIBddcg.exe
  C:\Windows\System\TIBddcg.exe
  2⤵
  PID:8920
- C:\Windows\System\loHAfye.exe
  C:\Windows\System\loHAfye.exe
  2⤵
  PID:8936
- C:\Windows\System\FUFVGIp.exe
  C:\Windows\System\FUFVGIp.exe
  2⤵
  PID:8952
- C:\Windows\System\qAsLqmy.exe
  C:\Windows\System\qAsLqmy.exe
  2⤵
  PID:8968
- C:\Windows\System\qNHvMcg.exe
  C:\Windows\System\qNHvMcg.exe
  2⤵
  PID:8996
- C:\Windows\System\GpSBEeP.exe
  C:\Windows\System\GpSBEeP.exe
  2⤵
  PID:9012
- C:\Windows\System\TxoMeZs.exe
  C:\Windows\System\TxoMeZs.exe
  2⤵
  PID:9036
- C:\Windows\System\DohmXve.exe
  C:\Windows\System\DohmXve.exe
  2⤵
  PID:9056
- C:\Windows\System\bTTpiYQ.exe
  C:\Windows\System\bTTpiYQ.exe
  2⤵
  PID:9076
- C:\Windows\System\QvEHxLC.exe
  C:\Windows\System\QvEHxLC.exe
  2⤵
  PID:8244
- C:\Windows\System\OWnxNJP.exe
  C:\Windows\System\OWnxNJP.exe
  2⤵
  PID:8264
- C:\Windows\System\NFDULbj.exe
  C:\Windows\System\NFDULbj.exe
  2⤵
  PID:8260
- C:\Windows\System\capwFOQ.exe
  C:\Windows\System\capwFOQ.exe
  2⤵
  PID:8404
- C:\Windows\System\lfpQcvq.exe
  C:\Windows\System\lfpQcvq.exe
  2⤵
  PID:8328
- C:\Windows\System\OiQpiAV.exe
  C:\Windows\System\OiQpiAV.exe
  2⤵
  PID:8500
- C:\Windows\System\lcsJHNf.exe
  C:\Windows\System\lcsJHNf.exe
  2⤵
  PID:2288
- C:\Windows\System\mxWRLAA.exe
  C:\Windows\System\mxWRLAA.exe
  2⤵
  PID:2436
- C:\Windows\System\JlqFwhD.exe
  C:\Windows\System\JlqFwhD.exe
  2⤵
  PID:8424
- C:\Windows\System\krHNlgW.exe
  C:\Windows\System\krHNlgW.exe
  2⤵
  PID:8488
- C:\Windows\System\ybpVbMC.exe
  C:\Windows\System\ybpVbMC.exe
  2⤵
  PID:8520
- C:\Windows\System\YkAOCsF.exe
  C:\Windows\System\YkAOCsF.exe
  2⤵
  PID:8632
- C:\Windows\System\iuGVxRF.exe
  C:\Windows\System\iuGVxRF.exe
  2⤵
  PID:8612
- C:\Windows\System\MubFXzi.exe
  C:\Windows\System\MubFXzi.exe
  2⤵
  PID:8680
- C:\Windows\System\scxgVOU.exe
  C:\Windows\System\scxgVOU.exe
  2⤵
  PID:8728
- C:\Windows\System\QjhRtYh.exe
  C:\Windows\System\QjhRtYh.exe
  2⤵
  PID:8696
- C:\Windows\System\gaIPGZH.exe
  C:\Windows\System\gaIPGZH.exe
  2⤵
  PID:8756
- C:\Windows\System\rAOqJVi.exe
  C:\Windows\System\rAOqJVi.exe
  2⤵
  PID:8840
- C:\Windows\System\CYTClHc.exe
  C:\Windows\System\CYTClHc.exe
  2⤵
  PID:8916
- C:\Windows\System\WsEIarq.exe
  C:\Windows\System\WsEIarq.exe
  2⤵
  PID:8892
- C:\Windows\System\EGaiuho.exe
  C:\Windows\System\EGaiuho.exe
  2⤵
  PID:8824
- C:\Windows\System\HaggLQO.exe
  C:\Windows\System\HaggLQO.exe
  2⤵
  PID:8808
- C:\Windows\System\LNqVVDW.exe
  C:\Windows\System\LNqVVDW.exe
  2⤵
  PID:9004
- C:\Windows\System\tniNhcI.exe
  C:\Windows\System\tniNhcI.exe
  2⤵
  PID:9116
- C:\Windows\System\BgWdzKr.exe
  C:\Windows\System\BgWdzKr.exe
  2⤵
  PID:9144
- C:\Windows\System\NefZHwh.exe
  C:\Windows\System\NefZHwh.exe
  2⤵
  PID:9164
- C:\Windows\System\BxchTlQ.exe
  C:\Windows\System\BxchTlQ.exe
  2⤵
  PID:9184
- C:\Windows\System\JAxgclU.exe
  C:\Windows\System\JAxgclU.exe
  2⤵
  PID:9204
- C:\Windows\System\apgwdhl.exe
  C:\Windows\System\apgwdhl.exe
  2⤵
  PID:7664
- C:\Windows\System\nDGCFbq.exe
  C:\Windows\System\nDGCFbq.exe
  2⤵
  PID:8248
- C:\Windows\System\CykwqoK.exe
  C:\Windows\System\CykwqoK.exe
  2⤵
  PID:8568
- C:\Windows\System\pTYkLiG.exe
  C:\Windows\System\pTYkLiG.exe
  2⤵
  PID:8708
- C:\Windows\System\EEFkNXz.exe
  C:\Windows\System\EEFkNXz.exe
  2⤵
  PID:8880
- C:\Windows\System\SuCGqik.exe
  C:\Windows\System\SuCGqik.exe
  2⤵
  PID:9024
- C:\Windows\System\FpzKhef.exe
  C:\Windows\System\FpzKhef.exe
  2⤵
  PID:8188
- C:\Windows\System\DOdIuyz.exe
  C:\Windows\System\DOdIuyz.exe
  2⤵
  PID:9100
- C:\Windows\System\lHCJvAJ.exe
  C:\Windows\System\lHCJvAJ.exe
  2⤵
  PID:9148
- C:\Windows\System\cFpogYw.exe
  C:\Windows\System\cFpogYw.exe
  2⤵
  PID:9168
- C:\Windows\System\IBzdMgK.exe
  C:\Windows\System\IBzdMgK.exe
  2⤵
  PID:9192
- C:\Windows\System\ptONbnn.exe
  C:\Windows\System\ptONbnn.exe
  2⤵
  PID:8216
- C:\Windows\System\bDiTIIN.exe
  C:\Windows\System\bDiTIIN.exe
  2⤵
  PID:8280
- C:\Windows\System\KJCFrRA.exe
  C:\Windows\System\KJCFrRA.exe
  2⤵
  PID:8596
- C:\Windows\System\EEYUcdz.exe
  C:\Windows\System\EEYUcdz.exe
  2⤵
  PID:8580
- C:\Windows\System\GeHDYdT.exe
  C:\Windows\System\GeHDYdT.exe
  2⤵
  PID:8644
- C:\Windows\System\wimfuzg.exe
  C:\Windows\System\wimfuzg.exe
  2⤵
  PID:8388
- C:\Windows\System\yXsYHFA.exe
  C:\Windows\System\yXsYHFA.exe
  2⤵
  PID:8456
- C:\Windows\System\EkcLLqn.exe
  C:\Windows\System\EkcLLqn.exe
  2⤵
  PID:8960
- C:\Windows\System\qRQFhlA.exe
  C:\Windows\System\qRQFhlA.exe
  2⤵
  PID:9044
- C:\Windows\System\qxHmlrQ.exe
  C:\Windows\System\qxHmlrQ.exe
  2⤵
  PID:9088
- C:\Windows\System\rfLnZqK.exe
  C:\Windows\System\rfLnZqK.exe
  2⤵
  PID:9140
- C:\Windows\System\pwzeKil.exe
  C:\Windows\System\pwzeKil.exe
  2⤵
  PID:8548
- C:\Windows\System\BGmGoHD.exe
  C:\Windows\System\BGmGoHD.exe
  2⤵
  PID:8856
- C:\Windows\System\FJplIiN.exe
  C:\Windows\System\FJplIiN.exe
  2⤵
  PID:9052
- C:\Windows\System\nCIpvOR.exe
  C:\Windows\System\nCIpvOR.exe
  2⤵
  PID:8228
- C:\Windows\System\qqwUkmQ.exe
  C:\Windows\System\qqwUkmQ.exe
  2⤵
  PID:7432
- C:\Windows\System\PqOGiwj.exe
  C:\Windows\System\PqOGiwj.exe
  2⤵
  PID:8664
- C:\Windows\System\OIgepgK.exe
  C:\Windows\System\OIgepgK.exe
  2⤵
  PID:8144
- C:\Windows\System\RVXHOYD.exe
  C:\Windows\System\RVXHOYD.exe
  2⤵
  PID:8468
- C:\Windows\System\YuwqteY.exe
  C:\Windows\System\YuwqteY.exe
  2⤵
  PID:1172
- C:\Windows\System\KnGtsAo.exe
  C:\Windows\System\KnGtsAo.exe
  2⤵
  PID:9092
- C:\Windows\System\ZjjmeqP.exe
  C:\Windows\System\ZjjmeqP.exe
  2⤵
  PID:9124
- C:\Windows\System\TtapKIi.exe
  C:\Windows\System\TtapKIi.exe
  2⤵
  PID:9224
- C:\Windows\System\HzWcaqI.exe
  C:\Windows\System\HzWcaqI.exe
  2⤵
  PID:9248
- C:\Windows\System\JJJxfwU.exe
  C:\Windows\System\JJJxfwU.exe
  2⤵
  PID:9264
- C:\Windows\System\ouxZIhq.exe
  C:\Windows\System\ouxZIhq.exe
  2⤵
  PID:9280
- C:\Windows\System\CgOxHCa.exe
  C:\Windows\System\CgOxHCa.exe
  2⤵
  PID:9304
- C:\Windows\System\vTGHLZg.exe
  C:\Windows\System\vTGHLZg.exe
  2⤵
  PID:9320
- C:\Windows\System\uwyJPuU.exe
  C:\Windows\System\uwyJPuU.exe
  2⤵
  PID:9336
- C:\Windows\System\mSlLiqm.exe
  C:\Windows\System\mSlLiqm.exe
  2⤵
  PID:9352
- C:\Windows\System\KUfzUPy.exe
  C:\Windows\System\KUfzUPy.exe
  2⤵
  PID:9372
- C:\Windows\System\rHOqdiO.exe
  C:\Windows\System\rHOqdiO.exe
  2⤵
  PID:9388
- C:\Windows\System\PgXwyMf.exe
  C:\Windows\System\PgXwyMf.exe
  2⤵
  PID:9404
- C:\Windows\System\IKDHJeY.exe
  C:\Windows\System\IKDHJeY.exe
  2⤵
  PID:9420
- C:\Windows\System\vailVoV.exe
  C:\Windows\System\vailVoV.exe
  2⤵
  PID:9436
- C:\Windows\System\rjqahNx.exe
  C:\Windows\System\rjqahNx.exe
  2⤵
  PID:9452
- C:\Windows\System\caDynOX.exe
  C:\Windows\System\caDynOX.exe
  2⤵
  PID:9468
- C:\Windows\System\KjBuYQP.exe
  C:\Windows\System\KjBuYQP.exe
  2⤵
  PID:9484
- C:\Windows\System\YaptAYS.exe
  C:\Windows\System\YaptAYS.exe
  2⤵
  PID:9500
- C:\Windows\System\fYTnMMK.exe
  C:\Windows\System\fYTnMMK.exe
  2⤵
  PID:9516
- C:\Windows\System\VDQEqZG.exe
  C:\Windows\System\VDQEqZG.exe
  2⤵
  PID:9532
- C:\Windows\System\giBzJOg.exe
  C:\Windows\System\giBzJOg.exe
  2⤵
  PID:9548
- C:\Windows\System\BFsKzhd.exe
  C:\Windows\System\BFsKzhd.exe
  2⤵
  PID:9564
- C:\Windows\System\GYVXtsV.exe
  C:\Windows\System\GYVXtsV.exe
  2⤵
  PID:9584
- C:\Windows\System\RjkjsxU.exe
  C:\Windows\System\RjkjsxU.exe
  2⤵
  PID:9600
- C:\Windows\System\JyAqJAG.exe
  C:\Windows\System\JyAqJAG.exe
  2⤵
  PID:9616
- C:\Windows\System\dfolJzk.exe
  C:\Windows\System\dfolJzk.exe
  2⤵
  PID:9632
- C:\Windows\System\DZAvGaS.exe
  C:\Windows\System\DZAvGaS.exe
  2⤵
  PID:9648
- C:\Windows\System\TykXACw.exe
  C:\Windows\System\TykXACw.exe
  2⤵
  PID:9664
- C:\Windows\System\drwxhbO.exe
  C:\Windows\System\drwxhbO.exe
  2⤵
  PID:9680
- C:\Windows\System\KfdzVlD.exe
  C:\Windows\System\KfdzVlD.exe
  2⤵
  PID:9696
- C:\Windows\System\vqTznZC.exe
  C:\Windows\System\vqTznZC.exe
  2⤵
  PID:9712
- C:\Windows\System\OCzybFh.exe
  C:\Windows\System\OCzybFh.exe
  2⤵
  PID:9728
- C:\Windows\System\UnubPYi.exe
  C:\Windows\System\UnubPYi.exe
  2⤵
  PID:9748
- C:\Windows\System\FkQZpEC.exe
  C:\Windows\System\FkQZpEC.exe
  2⤵
  PID:9764
- C:\Windows\System\UVtvrco.exe
  C:\Windows\System\UVtvrco.exe
  2⤵
  PID:9780
- C:\Windows\System\EoeMyfu.exe
  C:\Windows\System\EoeMyfu.exe
  2⤵
  PID:9796
- C:\Windows\System\eElaSGp.exe
  C:\Windows\System\eElaSGp.exe
  2⤵
  PID:9812
- C:\Windows\System\tGKdEWK.exe
  C:\Windows\System\tGKdEWK.exe
  2⤵
  PID:9828
- C:\Windows\System\JQKzNxh.exe
  C:\Windows\System\JQKzNxh.exe
  2⤵
  PID:9844
- C:\Windows\System\tukXMiO.exe
  C:\Windows\System\tukXMiO.exe
  2⤵
  PID:9860
- C:\Windows\System\qBxINfs.exe
  C:\Windows\System\qBxINfs.exe
  2⤵
  PID:9876
- C:\Windows\System\gzLKULV.exe
  C:\Windows\System\gzLKULV.exe
  2⤵
  PID:9892
- C:\Windows\System\NDHluzQ.exe
  C:\Windows\System\NDHluzQ.exe
  2⤵
  PID:9908
- C:\Windows\System\ZGYFdNH.exe
  C:\Windows\System\ZGYFdNH.exe
  2⤵
  PID:9924
- C:\Windows\System\KRRLODM.exe
  C:\Windows\System\KRRLODM.exe
  2⤵
  PID:9940
- C:\Windows\System\jDFFyKw.exe
  C:\Windows\System\jDFFyKw.exe
  2⤵
  PID:9956
- C:\Windows\System\FTnBQyC.exe
  C:\Windows\System\FTnBQyC.exe
  2⤵
  PID:9972
- C:\Windows\System\OZGzXRu.exe
  C:\Windows\System\OZGzXRu.exe
  2⤵
  PID:9988
- C:\Windows\System\tIRZgMg.exe
  C:\Windows\System\tIRZgMg.exe
  2⤵
  PID:10004
- C:\Windows\System\hMfGcoO.exe
  C:\Windows\System\hMfGcoO.exe
  2⤵
  PID:10020
- C:\Windows\System\FYNvFFO.exe
  C:\Windows\System\FYNvFFO.exe
  2⤵
  PID:10036
- C:\Windows\System\AEaIXHF.exe
  C:\Windows\System\AEaIXHF.exe
  2⤵
  PID:10052
- C:\Windows\System\npVGbOn.exe
  C:\Windows\System\npVGbOn.exe
  2⤵
  PID:10068
- C:\Windows\System\huAlfhY.exe
  C:\Windows\System\huAlfhY.exe
  2⤵
  PID:10084
- C:\Windows\System\fhidJdU.exe
  C:\Windows\System\fhidJdU.exe
  2⤵
  PID:10100
- C:\Windows\System\HMYnbgd.exe
  C:\Windows\System\HMYnbgd.exe
  2⤵
  PID:10116
- C:\Windows\System\TgrgBpf.exe
  C:\Windows\System\TgrgBpf.exe
  2⤵
  PID:10132
- C:\Windows\System\SqmbGBW.exe
  C:\Windows\System\SqmbGBW.exe
  2⤵
  PID:10148
- C:\Windows\System\hcYoOEX.exe
  C:\Windows\System\hcYoOEX.exe
  2⤵
  PID:10164
- C:\Windows\System\valpYYN.exe
  C:\Windows\System\valpYYN.exe
  2⤵
  PID:10180
- C:\Windows\System\eIkwTgI.exe
  C:\Windows\System\eIkwTgI.exe
  2⤵
  PID:10196
- C:\Windows\System\rjdWOXK.exe
  C:\Windows\System\rjdWOXK.exe
  2⤵
  PID:10212
- C:\Windows\System\yRqLuGK.exe
  C:\Windows\System\yRqLuGK.exe
  2⤵
  PID:10228
- C:\Windows\System\oArUpZb.exe
  C:\Windows\System\oArUpZb.exe
  2⤵
  PID:9108
- C:\Windows\System\xWBWbni.exe
  C:\Windows\System\xWBWbni.exe
  2⤵
  PID:8760
- C:\Windows\System\QcVVCnY.exe
  C:\Windows\System\QcVVCnY.exe
  2⤵
  PID:8296
- C:\Windows\System\qSKIGnH.exe
  C:\Windows\System\qSKIGnH.exe
  2⤵
  PID:9272
- C:\Windows\System\IQqVndQ.exe
  C:\Windows\System\IQqVndQ.exe
  2⤵
  PID:9288
- C:\Windows\System\jxpsYZo.exe
  C:\Windows\System\jxpsYZo.exe
  2⤵
  PID:9312
- C:\Windows\System\oFkeKmS.exe
  C:\Windows\System\oFkeKmS.exe
  2⤵
  PID:9220
- C:\Windows\System\lrntfOw.exe
  C:\Windows\System\lrntfOw.exe
  2⤵
  PID:9316
- C:\Windows\System\HhPKNZe.exe
  C:\Windows\System\HhPKNZe.exe
  2⤵
  PID:8976
- C:\Windows\System\aTjsumA.exe
  C:\Windows\System\aTjsumA.exe
  2⤵
  PID:9396
- C:\Windows\System\WdgJtdF.exe
  C:\Windows\System\WdgJtdF.exe
  2⤵
  PID:9444
- C:\Windows\System\brMVIUP.exe
  C:\Windows\System\brMVIUP.exe
  2⤵
  PID:9412
- C:\Windows\System\SWxeTEV.exe
  C:\Windows\System\SWxeTEV.exe
  2⤵
  PID:9428
- C:\Windows\System\vaPJHYe.exe
  C:\Windows\System\vaPJHYe.exe
  2⤵
  PID:9524
- C:\Windows\System\RkEleiS.exe
  C:\Windows\System\RkEleiS.exe
  2⤵
  PID:9540
- C:\Windows\System\xFsCaSw.exe
  C:\Windows\System\xFsCaSw.exe
  2⤵
  PID:9580
- C:\Windows\System\KReaorH.exe
  C:\Windows\System\KReaorH.exe
  2⤵
  PID:9596
- C:\Windows\System\GSoSOrY.exe
  C:\Windows\System\GSoSOrY.exe
  2⤵
  PID:9660
- C:\Windows\System\hQqlElS.exe
  C:\Windows\System\hQqlElS.exe
  2⤵
  PID:9644
- C:\Windows\System\SAkAYkb.exe
  C:\Windows\System\SAkAYkb.exe
  2⤵
  PID:9724
- C:\Windows\System\cZhHpDL.exe
  C:\Windows\System\cZhHpDL.exe
  2⤵
  PID:9788
- C:\Windows\System\GSSrWyU.exe
  C:\Windows\System\GSSrWyU.exe
  2⤵
  PID:9804
- C:\Windows\System\eHzkVHe.exe
  C:\Windows\System\eHzkVHe.exe
  2⤵
  PID:9852
- C:\Windows\System\meVrbaK.exe
  C:\Windows\System\meVrbaK.exe
  2⤵
  PID:9776
- C:\Windows\System\bLODrgx.exe
  C:\Windows\System\bLODrgx.exe
  2⤵
  PID:9888
- C:\Windows\System\jHBIDKX.exe
  C:\Windows\System\jHBIDKX.exe
  2⤵
  PID:9948
- C:\Windows\System\tKVixuI.exe
  C:\Windows\System\tKVixuI.exe
  2⤵
  PID:9840
- C:\Windows\System\GRCRsQj.exe
  C:\Windows\System\GRCRsQj.exe
  2⤵
  PID:10032
- C:\Windows\System\lrgpSQs.exe
  C:\Windows\System\lrgpSQs.exe
  2⤵
  PID:9872
- C:\Windows\System\EJLqkeG.exe
  C:\Windows\System\EJLqkeG.exe
  2⤵
  PID:10060
- C:\Windows\System\xZrvwdz.exe
  C:\Windows\System\xZrvwdz.exe
  2⤵
  PID:10044
- C:\Windows\System\aRwIiFA.exe
  C:\Windows\System\aRwIiFA.exe
  2⤵
  PID:10108
- C:\Windows\System\BzkWiUY.exe
  C:\Windows\System\BzkWiUY.exe
  2⤵
  PID:10172
- C:\Windows\System\ugdQXbv.exe
  C:\Windows\System\ugdQXbv.exe
  2⤵
  PID:10092
- C:\Windows\System\gsECEVp.exe
  C:\Windows\System\gsECEVp.exe
  2⤵
  PID:7828
- C:\Windows\System\sphLtOw.exe
  C:\Windows\System\sphLtOw.exe
  2⤵
  PID:10192
- C:\Windows\System\vmNTDsW.exe
  C:\Windows\System\vmNTDsW.exe
  2⤵
  PID:9300
- C:\Windows\System\mTBqEzL.exe
  C:\Windows\System\mTBqEzL.exe
  2⤵
  PID:10188
- C:\Windows\System\rZzEopN.exe
  C:\Windows\System\rZzEopN.exe
  2⤵
  PID:9448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AQLLtXR.exe

Filesize
1.5MB

MD5
557ba395891b0639becce468e407441b

SHA1
3ac0489a9b73915b560f190cd788b467bfd38531

SHA256
d2eb464369afe61ede5ce53020c56361538d48e908de40b4af2341bf21e55e6c

SHA512
8fc746cf36b6a1164203f1eca3597383d8fbcb8b8d28a778f830ddd243a9a67d691689c98b2370b41045e4fdb2865da8dcf5806899a86b144fb2b4f3121781da

Download Submit
C:\Windows\system\BVEuDfb.exe

Filesize
1.5MB

MD5
5cfb5f38d38f9150a310f98db5497d0c

SHA1
529c8ef3a91bb23cd14106c8e45135b9be81aab1

SHA256
693766adb815844af0884a0c8a4898b0da520b82410b0cd2a2b39ab0aa2e8585

SHA512
5e7a044ae2809bff04d88452d4b27f2f24929f83fa48f8443f3b46d3a3b03aeff9aa2e7dac70c85ab39fe65eeb50ed5d79d15c8cb966fee5317264da3e7810ae

Download Submit
C:\Windows\system\BVaQmBX.exe

Filesize
1.5MB

MD5
faaf237c194dc648ffcfe779d798212d

SHA1
19f2d58aac915e2b2434dd2a07d9a438ceb67254

SHA256
db1b5591ada9724e8ae6845232ab7fb6605f1b1b6f70e181add0a4a8d2fb1819

SHA512
089e8dc07f6517d02ec991ba0a979aa89175041986b9b32138e1b8519ecc7e7a968e46db6cb9f92201f9f6062b910a28bd048f9e3cd2a095cd928a3c872599f7

Download Submit
C:\Windows\system\BbXeEZW.exe

Filesize
1.5MB

MD5
36210562bdb98f766374a265e533fed8

SHA1
01d49d1f3342cfa1ba7d96178d9853e132daed36

SHA256
55027202ee64063a60ec015559e5aa77f69b2e46f2265dfc167661700865dd78

SHA512
0d413d8ac3980e1bfc6e13e05ac8480adf330f0f24148a6699de963107b86e115155a5da1ff6851b608d5af667a526bc1f1414e53327b83418b4aa81f0453783

Download Submit
C:\Windows\system\EbvFGZR.exe

Filesize
1.5MB

MD5
5199cc8f3d6ab2c3ea56d9782125c763

SHA1
3a816c51672348a489769a361609dcd66349ef39

SHA256
a60a1c0093c81571dd6673301f3524d5848c98ca11debf69d699c864e8286e2d

SHA512
10dcf88acc9c2f76ef290c187757090b2627ef1b6c514cec235dec4cd0db7d691c1aaf9f10b5d7486bd18c496b68a20b67350de897a5a4fc2cb148abb705d900

Download Submit
C:\Windows\system\FoFsjKj.exe

Filesize
1.5MB

MD5
9b5751e01f6528d4aad393cc3fe5f74f

SHA1
1f778a1d973f2b9bb322bf3e0b360c14be323b9b

SHA256
0d0c83127e8c53166385017aaea11f1b5ab512326ecbeacfcf1cd35f2cf42bd8

SHA512
2e28206e1f732e1e307b6251e53397cad3163bc5275059914ab5bda76d0ce795a15defbd3bfda953e4fd71e63986a37f137d40665d1a5bea90fe5204019c6bdf

Download Submit
C:\Windows\system\GAAkwQq.exe

Filesize
1.5MB

MD5
0154c3ab2d2a29847d4711bef5a0fba3

SHA1
132c6fa3647cc56169d097ec5dc20aac298eceaa

SHA256
34bec0abdee67b47be21329590f5c610839ebb439d949f3ae1e077292beb9b3f

SHA512
f9709da03e392df78e57b3a35eeeb4be8e1620ff2151a23f89c9ee04af96ff7d7a512edd8d14c9d25f294f0c407238c21c26815d9a206129958596fc1ea0197d

Download Submit
C:\Windows\system\IOYzSTP.exe

Filesize
1.5MB

MD5
05bd8b97a9c082c798173db72693efb5

SHA1
e89808a7ec2d81a399d742bf11fdd0de37616445

SHA256
3a88fec322894247eb885f07735fb84773ccfa8e426cf7746bebf02dfd712141

SHA512
c4f9709087cb79841f524d0683c6c04246c325ea1e36346965135ef96575c63c4bc680bb5b28fbd3450e59fa7d3ca2b3d3d53c81bc50debef7a275eb752eb3a6

Download Submit
C:\Windows\system\ISXvhAw.exe

Filesize
1.5MB

MD5
e9c3c566f4dd60cbc6fb1de935bb16cd

SHA1
e96359b9dc53a70c9e8aa5773ec88ef2df7256c7

SHA256
9cd6c96175fde2060de42c151ba1142789edbff5b3bc8ce9aa52e038ed59e8fd

SHA512
2e92c3b9333c4d10960a3c03c1ee72b56b19e6a021f1db6246d89762b645f719f31713f6514d83db03e460ce02ad97974b01aea4be24eae30a3c708cdf6f5517

Download Submit
C:\Windows\system\JYiRtIU.exe

Filesize
1.5MB

MD5
71471750ac46a3fa113bb8641c8854db

SHA1
c9faa7a67afb32729fb8432d3dc50607c2e37603

SHA256
ee4c35e4aaff9011ca0cefc896760223e4c5fe3a9c6e07a548a74db650e2b8cd

SHA512
df864eebe2285f67299523137f48fb9ec270c0ba76be646f59d9bb04a18a0f91356b9c31c5eeab11c98ff956ea379b7a926cf9e9058168598fd02047652c62d9

Download Submit
C:\Windows\system\JepjbDq.exe

Filesize
1.5MB

MD5
87ebe28054a4fd0210647475e9754b61

SHA1
02524514291ad90dafd9f802a66de068fede8356

SHA256
e2f952d793d6ad5f1ab8376f51f426d495755f8fd22f88726e031b5c25627a7f

SHA512
80b4cfdeab8945fac64e9e93f61dfddf3311d8df0e6a1906afa0e757c22144eea55a794db1c08de6042d55b4b331e1c13db39257dd3adf1bea88dd1c02e5efd0

Download Submit
C:\Windows\system\RFPNHiU.exe

Filesize
1.5MB

MD5
67ed435e7ba14d805d8d366aec01346b

SHA1
c9f2960f7269345898c417e6e797bcf29a8d14e0

SHA256
9ce6c7a31bb47f043c8f1ddea66ccde41fe65df29a7352a00d616a64f9c9f316

SHA512
f3e6af105c3296f9af04ae938cb5060d7491ec1b0979137119d5f663247438e5479b5a3767b1c6c3d0e683c9329693d8a71ba3f82176a7d23f137d6151c9618c

Download Submit
C:\Windows\system\RnZdSdG.exe

Filesize
1.5MB

MD5
95b58e5acc948448639e7c8dc11eda1a

SHA1
7ed28c82b3de7e906309e40df7878e06903388a5

SHA256
0ad81d7b9e0ff515dd9ace19749a4aec7891418cf1f5cc4aab99ff29cd74d0b7

SHA512
5b1c5a9b95b21c5a64bd886f2b3c916c600ca54e20d5828c5df7b9f862d06c87f7cd04bdc517738a06851f33566a3fbd1d3a88cd3ec3ce102b54f5a1140192ff

Download Submit
C:\Windows\system\TOkNICU.exe

Filesize
1.5MB

MD5
e185585309cd6589b7d2f28818a958a4

SHA1
b90c40a62386fbf806c0566e0e9a745825fa6db2

SHA256
6693feff5f71e9e623d31e0f812875f803651774bd29a719b904308e930063cb

SHA512
eb820d2d5d5122a20cfa40b35add1aabdadaf6b79aa9301b4e0010a13e7bff7a06350b37c24f46bc0f30d04a4f42c3413fedb7144de9515839f251a8aa8e5b66

Download Submit
C:\Windows\system\UbglBjX.exe

Filesize
1.5MB

MD5
6589889935fe8d743eb1124318e40b8f

SHA1
4d92e82e656f5f8fdec338eb0e4c0d250c108cea

SHA256
c06ea983261b5467c51e212deca6da537b1a3e6f659b32c1431851c93a0f78ae

SHA512
0b0054819c68ab18ef17772408fbe5f69aa8fccb3d32c2cadbe734abb19d70f914d869f1ee7ddf40159590d3f17f77249e2415a7f139b0e4234fd7b1644719db

Download Submit
C:\Windows\system\UgUkYqd.exe

Filesize
1.5MB

MD5
ff631c2c2ade6413aac9c0780846dad5

SHA1
8b4b4f69090cb7762a25fa5fc1a5b8cec78c3bb8

SHA256
188c222ae6a61b8b4f1447f99ab3780a2f08baa0460b2243ae7d8228df79bfbf

SHA512
9d052e8611e1256f5a14faedd6f6a2af6efed36af5f5679ef9f8cd1d648a364a0e8cdf05d56c1766d845030a9f6f61c78ce5511f66f1f964a9b340d33dbac0dd

Download Submit
C:\Windows\system\YPTWwYf.exe

Filesize
1.5MB

MD5
81712e1a4118f14fa0640afd34021ff9

SHA1
3053de2be7a6a2bbae70187987d3945236a3078c

SHA256
636043166f463d5e02e8c894277b5486072f02981aa2afc824d938234f6357b0

SHA512
a5e67225b28e272356c28a8d7ffe9951916ebcc31ced354cd971453350b6e16486675326217dd8fa607eb3f8b8cb68d1e368ad7c286442ecb439f1b05aa1c7d5

Download Submit
C:\Windows\system\ajNHWwb.exe

Filesize
1.5MB

MD5
e3fabeb0e2de00431f25c8dc42d07205

SHA1
b2b69526d7a82e6941fcbce62923b221af6cb24a

SHA256
3a5e2d108aabb312a5ad203fe800be227b1edce9626c3e744734ec68b3fabe99

SHA512
b19dc15a8244f570dc4cefcd7ef90b1a6f1c000f08e4fa9441670a608ac3e32feda695f5b0bcc2f80b5cccea50f21a561fec9b90291c581621b304680ffca8e7

Download Submit
C:\Windows\system\bLkVTAO.exe

Filesize
1.5MB

MD5
3549c6f604fb27b7839237f6f01a8d8d

SHA1
34e84a65496bf94615ea8752a4e23ad20dd9d0f8

SHA256
f4309c60e83f66000d22b101cb449f2eda0e50d2a4c45c85796cd5553da14565

SHA512
4da142f8818d8177b68a7c6f834bec385a77fc313560a59b9adec156877ec3c3e3395969657a85cdb5342decf660f68bfabce9599375456c608bd1cfbe78e0a2

Download Submit
C:\Windows\system\lOTTRNB.exe

Filesize
1.5MB

MD5
431727a240fc7c2be81c3a22fbf7eb80

SHA1
a2c07d06228259c7b9c99e733b2294bdcddc5859

SHA256
5ee9b3aed4211b35658f4473392ffdbc0d075664b1769893298660a5ef7cce09

SHA512
a5b65f9fd2cc0719a00c42f6d0c467dc9d30ce0d1cd3453594a3592b3b9ea573b9e938479966ebd3f53560cf9ae793b343fb60acc2c8fab1fb2334ab742361ae

Download Submit
C:\Windows\system\sFggRMi.exe

Filesize
1.5MB

MD5
ce3cc5422b0b9b5074d003c3556966c9

SHA1
90cf3271a9c109655e5536ab8794a273b3bcc70f

SHA256
0d1b8f399d64713cc454cfbd29386a1cd435212da9acfaeb9d4ea9335c98f4e6

SHA512
a4870ab477af56e2ed42e85ba49ee6d6a1b719da47959d9768b6fccf517cb6b2b7778386de847a668438d3c4046655f5e3339772be43449fc42bd9d613053206

Download Submit
C:\Windows\system\sfuCRwh.exe

Filesize
1.5MB

MD5
6cde42b86e465ead236b591379f0f53c

SHA1
3ab02c376791d3df7643c5330e50f4afab84966b

SHA256
084fd27ca7d4d985f3d2d53597248fb9c46e78b22a1ff6239ca453332734f1be

SHA512
e1e3896aee553bd28ae22a967b498aface0fdee0e9473dec1b59c19294be9c8e31b51a6f49e237855c4ecd0f924f6405e9f5e63ae2564402f3bcaf7bd6ed2438

Download Submit
C:\Windows\system\tCUPURH.exe

Filesize
1.5MB

MD5
3032abf332c2541f3990c4a6831ab35f

SHA1
eb614756811297cd1b596bdbd16cebd282e6cbc4

SHA256
4cd3dc005eab03d2bbc01db26fcc0d2e55b885eea39c698b163e4d33a1fce131

SHA512
3977482aa0e93effa23438b76cd3fba0657149385712265bc5302e2e48bb4331e0965c37fc37a12c96cd9943dd02ae644b21d07c870c637ac4895a5ecb6cc738

Download Submit
C:\Windows\system\wkTfpas.exe

Filesize
1.5MB

MD5
3b5e6c943eca541d46e331e801e382ed

SHA1
e663df07e341a628e1e69353506703a2b05fdd0f

SHA256
21a292f9da66e0802d72b628a92dc0417011fec6aa56f314cf3b54327be12ee4

SHA512
42707a2b7ad6cdcd3d5d401ae6f47a080437e4a9b87c32db3776f3d5952748ecb70635f9256c93aa7c3ebf4b86893a9501ed1305b1579c9efda47faac7135307

Download Submit
C:\Windows\system\xSNoygt.exe

Filesize
1.5MB

MD5
cfc1df6e3cde789b69e2828912498e80

SHA1
6e97906ae9719546589da6193af7d99ca23a6fb3

SHA256
6c2be0c79d4f65e294b4af491d2ad6d83eebce61ed6520caa477fed4a1160f87

SHA512
f1ec90051c396415dfc1e7cefc635bcc8fdf9b271030512811a4322415b874d7f24a72c68c59ca4b1f23d6a3355040e9c2f0359b80d98b7f4dba9b7ec89cb24e

Download Submit
C:\Windows\system\yEPXzdu.exe

Filesize
1.5MB

MD5
58862223ae61162d4256ba0df62e2cc0

SHA1
04ea468b19497d9ccf4fb8feedafda1dc3e62171

SHA256
9bc2ca178496127acf6c678fbffdd41c0abf73fe14a805748767d3a53c2d9e66

SHA512
54e644d6cfd60907a83642da909023af6bcc84ec70456cf7049c25f31b9c903d54414ce776b9f169f6c7ddb95adae297a13fb508eb2712c8825a648ac8dc0f2a

Download Submit
C:\Windows\system\yIPzkoL.exe

Filesize
1.5MB

MD5
3bdef0c6ab72f2280d03f58198a80190

SHA1
12f6693f6538993585de5536a3e2c300c29fc3e8

SHA256
3a7985c3ac82c961775b7ed2adfe699824249de74587ddac5ba337ca67e050ee

SHA512
5aa73165a21ae8bf4e3de6d9f854c345bc078769b7e49be8dcbaa2ac5c0c4d7e039cfc9dae28640eb3deb7ee9bc3c99ed7d06a2902b45f2ff387d918813a44bb

Download Submit
C:\Windows\system\yNcoOqn.exe

Filesize
1.5MB

MD5
5b7f19b9e5694b65a41e180ba12f2591

SHA1
d468a864d001ad5bd2979e9224571ec4f905647d

SHA256
9b6135787d8cc525af1e35d5f4e1930c6b2efb06fea3ff48cd638244ab5c9ea4

SHA512
eefd9532954d868a1d64b40f12913bd5c8c0ed9c597c2aea3d23b7b78e8cd2b841aca78702f06504ce534549ca1f58161dacebc224e27a0ff7874f14a2571d90

Download Submit
C:\Windows\system\yxcaONa.exe

Filesize
1.5MB

MD5
793a895d986a2f811cc7036d01be4759

SHA1
34bcc1d164ea30377185a5703ef8147bd5957cf1

SHA256
e810804674ce2e5506295425fbaba48f0c4b3fa99729d93902cbebd83fa92885

SHA512
dcce12255aed3cec79528dcc822909321d92a6ee9a6ea80e347591a96bc49372fbf76d554f67f374da0af284a1ebec513d0515baab1dc169c69383b7093cbb1c

Download Submit
\Windows\system\IEltaBb.exe

Filesize
1.5MB

MD5
eccdb4d506b46f3ecf5a43e85a5c3412

SHA1
9e7ae62fdd53ceeec41cdc81405c060eaeb9a4f3

SHA256
7a9dd560e0d397949e80211f291747c16d21b0dbaae2ea09ba5751c45719f3d8

SHA512
24383024936fe89f1f708c8d3dcc2e30c973c957c4acf0964f32f32f4a9bcdee55519b6d6d7b6092f203885e07a9b92df21748677231c29397d591be78609905

Download Submit
\Windows\system\IMsgVmW.exe

Filesize
1.5MB

MD5
93e1ab3165b8ae2c855a98ee43c04b20

SHA1
b6ca2d86c72cf23e75ef2cf483ac7d62d9f78d2c

SHA256
4d5f4a53f518cc09bb637d1237d16d31393209ebe8a62b280fb66fe2dc070d14

SHA512
7458c987f71abe3d0f10769a577921647f6a22a21f9a5c16e17fb519aa5362a888f321ce38db4c603dddade86da967eb7268a41cad725a88fe424c4049ec2635

Download Submit
\Windows\system\TZOapHU.exe

Filesize
1.5MB

MD5
5ab84c1288be810186a3f597d7c8d621

SHA1
04bb3c975b254f2b304b4e3fd0d99164e54769c5

SHA256
54afbd64467f0bc41c8885e786c74570cfb351917c7feb18c3c89274172703af

SHA512
8dca2fcf40cec4f8dfe9f279b831775354bb4fdc6edbf8b7072f5e72fc090219479787ca2ce8dda2dd9e30a263afe1b6856025afbea42638f749816b41fc5120

Download Submit
\Windows\system\UvsWTqS.exe

Filesize
1.5MB

MD5
f11f80e1ed252646eea6ffc0c722a115

SHA1
7d522d7d5bef53ea2bf8d603aad658627b3d9a91

SHA256
74b2cbf3eadda60f317c9409a58b623385ce6967942d3b9c93620ac1b0cb5fff

SHA512
e9836410fe7bc131403e947fbef315096e2c2cfb221fc9ccda23b128a313be20b6e5e1fc77f34674f0d28029ec007e8e1329e814a151278277ec5a3b5495d67b

Download Submit
\Windows\system\nkdcClE.exe

Filesize
1.5MB

MD5
ad39c03af7ffaf1d1bf2ca88eed3b9a7

SHA1
413bb3f5361d4334a5551b47d23679ebb0a4a17a

SHA256
8b9172ea76240a393f67bb532afcd66c76f801292267867043bd7b34b3f1b0c9

SHA512
9a1ce178a54f1dccaf49e9437df28d51a7a6b46626a6bf978bcdbbe12821ced73675e2d905116fae946071f965b01fcf43163e589a5422c265f3ebe1bb692be1

Download Submit
memory/1540-4144-0x000000013F7E0000-0x000000013FB31000-memory.dmp

Filesize
3.3MB

Download
memory/1540-91-0x000000013F7E0000-0x000000013FB31000-memory.dmp

Filesize
3.3MB

Download
memory/1704-32-0x000000013F5A0000-0x000000013F8F1000-memory.dmp

Filesize
3.3MB

Download
memory/1704-4143-0x000000013F5A0000-0x000000013F8F1000-memory.dmp

Filesize
3.3MB

Download
memory/1900-27-0x000000013FD80000-0x00000001400D1000-memory.dmp

Filesize
3.3MB

Download
memory/1900-4142-0x000000013FD80000-0x00000001400D1000-memory.dmp

Filesize
3.3MB

Download
memory/2132-78-0x000000013F6C0000-0x000000013FA11000-memory.dmp

Filesize
3.3MB

Download
memory/2132-4145-0x000000013F6C0000-0x000000013FA11000-memory.dmp

Filesize
3.3MB

Download
memory/2268-28-0x000000013F740000-0x000000013FA91000-memory.dmp

Filesize
3.3MB

Download
memory/2268-4146-0x000000013F740000-0x000000013FA91000-memory.dmp

Filesize
3.3MB

Download
memory/2272-41-0x000000013F970000-0x000000013FCC1000-memory.dmp

Filesize
3.3MB

Download
memory/2272-1418-0x000000013F970000-0x000000013FCC1000-memory.dmp

Filesize
3.3MB

Download
memory/2272-4148-0x000000013F970000-0x000000013FCC1000-memory.dmp

Filesize
3.3MB

Download
memory/2400-33-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/2400-29-0x000000013FFD0000-0x0000000140321000-memory.dmp

Filesize
3.3MB

Download
memory/2400-145-0x000000013FD00000-0x0000000140051000-memory.dmp

Filesize
3.3MB

Download
memory/2400-74-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/2400-40-0x000000013F970000-0x000000013FCC1000-memory.dmp

Filesize
3.3MB

Download
memory/2400-129-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/2400-364-0x000000013F5C0000-0x000000013F911000-memory.dmp

Filesize
3.3MB

Download
memory/2400-84-0x000000013F070000-0x000000013F3C1000-memory.dmp

Filesize
3.3MB

Download
memory/2400-96-0x000000013F950000-0x000000013FCA1000-memory.dmp

Filesize
3.3MB

Download
memory/2400-110-0x000000013F940000-0x000000013FC91000-memory.dmp

Filesize
3.3MB

Download
memory/2400-31-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/2400-0-0x000000013F5C0000-0x000000013F911000-memory.dmp

Filesize
3.3MB

Download
memory/2400-142-0x000000013FCC0000-0x0000000140011000-memory.dmp

Filesize
3.3MB

Download
memory/2400-34-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/2400-100-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/2400-149-0x000000013FA60000-0x000000013FDB1000-memory.dmp

Filesize
3.3MB

Download
memory/2400-972-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/2400-8-0x000000013FD80000-0x00000001400D1000-memory.dmp

Filesize
3.3MB

Download
memory/2400-151-0x000000013FE90000-0x00000001401E1000-memory.dmp

Filesize
3.3MB

Download
memory/2400-773-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/2400-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2400-1586-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/2624-116-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/2624-4279-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/2624-4166-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/2728-4137-0x000000013F320000-0x000000013F671000-memory.dmp

Filesize
3.3MB

Download
memory/2728-104-0x000000013F320000-0x000000013F671000-memory.dmp

Filesize
3.3MB

Download
memory/2784-121-0x000000013FCC0000-0x0000000140011000-memory.dmp

Filesize
3.3MB

Download
memory/2784-4199-0x000000013FCC0000-0x0000000140011000-memory.dmp

Filesize
3.3MB

Download
memory/2784-4282-0x000000013FCC0000-0x0000000140011000-memory.dmp

Filesize
3.3MB

Download
memory/2944-30-0x000000013FFD0000-0x0000000140321000-memory.dmp

Filesize
3.3MB

Download
memory/2944-4131-0x000000013FFD0000-0x0000000140321000-memory.dmp

Filesize
3.3MB

Download
memory/3048-36-0x000000013F490000-0x000000013F7E1000-memory.dmp

Filesize
3.3MB

Download
memory/3048-4266-0x000000013F490000-0x000000013F7E1000-memory.dmp

Filesize
3.3MB

Download
memory/3048-1155-0x000000013F490000-0x000000013F7E1000-memory.dmp

Filesize
3.3MB

Download