xmrig | bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
Size

1.5MB
MD5

d1746472ce1262685da00d9491f4a75f
SHA1

5486e6926789e01ff64824d835b8c167ea00aa25
SHA256

bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a
SHA512

24bab640fcf882bcac80247a852d70ce3670ff025694911ba4c9655f0c38fd484bd4c1d093172df4276d9524c8d549c329c124e7ee99f4f62a6f3154a11340f6
SSDEEP

24576:EnCbLE/tyK3yt0mFdfE0bLBgDOph4THCGLQTfwlKjoIdBF672l6i2Ncb2ygupgrN:EnCbL83y9FdfE0pZ0zCa4wI156uL3pgp

Score

10^/10

xmrig miner upx

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2664-0-0x000000013FD70000-0x00000001400C4000-memory.dmp	xmrig
behavioral1/files/0x000b00000001225f-3.dat	xmrig
behavioral1/files/0x0008000000018634-9.dat	xmrig
behavioral1/memory/1744-13-0x000000013F640000-0x000000013F994000-memory.dmp	xmrig
behavioral1/memory/2664-16-0x000000013F970000-0x000000013FCC4000-memory.dmp	xmrig
behavioral1/memory/2784-15-0x000000013F970000-0x000000013FCC4000-memory.dmp	xmrig
behavioral1/files/0x0007000000018636-17.dat	xmrig
behavioral1/memory/2724-22-0x000000013FB20000-0x000000013FE74000-memory.dmp	xmrig
behavioral1/memory/2852-38-0x000000013FF70000-0x00000001402C4000-memory.dmp	xmrig
behavioral1/files/0x0007000000018741-23.dat	xmrig
behavioral1/memory/2664-75-0x000000013F790000-0x000000013FAE4000-memory.dmp	xmrig
behavioral1/memory/2640-76-0x000000013F3D0000-0x000000013F724000-memory.dmp	xmrig
behavioral1/files/0x00050000000195c2-102.dat	xmrig
behavioral1/files/0x000500000001945c-82.dat	xmrig
behavioral1/files/0x00050000000195cc-135.dat	xmrig
behavioral1/files/0x00050000000196a0-158.dat	xmrig
behavioral1/memory/1776-577-0x000000013F7E0000-0x000000013FB34000-memory.dmp	xmrig
behavioral1/memory/2664-647-0x000000013F790000-0x000000013FAE4000-memory.dmp	xmrig
behavioral1/memory/2640-1044-0x000000013F3D0000-0x000000013F724000-memory.dmp	xmrig
behavioral1/memory/1348-1314-0x000000013F970000-0x000000013FCC4000-memory.dmp	xmrig
behavioral1/memory/1992-1297-0x000000013F870000-0x000000013FBC4000-memory.dmp	xmrig
behavioral1/memory/2104-1288-0x000000013F790000-0x000000013FAE4000-memory.dmp	xmrig
behavioral1/files/0x0005000000019bf0-171.dat	xmrig
behavioral1/files/0x0005000000019bec-166.dat	xmrig
behavioral1/files/0x0005000000019931-162.dat	xmrig
behavioral1/files/0x0005000000019665-154.dat	xmrig
behavioral1/files/0x0005000000019624-150.dat	xmrig
behavioral1/files/0x00050000000195e0-146.dat	xmrig
behavioral1/files/0x00050000000195d0-142.dat	xmrig
behavioral1/files/0x00050000000195ce-138.dat	xmrig
behavioral1/files/0x00050000000195ca-130.dat	xmrig
behavioral1/files/0x00050000000195c8-127.dat	xmrig
behavioral1/files/0x00050000000195c7-123.dat	xmrig
behavioral1/files/0x00050000000195c4-122.dat	xmrig
behavioral1/files/0x000500000001958b-121.dat	xmrig
behavioral1/files/0x000500000001948d-120.dat	xmrig
behavioral1/files/0x00050000000195c6-119.dat	xmrig
behavioral1/memory/2664-118-0x0000000001EE0000-0x0000000002234000-memory.dmp	xmrig
behavioral1/memory/2664-109-0x000000013F970000-0x000000013FCC4000-memory.dmp	xmrig
behavioral1/files/0x00050000000194e2-101.dat	xmrig
behavioral1/memory/1348-99-0x000000013F970000-0x000000013FCC4000-memory.dmp	xmrig
behavioral1/files/0x000e000000017467-90.dat	xmrig
behavioral1/memory/2724-105-0x000000013FB20000-0x000000013FE74000-memory.dmp	xmrig
behavioral1/memory/2852-95-0x000000013FF70000-0x00000001402C4000-memory.dmp	xmrig
behavioral1/memory/1992-93-0x000000013F870000-0x000000013FBC4000-memory.dmp	xmrig
behavioral1/memory/2104-78-0x000000013F790000-0x000000013FAE4000-memory.dmp	xmrig
behavioral1/memory/2664-67-0x000000013F7E0000-0x000000013FB34000-memory.dmp	xmrig
behavioral1/files/0x00050000000193e6-64.dat	xmrig
behavioral1/memory/2832-58-0x000000013FDB0000-0x0000000140104000-memory.dmp	xmrig
behavioral1/memory/2908-57-0x000000013F680000-0x000000013F9D4000-memory.dmp	xmrig
behavioral1/files/0x00050000000193f0-74.dat	xmrig
behavioral1/memory/1744-72-0x000000013F640000-0x000000013F994000-memory.dmp	xmrig
behavioral1/memory/1776-70-0x000000013F7E0000-0x000000013FB34000-memory.dmp	xmrig
behavioral1/memory/2664-63-0x000000013FD70000-0x00000001400C4000-memory.dmp	xmrig
behavioral1/files/0x000600000001938e-61.dat	xmrig
behavioral1/files/0x00070000000191d1-54.dat	xmrig
behavioral1/files/0x00060000000191ad-53.dat	xmrig
behavioral1/memory/2708-49-0x000000013FF20000-0x0000000140274000-memory.dmp	xmrig
behavioral1/memory/2604-48-0x000000013F180000-0x000000013F4D4000-memory.dmp	xmrig
behavioral1/memory/2664-44-0x0000000001EE0000-0x0000000002234000-memory.dmp	xmrig
behavioral1/files/0x00070000000191cf-42.dat	xmrig
behavioral1/files/0x000600000001919c-40.dat	xmrig
behavioral1/memory/2664-4008-0x0000000001EE0000-0x0000000002234000-memory.dmp	xmrig
behavioral1/memory/1744-4009-0x000000013F640000-0x000000013F994000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1744	fiAPejt.exe
2784	UlmszzZ.exe
2724	sXffSJH.exe
2852	TCQVAcS.exe
2604	hgrzMCr.exe
2708	tDpVTKn.exe
2908	UDYazqu.exe
2832	xBmMvXB.exe
1776	VyjGGMi.exe
2640	zccukbz.exe
2104	LvKwgOw.exe
1992	fMbdWXZ.exe
1348	cuEbfmj.exe
2188	ySjRKmO.exe
2868	XYRNtOh.exe
1028	fiLhHlA.exe
2140	DSvgpfj.exe
2816	yDVZHdk.exe
1832	EkXvekL.exe
540	ApReMTD.exe
2988	mNlXIQY.exe
1976	EVGYbjL.exe
1252	GOnNVSu.exe
1260	rDhwcKP.exe
1996	HZkbUTx.exe
1588	qqTNDTl.exe
448	avlrpIs.exe
2364	hmZDWiM.exe
1660	VNkQjFb.exe
1288	BrCVCIg.exe
2536	sGmjiyw.exe
1600	stTkfiu.exe
1656	qzxsRig.exe
1664	ODwLDca.exe
1876	KZdsZep.exe
1704	ywhXxRb.exe
1452	HWDzhNy.exe
2440	KtmtqtG.exe
1480	PUJTfoE.exe
1684	zBNqorw.exe
2236	RaQbUED.exe
1668	HWWLJXm.exe
2252	qSQVPIH.exe
2272	KJlJcBY.exe
2480	haVkOqe.exe
2428	DkcVGNw.exe
1720	wQMSCjF.exe
2248	rhUNlXm.exe
1672	AwNiXon.exe
568	ZtxIqgW.exe
988	BgZdbRJ.exe
1884	NXThZIM.exe
1192	DwjisAA.exe
2032	QxDHJaT.exe
2528	GYTjBhS.exe
2296	cicYNpp.exe
2484	EpLJrjn.exe
1512	cJwTHoH.exe
1624	bYDceQt.exe
108	FWlcSLB.exe
2700	qAEjKcR.exe
2804	jarwvvq.exe
796	cfPEJNn.exe
2612	zDkApFC.exe

Loads dropped DLL 64 IoCs

pid	Process
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2664-0-0x000000013FD70000-0x00000001400C4000-memory.dmp	upx
behavioral1/files/0x000b00000001225f-3.dat	upx
behavioral1/files/0x0008000000018634-9.dat	upx
behavioral1/memory/1744-13-0x000000013F640000-0x000000013F994000-memory.dmp	upx
behavioral1/memory/2784-15-0x000000013F970000-0x000000013FCC4000-memory.dmp	upx
behavioral1/files/0x0007000000018636-17.dat	upx
behavioral1/memory/2724-22-0x000000013FB20000-0x000000013FE74000-memory.dmp	upx
behavioral1/memory/2852-38-0x000000013FF70000-0x00000001402C4000-memory.dmp	upx
behavioral1/files/0x0007000000018741-23.dat	upx
behavioral1/memory/2640-76-0x000000013F3D0000-0x000000013F724000-memory.dmp	upx
behavioral1/files/0x00050000000195c2-102.dat	upx
behavioral1/files/0x000500000001945c-82.dat	upx
behavioral1/files/0x00050000000195cc-135.dat	upx
behavioral1/files/0x00050000000196a0-158.dat	upx
behavioral1/memory/1776-577-0x000000013F7E0000-0x000000013FB34000-memory.dmp	upx
behavioral1/memory/2640-1044-0x000000013F3D0000-0x000000013F724000-memory.dmp	upx
behavioral1/memory/1348-1314-0x000000013F970000-0x000000013FCC4000-memory.dmp	upx
behavioral1/memory/1992-1297-0x000000013F870000-0x000000013FBC4000-memory.dmp	upx
behavioral1/memory/2104-1288-0x000000013F790000-0x000000013FAE4000-memory.dmp	upx
behavioral1/files/0x0005000000019bf0-171.dat	upx
behavioral1/files/0x0005000000019bec-166.dat	upx
behavioral1/files/0x0005000000019931-162.dat	upx
behavioral1/files/0x0005000000019665-154.dat	upx
behavioral1/files/0x0005000000019624-150.dat	upx
behavioral1/files/0x00050000000195e0-146.dat	upx
behavioral1/files/0x00050000000195d0-142.dat	upx
behavioral1/files/0x00050000000195ce-138.dat	upx
behavioral1/files/0x00050000000195ca-130.dat	upx
behavioral1/files/0x00050000000195c8-127.dat	upx
behavioral1/files/0x00050000000195c7-123.dat	upx
behavioral1/files/0x00050000000195c4-122.dat	upx
behavioral1/files/0x000500000001958b-121.dat	upx
behavioral1/files/0x000500000001948d-120.dat	upx
behavioral1/files/0x00050000000195c6-119.dat	upx
behavioral1/files/0x00050000000194e2-101.dat	upx
behavioral1/memory/1348-99-0x000000013F970000-0x000000013FCC4000-memory.dmp	upx
behavioral1/files/0x000e000000017467-90.dat	upx
behavioral1/memory/2724-105-0x000000013FB20000-0x000000013FE74000-memory.dmp	upx
behavioral1/memory/2852-95-0x000000013FF70000-0x00000001402C4000-memory.dmp	upx
behavioral1/memory/1992-93-0x000000013F870000-0x000000013FBC4000-memory.dmp	upx
behavioral1/memory/2104-78-0x000000013F790000-0x000000013FAE4000-memory.dmp	upx
behavioral1/files/0x00050000000193e6-64.dat	upx
behavioral1/memory/2832-58-0x000000013FDB0000-0x0000000140104000-memory.dmp	upx
behavioral1/memory/2908-57-0x000000013F680000-0x000000013F9D4000-memory.dmp	upx
behavioral1/files/0x00050000000193f0-74.dat	upx
behavioral1/memory/1744-72-0x000000013F640000-0x000000013F994000-memory.dmp	upx
behavioral1/memory/1776-70-0x000000013F7E0000-0x000000013FB34000-memory.dmp	upx
behavioral1/memory/2664-63-0x000000013FD70000-0x00000001400C4000-memory.dmp	upx
behavioral1/files/0x000600000001938e-61.dat	upx
behavioral1/files/0x00070000000191d1-54.dat	upx
behavioral1/files/0x00060000000191ad-53.dat	upx
behavioral1/memory/2708-49-0x000000013FF20000-0x0000000140274000-memory.dmp	upx
behavioral1/memory/2604-48-0x000000013F180000-0x000000013F4D4000-memory.dmp	upx
behavioral1/files/0x00070000000191cf-42.dat	upx
behavioral1/files/0x000600000001919c-40.dat	upx
behavioral1/memory/1744-4009-0x000000013F640000-0x000000013F994000-memory.dmp	upx
behavioral1/memory/2784-4010-0x000000013F970000-0x000000013FCC4000-memory.dmp	upx
behavioral1/memory/2708-4012-0x000000013FF20000-0x0000000140274000-memory.dmp	upx
behavioral1/memory/2724-4011-0x000000013FB20000-0x000000013FE74000-memory.dmp	upx
behavioral1/memory/2604-4013-0x000000013F180000-0x000000013F4D4000-memory.dmp	upx
behavioral1/memory/2832-4014-0x000000013FDB0000-0x0000000140104000-memory.dmp	upx
behavioral1/memory/1776-4015-0x000000013F7E0000-0x000000013FB34000-memory.dmp	upx
behavioral1/memory/2852-4017-0x000000013FF70000-0x00000001402C4000-memory.dmp	upx
behavioral1/memory/2908-4016-0x000000013F680000-0x000000013F9D4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DkcVGNw.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\nYOQYct.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\EyjANlE.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\XAfMVrq.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\JZgYEjb.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\qzxsRig.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\TFWzdZg.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\rRcyGuj.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\DiFtEng.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\kPYbxBc.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\jcBNdKo.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\RlRICRI.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\YcDVSQa.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\sIRTSPj.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\SSxMMeC.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\xVOLeVl.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\IHUDKUQ.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\PNuSRuE.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\bvTANWf.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\BQKkwuw.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\nXRaHet.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\mYrRNRj.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\yxWQlzu.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\hTLJnhv.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\UjMVNOo.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\TrHzyZi.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\HpWEfSI.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\DolgBLh.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\aeQqhhk.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\qqTNDTl.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\gDzvkAO.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\ABzHgbY.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\PJBPHgX.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\TXzRFJV.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\UcNadsT.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\WZWpTkS.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\kUjlvGQ.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\PvIpjVS.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\QMFLRlr.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\FWlcSLB.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\jrmLQKF.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\ZgVrRfe.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\uEdooMF.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\KoCvnhc.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\FJPBoUe.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\qBqyzjj.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\JGSWhQH.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\MhWcqnl.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\qLDlIef.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\QxDHJaT.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\aYErpdz.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\MQEAeIT.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\HePXTtZ.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\nfQbaoX.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\mSDEMLW.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\PdJCEYW.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\AKQxpLK.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\PWZhHxa.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\LjJnVRp.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\AwyxdsP.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\ocpbuhz.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\IMQrQwK.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\MGfVxLZ.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
File created	C:\Windows\System\fOdVhHg.exe	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 1744	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	32
PID 2664 wrote to memory of 1744	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	32
PID 2664 wrote to memory of 1744	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	32
PID 2664 wrote to memory of 2784	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	33
PID 2664 wrote to memory of 2784	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	33
PID 2664 wrote to memory of 2784	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	33
PID 2664 wrote to memory of 2724	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	34
PID 2664 wrote to memory of 2724	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	34
PID 2664 wrote to memory of 2724	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	34
PID 2664 wrote to memory of 2852	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	35
PID 2664 wrote to memory of 2852	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	35
PID 2664 wrote to memory of 2852	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	35
PID 2664 wrote to memory of 2604	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	36
PID 2664 wrote to memory of 2604	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	36
PID 2664 wrote to memory of 2604	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	36
PID 2664 wrote to memory of 2908	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	37
PID 2664 wrote to memory of 2908	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	37
PID 2664 wrote to memory of 2908	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	37
PID 2664 wrote to memory of 2708	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	38
PID 2664 wrote to memory of 2708	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	38
PID 2664 wrote to memory of 2708	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	38
PID 2664 wrote to memory of 2832	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	39
PID 2664 wrote to memory of 2832	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	39
PID 2664 wrote to memory of 2832	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	39
PID 2664 wrote to memory of 1776	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	40
PID 2664 wrote to memory of 1776	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	40
PID 2664 wrote to memory of 1776	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	40
PID 2664 wrote to memory of 2104	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	41
PID 2664 wrote to memory of 2104	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	41
PID 2664 wrote to memory of 2104	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	41
PID 2664 wrote to memory of 2640	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	42
PID 2664 wrote to memory of 2640	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	42
PID 2664 wrote to memory of 2640	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	42
PID 2664 wrote to memory of 1992	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	43
PID 2664 wrote to memory of 1992	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	43
PID 2664 wrote to memory of 1992	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	43
PID 2664 wrote to memory of 1348	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	44
PID 2664 wrote to memory of 1348	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	44
PID 2664 wrote to memory of 1348	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	44
PID 2664 wrote to memory of 2140	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	45
PID 2664 wrote to memory of 2140	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	45
PID 2664 wrote to memory of 2140	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	45
PID 2664 wrote to memory of 2188	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	46
PID 2664 wrote to memory of 2188	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	46
PID 2664 wrote to memory of 2188	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	46
PID 2664 wrote to memory of 2816	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	47
PID 2664 wrote to memory of 2816	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	47
PID 2664 wrote to memory of 2816	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	47
PID 2664 wrote to memory of 2868	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	48
PID 2664 wrote to memory of 2868	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	48
PID 2664 wrote to memory of 2868	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	48
PID 2664 wrote to memory of 1832	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	49
PID 2664 wrote to memory of 1832	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	49
PID 2664 wrote to memory of 1832	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	49
PID 2664 wrote to memory of 1028	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	50
PID 2664 wrote to memory of 1028	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	50
PID 2664 wrote to memory of 1028	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	50
PID 2664 wrote to memory of 540	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	51
PID 2664 wrote to memory of 540	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	51
PID 2664 wrote to memory of 540	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	51
PID 2664 wrote to memory of 2988	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	52
PID 2664 wrote to memory of 2988	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	52
PID 2664 wrote to memory of 2988	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	52
PID 2664 wrote to memory of 1976	2664	JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe	53

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd6c160fdcd78cf97589c98f8eff0848a3089cdd7823641986ea07922444c20a.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\System\fiAPejt.exe
  C:\Windows\System\fiAPejt.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\UlmszzZ.exe
  C:\Windows\System\UlmszzZ.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\sXffSJH.exe
  C:\Windows\System\sXffSJH.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\TCQVAcS.exe
  C:\Windows\System\TCQVAcS.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\hgrzMCr.exe
  C:\Windows\System\hgrzMCr.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\UDYazqu.exe
  C:\Windows\System\UDYazqu.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\tDpVTKn.exe
  C:\Windows\System\tDpVTKn.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\xBmMvXB.exe
  C:\Windows\System\xBmMvXB.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\VyjGGMi.exe
  C:\Windows\System\VyjGGMi.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\LvKwgOw.exe
  C:\Windows\System\LvKwgOw.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\zccukbz.exe
  C:\Windows\System\zccukbz.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\fMbdWXZ.exe
  C:\Windows\System\fMbdWXZ.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\cuEbfmj.exe
  C:\Windows\System\cuEbfmj.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\DSvgpfj.exe
  C:\Windows\System\DSvgpfj.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\ySjRKmO.exe
  C:\Windows\System\ySjRKmO.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\yDVZHdk.exe
  C:\Windows\System\yDVZHdk.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\XYRNtOh.exe
  C:\Windows\System\XYRNtOh.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\EkXvekL.exe
  C:\Windows\System\EkXvekL.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\fiLhHlA.exe
  C:\Windows\System\fiLhHlA.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\ApReMTD.exe
  C:\Windows\System\ApReMTD.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\mNlXIQY.exe
  C:\Windows\System\mNlXIQY.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\EVGYbjL.exe
  C:\Windows\System\EVGYbjL.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\GOnNVSu.exe
  C:\Windows\System\GOnNVSu.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\rDhwcKP.exe
  C:\Windows\System\rDhwcKP.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\HZkbUTx.exe
  C:\Windows\System\HZkbUTx.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\qqTNDTl.exe
  C:\Windows\System\qqTNDTl.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\avlrpIs.exe
  C:\Windows\System\avlrpIs.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\hmZDWiM.exe
  C:\Windows\System\hmZDWiM.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\VNkQjFb.exe
  C:\Windows\System\VNkQjFb.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\BrCVCIg.exe
  C:\Windows\System\BrCVCIg.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\sGmjiyw.exe
  C:\Windows\System\sGmjiyw.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\stTkfiu.exe
  C:\Windows\System\stTkfiu.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\qzxsRig.exe
  C:\Windows\System\qzxsRig.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\ODwLDca.exe
  C:\Windows\System\ODwLDca.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\KZdsZep.exe
  C:\Windows\System\KZdsZep.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\ywhXxRb.exe
  C:\Windows\System\ywhXxRb.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\HWDzhNy.exe
  C:\Windows\System\HWDzhNy.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\KtmtqtG.exe
  C:\Windows\System\KtmtqtG.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\PUJTfoE.exe
  C:\Windows\System\PUJTfoE.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\zBNqorw.exe
  C:\Windows\System\zBNqorw.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\RaQbUED.exe
  C:\Windows\System\RaQbUED.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\HWWLJXm.exe
  C:\Windows\System\HWWLJXm.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\qSQVPIH.exe
  C:\Windows\System\qSQVPIH.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\KJlJcBY.exe
  C:\Windows\System\KJlJcBY.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\haVkOqe.exe
  C:\Windows\System\haVkOqe.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\DkcVGNw.exe
  C:\Windows\System\DkcVGNw.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\wQMSCjF.exe
  C:\Windows\System\wQMSCjF.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\rhUNlXm.exe
  C:\Windows\System\rhUNlXm.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\AwNiXon.exe
  C:\Windows\System\AwNiXon.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\ZtxIqgW.exe
  C:\Windows\System\ZtxIqgW.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\BgZdbRJ.exe
  C:\Windows\System\BgZdbRJ.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\NXThZIM.exe
  C:\Windows\System\NXThZIM.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\DwjisAA.exe
  C:\Windows\System\DwjisAA.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\QxDHJaT.exe
  C:\Windows\System\QxDHJaT.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\GYTjBhS.exe
  C:\Windows\System\GYTjBhS.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\cicYNpp.exe
  C:\Windows\System\cicYNpp.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\EpLJrjn.exe
  C:\Windows\System\EpLJrjn.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\cJwTHoH.exe
  C:\Windows\System\cJwTHoH.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\bYDceQt.exe
  C:\Windows\System\bYDceQt.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\FWlcSLB.exe
  C:\Windows\System\FWlcSLB.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\qAEjKcR.exe
  C:\Windows\System\qAEjKcR.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\jarwvvq.exe
  C:\Windows\System\jarwvvq.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\cfPEJNn.exe
  C:\Windows\System\cfPEJNn.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\zDkApFC.exe
  C:\Windows\System\zDkApFC.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\tybHMwH.exe
  C:\Windows\System\tybHMwH.exe
  2⤵
  PID:2424
- C:\Windows\System\vZqrBfo.exe
  C:\Windows\System\vZqrBfo.exe
  2⤵
  PID:2796
- C:\Windows\System\TFWzdZg.exe
  C:\Windows\System\TFWzdZg.exe
  2⤵
  PID:1764
- C:\Windows\System\JNiKpdz.exe
  C:\Windows\System\JNiKpdz.exe
  2⤵
  PID:2180
- C:\Windows\System\cvZDiae.exe
  C:\Windows\System\cvZDiae.exe
  2⤵
  PID:2904
- C:\Windows\System\Jpclxbu.exe
  C:\Windows\System\Jpclxbu.exe
  2⤵
  PID:772
- C:\Windows\System\gaMvtYG.exe
  C:\Windows\System\gaMvtYG.exe
  2⤵
  PID:1696
- C:\Windows\System\PJGzdFb.exe
  C:\Windows\System\PJGzdFb.exe
  2⤵
  PID:2100
- C:\Windows\System\rRuPSLU.exe
  C:\Windows\System\rRuPSLU.exe
  2⤵
  PID:1424
- C:\Windows\System\UdaURle.exe
  C:\Windows\System\UdaURle.exe
  2⤵
  PID:1848
- C:\Windows\System\wqOQtXE.exe
  C:\Windows\System\wqOQtXE.exe
  2⤵
  PID:1828
- C:\Windows\System\ZnyqUAS.exe
  C:\Windows\System\ZnyqUAS.exe
  2⤵
  PID:2116
- C:\Windows\System\KAhnbyj.exe
  C:\Windows\System\KAhnbyj.exe
  2⤵
  PID:408
- C:\Windows\System\gpasHSm.exe
  C:\Windows\System\gpasHSm.exe
  2⤵
  PID:620
- C:\Windows\System\AGITYRX.exe
  C:\Windows\System\AGITYRX.exe
  2⤵
  PID:1172
- C:\Windows\System\XCrtZyX.exe
  C:\Windows\System\XCrtZyX.exe
  2⤵
  PID:296
- C:\Windows\System\DkxnPHr.exe
  C:\Windows\System\DkxnPHr.exe
  2⤵
  PID:1140
- C:\Windows\System\TkMFKdF.exe
  C:\Windows\System\TkMFKdF.exe
  2⤵
  PID:908
- C:\Windows\System\kSgWuXe.exe
  C:\Windows\System\kSgWuXe.exe
  2⤵
  PID:2488
- C:\Windows\System\mCLUvFG.exe
  C:\Windows\System\mCLUvFG.exe
  2⤵
  PID:2004
- C:\Windows\System\gvKtvEk.exe
  C:\Windows\System\gvKtvEk.exe
  2⤵
  PID:2492
- C:\Windows\System\zRvuowg.exe
  C:\Windows\System\zRvuowg.exe
  2⤵
  PID:1396
- C:\Windows\System\ERpjhka.exe
  C:\Windows\System\ERpjhka.exe
  2⤵
  PID:2476
- C:\Windows\System\EIWrEwQ.exe
  C:\Windows\System\EIWrEwQ.exe
  2⤵
  PID:1576
- C:\Windows\System\cJyckoI.exe
  C:\Windows\System\cJyckoI.exe
  2⤵
  PID:2056
- C:\Windows\System\YmZtcfP.exe
  C:\Windows\System\YmZtcfP.exe
  2⤵
  PID:1232
- C:\Windows\System\gmooRlo.exe
  C:\Windows\System\gmooRlo.exe
  2⤵
  PID:2352
- C:\Windows\System\etPoFAu.exe
  C:\Windows\System\etPoFAu.exe
  2⤵
  PID:2356
- C:\Windows\System\EQxPNZy.exe
  C:\Windows\System\EQxPNZy.exe
  2⤵
  PID:2824
- C:\Windows\System\IiIdCLd.exe
  C:\Windows\System\IiIdCLd.exe
  2⤵
  PID:2728
- C:\Windows\System\YlZjQAV.exe
  C:\Windows\System\YlZjQAV.exe
  2⤵
  PID:2576
- C:\Windows\System\kHMSbGq.exe
  C:\Windows\System\kHMSbGq.exe
  2⤵
  PID:2676
- C:\Windows\System\NQhvFAI.exe
  C:\Windows\System\NQhvFAI.exe
  2⤵
  PID:2580
- C:\Windows\System\PZMiUHd.exe
  C:\Windows\System\PZMiUHd.exe
  2⤵
  PID:2976
- C:\Windows\System\jNeLWsm.exe
  C:\Windows\System\jNeLWsm.exe
  2⤵
  PID:3088
- C:\Windows\System\ZklrrrK.exe
  C:\Windows\System\ZklrrrK.exe
  2⤵
  PID:3104
- C:\Windows\System\SSxMMeC.exe
  C:\Windows\System\SSxMMeC.exe
  2⤵
  PID:3120
- C:\Windows\System\ZTXcOPJ.exe
  C:\Windows\System\ZTXcOPJ.exe
  2⤵
  PID:3136
- C:\Windows\System\ymfSqCv.exe
  C:\Windows\System\ymfSqCv.exe
  2⤵
  PID:3152
- C:\Windows\System\vfBZskN.exe
  C:\Windows\System\vfBZskN.exe
  2⤵
  PID:3168
- C:\Windows\System\jwmOYDR.exe
  C:\Windows\System\jwmOYDR.exe
  2⤵
  PID:3184
- C:\Windows\System\MATdTnZ.exe
  C:\Windows\System\MATdTnZ.exe
  2⤵
  PID:3200
- C:\Windows\System\nYOQYct.exe
  C:\Windows\System\nYOQYct.exe
  2⤵
  PID:3216
- C:\Windows\System\cTLDhGV.exe
  C:\Windows\System\cTLDhGV.exe
  2⤵
  PID:3232
- C:\Windows\System\SSgUtlG.exe
  C:\Windows\System\SSgUtlG.exe
  2⤵
  PID:3248
- C:\Windows\System\nSOiMLA.exe
  C:\Windows\System\nSOiMLA.exe
  2⤵
  PID:3264
- C:\Windows\System\zITsfDB.exe
  C:\Windows\System\zITsfDB.exe
  2⤵
  PID:3280
- C:\Windows\System\oovzrUu.exe
  C:\Windows\System\oovzrUu.exe
  2⤵
  PID:3296
- C:\Windows\System\QNHUPng.exe
  C:\Windows\System\QNHUPng.exe
  2⤵
  PID:3312
- C:\Windows\System\WHhaSbY.exe
  C:\Windows\System\WHhaSbY.exe
  2⤵
  PID:3328
- C:\Windows\System\EqcKFaP.exe
  C:\Windows\System\EqcKFaP.exe
  2⤵
  PID:3344
- C:\Windows\System\UoDeZEu.exe
  C:\Windows\System\UoDeZEu.exe
  2⤵
  PID:3360
- C:\Windows\System\wOpqpZq.exe
  C:\Windows\System\wOpqpZq.exe
  2⤵
  PID:3376
- C:\Windows\System\keaIEcu.exe
  C:\Windows\System\keaIEcu.exe
  2⤵
  PID:3392
- C:\Windows\System\LaMJhMj.exe
  C:\Windows\System\LaMJhMj.exe
  2⤵
  PID:3408
- C:\Windows\System\EoEfYmV.exe
  C:\Windows\System\EoEfYmV.exe
  2⤵
  PID:3424
- C:\Windows\System\wjoAQvz.exe
  C:\Windows\System\wjoAQvz.exe
  2⤵
  PID:3440
- C:\Windows\System\mYrRNRj.exe
  C:\Windows\System\mYrRNRj.exe
  2⤵
  PID:3456
- C:\Windows\System\InWIzSv.exe
  C:\Windows\System\InWIzSv.exe
  2⤵
  PID:3472
- C:\Windows\System\ZgXGoQL.exe
  C:\Windows\System\ZgXGoQL.exe
  2⤵
  PID:3488
- C:\Windows\System\zkYHfLD.exe
  C:\Windows\System\zkYHfLD.exe
  2⤵
  PID:3504
- C:\Windows\System\dksWCeL.exe
  C:\Windows\System\dksWCeL.exe
  2⤵
  PID:3520
- C:\Windows\System\wHkkeKr.exe
  C:\Windows\System\wHkkeKr.exe
  2⤵
  PID:3536
- C:\Windows\System\TNmwhhI.exe
  C:\Windows\System\TNmwhhI.exe
  2⤵
  PID:3552
- C:\Windows\System\FxAdiQG.exe
  C:\Windows\System\FxAdiQG.exe
  2⤵
  PID:3568
- C:\Windows\System\aYErpdz.exe
  C:\Windows\System\aYErpdz.exe
  2⤵
  PID:3584
- C:\Windows\System\iDtjxOC.exe
  C:\Windows\System\iDtjxOC.exe
  2⤵
  PID:3600
- C:\Windows\System\uJQqVpF.exe
  C:\Windows\System\uJQqVpF.exe
  2⤵
  PID:3620
- C:\Windows\System\iWQHWxT.exe
  C:\Windows\System\iWQHWxT.exe
  2⤵
  PID:3636
- C:\Windows\System\lkuDOLQ.exe
  C:\Windows\System\lkuDOLQ.exe
  2⤵
  PID:3652
- C:\Windows\System\GDaXIBH.exe
  C:\Windows\System\GDaXIBH.exe
  2⤵
  PID:3668
- C:\Windows\System\ACskEIY.exe
  C:\Windows\System\ACskEIY.exe
  2⤵
  PID:3684
- C:\Windows\System\sackVrK.exe
  C:\Windows\System\sackVrK.exe
  2⤵
  PID:3700
- C:\Windows\System\NXwQABo.exe
  C:\Windows\System\NXwQABo.exe
  2⤵
  PID:3716
- C:\Windows\System\wspmcMA.exe
  C:\Windows\System\wspmcMA.exe
  2⤵
  PID:3732
- C:\Windows\System\BAslNFP.exe
  C:\Windows\System\BAslNFP.exe
  2⤵
  PID:3748
- C:\Windows\System\tjbkMkG.exe
  C:\Windows\System\tjbkMkG.exe
  2⤵
  PID:3764
- C:\Windows\System\vyAzmIL.exe
  C:\Windows\System\vyAzmIL.exe
  2⤵
  PID:3780
- C:\Windows\System\hvdgbft.exe
  C:\Windows\System\hvdgbft.exe
  2⤵
  PID:3796
- C:\Windows\System\UhHYdPU.exe
  C:\Windows\System\UhHYdPU.exe
  2⤵
  PID:3812
- C:\Windows\System\YKwMRzG.exe
  C:\Windows\System\YKwMRzG.exe
  2⤵
  PID:3828
- C:\Windows\System\HXzMBTq.exe
  C:\Windows\System\HXzMBTq.exe
  2⤵
  PID:3844
- C:\Windows\System\VqtXrCI.exe
  C:\Windows\System\VqtXrCI.exe
  2⤵
  PID:3860
- C:\Windows\System\RgZwhID.exe
  C:\Windows\System\RgZwhID.exe
  2⤵
  PID:3876
- C:\Windows\System\FJhvdun.exe
  C:\Windows\System\FJhvdun.exe
  2⤵
  PID:3892
- C:\Windows\System\UgLuGJp.exe
  C:\Windows\System\UgLuGJp.exe
  2⤵
  PID:3908
- C:\Windows\System\gXtLhHo.exe
  C:\Windows\System\gXtLhHo.exe
  2⤵
  PID:3924
- C:\Windows\System\mAcWiok.exe
  C:\Windows\System\mAcWiok.exe
  2⤵
  PID:3940
- C:\Windows\System\vuqcNsQ.exe
  C:\Windows\System\vuqcNsQ.exe
  2⤵
  PID:3956
- C:\Windows\System\OIIduhQ.exe
  C:\Windows\System\OIIduhQ.exe
  2⤵
  PID:3972
- C:\Windows\System\hBJGMUE.exe
  C:\Windows\System\hBJGMUE.exe
  2⤵
  PID:3988
- C:\Windows\System\NesbYZV.exe
  C:\Windows\System\NesbYZV.exe
  2⤵
  PID:4004
- C:\Windows\System\DiLfJjQ.exe
  C:\Windows\System\DiLfJjQ.exe
  2⤵
  PID:4020
- C:\Windows\System\WvNjxvb.exe
  C:\Windows\System\WvNjxvb.exe
  2⤵
  PID:4036
- C:\Windows\System\SuoDfqE.exe
  C:\Windows\System\SuoDfqE.exe
  2⤵
  PID:4052
- C:\Windows\System\oVmEoHm.exe
  C:\Windows\System\oVmEoHm.exe
  2⤵
  PID:4068
- C:\Windows\System\afEgFDu.exe
  C:\Windows\System\afEgFDu.exe
  2⤵
  PID:4084
- C:\Windows\System\FmUjzTH.exe
  C:\Windows\System\FmUjzTH.exe
  2⤵
  PID:764
- C:\Windows\System\MQEAeIT.exe
  C:\Windows\System\MQEAeIT.exe
  2⤵
  PID:2668
- C:\Windows\System\rRcyGuj.exe
  C:\Windows\System\rRcyGuj.exe
  2⤵
  PID:2836
- C:\Windows\System\MgZLJZp.exe
  C:\Windows\System\MgZLJZp.exe
  2⤵
  PID:1736
- C:\Windows\System\ZvPlmSF.exe
  C:\Windows\System\ZvPlmSF.exe
  2⤵
  PID:1564
- C:\Windows\System\DJFodLI.exe
  C:\Windows\System\DJFodLI.exe
  2⤵
  PID:268
- C:\Windows\System\bWdqPCW.exe
  C:\Windows\System\bWdqPCW.exe
  2⤵
  PID:832
- C:\Windows\System\SnMsPio.exe
  C:\Windows\System\SnMsPio.exe
  2⤵
  PID:2460
- C:\Windows\System\FKqfzMg.exe
  C:\Windows\System\FKqfzMg.exe
  2⤵
  PID:2520
- C:\Windows\System\veSUYzL.exe
  C:\Windows\System\veSUYzL.exe
  2⤵
  PID:2292
- C:\Windows\System\napMDyc.exe
  C:\Windows\System\napMDyc.exe
  2⤵
  PID:880
- C:\Windows\System\nCZOpyo.exe
  C:\Windows\System\nCZOpyo.exe
  2⤵
  PID:2856
- C:\Windows\System\hVUXDZJ.exe
  C:\Windows\System\hVUXDZJ.exe
  2⤵
  PID:1096
- C:\Windows\System\hHGUAPK.exe
  C:\Windows\System\hHGUAPK.exe
  2⤵
  PID:2772
- C:\Windows\System\dqXtcbN.exe
  C:\Windows\System\dqXtcbN.exe
  2⤵
  PID:2588
- C:\Windows\System\bEgYcJO.exe
  C:\Windows\System\bEgYcJO.exe
  2⤵
  PID:3096
- C:\Windows\System\QcSKTwA.exe
  C:\Windows\System\QcSKTwA.exe
  2⤵
  PID:3128
- C:\Windows\System\nrQQpEd.exe
  C:\Windows\System\nrQQpEd.exe
  2⤵
  PID:3148
- C:\Windows\System\lTmSGwh.exe
  C:\Windows\System\lTmSGwh.exe
  2⤵
  PID:3180
- C:\Windows\System\ecJvMXj.exe
  C:\Windows\System\ecJvMXj.exe
  2⤵
  PID:3212
- C:\Windows\System\mSDEMLW.exe
  C:\Windows\System\mSDEMLW.exe
  2⤵
  PID:3256
- C:\Windows\System\LytHdil.exe
  C:\Windows\System\LytHdil.exe
  2⤵
  PID:3320
- C:\Windows\System\MvArBdI.exe
  C:\Windows\System\MvArBdI.exe
  2⤵
  PID:3324
- C:\Windows\System\yHplBfo.exe
  C:\Windows\System\yHplBfo.exe
  2⤵
  PID:3340
- C:\Windows\System\gDzvkAO.exe
  C:\Windows\System\gDzvkAO.exe
  2⤵
  PID:3372
- C:\Windows\System\JaLYDaU.exe
  C:\Windows\System\JaLYDaU.exe
  2⤵
  PID:3404
- C:\Windows\System\zkDibeT.exe
  C:\Windows\System\zkDibeT.exe
  2⤵
  PID:3448
- C:\Windows\System\gcgbnEh.exe
  C:\Windows\System\gcgbnEh.exe
  2⤵
  PID:3468
- C:\Windows\System\GMBuaFR.exe
  C:\Windows\System\GMBuaFR.exe
  2⤵
  PID:3512
- C:\Windows\System\XMUfDdY.exe
  C:\Windows\System\XMUfDdY.exe
  2⤵
  PID:3532
- C:\Windows\System\juVQnjt.exe
  C:\Windows\System\juVQnjt.exe
  2⤵
  PID:3576
- C:\Windows\System\PdJCEYW.exe
  C:\Windows\System\PdJCEYW.exe
  2⤵
  PID:3608
- C:\Windows\System\uvPETIU.exe
  C:\Windows\System\uvPETIU.exe
  2⤵
  PID:3644
- C:\Windows\System\FQSjcRS.exe
  C:\Windows\System\FQSjcRS.exe
  2⤵
  PID:3660
- C:\Windows\System\MPxsFxR.exe
  C:\Windows\System\MPxsFxR.exe
  2⤵
  PID:3692
- C:\Windows\System\BtZogxM.exe
  C:\Windows\System\BtZogxM.exe
  2⤵
  PID:3724
- C:\Windows\System\OgAoYYS.exe
  C:\Windows\System\OgAoYYS.exe
  2⤵
  PID:3756
- C:\Windows\System\qlDakjI.exe
  C:\Windows\System\qlDakjI.exe
  2⤵
  PID:3788
- C:\Windows\System\KybANZU.exe
  C:\Windows\System\KybANZU.exe
  2⤵
  PID:3820
- C:\Windows\System\yMBqJxa.exe
  C:\Windows\System\yMBqJxa.exe
  2⤵
  PID:3852
- C:\Windows\System\axvFlQk.exe
  C:\Windows\System\axvFlQk.exe
  2⤵
  PID:3884
- C:\Windows\System\YSZIBge.exe
  C:\Windows\System\YSZIBge.exe
  2⤵
  PID:3916
- C:\Windows\System\EuhXfJy.exe
  C:\Windows\System\EuhXfJy.exe
  2⤵
  PID:3948
- C:\Windows\System\ccGNYvs.exe
  C:\Windows\System\ccGNYvs.exe
  2⤵
  PID:3980
- C:\Windows\System\QIGJQyE.exe
  C:\Windows\System\QIGJQyE.exe
  2⤵
  PID:4012
- C:\Windows\System\nexPaow.exe
  C:\Windows\System\nexPaow.exe
  2⤵
  PID:4044
- C:\Windows\System\tEnVLvN.exe
  C:\Windows\System\tEnVLvN.exe
  2⤵
  PID:4076
- C:\Windows\System\cZGAnTy.exe
  C:\Windows\System\cZGAnTy.exe
  2⤵
  PID:2876
- C:\Windows\System\yxWQlzu.exe
  C:\Windows\System\yxWQlzu.exe
  2⤵
  PID:1388
- C:\Windows\System\elIMKLt.exe
  C:\Windows\System\elIMKLt.exe
  2⤵
  PID:1276
- C:\Windows\System\jrmLQKF.exe
  C:\Windows\System\jrmLQKF.exe
  2⤵
  PID:2412
- C:\Windows\System\HPFGZhy.exe
  C:\Windows\System\HPFGZhy.exe
  2⤵
  PID:1000
- C:\Windows\System\bAHZAVY.exe
  C:\Windows\System\bAHZAVY.exe
  2⤵
  PID:888
- C:\Windows\System\zFJOJRH.exe
  C:\Windows\System\zFJOJRH.exe
  2⤵
  PID:1492
- C:\Windows\System\AQfyCmq.exe
  C:\Windows\System\AQfyCmq.exe
  2⤵
  PID:4108
- C:\Windows\System\oBKfGQN.exe
  C:\Windows\System\oBKfGQN.exe
  2⤵
  PID:4124
- C:\Windows\System\IvkGXBI.exe
  C:\Windows\System\IvkGXBI.exe
  2⤵
  PID:4140
- C:\Windows\System\OjuxsJG.exe
  C:\Windows\System\OjuxsJG.exe
  2⤵
  PID:4156
- C:\Windows\System\utIIGmZ.exe
  C:\Windows\System\utIIGmZ.exe
  2⤵
  PID:4172
- C:\Windows\System\qXvUPrp.exe
  C:\Windows\System\qXvUPrp.exe
  2⤵
  PID:4188
- C:\Windows\System\xWFZQKe.exe
  C:\Windows\System\xWFZQKe.exe
  2⤵
  PID:4204
- C:\Windows\System\uEtwiEL.exe
  C:\Windows\System\uEtwiEL.exe
  2⤵
  PID:4220
- C:\Windows\System\sqGqriY.exe
  C:\Windows\System\sqGqriY.exe
  2⤵
  PID:4236
- C:\Windows\System\pMuFKtV.exe
  C:\Windows\System\pMuFKtV.exe
  2⤵
  PID:4252
- C:\Windows\System\OKynUhU.exe
  C:\Windows\System\OKynUhU.exe
  2⤵
  PID:4268
- C:\Windows\System\hTLJnhv.exe
  C:\Windows\System\hTLJnhv.exe
  2⤵
  PID:4308
- C:\Windows\System\OsDsgve.exe
  C:\Windows\System\OsDsgve.exe
  2⤵
  PID:4324
- C:\Windows\System\XLHKcKf.exe
  C:\Windows\System\XLHKcKf.exe
  2⤵
  PID:4340
- C:\Windows\System\AwyxdsP.exe
  C:\Windows\System\AwyxdsP.exe
  2⤵
  PID:4356
- C:\Windows\System\qXVpAQe.exe
  C:\Windows\System\qXVpAQe.exe
  2⤵
  PID:4372
- C:\Windows\System\DsDrvOG.exe
  C:\Windows\System\DsDrvOG.exe
  2⤵
  PID:4392
- C:\Windows\System\ckJEPhN.exe
  C:\Windows\System\ckJEPhN.exe
  2⤵
  PID:4408
- C:\Windows\System\nnNOJPH.exe
  C:\Windows\System\nnNOJPH.exe
  2⤵
  PID:4428
- C:\Windows\System\nXedrXf.exe
  C:\Windows\System\nXedrXf.exe
  2⤵
  PID:4444
- C:\Windows\System\AfKHVuD.exe
  C:\Windows\System\AfKHVuD.exe
  2⤵
  PID:4460
- C:\Windows\System\kOWfIYu.exe
  C:\Windows\System\kOWfIYu.exe
  2⤵
  PID:4476
- C:\Windows\System\BKxeRfb.exe
  C:\Windows\System\BKxeRfb.exe
  2⤵
  PID:4492
- C:\Windows\System\YGXqtfX.exe
  C:\Windows\System\YGXqtfX.exe
  2⤵
  PID:4508
- C:\Windows\System\iVgozrE.exe
  C:\Windows\System\iVgozrE.exe
  2⤵
  PID:4524
- C:\Windows\System\IgQPcTJ.exe
  C:\Windows\System\IgQPcTJ.exe
  2⤵
  PID:4540
- C:\Windows\System\GcfKLTg.exe
  C:\Windows\System\GcfKLTg.exe
  2⤵
  PID:4556
- C:\Windows\System\ykuOXQx.exe
  C:\Windows\System\ykuOXQx.exe
  2⤵
  PID:4572
- C:\Windows\System\IEEYbAO.exe
  C:\Windows\System\IEEYbAO.exe
  2⤵
  PID:4588
- C:\Windows\System\AtRokQH.exe
  C:\Windows\System\AtRokQH.exe
  2⤵
  PID:4604
- C:\Windows\System\LukLsRs.exe
  C:\Windows\System\LukLsRs.exe
  2⤵
  PID:4620
- C:\Windows\System\cwEnycI.exe
  C:\Windows\System\cwEnycI.exe
  2⤵
  PID:4636
- C:\Windows\System\TAiTIif.exe
  C:\Windows\System\TAiTIif.exe
  2⤵
  PID:4652
- C:\Windows\System\CZYdezJ.exe
  C:\Windows\System\CZYdezJ.exe
  2⤵
  PID:4668
- C:\Windows\System\OZbjmZo.exe
  C:\Windows\System\OZbjmZo.exe
  2⤵
  PID:4684
- C:\Windows\System\PApJUEY.exe
  C:\Windows\System\PApJUEY.exe
  2⤵
  PID:4700
- C:\Windows\System\XNXBGPo.exe
  C:\Windows\System\XNXBGPo.exe
  2⤵
  PID:4716
- C:\Windows\System\ZAitMTm.exe
  C:\Windows\System\ZAitMTm.exe
  2⤵
  PID:4732
- C:\Windows\System\ppcERMQ.exe
  C:\Windows\System\ppcERMQ.exe
  2⤵
  PID:4748
- C:\Windows\System\tPfMEda.exe
  C:\Windows\System\tPfMEda.exe
  2⤵
  PID:4764
- C:\Windows\System\PDNBIzl.exe
  C:\Windows\System\PDNBIzl.exe
  2⤵
  PID:4780
- C:\Windows\System\cKItawz.exe
  C:\Windows\System\cKItawz.exe
  2⤵
  PID:4796
- C:\Windows\System\BpfNntd.exe
  C:\Windows\System\BpfNntd.exe
  2⤵
  PID:4812
- C:\Windows\System\UBYIIRh.exe
  C:\Windows\System\UBYIIRh.exe
  2⤵
  PID:4828
- C:\Windows\System\hjydSVV.exe
  C:\Windows\System\hjydSVV.exe
  2⤵
  PID:4844
- C:\Windows\System\frnRAeo.exe
  C:\Windows\System\frnRAeo.exe
  2⤵
  PID:4860
- C:\Windows\System\SPZbynW.exe
  C:\Windows\System\SPZbynW.exe
  2⤵
  PID:4876
- C:\Windows\System\AlzoPPC.exe
  C:\Windows\System\AlzoPPC.exe
  2⤵
  PID:4892
- C:\Windows\System\gKrSVkv.exe
  C:\Windows\System\gKrSVkv.exe
  2⤵
  PID:4908
- C:\Windows\System\HkeMFwL.exe
  C:\Windows\System\HkeMFwL.exe
  2⤵
  PID:4924
- C:\Windows\System\sCbOIMA.exe
  C:\Windows\System\sCbOIMA.exe
  2⤵
  PID:4940
- C:\Windows\System\JnGHoco.exe
  C:\Windows\System\JnGHoco.exe
  2⤵
  PID:4960
- C:\Windows\System\FBqwNFa.exe
  C:\Windows\System\FBqwNFa.exe
  2⤵
  PID:4976
- C:\Windows\System\biOQKEK.exe
  C:\Windows\System\biOQKEK.exe
  2⤵
  PID:4992
- C:\Windows\System\XjChbEb.exe
  C:\Windows\System\XjChbEb.exe
  2⤵
  PID:5008
- C:\Windows\System\UjMVNOo.exe
  C:\Windows\System\UjMVNOo.exe
  2⤵
  PID:5024
- C:\Windows\System\mKgWfwx.exe
  C:\Windows\System\mKgWfwx.exe
  2⤵
  PID:5040
- C:\Windows\System\iKUilfk.exe
  C:\Windows\System\iKUilfk.exe
  2⤵
  PID:5056
- C:\Windows\System\ysWIogW.exe
  C:\Windows\System\ysWIogW.exe
  2⤵
  PID:5072
- C:\Windows\System\nwADbmN.exe
  C:\Windows\System\nwADbmN.exe
  2⤵
  PID:5088
- C:\Windows\System\jkedGzI.exe
  C:\Windows\System\jkedGzI.exe
  2⤵
  PID:5104
- C:\Windows\System\hQOWLKL.exe
  C:\Windows\System\hQOWLKL.exe
  2⤵
  PID:2768
- C:\Windows\System\lNpPlph.exe
  C:\Windows\System\lNpPlph.exe
  2⤵
  PID:3112
- C:\Windows\System\TeAnOOq.exe
  C:\Windows\System\TeAnOOq.exe
  2⤵
  PID:3160
- C:\Windows\System\WwomkdI.exe
  C:\Windows\System\WwomkdI.exe
  2⤵
  PID:3224
- C:\Windows\System\YiuwzXQ.exe
  C:\Windows\System\YiuwzXQ.exe
  2⤵
  PID:3292
- C:\Windows\System\rJxsZLQ.exe
  C:\Windows\System\rJxsZLQ.exe
  2⤵
  PID:3352
- C:\Windows\System\kFsAnPs.exe
  C:\Windows\System\kFsAnPs.exe
  2⤵
  PID:3420
- C:\Windows\System\hNLlJLD.exe
  C:\Windows\System\hNLlJLD.exe
  2⤵
  PID:3464
- C:\Windows\System\FJPBoUe.exe
  C:\Windows\System\FJPBoUe.exe
  2⤵
  PID:3548
- C:\Windows\System\PewFwYy.exe
  C:\Windows\System\PewFwYy.exe
  2⤵
  PID:3008
- C:\Windows\System\UoyxlxQ.exe
  C:\Windows\System\UoyxlxQ.exe
  2⤵
  PID:3664
- C:\Windows\System\EPLaBPG.exe
  C:\Windows\System\EPLaBPG.exe
  2⤵
  PID:3792
- C:\Windows\System\XXrXiuY.exe
  C:\Windows\System\XXrXiuY.exe
  2⤵
  PID:3920
- C:\Windows\System\ETkZfFc.exe
  C:\Windows\System\ETkZfFc.exe
  2⤵
  PID:4048
- C:\Windows\System\yibeXVN.exe
  C:\Windows\System\yibeXVN.exe
  2⤵
  PID:1604
- C:\Windows\System\gJVMHZp.exe
  C:\Windows\System\gJVMHZp.exe
  2⤵
  PID:4100
- C:\Windows\System\CpVuFgp.exe
  C:\Windows\System\CpVuFgp.exe
  2⤵
  PID:3712
- C:\Windows\System\dbQrlKV.exe
  C:\Windows\System\dbQrlKV.exe
  2⤵
  PID:4164
- C:\Windows\System\zJRAkkF.exe
  C:\Windows\System\zJRAkkF.exe
  2⤵
  PID:4228
- C:\Windows\System\Oddoyvc.exe
  C:\Windows\System\Oddoyvc.exe
  2⤵
  PID:3904
- C:\Windows\System\QbEjPrK.exe
  C:\Windows\System\QbEjPrK.exe
  2⤵
  PID:4032
- C:\Windows\System\IEGmWUc.exe
  C:\Windows\System\IEGmWUc.exe
  2⤵
  PID:4260
- C:\Windows\System\wwYeDkW.exe
  C:\Windows\System\wwYeDkW.exe
  2⤵
  PID:1688
- C:\Windows\System\MdWdLWM.exe
  C:\Windows\System\MdWdLWM.exe
  2⤵
  PID:4116
- C:\Windows\System\JZJWdMT.exe
  C:\Windows\System\JZJWdMT.exe
  2⤵
  PID:4152
- C:\Windows\System\rkxrMNf.exe
  C:\Windows\System\rkxrMNf.exe
  2⤵
  PID:2940
- C:\Windows\System\KgznqSy.exe
  C:\Windows\System\KgznqSy.exe
  2⤵
  PID:4276
- C:\Windows\System\TOyLtGp.exe
  C:\Windows\System\TOyLtGp.exe
  2⤵
  PID:4320
- C:\Windows\System\rSHsgER.exe
  C:\Windows\System\rSHsgER.exe
  2⤵
  PID:4384
- C:\Windows\System\HwCaBPv.exe
  C:\Windows\System\HwCaBPv.exe
  2⤵
  PID:4288
- C:\Windows\System\htEofaV.exe
  C:\Windows\System\htEofaV.exe
  2⤵
  PID:4304
- C:\Windows\System\JmSBTrH.exe
  C:\Windows\System\JmSBTrH.exe
  2⤵
  PID:4368
- C:\Windows\System\uuPOnty.exe
  C:\Windows\System\uuPOnty.exe
  2⤵
  PID:4400
- C:\Windows\System\VxBocCm.exe
  C:\Windows\System\VxBocCm.exe
  2⤵
  PID:4468
- C:\Windows\System\ofzKqhB.exe
  C:\Windows\System\ofzKqhB.exe
  2⤵
  PID:2788
- C:\Windows\System\fyNEVro.exe
  C:\Windows\System\fyNEVro.exe
  2⤵
  PID:2848
- C:\Windows\System\xUXDLKg.exe
  C:\Windows\System\xUXDLKg.exe
  2⤵
  PID:4520
- C:\Windows\System\lzBPuzV.exe
  C:\Windows\System\lzBPuzV.exe
  2⤵
  PID:4536
- C:\Windows\System\wSwPonr.exe
  C:\Windows\System\wSwPonr.exe
  2⤵
  PID:4584
- C:\Windows\System\ZgVrRfe.exe
  C:\Windows\System\ZgVrRfe.exe
  2⤵
  PID:4648
- C:\Windows\System\uzxuHvN.exe
  C:\Windows\System\uzxuHvN.exe
  2⤵
  PID:2812
- C:\Windows\System\JojKBWp.exe
  C:\Windows\System\JojKBWp.exe
  2⤵
  PID:4632
- C:\Windows\System\QIBsFsB.exe
  C:\Windows\System\QIBsFsB.exe
  2⤵
  PID:4708
- C:\Windows\System\gMPPXhA.exe
  C:\Windows\System\gMPPXhA.exe
  2⤵
  PID:4772
- C:\Windows\System\KqLXJnd.exe
  C:\Windows\System\KqLXJnd.exe
  2⤵
  PID:4696
- C:\Windows\System\FnlXFck.exe
  C:\Windows\System\FnlXFck.exe
  2⤵
  PID:4836
- C:\Windows\System\HeKiffc.exe
  C:\Windows\System\HeKiffc.exe
  2⤵
  PID:4900
- C:\Windows\System\bVJpLQr.exe
  C:\Windows\System\bVJpLQr.exe
  2⤵
  PID:4820
- C:\Windows\System\ypNrjdz.exe
  C:\Windows\System\ypNrjdz.exe
  2⤵
  PID:4756
- C:\Windows\System\AbVVIbT.exe
  C:\Windows\System\AbVVIbT.exe
  2⤵
  PID:4856
- C:\Windows\System\FLLMuUq.exe
  C:\Windows\System\FLLMuUq.exe
  2⤵
  PID:5004
- C:\Windows\System\CdMzzcV.exe
  C:\Windows\System\CdMzzcV.exe
  2⤵
  PID:5064
- C:\Windows\System\metUdWW.exe
  C:\Windows\System\metUdWW.exe
  2⤵
  PID:4888
- C:\Windows\System\lzAdmNr.exe
  C:\Windows\System\lzAdmNr.exe
  2⤵
  PID:5096
- C:\Windows\System\hQsbmfB.exe
  C:\Windows\System\hQsbmfB.exe
  2⤵
  PID:1044
- C:\Windows\System\PXhvzMw.exe
  C:\Windows\System\PXhvzMw.exe
  2⤵
  PID:5368
- C:\Windows\System\SPvaOzz.exe
  C:\Windows\System\SPvaOzz.exe
  2⤵
  PID:5384
- C:\Windows\System\ZVpcRNH.exe
  C:\Windows\System\ZVpcRNH.exe
  2⤵
  PID:5400
- C:\Windows\System\LlWJUXe.exe
  C:\Windows\System\LlWJUXe.exe
  2⤵
  PID:5416
- C:\Windows\System\MznkFXA.exe
  C:\Windows\System\MznkFXA.exe
  2⤵
  PID:5432
- C:\Windows\System\iZNWkyH.exe
  C:\Windows\System\iZNWkyH.exe
  2⤵
  PID:5448
- C:\Windows\System\qacZxrk.exe
  C:\Windows\System\qacZxrk.exe
  2⤵
  PID:5464
- C:\Windows\System\kaReOfU.exe
  C:\Windows\System\kaReOfU.exe
  2⤵
  PID:5480
- C:\Windows\System\mPZlxII.exe
  C:\Windows\System\mPZlxII.exe
  2⤵
  PID:5496
- C:\Windows\System\LVgyydk.exe
  C:\Windows\System\LVgyydk.exe
  2⤵
  PID:5512
- C:\Windows\System\oJDATAC.exe
  C:\Windows\System\oJDATAC.exe
  2⤵
  PID:5528
- C:\Windows\System\GgPvOcn.exe
  C:\Windows\System\GgPvOcn.exe
  2⤵
  PID:5544
- C:\Windows\System\EPhnoSh.exe
  C:\Windows\System\EPhnoSh.exe
  2⤵
  PID:5560
- C:\Windows\System\JUwTYWX.exe
  C:\Windows\System\JUwTYWX.exe
  2⤵
  PID:5576
- C:\Windows\System\FPHSGdm.exe
  C:\Windows\System\FPHSGdm.exe
  2⤵
  PID:5592
- C:\Windows\System\ZDcoEXl.exe
  C:\Windows\System\ZDcoEXl.exe
  2⤵
  PID:5608
- C:\Windows\System\eLlDgXJ.exe
  C:\Windows\System\eLlDgXJ.exe
  2⤵
  PID:5624
- C:\Windows\System\wuRPygB.exe
  C:\Windows\System\wuRPygB.exe
  2⤵
  PID:5640
- C:\Windows\System\LvGnEOT.exe
  C:\Windows\System\LvGnEOT.exe
  2⤵
  PID:5656
- C:\Windows\System\keqwcqO.exe
  C:\Windows\System\keqwcqO.exe
  2⤵
  PID:5676
- C:\Windows\System\FnRphlb.exe
  C:\Windows\System\FnRphlb.exe
  2⤵
  PID:5692
- C:\Windows\System\ijktCAl.exe
  C:\Windows\System\ijktCAl.exe
  2⤵
  PID:5708
- C:\Windows\System\CXEnpqT.exe
  C:\Windows\System\CXEnpqT.exe
  2⤵
  PID:5724
- C:\Windows\System\YsZxFVv.exe
  C:\Windows\System\YsZxFVv.exe
  2⤵
  PID:5740
- C:\Windows\System\kDSfKGR.exe
  C:\Windows\System\kDSfKGR.exe
  2⤵
  PID:5756
- C:\Windows\System\ZLgapYV.exe
  C:\Windows\System\ZLgapYV.exe
  2⤵
  PID:5772
- C:\Windows\System\UAaYZXZ.exe
  C:\Windows\System\UAaYZXZ.exe
  2⤵
  PID:5788
- C:\Windows\System\uqcNLNF.exe
  C:\Windows\System\uqcNLNF.exe
  2⤵
  PID:5804
- C:\Windows\System\jfxbrHW.exe
  C:\Windows\System\jfxbrHW.exe
  2⤵
  PID:5820
- C:\Windows\System\aUDMEhJ.exe
  C:\Windows\System\aUDMEhJ.exe
  2⤵
  PID:5836
- C:\Windows\System\ypzegOg.exe
  C:\Windows\System\ypzegOg.exe
  2⤵
  PID:5852
- C:\Windows\System\ohjEZQF.exe
  C:\Windows\System\ohjEZQF.exe
  2⤵
  PID:5868
- C:\Windows\System\OKFlpZG.exe
  C:\Windows\System\OKFlpZG.exe
  2⤵
  PID:5884
- C:\Windows\System\KIkpoxE.exe
  C:\Windows\System\KIkpoxE.exe
  2⤵
  PID:5900
- C:\Windows\System\AocYPqn.exe
  C:\Windows\System\AocYPqn.exe
  2⤵
  PID:5920
- C:\Windows\System\CnbfDpS.exe
  C:\Windows\System\CnbfDpS.exe
  2⤵
  PID:5936
- C:\Windows\System\AcxzsFK.exe
  C:\Windows\System\AcxzsFK.exe
  2⤵
  PID:5952
- C:\Windows\System\EpdYBVu.exe
  C:\Windows\System\EpdYBVu.exe
  2⤵
  PID:5968
- C:\Windows\System\tsqbBxt.exe
  C:\Windows\System\tsqbBxt.exe
  2⤵
  PID:5984
- C:\Windows\System\hlogllA.exe
  C:\Windows\System\hlogllA.exe
  2⤵
  PID:6000
- C:\Windows\System\lpLJAqu.exe
  C:\Windows\System\lpLJAqu.exe
  2⤵
  PID:6016
- C:\Windows\System\EjFBYRN.exe
  C:\Windows\System\EjFBYRN.exe
  2⤵
  PID:6032
- C:\Windows\System\dBcogve.exe
  C:\Windows\System\dBcogve.exe
  2⤵
  PID:6048
- C:\Windows\System\yEILKWm.exe
  C:\Windows\System\yEILKWm.exe
  2⤵
  PID:6064
- C:\Windows\System\HrxpIHx.exe
  C:\Windows\System\HrxpIHx.exe
  2⤵
  PID:6080
- C:\Windows\System\RFRMoFk.exe
  C:\Windows\System\RFRMoFk.exe
  2⤵
  PID:6096
- C:\Windows\System\ooUrXDp.exe
  C:\Windows\System\ooUrXDp.exe
  2⤵
  PID:6112
- C:\Windows\System\mboROrG.exe
  C:\Windows\System\mboROrG.exe
  2⤵
  PID:6128
- C:\Windows\System\hJjjknh.exe
  C:\Windows\System\hJjjknh.exe
  2⤵
  PID:2692
- C:\Windows\System\zmFFptw.exe
  C:\Windows\System\zmFFptw.exe
  2⤵
  PID:536
- C:\Windows\System\UcNadsT.exe
  C:\Windows\System\UcNadsT.exe
  2⤵
  PID:1436
- C:\Windows\System\JmbmKzF.exe
  C:\Windows\System\JmbmKzF.exe
  2⤵
  PID:4488
- C:\Windows\System\sMtlXYy.exe
  C:\Windows\System\sMtlXYy.exe
  2⤵
  PID:5068
- C:\Windows\System\LSJAffR.exe
  C:\Windows\System\LSJAffR.exe
  2⤵
  PID:3840
- C:\Windows\System\RpTteoz.exe
  C:\Windows\System\RpTteoz.exe
  2⤵
  PID:3648
- C:\Windows\System\jGGJgjt.exe
  C:\Windows\System\jGGJgjt.exe
  2⤵
  PID:1872
- C:\Windows\System\QobTkrC.exe
  C:\Windows\System\QobTkrC.exe
  2⤵
  PID:4232
- C:\Windows\System\xyhGTOJ.exe
  C:\Windows\System\xyhGTOJ.exe
  2⤵
  PID:3856
- C:\Windows\System\QkIFyyZ.exe
  C:\Windows\System\QkIFyyZ.exe
  2⤵
  PID:2744
- C:\Windows\System\zOdHGTD.exe
  C:\Windows\System\zOdHGTD.exe
  2⤵
  PID:4196
- C:\Windows\System\wVHGGWD.exe
  C:\Windows\System\wVHGGWD.exe
  2⤵
  PID:4424
- C:\Windows\System\vxknCUB.exe
  C:\Windows\System\vxknCUB.exe
  2⤵
  PID:2224
- C:\Windows\System\vfTrtMt.exe
  C:\Windows\System\vfTrtMt.exe
  2⤵
  PID:4452
- C:\Windows\System\OAvrVfC.exe
  C:\Windows\System\OAvrVfC.exe
  2⤵
  PID:4148
- C:\Windows\System\AKQxpLK.exe
  C:\Windows\System\AKQxpLK.exe
  2⤵
  PID:4244
- C:\Windows\System\BUdSErK.exe
  C:\Windows\System\BUdSErK.exe
  2⤵
  PID:2928
- C:\Windows\System\YIAqkqs.exe
  C:\Windows\System\YIAqkqs.exe
  2⤵
  PID:4532
- C:\Windows\System\AxTgTLE.exe
  C:\Windows\System\AxTgTLE.exe
  2⤵
  PID:2564
- C:\Windows\System\dZDmdMC.exe
  C:\Windows\System\dZDmdMC.exe
  2⤵
  PID:2748
- C:\Windows\System\QtEuKdW.exe
  C:\Windows\System\QtEuKdW.exe
  2⤵
  PID:5128
- C:\Windows\System\KjayIkW.exe
  C:\Windows\System\KjayIkW.exe
  2⤵
  PID:5144
- C:\Windows\System\mgQeoFX.exe
  C:\Windows\System\mgQeoFX.exe
  2⤵
  PID:5160
- C:\Windows\System\WUngUFJ.exe
  C:\Windows\System\WUngUFJ.exe
  2⤵
  PID:5176
- C:\Windows\System\hVjXRBs.exe
  C:\Windows\System\hVjXRBs.exe
  2⤵
  PID:5192
- C:\Windows\System\yKcfunQ.exe
  C:\Windows\System\yKcfunQ.exe
  2⤵
  PID:5208
- C:\Windows\System\fQEaPQh.exe
  C:\Windows\System\fQEaPQh.exe
  2⤵
  PID:5224
- C:\Windows\System\uaoFmIW.exe
  C:\Windows\System\uaoFmIW.exe
  2⤵
  PID:5240
- C:\Windows\System\xnhGOhc.exe
  C:\Windows\System\xnhGOhc.exe
  2⤵
  PID:5256
- C:\Windows\System\YYvhdWs.exe
  C:\Windows\System\YYvhdWs.exe
  2⤵
  PID:5272
- C:\Windows\System\XooBHcx.exe
  C:\Windows\System\XooBHcx.exe
  2⤵
  PID:5288
- C:\Windows\System\uCTBkbx.exe
  C:\Windows\System\uCTBkbx.exe
  2⤵
  PID:5304
- C:\Windows\System\nGHSXkI.exe
  C:\Windows\System\nGHSXkI.exe
  2⤵
  PID:5320
- C:\Windows\System\trkwIsp.exe
  C:\Windows\System\trkwIsp.exe
  2⤵
  PID:5336
- C:\Windows\System\ThpiQSY.exe
  C:\Windows\System\ThpiQSY.exe
  2⤵
  PID:4580
- C:\Windows\System\loYGbhW.exe
  C:\Windows\System\loYGbhW.exe
  2⤵
  PID:4788
- C:\Windows\System\ggvpbUX.exe
  C:\Windows\System\ggvpbUX.exe
  2⤵
  PID:4972
- C:\Windows\System\QeZxkxB.exe
  C:\Windows\System\QeZxkxB.exe
  2⤵
  PID:2944
- C:\Windows\System\xWLDxIN.exe
  C:\Windows\System\xWLDxIN.exe
  2⤵
  PID:3084
- C:\Windows\System\FTuJNGr.exe
  C:\Windows\System\FTuJNGr.exe
  2⤵
  PID:5016
- C:\Windows\System\cwtLKuZ.exe
  C:\Windows\System\cwtLKuZ.exe
  2⤵
  PID:1728
- C:\Windows\System\xyGAOAF.exe
  C:\Windows\System\xyGAOAF.exe
  2⤵
  PID:3384
- C:\Windows\System\EsmKvQG.exe
  C:\Windows\System\EsmKvQG.exe
  2⤵
  PID:5112
- C:\Windows\System\zLGumMb.exe
  C:\Windows\System\zLGumMb.exe
  2⤵
  PID:3276
- C:\Windows\System\uOKcoiJ.exe
  C:\Windows\System\uOKcoiJ.exe
  2⤵
  PID:3744
- C:\Windows\System\wFerZGU.exe
  C:\Windows\System\wFerZGU.exe
  2⤵
  PID:1920
- C:\Windows\System\VdXbWlv.exe
  C:\Windows\System\VdXbWlv.exe
  2⤵
  PID:952
- C:\Windows\System\mXDRLcY.exe
  C:\Windows\System\mXDRLcY.exe
  2⤵
  PID:2660
- C:\Windows\System\HKVBNMv.exe
  C:\Windows\System\HKVBNMv.exe
  2⤵
  PID:1924
- C:\Windows\System\SWCuWaZ.exe
  C:\Windows\System\SWCuWaZ.exe
  2⤵
  PID:1268
- C:\Windows\System\gzGptzc.exe
  C:\Windows\System\gzGptzc.exe
  2⤵
  PID:2316
- C:\Windows\System\uBhEZaN.exe
  C:\Windows\System\uBhEZaN.exe
  2⤵
  PID:5360
- C:\Windows\System\vaCndSk.exe
  C:\Windows\System\vaCndSk.exe
  2⤵
  PID:5364
- C:\Windows\System\jEQFHgC.exe
  C:\Windows\System\jEQFHgC.exe
  2⤵
  PID:5376
- C:\Windows\System\YllQWGO.exe
  C:\Windows\System\YllQWGO.exe
  2⤵
  PID:5456
- C:\Windows\System\mumLZxe.exe
  C:\Windows\System\mumLZxe.exe
  2⤵
  PID:5412
- C:\Windows\System\yfpgLOe.exe
  C:\Windows\System\yfpgLOe.exe
  2⤵
  PID:5520
- C:\Windows\System\gjGqYoX.exe
  C:\Windows\System\gjGqYoX.exe
  2⤵
  PID:5444
- C:\Windows\System\WzRjfbE.exe
  C:\Windows\System\WzRjfbE.exe
  2⤵
  PID:5476
- C:\Windows\System\wUqXaIc.exe
  C:\Windows\System\wUqXaIc.exe
  2⤵
  PID:5616
- C:\Windows\System\cnuUZfS.exe
  C:\Windows\System\cnuUZfS.exe
  2⤵
  PID:5568
- C:\Windows\System\Kqokvgw.exe
  C:\Windows\System\Kqokvgw.exe
  2⤵
  PID:5684
- C:\Windows\System\wItkmev.exe
  C:\Windows\System\wItkmev.exe
  2⤵
  PID:5600
- C:\Windows\System\Ubwpbbx.exe
  C:\Windows\System\Ubwpbbx.exe
  2⤵
  PID:5664
- C:\Windows\System\MYSXplC.exe
  C:\Windows\System\MYSXplC.exe
  2⤵
  PID:5784
- C:\Windows\System\ijOARGd.exe
  C:\Windows\System\ijOARGd.exe
  2⤵
  PID:5816
- C:\Windows\System\leLrQhz.exe
  C:\Windows\System\leLrQhz.exe
  2⤵
  PID:5704
- C:\Windows\System\EAtQaQw.exe
  C:\Windows\System\EAtQaQw.exe
  2⤵
  PID:5912
- C:\Windows\System\xVOLeVl.exe
  C:\Windows\System\xVOLeVl.exe
  2⤵
  PID:5736
- C:\Windows\System\ZCLoUiV.exe
  C:\Windows\System\ZCLoUiV.exe
  2⤵
  PID:5892
- C:\Windows\System\umAwXcS.exe
  C:\Windows\System\umAwXcS.exe
  2⤵
  PID:5832
- C:\Windows\System\jIdgtJK.exe
  C:\Windows\System\jIdgtJK.exe
  2⤵
  PID:5932
- C:\Windows\System\EveVWAK.exe
  C:\Windows\System\EveVWAK.exe
  2⤵
  PID:5960
- C:\Windows\System\OTmxkJc.exe
  C:\Windows\System\OTmxkJc.exe
  2⤵
  PID:6008
- C:\Windows\System\sPvhpvd.exe
  C:\Windows\System\sPvhpvd.exe
  2⤵
  PID:6040
- C:\Windows\System\uPqpIuL.exe
  C:\Windows\System\uPqpIuL.exe
  2⤵
  PID:2360
- C:\Windows\System\CqFUeVh.exe
  C:\Windows\System\CqFUeVh.exe
  2⤵
  PID:6056
- C:\Windows\System\RjOTvRe.exe
  C:\Windows\System\RjOTvRe.exe
  2⤵
  PID:6108
- C:\Windows\System\nMcgLht.exe
  C:\Windows\System\nMcgLht.exe
  2⤵
  PID:6120
- C:\Windows\System\XuylHCJ.exe
  C:\Windows\System\XuylHCJ.exe
  2⤵
  PID:4936
- C:\Windows\System\xABGIZN.exe
  C:\Windows\System\xABGIZN.exe
  2⤵
  PID:4956
- C:\Windows\System\SwGGTnu.exe
  C:\Windows\System\SwGGTnu.exe
  2⤵
  PID:4484
- C:\Windows\System\LWbKnkM.exe
  C:\Windows\System\LWbKnkM.exe
  2⤵
  PID:308
- C:\Windows\System\jtEJcOP.exe
  C:\Windows\System\jtEJcOP.exe
  2⤵
  PID:1692
- C:\Windows\System\QPXklIX.exe
  C:\Windows\System\QPXklIX.exe
  2⤵
  PID:2896
- C:\Windows\System\WJiIFmz.exe
  C:\Windows\System\WJiIFmz.exe
  2⤵
  PID:1892
- C:\Windows\System\MmnOwoM.exe
  C:\Windows\System\MmnOwoM.exe
  2⤵
  PID:4336
- C:\Windows\System\JilxHJk.exe
  C:\Windows\System\JilxHJk.exe
  2⤵
  PID:4380
- C:\Windows\System\DNngtbj.exe
  C:\Windows\System\DNngtbj.exe
  2⤵
  PID:1932
- C:\Windows\System\lYQpcmA.exe
  C:\Windows\System\lYQpcmA.exe
  2⤵
  PID:2880
- C:\Windows\System\KdMXXJg.exe
  C:\Windows\System\KdMXXJg.exe
  2⤵
  PID:5152
- C:\Windows\System\EZgjXsF.exe
  C:\Windows\System\EZgjXsF.exe
  2⤵
  PID:5156
- C:\Windows\System\iJqfbrG.exe
  C:\Windows\System\iJqfbrG.exe
  2⤵
  PID:4744
- C:\Windows\System\TdMBSkF.exe
  C:\Windows\System\TdMBSkF.exe
  2⤵
  PID:5264
- C:\Windows\System\pdqKkPo.exe
  C:\Windows\System\pdqKkPo.exe
  2⤵
  PID:5332
- C:\Windows\System\HHrFDnF.exe
  C:\Windows\System\HHrFDnF.exe
  2⤵
  PID:5204
- C:\Windows\System\XPTduKt.exe
  C:\Windows\System\XPTduKt.exe
  2⤵
  PID:2260
- C:\Windows\System\xcEcMVs.exe
  C:\Windows\System\xcEcMVs.exe
  2⤵
  PID:5284
- C:\Windows\System\jOzSjHQ.exe
  C:\Windows\System\jOzSjHQ.exe
  2⤵
  PID:4760
- C:\Windows\System\GPoDrCV.exe
  C:\Windows\System\GPoDrCV.exe
  2⤵
  PID:4920
- C:\Windows\System\vsiHIVy.exe
  C:\Windows\System\vsiHIVy.exe
  2⤵
  PID:3080
- C:\Windows\System\ClHtWGn.exe
  C:\Windows\System\ClHtWGn.exe
  2⤵
  PID:5048
- C:\Windows\System\fwXLbgh.exe
  C:\Windows\System\fwXLbgh.exe
  2⤵
  PID:3728
- C:\Windows\System\lQRZkbN.exe
  C:\Windows\System\lQRZkbN.exe
  2⤵
  PID:2872
- C:\Windows\System\jNWByBE.exe
  C:\Windows\System\jNWByBE.exe
  2⤵
  PID:1916
- C:\Windows\System\EmOTGxL.exe
  C:\Windows\System\EmOTGxL.exe
  2⤵
  PID:1676
- C:\Windows\System\PcLROAR.exe
  C:\Windows\System\PcLROAR.exe
  2⤵
  PID:3288
- C:\Windows\System\bMopfOL.exe
  C:\Windows\System\bMopfOL.exe
  2⤵
  PID:2648
- C:\Windows\System\AybTcMu.exe
  C:\Windows\System\AybTcMu.exe
  2⤵
  PID:5488
- C:\Windows\System\WZWpTkS.exe
  C:\Windows\System\WZWpTkS.exe
  2⤵
  PID:5396
- C:\Windows\System\ytEKoXk.exe
  C:\Windows\System\ytEKoXk.exe
  2⤵
  PID:5552
- C:\Windows\System\QfYKpWU.exe
  C:\Windows\System\QfYKpWU.exe
  2⤵
  PID:5536
- C:\Windows\System\lBPFYtV.exe
  C:\Windows\System\lBPFYtV.exe
  2⤵
  PID:2620
- C:\Windows\System\fSrUxfD.exe
  C:\Windows\System\fSrUxfD.exe
  2⤵
  PID:5752
- C:\Windows\System\wZnWalW.exe
  C:\Windows\System\wZnWalW.exe
  2⤵
  PID:5844
- C:\Windows\System\rOaJJlw.exe
  C:\Windows\System\rOaJJlw.exe
  2⤵
  PID:5636
- C:\Windows\System\cpvoKzg.exe
  C:\Windows\System\cpvoKzg.exe
  2⤵
  PID:5928
- C:\Windows\System\qXWgTVL.exe
  C:\Windows\System\qXWgTVL.exe
  2⤵
  PID:5908
- C:\Windows\System\gMTgxYv.exe
  C:\Windows\System\gMTgxYv.exe
  2⤵
  PID:5948
- C:\Windows\System\CVBgyLb.exe
  C:\Windows\System\CVBgyLb.exe
  2⤵
  PID:5996
- C:\Windows\System\ELyXpgn.exe
  C:\Windows\System\ELyXpgn.exe
  2⤵
  PID:6072
- C:\Windows\System\lygvtBt.exe
  C:\Windows\System\lygvtBt.exe
  2⤵
  PID:6088
- C:\Windows\System\ATJaAnQ.exe
  C:\Windows\System\ATJaAnQ.exe
  2⤵
  PID:4932
- C:\Windows\System\AskKZjz.exe
  C:\Windows\System\AskKZjz.exe
  2⤵
  PID:4136
- C:\Windows\System\xjOODJA.exe
  C:\Windows\System\xjOODJA.exe
  2⤵
  PID:6140
- C:\Windows\System\hWBquDL.exe
  C:\Windows\System\hWBquDL.exe
  2⤵
  PID:2000
- C:\Windows\System\eFInAGg.exe
  C:\Windows\System\eFInAGg.exe
  2⤵
  PID:3632
- C:\Windows\System\wrcvTCS.exe
  C:\Windows\System\wrcvTCS.exe
  2⤵
  PID:5188
- C:\Windows\System\SSJLeKA.exe
  C:\Windows\System\SSJLeKA.exe
  2⤵
  PID:4500
- C:\Windows\System\FCSthDp.exe
  C:\Windows\System\FCSthDp.exe
  2⤵
  PID:3968
- C:\Windows\System\CgLHlDh.exe
  C:\Windows\System\CgLHlDh.exe
  2⤵
  PID:5220
- C:\Windows\System\dYJYPTo.exe
  C:\Windows\System\dYJYPTo.exe
  2⤵
  PID:5232
- C:\Windows\System\mBuVoHL.exe
  C:\Windows\System\mBuVoHL.exe
  2⤵
  PID:5316
- C:\Windows\System\NLfohqK.exe
  C:\Windows\System\NLfohqK.exe
  2⤵
  PID:4596
- C:\Windows\System\adyowPO.exe
  C:\Windows\System\adyowPO.exe
  2⤵
  PID:3144
- C:\Windows\System\IbKXWrP.exe
  C:\Windows\System\IbKXWrP.exe
  2⤵
  PID:1644
- C:\Windows\System\gQdRfdC.exe
  C:\Windows\System\gQdRfdC.exe
  2⤵
  PID:5428
- C:\Windows\System\mgHeDLh.exe
  C:\Windows\System\mgHeDLh.exe
  2⤵
  PID:4000
- C:\Windows\System\KijhRyr.exe
  C:\Windows\System\KijhRyr.exe
  2⤵
  PID:2596
- C:\Windows\System\NKLhwvf.exe
  C:\Windows\System\NKLhwvf.exe
  2⤵
  PID:2568
- C:\Windows\System\QBKMTKD.exe
  C:\Windows\System\QBKMTKD.exe
  2⤵
  PID:5780
- C:\Windows\System\TnqSCwO.exe
  C:\Windows\System\TnqSCwO.exe
  2⤵
  PID:3020
- C:\Windows\System\EkmGPcz.exe
  C:\Windows\System\EkmGPcz.exe
  2⤵
  PID:5812
- C:\Windows\System\YlWcuMm.exe
  C:\Windows\System\YlWcuMm.exe
  2⤵
  PID:2952
- C:\Windows\System\ocpbuhz.exe
  C:\Windows\System\ocpbuhz.exe
  2⤵
  PID:5916
- C:\Windows\System\OGTNKTF.exe
  C:\Windows\System\OGTNKTF.exe
  2⤵
  PID:3064
- C:\Windows\System\Ediemod.exe
  C:\Windows\System\Ediemod.exe
  2⤵
  PID:5236
- C:\Windows\System\gGmREFD.exe
  C:\Windows\System\gGmREFD.exe
  2⤵
  PID:5252
- C:\Windows\System\WnlIgut.exe
  C:\Windows\System\WnlIgut.exe
  2⤵
  PID:4284
- C:\Windows\System\GdLXYWi.exe
  C:\Windows\System\GdLXYWi.exe
  2⤵
  PID:5124
- C:\Windows\System\VjYfpqd.exe
  C:\Windows\System\VjYfpqd.exe
  2⤵
  PID:2644
- C:\Windows\System\FZBVqlX.exe
  C:\Windows\System\FZBVqlX.exe
  2⤵
  PID:5716
- C:\Windows\System\NdNGzyZ.exe
  C:\Windows\System\NdNGzyZ.exe
  2⤵
  PID:4804
- C:\Windows\System\DYXdWYQ.exe
  C:\Windows\System\DYXdWYQ.exe
  2⤵
  PID:2552
- C:\Windows\System\LsgDQRk.exe
  C:\Windows\System\LsgDQRk.exe
  2⤵
  PID:2284
- C:\Windows\System\XnUSBWb.exe
  C:\Windows\System\XnUSBWb.exe
  2⤵
  PID:5880
- C:\Windows\System\SEVvpBk.exe
  C:\Windows\System\SEVvpBk.exe
  2⤵
  PID:5100
- C:\Windows\System\uZSRacp.exe
  C:\Windows\System\uZSRacp.exe
  2⤵
  PID:5632
- C:\Windows\System\DhFQzIS.exe
  C:\Windows\System\DhFQzIS.exe
  2⤵
  PID:4388
- C:\Windows\System\LeTsiyP.exe
  C:\Windows\System\LeTsiyP.exe
  2⤵
  PID:3776
- C:\Windows\System\OjsJTOu.exe
  C:\Windows\System\OjsJTOu.exe
  2⤵
  PID:4740
- C:\Windows\System\UGwPYCJ.exe
  C:\Windows\System\UGwPYCJ.exe
  2⤵
  PID:4436
- C:\Windows\System\iQchPSG.exe
  C:\Windows\System\iQchPSG.exe
  2⤵
  PID:6148
- C:\Windows\System\WTppVlo.exe
  C:\Windows\System\WTppVlo.exe
  2⤵
  PID:6164
- C:\Windows\System\lhMQERn.exe
  C:\Windows\System\lhMQERn.exe
  2⤵
  PID:6180
- C:\Windows\System\AkSdRIn.exe
  C:\Windows\System\AkSdRIn.exe
  2⤵
  PID:6196
- C:\Windows\System\JpwDbGE.exe
  C:\Windows\System\JpwDbGE.exe
  2⤵
  PID:6484
- C:\Windows\System\kbjjrjx.exe
  C:\Windows\System\kbjjrjx.exe
  2⤵
  PID:6568
- C:\Windows\System\KVxzUqm.exe
  C:\Windows\System\KVxzUqm.exe
  2⤵
  PID:6588
- C:\Windows\System\JgRcSBm.exe
  C:\Windows\System\JgRcSBm.exe
  2⤵
  PID:6608
- C:\Windows\System\tFQqGrI.exe
  C:\Windows\System\tFQqGrI.exe
  2⤵
  PID:6716
- C:\Windows\System\YALdaKO.exe
  C:\Windows\System\YALdaKO.exe
  2⤵
  PID:6736
- C:\Windows\System\pnjcNks.exe
  C:\Windows\System\pnjcNks.exe
  2⤵
  PID:6752
- C:\Windows\System\ABzHgbY.exe
  C:\Windows\System\ABzHgbY.exe
  2⤵
  PID:6768
- C:\Windows\System\XwuWxrk.exe
  C:\Windows\System\XwuWxrk.exe
  2⤵
  PID:6784
- C:\Windows\System\IMQrQwK.exe
  C:\Windows\System\IMQrQwK.exe
  2⤵
  PID:6800
- C:\Windows\System\WGPGmwD.exe
  C:\Windows\System\WGPGmwD.exe
  2⤵
  PID:6816
- C:\Windows\System\SDsMUzf.exe
  C:\Windows\System\SDsMUzf.exe
  2⤵
  PID:6832
- C:\Windows\System\KFAqcvt.exe
  C:\Windows\System\KFAqcvt.exe
  2⤵
  PID:6848
- C:\Windows\System\lCRDOCu.exe
  C:\Windows\System\lCRDOCu.exe
  2⤵
  PID:6864
- C:\Windows\System\HpWEfSI.exe
  C:\Windows\System\HpWEfSI.exe
  2⤵
  PID:6880
- C:\Windows\System\EVaPlAi.exe
  C:\Windows\System\EVaPlAi.exe
  2⤵
  PID:6896
- C:\Windows\System\czeaZZb.exe
  C:\Windows\System\czeaZZb.exe
  2⤵
  PID:6912
- C:\Windows\System\HePXTtZ.exe
  C:\Windows\System\HePXTtZ.exe
  2⤵
  PID:6928
- C:\Windows\System\arYgMxu.exe
  C:\Windows\System\arYgMxu.exe
  2⤵
  PID:6944
- C:\Windows\System\kPYbxBc.exe
  C:\Windows\System\kPYbxBc.exe
  2⤵
  PID:6960
- C:\Windows\System\odsvhfp.exe
  C:\Windows\System\odsvhfp.exe
  2⤵
  PID:7012
- C:\Windows\System\tMUtDMV.exe
  C:\Windows\System\tMUtDMV.exe
  2⤵
  PID:7044
- C:\Windows\System\zpxrMjP.exe
  C:\Windows\System\zpxrMjP.exe
  2⤵
  PID:7060
- C:\Windows\System\QzwEesU.exe
  C:\Windows\System\QzwEesU.exe
  2⤵
  PID:7116
- C:\Windows\System\synnVbY.exe
  C:\Windows\System\synnVbY.exe
  2⤵
  PID:7132
- C:\Windows\System\XwvrKdN.exe
  C:\Windows\System\XwvrKdN.exe
  2⤵
  PID:7148
- C:\Windows\System\YkgrSkw.exe
  C:\Windows\System\YkgrSkw.exe
  2⤵
  PID:4680
- C:\Windows\System\WwdZZsK.exe
  C:\Windows\System\WwdZZsK.exe
  2⤵
  PID:2120
- C:\Windows\System\uDOVzZV.exe
  C:\Windows\System\uDOVzZV.exe
  2⤵
  PID:6076
- C:\Windows\System\mzbwrTc.exe
  C:\Windows\System\mzbwrTc.exe
  2⤵
  PID:6160
- C:\Windows\System\pTOubdy.exe
  C:\Windows\System\pTOubdy.exe
  2⤵
  PID:6224
- C:\Windows\System\SYhwAPa.exe
  C:\Windows\System\SYhwAPa.exe
  2⤵
  PID:6240
- C:\Windows\System\uEdooMF.exe
  C:\Windows\System\uEdooMF.exe
  2⤵
  PID:6272
- C:\Windows\System\PWZhHxa.exe
  C:\Windows\System\PWZhHxa.exe
  2⤵
  PID:6268
- C:\Windows\System\nRwWKiy.exe
  C:\Windows\System\nRwWKiy.exe
  2⤵
  PID:6288
- C:\Windows\System\ZizLxty.exe
  C:\Windows\System\ZizLxty.exe
  2⤵
  PID:6304
- C:\Windows\System\POjsJtQ.exe
  C:\Windows\System\POjsJtQ.exe
  2⤵
  PID:4952
- C:\Windows\System\HPYxXqO.exe
  C:\Windows\System\HPYxXqO.exe
  2⤵
  PID:6336
- C:\Windows\System\XhWXPre.exe
  C:\Windows\System\XhWXPre.exe
  2⤵
  PID:6352
- C:\Windows\System\JmQXMIh.exe
  C:\Windows\System\JmQXMIh.exe
  2⤵
  PID:6368
- C:\Windows\System\dPIcExd.exe
  C:\Windows\System\dPIcExd.exe
  2⤵
  PID:6400
- C:\Windows\System\zImmAeU.exe
  C:\Windows\System\zImmAeU.exe
  2⤵
  PID:6408
- C:\Windows\System\wADQTmg.exe
  C:\Windows\System\wADQTmg.exe
  2⤵
  PID:6392
- C:\Windows\System\nOPemiZ.exe
  C:\Windows\System\nOPemiZ.exe
  2⤵
  PID:6432
- C:\Windows\System\Hytdivv.exe
  C:\Windows\System\Hytdivv.exe
  2⤵
  PID:6448
- C:\Windows\System\KeFtnLX.exe
  C:\Windows\System\KeFtnLX.exe
  2⤵
  PID:6464
- C:\Windows\System\DMinDIM.exe
  C:\Windows\System\DMinDIM.exe
  2⤵
  PID:6480
- C:\Windows\System\SiNDWzZ.exe
  C:\Windows\System\SiNDWzZ.exe
  2⤵
  PID:6500
- C:\Windows\System\HwBYFlJ.exe
  C:\Windows\System\HwBYFlJ.exe
  2⤵
  PID:6516
- C:\Windows\System\QjtQilw.exe
  C:\Windows\System\QjtQilw.exe
  2⤵
  PID:6532
- C:\Windows\System\LkAZIDq.exe
  C:\Windows\System\LkAZIDq.exe
  2⤵
  PID:6548
- C:\Windows\System\DKhApue.exe
  C:\Windows\System\DKhApue.exe
  2⤵
  PID:6508
- C:\Windows\System\bxSNply.exe
  C:\Windows\System\bxSNply.exe
  2⤵
  PID:6576
- C:\Windows\System\VZeaSZZ.exe
  C:\Windows\System\VZeaSZZ.exe
  2⤵
  PID:6636
- C:\Windows\System\YQwFKuI.exe
  C:\Windows\System\YQwFKuI.exe
  2⤵
  PID:6660
- C:\Windows\System\dGsdXuI.exe
  C:\Windows\System\dGsdXuI.exe
  2⤵
  PID:6676
- C:\Windows\System\duhicjk.exe
  C:\Windows\System\duhicjk.exe
  2⤵
  PID:6692
- C:\Windows\System\dKJluVG.exe
  C:\Windows\System\dKJluVG.exe
  2⤵
  PID:6708
- C:\Windows\System\qmCCGcy.exe
  C:\Windows\System\qmCCGcy.exe
  2⤵
  PID:6584
- C:\Windows\System\gjPEkrq.exe
  C:\Windows\System\gjPEkrq.exe
  2⤵
  PID:6632
- C:\Windows\System\rwgfeGI.exe
  C:\Windows\System\rwgfeGI.exe
  2⤵
  PID:2996
- C:\Windows\System\DebjpOJ.exe
  C:\Windows\System\DebjpOJ.exe
  2⤵
  PID:6812
- C:\Windows\System\ZHoINNY.exe
  C:\Windows\System\ZHoINNY.exe
  2⤵
  PID:6744
- C:\Windows\System\OWrZPkv.exe
  C:\Windows\System\OWrZPkv.exe
  2⤵
  PID:6904
- C:\Windows\System\OOqsGRf.exe
  C:\Windows\System\OOqsGRf.exe
  2⤵
  PID:6940
- C:\Windows\System\UIwpeSW.exe
  C:\Windows\System\UIwpeSW.exe
  2⤵
  PID:6796
- C:\Windows\System\GqVuoRL.exe
  C:\Windows\System\GqVuoRL.exe
  2⤵
  PID:6976
- C:\Windows\System\tXzPrJa.exe
  C:\Windows\System\tXzPrJa.exe
  2⤵
  PID:6888
- C:\Windows\System\ZQDCCdV.exe
  C:\Windows\System\ZQDCCdV.exe
  2⤵
  PID:6952
- C:\Windows\System\EoHuLkx.exe
  C:\Windows\System\EoHuLkx.exe
  2⤵
  PID:6956
- C:\Windows\System\HifwCBY.exe
  C:\Windows\System\HifwCBY.exe
  2⤵
  PID:7004
- C:\Windows\System\iUVCbUJ.exe
  C:\Windows\System\iUVCbUJ.exe
  2⤵
  PID:7124
- C:\Windows\System\YLxTYxT.exe
  C:\Windows\System\YLxTYxT.exe
  2⤵
  PID:7164
- C:\Windows\System\yiIimqo.exe
  C:\Windows\System\yiIimqo.exe
  2⤵
  PID:6252
- C:\Windows\System\UkDAJvL.exe
  C:\Windows\System\UkDAJvL.exe
  2⤵
  PID:6276
- C:\Windows\System\npnDrmQ.exe
  C:\Windows\System\npnDrmQ.exe
  2⤵
  PID:6348
- C:\Windows\System\LrQcZIC.exe
  C:\Windows\System\LrQcZIC.exe
  2⤵
  PID:6384
- C:\Windows\System\biNKuwf.exe
  C:\Windows\System\biNKuwf.exe
  2⤵
  PID:6444
- C:\Windows\System\ZfZTcaC.exe
  C:\Windows\System\ZfZTcaC.exe
  2⤵
  PID:6540
- C:\Windows\System\qUuSRYo.exe
  C:\Windows\System\qUuSRYo.exe
  2⤵
  PID:7076
- C:\Windows\System\YKGjwmO.exe
  C:\Windows\System\YKGjwmO.exe
  2⤵
  PID:7144
- C:\Windows\System\jcBNdKo.exe
  C:\Windows\System\jcBNdKo.exe
  2⤵
  PID:7080
- C:\Windows\System\pmfdKnp.exe
  C:\Windows\System\pmfdKnp.exe
  2⤵
  PID:6624
- C:\Windows\System\RmoBWJp.exe
  C:\Windows\System\RmoBWJp.exe
  2⤵
  PID:6792
- C:\Windows\System\DQqjOCj.exe
  C:\Windows\System\DQqjOCj.exe
  2⤵
  PID:6920
- C:\Windows\System\NcUdrSv.exe
  C:\Windows\System\NcUdrSv.exe
  2⤵
  PID:7156
- C:\Windows\System\otLvmYk.exe
  C:\Windows\System\otLvmYk.exe
  2⤵
  PID:6380
- C:\Windows\System\EjDXkKZ.exe
  C:\Windows\System\EjDXkKZ.exe
  2⤵
  PID:6656
- C:\Windows\System\uFUojae.exe
  C:\Windows\System\uFUojae.exe
  2⤵
  PID:6828
- C:\Windows\System\sXVtOAY.exe
  C:\Windows\System\sXVtOAY.exe
  2⤵
  PID:7172
- C:\Windows\System\FxlQMxL.exe
  C:\Windows\System\FxlQMxL.exe
  2⤵
  PID:7188
- C:\Windows\System\evsHeYx.exe
  C:\Windows\System\evsHeYx.exe
  2⤵
  PID:7268
- C:\Windows\System\QcvSBOm.exe
  C:\Windows\System\QcvSBOm.exe
  2⤵
  PID:7284
- C:\Windows\System\jeikQcr.exe
  C:\Windows\System\jeikQcr.exe
  2⤵
  PID:7300
- C:\Windows\System\WGQlKri.exe
  C:\Windows\System\WGQlKri.exe
  2⤵
  PID:7316
- C:\Windows\System\SIElRxq.exe
  C:\Windows\System\SIElRxq.exe
  2⤵
  PID:7332
- C:\Windows\System\SHuJdqv.exe
  C:\Windows\System\SHuJdqv.exe
  2⤵
  PID:7348
- C:\Windows\System\BYMKUmh.exe
  C:\Windows\System\BYMKUmh.exe
  2⤵
  PID:7364
- C:\Windows\System\vlsLTeM.exe
  C:\Windows\System\vlsLTeM.exe
  2⤵
  PID:7380
- C:\Windows\System\peLKAvV.exe
  C:\Windows\System\peLKAvV.exe
  2⤵
  PID:7396
- C:\Windows\System\GMqtRXx.exe
  C:\Windows\System\GMqtRXx.exe
  2⤵
  PID:7412
- C:\Windows\System\mZTyLbE.exe
  C:\Windows\System\mZTyLbE.exe
  2⤵
  PID:7428
- C:\Windows\System\ZHtkMvi.exe
  C:\Windows\System\ZHtkMvi.exe
  2⤵
  PID:7444
- C:\Windows\System\flXkQpg.exe
  C:\Windows\System\flXkQpg.exe
  2⤵
  PID:7460
- C:\Windows\System\GmorcUi.exe
  C:\Windows\System\GmorcUi.exe
  2⤵
  PID:7476
- C:\Windows\System\leNaDMi.exe
  C:\Windows\System\leNaDMi.exe
  2⤵
  PID:7492
- C:\Windows\System\YbSqxds.exe
  C:\Windows\System\YbSqxds.exe
  2⤵
  PID:7508
- C:\Windows\System\XoemdSb.exe
  C:\Windows\System\XoemdSb.exe
  2⤵
  PID:7524
- C:\Windows\System\UkrbSCe.exe
  C:\Windows\System\UkrbSCe.exe
  2⤵
  PID:7540
- C:\Windows\System\IWpeYKV.exe
  C:\Windows\System\IWpeYKV.exe
  2⤵
  PID:7556
- C:\Windows\System\RTityBM.exe
  C:\Windows\System\RTityBM.exe
  2⤵
  PID:7572
- C:\Windows\System\TWELdCb.exe
  C:\Windows\System\TWELdCb.exe
  2⤵
  PID:7588
- C:\Windows\System\ltATzJf.exe
  C:\Windows\System\ltATzJf.exe
  2⤵
  PID:7608
- C:\Windows\System\pKDFFMV.exe
  C:\Windows\System\pKDFFMV.exe
  2⤵
  PID:7624
- C:\Windows\System\GTLoOqH.exe
  C:\Windows\System\GTLoOqH.exe
  2⤵
  PID:7640
- C:\Windows\System\hquGvkF.exe
  C:\Windows\System\hquGvkF.exe
  2⤵
  PID:7656
- C:\Windows\System\IHUDKUQ.exe
  C:\Windows\System\IHUDKUQ.exe
  2⤵
  PID:7672
- C:\Windows\System\oqyCFqK.exe
  C:\Windows\System\oqyCFqK.exe
  2⤵
  PID:7688
- C:\Windows\System\cOaCcUW.exe
  C:\Windows\System\cOaCcUW.exe
  2⤵
  PID:7704
- C:\Windows\System\wCNXyNy.exe
  C:\Windows\System\wCNXyNy.exe
  2⤵
  PID:7720
- C:\Windows\System\PJiVEzk.exe
  C:\Windows\System\PJiVEzk.exe
  2⤵
  PID:7736
- C:\Windows\System\tAjtSTK.exe
  C:\Windows\System\tAjtSTK.exe
  2⤵
  PID:7752
- C:\Windows\System\uVZHTXh.exe
  C:\Windows\System\uVZHTXh.exe
  2⤵
  PID:7768
- C:\Windows\System\DolgBLh.exe
  C:\Windows\System\DolgBLh.exe
  2⤵
  PID:7784
- C:\Windows\System\qiATGpT.exe
  C:\Windows\System\qiATGpT.exe
  2⤵
  PID:7800
- C:\Windows\System\AIDijFh.exe
  C:\Windows\System\AIDijFh.exe
  2⤵
  PID:7816
- C:\Windows\System\nfQbaoX.exe
  C:\Windows\System\nfQbaoX.exe
  2⤵
  PID:7832
- C:\Windows\System\VQoePGC.exe
  C:\Windows\System\VQoePGC.exe
  2⤵
  PID:7848
- C:\Windows\System\YSpZuGM.exe
  C:\Windows\System\YSpZuGM.exe
  2⤵
  PID:7864
- C:\Windows\System\GehlGVs.exe
  C:\Windows\System\GehlGVs.exe
  2⤵
  PID:7880
- C:\Windows\System\lGWVWpL.exe
  C:\Windows\System\lGWVWpL.exe
  2⤵
  PID:7896
- C:\Windows\System\yUUKoAT.exe
  C:\Windows\System\yUUKoAT.exe
  2⤵
  PID:7912
- C:\Windows\System\LVuBmIX.exe
  C:\Windows\System\LVuBmIX.exe
  2⤵
  PID:7928
- C:\Windows\System\VbtzSfK.exe
  C:\Windows\System\VbtzSfK.exe
  2⤵
  PID:7944
- C:\Windows\System\sftbORw.exe
  C:\Windows\System\sftbORw.exe
  2⤵
  PID:7960
- C:\Windows\System\kqNCIjt.exe
  C:\Windows\System\kqNCIjt.exe
  2⤵
  PID:7976
- C:\Windows\System\GauIRht.exe
  C:\Windows\System\GauIRht.exe
  2⤵
  PID:7992
- C:\Windows\System\fHrLdwP.exe
  C:\Windows\System\fHrLdwP.exe
  2⤵
  PID:8008
- C:\Windows\System\GJUWjtT.exe
  C:\Windows\System\GJUWjtT.exe
  2⤵
  PID:8028
- C:\Windows\System\iOmAnZm.exe
  C:\Windows\System\iOmAnZm.exe
  2⤵
  PID:8044
- C:\Windows\System\xSghTxv.exe
  C:\Windows\System\xSghTxv.exe
  2⤵
  PID:8060
- C:\Windows\System\halxMIX.exe
  C:\Windows\System\halxMIX.exe
  2⤵
  PID:8076
- C:\Windows\System\VzLgNFZ.exe
  C:\Windows\System\VzLgNFZ.exe
  2⤵
  PID:8092
- C:\Windows\System\RpsvASi.exe
  C:\Windows\System\RpsvASi.exe
  2⤵
  PID:8108
- C:\Windows\System\glniVyd.exe
  C:\Windows\System\glniVyd.exe
  2⤵
  PID:8124
- C:\Windows\System\BIVeOTc.exe
  C:\Windows\System\BIVeOTc.exe
  2⤵
  PID:8144
- C:\Windows\System\jAwONCX.exe
  C:\Windows\System\jAwONCX.exe
  2⤵
  PID:8160
- C:\Windows\System\ECXuCcC.exe
  C:\Windows\System\ECXuCcC.exe
  2⤵
  PID:8176
- C:\Windows\System\zpAtvyO.exe
  C:\Windows\System\zpAtvyO.exe
  2⤵
  PID:6748
- C:\Windows\System\qTadduP.exe
  C:\Windows\System\qTadduP.exe
  2⤵
  PID:6176
- C:\Windows\System\Qmwtsta.exe
  C:\Windows\System\Qmwtsta.exe
  2⤵
  PID:7020
- C:\Windows\System\faIbFWB.exe
  C:\Windows\System\faIbFWB.exe
  2⤵
  PID:7036
- C:\Windows\System\ABxtwrJ.exe
  C:\Windows\System\ABxtwrJ.exe
  2⤵
  PID:7072
- C:\Windows\System\HsrjViF.exe
  C:\Windows\System\HsrjViF.exe
  2⤵
  PID:7088
- C:\Windows\System\PSStEne.exe
  C:\Windows\System\PSStEne.exe
  2⤵
  PID:7104
- C:\Windows\System\zLBwSQw.exe
  C:\Windows\System\zLBwSQw.exe
  2⤵
  PID:6700
- C:\Windows\System\gjsVHLk.exe
  C:\Windows\System\gjsVHLk.exe
  2⤵
  PID:6364
- C:\Windows\System\sNyanPY.exe
  C:\Windows\System\sNyanPY.exe
  2⤵
  PID:6236
- C:\Windows\System\VLyHFIX.exe
  C:\Windows\System\VLyHFIX.exe
  2⤵
  PID:6332
- C:\Windows\System\nQYmEus.exe
  C:\Windows\System\nQYmEus.exe
  2⤵
  PID:6460
- C:\Windows\System\SRDDxCo.exe
  C:\Windows\System\SRDDxCo.exe
  2⤵
  PID:6528
- C:\Windows\System\sjCZiHW.exe
  C:\Windows\System\sjCZiHW.exe
  2⤵
  PID:6704
- C:\Windows\System\qMeJOyi.exe
  C:\Windows\System\qMeJOyi.exe
  2⤵
  PID:6344
- C:\Windows\System\UIKTuww.exe
  C:\Windows\System\UIKTuww.exe
  2⤵
  PID:7280
- C:\Windows\System\bPpWRdT.exe
  C:\Windows\System\bPpWRdT.exe
  2⤵
  PID:2656
- C:\Windows\System\tmngNFZ.exe
  C:\Windows\System\tmngNFZ.exe
  2⤵
  PID:7376
- C:\Windows\System\IajghXf.exe
  C:\Windows\System\IajghXf.exe
  2⤵
  PID:7440
- C:\Windows\System\NIPeWBZ.exe
  C:\Windows\System\NIPeWBZ.exe
  2⤵
  PID:6876
- C:\Windows\System\rQtCfYC.exe
  C:\Windows\System\rQtCfYC.exe
  2⤵
  PID:2508
- C:\Windows\System\UdApCtq.exe
  C:\Windows\System\UdApCtq.exe
  2⤵
  PID:7472
- C:\Windows\System\fuatOBQ.exe
  C:\Windows\System\fuatOBQ.exe
  2⤵
  PID:7504
- C:\Windows\System\qzkxlFF.exe
  C:\Windows\System\qzkxlFF.exe
  2⤵
  PID:6604
- C:\Windows\System\kMTXuZu.exe
  C:\Windows\System\kMTXuZu.exe
  2⤵
  PID:7000
- C:\Windows\System\GpuEPGD.exe
  C:\Windows\System\GpuEPGD.exe
  2⤵
  PID:7196
- C:\Windows\System\inSWRSq.exe
  C:\Windows\System\inSWRSq.exe
  2⤵
  PID:7636
- C:\Windows\System\siNrzTd.exe
  C:\Windows\System\siNrzTd.exe
  2⤵
  PID:7696
- C:\Windows\System\fpwtXPN.exe
  C:\Windows\System\fpwtXPN.exe
  2⤵
  PID:7760
- C:\Windows\System\YWRlMvw.exe
  C:\Windows\System\YWRlMvw.exe
  2⤵
  PID:7828
- C:\Windows\System\xmYgrKS.exe
  C:\Windows\System\xmYgrKS.exe
  2⤵
  PID:7892
- C:\Windows\System\priSKhh.exe
  C:\Windows\System\priSKhh.exe
  2⤵
  PID:7952
- C:\Windows\System\wnpCbHQ.exe
  C:\Windows\System\wnpCbHQ.exe
  2⤵
  PID:8016
- C:\Windows\System\rTqrqZG.exe
  C:\Windows\System\rTqrqZG.exe
  2⤵
  PID:8052
- C:\Windows\System\TmHdGgs.exe
  C:\Windows\System\TmHdGgs.exe
  2⤵
  PID:7200
- C:\Windows\System\YpehINk.exe
  C:\Windows\System\YpehINk.exe
  2⤵
  PID:7904
- C:\Windows\System\SdFNCYs.exe
  C:\Windows\System\SdFNCYs.exe
  2⤵
  PID:7360
- C:\Windows\System\HnoTVtb.exe
  C:\Windows\System\HnoTVtb.exe
  2⤵
  PID:7548
- C:\Windows\System\KgZMmcL.exe
  C:\Windows\System\KgZMmcL.exe
  2⤵
  PID:7616
- C:\Windows\System\LUuSlPJ.exe
  C:\Windows\System\LUuSlPJ.exe
  2⤵
  PID:7296
- C:\Windows\System\fRWCGAc.exe
  C:\Windows\System\fRWCGAc.exe
  2⤵
  PID:7744
- C:\Windows\System\pLbmgtV.exe
  C:\Windows\System\pLbmgtV.exe
  2⤵
  PID:7780
- C:\Windows\System\IpcAILK.exe
  C:\Windows\System\IpcAILK.exe
  2⤵
  PID:7872
- C:\Windows\System\EyjANlE.exe
  C:\Windows\System\EyjANlE.exe
  2⤵
  PID:8000
- C:\Windows\System\HOpDxBp.exe
  C:\Windows\System\HOpDxBp.exe
  2⤵
  PID:7456
- C:\Windows\System\zeZUJMf.exe
  C:\Windows\System\zeZUJMf.exe
  2⤵
  PID:8072
- C:\Windows\System\BZcFSbu.exe
  C:\Windows\System\BZcFSbu.exe
  2⤵
  PID:8152
- C:\Windows\System\KGAiQzh.exe
  C:\Windows\System\KGAiQzh.exe
  2⤵
  PID:8184
- C:\Windows\System\TrHzyZi.exe
  C:\Windows\System\TrHzyZi.exe
  2⤵
  PID:6260
- C:\Windows\System\OmPRkMX.exe
  C:\Windows\System\OmPRkMX.exe
  2⤵
  PID:7096
- C:\Windows\System\jJjMHIi.exe
  C:\Windows\System\jJjMHIi.exe
  2⤵
  PID:8136
- C:\Windows\System\CtFiXrg.exe
  C:\Windows\System\CtFiXrg.exe
  2⤵
  PID:6496
- C:\Windows\System\fErSsGP.exe
  C:\Windows\System\fErSsGP.exe
  2⤵
  PID:7312
- C:\Windows\System\NlcfoZE.exe
  C:\Windows\System\NlcfoZE.exe
  2⤵
  PID:6984
- C:\Windows\System\MRrxTEW.exe
  C:\Windows\System\MRrxTEW.exe
  2⤵
  PID:6844
- C:\Windows\System\jLMsqAt.exe
  C:\Windows\System\jLMsqAt.exe
  2⤵
  PID:7340
- C:\Windows\System\yTqBZue.exe
  C:\Windows\System\yTqBZue.exe
  2⤵
  PID:6616
- C:\Windows\System\fpndExu.exe
  C:\Windows\System\fpndExu.exe
  2⤵
  PID:7184
- C:\Windows\System\aEQfSwA.exe
  C:\Windows\System\aEQfSwA.exe
  2⤵
  PID:7732
- C:\Windows\System\bvTANWf.exe
  C:\Windows\System\bvTANWf.exe
  2⤵
  PID:8116
- C:\Windows\System\kPKBVPW.exe
  C:\Windows\System\kPKBVPW.exe
  2⤵
  PID:6360
- C:\Windows\System\hhgdwQN.exe
  C:\Windows\System\hhgdwQN.exe
  2⤵
  PID:6668
- C:\Windows\System\GnldLXI.exe
  C:\Windows\System\GnldLXI.exe
  2⤵
  PID:2684
- C:\Windows\System\hIRRXLN.exe
  C:\Windows\System\hIRRXLN.exe
  2⤵
  PID:6420
- C:\Windows\System\qQgqoIC.exe
  C:\Windows\System\qQgqoIC.exe
  2⤵
  PID:7276
- C:\Windows\System\rSxvtXS.exe
  C:\Windows\System\rSxvtXS.exe
  2⤵
  PID:6808
- C:\Windows\System\RwFSGCk.exe
  C:\Windows\System\RwFSGCk.exe
  2⤵
  PID:7844
- C:\Windows\System\SWOvMXn.exe
  C:\Windows\System\SWOvMXn.exe
  2⤵
  PID:7552
- C:\Windows\System\PgwjaCG.exe
  C:\Windows\System\PgwjaCG.exe
  2⤵
  PID:6472
- C:\Windows\System\EqbXNEa.exe
  C:\Windows\System\EqbXNEa.exe
  2⤵
  PID:6440
- C:\Windows\System\NPNYDmE.exe
  C:\Windows\System\NPNYDmE.exe
  2⤵
  PID:7632
- C:\Windows\System\jCykHUE.exe
  C:\Windows\System\jCykHUE.exe
  2⤵
  PID:2052
- C:\Windows\System\iTVQJLb.exe
  C:\Windows\System\iTVQJLb.exe
  2⤵
  PID:7600
- C:\Windows\System\lXnEFQp.exe
  C:\Windows\System\lXnEFQp.exe
  2⤵
  PID:6244
- C:\Windows\System\fGyjRJt.exe
  C:\Windows\System\fGyjRJt.exe
  2⤵
  PID:7712
- C:\Windows\System\XjtYBoe.exe
  C:\Windows\System\XjtYBoe.exe
  2⤵
  PID:7052
- C:\Windows\System\iLqZyTA.exe
  C:\Windows\System\iLqZyTA.exe
  2⤵
  PID:6156
- C:\Windows\System\OckzIIT.exe
  C:\Windows\System\OckzIIT.exe
  2⤵
  PID:8040
- C:\Windows\System\WYFXnBL.exe
  C:\Windows\System\WYFXnBL.exe
  2⤵
  PID:7292
- C:\Windows\System\ZPXrtVZ.exe
  C:\Windows\System\ZPXrtVZ.exe
  2⤵
  PID:7748
- C:\Windows\System\mMOoiLL.exe
  C:\Windows\System\mMOoiLL.exe
  2⤵
  PID:7520
- C:\Windows\System\kjEuipJ.exe
  C:\Windows\System\kjEuipJ.exe
  2⤵
  PID:6300
- C:\Windows\System\CjZGSid.exe
  C:\Windows\System\CjZGSid.exe
  2⤵
  PID:7988
- C:\Windows\System\MGYcmeG.exe
  C:\Windows\System\MGYcmeG.exe
  2⤵
  PID:7584
- C:\Windows\System\VmPyDWU.exe
  C:\Windows\System\VmPyDWU.exe
  2⤵
  PID:7420
- C:\Windows\System\OSBeAGD.exe
  C:\Windows\System\OSBeAGD.exe
  2⤵
  PID:6284
- C:\Windows\System\XAfMVrq.exe
  C:\Windows\System\XAfMVrq.exe
  2⤵
  PID:7668
- C:\Windows\System\SzySknR.exe
  C:\Windows\System\SzySknR.exe
  2⤵
  PID:7920
- C:\Windows\System\WRreujn.exe
  C:\Windows\System\WRreujn.exe
  2⤵
  PID:8156
- C:\Windows\System\UIlmIdw.exe
  C:\Windows\System\UIlmIdw.exe
  2⤵
  PID:7924
- C:\Windows\System\JFYNEzg.exe
  C:\Windows\System\JFYNEzg.exe
  2⤵
  PID:8196
- C:\Windows\System\wtykuyd.exe
  C:\Windows\System\wtykuyd.exe
  2⤵
  PID:8220
- C:\Windows\System\txxRWDf.exe
  C:\Windows\System\txxRWDf.exe
  2⤵
  PID:8236
- C:\Windows\System\BQKkwuw.exe
  C:\Windows\System\BQKkwuw.exe
  2⤵
  PID:8252
- C:\Windows\System\bMisWAp.exe
  C:\Windows\System\bMisWAp.exe
  2⤵
  PID:8280
- C:\Windows\System\vVullyG.exe
  C:\Windows\System\vVullyG.exe
  2⤵
  PID:8296
- C:\Windows\System\Zwpxdux.exe
  C:\Windows\System\Zwpxdux.exe
  2⤵
  PID:8312
- C:\Windows\System\uUfctRZ.exe
  C:\Windows\System\uUfctRZ.exe
  2⤵
  PID:8332
- C:\Windows\System\rcbHUJb.exe
  C:\Windows\System\rcbHUJb.exe
  2⤵
  PID:8352
- C:\Windows\System\Xkwbcgc.exe
  C:\Windows\System\Xkwbcgc.exe
  2⤵
  PID:8368
- C:\Windows\System\gYwBBzy.exe
  C:\Windows\System\gYwBBzy.exe
  2⤵
  PID:8400
- C:\Windows\System\vpUZVHe.exe
  C:\Windows\System\vpUZVHe.exe
  2⤵
  PID:8420
- C:\Windows\System\ySHzXKE.exe
  C:\Windows\System\ySHzXKE.exe
  2⤵
  PID:8444
- C:\Windows\System\OFGjiTC.exe
  C:\Windows\System\OFGjiTC.exe
  2⤵
  PID:8460
- C:\Windows\System\uagPeqh.exe
  C:\Windows\System\uagPeqh.exe
  2⤵
  PID:8480
- C:\Windows\System\ilVWjeH.exe
  C:\Windows\System\ilVWjeH.exe
  2⤵
  PID:8496
- C:\Windows\System\mlOUBpf.exe
  C:\Windows\System\mlOUBpf.exe
  2⤵
  PID:8512
- C:\Windows\System\WvKTquR.exe
  C:\Windows\System\WvKTquR.exe
  2⤵
  PID:8528
- C:\Windows\System\dmOhStp.exe
  C:\Windows\System\dmOhStp.exe
  2⤵
  PID:8544
- C:\Windows\System\pIHJZDb.exe
  C:\Windows\System\pIHJZDb.exe
  2⤵
  PID:8560
- C:\Windows\System\dkTWVSo.exe
  C:\Windows\System\dkTWVSo.exe
  2⤵
  PID:8576
- C:\Windows\System\AanOZuN.exe
  C:\Windows\System\AanOZuN.exe
  2⤵
  PID:8592
- C:\Windows\System\xbIXTTK.exe
  C:\Windows\System\xbIXTTK.exe
  2⤵
  PID:8608
- C:\Windows\System\blfocTT.exe
  C:\Windows\System\blfocTT.exe
  2⤵
  PID:8624
- C:\Windows\System\nNgAcgU.exe
  C:\Windows\System\nNgAcgU.exe
  2⤵
  PID:8640
- C:\Windows\System\pzPWMpu.exe
  C:\Windows\System\pzPWMpu.exe
  2⤵
  PID:8656
- C:\Windows\System\omKwqwT.exe
  C:\Windows\System\omKwqwT.exe
  2⤵
  PID:8672
- C:\Windows\System\yUBqTpN.exe
  C:\Windows\System\yUBqTpN.exe
  2⤵
  PID:8688
- C:\Windows\System\GWqJxJc.exe
  C:\Windows\System\GWqJxJc.exe
  2⤵
  PID:8704
- C:\Windows\System\OLBzGuJ.exe
  C:\Windows\System\OLBzGuJ.exe
  2⤵
  PID:8720
- C:\Windows\System\AVXvnGy.exe
  C:\Windows\System\AVXvnGy.exe
  2⤵
  PID:8736
- C:\Windows\System\FUiZKAJ.exe
  C:\Windows\System\FUiZKAJ.exe
  2⤵
  PID:8752
- C:\Windows\System\KPYOvPd.exe
  C:\Windows\System\KPYOvPd.exe
  2⤵
  PID:8768
- C:\Windows\System\ysfVHnP.exe
  C:\Windows\System\ysfVHnP.exe
  2⤵
  PID:8784
- C:\Windows\System\IQZFyNv.exe
  C:\Windows\System\IQZFyNv.exe
  2⤵
  PID:8800
- C:\Windows\System\XQfzGEo.exe
  C:\Windows\System\XQfzGEo.exe
  2⤵
  PID:8816
- C:\Windows\System\BpvHLmg.exe
  C:\Windows\System\BpvHLmg.exe
  2⤵
  PID:8832
- C:\Windows\System\MjOUIyo.exe
  C:\Windows\System\MjOUIyo.exe
  2⤵
  PID:8848
- C:\Windows\System\yAMepDD.exe
  C:\Windows\System\yAMepDD.exe
  2⤵
  PID:8864
- C:\Windows\System\YBBYvqx.exe
  C:\Windows\System\YBBYvqx.exe
  2⤵
  PID:8880
- C:\Windows\System\kxVhcCQ.exe
  C:\Windows\System\kxVhcCQ.exe
  2⤵
  PID:8896
- C:\Windows\System\GUBwcPK.exe
  C:\Windows\System\GUBwcPK.exe
  2⤵
  PID:8912
- C:\Windows\System\FLAGXuK.exe
  C:\Windows\System\FLAGXuK.exe
  2⤵
  PID:8928
- C:\Windows\System\TOzdpKx.exe
  C:\Windows\System\TOzdpKx.exe
  2⤵
  PID:8944
- C:\Windows\System\TXJCrUN.exe
  C:\Windows\System\TXJCrUN.exe
  2⤵
  PID:8960
- C:\Windows\System\VOOSPvy.exe
  C:\Windows\System\VOOSPvy.exe
  2⤵
  PID:8976
- C:\Windows\System\iEIIvLv.exe
  C:\Windows\System\iEIIvLv.exe
  2⤵
  PID:8992
- C:\Windows\System\eMdeBva.exe
  C:\Windows\System\eMdeBva.exe
  2⤵
  PID:9008
- C:\Windows\System\uiGSkRo.exe
  C:\Windows\System\uiGSkRo.exe
  2⤵
  PID:9024
- C:\Windows\System\AOLLMTy.exe
  C:\Windows\System\AOLLMTy.exe
  2⤵
  PID:9040
- C:\Windows\System\boSEaKs.exe
  C:\Windows\System\boSEaKs.exe
  2⤵
  PID:9056
- C:\Windows\System\qCYIJQS.exe
  C:\Windows\System\qCYIJQS.exe
  2⤵
  PID:9072
- C:\Windows\System\iuROzJb.exe
  C:\Windows\System\iuROzJb.exe
  2⤵
  PID:9088
- C:\Windows\System\TYIWUqb.exe
  C:\Windows\System\TYIWUqb.exe
  2⤵
  PID:9104
- C:\Windows\System\DbeKmgj.exe
  C:\Windows\System\DbeKmgj.exe
  2⤵
  PID:9120
- C:\Windows\System\fvuZFmY.exe
  C:\Windows\System\fvuZFmY.exe
  2⤵
  PID:9136
- C:\Windows\System\eOVIjRU.exe
  C:\Windows\System\eOVIjRU.exe
  2⤵
  PID:9152
- C:\Windows\System\uoqMJsO.exe
  C:\Windows\System\uoqMJsO.exe
  2⤵
  PID:9168
- C:\Windows\System\SQHThVf.exe
  C:\Windows\System\SQHThVf.exe
  2⤵
  PID:9184
- C:\Windows\System\xAtfAWi.exe
  C:\Windows\System\xAtfAWi.exe
  2⤵
  PID:9200
- C:\Windows\System\gORkyjc.exe
  C:\Windows\System\gORkyjc.exe
  2⤵
  PID:7940
- C:\Windows\System\ImeCYdm.exe
  C:\Windows\System\ImeCYdm.exe
  2⤵
  PID:8260
- C:\Windows\System\lRqLShu.exe
  C:\Windows\System\lRqLShu.exe
  2⤵
  PID:8276
- C:\Windows\System\WvsobAo.exe
  C:\Windows\System\WvsobAo.exe
  2⤵
  PID:8344
- C:\Windows\System\ihqjojg.exe
  C:\Windows\System\ihqjojg.exe
  2⤵
  PID:8384
- C:\Windows\System\NsduICo.exe
  C:\Windows\System\NsduICo.exe
  2⤵
  PID:8428
- C:\Windows\System\oQDRGpf.exe
  C:\Windows\System\oQDRGpf.exe
  2⤵
  PID:8104
- C:\Windows\System\wAuVEMF.exe
  C:\Windows\System\wAuVEMF.exe
  2⤵
  PID:8320
- C:\Windows\System\eSReLQL.exe
  C:\Windows\System\eSReLQL.exe
  2⤵
  PID:7824
- C:\Windows\System\gpZawGU.exe
  C:\Windows\System\gpZawGU.exe
  2⤵
  PID:7648
- C:\Windows\System\VsUSuwK.exe
  C:\Windows\System\VsUSuwK.exe
  2⤵
  PID:8536
- C:\Windows\System\VMSGyLf.exe
  C:\Windows\System\VMSGyLf.exe
  2⤵
  PID:8600
- C:\Windows\System\VLakCNU.exe
  C:\Windows\System\VLakCNU.exe
  2⤵
  PID:6860
- C:\Windows\System\zHPbxYg.exe
  C:\Windows\System\zHPbxYg.exe
  2⤵
  PID:7308
- C:\Windows\System\bOVWHgY.exe
  C:\Windows\System\bOVWHgY.exe
  2⤵
  PID:7716
- C:\Windows\System\JDQsVoR.exe
  C:\Windows\System\JDQsVoR.exe
  2⤵
  PID:8212
- C:\Windows\System\mQlCrWd.exe
  C:\Windows\System\mQlCrWd.exe
  2⤵
  PID:8292
- C:\Windows\System\DMtuDCs.exe
  C:\Windows\System\DMtuDCs.exe
  2⤵
  PID:8328
- C:\Windows\System\fVxDisM.exe
  C:\Windows\System\fVxDisM.exe
  2⤵
  PID:8416
- C:\Windows\System\AakrTVx.exe
  C:\Windows\System\AakrTVx.exe
  2⤵
  PID:8456
- C:\Windows\System\zuLuWYB.exe
  C:\Windows\System\zuLuWYB.exe
  2⤵
  PID:8488
- C:\Windows\System\VIvqIYh.exe
  C:\Windows\System\VIvqIYh.exe
  2⤵
  PID:8652
- C:\Windows\System\DiFtEng.exe
  C:\Windows\System\DiFtEng.exe
  2⤵
  PID:8732
- C:\Windows\System\SHtxpds.exe
  C:\Windows\System\SHtxpds.exe
  2⤵
  PID:8796
- C:\Windows\System\RLIjNDm.exe
  C:\Windows\System\RLIjNDm.exe
  2⤵
  PID:8860
- C:\Windows\System\kwuQacF.exe
  C:\Windows\System\kwuQacF.exe
  2⤵
  PID:8924
- C:\Windows\System\txMJfML.exe
  C:\Windows\System\txMJfML.exe
  2⤵
  PID:8988
- C:\Windows\System\srrbBvC.exe
  C:\Windows\System\srrbBvC.exe
  2⤵
  PID:9052
- C:\Windows\System\KKsuaHU.exe
  C:\Windows\System\KKsuaHU.exe
  2⤵
  PID:8556
- C:\Windows\System\YARoUsc.exe
  C:\Windows\System\YARoUsc.exe
  2⤵
  PID:9148
- C:\Windows\System\aImXNlP.exe
  C:\Windows\System\aImXNlP.exe
  2⤵
  PID:9004
- C:\Windows\System\RlRICRI.exe
  C:\Windows\System\RlRICRI.exe
  2⤵
  PID:9160
- C:\Windows\System\MGfVxLZ.exe
  C:\Windows\System\MGfVxLZ.exe
  2⤵
  PID:8844
- C:\Windows\System\IsJAWQX.exe
  C:\Windows\System\IsJAWQX.exe
  2⤵
  PID:8908
- C:\Windows\System\VlMEqin.exe
  C:\Windows\System\VlMEqin.exe
  2⤵
  PID:9036
- C:\Windows\System\EeyPTJG.exe
  C:\Windows\System\EeyPTJG.exe
  2⤵
  PID:9132
- C:\Windows\System\ETTjFtM.exe
  C:\Windows\System\ETTjFtM.exe
  2⤵
  PID:8780
- C:\Windows\System\JVQokyi.exe
  C:\Windows\System\JVQokyi.exe
  2⤵
  PID:9212
- C:\Windows\System\IVeBJdr.exe
  C:\Windows\System\IVeBJdr.exe
  2⤵
  PID:8268
- C:\Windows\System\nJQXDcw.exe
  C:\Windows\System\nJQXDcw.exe
  2⤵
  PID:9192
- C:\Windows\System\AqrvdGI.exe
  C:\Windows\System\AqrvdGI.exe
  2⤵
  PID:8436
- C:\Windows\System\CMeEFkR.exe
  C:\Windows\System\CMeEFkR.exe
  2⤵
  PID:8508
- C:\Windows\System\ZuHAPZu.exe
  C:\Windows\System\ZuHAPZu.exe
  2⤵
  PID:8020
- C:\Windows\System\tnqLPvS.exe
  C:\Windows\System\tnqLPvS.exe
  2⤵
  PID:6780
- C:\Windows\System\CDkAayR.exe
  C:\Windows\System\CDkAayR.exe
  2⤵
  PID:8364
- C:\Windows\System\xDVuPjr.exe
  C:\Windows\System\xDVuPjr.exe
  2⤵
  PID:8856
- C:\Windows\System\AudpmXx.exe
  C:\Windows\System\AudpmXx.exe
  2⤵
  PID:8984
- C:\Windows\System\YkOmRPJ.exe
  C:\Windows\System\YkOmRPJ.exe
  2⤵
  PID:8392
- C:\Windows\System\JzSCqus.exe
  C:\Windows\System\JzSCqus.exe
  2⤵
  PID:8472
- C:\Windows\System\xLcfoWd.exe
  C:\Windows\System\xLcfoWd.exe
  2⤵
  PID:8572
- C:\Windows\System\FsCENjI.exe
  C:\Windows\System\FsCENjI.exe
  2⤵
  PID:8208
- C:\Windows\System\vuNmWjl.exe
  C:\Windows\System\vuNmWjl.exe
  2⤵
  PID:8620
- C:\Windows\System\AwtoIld.exe
  C:\Windows\System\AwtoIld.exe
  2⤵
  PID:8892
- C:\Windows\System\NlLGFFe.exe
  C:\Windows\System\NlLGFFe.exe
  2⤵
  PID:9116
- C:\Windows\System\XWroEHi.exe
  C:\Windows\System\XWroEHi.exe
  2⤵
  PID:8840
- C:\Windows\System\nOrLrcO.exe
  C:\Windows\System\nOrLrcO.exe
  2⤵
  PID:8972
- C:\Windows\System\ylqWQDO.exe
  C:\Windows\System\ylqWQDO.exe
  2⤵
  PID:8380
- C:\Windows\System\wWooXOm.exe
  C:\Windows\System\wWooXOm.exe
  2⤵
  PID:8140
- C:\Windows\System\ToaGyhJ.exe
  C:\Windows\System\ToaGyhJ.exe
  2⤵
  PID:2828
- C:\Windows\System\WsiJiFX.exe
  C:\Windows\System\WsiJiFX.exe
  2⤵
  PID:9048
- C:\Windows\System\AOhTIQw.exe
  C:\Windows\System\AOhTIQw.exe
  2⤵
  PID:9000
- C:\Windows\System\htVnxgl.exe
  C:\Windows\System\htVnxgl.exe
  2⤵
  PID:9208
- C:\Windows\System\Qxjkiiw.exe
  C:\Windows\System\Qxjkiiw.exe
  2⤵
  PID:9128
- C:\Windows\System\jkhdfiR.exe
  C:\Windows\System\jkhdfiR.exe
  2⤵
  PID:8828
- C:\Windows\System\IUpodst.exe
  C:\Windows\System\IUpodst.exe
  2⤵
  PID:9020
- C:\Windows\System\dOyAADQ.exe
  C:\Windows\System\dOyAADQ.exe
  2⤵
  PID:8684
- C:\Windows\System\nhMrSjZ.exe
  C:\Windows\System\nhMrSjZ.exe
  2⤵
  PID:6504
- C:\Windows\System\VxZsRqz.exe
  C:\Windows\System\VxZsRqz.exe
  2⤵
  PID:9176
- C:\Windows\System\xirzzDd.exe
  C:\Windows\System\xirzzDd.exe
  2⤵
  PID:9144
- C:\Windows\System\erstgzH.exe
  C:\Windows\System\erstgzH.exe
  2⤵
  PID:8956
- C:\Windows\System\yrimoYS.exe
  C:\Windows\System\yrimoYS.exe
  2⤵
  PID:8228
- C:\Windows\System\tCxJcmX.exe
  C:\Windows\System\tCxJcmX.exe
  2⤵
  PID:8340
- C:\Windows\System\pfFTaZX.exe
  C:\Windows\System\pfFTaZX.exe
  2⤵
  PID:8792
- C:\Windows\System\SjyWjKz.exe
  C:\Windows\System\SjyWjKz.exe
  2⤵
  PID:8308
- C:\Windows\System\PYvZUml.exe
  C:\Windows\System\PYvZUml.exe
  2⤵
  PID:8728
- C:\Windows\System\EgZluOE.exe
  C:\Windows\System\EgZluOE.exe
  2⤵
  PID:9180
- C:\Windows\System\KUpQsAR.exe
  C:\Windows\System\KUpQsAR.exe
  2⤵
  PID:8248
- C:\Windows\System\OFcqdBK.exe
  C:\Windows\System\OFcqdBK.exe
  2⤵
  PID:9228
- C:\Windows\System\Jpezfvp.exe
  C:\Windows\System\Jpezfvp.exe
  2⤵
  PID:9244
- C:\Windows\System\lUGLNxi.exe
  C:\Windows\System\lUGLNxi.exe
  2⤵
  PID:9264
- C:\Windows\System\eqJZgUU.exe
  C:\Windows\System\eqJZgUU.exe
  2⤵
  PID:9280
- C:\Windows\System\yMMFUgb.exe
  C:\Windows\System\yMMFUgb.exe
  2⤵
  PID:9296
- C:\Windows\System\fVlCPdw.exe
  C:\Windows\System\fVlCPdw.exe
  2⤵
  PID:9312
- C:\Windows\System\BDsNaWi.exe
  C:\Windows\System\BDsNaWi.exe
  2⤵
  PID:9328
- C:\Windows\System\hEgDgKI.exe
  C:\Windows\System\hEgDgKI.exe
  2⤵
  PID:9344
- C:\Windows\System\gxVRRkp.exe
  C:\Windows\System\gxVRRkp.exe
  2⤵
  PID:9360
- C:\Windows\System\WVIZtKC.exe
  C:\Windows\System\WVIZtKC.exe
  2⤵
  PID:9376
- C:\Windows\System\ZIKrRmH.exe
  C:\Windows\System\ZIKrRmH.exe
  2⤵
  PID:9392
- C:\Windows\System\lltNwmz.exe
  C:\Windows\System\lltNwmz.exe
  2⤵
  PID:9408
- C:\Windows\System\qLDlIef.exe
  C:\Windows\System\qLDlIef.exe
  2⤵
  PID:9424
- C:\Windows\System\oUPDEVZ.exe
  C:\Windows\System\oUPDEVZ.exe
  2⤵
  PID:9440
- C:\Windows\System\pJlDhds.exe
  C:\Windows\System\pJlDhds.exe
  2⤵
  PID:9456
- C:\Windows\System\kZTDfNN.exe
  C:\Windows\System\kZTDfNN.exe
  2⤵
  PID:9564
- C:\Windows\System\myBuRxY.exe
  C:\Windows\System\myBuRxY.exe
  2⤵
  PID:9580
- C:\Windows\System\cpnXvyW.exe
  C:\Windows\System\cpnXvyW.exe
  2⤵
  PID:9596
- C:\Windows\System\CocEpJQ.exe
  C:\Windows\System\CocEpJQ.exe
  2⤵
  PID:9624
- C:\Windows\System\bFJuvgG.exe
  C:\Windows\System\bFJuvgG.exe
  2⤵
  PID:9640
- C:\Windows\System\LvMQeul.exe
  C:\Windows\System\LvMQeul.exe
  2⤵
  PID:9656
- C:\Windows\System\kqYfwxh.exe
  C:\Windows\System\kqYfwxh.exe
  2⤵
  PID:9672
- C:\Windows\System\mssIJvr.exe
  C:\Windows\System\mssIJvr.exe
  2⤵
  PID:9688
- C:\Windows\System\UZVrqfD.exe
  C:\Windows\System\UZVrqfD.exe
  2⤵
  PID:9704
- C:\Windows\System\IVGiTGQ.exe
  C:\Windows\System\IVGiTGQ.exe
  2⤵
  PID:9720
- C:\Windows\System\pyIODfx.exe
  C:\Windows\System\pyIODfx.exe
  2⤵
  PID:9736
- C:\Windows\System\KPNTFEc.exe
  C:\Windows\System\KPNTFEc.exe
  2⤵
  PID:9752
- C:\Windows\System\bQUDVIy.exe
  C:\Windows\System\bQUDVIy.exe
  2⤵
  PID:9768
- C:\Windows\System\JHKYCuv.exe
  C:\Windows\System\JHKYCuv.exe
  2⤵
  PID:9784
- C:\Windows\System\uqYJYqR.exe
  C:\Windows\System\uqYJYqR.exe
  2⤵
  PID:9800
- C:\Windows\System\KlQqCdP.exe
  C:\Windows\System\KlQqCdP.exe
  2⤵
  PID:9816
- C:\Windows\System\uqZYlZg.exe
  C:\Windows\System\uqZYlZg.exe
  2⤵
  PID:9832
- C:\Windows\System\NpSMsSf.exe
  C:\Windows\System\NpSMsSf.exe
  2⤵
  PID:9848
- C:\Windows\System\HIotHDE.exe
  C:\Windows\System\HIotHDE.exe
  2⤵
  PID:9864
- C:\Windows\System\ovkWeEX.exe
  C:\Windows\System\ovkWeEX.exe
  2⤵
  PID:9884
- C:\Windows\System\gacSizQ.exe
  C:\Windows\System\gacSizQ.exe
  2⤵
  PID:9900
- C:\Windows\System\HKCDtJA.exe
  C:\Windows\System\HKCDtJA.exe
  2⤵
  PID:9916
- C:\Windows\System\FNIKfCX.exe
  C:\Windows\System\FNIKfCX.exe
  2⤵
  PID:9932
- C:\Windows\System\lDtdOUb.exe
  C:\Windows\System\lDtdOUb.exe
  2⤵
  PID:9952
- C:\Windows\System\DbjUTde.exe
  C:\Windows\System\DbjUTde.exe
  2⤵
  PID:9968
- C:\Windows\System\CbTKpTB.exe
  C:\Windows\System\CbTKpTB.exe
  2⤵
  PID:9984
- C:\Windows\System\gONIIFY.exe
  C:\Windows\System\gONIIFY.exe
  2⤵
  PID:10000
- C:\Windows\System\DAyVpAj.exe
  C:\Windows\System\DAyVpAj.exe
  2⤵
  PID:10016
- C:\Windows\System\GbQKoCo.exe
  C:\Windows\System\GbQKoCo.exe
  2⤵
  PID:10036
- C:\Windows\System\UTLcPpT.exe
  C:\Windows\System\UTLcPpT.exe
  2⤵
  PID:10052
- C:\Windows\System\ANgIHak.exe
  C:\Windows\System\ANgIHak.exe
  2⤵
  PID:10072
- C:\Windows\System\dreVdic.exe
  C:\Windows\System\dreVdic.exe
  2⤵
  PID:10092
- C:\Windows\System\oEQiiGu.exe
  C:\Windows\System\oEQiiGu.exe
  2⤵
  PID:10140
- C:\Windows\System\wOKYYGH.exe
  C:\Windows\System\wOKYYGH.exe
  2⤵
  PID:10156
- C:\Windows\System\mqxeABs.exe
  C:\Windows\System\mqxeABs.exe
  2⤵
  PID:10180
- C:\Windows\System\XGczaeJ.exe
  C:\Windows\System\XGczaeJ.exe
  2⤵
  PID:10196
- C:\Windows\System\chRlizM.exe
  C:\Windows\System\chRlizM.exe
  2⤵
  PID:10212
- C:\Windows\System\TDhCIRb.exe
  C:\Windows\System\TDhCIRb.exe
  2⤵
  PID:10232
- C:\Windows\System\fYqerou.exe
  C:\Windows\System\fYqerou.exe
  2⤵
  PID:9240
- C:\Windows\System\XXTgsVt.exe
  C:\Windows\System\XXTgsVt.exe
  2⤵
  PID:9340
- C:\Windows\System\qBqyzjj.exe
  C:\Windows\System\qBqyzjj.exe
  2⤵
  PID:9404
- C:\Windows\System\PFxEufp.exe
  C:\Windows\System\PFxEufp.exe
  2⤵
  PID:9432
- C:\Windows\System\ZKTrVEp.exe
  C:\Windows\System\ZKTrVEp.exe
  2⤵
  PID:9352
- C:\Windows\System\JZgYEjb.exe
  C:\Windows\System\JZgYEjb.exe
  2⤵
  PID:9356
- C:\Windows\System\cUDWPMH.exe
  C:\Windows\System\cUDWPMH.exe
  2⤵
  PID:9436
- C:\Windows\System\bXbZvaU.exe
  C:\Windows\System\bXbZvaU.exe
  2⤵
  PID:9472
- C:\Windows\System\HTgkVvm.exe
  C:\Windows\System\HTgkVvm.exe
  2⤵
  PID:9520
- C:\Windows\System\DsWtHfE.exe
  C:\Windows\System\DsWtHfE.exe
  2⤵
  PID:9532
- C:\Windows\System\tamSvYA.exe
  C:\Windows\System\tamSvYA.exe
  2⤵
  PID:9556
- C:\Windows\System\ubOjIZA.exe
  C:\Windows\System\ubOjIZA.exe
  2⤵
  PID:9576
- C:\Windows\System\gvhFVvx.exe
  C:\Windows\System\gvhFVvx.exe
  2⤵
  PID:9612
- C:\Windows\System\cafQuuc.exe
  C:\Windows\System\cafQuuc.exe
  2⤵
  PID:9608
- C:\Windows\System\fnBqIHn.exe
  C:\Windows\System\fnBqIHn.exe
  2⤵
  PID:9664
- C:\Windows\System\fOdVhHg.exe
  C:\Windows\System\fOdVhHg.exe
  2⤵
  PID:9700
- C:\Windows\System\svcTDeB.exe
  C:\Windows\System\svcTDeB.exe
  2⤵
  PID:9728
- C:\Windows\System\jYNTHdW.exe
  C:\Windows\System\jYNTHdW.exe
  2⤵
  PID:9792
- C:\Windows\System\mpznlrM.exe
  C:\Windows\System\mpznlrM.exe
  2⤵
  PID:9856
- C:\Windows\System\XFcGHOj.exe
  C:\Windows\System\XFcGHOj.exe
  2⤵
  PID:9908
- C:\Windows\System\kfFpZzv.exe
  C:\Windows\System\kfFpZzv.exe
  2⤵
  PID:9964
- C:\Windows\System\qiuQlMP.exe
  C:\Windows\System\qiuQlMP.exe
  2⤵
  PID:10024
- C:\Windows\System\NfooheS.exe
  C:\Windows\System\NfooheS.exe
  2⤵
  PID:9944
- C:\Windows\System\yQIYFkm.exe
  C:\Windows\System\yQIYFkm.exe
  2⤵
  PID:10044
- C:\Windows\System\YJNLURE.exe
  C:\Windows\System\YJNLURE.exe
  2⤵
  PID:10064
- C:\Windows\System\emsbTsl.exe
  C:\Windows\System\emsbTsl.exe
  2⤵
  PID:10104
- C:\Windows\System\jOSbcLn.exe
  C:\Windows\System\jOSbcLn.exe
  2⤵
  PID:10120
- C:\Windows\System\FSykloQ.exe
  C:\Windows\System\FSykloQ.exe
  2⤵
  PID:10088
- C:\Windows\System\aaZPWSj.exe
  C:\Windows\System\aaZPWSj.exe
  2⤵
  PID:10168
- C:\Windows\System\lBvjtFl.exe
  C:\Windows\System\lBvjtFl.exe
  2⤵
  PID:10188
- C:\Windows\System\NswjbBB.exe
  C:\Windows\System\NswjbBB.exe
  2⤵
  PID:10220
- C:\Windows\System\NPLCqXl.exe
  C:\Windows\System\NPLCqXl.exe
  2⤵
  PID:7452
- C:\Windows\System\havpCcw.exe
  C:\Windows\System\havpCcw.exe
  2⤵
  PID:9372
- C:\Windows\System\JOinqzG.exe
  C:\Windows\System\JOinqzG.exe
  2⤵
  PID:9100
- C:\Windows\System\HRrVEEr.exe
  C:\Windows\System\HRrVEEr.exe
  2⤵
  PID:1488
- C:\Windows\System\bxtWoUx.exe
  C:\Windows\System\bxtWoUx.exe
  2⤵
  PID:9420
- C:\Windows\System\GzfUPLv.exe
  C:\Windows\System\GzfUPLv.exe
  2⤵
  PID:9484
- C:\Windows\System\mfVUzXK.exe
  C:\Windows\System\mfVUzXK.exe
  2⤵
  PID:9504
- C:\Windows\System\CAGcvsU.exe
  C:\Windows\System\CAGcvsU.exe
  2⤵
  PID:9508
- C:\Windows\System\vjsqcPy.exe
  C:\Windows\System\vjsqcPy.exe
  2⤵
  PID:9540
- C:\Windows\System\pfJZWIW.exe
  C:\Windows\System\pfJZWIW.exe
  2⤵
  PID:9572
- C:\Windows\System\HCfhGZn.exe
  C:\Windows\System\HCfhGZn.exe
  2⤵
  PID:9616
- C:\Windows\System\brKoDQj.exe
  C:\Windows\System\brKoDQj.exe
  2⤵
  PID:9696
- C:\Windows\System\BTojDmq.exe
  C:\Windows\System\BTojDmq.exe
  2⤵
  PID:9748
- C:\Windows\System\qpfFewu.exe
  C:\Windows\System\qpfFewu.exe
  2⤵
  PID:9780
- C:\Windows\System\dIBwagJ.exe
  C:\Windows\System\dIBwagJ.exe
  2⤵
  PID:9844
- C:\Windows\System\uxkGpJu.exe
  C:\Windows\System\uxkGpJu.exe
  2⤵
  PID:9960
- C:\Windows\System\LLIFyTp.exe
  C:\Windows\System\LLIFyTp.exe
  2⤵
  PID:9896
- C:\Windows\System\gHYXaxy.exe
  C:\Windows\System\gHYXaxy.exe
  2⤵
  PID:10048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ApReMTD.exe

Filesize
1.5MB

MD5
3b59ff1c9ce018483f0db80ff4ba01bd

SHA1
aea07a816545927cce9f0dceabbb54722e784226

SHA256
e9e116f0d552636553d7de7f37bb69f84a0a37ab6e25fedacf037c6f41262a8c

SHA512
9426bd0f9502093c204a20813b7bf10498f9bf17980d2d4b225646a96d6b8397bc1479aa9b01ddf21053f9882b6b1503bd16a7d0fa3608c9d948a5daecc4c5ea

Download Submit
C:\Windows\system\BrCVCIg.exe

Filesize
1.5MB

MD5
4b04cd3a66c676b553ae3df190e387e3

SHA1
94ee6210efe83f9ed5a5dca72f833168f5b6eb3e

SHA256
6ebbf64fef0585188ce473cbd82d94d4993267acb9ccd3386c46dee82617526e

SHA512
0304fa208690d32da314b77adec74696322f1b6cd4262c86f3eb6cf92dcd554357e114270a0f52d97898e267deb2abc17ba79178c2d324b08d7b8e1abc5fb3fa

Download Submit
C:\Windows\system\DSvgpfj.exe

Filesize
1.5MB

MD5
d0f18fd8c4d29d54ca20e88c3bf301e6

SHA1
feb5a0ade04f6f8af29f2cf1ccb108d4301bfc97

SHA256
6075ab4d5f763138055b0ad6ce59f0722e45bb81771944ffaf61cb50633e1331

SHA512
38faed6c37f1034665fa0a819163ea7a676dc50c554fa63bc117d62f773ebfd5058a35af078dfc878413ac7441679224603909415c690db40c4a154f67d1d88e

Download Submit
C:\Windows\system\EVGYbjL.exe

Filesize
1.5MB

MD5
bb30d5126919c1cf13149381d98708bf

SHA1
90484615c53f17ae5c35d0c9de54bb39a1cf6073

SHA256
604da3bf76c7c91ff8fdd2d11de3fa20f5c069efe5f12b612d83851d6126e6d6

SHA512
93465fd266e707e0b69fc9960f0056b0497dc4b48dda17bc8bc0a204c7e1e5d18781dd8476a723062804cee832f800cef36b1759a96c148fa0003707fe9b3410

Download Submit
C:\Windows\system\EkXvekL.exe

Filesize
1.5MB

MD5
591c30e4ddfa17294aa34d47de1d650a

SHA1
5a931489e644386d6e30d82ee4e02b992112fe34

SHA256
d793d39daa70d8c85c671dc354976025cb53ef1a5ac76dd48ca9f1a6231154a8

SHA512
d34fb5ca96bb1315d5144cded0739619b028e8157e0d1658f59e63dae8b828a429565953a0562d16a9f3e584875968de0d633ebe8f4514416f3000aff4eba399

Download Submit
C:\Windows\system\GOnNVSu.exe

Filesize
1.5MB

MD5
c54403eda683a276623e2a5fa70e21d5

SHA1
cfb866a054860fcd19b17d1651bd2b9d2a660320

SHA256
390ab34d6ffc8968279d8941edaecfb8f8c4154928d8d227b229f6c830d2d843

SHA512
b3c87740fa6a2da3cab9b7db573d8dc7eb08c2046eaa76f543f102f543f139fc6620f6812d30a9aaf80f774be426d05e5b49db2c029e154298adfba0866d2aae

Download Submit
C:\Windows\system\HZkbUTx.exe

Filesize
1.5MB

MD5
670a7c4208e487c3c840b2298b700ca7

SHA1
68a628990a83d821558b21def49db86b424dbc00

SHA256
bfe6c72238d7aa6a73c57dfa964885d6bf9da2e6120ccd2f167e4b94b21fd032

SHA512
50288b93a1f271e2fa0ceb0ebebe0bd1870af2f3d415f6191c83c81547a02914d7cb259e34dd509c501821ecc70d21b2ba1597871ebc04bcccd34c03fa5a41fe

Download Submit
C:\Windows\system\UDYazqu.exe

Filesize
1.5MB

MD5
1ceb58ba2c9467b7e37c4cb148e6770f

SHA1
02419da413604bf071250026bbb372d44d95ac2c

SHA256
4306defcc2bff703b756a94454ba0d1becd0350c69fa278c24a74043f3e1b997

SHA512
f609149633abc90d1b13477af17aa456e668f57226641115a5fa9aef9459b31c5950057cc8c53fc48917d3ad4100c198e6cf5cb9e2ad30f324fd8c9642c3d7cc

Download Submit
C:\Windows\system\VNkQjFb.exe

Filesize
1.5MB

MD5
3b2bc5c8bd4646802c84e56be61986f5

SHA1
affec1d9128ced5318592eb1868230a3203cdbc0

SHA256
3e890eb902e26e52cab094a5540aed930d5147ff9ae973e8864be260de85b04d

SHA512
40eeaa96b1ca351488eaf3da7ce363470297fc3512f525054fdc9b96c7925c23c1bfa5014f64903c829215d49654c3d8b3d5b1d00e3bc0999bf0d332eb3808f7

Download Submit
C:\Windows\system\VyjGGMi.exe

Filesize
1.5MB

MD5
e61ae79ff40b33b8ad8863567b97c92c

SHA1
c2d0defdff5f4db0525867dc756b9ec5fb607e73

SHA256
381a3aa6b12dc7754b6dd4d870954d66697d19cc2c070063661461b46a33e969

SHA512
c3a73c3a5102ab0575a546a8af52ace790b2be4bcc6b5cfc162bda9c4b3d10823be29c66042e3e423eaee32c30dcd5b103991d3e84614f32b0b5298b86f5b079

Download Submit
C:\Windows\system\avlrpIs.exe

Filesize
1.5MB

MD5
5f7b75d940ac32d9b221f823e47f9c7e

SHA1
e67fc977337f6795819d09d9b3fe8ce4a2cdc34f

SHA256
395a03a6d0764996c661ad31cda4277b3e71ae553fbb6802642951db41626780

SHA512
08a646d91e2e1d5414ec10acc62e04632705f38daf6130f28aa73a910371b92d7a4fe073eb3ba53961fa5fa45ee55fc966cb8fe4286e942ed43540136e67e779

Download Submit
C:\Windows\system\cuEbfmj.exe

Filesize
1.5MB

MD5
11c229fdf47a8a03f1f2f1baaa218d64

SHA1
b387d0545c04c286d6bf8cf4b89d29732036376e

SHA256
9b9b093d3e413dacd42f5052823fa299e271c869ac1cd366010cac8434a973be

SHA512
a5d576848939fde7549bcfe01deae6ba236c09ea3179cf1f4043a2acb262b0a83c93b20ef4db65d9d39cf8d1f4815481626ea2ff3c44ff348b3777f7ce0494ca

Download Submit
C:\Windows\system\fMbdWXZ.exe

Filesize
1.5MB

MD5
2ac90445741976a3665f5a858535d2d8

SHA1
30b5d2df320d5680fdbb03dc16839098097ae2d3

SHA256
0deb57879450fcbf7d58c5faf6f8c8107fefc3a3847377e85f71c1ffafe032e6

SHA512
cf7c8f5de90e757904690b16394db8b0d59127770726820d34bdd4759a90593997a547976239a05b66c45ee987e902d1e6558fd321520be60ee14632d8f6a116

Download Submit
C:\Windows\system\fiLhHlA.exe

Filesize
1.5MB

MD5
3e6f963b9df89a4b5d09404ccde1bcf4

SHA1
fff1e22edda61904973b557c249dfc8c30f7f13b

SHA256
58854a294d0d10dcaa767b01447ea402093908a6a51e63b2fd101f4511acaec8

SHA512
9291d2df3c8df70ea70c4725aa77527716fb6b874d985ad36f4ba7b5153bf1ed906b7493773c230656a544dab85035b2ad17b57fe544fa6beff48a6b52823783

Download Submit
C:\Windows\system\hgrzMCr.exe

Filesize
1.5MB

MD5
84eab9f7eafd35a4e9d2b431b231946b

SHA1
9b5a1eb3787e55857235ca375cb3037fe8dad31f

SHA256
eed04b72fc5769b067914c7edf38a531dbf56d5260abb6fbfee2b6cd4cdab7ed

SHA512
b21b4685b52321746ac016e3d426048daa8e516b875abbfa48784511c0bce5825988fa5c7a5e599e9fde99faf5f5fe3fec3d2faa1a10fd342ef6bfa94cf208c1

Download Submit
C:\Windows\system\hmZDWiM.exe

Filesize
1.5MB

MD5
a3b9cc68b4320a5ca75c78e55fdd9ddd

SHA1
f27f740155f23a9926f9c339cc5ccc0d02b88d31

SHA256
132edc46bdf064942754a15c6a744993dd1e3fe1de564a9d68379990af23c909

SHA512
ed39a5a086b670de61271fd2036153912dfbf4ea00e82f4366b6183d2427d7fe40d2d61079c87f328d39f607d9bf585d2da632231a8389c96e29ac668216fd1e

Download Submit
C:\Windows\system\mNlXIQY.exe

Filesize
1.5MB

MD5
1d10fb05073bd3bc91968166bfaec492

SHA1
d8302b323c96061ce5e1e9b4ab8fa4cd8be78e27

SHA256
0d12049a507cb2383d7e3ad9fe80874877a0e909653c3d10334f0fb7781f6d2f

SHA512
a7e8f95187f398af515e4c6b8b2b96d196ca849a0e2154223db64e537a7c296f1f0d89ee008b9abcc477e9447dc9576669ccdc9e1aa24f402c3bf596761d3cd2

Download Submit
C:\Windows\system\qqTNDTl.exe

Filesize
1.5MB

MD5
bd56f22bac5e2b899e90d711c4e1ecdb

SHA1
27f65277e99d206d63bc0b0be5a4f5d746349fa8

SHA256
267370a285dea2b363bd43bea8f364c135de0f70053108c5520c7311235a2d83

SHA512
267d231125aa6e2ec301c562e671428437a0564806000af2a92c2134d51ddb898faf283fe8975a1360a847df5dba5043ff1edcdeb6522294c50c4d6cf7bb9e41

Download Submit
C:\Windows\system\rDhwcKP.exe

Filesize
1.5MB

MD5
776195086aa86853e3a1a6c606c3d084

SHA1
74e7d41981f69ace48e830d6b67b6cea92508b85

SHA256
7571c45dc25a720d76c64a54b6c8f94cdf23dd02fa0954cbd9c4a6f09ce4d1ae

SHA512
31590da2e3943b9ac3511c76be8c7e5e1f4e7b9d04011474677b794c55fefbd4f1f2d3b8c6c572173338b3b87fe7445701ee5e3d64c53b38b5fbfb8a14d978dd

Download Submit
C:\Windows\system\sGmjiyw.exe

Filesize
1.5MB

MD5
889efd349eb4b33ac71126f5e5803238

SHA1
4f8a40ba2ec197a66010850e15a68a00264949a1

SHA256
3b287912329143b0da33e5f49ca3eaa1d9243015b0fb456e40332c0c042b36df

SHA512
67c0b993f1f3919df5a94255d31d88003a64d87d13ae5018f689229ae2b1866104a652d00b5b0441f7aa79f6c29f8d18c6d34e86e8066d708e8f82c663e06c21

Download Submit
C:\Windows\system\stTkfiu.exe

Filesize
1.5MB

MD5
f231bcb689c9b16909599017930acaab

SHA1
a5d02f4506eb21237f3a09da0b3f64e90aaa5b49

SHA256
e0457ee9f2c8a3a6e42b0a4d38b90526d2b6f796a70573b07500bd6c3220b266

SHA512
822403a1e85307524d4ab99917137e9dad3ebfbcd9b1c4ae48d2cceb7cb7bad7eb1fa409602dbb7c6a8b9415eaccfbb3929b7760c5687d206ac85487bb00346c

Download Submit
C:\Windows\system\tDpVTKn.exe

Filesize
1.5MB

MD5
fa8b25151bebcc190d3c41816e975e73

SHA1
c9dfc1ffcfe0d72dbf1d9ae3105d389820bb32f5

SHA256
ba036fe23b0f7e1a7bde6108b94960965cd3569b68b75e63be7511351d6c8724

SHA512
4766f3fe28f17b824ed22753e5f1689e36d7c8c16b765b573cfd65c5e7a807b191aea12a8012c496c8189fde5829727479328d73f3f775490cfc3fd43270a392

Download Submit
C:\Windows\system\xBmMvXB.exe

Filesize
1.5MB

MD5
841c3ffad583d90d16c751c0c789c637

SHA1
88cad5d66882948f0287710d8ca5ce56a6a6af22

SHA256
300effb8b4e0cd79c77fa945c71cdeedf52d119bb8f2ed9eae984bda1b36693f

SHA512
c63488daabbaaa193b60421ffd0824d5184678c31cc46bf717cc9229b90bf06918369e4d30ae6fda64964a55c31300a024526c95fb3d97f19b383cff496e2661

Download Submit
C:\Windows\system\yDVZHdk.exe

Filesize
1.5MB

MD5
24de432d619d38ee8c09088481a149a7

SHA1
f2877e8363b4cc93f83e419d1735dd2381d13a13

SHA256
c2ad7101c067e6e9eec7756431a12cfdfb799d16ccb5b12428416b96fabd1120

SHA512
f8dec8626fc2f3fd5a24704ef6cc2824e005862aad613dcbf3656497507c8d4e3a5a119c1736444382dc23cac7665fc7962f43d7f6cb94d8db22697b3adc9abc

Download Submit
C:\Windows\system\ySjRKmO.exe

Filesize
1.5MB

MD5
38ae6c8338196a1f61ffddfed69ec5a9

SHA1
cf3a87ff83f99f94e5e4a949ff8c4280f777f869

SHA256
21a46a4a6b71a732dee7c7f3d921b9f865bd94be0bf88193e57ae493508487d5

SHA512
4497f4106a7da5e927d59985e43e3f68f541b0e5421fa90d186a4a78c833388f417a9fc155bacd205c05f76010e3d093bc6af15799c4b85267f72bd29720eb84

Download Submit
C:\Windows\system\zccukbz.exe

Filesize
1.5MB

MD5
c7e61e5eba294c14b63f0e159bc83ab7

SHA1
c8092ea3424a346b434f5f466833cbe51566119f

SHA256
23a22515232beefdd012bf70aba9574bd0fd8ddf300fa6ec6edd42ca24847d1e

SHA512
6df557f3720b756a78f90490318fbcbfbc485b4b72cb9d37f7eca297b0f224a14c1dccc5c83597f215391b347aa3749f3c71ca890fb42ab4a100fdecb41a47b0

Download Submit
\Windows\system\LvKwgOw.exe

Filesize
1.5MB

MD5
3ead5122de5d2a7506e52a0f2affb52e

SHA1
98dfcae21844dbc56ded29a271e6db5ec7848d54

SHA256
3a229721adf199674da5c8590f331731b1304e359a18c6fd36d4e2a685148131

SHA512
4b5915e073f23c9c2009fcf4b65969c52cd0c11b5212df789a17b1ad46ffa4d7f2dfafd56d55db719360e68f258a3a93d3c0f5fef445b39f9d9ee9512402fa84

Download Submit
\Windows\system\TCQVAcS.exe

Filesize
1.5MB

MD5
86133c60f52edcf17d65665800667c7a

SHA1
e3009f66d926a8490ff54fc7b1ec422b89e1bf82

SHA256
45cfa43264083b184d35266596637fb7d159171c42bebaea23fba168c61aa800

SHA512
a4a89aff59a56dd8473b9c47b88b68215d1badce105f18d7321faae3eb3d1a7c866d7848324c7d78ee1f6e05954e9cb6d63da976a708f9906e9eeb3b881b844d

Download Submit
\Windows\system\UlmszzZ.exe

Filesize
1.5MB

MD5
e5f16237e9eb1c5aa0c260b46975f5a8

SHA1
20e61dc1d2f7250d6f7b6b7a69dba2b8a0da4ddf

SHA256
a20f9bdbfbed36d508ba8f9ec041dfecc8f92af91b7d766d5ab3acffe7ee1bb6

SHA512
333b3503909338f1d43c098c9fb78518db1e869af5fd5fc836f7c752ddd8faac3fdf9a78d7b3a58ce2ffebbcf9019570f4672fee04b654e3b834b8411aae266a

Download Submit
\Windows\system\XYRNtOh.exe

Filesize
1.5MB

MD5
7c454c0a8e776381c3de8853dd04b4a9

SHA1
240f11fbc32992119e7c142c38abaf3956095ece

SHA256
e20347e0f96b89b0cafc098c04dfc74fa5301ea08a37f04af5723d23245d2627

SHA512
8c81330f122eb9b815c17bf4e66e9f728c6c15d2d3f59251397a86da25dcaa4ada7e168f8296c21da176008dfd828f1078bd7fffd4b24b7b911153ed6c7afad0

Download Submit
\Windows\system\fiAPejt.exe

Filesize
1.5MB

MD5
67ebda7d9da3d5b581f0da47d0078eb5

SHA1
ef79b799ed45b65c3815898dd8c8c85d0aaec749

SHA256
278f151e6eb326978cdf145d2abe489f9b7d52507f3ef2ee426258aa9292fc58

SHA512
9909922eddf24c86bd9f83c2c82e2902a8a29963a834996ea83b385e1ab54ebad0fc3d2b83fc6114ec74031f13a8d821201fa6c5bf80d30d7da8627b8d487a38

Download Submit
\Windows\system\sXffSJH.exe

Filesize
1.5MB

MD5
0f6fac04df115cf8ab7276be86814593

SHA1
116d901d935452f20b06cd5ecf46ab235866d547

SHA256
c1bcaa2c46593576d83bd468c81b64780bfc1955baffe5c8b538ba6be26a9362

SHA512
be9aef9349aef1b5e8a3d7504c938af6bbe72d97ee606e9362b163f7bf53b7369ebf0ecb8d14c2feac25cd5edeb044b63337a6cd2103386e26303cd37b3eddd7

Download Submit
memory/1348-99-0x000000013F970000-0x000000013FCC4000-memory.dmp

Filesize
3.3MB

Download
memory/1348-1314-0x000000013F970000-0x000000013FCC4000-memory.dmp

Filesize
3.3MB

Download
memory/1348-4021-0x000000013F970000-0x000000013FCC4000-memory.dmp

Filesize
3.3MB

Download
memory/1744-13-0x000000013F640000-0x000000013F994000-memory.dmp

Filesize
3.3MB

Download
memory/1744-4009-0x000000013F640000-0x000000013F994000-memory.dmp

Filesize
3.3MB

Download
memory/1744-72-0x000000013F640000-0x000000013F994000-memory.dmp

Filesize
3.3MB

Download
memory/1776-4015-0x000000013F7E0000-0x000000013FB34000-memory.dmp

Filesize
3.3MB

Download
memory/1776-577-0x000000013F7E0000-0x000000013FB34000-memory.dmp

Filesize
3.3MB

Download
memory/1776-70-0x000000013F7E0000-0x000000013FB34000-memory.dmp

Filesize
3.3MB

Download
memory/1992-1297-0x000000013F870000-0x000000013FBC4000-memory.dmp

Filesize
3.3MB

Download
memory/1992-4020-0x000000013F870000-0x000000013FBC4000-memory.dmp

Filesize
3.3MB

Download
memory/1992-93-0x000000013F870000-0x000000013FBC4000-memory.dmp

Filesize
3.3MB

Download
memory/2104-78-0x000000013F790000-0x000000013FAE4000-memory.dmp

Filesize
3.3MB

Download
memory/2104-4019-0x000000013F790000-0x000000013FAE4000-memory.dmp

Filesize
3.3MB

Download
memory/2104-1288-0x000000013F790000-0x000000013FAE4000-memory.dmp

Filesize
3.3MB

Download
memory/2604-4013-0x000000013F180000-0x000000013F4D4000-memory.dmp

Filesize
3.3MB

Download
memory/2604-48-0x000000013F180000-0x000000013F4D4000-memory.dmp

Filesize
3.3MB

Download
memory/2640-4018-0x000000013F3D0000-0x000000013F724000-memory.dmp

Filesize
3.3MB

Download
memory/2640-76-0x000000013F3D0000-0x000000013F724000-memory.dmp

Filesize
3.3MB

Download
memory/2640-1044-0x000000013F3D0000-0x000000013F724000-memory.dmp

Filesize
3.3MB

Download
memory/2664-50-0x000000013F180000-0x000000013F4D4000-memory.dmp

Filesize
3.3MB

Download
memory/2664-4006-0x000000013F970000-0x000000013FCC4000-memory.dmp

Filesize
3.3MB

Download
memory/2664-0-0x000000013FD70000-0x00000001400C4000-memory.dmp

Filesize
3.3MB

Download
memory/2664-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2664-118-0x0000000001EE0000-0x0000000002234000-memory.dmp

Filesize
3.3MB

Download
memory/2664-86-0x000000013F870000-0x000000013FBC4000-memory.dmp

Filesize
3.3MB

Download
memory/2664-647-0x000000013F790000-0x000000013FAE4000-memory.dmp

Filesize
3.3MB

Download
memory/2664-100-0x000000013F3A0000-0x000000013F6F4000-memory.dmp

Filesize
3.3MB

Download
memory/2664-63-0x000000013FD70000-0x00000001400C4000-memory.dmp

Filesize
3.3MB

Download
memory/2664-75-0x000000013F790000-0x000000013FAE4000-memory.dmp

Filesize
3.3MB

Download
memory/2664-370-0x0000000001EE0000-0x0000000002234000-memory.dmp

Filesize
3.3MB

Download
memory/2664-20-0x0000000001EE0000-0x0000000002234000-memory.dmp

Filesize
3.3MB

Download
memory/2664-52-0x0000000001EE0000-0x0000000002234000-memory.dmp

Filesize
3.3MB

Download
memory/2664-51-0x000000013F680000-0x000000013F9D4000-memory.dmp

Filesize
3.3MB

Download
memory/2664-109-0x000000013F970000-0x000000013FCC4000-memory.dmp

Filesize
3.3MB

Download
memory/2664-6-0x000000013F640000-0x000000013F994000-memory.dmp

Filesize
3.3MB

Download
memory/2664-16-0x000000013F970000-0x000000013FCC4000-memory.dmp

Filesize
3.3MB

Download
memory/2664-44-0x0000000001EE0000-0x0000000002234000-memory.dmp

Filesize
3.3MB

Download
memory/2664-4008-0x0000000001EE0000-0x0000000002234000-memory.dmp

Filesize
3.3MB

Download
memory/2664-67-0x000000013F7E0000-0x000000013FB34000-memory.dmp

Filesize
3.3MB

Download
memory/2664-30-0x0000000001EE0000-0x0000000002234000-memory.dmp

Filesize
3.3MB

Download
memory/2664-4005-0x000000013F870000-0x000000013FBC4000-memory.dmp

Filesize
3.3MB

Download
memory/2664-114-0x000000013F450000-0x000000013F7A4000-memory.dmp

Filesize
3.3MB

Download
memory/2664-4007-0x000000013F450000-0x000000013F7A4000-memory.dmp

Filesize
3.3MB

Download
memory/2708-49-0x000000013FF20000-0x0000000140274000-memory.dmp

Filesize
3.3MB

Download
memory/2708-4012-0x000000013FF20000-0x0000000140274000-memory.dmp

Filesize
3.3MB

Download
memory/2724-22-0x000000013FB20000-0x000000013FE74000-memory.dmp

Filesize
3.3MB

Download
memory/2724-105-0x000000013FB20000-0x000000013FE74000-memory.dmp

Filesize
3.3MB

Download
memory/2724-4011-0x000000013FB20000-0x000000013FE74000-memory.dmp

Filesize
3.3MB

Download
memory/2784-15-0x000000013F970000-0x000000013FCC4000-memory.dmp

Filesize
3.3MB

Download
memory/2784-4010-0x000000013F970000-0x000000013FCC4000-memory.dmp

Filesize
3.3MB

Download
memory/2832-4014-0x000000013FDB0000-0x0000000140104000-memory.dmp

Filesize
3.3MB

Download
memory/2832-58-0x000000013FDB0000-0x0000000140104000-memory.dmp

Filesize
3.3MB

Download
memory/2852-4017-0x000000013FF70000-0x00000001402C4000-memory.dmp

Filesize
3.3MB

Download
memory/2852-38-0x000000013FF70000-0x00000001402C4000-memory.dmp

Filesize
3.3MB

Download
memory/2852-95-0x000000013FF70000-0x00000001402C4000-memory.dmp

Filesize
3.3MB

Download
memory/2908-4016-0x000000013F680000-0x000000013F9D4000-memory.dmp

Filesize
3.3MB

Download
memory/2908-57-0x000000013F680000-0x000000013F9D4000-memory.dmp

Filesize
3.3MB

Download