xmrig | 12cbafa01deda1af51e97566ccfaad9b85bc3e41d8d1713808b96567e72b54df

Analysis

max time kernel
32s
max time network
30s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
Size

1.9MB
MD5

09ad7b9dba337bf19c4e3116080d8671
SHA1

8eaee804d312d8840ecf6a27ca9fe4da7e4845cc
SHA256

12cbafa01deda1af51e97566ccfaad9b85bc3e41d8d1713808b96567e72b54df
SHA512

d79c6c6563636d90788beea2f4fe394ceda2b18ae360b2cc3f2ef4c89aa80c873672979a194912ed5927fcac52fe53b2496e28ee9877e55e9efed0bd15854326
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1k:NABD

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2672-56-0x000000013FF10000-0x0000000140302000-memory.dmp	xmrig
behavioral1/memory/2016-62-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2912-65-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/1984-35-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2480-60-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2592-54-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/1440-47-0x000000013FD10000-0x0000000140102000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1984	CgGjNYT.exe
1440	ycnjtTL.exe
2016	JWJMKha.exe
2592	OUyVzpb.exe
2672	CttWbjq.exe
2912	crBlnPD.exe
2480	RLOurqJ.exe
2576	OOLgKmj.exe
2488	AyMswGa.exe
3016	qdWHZYD.exe
2468	qocklHb.exe
2528	gcskadX.exe
2624	YqdCrZK.exe
2800	fmGxEER.exe
2984	XkCPKOb.exe
1444	QpULuab.exe
2988	gZTVSFX.exe
1644	RVSJzWy.exe
2248	iqkbhqb.exe
2076	vsLAbhA.exe
1308	woXGSHz.exe
1704	rLqkHqB.exe
1040	KRmcooS.exe
1488	amUxIJz.exe
564	TNaXBBf.exe
2420	DGrPSpT.exe
1064	DixkFLb.exe
2164	wodKIqM.exe
1784	IdyHSmh.exe
1880	xqJZwJx.exe
1876	RTpkgBa.exe
1652	NbJZKgG.exe
1664	dxnuIYv.exe
2064	SGAOGKa.exe
2532	UMyuczS.exe
2320	emAWhEr.exe
2120	MsPkXBg.exe
2968	vpdNCaY.exe
2348	TnWXazK.exe
1612	SCcBVPM.exe
2632	DiFmgqR.exe
1316	xzoZTpG.exe
2824	vAGIuoY.exe
1684	AYDOTMT.exe
2412	MFqwMpl.exe
2520	qGjBMzR.exe
1368	RXgZfJW.exe
2920	GdQuyMt.exe
2384	lhaeMLx.exe
3092	VBndYhu.exe
3124	awbRpxD.exe
3160	FclkNvI.exe
3192	yMxeDFL.exe
3224	wmxvHka.exe
3272	QMLjHds.exe
3304	QaMPPIM.exe
3336	pmmhLNo.exe
3372	nZocSDO.exe
3412	sONLolC.exe
3448	NKfkLYC.exe
3484	QjqEzLC.exe
3516	qeYhamj.exe
3556	grwCbKo.exe
3588	NxIMNBQ.exe

Loads dropped DLL 64 IoCs

pid	Process
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe

UPX packed file 51 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1304-1-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/files/0x000a000000015cbd-3.dat	upx
behavioral1/files/0x0007000000015f3c-13.dat	upx
behavioral1/files/0x00070000000160cc-30.dat	upx
behavioral1/files/0x0007000000015fa7-19.dat	upx
behavioral1/files/0x000a000000016476-48.dat	upx
behavioral1/memory/2672-56-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/files/0x001800000000558a-32.dat	upx
behavioral1/memory/2016-62-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2912-65-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/memory/2576-66-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/files/0x0006000000016d1f-71.dat	upx
behavioral1/memory/2488-82-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2468-84-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/files/0x00060000000175b2-130.dat	upx
behavioral1/files/0x000500000001874a-158.dat	upx
behavioral1/files/0x0005000000019227-179.dat	upx
behavioral1/files/0x00050000000191ed-172.dat	upx
behavioral1/files/0x0006000000018bba-165.dat	upx
behavioral1/files/0x00050000000186d3-151.dat	upx
behavioral1/files/0x000500000001865a-144.dat	upx
behavioral1/files/0x001500000001863c-137.dat	upx
behavioral1/files/0x000600000001744c-123.dat	upx
behavioral1/files/0x000600000001739d-116.dat	upx
behavioral1/files/0x0006000000016e78-109.dat	upx
behavioral1/files/0x0007000000016d05-70.dat	upx
behavioral1/files/0x0006000000016d16-67.dat	upx
behavioral1/files/0x0006000000016da4-102.dat	upx
behavioral1/files/0x0006000000016d32-96.dat	upx
behavioral1/files/0x0006000000016d3a-86.dat	upx
behavioral1/memory/1984-35-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/files/0x0005000000019233-182.dat	upx
behavioral1/files/0x0005000000019223-177.dat	upx
behavioral1/files/0x00050000000191eb-170.dat	upx
behavioral1/files/0x000500000001874c-163.dat	upx
behavioral1/files/0x0005000000018700-156.dat	upx
behavioral1/files/0x00050000000186c1-149.dat	upx
behavioral1/files/0x0009000000018640-142.dat	upx
behavioral1/files/0x00060000000175b8-135.dat	upx
behavioral1/files/0x00060000000175ac-128.dat	upx
behavioral1/files/0x00060000000173e5-121.dat	upx
behavioral1/files/0x0006000000016fe8-114.dat	upx
behavioral1/files/0x0006000000016db3-107.dat	upx
behavioral1/files/0x0006000000016d9f-100.dat	upx
behavioral1/memory/3016-83-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/files/0x0006000000016d36-81.dat	upx
behavioral1/memory/2480-60-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/memory/2592-54-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/files/0x0006000000016d0e-49.dat	upx
behavioral1/memory/1440-47-0x000000013FD10000-0x0000000140102000-memory.dmp	upx
behavioral1/files/0x0009000000015d24-15.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GbHzEUJ.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\dOOLKAA.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\jZDCBAi.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\ZeTIEfd.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\bgvlivO.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\SLbUqJH.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\qocklHb.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\PEFOPLc.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\EjfvZes.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\RbzasBj.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\ALnlNGG.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\iMDdEPu.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\AuLhebX.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\oscpsnt.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\QhBbNcx.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\AJGgNAO.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\PmfAmqd.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\MKUbWbL.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\VhjotZF.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\iQsOvkD.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\Pzbuyex.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\CZxCSMn.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\aLBAFJC.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\smPUgbs.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\XoCGBVv.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\cMRphBD.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\VQIQIjj.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\OIvIrOF.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\kKWwpjq.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\oIKJgRd.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\PPNQIjG.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\uipAJid.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\RrfcvPu.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\sUsVXyl.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\uQqxFBG.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\rUQyWUJ.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\IPoOdZH.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\GbeDZVm.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\OxJnfqn.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\IdyHSmh.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\CPyuIxy.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\ErhrUoR.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\mEAnuvQ.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\fZbbLZi.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\DwaHHdK.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\AhhDJlb.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\GsOTweh.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\gRAFchQ.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\BtfXoDQ.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\bpPLCZQ.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\emZuAEw.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\uUdzdWK.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\GdCEsfT.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\vtJnqVV.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\pDFuwYP.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\iXZMLhn.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\vQgPFJT.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\duLfAdt.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\OnXdojO.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\LcYlQyH.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\IVDNWEN.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\MFqwMpl.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\DogsBHT.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
File created	C:\Windows\System\GAvsiYq.exe	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1712	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
Token: SeDebugPrivilege	1712	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 1712	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	29
PID 1304 wrote to memory of 1712	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	29
PID 1304 wrote to memory of 1712	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	29
PID 1304 wrote to memory of 1984	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	30
PID 1304 wrote to memory of 1984	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	30
PID 1304 wrote to memory of 1984	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	30
PID 1304 wrote to memory of 2016	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	31
PID 1304 wrote to memory of 2016	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	31
PID 1304 wrote to memory of 2016	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	31
PID 1304 wrote to memory of 1440	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	32
PID 1304 wrote to memory of 1440	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	32
PID 1304 wrote to memory of 1440	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	32
PID 1304 wrote to memory of 2592	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	33
PID 1304 wrote to memory of 2592	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	33
PID 1304 wrote to memory of 2592	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	33
PID 1304 wrote to memory of 2672	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	34
PID 1304 wrote to memory of 2672	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	34
PID 1304 wrote to memory of 2672	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	34
PID 1304 wrote to memory of 2576	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	35
PID 1304 wrote to memory of 2576	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	35
PID 1304 wrote to memory of 2576	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	35
PID 1304 wrote to memory of 2912	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	36
PID 1304 wrote to memory of 2912	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	36
PID 1304 wrote to memory of 2912	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	36
PID 1304 wrote to memory of 2488	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	37
PID 1304 wrote to memory of 2488	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	37
PID 1304 wrote to memory of 2488	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	37
PID 1304 wrote to memory of 2480	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	38
PID 1304 wrote to memory of 2480	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	38
PID 1304 wrote to memory of 2480	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	38
PID 1304 wrote to memory of 2528	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	39
PID 1304 wrote to memory of 2528	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	39
PID 1304 wrote to memory of 2528	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	39
PID 1304 wrote to memory of 3016	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	40
PID 1304 wrote to memory of 3016	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	40
PID 1304 wrote to memory of 3016	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	40
PID 1304 wrote to memory of 2624	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	41
PID 1304 wrote to memory of 2624	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	41
PID 1304 wrote to memory of 2624	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	41
PID 1304 wrote to memory of 2468	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	42
PID 1304 wrote to memory of 2468	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	42
PID 1304 wrote to memory of 2468	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	42
PID 1304 wrote to memory of 3044	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	43
PID 1304 wrote to memory of 3044	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	43
PID 1304 wrote to memory of 3044	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	43
PID 1304 wrote to memory of 2800	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	44
PID 1304 wrote to memory of 2800	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	44
PID 1304 wrote to memory of 2800	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	44
PID 1304 wrote to memory of 2840	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	45
PID 1304 wrote to memory of 2840	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	45
PID 1304 wrote to memory of 2840	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	45
PID 1304 wrote to memory of 2984	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	46
PID 1304 wrote to memory of 2984	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	46
PID 1304 wrote to memory of 2984	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	46
PID 1304 wrote to memory of 2768	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	47
PID 1304 wrote to memory of 2768	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	47
PID 1304 wrote to memory of 2768	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	47
PID 1304 wrote to memory of 1444	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	48
PID 1304 wrote to memory of 1444	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	48
PID 1304 wrote to memory of 1444	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	48
PID 1304 wrote to memory of 2132	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	49
PID 1304 wrote to memory of 2132	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	49
PID 1304 wrote to memory of 2132	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	49
PID 1304 wrote to memory of 2988	1304	09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09ad7b9dba337bf19c4e3116080d8671_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1712
- C:\Windows\System\CgGjNYT.exe
  C:\Windows\System\CgGjNYT.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\JWJMKha.exe
  C:\Windows\System\JWJMKha.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\ycnjtTL.exe
  C:\Windows\System\ycnjtTL.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\OUyVzpb.exe
  C:\Windows\System\OUyVzpb.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\CttWbjq.exe
  C:\Windows\System\CttWbjq.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\OOLgKmj.exe
  C:\Windows\System\OOLgKmj.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\crBlnPD.exe
  C:\Windows\System\crBlnPD.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\AyMswGa.exe
  C:\Windows\System\AyMswGa.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\RLOurqJ.exe
  C:\Windows\System\RLOurqJ.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\gcskadX.exe
  C:\Windows\System\gcskadX.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\qdWHZYD.exe
  C:\Windows\System\qdWHZYD.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\YqdCrZK.exe
  C:\Windows\System\YqdCrZK.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\qocklHb.exe
  C:\Windows\System\qocklHb.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\mMlJIwj.exe
  C:\Windows\System\mMlJIwj.exe
  2⤵
  PID:3044
- C:\Windows\System\fmGxEER.exe
  C:\Windows\System\fmGxEER.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\FGchTTu.exe
  C:\Windows\System\FGchTTu.exe
  2⤵
  PID:2840
- C:\Windows\System\XkCPKOb.exe
  C:\Windows\System\XkCPKOb.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\urJIFDp.exe
  C:\Windows\System\urJIFDp.exe
  2⤵
  PID:2768
- C:\Windows\System\QpULuab.exe
  C:\Windows\System\QpULuab.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\pOwYtyw.exe
  C:\Windows\System\pOwYtyw.exe
  2⤵
  PID:2132
- C:\Windows\System\gZTVSFX.exe
  C:\Windows\System\gZTVSFX.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\AeTYviv.exe
  C:\Windows\System\AeTYviv.exe
  2⤵
  PID:2732
- C:\Windows\System\RVSJzWy.exe
  C:\Windows\System\RVSJzWy.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\KrdLQrZ.exe
  C:\Windows\System\KrdLQrZ.exe
  2⤵
  PID:1588
- C:\Windows\System\iqkbhqb.exe
  C:\Windows\System\iqkbhqb.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\uIVpXOj.exe
  C:\Windows\System\uIVpXOj.exe
  2⤵
  PID:1044
- C:\Windows\System\vsLAbhA.exe
  C:\Windows\System\vsLAbhA.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\QgakknT.exe
  C:\Windows\System\QgakknT.exe
  2⤵
  PID:848
- C:\Windows\System\woXGSHz.exe
  C:\Windows\System\woXGSHz.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\vhFSUUh.exe
  C:\Windows\System\vhFSUUh.exe
  2⤵
  PID:2352
- C:\Windows\System\rLqkHqB.exe
  C:\Windows\System\rLqkHqB.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\FZQwhEW.exe
  C:\Windows\System\FZQwhEW.exe
  2⤵
  PID:540
- C:\Windows\System\KRmcooS.exe
  C:\Windows\System\KRmcooS.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\FcAtNnR.exe
  C:\Windows\System\FcAtNnR.exe
  2⤵
  PID:584
- C:\Windows\System\amUxIJz.exe
  C:\Windows\System\amUxIJz.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\TAQyolA.exe
  C:\Windows\System\TAQyolA.exe
  2⤵
  PID:1276
- C:\Windows\System\TNaXBBf.exe
  C:\Windows\System\TNaXBBf.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\AZrUnJY.exe
  C:\Windows\System\AZrUnJY.exe
  2⤵
  PID:1868
- C:\Windows\System\DGrPSpT.exe
  C:\Windows\System\DGrPSpT.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\fNfUAHb.exe
  C:\Windows\System\fNfUAHb.exe
  2⤵
  PID:1012
- C:\Windows\System\DixkFLb.exe
  C:\Windows\System\DixkFLb.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\iQsOvkD.exe
  C:\Windows\System\iQsOvkD.exe
  2⤵
  PID:1708
- C:\Windows\System\wodKIqM.exe
  C:\Windows\System\wodKIqM.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\avEtmhx.exe
  C:\Windows\System\avEtmhx.exe
  2⤵
  PID:2340
- C:\Windows\System\IdyHSmh.exe
  C:\Windows\System\IdyHSmh.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\ZXAbvhN.exe
  C:\Windows\System\ZXAbvhN.exe
  2⤵
  PID:1776
- C:\Windows\System\xqJZwJx.exe
  C:\Windows\System\xqJZwJx.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\KSeCLmt.exe
  C:\Windows\System\KSeCLmt.exe
  2⤵
  PID:1624
- C:\Windows\System\RTpkgBa.exe
  C:\Windows\System\RTpkgBa.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\BUTUwcG.exe
  C:\Windows\System\BUTUwcG.exe
  2⤵
  PID:2084
- C:\Windows\System\NbJZKgG.exe
  C:\Windows\System\NbJZKgG.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\xlrfflV.exe
  C:\Windows\System\xlrfflV.exe
  2⤵
  PID:1404
- C:\Windows\System\dxnuIYv.exe
  C:\Windows\System\dxnuIYv.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\ooLYePf.exe
  C:\Windows\System\ooLYePf.exe
  2⤵
  PID:968
- C:\Windows\System\SGAOGKa.exe
  C:\Windows\System\SGAOGKa.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\QNvVQbg.exe
  C:\Windows\System\QNvVQbg.exe
  2⤵
  PID:2536
- C:\Windows\System\UMyuczS.exe
  C:\Windows\System\UMyuczS.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\dOLJCEw.exe
  C:\Windows\System\dOLJCEw.exe
  2⤵
  PID:576
- C:\Windows\System\emAWhEr.exe
  C:\Windows\System\emAWhEr.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\mpTsUPf.exe
  C:\Windows\System\mpTsUPf.exe
  2⤵
  PID:2932
- C:\Windows\System\MsPkXBg.exe
  C:\Windows\System\MsPkXBg.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\FKMnaDy.exe
  C:\Windows\System\FKMnaDy.exe
  2⤵
  PID:2160
- C:\Windows\System\vpdNCaY.exe
  C:\Windows\System\vpdNCaY.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\YStiIzn.exe
  C:\Windows\System\YStiIzn.exe
  2⤵
  PID:1668
- C:\Windows\System\TnWXazK.exe
  C:\Windows\System\TnWXazK.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\XpndOJS.exe
  C:\Windows\System\XpndOJS.exe
  2⤵
  PID:1824
- C:\Windows\System\SCcBVPM.exe
  C:\Windows\System\SCcBVPM.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\ZxvegAD.exe
  C:\Windows\System\ZxvegAD.exe
  2⤵
  PID:1924
- C:\Windows\System\DiFmgqR.exe
  C:\Windows\System\DiFmgqR.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\OfXdnqB.exe
  C:\Windows\System\OfXdnqB.exe
  2⤵
  PID:2660
- C:\Windows\System\xzoZTpG.exe
  C:\Windows\System\xzoZTpG.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\CZnkKVz.exe
  C:\Windows\System\CZnkKVz.exe
  2⤵
  PID:2820
- C:\Windows\System\vAGIuoY.exe
  C:\Windows\System\vAGIuoY.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\gWRqmoy.exe
  C:\Windows\System\gWRqmoy.exe
  2⤵
  PID:2864
- C:\Windows\System\AYDOTMT.exe
  C:\Windows\System\AYDOTMT.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\fyrayAp.exe
  C:\Windows\System\fyrayAp.exe
  2⤵
  PID:1748
- C:\Windows\System\MFqwMpl.exe
  C:\Windows\System\MFqwMpl.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\pGJvRmL.exe
  C:\Windows\System\pGJvRmL.exe
  2⤵
  PID:1388
- C:\Windows\System\qGjBMzR.exe
  C:\Windows\System\qGjBMzR.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\afIkapb.exe
  C:\Windows\System\afIkapb.exe
  2⤵
  PID:2636
- C:\Windows\System\RXgZfJW.exe
  C:\Windows\System\RXgZfJW.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\smPUgbs.exe
  C:\Windows\System\smPUgbs.exe
  2⤵
  PID:112
- C:\Windows\System\GdQuyMt.exe
  C:\Windows\System\GdQuyMt.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\ANBVtmv.exe
  C:\Windows\System\ANBVtmv.exe
  2⤵
  PID:1272
- C:\Windows\System\lhaeMLx.exe
  C:\Windows\System\lhaeMLx.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\mXZkryY.exe
  C:\Windows\System\mXZkryY.exe
  2⤵
  PID:2552
- C:\Windows\System\VBndYhu.exe
  C:\Windows\System\VBndYhu.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\MWUaZHJ.exe
  C:\Windows\System\MWUaZHJ.exe
  2⤵
  PID:3108
- C:\Windows\System\awbRpxD.exe
  C:\Windows\System\awbRpxD.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\Pzbuyex.exe
  C:\Windows\System\Pzbuyex.exe
  2⤵
  PID:3140
- C:\Windows\System\FclkNvI.exe
  C:\Windows\System\FclkNvI.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\mhCofKT.exe
  C:\Windows\System\mhCofKT.exe
  2⤵
  PID:3176
- C:\Windows\System\yMxeDFL.exe
  C:\Windows\System\yMxeDFL.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\eIDkmUO.exe
  C:\Windows\System\eIDkmUO.exe
  2⤵
  PID:3208
- C:\Windows\System\wmxvHka.exe
  C:\Windows\System\wmxvHka.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\KNpeJxB.exe
  C:\Windows\System\KNpeJxB.exe
  2⤵
  PID:3244
- C:\Windows\System\QMLjHds.exe
  C:\Windows\System\QMLjHds.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\xpwvhml.exe
  C:\Windows\System\xpwvhml.exe
  2⤵
  PID:3288
- C:\Windows\System\QaMPPIM.exe
  C:\Windows\System\QaMPPIM.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\fZbbLZi.exe
  C:\Windows\System\fZbbLZi.exe
  2⤵
  PID:3320
- C:\Windows\System\pmmhLNo.exe
  C:\Windows\System\pmmhLNo.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\xfAAxbE.exe
  C:\Windows\System\xfAAxbE.exe
  2⤵
  PID:3352
- C:\Windows\System\nZocSDO.exe
  C:\Windows\System\nZocSDO.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\bhVrNBb.exe
  C:\Windows\System\bhVrNBb.exe
  2⤵
  PID:3396
- C:\Windows\System\sONLolC.exe
  C:\Windows\System\sONLolC.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\KZqJjQv.exe
  C:\Windows\System\KZqJjQv.exe
  2⤵
  PID:3428
- C:\Windows\System\NKfkLYC.exe
  C:\Windows\System\NKfkLYC.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\gLFfIEh.exe
  C:\Windows\System\gLFfIEh.exe
  2⤵
  PID:3468
- C:\Windows\System\QjqEzLC.exe
  C:\Windows\System\QjqEzLC.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\IZHygEa.exe
  C:\Windows\System\IZHygEa.exe
  2⤵
  PID:3500
- C:\Windows\System\qeYhamj.exe
  C:\Windows\System\qeYhamj.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\rbrcnVH.exe
  C:\Windows\System\rbrcnVH.exe
  2⤵
  PID:3532
- C:\Windows\System\grwCbKo.exe
  C:\Windows\System\grwCbKo.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\xpAweDV.exe
  C:\Windows\System\xpAweDV.exe
  2⤵
  PID:3572
- C:\Windows\System\NxIMNBQ.exe
  C:\Windows\System\NxIMNBQ.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\hYGrUoe.exe
  C:\Windows\System\hYGrUoe.exe
  2⤵
  PID:3604
- C:\Windows\System\RNGqvfG.exe
  C:\Windows\System\RNGqvfG.exe
  2⤵
  PID:3620
- C:\Windows\System\blzHNSb.exe
  C:\Windows\System\blzHNSb.exe
  2⤵
  PID:3636
- C:\Windows\System\xkkTrFu.exe
  C:\Windows\System\xkkTrFu.exe
  2⤵
  PID:3652
- C:\Windows\System\MCZErOj.exe
  C:\Windows\System\MCZErOj.exe
  2⤵
  PID:3676
- C:\Windows\System\gVtAEFq.exe
  C:\Windows\System\gVtAEFq.exe
  2⤵
  PID:3696
- C:\Windows\System\mxKVeKE.exe
  C:\Windows\System\mxKVeKE.exe
  2⤵
  PID:3720
- C:\Windows\System\YRfoEPc.exe
  C:\Windows\System\YRfoEPc.exe
  2⤵
  PID:3740
- C:\Windows\System\zdPWvyo.exe
  C:\Windows\System\zdPWvyo.exe
  2⤵
  PID:3756
- C:\Windows\System\QKoMnnX.exe
  C:\Windows\System\QKoMnnX.exe
  2⤵
  PID:3776
- C:\Windows\System\iQOaoic.exe
  C:\Windows\System\iQOaoic.exe
  2⤵
  PID:3792
- C:\Windows\System\ZKdbAeP.exe
  C:\Windows\System\ZKdbAeP.exe
  2⤵
  PID:3808
- C:\Windows\System\FBSShOM.exe
  C:\Windows\System\FBSShOM.exe
  2⤵
  PID:3824
- C:\Windows\System\SgRhzqy.exe
  C:\Windows\System\SgRhzqy.exe
  2⤵
  PID:3844
- C:\Windows\System\VklLVid.exe
  C:\Windows\System\VklLVid.exe
  2⤵
  PID:3860
- C:\Windows\System\qILzuIp.exe
  C:\Windows\System\qILzuIp.exe
  2⤵
  PID:3876
- C:\Windows\System\WfgVluR.exe
  C:\Windows\System\WfgVluR.exe
  2⤵
  PID:3892
- C:\Windows\System\BYlCnyc.exe
  C:\Windows\System\BYlCnyc.exe
  2⤵
  PID:3912
- C:\Windows\System\peWtjfT.exe
  C:\Windows\System\peWtjfT.exe
  2⤵
  PID:3928
- C:\Windows\System\sEFkXTB.exe
  C:\Windows\System\sEFkXTB.exe
  2⤵
  PID:3944
- C:\Windows\System\tzYnmOP.exe
  C:\Windows\System\tzYnmOP.exe
  2⤵
  PID:3968
- C:\Windows\System\XzqsNxA.exe
  C:\Windows\System\XzqsNxA.exe
  2⤵
  PID:3988
- C:\Windows\System\oIMMUpU.exe
  C:\Windows\System\oIMMUpU.exe
  2⤵
  PID:4004
- C:\Windows\System\FKtXfGW.exe
  C:\Windows\System\FKtXfGW.exe
  2⤵
  PID:4020
- C:\Windows\System\JMIBsym.exe
  C:\Windows\System\JMIBsym.exe
  2⤵
  PID:4040
- C:\Windows\System\elFGYtd.exe
  C:\Windows\System\elFGYtd.exe
  2⤵
  PID:4064
- C:\Windows\System\DTXkyRM.exe
  C:\Windows\System\DTXkyRM.exe
  2⤵
  PID:4080
- C:\Windows\System\ATfwYZT.exe
  C:\Windows\System\ATfwYZT.exe
  2⤵
  PID:2332
- C:\Windows\System\EzKLCpH.exe
  C:\Windows\System\EzKLCpH.exe
  2⤵
  PID:1492
- C:\Windows\System\SLwDsMf.exe
  C:\Windows\System\SLwDsMf.exe
  2⤵
  PID:944
- C:\Windows\System\bdKtVxy.exe
  C:\Windows\System\bdKtVxy.exe
  2⤵
  PID:1168
- C:\Windows\System\UlNdwYu.exe
  C:\Windows\System\UlNdwYu.exe
  2⤵
  PID:2156
- C:\Windows\System\JEZVoWC.exe
  C:\Windows\System\JEZVoWC.exe
  2⤵
  PID:704
- C:\Windows\System\qFiRVvm.exe
  C:\Windows\System\qFiRVvm.exe
  2⤵
  PID:3104
- C:\Windows\System\uByybnP.exe
  C:\Windows\System\uByybnP.exe
  2⤵
  PID:3172
- C:\Windows\System\yvHblEG.exe
  C:\Windows\System\yvHblEG.exe
  2⤵
  PID:3240
- C:\Windows\System\DAlJTFv.exe
  C:\Windows\System\DAlJTFv.exe
  2⤵
  PID:3312
- C:\Windows\System\hHWBdLI.exe
  C:\Windows\System\hHWBdLI.exe
  2⤵
  PID:3388
- C:\Windows\System\EpzgnIH.exe
  C:\Windows\System\EpzgnIH.exe
  2⤵
  PID:3424
- C:\Windows\System\PnRMVab.exe
  C:\Windows\System\PnRMVab.exe
  2⤵
  PID:3492
- C:\Windows\System\tESOHut.exe
  C:\Windows\System\tESOHut.exe
  2⤵
  PID:2640
- C:\Windows\System\EdsKCWz.exe
  C:\Windows\System\EdsKCWz.exe
  2⤵
  PID:3600
- C:\Windows\System\iRJEMft.exe
  C:\Windows\System\iRJEMft.exe
  2⤵
  PID:3664
- C:\Windows\System\zvSYbjc.exe
  C:\Windows\System\zvSYbjc.exe
  2⤵
  PID:2684
- C:\Windows\System\qMCnLFr.exe
  C:\Windows\System\qMCnLFr.exe
  2⤵
  PID:3716
- C:\Windows\System\JeXlumH.exe
  C:\Windows\System\JeXlumH.exe
  2⤵
  PID:3788
- C:\Windows\System\VehhHSv.exe
  C:\Windows\System\VehhHSv.exe
  2⤵
  PID:3856
- C:\Windows\System\XCdFTEM.exe
  C:\Windows\System\XCdFTEM.exe
  2⤵
  PID:3952
- C:\Windows\System\pktNOli.exe
  C:\Windows\System\pktNOli.exe
  2⤵
  PID:3996
- C:\Windows\System\rvLEsix.exe
  C:\Windows\System\rvLEsix.exe
  2⤵
  PID:4072
- C:\Windows\System\VfJDctt.exe
  C:\Windows\System\VfJDctt.exe
  2⤵
  PID:916
- C:\Windows\System\FEBMTom.exe
  C:\Windows\System\FEBMTom.exe
  2⤵
  PID:3168
- C:\Windows\System\PtQbsJu.exe
  C:\Windows\System\PtQbsJu.exe
  2⤵
  PID:3420
- C:\Windows\System\DcsRTyP.exe
  C:\Windows\System\DcsRTyP.exe
  2⤵
  PID:3660
- C:\Windows\System\qXhZeVL.exe
  C:\Windows\System\qXhZeVL.exe
  2⤵
  PID:3852
- C:\Windows\System\HkVyUqi.exe
  C:\Windows\System\HkVyUqi.exe
  2⤵
  PID:4108
- C:\Windows\System\IwefKaK.exe
  C:\Windows\System\IwefKaK.exe
  2⤵
  PID:4124
- C:\Windows\System\YqcinSK.exe
  C:\Windows\System\YqcinSK.exe
  2⤵
  PID:4256
- C:\Windows\System\AwagxBP.exe
  C:\Windows\System\AwagxBP.exe
  2⤵
  PID:4272
- C:\Windows\System\NxNDciT.exe
  C:\Windows\System\NxNDciT.exe
  2⤵
  PID:4288
- C:\Windows\System\hTOuYBJ.exe
  C:\Windows\System\hTOuYBJ.exe
  2⤵
  PID:4304
- C:\Windows\System\qDWbuTT.exe
  C:\Windows\System\qDWbuTT.exe
  2⤵
  PID:4348
- C:\Windows\System\dCJhjwO.exe
  C:\Windows\System\dCJhjwO.exe
  2⤵
  PID:4364
- C:\Windows\System\JPwjvww.exe
  C:\Windows\System\JPwjvww.exe
  2⤵
  PID:4380
- C:\Windows\System\fRsbppg.exe
  C:\Windows\System\fRsbppg.exe
  2⤵
  PID:4396
- C:\Windows\System\yVTHNgc.exe
  C:\Windows\System\yVTHNgc.exe
  2⤵
  PID:4412
- C:\Windows\System\UcVNLsY.exe
  C:\Windows\System\UcVNLsY.exe
  2⤵
  PID:4428
- C:\Windows\System\pFcHIfz.exe
  C:\Windows\System\pFcHIfz.exe
  2⤵
  PID:4444
- C:\Windows\System\wSFrlnt.exe
  C:\Windows\System\wSFrlnt.exe
  2⤵
  PID:4460
- C:\Windows\System\dfKaorI.exe
  C:\Windows\System\dfKaorI.exe
  2⤵
  PID:4480
- C:\Windows\System\TfnZFMA.exe
  C:\Windows\System\TfnZFMA.exe
  2⤵
  PID:4496
- C:\Windows\System\rEjnkPI.exe
  C:\Windows\System\rEjnkPI.exe
  2⤵
  PID:4512
- C:\Windows\System\xqfGGRz.exe
  C:\Windows\System\xqfGGRz.exe
  2⤵
  PID:4528
- C:\Windows\System\IwGxpuW.exe
  C:\Windows\System\IwGxpuW.exe
  2⤵
  PID:4544
- C:\Windows\System\lTQkyxP.exe
  C:\Windows\System\lTQkyxP.exe
  2⤵
  PID:4560
- C:\Windows\System\SjwUGKD.exe
  C:\Windows\System\SjwUGKD.exe
  2⤵
  PID:4576
- C:\Windows\System\GBwWlCr.exe
  C:\Windows\System\GBwWlCr.exe
  2⤵
  PID:4592
- C:\Windows\System\wOeiJhT.exe
  C:\Windows\System\wOeiJhT.exe
  2⤵
  PID:4608
- C:\Windows\System\cPxpKJj.exe
  C:\Windows\System\cPxpKJj.exe
  2⤵
  PID:4628
- C:\Windows\System\GqDyqro.exe
  C:\Windows\System\GqDyqro.exe
  2⤵
  PID:4652
- C:\Windows\System\ZHIfXwz.exe
  C:\Windows\System\ZHIfXwz.exe
  2⤵
  PID:4668
- C:\Windows\System\zRzPpAa.exe
  C:\Windows\System\zRzPpAa.exe
  2⤵
  PID:4684
- C:\Windows\System\pOVzcrm.exe
  C:\Windows\System\pOVzcrm.exe
  2⤵
  PID:4700
- C:\Windows\System\pndtcAW.exe
  C:\Windows\System\pndtcAW.exe
  2⤵
  PID:4716
- C:\Windows\System\PRJkFZt.exe
  C:\Windows\System\PRJkFZt.exe
  2⤵
  PID:4732
- C:\Windows\System\sIwXkSy.exe
  C:\Windows\System\sIwXkSy.exe
  2⤵
  PID:4752
- C:\Windows\System\cBXOfXB.exe
  C:\Windows\System\cBXOfXB.exe
  2⤵
  PID:4768
- C:\Windows\System\TMIbFdk.exe
  C:\Windows\System\TMIbFdk.exe
  2⤵
  PID:4784
- C:\Windows\System\EEUzjgk.exe
  C:\Windows\System\EEUzjgk.exe
  2⤵
  PID:4800
- C:\Windows\System\MVugbPl.exe
  C:\Windows\System\MVugbPl.exe
  2⤵
  PID:4816
- C:\Windows\System\HAVnLaj.exe
  C:\Windows\System\HAVnLaj.exe
  2⤵
  PID:4872
- C:\Windows\System\IWuqIDB.exe
  C:\Windows\System\IWuqIDB.exe
  2⤵
  PID:4892
- C:\Windows\System\WXBbNGq.exe
  C:\Windows\System\WXBbNGq.exe
  2⤵
  PID:4908
- C:\Windows\System\dgwayeM.exe
  C:\Windows\System\dgwayeM.exe
  2⤵
  PID:4924
- C:\Windows\System\dLmScdv.exe
  C:\Windows\System\dLmScdv.exe
  2⤵
  PID:4940
- C:\Windows\System\nlvmxxG.exe
  C:\Windows\System\nlvmxxG.exe
  2⤵
  PID:4956
- C:\Windows\System\vutEbaj.exe
  C:\Windows\System\vutEbaj.exe
  2⤵
  PID:4972
- C:\Windows\System\vtzwQhJ.exe
  C:\Windows\System\vtzwQhJ.exe
  2⤵
  PID:4988
- C:\Windows\System\oAHnsKy.exe
  C:\Windows\System\oAHnsKy.exe
  2⤵
  PID:5004
- C:\Windows\System\aKusPiE.exe
  C:\Windows\System\aKusPiE.exe
  2⤵
  PID:5020
- C:\Windows\System\FSLEcgB.exe
  C:\Windows\System\FSLEcgB.exe
  2⤵
  PID:5036
- C:\Windows\System\ZEDgpFL.exe
  C:\Windows\System\ZEDgpFL.exe
  2⤵
  PID:5052
- C:\Windows\System\NHIrnnU.exe
  C:\Windows\System\NHIrnnU.exe
  2⤵
  PID:5068
- C:\Windows\System\GZpZzbs.exe
  C:\Windows\System\GZpZzbs.exe
  2⤵
  PID:5084
- C:\Windows\System\DIhYqgI.exe
  C:\Windows\System\DIhYqgI.exe
  2⤵
  PID:5100
- C:\Windows\System\qphDwgl.exe
  C:\Windows\System\qphDwgl.exe
  2⤵
  PID:5116
- C:\Windows\System\MnWrbhM.exe
  C:\Windows\System\MnWrbhM.exe
  2⤵
  PID:2748
- C:\Windows\System\JGHJERK.exe
  C:\Windows\System\JGHJERK.exe
  2⤵
  PID:2972
- C:\Windows\System\TzgqHJo.exe
  C:\Windows\System\TzgqHJo.exe
  2⤵
  PID:3048
- C:\Windows\System\LxXxaen.exe
  C:\Windows\System\LxXxaen.exe
  2⤵
  PID:1284
- C:\Windows\System\ZaQbawl.exe
  C:\Windows\System\ZaQbawl.exe
  2⤵
  PID:2040
- C:\Windows\System\VlAIiSH.exe
  C:\Windows\System\VlAIiSH.exe
  2⤵
  PID:2196
- C:\Windows\System\BFvHWZz.exe
  C:\Windows\System\BFvHWZz.exe
  2⤵
  PID:3712
- C:\Windows\System\hwqPCVU.exe
  C:\Windows\System\hwqPCVU.exe
  2⤵
  PID:4264
- C:\Windows\System\mQxBOjz.exe
  C:\Windows\System\mQxBOjz.exe
  2⤵
  PID:4356
- C:\Windows\System\NmdPzdr.exe
  C:\Windows\System\NmdPzdr.exe
  2⤵
  PID:2496
- C:\Windows\System\oFkgFvA.exe
  C:\Windows\System\oFkgFvA.exe
  2⤵
  PID:4456
- C:\Windows\System\ofupujJ.exe
  C:\Windows\System\ofupujJ.exe
  2⤵
  PID:4524
- C:\Windows\System\qsGWrgu.exe
  C:\Windows\System\qsGWrgu.exe
  2⤵
  PID:4616
- C:\Windows\System\xORtzqa.exe
  C:\Windows\System\xORtzqa.exe
  2⤵
  PID:4664
- C:\Windows\System\DaBGVYw.exe
  C:\Windows\System\DaBGVYw.exe
  2⤵
  PID:4728
- C:\Windows\System\AAjMROR.exe
  C:\Windows\System\AAjMROR.exe
  2⤵
  PID:4796
- C:\Windows\System\PAjVmHq.exe
  C:\Windows\System\PAjVmHq.exe
  2⤵
  PID:4844
- C:\Windows\System\idqUKGg.exe
  C:\Windows\System\idqUKGg.exe
  2⤵
  PID:4864
- C:\Windows\System\PPNQIjG.exe
  C:\Windows\System\PPNQIjG.exe
  2⤵
  PID:4932
- C:\Windows\System\SOYCunb.exe
  C:\Windows\System\SOYCunb.exe
  2⤵
  PID:4996
- C:\Windows\System\yCEXxWD.exe
  C:\Windows\System\yCEXxWD.exe
  2⤵
  PID:5064
- C:\Windows\System\BYIQegE.exe
  C:\Windows\System\BYIQegE.exe
  2⤵
  PID:2116
- C:\Windows\System\WDhpaLb.exe
  C:\Windows\System\WDhpaLb.exe
  2⤵
  PID:1660
- C:\Windows\System\TFwgZyh.exe
  C:\Windows\System\TFwgZyh.exe
  2⤵
  PID:592
- C:\Windows\System\LBTRGCS.exe
  C:\Windows\System\LBTRGCS.exe
  2⤵
  PID:5132
- C:\Windows\System\genliFd.exe
  C:\Windows\System\genliFd.exe
  2⤵
  PID:5148
- C:\Windows\System\VVFzNdG.exe
  C:\Windows\System\VVFzNdG.exe
  2⤵
  PID:5164
- C:\Windows\System\RbzasBj.exe
  C:\Windows\System\RbzasBj.exe
  2⤵
  PID:5188
- C:\Windows\System\YJwulYe.exe
  C:\Windows\System\YJwulYe.exe
  2⤵
  PID:5208
- C:\Windows\System\BKcGngw.exe
  C:\Windows\System\BKcGngw.exe
  2⤵
  PID:5236
- C:\Windows\System\OFRsawO.exe
  C:\Windows\System\OFRsawO.exe
  2⤵
  PID:5252
- C:\Windows\System\hOBmenY.exe
  C:\Windows\System\hOBmenY.exe
  2⤵
  PID:5268
- C:\Windows\System\rIYIVgP.exe
  C:\Windows\System\rIYIVgP.exe
  2⤵
  PID:5284
- C:\Windows\System\InPLwyB.exe
  C:\Windows\System\InPLwyB.exe
  2⤵
  PID:5300
- C:\Windows\System\XgnHCHS.exe
  C:\Windows\System\XgnHCHS.exe
  2⤵
  PID:5316
- C:\Windows\System\LCXKGDy.exe
  C:\Windows\System\LCXKGDy.exe
  2⤵
  PID:5336
- C:\Windows\System\KZSoFWI.exe
  C:\Windows\System\KZSoFWI.exe
  2⤵
  PID:5352
- C:\Windows\System\DLglUob.exe
  C:\Windows\System\DLglUob.exe
  2⤵
  PID:5368
- C:\Windows\System\ORzQQVe.exe
  C:\Windows\System\ORzQQVe.exe
  2⤵
  PID:2612
- C:\Windows\System\tZmZsgD.exe
  C:\Windows\System\tZmZsgD.exe
  2⤵
  PID:4424
- C:\Windows\System\MYuUkrD.exe
  C:\Windows\System\MYuUkrD.exe
  2⤵
  PID:4840
- C:\Windows\System\BvJZUVn.exe
  C:\Windows\System\BvJZUVn.exe
  2⤵
  PID:5032
- C:\Windows\System\SyUxpuf.exe
  C:\Windows\System\SyUxpuf.exe
  2⤵
  PID:5124
- C:\Windows\System\dWydwTQ.exe
  C:\Windows\System\dWydwTQ.exe
  2⤵
  PID:2832
- C:\Windows\System\AOgtlae.exe
  C:\Windows\System\AOgtlae.exe
  2⤵
  PID:2860
- C:\Windows\System\QFhZeiR.exe
  C:\Windows\System\QFhZeiR.exe
  2⤵
  PID:3444
- C:\Windows\System\duvnZKm.exe
  C:\Windows\System\duvnZKm.exe
  2⤵
  PID:1636
- C:\Windows\System\HNnqtmk.exe
  C:\Windows\System\HNnqtmk.exe
  2⤵
  PID:3908
- C:\Windows\System\VYHVhsm.exe
  C:\Windows\System\VYHVhsm.exe
  2⤵
  PID:1744
- C:\Windows\System\SfkupBV.exe
  C:\Windows\System\SfkupBV.exe
  2⤵
  PID:4032
- C:\Windows\System\sXiQCRN.exe
  C:\Windows\System\sXiQCRN.exe
  2⤵
  PID:4144
- C:\Windows\System\yUaVrEX.exe
  C:\Windows\System\yUaVrEX.exe
  2⤵
  PID:4152
- C:\Windows\System\PGzwOKb.exe
  C:\Windows\System\PGzwOKb.exe
  2⤵
  PID:556
- C:\Windows\System\NgPqDcu.exe
  C:\Windows\System\NgPqDcu.exe
  2⤵
  PID:292
- C:\Windows\System\Mcsxyxg.exe
  C:\Windows\System\Mcsxyxg.exe
  2⤵
  PID:3056
- C:\Windows\System\sNqkVsI.exe
  C:\Windows\System\sNqkVsI.exe
  2⤵
  PID:4220
- C:\Windows\System\YOuncGf.exe
  C:\Windows\System\YOuncGf.exe
  2⤵
  PID:1536
- C:\Windows\System\ALVMUAn.exe
  C:\Windows\System\ALVMUAn.exe
  2⤵
  PID:2676
- C:\Windows\System\AMyoTdt.exe
  C:\Windows\System\AMyoTdt.exe
  2⤵
  PID:684
- C:\Windows\System\QnfdFPy.exe
  C:\Windows\System\QnfdFPy.exe
  2⤵
  PID:5172
- C:\Windows\System\OhquYoF.exe
  C:\Windows\System\OhquYoF.exe
  2⤵
  PID:5220
- C:\Windows\System\hTrWvGt.exe
  C:\Windows\System\hTrWvGt.exe
  2⤵
  PID:5292
- C:\Windows\System\TKjUqbk.exe
  C:\Windows\System\TKjUqbk.exe
  2⤵
  PID:5332
- C:\Windows\System\sgbZoEj.exe
  C:\Windows\System\sgbZoEj.exe
  2⤵
  PID:3084
- C:\Windows\System\pLqZNIt.exe
  C:\Windows\System\pLqZNIt.exe
  2⤵
  PID:4172
- C:\Windows\System\ICrzMuu.exe
  C:\Windows\System\ICrzMuu.exe
  2⤵
  PID:4212
- C:\Windows\System\cCoVRMt.exe
  C:\Windows\System\cCoVRMt.exe
  2⤵
  PID:4340
- C:\Windows\System\AZtQpSk.exe
  C:\Windows\System\AZtQpSk.exe
  2⤵
  PID:4324
- C:\Windows\System\Kqvmckm.exe
  C:\Windows\System\Kqvmckm.exe
  2⤵
  PID:2004
- C:\Windows\System\MMPcTiF.exe
  C:\Windows\System\MMPcTiF.exe
  2⤵
  PID:2504
- C:\Windows\System\YHPbhsB.exe
  C:\Windows\System\YHPbhsB.exe
  2⤵
  PID:1584
- C:\Windows\System\vUpvjab.exe
  C:\Windows\System\vUpvjab.exe
  2⤵
  PID:1968
- C:\Windows\System\CnENtlS.exe
  C:\Windows\System\CnENtlS.exe
  2⤵
  PID:828
- C:\Windows\System\MJEkIKC.exe
  C:\Windows\System\MJEkIKC.exe
  2⤵
  PID:1048
- C:\Windows\System\hNVWgiW.exe
  C:\Windows\System\hNVWgiW.exe
  2⤵
  PID:1980
- C:\Windows\System\zgHMVfv.exe
  C:\Windows\System\zgHMVfv.exe
  2⤵
  PID:4320
- C:\Windows\System\mRjkOBU.exe
  C:\Windows\System\mRjkOBU.exe
  2⤵
  PID:4408
- C:\Windows\System\SzWNhAJ.exe
  C:\Windows\System\SzWNhAJ.exe
  2⤵
  PID:2524
- C:\Windows\System\zXAIMdH.exe
  C:\Windows\System\zXAIMdH.exe
  2⤵
  PID:4536
- C:\Windows\System\kRbndpg.exe
  C:\Windows\System\kRbndpg.exe
  2⤵
  PID:4600
- C:\Windows\System\ArYsMka.exe
  C:\Windows\System\ArYsMka.exe
  2⤵
  PID:4676
- C:\Windows\System\pqRPUla.exe
  C:\Windows\System\pqRPUla.exe
  2⤵
  PID:4780
- C:\Windows\System\BPeAmLT.exe
  C:\Windows\System\BPeAmLT.exe
  2⤵
  PID:2668
- C:\Windows\System\oyULlSQ.exe
  C:\Windows\System\oyULlSQ.exe
  2⤵
  PID:1812
- C:\Windows\System\SOjNOOO.exe
  C:\Windows\System\SOjNOOO.exe
  2⤵
  PID:2936
- C:\Windows\System\itGdEin.exe
  C:\Windows\System\itGdEin.exe
  2⤵
  PID:3088
- C:\Windows\System\EfFWAYX.exe
  C:\Windows\System\EfFWAYX.exe
  2⤵
  PID:3156
- C:\Windows\System\IUvvMOy.exe
  C:\Windows\System\IUvvMOy.exe
  2⤵
  PID:3220
- C:\Windows\System\wncMgre.exe
  C:\Windows\System\wncMgre.exe
  2⤵
  PID:3300
- C:\Windows\System\tSJKnfd.exe
  C:\Windows\System\tSJKnfd.exe
  2⤵
  PID:3364
- C:\Windows\System\ORjQvRy.exe
  C:\Windows\System\ORjQvRy.exe
  2⤵
  PID:3440
- C:\Windows\System\mpvhgDM.exe
  C:\Windows\System\mpvhgDM.exe
  2⤵
  PID:3512
- C:\Windows\System\ybTMMmA.exe
  C:\Windows\System\ybTMMmA.exe
  2⤵
  PID:3584
- C:\Windows\System\IkCiUwO.exe
  C:\Windows\System\IkCiUwO.exe
  2⤵
  PID:3648
- C:\Windows\System\piOCCiD.exe
  C:\Windows\System\piOCCiD.exe
  2⤵
  PID:3736
- C:\Windows\System\pMFgxxN.exe
  C:\Windows\System\pMFgxxN.exe
  2⤵
  PID:3804
- C:\Windows\System\CHDrXSx.exe
  C:\Windows\System\CHDrXSx.exe
  2⤵
  PID:3872
- C:\Windows\System\JAwRjxH.exe
  C:\Windows\System\JAwRjxH.exe
  2⤵
  PID:3940
- C:\Windows\System\wuLYlmA.exe
  C:\Windows\System\wuLYlmA.exe
  2⤵
  PID:4016
- C:\Windows\System\dvDwcMl.exe
  C:\Windows\System\dvDwcMl.exe
  2⤵
  PID:4092
- C:\Windows\System\ZPkPaBJ.exe
  C:\Windows\System\ZPkPaBJ.exe
  2⤵
  PID:2928
- C:\Windows\System\jsGJQaM.exe
  C:\Windows\System\jsGJQaM.exe
  2⤵
  PID:3232
- C:\Windows\System\KsVHRuj.exe
  C:\Windows\System\KsVHRuj.exe
  2⤵
  PID:3464
- C:\Windows\System\PhCjqer.exe
  C:\Windows\System\PhCjqer.exe
  2⤵
  PID:2604
- C:\Windows\System\UgDMhKx.exe
  C:\Windows\System\UgDMhKx.exe
  2⤵
  PID:3920
- C:\Windows\System\qtDEBNW.exe
  C:\Windows\System\qtDEBNW.exe
  2⤵
  PID:3136
- C:\Windows\System\lAonDQY.exe
  C:\Windows\System\lAonDQY.exe
  2⤵
  PID:4104
- C:\Windows\System\PmDeDXT.exe
  C:\Windows\System\PmDeDXT.exe
  2⤵
  PID:5096
- C:\Windows\System\UDeBZsN.exe
  C:\Windows\System\UDeBZsN.exe
  2⤵
  PID:4852
- C:\Windows\System\qqavAtl.exe
  C:\Windows\System\qqavAtl.exe
  2⤵
  PID:4624
- C:\Windows\System\FdpqQry.exe
  C:\Windows\System\FdpqQry.exe
  2⤵
  PID:4388
- C:\Windows\System\BQlBcnx.exe
  C:\Windows\System\BQlBcnx.exe
  2⤵
  PID:2392
- C:\Windows\System\phTeylz.exe
  C:\Windows\System\phTeylz.exe
  2⤵
  PID:2812
- C:\Windows\System\uipAJid.exe
  C:\Windows\System\uipAJid.exe
  2⤵
  PID:5076
- C:\Windows\System\yTHitGD.exe
  C:\Windows\System\yTHitGD.exe
  2⤵
  PID:5012
- C:\Windows\System\pdABBaX.exe
  C:\Windows\System\pdABBaX.exe
  2⤵
  PID:4948
- C:\Windows\System\CzFLVxS.exe
  C:\Windows\System\CzFLVxS.exe
  2⤵
  PID:4880
- C:\Windows\System\AWjIMJI.exe
  C:\Windows\System\AWjIMJI.exe
  2⤵
  PID:4300
- C:\Windows\System\XVxlSIL.exe
  C:\Windows\System\XVxlSIL.exe
  2⤵
  PID:5396
- C:\Windows\System\ZQFUApe.exe
  C:\Windows\System\ZQFUApe.exe
  2⤵
  PID:3268
- C:\Windows\System\CZYdFVt.exe
  C:\Windows\System\CZYdFVt.exe
  2⤵
  PID:5432
- C:\Windows\System\kpSGilP.exe
  C:\Windows\System\kpSGilP.exe
  2⤵
  PID:4060
- C:\Windows\System\fJbJMoh.exe
  C:\Windows\System\fJbJMoh.exe
  2⤵
  PID:1988
- C:\Windows\System\cjfZScb.exe
  C:\Windows\System\cjfZScb.exe
  2⤵
  PID:2884
- C:\Windows\System\LTNKojQ.exe
  C:\Windows\System\LTNKojQ.exe
  2⤵
  PID:5760
- C:\Windows\System\UhOZFKq.exe
  C:\Windows\System\UhOZFKq.exe
  2⤵
  PID:2324
- C:\Windows\System\ptUeKZK.exe
  C:\Windows\System\ptUeKZK.exe
  2⤵
  PID:1600
- C:\Windows\System\XwZPRhH.exe
  C:\Windows\System\XwZPRhH.exe
  2⤵
  PID:3836
- C:\Windows\System\PBFJcdL.exe
  C:\Windows\System\PBFJcdL.exe
  2⤵
  PID:5140
- C:\Windows\System\ewydkjf.exe
  C:\Windows\System\ewydkjf.exe
  2⤵
  PID:4236
- C:\Windows\System\VcsIuUs.exe
  C:\Windows\System\VcsIuUs.exe
  2⤵
  PID:5180
- C:\Windows\System\KgPuxxS.exe
  C:\Windows\System\KgPuxxS.exe
  2⤵
  PID:3692
- C:\Windows\System\HykmphS.exe
  C:\Windows\System\HykmphS.exe
  2⤵
  PID:4344
- C:\Windows\System\SSsBKLS.exe
  C:\Windows\System\SSsBKLS.exe
  2⤵
  PID:4332
- C:\Windows\System\kLPVdrQ.exe
  C:\Windows\System\kLPVdrQ.exe
  2⤵
  PID:5364
- C:\Windows\System\RwWoecJ.exe
  C:\Windows\System\RwWoecJ.exe
  2⤵
  PID:2268
- C:\Windows\System\zHiEcGm.exe
  C:\Windows\System\zHiEcGm.exe
  2⤵
  PID:280
- C:\Windows\System\MeKEUXR.exe
  C:\Windows\System\MeKEUXR.exe
  2⤵
  PID:2456
- C:\Windows\System\mMckurT.exe
  C:\Windows\System\mMckurT.exe
  2⤵
  PID:2816
- C:\Windows\System\ojYSpbX.exe
  C:\Windows\System\ojYSpbX.exe
  2⤵
  PID:896
- C:\Windows\System\zNdiffV.exe
  C:\Windows\System\zNdiffV.exe
  2⤵
  PID:4504
- C:\Windows\System\UcoplQr.exe
  C:\Windows\System\UcoplQr.exe
  2⤵
  PID:4712
- C:\Windows\System\KNesuaA.exe
  C:\Windows\System\KNesuaA.exe
  2⤵
  PID:3012
- C:\Windows\System\RSYSIoh.exe
  C:\Windows\System\RSYSIoh.exe
  2⤵
  PID:1172
- C:\Windows\System\IPoOdZH.exe
  C:\Windows\System\IPoOdZH.exe
  2⤵
  PID:4468
- C:\Windows\System\GNANDYe.exe
  C:\Windows\System\GNANDYe.exe
  2⤵
  PID:4748
- C:\Windows\System\LKYvqQu.exe
  C:\Windows\System\LKYvqQu.exe
  2⤵
  PID:1560
- C:\Windows\System\dwvfduz.exe
  C:\Windows\System\dwvfduz.exe
  2⤵
  PID:4776
- C:\Windows\System\XaEcYgB.exe
  C:\Windows\System\XaEcYgB.exe
  2⤵
  PID:384
- C:\Windows\System\rFNmvth.exe
  C:\Windows\System\rFNmvth.exe
  2⤵
  PID:3188
- C:\Windows\System\cYVBZdV.exe
  C:\Windows\System\cYVBZdV.exe
  2⤵
  PID:3728
- C:\Windows\System\GnPFgox.exe
  C:\Windows\System\GnPFgox.exe
  2⤵
  PID:3332
- C:\Windows\System\HbUCbki.exe
  C:\Windows\System\HbUCbki.exe
  2⤵
  PID:3508
- C:\Windows\System\cLadFYi.exe
  C:\Windows\System\cLadFYi.exe
  2⤵
  PID:3904
- C:\Windows\System\ToKdzOu.exe
  C:\Windows\System\ToKdzOu.exe
  2⤵
  PID:4048
- C:\Windows\System\OUiyJcx.exe
  C:\Windows\System\OUiyJcx.exe
  2⤵
  PID:3616
- C:\Windows\System\vMuikix.exe
  C:\Windows\System\vMuikix.exe
  2⤵
  PID:3020
- C:\Windows\System\vqWygdE.exe
  C:\Windows\System\vqWygdE.exe
  2⤵
  PID:4036
- C:\Windows\System\qgDZKAN.exe
  C:\Windows\System\qgDZKAN.exe
  2⤵
  PID:3784
- C:\Windows\System\JpDyVmV.exe
  C:\Windows\System\JpDyVmV.exe
  2⤵
  PID:4964
- C:\Windows\System\InCVCLD.exe
  C:\Windows\System\InCVCLD.exe
  2⤵
  PID:1700
- C:\Windows\System\rupyhgX.exe
  C:\Windows\System\rupyhgX.exe
  2⤵
  PID:4392
- C:\Windows\System\JwQyrfF.exe
  C:\Windows\System\JwQyrfF.exe
  2⤵
  PID:5080
- C:\Windows\System\pqTZZdC.exe
  C:\Windows\System\pqTZZdC.exe
  2⤵
  PID:4916
- C:\Windows\System\LIrbhZw.exe
  C:\Windows\System\LIrbhZw.exe
  2⤵
  PID:2692
- C:\Windows\System\sgtyOaR.exe
  C:\Windows\System\sgtyOaR.exe
  2⤵
  PID:2540
- C:\Windows\System\TxCJnHg.exe
  C:\Windows\System\TxCJnHg.exe
  2⤵
  PID:3552
- C:\Windows\System\tpXqKZb.exe
  C:\Windows\System\tpXqKZb.exe
  2⤵
  PID:2440
- C:\Windows\System\XRTGSpf.exe
  C:\Windows\System\XRTGSpf.exe
  2⤵
  PID:2708
- C:\Windows\System\KMtRqyq.exe
  C:\Windows\System\KMtRqyq.exe
  2⤵
  PID:3028
- C:\Windows\System\wYRBQot.exe
  C:\Windows\System\wYRBQot.exe
  2⤵
  PID:2896
- C:\Windows\System\HgSBbfk.exe
  C:\Windows\System\HgSBbfk.exe
  2⤵
  PID:2428
- C:\Windows\System\dHVSInM.exe
  C:\Windows\System\dHVSInM.exe
  2⤵
  PID:2104
- C:\Windows\System\QvFVdNh.exe
  C:\Windows\System\QvFVdNh.exe
  2⤵
  PID:2464
- C:\Windows\System\uWWHnMX.exe
  C:\Windows\System\uWWHnMX.exe
  2⤵
  PID:1260
- C:\Windows\System\rXdxBxu.exe
  C:\Windows\System\rXdxBxu.exe
  2⤵
  PID:4228
- C:\Windows\System\DQSFUhM.exe
  C:\Windows\System\DQSFUhM.exe
  2⤵
  PID:2876
- C:\Windows\System\wmGOlrT.exe
  C:\Windows\System\wmGOlrT.exe
  2⤵
  PID:2688
- C:\Windows\System\oWRIawo.exe
  C:\Windows\System\oWRIawo.exe
  2⤵
  PID:2180
- C:\Windows\System\ffJlHPQ.exe
  C:\Windows\System\ffJlHPQ.exe
  2⤵
  PID:2644
- C:\Windows\System\lFxGrRA.exe
  C:\Windows\System\lFxGrRA.exe
  2⤵
  PID:1100
- C:\Windows\System\yNAtrDK.exe
  C:\Windows\System\yNAtrDK.exe
  2⤵
  PID:3408
- C:\Windows\System\UzOUSuH.exe
  C:\Windows\System\UzOUSuH.exe
  2⤵
  PID:3840
- C:\Windows\System\KGBxOjX.exe
  C:\Windows\System\KGBxOjX.exe
  2⤵
  PID:3380
- C:\Windows\System\aCGeSAY.exe
  C:\Windows\System\aCGeSAY.exe
  2⤵
  PID:4520
- C:\Windows\System\aFDngHY.exe
  C:\Windows\System\aFDngHY.exe
  2⤵
  PID:2584
- C:\Windows\System\CJYfTcE.exe
  C:\Windows\System\CJYfTcE.exe
  2⤵
  PID:3632
- C:\Windows\System\HhlgyZp.exe
  C:\Windows\System\HhlgyZp.exe
  2⤵
  PID:3752
- C:\Windows\System\RQCHFbT.exe
  C:\Windows\System\RQCHFbT.exe
  2⤵
  PID:4440
- C:\Windows\System\TDuPpYN.exe
  C:\Windows\System\TDuPpYN.exe
  2⤵
  PID:2892
- C:\Windows\System\dWULGTw.exe
  C:\Windows\System\dWULGTw.exe
  2⤵
  PID:2628
- C:\Windows\System\hGhmpoL.exe
  C:\Windows\System\hGhmpoL.exe
  2⤵
  PID:5156
- C:\Windows\System\koLQGLa.exe
  C:\Windows\System\koLQGLa.exe
  2⤵
  PID:4216
- C:\Windows\System\tXkdtYh.exe
  C:\Windows\System\tXkdtYh.exe
  2⤵
  PID:5328
- C:\Windows\System\KyidJlf.exe
  C:\Windows\System\KyidJlf.exe
  2⤵
  PID:296
- C:\Windows\System\TELSJcN.exe
  C:\Windows\System\TELSJcN.exe
  2⤵
  PID:1940
- C:\Windows\System\TlNbfAx.exe
  C:\Windows\System\TlNbfAx.exe
  2⤵
  PID:2200
- C:\Windows\System\lpCCIda.exe
  C:\Windows\System\lpCCIda.exe
  2⤵
  PID:4296
- C:\Windows\System\fNOrcFE.exe
  C:\Windows\System\fNOrcFE.exe
  2⤵
  PID:4168
- C:\Windows\System\fMzdOoe.exe
  C:\Windows\System\fMzdOoe.exe
  2⤵
  PID:5260
- C:\Windows\System\XBcenuA.exe
  C:\Windows\System\XBcenuA.exe
  2⤵
  PID:3216
- C:\Windows\System\fkkzpXa.exe
  C:\Windows\System\fkkzpXa.exe
  2⤵
  PID:4984
- C:\Windows\System\POoSmiK.exe
  C:\Windows\System\POoSmiK.exe
  2⤵
  PID:4100
- C:\Windows\System\jjzqorV.exe
  C:\Windows\System\jjzqorV.exe
  2⤵
  PID:3772
- C:\Windows\System\LFtdGXJ.exe
  C:\Windows\System\LFtdGXJ.exe
  2⤵
  PID:2844
- C:\Windows\System\aUcmOxk.exe
  C:\Windows\System\aUcmOxk.exe
  2⤵
  PID:2452
- C:\Windows\System\ukrrtrB.exe
  C:\Windows\System\ukrrtrB.exe
  2⤵
  PID:1448
- C:\Windows\System\ZDqOYyW.exe
  C:\Windows\System\ZDqOYyW.exe
  2⤵
  PID:772
- C:\Windows\System\ZIPTDZi.exe
  C:\Windows\System\ZIPTDZi.exe
  2⤵
  PID:2804
- C:\Windows\System\tGiatbq.exe
  C:\Windows\System\tGiatbq.exe
  2⤵
  PID:3984
- C:\Windows\System\xxTIsXg.exe
  C:\Windows\System\xxTIsXg.exe
  2⤵
  PID:3980
- C:\Windows\System\vPeehdW.exe
  C:\Windows\System\vPeehdW.exe
  2⤵
  PID:4248
- C:\Windows\System\MVeEdbv.exe
  C:\Windows\System\MVeEdbv.exe
  2⤵
  PID:3296
- C:\Windows\System\HdtlZaq.exe
  C:\Windows\System\HdtlZaq.exe
  2⤵
  PID:6156
- C:\Windows\System\DDrzHBv.exe
  C:\Windows\System\DDrzHBv.exe
  2⤵
  PID:6176
- C:\Windows\System\rKAJiHc.exe
  C:\Windows\System\rKAJiHc.exe
  2⤵
  PID:6192
- C:\Windows\System\cYjmelg.exe
  C:\Windows\System\cYjmelg.exe
  2⤵
  PID:6208
- C:\Windows\System\CCaYvxL.exe
  C:\Windows\System\CCaYvxL.exe
  2⤵
  PID:6228
- C:\Windows\System\AeSnpxc.exe
  C:\Windows\System\AeSnpxc.exe
  2⤵
  PID:6244
- C:\Windows\System\YsweZgL.exe
  C:\Windows\System\YsweZgL.exe
  2⤵
  PID:6260
- C:\Windows\System\tJvZjDR.exe
  C:\Windows\System\tJvZjDR.exe
  2⤵
  PID:6276
- C:\Windows\System\OEybJbt.exe
  C:\Windows\System\OEybJbt.exe
  2⤵
  PID:6296
- C:\Windows\System\BAecSZn.exe
  C:\Windows\System\BAecSZn.exe
  2⤵
  PID:6312
- C:\Windows\System\udBeUnZ.exe
  C:\Windows\System\udBeUnZ.exe
  2⤵
  PID:6328
- C:\Windows\System\ARQRRpH.exe
  C:\Windows\System\ARQRRpH.exe
  2⤵
  PID:6344
- C:\Windows\System\QXVFkXL.exe
  C:\Windows\System\QXVFkXL.exe
  2⤵
  PID:6360
- C:\Windows\System\KmOtfat.exe
  C:\Windows\System\KmOtfat.exe
  2⤵
  PID:6376
- C:\Windows\System\bLhhbGI.exe
  C:\Windows\System\bLhhbGI.exe
  2⤵
  PID:6392
- C:\Windows\System\ehHgiOb.exe
  C:\Windows\System\ehHgiOb.exe
  2⤵
  PID:6408
- C:\Windows\System\Vsmknkx.exe
  C:\Windows\System\Vsmknkx.exe
  2⤵
  PID:6424
- C:\Windows\System\LLuqNPj.exe
  C:\Windows\System\LLuqNPj.exe
  2⤵
  PID:6440
- C:\Windows\System\TceJsdd.exe
  C:\Windows\System\TceJsdd.exe
  2⤵
  PID:6456
- C:\Windows\System\QEefDDv.exe
  C:\Windows\System\QEefDDv.exe
  2⤵
  PID:6472
- C:\Windows\System\USahzBn.exe
  C:\Windows\System\USahzBn.exe
  2⤵
  PID:6488
- C:\Windows\System\bpfMnBE.exe
  C:\Windows\System\bpfMnBE.exe
  2⤵
  PID:6504
- C:\Windows\System\VnBmebO.exe
  C:\Windows\System\VnBmebO.exe
  2⤵
  PID:6520
- C:\Windows\System\RLtjMni.exe
  C:\Windows\System\RLtjMni.exe
  2⤵
  PID:6536
- C:\Windows\System\OTVYIjL.exe
  C:\Windows\System\OTVYIjL.exe
  2⤵
  PID:6552
- C:\Windows\System\GAvsiYq.exe
  C:\Windows\System\GAvsiYq.exe
  2⤵
  PID:6568
- C:\Windows\System\uyqpxhq.exe
  C:\Windows\System\uyqpxhq.exe
  2⤵
  PID:6584
- C:\Windows\System\YUFDWdH.exe
  C:\Windows\System\YUFDWdH.exe
  2⤵
  PID:6600
- C:\Windows\System\crJSusq.exe
  C:\Windows\System\crJSusq.exe
  2⤵
  PID:6616
- C:\Windows\System\WItbVEk.exe
  C:\Windows\System\WItbVEk.exe
  2⤵
  PID:6632
- C:\Windows\System\ObRbkIi.exe
  C:\Windows\System\ObRbkIi.exe
  2⤵
  PID:6648
- C:\Windows\System\cutqPHq.exe
  C:\Windows\System\cutqPHq.exe
  2⤵
  PID:6664
- C:\Windows\System\tfLArzn.exe
  C:\Windows\System\tfLArzn.exe
  2⤵
  PID:6680
- C:\Windows\System\vDLVVIE.exe
  C:\Windows\System\vDLVVIE.exe
  2⤵
  PID:6696
- C:\Windows\System\kNHLZLU.exe
  C:\Windows\System\kNHLZLU.exe
  2⤵
  PID:6712
- C:\Windows\System\dYzGbKt.exe
  C:\Windows\System\dYzGbKt.exe
  2⤵
  PID:6728
- C:\Windows\System\GrGnirv.exe
  C:\Windows\System\GrGnirv.exe
  2⤵
  PID:6744
- C:\Windows\System\ROSdsiK.exe
  C:\Windows\System\ROSdsiK.exe
  2⤵
  PID:6764
- C:\Windows\System\opbZTqc.exe
  C:\Windows\System\opbZTqc.exe
  2⤵
  PID:6780
- C:\Windows\System\OsDgxZw.exe
  C:\Windows\System\OsDgxZw.exe
  2⤵
  PID:6796
- C:\Windows\System\mkjXzrL.exe
  C:\Windows\System\mkjXzrL.exe
  2⤵
  PID:6812
- C:\Windows\System\TJHfScf.exe
  C:\Windows\System\TJHfScf.exe
  2⤵
  PID:6828
- C:\Windows\System\kBixDMe.exe
  C:\Windows\System\kBixDMe.exe
  2⤵
  PID:6844
- C:\Windows\System\vQUmtMG.exe
  C:\Windows\System\vQUmtMG.exe
  2⤵
  PID:6860
- C:\Windows\System\XUiXClo.exe
  C:\Windows\System\XUiXClo.exe
  2⤵
  PID:6876
- C:\Windows\System\IMVOxRk.exe
  C:\Windows\System\IMVOxRk.exe
  2⤵
  PID:6892
- C:\Windows\System\KRDlxji.exe
  C:\Windows\System\KRDlxji.exe
  2⤵
  PID:6908
- C:\Windows\System\QUgMPYr.exe
  C:\Windows\System\QUgMPYr.exe
  2⤵
  PID:6924
- C:\Windows\System\MrJLram.exe
  C:\Windows\System\MrJLram.exe
  2⤵
  PID:6940
- C:\Windows\System\YcQTEfe.exe
  C:\Windows\System\YcQTEfe.exe
  2⤵
  PID:6956
- C:\Windows\System\GbeDZVm.exe
  C:\Windows\System\GbeDZVm.exe
  2⤵
  PID:6972
- C:\Windows\System\JpkuqTi.exe
  C:\Windows\System\JpkuqTi.exe
  2⤵
  PID:6988
- C:\Windows\System\QkgsOaf.exe
  C:\Windows\System\QkgsOaf.exe
  2⤵
  PID:7004
- C:\Windows\System\sUsVXyl.exe
  C:\Windows\System\sUsVXyl.exe
  2⤵
  PID:7020
- C:\Windows\System\RRuhEnb.exe
  C:\Windows\System\RRuhEnb.exe
  2⤵
  PID:7036
- C:\Windows\System\wxuQwMJ.exe
  C:\Windows\System\wxuQwMJ.exe
  2⤵
  PID:7056
- C:\Windows\System\oMEgikA.exe
  C:\Windows\System\oMEgikA.exe
  2⤵
  PID:7072
- C:\Windows\System\BVzJxPU.exe
  C:\Windows\System\BVzJxPU.exe
  2⤵
  PID:7088
- C:\Windows\System\ynRXDlV.exe
  C:\Windows\System\ynRXDlV.exe
  2⤵
  PID:7104
- C:\Windows\System\oLtOpBd.exe
  C:\Windows\System\oLtOpBd.exe
  2⤵
  PID:7120
- C:\Windows\System\OZLRUlU.exe
  C:\Windows\System\OZLRUlU.exe
  2⤵
  PID:7136
- C:\Windows\System\HHLJZUW.exe
  C:\Windows\System\HHLJZUW.exe
  2⤵
  PID:7152
- C:\Windows\System\AoXYZjP.exe
  C:\Windows\System\AoXYZjP.exe
  2⤵
  PID:6148
- C:\Windows\System\REJQgIo.exe
  C:\Windows\System\REJQgIo.exe
  2⤵
  PID:4284
- C:\Windows\System\IVCnFNf.exe
  C:\Windows\System\IVCnFNf.exe
  2⤵
  PID:6216
- C:\Windows\System\zHdzJpr.exe
  C:\Windows\System\zHdzJpr.exe
  2⤵
  PID:4648
- C:\Windows\System\gguBjUK.exe
  C:\Windows\System\gguBjUK.exe
  2⤵
  PID:2856
- C:\Windows\System\cMRphBD.exe
  C:\Windows\System\cMRphBD.exe
  2⤵
  PID:4404
- C:\Windows\System\FihtFem.exe
  C:\Windows\System\FihtFem.exe
  2⤵
  PID:3688
- C:\Windows\System\lMLFJCG.exe
  C:\Windows\System\lMLFJCG.exe
  2⤵
  PID:6220
- C:\Windows\System\oHyZalD.exe
  C:\Windows\System\oHyZalD.exe
  2⤵
  PID:6288
- C:\Windows\System\aatlseg.exe
  C:\Windows\System\aatlseg.exe
  2⤵
  PID:6324
- C:\Windows\System\tNkhsLF.exe
  C:\Windows\System\tNkhsLF.exe
  2⤵
  PID:6388
- C:\Windows\System\XuBhyTU.exe
  C:\Windows\System\XuBhyTU.exe
  2⤵
  PID:6448
- C:\Windows\System\radtdff.exe
  C:\Windows\System\radtdff.exe
  2⤵
  PID:6516
- C:\Windows\System\qtdAHGX.exe
  C:\Windows\System\qtdAHGX.exe
  2⤵
  PID:6608
- C:\Windows\System\jwHrLBd.exe
  C:\Windows\System\jwHrLBd.exe
  2⤵
  PID:6672
- C:\Windows\System\zHqYoqR.exe
  C:\Windows\System\zHqYoqR.exe
  2⤵
  PID:6708
- C:\Windows\System\rWKXNvX.exe
  C:\Windows\System\rWKXNvX.exe
  2⤵
  PID:6776
- C:\Windows\System\BSNVWhx.exe
  C:\Windows\System\BSNVWhx.exe
  2⤵
  PID:6836
- C:\Windows\System\iQvqBbo.exe
  C:\Windows\System\iQvqBbo.exe
  2⤵
  PID:6900
- C:\Windows\System\VrGlnLD.exe
  C:\Windows\System\VrGlnLD.exe
  2⤵
  PID:6964
- C:\Windows\System\qrFBIUL.exe
  C:\Windows\System\qrFBIUL.exe
  2⤵
  PID:7000
- C:\Windows\System\fAwHUtk.exe
  C:\Windows\System\fAwHUtk.exe
  2⤵
  PID:6236
- C:\Windows\System\rYasUlm.exe
  C:\Windows\System\rYasUlm.exe
  2⤵
  PID:6980
- C:\Windows\System\uNnDAIC.exe
  C:\Windows\System\uNnDAIC.exe
  2⤵
  PID:6756
- C:\Windows\System\SonKSqY.exe
  C:\Windows\System\SonKSqY.exe
  2⤵
  PID:6340
- C:\Windows\System\SKGQetf.exe
  C:\Windows\System\SKGQetf.exe
  2⤵
  PID:6404
- C:\Windows\System\orhUdDt.exe
  C:\Windows\System\orhUdDt.exe
  2⤵
  PID:6496
- C:\Windows\System\kUGqRAF.exe
  C:\Windows\System\kUGqRAF.exe
  2⤵
  PID:6564
- C:\Windows\System\FQwKOvi.exe
  C:\Windows\System\FQwKOvi.exe
  2⤵
  PID:6628
- C:\Windows\System\aSesQtH.exe
  C:\Windows\System\aSesQtH.exe
  2⤵
  PID:6692
- C:\Windows\System\bXssHUK.exe
  C:\Windows\System\bXssHUK.exe
  2⤵
  PID:6788
- C:\Windows\System\pDWquRL.exe
  C:\Windows\System\pDWquRL.exe
  2⤵
  PID:6852
- C:\Windows\System\UVoUmIV.exe
  C:\Windows\System\UVoUmIV.exe
  2⤵
  PID:6916
- C:\Windows\System\LWLmNnG.exe
  C:\Windows\System\LWLmNnG.exe
  2⤵
  PID:7044
- C:\Windows\System\gUPbWBy.exe
  C:\Windows\System\gUPbWBy.exe
  2⤵
  PID:7084
- C:\Windows\System\lMidFae.exe
  C:\Windows\System\lMidFae.exe
  2⤵
  PID:7128
- C:\Windows\System\BjeVTtn.exe
  C:\Windows\System\BjeVTtn.exe
  2⤵
  PID:7144
- C:\Windows\System\pkKUoYS.exe
  C:\Windows\System\pkKUoYS.exe
  2⤵
  PID:2744
- C:\Windows\System\NiZBMAW.exe
  C:\Windows\System\NiZBMAW.exe
  2⤵
  PID:4764
- C:\Windows\System\QCaQoJf.exe
  C:\Windows\System\QCaQoJf.exe
  2⤵
  PID:6384
- C:\Windows\System\jaUxAmE.exe
  C:\Windows\System\jaUxAmE.exe
  2⤵
  PID:6224
- C:\Windows\System\EdimLZF.exe
  C:\Windows\System\EdimLZF.exe
  2⤵
  PID:924
- C:\Windows\System\xdRzkkx.exe
  C:\Windows\System\xdRzkkx.exe
  2⤵
  PID:6320
- C:\Windows\System\AGFamxw.exe
  C:\Windows\System\AGFamxw.exe
  2⤵
  PID:6644
- C:\Windows\System\jbQOHyI.exe
  C:\Windows\System\jbQOHyI.exe
  2⤵
  PID:6872
- C:\Windows\System\oHZKAhn.exe
  C:\Windows\System\oHZKAhn.exe
  2⤵
  PID:6676
- C:\Windows\System\TzegDlx.exe
  C:\Windows\System\TzegDlx.exe
  2⤵
  PID:6932
- C:\Windows\System\tddTAdV.exe
  C:\Windows\System\tddTAdV.exe
  2⤵
  PID:2852
- C:\Windows\System\XoCGBVv.exe
  C:\Windows\System\XoCGBVv.exe
  2⤵
  PID:1816
- C:\Windows\System\ZnQVSis.exe
  C:\Windows\System\ZnQVSis.exe
  2⤵
  PID:6336
- C:\Windows\System\nANCtcE.exe
  C:\Windows\System\nANCtcE.exe
  2⤵
  PID:6724
- C:\Windows\System\GpZpMZk.exe
  C:\Windows\System\GpZpMZk.exe
  2⤵
  PID:6884
- C:\Windows\System\EGCNXIN.exe
  C:\Windows\System\EGCNXIN.exe
  2⤵
  PID:7160
- C:\Windows\System\ZiYppLC.exe
  C:\Windows\System\ZiYppLC.exe
  2⤵
  PID:6512
- C:\Windows\System\nekMbFK.exe
  C:\Windows\System\nekMbFK.exe
  2⤵
  PID:6284
- C:\Windows\System\xWSxvwP.exe
  C:\Windows\System\xWSxvwP.exe
  2⤵
  PID:6272
- C:\Windows\System\dRjWAme.exe
  C:\Windows\System\dRjWAme.exe
  2⤵
  PID:6596
- C:\Windows\System\lEIAnvT.exe
  C:\Windows\System\lEIAnvT.exe
  2⤵
  PID:6372
- C:\Windows\System\HMRqkYf.exe
  C:\Windows\System\HMRqkYf.exe
  2⤵
  PID:7016
- C:\Windows\System\qoqFUvY.exe
  C:\Windows\System\qoqFUvY.exe
  2⤵
  PID:6400
- C:\Windows\System\DDJQHZI.exe
  C:\Windows\System\DDJQHZI.exe
  2⤵
  PID:6452
- C:\Windows\System\WEyEbFC.exe
  C:\Windows\System\WEyEbFC.exe
  2⤵
  PID:6688
- C:\Windows\System\iVfjLnu.exe
  C:\Windows\System\iVfjLnu.exe
  2⤵
  PID:7112
- C:\Windows\System\uZJrrSm.exe
  C:\Windows\System\uZJrrSm.exe
  2⤵
  PID:6188
- C:\Windows\System\mGEktyJ.exe
  C:\Windows\System\mGEktyJ.exe
  2⤵
  PID:7032
- C:\Windows\System\KmxVNec.exe
  C:\Windows\System\KmxVNec.exe
  2⤵
  PID:6760
- C:\Windows\System\VkdXDti.exe
  C:\Windows\System\VkdXDti.exe
  2⤵
  PID:6468
- C:\Windows\System\NWmCfkb.exe
  C:\Windows\System\NWmCfkb.exe
  2⤵
  PID:6172
- C:\Windows\System\qNWhJrr.exe
  C:\Windows\System\qNWhJrr.exe
  2⤵
  PID:6576
- C:\Windows\System\dgCugFn.exe
  C:\Windows\System\dgCugFn.exe
  2⤵
  PID:7184
- C:\Windows\System\moPMzWi.exe
  C:\Windows\System\moPMzWi.exe
  2⤵
  PID:7200
- C:\Windows\System\aahUAIj.exe
  C:\Windows\System\aahUAIj.exe
  2⤵
  PID:7216
- C:\Windows\System\WTyanls.exe
  C:\Windows\System\WTyanls.exe
  2⤵
  PID:7232
- C:\Windows\System\IewJbWS.exe
  C:\Windows\System\IewJbWS.exe
  2⤵
  PID:7248
- C:\Windows\System\RtifChw.exe
  C:\Windows\System\RtifChw.exe
  2⤵
  PID:7264
- C:\Windows\System\OtrtyDd.exe
  C:\Windows\System\OtrtyDd.exe
  2⤵
  PID:7296
- C:\Windows\System\EqZOtkR.exe
  C:\Windows\System\EqZOtkR.exe
  2⤵
  PID:7312
- C:\Windows\System\KahBGyF.exe
  C:\Windows\System\KahBGyF.exe
  2⤵
  PID:7328
- C:\Windows\System\cERrZTc.exe
  C:\Windows\System\cERrZTc.exe
  2⤵
  PID:7344
- C:\Windows\System\NYqYIMT.exe
  C:\Windows\System\NYqYIMT.exe
  2⤵
  PID:7360
- C:\Windows\System\JKDYTnz.exe
  C:\Windows\System\JKDYTnz.exe
  2⤵
  PID:7376
- C:\Windows\System\gaPvrum.exe
  C:\Windows\System\gaPvrum.exe
  2⤵
  PID:7392
- C:\Windows\System\TzCgSgu.exe
  C:\Windows\System\TzCgSgu.exe
  2⤵
  PID:7408
- C:\Windows\System\JlkDpqc.exe
  C:\Windows\System\JlkDpqc.exe
  2⤵
  PID:7424
- C:\Windows\System\peSWaon.exe
  C:\Windows\System\peSWaon.exe
  2⤵
  PID:7440
- C:\Windows\System\YOFFZLf.exe
  C:\Windows\System\YOFFZLf.exe
  2⤵
  PID:7456
- C:\Windows\System\dZVlBwJ.exe
  C:\Windows\System\dZVlBwJ.exe
  2⤵
  PID:7472
- C:\Windows\System\FJbYOVg.exe
  C:\Windows\System\FJbYOVg.exe
  2⤵
  PID:7488
- C:\Windows\System\paVtipA.exe
  C:\Windows\System\paVtipA.exe
  2⤵
  PID:7504
- C:\Windows\System\TZFHjZb.exe
  C:\Windows\System\TZFHjZb.exe
  2⤵
  PID:7520
- C:\Windows\System\LWPRQEa.exe
  C:\Windows\System\LWPRQEa.exe
  2⤵
  PID:7536
- C:\Windows\System\guBoQcp.exe
  C:\Windows\System\guBoQcp.exe
  2⤵
  PID:7552
- C:\Windows\System\YGXIaGM.exe
  C:\Windows\System\YGXIaGM.exe
  2⤵
  PID:7568
- C:\Windows\System\bpPLCZQ.exe
  C:\Windows\System\bpPLCZQ.exe
  2⤵
  PID:7584
- C:\Windows\System\rMyRcIn.exe
  C:\Windows\System\rMyRcIn.exe
  2⤵
  PID:7600
- C:\Windows\System\rUQyWUJ.exe
  C:\Windows\System\rUQyWUJ.exe
  2⤵
  PID:7616
- C:\Windows\System\LAbIpoC.exe
  C:\Windows\System\LAbIpoC.exe
  2⤵
  PID:7632
- C:\Windows\System\enyTNgm.exe
  C:\Windows\System\enyTNgm.exe
  2⤵
  PID:7648
- C:\Windows\System\juYHDYF.exe
  C:\Windows\System\juYHDYF.exe
  2⤵
  PID:7664
- C:\Windows\System\gvcMBkK.exe
  C:\Windows\System\gvcMBkK.exe
  2⤵
  PID:7680
- C:\Windows\System\vcWYvwR.exe
  C:\Windows\System\vcWYvwR.exe
  2⤵
  PID:7696
- C:\Windows\System\AFVUWOI.exe
  C:\Windows\System\AFVUWOI.exe
  2⤵
  PID:7712
- C:\Windows\System\hHTeaYP.exe
  C:\Windows\System\hHTeaYP.exe
  2⤵
  PID:7728
- C:\Windows\System\jVzrtiA.exe
  C:\Windows\System\jVzrtiA.exe
  2⤵
  PID:7744
- C:\Windows\System\VtUXpdJ.exe
  C:\Windows\System\VtUXpdJ.exe
  2⤵
  PID:7760
- C:\Windows\System\CRpVXaJ.exe
  C:\Windows\System\CRpVXaJ.exe
  2⤵
  PID:7776
- C:\Windows\System\MBozaTR.exe
  C:\Windows\System\MBozaTR.exe
  2⤵
  PID:7792
- C:\Windows\System\yQXzmeW.exe
  C:\Windows\System\yQXzmeW.exe
  2⤵
  PID:7808
- C:\Windows\System\KJImJSh.exe
  C:\Windows\System\KJImJSh.exe
  2⤵
  PID:7824
- C:\Windows\System\bvQtPde.exe
  C:\Windows\System\bvQtPde.exe
  2⤵
  PID:7840
- C:\Windows\System\FHuUXgS.exe
  C:\Windows\System\FHuUXgS.exe
  2⤵
  PID:7860
- C:\Windows\System\XaSJFQR.exe
  C:\Windows\System\XaSJFQR.exe
  2⤵
  PID:7876
- C:\Windows\System\rZEaNvq.exe
  C:\Windows\System\rZEaNvq.exe
  2⤵
  PID:7892
- C:\Windows\System\CZxEKON.exe
  C:\Windows\System\CZxEKON.exe
  2⤵
  PID:7908
- C:\Windows\System\qZahgzq.exe
  C:\Windows\System\qZahgzq.exe
  2⤵
  PID:7924
- C:\Windows\System\fDliIec.exe
  C:\Windows\System\fDliIec.exe
  2⤵
  PID:7940
- C:\Windows\System\nQIAiJr.exe
  C:\Windows\System\nQIAiJr.exe
  2⤵
  PID:7956
- C:\Windows\System\vteyYWn.exe
  C:\Windows\System\vteyYWn.exe
  2⤵
  PID:7972
- C:\Windows\System\UhuOwwG.exe
  C:\Windows\System\UhuOwwG.exe
  2⤵
  PID:7988
- C:\Windows\System\SQlCxHM.exe
  C:\Windows\System\SQlCxHM.exe
  2⤵
  PID:8004
- C:\Windows\System\iGUHEgn.exe
  C:\Windows\System\iGUHEgn.exe
  2⤵
  PID:8020
- C:\Windows\System\ZXudJkB.exe
  C:\Windows\System\ZXudJkB.exe
  2⤵
  PID:8036
- C:\Windows\System\VnoNQWJ.exe
  C:\Windows\System\VnoNQWJ.exe
  2⤵
  PID:8052
- C:\Windows\System\lIEPjSF.exe
  C:\Windows\System\lIEPjSF.exe
  2⤵
  PID:8068
- C:\Windows\System\ELHOqnG.exe
  C:\Windows\System\ELHOqnG.exe
  2⤵
  PID:8084
- C:\Windows\System\yCKgNkD.exe
  C:\Windows\System\yCKgNkD.exe
  2⤵
  PID:8100
- C:\Windows\System\brDjiRO.exe
  C:\Windows\System\brDjiRO.exe
  2⤵
  PID:8116
- C:\Windows\System\xTHZDeW.exe
  C:\Windows\System\xTHZDeW.exe
  2⤵
  PID:8132
- C:\Windows\System\PjMnhfs.exe
  C:\Windows\System\PjMnhfs.exe
  2⤵
  PID:8148
- C:\Windows\System\TIjqIbz.exe
  C:\Windows\System\TIjqIbz.exe
  2⤵
  PID:8164
- C:\Windows\System\uPUfHDN.exe
  C:\Windows\System\uPUfHDN.exe
  2⤵
  PID:8180
- C:\Windows\System\WetYtYd.exe
  C:\Windows\System\WetYtYd.exe
  2⤵
  PID:7068
- C:\Windows\System\cTOXSvP.exe
  C:\Windows\System\cTOXSvP.exe
  2⤵
  PID:7196
- C:\Windows\System\pzTiQUo.exe
  C:\Windows\System\pzTiQUo.exe
  2⤵
  PID:7080
- C:\Windows\System\iolyNVE.exe
  C:\Windows\System\iolyNVE.exe
  2⤵
  PID:6868
- C:\Windows\System\vfEYMgT.exe
  C:\Windows\System\vfEYMgT.exe
  2⤵
  PID:1648
- C:\Windows\System\XNZOAox.exe
  C:\Windows\System\XNZOAox.exe
  2⤵
  PID:7176
- C:\Windows\System\emZuAEw.exe
  C:\Windows\System\emZuAEw.exe
  2⤵
  PID:7228
- C:\Windows\System\AdqWWVe.exe
  C:\Windows\System\AdqWWVe.exe
  2⤵
  PID:7260
- C:\Windows\System\kqIPaIv.exe
  C:\Windows\System\kqIPaIv.exe
  2⤵
  PID:2012
- C:\Windows\System\NJDraiZ.exe
  C:\Windows\System\NJDraiZ.exe
  2⤵
  PID:7500
- C:\Windows\System\INshBeg.exe
  C:\Windows\System\INshBeg.exe
  2⤵
  PID:7624
- C:\Windows\System\LBXvkgs.exe
  C:\Windows\System\LBXvkgs.exe
  2⤵
  PID:7736
- C:\Windows\System\ypkwSnk.exe
  C:\Windows\System\ypkwSnk.exe
  2⤵
  PID:7608
- C:\Windows\System\hfTjufs.exe
  C:\Windows\System\hfTjufs.exe
  2⤵
  PID:7544
- C:\Windows\System\fOjarpq.exe
  C:\Windows\System\fOjarpq.exe
  2⤵
  PID:7384
- C:\Windows\System\oaqPMGo.exe
  C:\Windows\System\oaqPMGo.exe
  2⤵
  PID:7800
- C:\Windows\System\DwaHHdK.exe
  C:\Windows\System\DwaHHdK.exe
  2⤵
  PID:7888
- C:\Windows\System\PgbcyJP.exe
  C:\Windows\System\PgbcyJP.exe
  2⤵
  PID:7916
- C:\Windows\System\zKhZmZK.exe
  C:\Windows\System\zKhZmZK.exe
  2⤵
  PID:1716
- C:\Windows\System\yjbwinR.exe
  C:\Windows\System\yjbwinR.exe
  2⤵
  PID:7336
- C:\Windows\System\MApsUfc.exe
  C:\Windows\System\MApsUfc.exe
  2⤵
  PID:7756
- C:\Windows\System\aipzWkG.exe
  C:\Windows\System\aipzWkG.exe
  2⤵
  PID:7848
- C:\Windows\System\gcAqqfm.exe
  C:\Windows\System\gcAqqfm.exe
  2⤵
  PID:7496
- C:\Windows\System\VibWNLe.exe
  C:\Windows\System\VibWNLe.exe
  2⤵
  PID:7516
- C:\Windows\System\aRDcoHT.exe
  C:\Windows\System\aRDcoHT.exe
  2⤵
  PID:7984
- C:\Windows\System\XDTmozi.exe
  C:\Windows\System\XDTmozi.exe
  2⤵
  PID:7192
- C:\Windows\System\aDzdgIL.exe
  C:\Windows\System\aDzdgIL.exe
  2⤵
  PID:6996
- C:\Windows\System\mCPVBrO.exe
  C:\Windows\System\mCPVBrO.exe
  2⤵
  PID:7592
- C:\Windows\System\GODjsZy.exe
  C:\Windows\System\GODjsZy.exe
  2⤵
  PID:8208
- C:\Windows\System\RJcqbsz.exe
  C:\Windows\System\RJcqbsz.exe
  2⤵
  PID:8224
- C:\Windows\System\xmRljzF.exe
  C:\Windows\System\xmRljzF.exe
  2⤵
  PID:8248
- C:\Windows\System\PqqbHND.exe
  C:\Windows\System\PqqbHND.exe
  2⤵
  PID:8272
- C:\Windows\System\uQqxFBG.exe
  C:\Windows\System\uQqxFBG.exe
  2⤵
  PID:8288
- C:\Windows\System\xZjcgRD.exe
  C:\Windows\System\xZjcgRD.exe
  2⤵
  PID:8308
- C:\Windows\System\Vgrwbnk.exe
  C:\Windows\System\Vgrwbnk.exe
  2⤵
  PID:8324
- C:\Windows\System\YhoRsbF.exe
  C:\Windows\System\YhoRsbF.exe
  2⤵
  PID:8504
- C:\Windows\System\rpFHxpz.exe
  C:\Windows\System\rpFHxpz.exe
  2⤵
  PID:8528
- C:\Windows\System\UJnZCRs.exe
  C:\Windows\System\UJnZCRs.exe
  2⤵
  PID:8576
- C:\Windows\System\EsGMSRA.exe
  C:\Windows\System\EsGMSRA.exe
  2⤵
  PID:8608
- C:\Windows\System\shRtTTV.exe
  C:\Windows\System\shRtTTV.exe
  2⤵
  PID:8624
- C:\Windows\System\nbfWvyh.exe
  C:\Windows\System\nbfWvyh.exe
  2⤵
  PID:8640
- C:\Windows\System\BygIaUh.exe
  C:\Windows\System\BygIaUh.exe
  2⤵
  PID:8660
- C:\Windows\System\xgjCulR.exe
  C:\Windows\System\xgjCulR.exe
  2⤵
  PID:8676
- C:\Windows\System\RhEjdgJ.exe
  C:\Windows\System\RhEjdgJ.exe
  2⤵
  PID:8692
- C:\Windows\System\YCwksAk.exe
  C:\Windows\System\YCwksAk.exe
  2⤵
  PID:8708
- C:\Windows\System\wwOhdBd.exe
  C:\Windows\System\wwOhdBd.exe
  2⤵
  PID:8724
- C:\Windows\System\YLjnVfp.exe
  C:\Windows\System\YLjnVfp.exe
  2⤵
  PID:8744
- C:\Windows\System\BicQiUf.exe
  C:\Windows\System\BicQiUf.exe
  2⤵
  PID:8760
- C:\Windows\System\Pbgiwzs.exe
  C:\Windows\System\Pbgiwzs.exe
  2⤵
  PID:8780
- C:\Windows\System\SmeELwE.exe
  C:\Windows\System\SmeELwE.exe
  2⤵
  PID:8872
- C:\Windows\System\cCICImt.exe
  C:\Windows\System\cCICImt.exe
  2⤵
  PID:7672
- C:\Windows\System\beMDGPb.exe
  C:\Windows\System\beMDGPb.exe
  2⤵
  PID:7484
- C:\Windows\System\QhBbNcx.exe
  C:\Windows\System\QhBbNcx.exe
  2⤵
  PID:8200
- C:\Windows\System\uBcpgjR.exe
  C:\Windows\System\uBcpgjR.exe
  2⤵
  PID:8128
- C:\Windows\System\qlfWJae.exe
  C:\Windows\System\qlfWJae.exe
  2⤵
  PID:2388
- C:\Windows\System\QqoAXqj.exe
  C:\Windows\System\QqoAXqj.exe
  2⤵
  PID:7212
- C:\Windows\System\qmVxrOT.exe
  C:\Windows\System\qmVxrOT.exe
  2⤵
  PID:8092
- C:\Windows\System\RWmUPXj.exe
  C:\Windows\System\RWmUPXj.exe
  2⤵
  PID:6808
- C:\Windows\System\rWarLTe.exe
  C:\Windows\System\rWarLTe.exe
  2⤵
  PID:7400
- C:\Windows\System\zSNHFOD.exe
  C:\Windows\System\zSNHFOD.exe
  2⤵
  PID:7320
- C:\Windows\System\nFywSwx.exe
  C:\Windows\System\nFywSwx.exe
  2⤵
  PID:7560
- C:\Windows\System\OEzIyFg.exe
  C:\Windows\System\OEzIyFg.exe
  2⤵
  PID:7704
- C:\Windows\System\MWJUtcy.exe
  C:\Windows\System\MWJUtcy.exe
  2⤵
  PID:7548
- C:\Windows\System\wONEePq.exe
  C:\Windows\System\wONEePq.exe
  2⤵
  PID:7640
- C:\Windows\System\oDABHyI.exe
  C:\Windows\System\oDABHyI.exe
  2⤵
  PID:8016
- C:\Windows\System\xooIVIK.exe
  C:\Windows\System\xooIVIK.exe
  2⤵
  PID:8172
- C:\Windows\System\fHuJjvy.exe
  C:\Windows\System\fHuJjvy.exe
  2⤵
  PID:7820
- C:\Windows\System\gBBbshu.exe
  C:\Windows\System\gBBbshu.exe
  2⤵
  PID:8220
- C:\Windows\System\ZpMIXhG.exe
  C:\Windows\System\ZpMIXhG.exe
  2⤵
  PID:8296
- C:\Windows\System\BkQcZPg.exe
  C:\Windows\System\BkQcZPg.exe
  2⤵
  PID:8492
- C:\Windows\System\UtOTcgg.exe
  C:\Windows\System\UtOTcgg.exe
  2⤵
  PID:8536
- C:\Windows\System\QlHGPSH.exe
  C:\Windows\System\QlHGPSH.exe
  2⤵
  PID:8552
- C:\Windows\System\XEQojQu.exe
  C:\Windows\System\XEQojQu.exe
  2⤵
  PID:8568
- C:\Windows\System\OgyldWR.exe
  C:\Windows\System\OgyldWR.exe
  2⤵
  PID:8648
- C:\Windows\System\NhicNWc.exe
  C:\Windows\System\NhicNWc.exe
  2⤵
  PID:8688
- C:\Windows\System\wYDUEyR.exe
  C:\Windows\System\wYDUEyR.exe
  2⤵
  PID:8756
- C:\Windows\System\cBDZzsF.exe
  C:\Windows\System\cBDZzsF.exe
  2⤵
  PID:8264
- C:\Windows\System\EaxFIuq.exe
  C:\Windows\System\EaxFIuq.exe
  2⤵
  PID:8412
- C:\Windows\System\TmPlpRZ.exe
  C:\Windows\System\TmPlpRZ.exe
  2⤵
  PID:8816
- C:\Windows\System\NVmHFiM.exe
  C:\Windows\System\NVmHFiM.exe
  2⤵
  PID:8856
- C:\Windows\System\jZDCBAi.exe
  C:\Windows\System\jZDCBAi.exe
  2⤵
  PID:8280
- C:\Windows\System\aiquxMi.exe
  C:\Windows\System\aiquxMi.exe
  2⤵
  PID:8512
- C:\Windows\System\FIQdwim.exe
  C:\Windows\System\FIQdwim.exe
  2⤵
  PID:8588
- C:\Windows\System\ofJznFP.exe
  C:\Windows\System\ofJznFP.exe
  2⤵
  PID:8632
- C:\Windows\System\Uzfyfnc.exe
  C:\Windows\System\Uzfyfnc.exe
  2⤵
  PID:8732
- C:\Windows\System\QAInKmI.exe
  C:\Windows\System\QAInKmI.exe
  2⤵
  PID:8772
- C:\Windows\System\hedtSyI.exe
  C:\Windows\System\hedtSyI.exe
  2⤵
  PID:8820
- C:\Windows\System\UAbUdHZ.exe
  C:\Windows\System\UAbUdHZ.exe
  2⤵
  PID:8844
- C:\Windows\System\uyAWDeG.exe
  C:\Windows\System\uyAWDeG.exe
  2⤵
  PID:8060
- C:\Windows\System\CUwlwaW.exe
  C:\Windows\System\CUwlwaW.exe
  2⤵
  PID:8156
- C:\Windows\System\TdCBGja.exe
  C:\Windows\System\TdCBGja.exe
  2⤵
  PID:8932
- C:\Windows\System\PmfAmqd.exe
  C:\Windows\System\PmfAmqd.exe
  2⤵
  PID:8948
- C:\Windows\System\RfrYPDH.exe
  C:\Windows\System\RfrYPDH.exe
  2⤵
  PID:8964
- C:\Windows\System\lYtaJXm.exe
  C:\Windows\System\lYtaJXm.exe
  2⤵
  PID:8980
- C:\Windows\System\UOGobzn.exe
  C:\Windows\System\UOGobzn.exe
  2⤵
  PID:8996
- C:\Windows\System\GHBUcbt.exe
  C:\Windows\System\GHBUcbt.exe
  2⤵
  PID:9012
- C:\Windows\System\CuCUqBo.exe
  C:\Windows\System\CuCUqBo.exe
  2⤵
  PID:9028
- C:\Windows\System\auFkMQU.exe
  C:\Windows\System\auFkMQU.exe
  2⤵
  PID:9052
- C:\Windows\System\MJkqkEZ.exe
  C:\Windows\System\MJkqkEZ.exe
  2⤵
  PID:9064
- C:\Windows\System\VlUznmr.exe
  C:\Windows\System\VlUznmr.exe
  2⤵
  PID:9076
- C:\Windows\System\ObgXXlq.exe
  C:\Windows\System\ObgXXlq.exe
  2⤵
  PID:9092
- C:\Windows\System\BIdMTMb.exe
  C:\Windows\System\BIdMTMb.exe
  2⤵
  PID:9108
- C:\Windows\System\WXczCRq.exe
  C:\Windows\System\WXczCRq.exe
  2⤵
  PID:9124
- C:\Windows\System\gRqCatk.exe
  C:\Windows\System\gRqCatk.exe
  2⤵
  PID:9140
- C:\Windows\System\moXJjCo.exe
  C:\Windows\System\moXJjCo.exe
  2⤵
  PID:9156
- C:\Windows\System\ovFSoDV.exe
  C:\Windows\System\ovFSoDV.exe
  2⤵
  PID:9176
- C:\Windows\System\AABOBpi.exe
  C:\Windows\System\AABOBpi.exe
  2⤵
  PID:9196
- C:\Windows\System\IxKoibN.exe
  C:\Windows\System\IxKoibN.exe
  2⤵
  PID:7464
- C:\Windows\System\OiwAeGT.exe
  C:\Windows\System\OiwAeGT.exe
  2⤵
  PID:8124
- C:\Windows\System\QYiTiaq.exe
  C:\Windows\System\QYiTiaq.exe
  2⤵
  PID:8076
- C:\Windows\System\ZgvyKSP.exe
  C:\Windows\System\ZgvyKSP.exe
  2⤵
  PID:7688
- C:\Windows\System\tKMxqfP.exe
  C:\Windows\System\tKMxqfP.exe
  2⤵
  PID:8028
- C:\Windows\System\AJGgNAO.exe
  C:\Windows\System\AJGgNAO.exe
  2⤵
  PID:8240
- C:\Windows\System\hwxwDQN.exe
  C:\Windows\System\hwxwDQN.exe
  2⤵
  PID:5668
- C:\Windows\System\qMllLYY.exe
  C:\Windows\System\qMllLYY.exe
  2⤵
  PID:7304
- C:\Windows\System\MNhXLlt.exe
  C:\Windows\System\MNhXLlt.exe
  2⤵
  PID:8000
- C:\Windows\System\lynxUTM.exe
  C:\Windows\System\lynxUTM.exe
  2⤵
  PID:7372
- C:\Windows\System\MeTHkZn.exe
  C:\Windows\System\MeTHkZn.exe
  2⤵
  PID:7740
- C:\Windows\System\MzocvOS.exe
  C:\Windows\System\MzocvOS.exe
  2⤵
  PID:8216
- C:\Windows\System\OZkAPXU.exe
  C:\Windows\System\OZkAPXU.exe
  2⤵
  PID:7576
- C:\Windows\System\FiOZWwq.exe
  C:\Windows\System\FiOZWwq.exe
  2⤵
  PID:8388
- C:\Windows\System\ilVHSpj.exe
  C:\Windows\System\ilVHSpj.exe
  2⤵
  PID:8360
- C:\Windows\System\vcUlRGK.exe
  C:\Windows\System\vcUlRGK.exe
  2⤵
  PID:8344
- C:\Windows\System\pnTsQbx.exe
  C:\Windows\System\pnTsQbx.exe
  2⤵
  PID:8416
- C:\Windows\System\yxHrjrT.exe
  C:\Windows\System\yxHrjrT.exe
  2⤵
  PID:8428
- C:\Windows\System\LgFIaOh.exe
  C:\Windows\System\LgFIaOh.exe
  2⤵
  PID:8444
- C:\Windows\System\hzBHlUr.exe
  C:\Windows\System\hzBHlUr.exe
  2⤵
  PID:8464
- C:\Windows\System\NQmxmwL.exe
  C:\Windows\System\NQmxmwL.exe
  2⤵
  PID:8484
- C:\Windows\System\dSjwldV.exe
  C:\Windows\System\dSjwldV.exe
  2⤵
  PID:8720
- C:\Windows\System\DEOzKkU.exe
  C:\Windows\System\DEOzKkU.exe
  2⤵
  PID:8840
- C:\Windows\System\Xwxurqt.exe
  C:\Windows\System\Xwxurqt.exe
  2⤵
  PID:8544
- C:\Windows\System\woVqScN.exe
  C:\Windows\System\woVqScN.exe
  2⤵
  PID:8268
- C:\Windows\System\eJOxIgg.exe
  C:\Windows\System\eJOxIgg.exe
  2⤵
  PID:8836
- C:\Windows\System\tJalqaE.exe
  C:\Windows\System\tJalqaE.exe
  2⤵
  PID:8604
- C:\Windows\System\OIRRRBY.exe
  C:\Windows\System\OIRRRBY.exe
  2⤵
  PID:7180
- C:\Windows\System\LJlarEX.exe
  C:\Windows\System\LJlarEX.exe
  2⤵
  PID:7596
- C:\Windows\System\VQIQIjj.exe
  C:\Windows\System\VQIQIjj.exe
  2⤵
  PID:8792
- C:\Windows\System\PfGnrcU.exe
  C:\Windows\System\PfGnrcU.exe
  2⤵
  PID:8564
- C:\Windows\System\LjHxIOB.exe
  C:\Windows\System\LjHxIOB.exe
  2⤵
  PID:8144
- C:\Windows\System\goWpTCP.exe
  C:\Windows\System\goWpTCP.exe
  2⤵
  PID:8668
- C:\Windows\System\alXrRex.exe
  C:\Windows\System\alXrRex.exe
  2⤵
  PID:8700
- C:\Windows\System\cPjaLJq.exe
  C:\Windows\System\cPjaLJq.exe
  2⤵
  PID:8864
- C:\Windows\System\SlRNVXX.exe
  C:\Windows\System\SlRNVXX.exe
  2⤵
  PID:8884
- C:\Windows\System\bHYsMgc.exe
  C:\Windows\System\bHYsMgc.exe
  2⤵
  PID:8904
- C:\Windows\System\dvLAnSa.exe
  C:\Windows\System\dvLAnSa.exe
  2⤵
  PID:8920
- C:\Windows\System\xQykJBw.exe
  C:\Windows\System\xQykJBw.exe
  2⤵
  PID:8972
- C:\Windows\System\gXXHKGo.exe
  C:\Windows\System\gXXHKGo.exe
  2⤵
  PID:9036
- C:\Windows\System\AENUBnC.exe
  C:\Windows\System\AENUBnC.exe
  2⤵
  PID:9096
- C:\Windows\System\YZLIkZD.exe
  C:\Windows\System\YZLIkZD.exe
  2⤵
  PID:9208
- C:\Windows\System\ujDSmLD.exe
  C:\Windows\System\ujDSmLD.exe
  2⤵
  PID:7660
- C:\Windows\System\OwfJdWm.exe
  C:\Windows\System\OwfJdWm.exe
  2⤵
  PID:7968
- C:\Windows\System\nHMKiuH.exe
  C:\Windows\System\nHMKiuH.exe
  2⤵
  PID:7724
- C:\Windows\System\cEIMvtJ.exe
  C:\Windows\System\cEIMvtJ.exe
  2⤵
  PID:7340
- C:\Windows\System\VNGMqOK.exe
  C:\Windows\System\VNGMqOK.exe
  2⤵
  PID:8436
- C:\Windows\System\KKsAkZi.exe
  C:\Windows\System\KKsAkZi.exe
  2⤵
  PID:8480
- C:\Windows\System\RkWdLZS.exe
  C:\Windows\System\RkWdLZS.exe
  2⤵
  PID:8320
- C:\Windows\System\sUkqZPe.exe
  C:\Windows\System\sUkqZPe.exe
  2⤵
  PID:7952
- C:\Windows\System\ngJCYad.exe
  C:\Windows\System\ngJCYad.exe
  2⤵
  PID:6432
- C:\Windows\System\spJbOVo.exe
  C:\Windows\System\spJbOVo.exe
  2⤵
  PID:8392
- C:\Windows\System\BHFGQvR.exe
  C:\Windows\System\BHFGQvR.exe
  2⤵
  PID:8364
- C:\Windows\System\rSmTuqL.exe
  C:\Windows\System\rSmTuqL.exe
  2⤵
  PID:8616
- C:\Windows\System\ErcRPcM.exe
  C:\Windows\System\ErcRPcM.exe
  2⤵
  PID:7288
- C:\Windows\System\xMtqqNz.exe
  C:\Windows\System\xMtqqNz.exe
  2⤵
  PID:8500
- C:\Windows\System\MPrQZxn.exe
  C:\Windows\System\MPrQZxn.exe
  2⤵
  PID:8244
- C:\Windows\System\WGUFyTg.exe
  C:\Windows\System\WGUFyTg.exe
  2⤵
  PID:8896
- C:\Windows\System\xjXroCU.exe
  C:\Windows\System\xjXroCU.exe
  2⤵
  PID:9048
- C:\Windows\System\YqfIIHD.exe
  C:\Windows\System\YqfIIHD.exe
  2⤵
  PID:2544
- C:\Windows\System\bgBpfgq.exe
  C:\Windows\System\bgBpfgq.exe
  2⤵
  PID:7788
- C:\Windows\System\CPyuIxy.exe
  C:\Windows\System\CPyuIxy.exe
  2⤵
  PID:7868
- C:\Windows\System\DogsBHT.exe
  C:\Windows\System\DogsBHT.exe
  2⤵
  PID:9116
- C:\Windows\System\ekuJhQD.exe
  C:\Windows\System\ekuJhQD.exe
  2⤵
  PID:8380
- C:\Windows\System\syjQzJK.exe
  C:\Windows\System\syjQzJK.exe
  2⤵
  PID:8348
- C:\Windows\System\gqQctlU.exe
  C:\Windows\System\gqQctlU.exe
  2⤵
  PID:8812
- C:\Windows\System\xReCqHQ.exe
  C:\Windows\System\xReCqHQ.exe
  2⤵
  PID:1280
- C:\Windows\System\atjqtbJ.exe
  C:\Windows\System\atjqtbJ.exe
  2⤵
  PID:9184
- C:\Windows\System\cCEZUsq.exe
  C:\Windows\System\cCEZUsq.exe
  2⤵
  PID:9044
- C:\Windows\System\zMcBBgd.exe
  C:\Windows\System\zMcBBgd.exe
  2⤵
  PID:8960
- C:\Windows\System\kxqFMdp.exe
  C:\Windows\System\kxqFMdp.exe
  2⤵
  PID:8332
- C:\Windows\System\PEFOPLc.exe
  C:\Windows\System\PEFOPLc.exe
  2⤵
  PID:2236
- C:\Windows\System\gRBZhvM.exe
  C:\Windows\System\gRBZhvM.exe
  2⤵
  PID:8408
- C:\Windows\System\LahDsXC.exe
  C:\Windows\System\LahDsXC.exe
  2⤵
  PID:7132
- C:\Windows\System\EcVHIKn.exe
  C:\Windows\System\EcVHIKn.exe
  2⤵
  PID:8808
- C:\Windows\System\BZyCrPd.exe
  C:\Windows\System\BZyCrPd.exe
  2⤵
  PID:9004
- C:\Windows\System\FfmBuyH.exe
  C:\Windows\System\FfmBuyH.exe
  2⤵
  PID:8032
- C:\Windows\System\brGrmDb.exe
  C:\Windows\System\brGrmDb.exe
  2⤵
  PID:9148
- C:\Windows\System\LECDnYS.exe
  C:\Windows\System\LECDnYS.exe
  2⤵
  PID:9132
- C:\Windows\System\ebedoIf.exe
  C:\Windows\System\ebedoIf.exe
  2⤵
  PID:8880
- C:\Windows\System\RSrJgnE.exe
  C:\Windows\System\RSrJgnE.exe
  2⤵
  PID:8396
- C:\Windows\System\tmZweoA.exe
  C:\Windows\System\tmZweoA.exe
  2⤵
  PID:9120
- C:\Windows\System\udLvXjT.exe
  C:\Windows\System\udLvXjT.exe
  2⤵
  PID:8892
- C:\Windows\System\DoiCGZM.exe
  C:\Windows\System\DoiCGZM.exe
  2⤵
  PID:8548
- C:\Windows\System\HuJvpPr.exe
  C:\Windows\System\HuJvpPr.exe
  2⤵
  PID:7676
- C:\Windows\System\MjUlAnS.exe
  C:\Windows\System\MjUlAnS.exe
  2⤵
  PID:8988
- C:\Windows\System\WZyexRK.exe
  C:\Windows\System\WZyexRK.exe
  2⤵
  PID:8080
- C:\Windows\System\hvXurpx.exe
  C:\Windows\System\hvXurpx.exe
  2⤵
  PID:6256
- C:\Windows\System\GNgIZLu.exe
  C:\Windows\System\GNgIZLu.exe
  2⤵
  PID:9164
- C:\Windows\System\QplHnNp.exe
  C:\Windows\System\QplHnNp.exe
  2⤵
  PID:2952
- C:\Windows\System\oLjJMlW.exe
  C:\Windows\System\oLjJMlW.exe
  2⤵
  PID:8656
- C:\Windows\System\oLQAEUb.exe
  C:\Windows\System\oLQAEUb.exe
  2⤵
  PID:9020
- C:\Windows\System\vQgPFJT.exe
  C:\Windows\System\vQgPFJT.exe
  2⤵
  PID:9224
- C:\Windows\System\JaaScXd.exe
  C:\Windows\System\JaaScXd.exe
  2⤵
  PID:9240
- C:\Windows\System\wmLCLkm.exe
  C:\Windows\System\wmLCLkm.exe
  2⤵
  PID:9256
- C:\Windows\System\EfslMdc.exe
  C:\Windows\System\EfslMdc.exe
  2⤵
  PID:9272
- C:\Windows\System\NiVgmvj.exe
  C:\Windows\System\NiVgmvj.exe
  2⤵
  PID:9288
- C:\Windows\System\UAsRlns.exe
  C:\Windows\System\UAsRlns.exe
  2⤵
  PID:9304
- C:\Windows\System\fmUxFkO.exe
  C:\Windows\System\fmUxFkO.exe
  2⤵
  PID:9324
- C:\Windows\System\eQIKjih.exe
  C:\Windows\System\eQIKjih.exe
  2⤵
  PID:9344
- C:\Windows\System\AxAVNnW.exe
  C:\Windows\System\AxAVNnW.exe
  2⤵
  PID:9364
- C:\Windows\System\SsSUeMU.exe
  C:\Windows\System\SsSUeMU.exe
  2⤵
  PID:9384
- C:\Windows\System\oJHQowq.exe
  C:\Windows\System\oJHQowq.exe
  2⤵
  PID:9400
- C:\Windows\System\OPVHDOH.exe
  C:\Windows\System\OPVHDOH.exe
  2⤵
  PID:9420
- C:\Windows\System\LrBPbQl.exe
  C:\Windows\System\LrBPbQl.exe
  2⤵
  PID:9436
- C:\Windows\System\DcMmAkh.exe
  C:\Windows\System\DcMmAkh.exe
  2⤵
  PID:9452
- C:\Windows\System\lUtnPdw.exe
  C:\Windows\System\lUtnPdw.exe
  2⤵
  PID:9468
- C:\Windows\System\AamyOhe.exe
  C:\Windows\System\AamyOhe.exe
  2⤵
  PID:9484
- C:\Windows\System\dFTlqpQ.exe
  C:\Windows\System\dFTlqpQ.exe
  2⤵
  PID:9504
- C:\Windows\System\lszkbvu.exe
  C:\Windows\System\lszkbvu.exe
  2⤵
  PID:9520
- C:\Windows\System\NFmkGEZ.exe
  C:\Windows\System\NFmkGEZ.exe
  2⤵
  PID:9536
- C:\Windows\System\jEmSjTI.exe
  C:\Windows\System\jEmSjTI.exe
  2⤵
  PID:9552
- C:\Windows\System\fXIsdLE.exe
  C:\Windows\System\fXIsdLE.exe
  2⤵
  PID:9572
- C:\Windows\System\DYiANxB.exe
  C:\Windows\System\DYiANxB.exe
  2⤵
  PID:9588
- C:\Windows\System\ziHoydS.exe
  C:\Windows\System\ziHoydS.exe
  2⤵
  PID:9604
- C:\Windows\System\jIIiadY.exe
  C:\Windows\System\jIIiadY.exe
  2⤵
  PID:9620
- C:\Windows\System\ZvjwVFN.exe
  C:\Windows\System\ZvjwVFN.exe
  2⤵
  PID:9636
- C:\Windows\System\HwZILZK.exe
  C:\Windows\System\HwZILZK.exe
  2⤵
  PID:9652
- C:\Windows\System\nPYGrKf.exe
  C:\Windows\System\nPYGrKf.exe
  2⤵
  PID:9668
- C:\Windows\System\UkYakpS.exe
  C:\Windows\System\UkYakpS.exe
  2⤵
  PID:9688
- C:\Windows\System\VWCjgkx.exe
  C:\Windows\System\VWCjgkx.exe
  2⤵
  PID:9704
- C:\Windows\System\akJDkTg.exe
  C:\Windows\System\akJDkTg.exe
  2⤵
  PID:9720
- C:\Windows\System\LNPUlhG.exe
  C:\Windows\System\LNPUlhG.exe
  2⤵
  PID:9736
- C:\Windows\System\LxbBRHn.exe
  C:\Windows\System\LxbBRHn.exe
  2⤵
  PID:9752
- C:\Windows\System\DPlUapT.exe
  C:\Windows\System\DPlUapT.exe
  2⤵
  PID:9768
- C:\Windows\System\xAshhcc.exe
  C:\Windows\System\xAshhcc.exe
  2⤵
  PID:9784
- C:\Windows\System\DYcQoeZ.exe
  C:\Windows\System\DYcQoeZ.exe
  2⤵
  PID:9804
- C:\Windows\System\xHiqsrG.exe
  C:\Windows\System\xHiqsrG.exe
  2⤵
  PID:9820
- C:\Windows\System\ftHyQXw.exe
  C:\Windows\System\ftHyQXw.exe
  2⤵
  PID:9836
- C:\Windows\System\atmYeKo.exe
  C:\Windows\System\atmYeKo.exe
  2⤵
  PID:9856
- C:\Windows\System\NJwRfXk.exe
  C:\Windows\System\NJwRfXk.exe
  2⤵
  PID:9872
- C:\Windows\System\wKJrWBC.exe
  C:\Windows\System\wKJrWBC.exe
  2⤵
  PID:9888
- C:\Windows\System\QKujIyI.exe
  C:\Windows\System\QKujIyI.exe
  2⤵
  PID:9904
- C:\Windows\System\xBQpiwt.exe
  C:\Windows\System\xBQpiwt.exe
  2⤵
  PID:9920
- C:\Windows\System\ryPjUMn.exe
  C:\Windows\System\ryPjUMn.exe
  2⤵
  PID:9936
- C:\Windows\System\RJZyzJx.exe
  C:\Windows\System\RJZyzJx.exe
  2⤵
  PID:9952
- C:\Windows\System\hLouOcB.exe
  C:\Windows\System\hLouOcB.exe
  2⤵
  PID:9968
- C:\Windows\System\lmsSnhc.exe
  C:\Windows\System\lmsSnhc.exe
  2⤵
  PID:9984
- C:\Windows\System\HUmONvY.exe
  C:\Windows\System\HUmONvY.exe
  2⤵
  PID:10004
- C:\Windows\System\aqSdJqz.exe
  C:\Windows\System\aqSdJqz.exe
  2⤵
  PID:10020
- C:\Windows\System\sptaCLm.exe
  C:\Windows\System\sptaCLm.exe
  2⤵
  PID:10036
- C:\Windows\System\CCMFKlc.exe
  C:\Windows\System\CCMFKlc.exe
  2⤵
  PID:10052
- C:\Windows\System\lOYUGYV.exe
  C:\Windows\System\lOYUGYV.exe
  2⤵
  PID:10068
- C:\Windows\System\WETwKCZ.exe
  C:\Windows\System\WETwKCZ.exe
  2⤵
  PID:10084
- C:\Windows\System\Pmfobvw.exe
  C:\Windows\System\Pmfobvw.exe
  2⤵
  PID:10100
- C:\Windows\System\wqAwvqw.exe
  C:\Windows\System\wqAwvqw.exe
  2⤵
  PID:10116
- C:\Windows\System\ToDcrnb.exe
  C:\Windows\System\ToDcrnb.exe
  2⤵
  PID:10132
- C:\Windows\System\FoTiKvQ.exe
  C:\Windows\System\FoTiKvQ.exe
  2⤵
  PID:10148
- C:\Windows\System\wkFKtYy.exe
  C:\Windows\System\wkFKtYy.exe
  2⤵
  PID:10164
- C:\Windows\System\dxcGXhw.exe
  C:\Windows\System\dxcGXhw.exe
  2⤵
  PID:10184
- C:\Windows\System\kQnevcG.exe
  C:\Windows\System\kQnevcG.exe
  2⤵
  PID:10200
- C:\Windows\System\lgwBSjH.exe
  C:\Windows\System\lgwBSjH.exe
  2⤵
  PID:10216
- C:\Windows\System\OLWZXpL.exe
  C:\Windows\System\OLWZXpL.exe
  2⤵
  PID:10232
- C:\Windows\System\CNcVgsC.exe
  C:\Windows\System\CNcVgsC.exe
  2⤵
  PID:9220
- C:\Windows\System\VDfvdPM.exe
  C:\Windows\System\VDfvdPM.exe
  2⤵
  PID:8912
- C:\Windows\System\vtJnqVV.exe
  C:\Windows\System\vtJnqVV.exe
  2⤵
  PID:9232
- C:\Windows\System\XylIKDi.exe
  C:\Windows\System\XylIKDi.exe
  2⤵
  PID:8256
- C:\Windows\System\PREjdqL.exe
  C:\Windows\System\PREjdqL.exe
  2⤵
  PID:9392
- C:\Windows\System\aceBAtf.exe
  C:\Windows\System\aceBAtf.exe
  2⤵
  PID:9332
- C:\Windows\System\awXgPnz.exe
  C:\Windows\System\awXgPnz.exe
  2⤵
  PID:9376
- C:\Windows\System\laamWDb.exe
  C:\Windows\System\laamWDb.exe
  2⤵
  PID:9444
- C:\Windows\System\OwagQIC.exe
  C:\Windows\System\OwagQIC.exe
  2⤵
  PID:9496
- C:\Windows\System\AGJrkus.exe
  C:\Windows\System\AGJrkus.exe
  2⤵
  PID:9512
- C:\Windows\System\xuBvTXZ.exe
  C:\Windows\System\xuBvTXZ.exe
  2⤵
  PID:9460
- C:\Windows\System\SGkTwQY.exe
  C:\Windows\System\SGkTwQY.exe
  2⤵
  PID:9632
- C:\Windows\System\wlcTZSe.exe
  C:\Windows\System\wlcTZSe.exe
  2⤵
  PID:9728
- C:\Windows\System\UKGTBom.exe
  C:\Windows\System\UKGTBom.exe
  2⤵
  PID:9696
- C:\Windows\System\hVNOhKG.exe
  C:\Windows\System\hVNOhKG.exe
  2⤵
  PID:9832
- C:\Windows\System\HEIyAGi.exe
  C:\Windows\System\HEIyAGi.exe
  2⤵
  PID:9476
- C:\Windows\System\jNCmpQW.exe
  C:\Windows\System\jNCmpQW.exe
  2⤵
  PID:9680
- C:\Windows\System\yvaXPGh.exe
  C:\Windows\System\yvaXPGh.exe
  2⤵
  PID:9844
- C:\Windows\System\VPOYiEy.exe
  C:\Windows\System\VPOYiEy.exe
  2⤵
  PID:9612
- C:\Windows\System\oKuIvDd.exe
  C:\Windows\System\oKuIvDd.exe
  2⤵
  PID:9712
- C:\Windows\System\bKhaXpM.exe
  C:\Windows\System\bKhaXpM.exe
  2⤵
  PID:9776
- C:\Windows\System\cletcIX.exe
  C:\Windows\System\cletcIX.exe
  2⤵
  PID:9884
- C:\Windows\System\KEqGqYn.exe
  C:\Windows\System\KEqGqYn.exe
  2⤵
  PID:9948
- C:\Windows\System\yMxDmxS.exe
  C:\Windows\System\yMxDmxS.exe
  2⤵
  PID:10012
- C:\Windows\System\KIaYPMn.exe
  C:\Windows\System\KIaYPMn.exe
  2⤵
  PID:9864
- C:\Windows\System\iyJoVXM.exe
  C:\Windows\System\iyJoVXM.exe
  2⤵
  PID:9964
- C:\Windows\System\nSknJmj.exe
  C:\Windows\System\nSknJmj.exe
  2⤵
  PID:10076
- C:\Windows\System\FWBvRsD.exe
  C:\Windows\System\FWBvRsD.exe
  2⤵
  PID:10064
- C:\Windows\System\OLXzrxj.exe
  C:\Windows\System\OLXzrxj.exe
  2⤵
  PID:10108
- C:\Windows\System\xeWENVV.exe
  C:\Windows\System\xeWENVV.exe
  2⤵
  PID:10128
- C:\Windows\System\ZBzAila.exe
  C:\Windows\System\ZBzAila.exe
  2⤵
  PID:10180
- C:\Windows\System\YLLdfaD.exe
  C:\Windows\System\YLLdfaD.exe
  2⤵
  PID:10228
- C:\Windows\System\OKbdEMs.exe
  C:\Windows\System\OKbdEMs.exe
  2⤵
  PID:8524
- C:\Windows\System\jsnnDbc.exe
  C:\Windows\System\jsnnDbc.exe
  2⤵
  PID:7292
- C:\Windows\System\pDFuwYP.exe
  C:\Windows\System\pDFuwYP.exe
  2⤵
  PID:7532
- C:\Windows\System\PedgrIf.exe
  C:\Windows\System\PedgrIf.exe
  2⤵
  PID:9360
- C:\Windows\System\GmxLCnP.exe
  C:\Windows\System\GmxLCnP.exe
  2⤵
  PID:9428
- C:\Windows\System\uUdzdWK.exe
  C:\Windows\System\uUdzdWK.exe
  2⤵
  PID:9264
- C:\Windows\System\nbJSMey.exe
  C:\Windows\System\nbJSMey.exe
  2⤵
  PID:9412
- C:\Windows\System\fxqjqdr.exe
  C:\Windows\System\fxqjqdr.exe
  2⤵
  PID:9560
- C:\Windows\System\UMsuKVA.exe
  C:\Windows\System\UMsuKVA.exe
  2⤵
  PID:9544
- C:\Windows\System\ThCaQsU.exe
  C:\Windows\System\ThCaQsU.exe
  2⤵
  PID:9580
- C:\Windows\System\muDEZIC.exe
  C:\Windows\System\muDEZIC.exe
  2⤵
  PID:9664
- C:\Windows\System\AxhJSlK.exe
  C:\Windows\System\AxhJSlK.exe
  2⤵
  PID:9800
- C:\Windows\System\Ycozubj.exe
  C:\Windows\System\Ycozubj.exe
  2⤵
  PID:9816
- C:\Windows\System\yHiNWRJ.exe
  C:\Windows\System\yHiNWRJ.exe
  2⤵
  PID:9748
- C:\Windows\System\WAnxjfX.exe
  C:\Windows\System\WAnxjfX.exe
  2⤵
  PID:9932
- C:\Windows\System\tWvGQBm.exe
  C:\Windows\System\tWvGQBm.exe
  2⤵
  PID:10140
- C:\Windows\System\bqJKfdJ.exe
  C:\Windows\System\bqJKfdJ.exe
  2⤵
  PID:10224
- C:\Windows\System\HZfzRUe.exe
  C:\Windows\System\HZfzRUe.exe
  2⤵
  PID:9320
- C:\Windows\System\obKFBbw.exe
  C:\Windows\System\obKFBbw.exe
  2⤵
  PID:9532
- C:\Windows\System\vmCEVZw.exe
  C:\Windows\System\vmCEVZw.exe
  2⤵
  PID:9700
- C:\Windows\System\QPiEuuj.exe
  C:\Windows\System\QPiEuuj.exe
  2⤵
  PID:9960
- C:\Windows\System\iMDdEPu.exe
  C:\Windows\System\iMDdEPu.exe
  2⤵
  PID:9628
- C:\Windows\System\gLLWFzA.exe
  C:\Windows\System\gLLWFzA.exe
  2⤵
  PID:10252
- C:\Windows\System\rEuxPLO.exe
  C:\Windows\System\rEuxPLO.exe
  2⤵
  PID:10268
- C:\Windows\System\HmUuKKI.exe
  C:\Windows\System\HmUuKKI.exe
  2⤵
  PID:10284
- C:\Windows\System\PQzscjL.exe
  C:\Windows\System\PQzscjL.exe
  2⤵
  PID:10300
- C:\Windows\System\ixWbsHf.exe
  C:\Windows\System\ixWbsHf.exe
  2⤵
  PID:10316
- C:\Windows\System\qledgWo.exe
  C:\Windows\System\qledgWo.exe
  2⤵
  PID:10336
- C:\Windows\System\cZMdNio.exe
  C:\Windows\System\cZMdNio.exe
  2⤵
  PID:10356
- C:\Windows\System\ekhWWoS.exe
  C:\Windows\System\ekhWWoS.exe
  2⤵
  PID:10372
- C:\Windows\System\PnEKGQK.exe
  C:\Windows\System\PnEKGQK.exe
  2⤵
  PID:10388
- C:\Windows\System\knTYevK.exe
  C:\Windows\System\knTYevK.exe
  2⤵
  PID:10404
- C:\Windows\System\cptbrjh.exe
  C:\Windows\System\cptbrjh.exe
  2⤵
  PID:10420
- C:\Windows\System\UJuUDof.exe
  C:\Windows\System\UJuUDof.exe
  2⤵
  PID:10436
- C:\Windows\System\VnDzGjO.exe
  C:\Windows\System\VnDzGjO.exe
  2⤵
  PID:10452
- C:\Windows\System\XFqagiX.exe
  C:\Windows\System\XFqagiX.exe
  2⤵
  PID:10468
- C:\Windows\System\LOkiakr.exe
  C:\Windows\System\LOkiakr.exe
  2⤵
  PID:10484
- C:\Windows\System\HNleAkw.exe
  C:\Windows\System\HNleAkw.exe
  2⤵
  PID:10500
- C:\Windows\System\PDyBfKY.exe
  C:\Windows\System\PDyBfKY.exe
  2⤵
  PID:10516
- C:\Windows\System\WLLaRCF.exe
  C:\Windows\System\WLLaRCF.exe
  2⤵
  PID:10532
- C:\Windows\System\NSVkFsj.exe
  C:\Windows\System\NSVkFsj.exe
  2⤵
  PID:10548
- C:\Windows\System\GssrXoz.exe
  C:\Windows\System\GssrXoz.exe
  2⤵
  PID:10564
- C:\Windows\System\dMuIFRt.exe
  C:\Windows\System\dMuIFRt.exe
  2⤵
  PID:10580
- C:\Windows\System\QfZViWR.exe
  C:\Windows\System\QfZViWR.exe
  2⤵
  PID:10596
- C:\Windows\System\ZFZVbDO.exe
  C:\Windows\System\ZFZVbDO.exe
  2⤵
  PID:10612
- C:\Windows\System\PCNAAdF.exe
  C:\Windows\System\PCNAAdF.exe
  2⤵
  PID:10632
- C:\Windows\System\DRJAvGT.exe
  C:\Windows\System\DRJAvGT.exe
  2⤵
  PID:10648
- C:\Windows\System\GKaTCmE.exe
  C:\Windows\System\GKaTCmE.exe
  2⤵
  PID:10664
- C:\Windows\System\DHxaFTb.exe
  C:\Windows\System\DHxaFTb.exe
  2⤵
  PID:10684
- C:\Windows\System\tjCaACA.exe
  C:\Windows\System\tjCaACA.exe
  2⤵
  PID:10700
- C:\Windows\System\fEnmPGx.exe
  C:\Windows\System\fEnmPGx.exe
  2⤵
  PID:10716
- C:\Windows\System\TcPFzew.exe
  C:\Windows\System\TcPFzew.exe
  2⤵
  PID:10732
- C:\Windows\System\EJHLPKw.exe
  C:\Windows\System\EJHLPKw.exe
  2⤵
  PID:10748
- C:\Windows\System\cBIuZJY.exe
  C:\Windows\System\cBIuZJY.exe
  2⤵
  PID:10764
- C:\Windows\System\kBuJAyy.exe
  C:\Windows\System\kBuJAyy.exe
  2⤵
  PID:10780
- C:\Windows\System\XXOgomW.exe
  C:\Windows\System\XXOgomW.exe
  2⤵
  PID:10796
- C:\Windows\System\RUCDztI.exe
  C:\Windows\System\RUCDztI.exe
  2⤵
  PID:10816
- C:\Windows\System\OnrTwQv.exe
  C:\Windows\System\OnrTwQv.exe
  2⤵
  PID:10832
- C:\Windows\System\bEyXyyS.exe
  C:\Windows\System\bEyXyyS.exe
  2⤵
  PID:10848
- C:\Windows\System\pJtPrdJ.exe
  C:\Windows\System\pJtPrdJ.exe
  2⤵
  PID:10864
- C:\Windows\System\eMwWIMV.exe
  C:\Windows\System\eMwWIMV.exe
  2⤵
  PID:10880
- C:\Windows\System\PukHiHC.exe
  C:\Windows\System\PukHiHC.exe
  2⤵
  PID:10896
- C:\Windows\System\AVYAIcz.exe
  C:\Windows\System\AVYAIcz.exe
  2⤵
  PID:10912
- C:\Windows\System\ZWoJCoG.exe
  C:\Windows\System\ZWoJCoG.exe
  2⤵
  PID:10928
- C:\Windows\System\yrvEHjD.exe
  C:\Windows\System\yrvEHjD.exe
  2⤵
  PID:10944
- C:\Windows\System\dMVepQk.exe
  C:\Windows\System\dMVepQk.exe
  2⤵
  PID:10960
- C:\Windows\System\AIzwpTG.exe
  C:\Windows\System\AIzwpTG.exe
  2⤵
  PID:10976
- C:\Windows\System\PgjgLVv.exe
  C:\Windows\System\PgjgLVv.exe
  2⤵
  PID:10992
- C:\Windows\System\iKZILBA.exe
  C:\Windows\System\iKZILBA.exe
  2⤵
  PID:11008
- C:\Windows\System\uLfYDjx.exe
  C:\Windows\System\uLfYDjx.exe
  2⤵
  PID:11024
- C:\Windows\System\bNDtsov.exe
  C:\Windows\System\bNDtsov.exe
  2⤵
  PID:11040
- C:\Windows\System\KbFiISX.exe
  C:\Windows\System\KbFiISX.exe
  2⤵
  PID:11056
- C:\Windows\System\zeIkURv.exe
  C:\Windows\System\zeIkURv.exe
  2⤵
  PID:11072
- C:\Windows\System\vATitnd.exe
  C:\Windows\System\vATitnd.exe
  2⤵
  PID:11092
- C:\Windows\System\UuPaWem.exe
  C:\Windows\System\UuPaWem.exe
  2⤵
  PID:11108
- C:\Windows\System\vAtcLrq.exe
  C:\Windows\System\vAtcLrq.exe
  2⤵
  PID:11124
- C:\Windows\System\OIvIrOF.exe
  C:\Windows\System\OIvIrOF.exe
  2⤵
  PID:11140
- C:\Windows\System\WLCUiYy.exe
  C:\Windows\System\WLCUiYy.exe
  2⤵
  PID:11156
- C:\Windows\System\VtcGXUb.exe
  C:\Windows\System\VtcGXUb.exe
  2⤵
  PID:11172
- C:\Windows\System\LLUkGel.exe
  C:\Windows\System\LLUkGel.exe
  2⤵
  PID:11196
- C:\Windows\System\NhHiKyZ.exe
  C:\Windows\System\NhHiKyZ.exe
  2⤵
  PID:11224
- C:\Windows\System\yEurKwy.exe
  C:\Windows\System\yEurKwy.exe
  2⤵
  PID:10156
- C:\Windows\System\BggqLZo.exe
  C:\Windows\System\BggqLZo.exe
  2⤵
  PID:10212
- C:\Windows\System\GDzDuRV.exe
  C:\Windows\System\GDzDuRV.exe
  2⤵
  PID:9464
- C:\Windows\System\khbTOoz.exe
  C:\Windows\System\khbTOoz.exe
  2⤵
  PID:9812
- C:\Windows\System\EJkeDjL.exe
  C:\Windows\System\EJkeDjL.exe
  2⤵
  PID:10016
- C:\Windows\System\dfCyMUh.exe
  C:\Windows\System\dfCyMUh.exe
  2⤵
  PID:9432
- C:\Windows\System\FbEqCWY.exe
  C:\Windows\System\FbEqCWY.exe
  2⤵
  PID:10248
- C:\Windows\System\jKZQrgO.exe
  C:\Windows\System\jKZQrgO.exe
  2⤵
  PID:10312
- C:\Windows\System\cyVmhjJ.exe
  C:\Windows\System\cyVmhjJ.exe
  2⤵
  PID:10364
- C:\Windows\System\YwvIwFl.exe
  C:\Windows\System\YwvIwFl.exe
  2⤵
  PID:10400
- C:\Windows\System\gaxVFyp.exe
  C:\Windows\System\gaxVFyp.exe
  2⤵
  PID:10352
- C:\Windows\System\yriiYjo.exe
  C:\Windows\System\yriiYjo.exe
  2⤵
  PID:10412
- C:\Windows\System\hfUrIyx.exe
  C:\Windows\System\hfUrIyx.exe
  2⤵
  PID:10476
- C:\Windows\System\sTvGuxh.exe
  C:\Windows\System\sTvGuxh.exe
  2⤵
  PID:10524
- C:\Windows\System\UYPCtkC.exe
  C:\Windows\System\UYPCtkC.exe
  2⤵
  PID:10540
- C:\Windows\System\ugTrYtI.exe
  C:\Windows\System\ugTrYtI.exe
  2⤵
  PID:10572
- C:\Windows\System\xVAMVKI.exe
  C:\Windows\System\xVAMVKI.exe
  2⤵
  PID:10620
- C:\Windows\System\wEifgnS.exe
  C:\Windows\System\wEifgnS.exe
  2⤵
  PID:10660
- C:\Windows\System\fLdlcPo.exe
  C:\Windows\System\fLdlcPo.exe
  2⤵
  PID:10728
- C:\Windows\System\ChYdnyE.exe
  C:\Windows\System\ChYdnyE.exe
  2⤵
  PID:10792
- C:\Windows\System\lvyuaEf.exe
  C:\Windows\System\lvyuaEf.exe
  2⤵
  PID:10860
- C:\Windows\System\uwAVnkp.exe
  C:\Windows\System\uwAVnkp.exe
  2⤵
  PID:10924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AyMswGa.exe

Filesize
1.9MB

MD5
b93e940de94417a911c4d10211ba3bb7

SHA1
9e5cdbab4517c7c980be3e863f53dffc8688c956

SHA256
057709493f469e8fe30bf3334bd55eb1ab1f96145a997ba50f20570fd6dd3911

SHA512
31641be287455d78ca94daf275deb06fb6507cced088529fbbf46eee7df2700bf7cf6bd51c2d67456a5c4d219520b99d3bb8c2f57593939292cbcc41c776220c

Download Submit
C:\Windows\system\CttWbjq.exe

Filesize
1.9MB

MD5
56c8c9aa66ed38529c9ce2e700b773c7

SHA1
58516ea35f8a2773aeb61de1d7793c00f80ab34e

SHA256
a591beb563c9e6cf0f35f868864e4ae70797ca127005ff14c045e4cb053fb803

SHA512
3eb8cf58d891ee522d022906fc8f97d2ae01772dbe3e49e2224d0e8e02f16cd0f72bf09229d4e4fe115d289a15cdf4fb13cf3bb07f06848778e412dd86b0cfe4

Download Submit
C:\Windows\system\JWJMKha.exe

Filesize
1.9MB

MD5
0cd46e9af269ffb67facb74d2e485663

SHA1
5ab36a7f707419a9b350bbd609cf9a988bcd7fdd

SHA256
219cdd89aee1475b03be62c5d9501783751b3d57f4b629ba648318ff7f7bb6ea

SHA512
c79020a8efcc7a3bf167f661a7eca371a4e13acc6338bc7e31749c222e5946ad985316aac3f1b75cc4c07246627dc452963b2bcfca2f4bfabc80fc7e5ec1a743

Download Submit
C:\Windows\system\KRmcooS.exe

Filesize
1.9MB

MD5
df3a37641667f128fc83ac4adca2c723

SHA1
41d3ba6dfc5d80d387d763d003f3443e1891dbb3

SHA256
ca99d394b24d249fa497f01240d4e11748d785a7eaba2dfdbbaa63f92ee2d126

SHA512
240d6bbbed425f9c35ec09ce48dbe103f09c0743d86712a7ab455aef3d69ff791de66fade610af168512c47aab737fd7c5c924631a4c1b4fcf9c5ce30d34dab3

Download Submit
C:\Windows\system\QpULuab.exe

Filesize
1.9MB

MD5
ae1577ddb7af677158716d6b72225e8e

SHA1
b25dc0b9f0a6f363588050fda33decefc18c7eef

SHA256
3c7877c3efa1cb7794dda12530343aa45bf4387c796edc96eb39790aacb687d0

SHA512
fd5b67f9cda9dc4269ce99afee2c079663c45871dd805011f6d74a4330fb381deae3588468a0d06a49717b7be53e052776be3349892a85b7835b7be29fbdd13c

Download Submit
C:\Windows\system\RLOurqJ.exe

Filesize
1.9MB

MD5
2fcc7994060c973d9c0241b5f916ae4e

SHA1
0f2407dc84b908c3e6320a8800dfd5a4759ade9f

SHA256
cf76d3cc72caa2adda0601cac7e8f0d9b229fa985300501f7562f7826bbe88d3

SHA512
8fd3b21e106ea8575a1bc8653eba187f2db701b932ca2c0821b5aee2546f9b08bb7269523389946d87ab5da36740765aba293b879a59295e2afc29210b5e7249

Download Submit
C:\Windows\system\RVSJzWy.exe

Filesize
1.9MB

MD5
5c2ad38e46a4bb5d5815bf0c562dc946

SHA1
585f4f8061cfc1b41b7bf9d1ff73ce08fc9af5d4

SHA256
c3ddb3dd8e547d8e303f83fc4554a1981ec51fe473834271485e646226b86d4e

SHA512
a6ba47a9adfdfd36a704353f7b6764fc97dee37b054fd14aed18f94d4d82e65712999c501dccf6ff2273323ea655b7a3345b2b060df46bebc9e0859cb60bc213

Download Submit
C:\Windows\system\TNaXBBf.exe

Filesize
1.9MB

MD5
615c6c9a7d08990002203c71c24e043b

SHA1
140d968c9d0dc51431046270ae229e46e1bd63f6

SHA256
baa6f9de1d1f00fb684198ff518ed171debd12121cadaeceaf402c2aae450aaf

SHA512
9f5b61aa5056fa2f6b3625e49d67248f2453302fa0b759a6e94e5363ed26e6b3e51421dbe43aa5c7f2b381be7911ec1c56eedf17f56bea642ad8251f3c987426

Download Submit
C:\Windows\system\XkCPKOb.exe

Filesize
1.9MB

MD5
f94858a3d874bf37ff767075c4593d36

SHA1
00957d1bcad9a37ae4036f1504a710030d176461

SHA256
bbb8a8ec0f655da4b8ed4404ce95c468e91f819900d93cd97c48cac82554ae08

SHA512
75d8d14f401abcae327072828929a92ca483d84c56ffac8e6251786d285d09e79ab5f30716b731450c9c7a7ded65426d36c7e69e537d6bf9e44c2049a5775c25

Download Submit
C:\Windows\system\YqdCrZK.exe

Filesize
1.9MB

MD5
c3db407ce44ef7378bb6a576e9d1f5db

SHA1
c08763036f7ced7a8229e823d84d9828725f8741

SHA256
8473ff889a6c820a4cb08cfb9654e3991f389fae494b44872f3e6be1bad42208

SHA512
f6dcd40c13bbb1a7e0ce61b14699854200b512382fac394202b4561df97d1b73fb5e4bc23292b56fa0673975b0cf6e2ae78329a53303693f15f4d4803124cfad

Download Submit
C:\Windows\system\amUxIJz.exe

Filesize
1.9MB

MD5
ebeb97f42fbbb9d1f56b8d4b0f2210ce

SHA1
a01475e470a40ce57808e4a898978502da814889

SHA256
4279fdb32199e7d3892b4e2f4ac80de53c4b3b7e4d952814e96dbcbb9098838c

SHA512
007f1e69556d4ba00743431ee406dcb13ce67b91cea707b356998b567e6dfe3a4b1e5fe982b6d85b92ce154c75b35f0b42ea46b5e0bcb000f8e126a58c0dbc4e

Download Submit
C:\Windows\system\crBlnPD.exe

Filesize
1.9MB

MD5
2470031a355fc5aa550bf7ed7e421de5

SHA1
b2409d2d54ef6f4759bae70956a58ada7f54e430

SHA256
ef38934e4fc2d6f3d3a40e342dbf3d96d3c09c90635d375c5d3d71170187b00a

SHA512
e9e0f66dcca1b3ea83d0457849291c49efccd4ef9bbbf8c4e2c52a246b0fd0b877c8a7c4e432bb1352b790388ae795b4de5c555103de3f35e0b0a80183881a9d

Download Submit
C:\Windows\system\fmGxEER.exe

Filesize
1.9MB

MD5
afe0ade58bcd3fbfddcef8644d2f5d3c

SHA1
f6184a62d0e100a3e99bdb880248fb3f7a85884c

SHA256
0449a18be6caea151d3c4b0d8164eb0cb39cd06e44783c6e91f59764d72534b3

SHA512
7e2b2f55a9822608898d5b69c2d9a6b4a51e7bb366bc5af737ddea1ce8cdd026308e83262cb0dba632101113c6637eeb3366b59608febbc441164d549f9e23b1

Download Submit
C:\Windows\system\gZTVSFX.exe

Filesize
1.9MB

MD5
6e944ebd3f20f825e1dbb2d937610359

SHA1
66da2a7022a3441f9a3a645c60662cf5b9d99db1

SHA256
85f5f3e9350c9455164b591fd7430f16ebddd01bd6f3a96a08079b6acddc48b3

SHA512
e84d127d36c7cfe2425498d903277b0dff08ffb2660634aab972fa66a9969a52ff9c89bfdf1f108db91139f59706f7ff4a0ba3f6e5738af620fcd878abc18a6b

Download Submit
C:\Windows\system\iqkbhqb.exe

Filesize
1.9MB

MD5
679db6e1754424176c048b92acbaa8e6

SHA1
43ce5575e6219dc12246094c4e3fd724a99de30f

SHA256
7f5f2a119bc00b5f4e5815788f535c85fa56a15cec7d5a04c708c636458248ac

SHA512
abb359b2fee6b81cf073f23469d8edaad05428eb856b8085953e33312e3a392b93fe5e798cff83bb49ba549e6052dccad60d4b88cd170cc632d62c05d64020b1

Download Submit
C:\Windows\system\qocklHb.exe

Filesize
1.9MB

MD5
3fc84835bc34139014332d2518d7f1e0

SHA1
2ef4e06c7a25d688a66e68a165bfb0cf12f3d35f

SHA256
fc9192c637ed69f3f2abb8d69768e743e4664a8ead2bf80466d942ddac0161b6

SHA512
a9e9be16ad18632f6a91e659b779b2fea5e5d25eef1b2fc5929332442ace58d11f3e552b83364db62da9b112a3f6a9e2599dae3d5995577a083377fc8e88e676

Download Submit
C:\Windows\system\rLqkHqB.exe

Filesize
1.9MB

MD5
e93ff51489e53cdd99a7834babbe6f4d

SHA1
035c4f2da580afad9ca6c7154bd40e26846206a5

SHA256
35f3b9a8773c64c86917cf8ac9baab1a57edd85a09bcb3938b5ade5062acc169

SHA512
62feb3e9187c784514290570e45dd29fd06566b30dd05123d4a37a270c244ae7063229f7142a57f45059c463d6e852d19eb8e08cf6a3da346c8a7a7a14fec4c3

Download Submit
C:\Windows\system\vsLAbhA.exe

Filesize
1.9MB

MD5
58bf0b13d12884c7026500c3bdc7217e

SHA1
c707f9e0ea0632f3f898c344a62e102a975a43df

SHA256
7a01e8aedf976bd7b80b87f12043b64ac3f89d00853d7267d9933f48fa4090a1

SHA512
a564504ca5f1b113891dd937c7da6ba85e1d705360beb9723d1ae3c88c6ba375aefc1995cd7f99075277137cf68e368eb03d6195503c480270e206e4b78273c1

Download Submit
C:\Windows\system\woXGSHz.exe

Filesize
1.9MB

MD5
5ce30e0135d482a63b34e02d9255bdba

SHA1
f4e6d375be787625eea8798a07354237592ac3da

SHA256
49f3c63915592acb64cbcf0ac18e12cf142f08532d163eef93bf0bbe545234fa

SHA512
adc6590d2435165de476eac8f533790a590141ae5bc1cbae2627bc0901c60e38a70504f2d46815d27495de733332148a887e3876bb1874cb8daee4ff1ecce31a

Download Submit
C:\Windows\system\ycnjtTL.exe

Filesize
1.9MB

MD5
af2ca5a4bf8be2aa91d74bcfa032cd65

SHA1
7a53946875568e2c46302036bfca21710c4ad998

SHA256
21a9bb3755722900f26ffe8e833dc0ac8e13f0abe198b974524d7b3273055c3e

SHA512
439c6e725e00f310c6ee027894789743d240bb1a5b45799a1ae181b3f14fb469c4ce69a72daa08665a700271bbbafd6841099eec0deb7bb0bb305af3e08bdcbb

Download Submit
\Windows\system\AZrUnJY.exe

Filesize
1.9MB

MD5
6a82c28d52af48a836a614b931578bf6

SHA1
b114023899fda7285780c8ce3363c5caf84b2f75

SHA256
a41dc216f5e1a257b480518aa835cb9ce50310558caa8a6abbdc09fc6cffe254

SHA512
bfddf7902161f74eb0eb448bb47578c1da0d61d0b48f855f8533e82c2f1672e3f08422f3b6f179215e67bb15ee6954860db05420d3ab9a02d4a3c690bf5914e3

Download Submit
\Windows\system\AeTYviv.exe

Filesize
1.9MB

MD5
79f27122617ea81c243b0347ef6191e6

SHA1
ac9ce9da566a8721835b5b7701fc8dc37bc46d1b

SHA256
6c6e9254f429a4f3d8b4c6385a6b533fff53be58890e05f5a45d7b2bbe9e46a2

SHA512
3ab927584ac565c6be8aa0c22b74f6a4d1c91ea377e465d382fe21f06729db17a663e8b3a20b4fa7d457a3e0dc1b45fd50569cd872d7c82230d5327556857854

Download Submit
\Windows\system\CgGjNYT.exe

Filesize
1.9MB

MD5
07247435c4618b8539c2e7f6a46c70e6

SHA1
d80d660f9c86f4030fffbf7813a2aee114b31e33

SHA256
6371fb9e031a8c457f8e722938f096060e3df7006d5349a1ceaa111995cbae36

SHA512
6b95a28612845622d854886a3f5fe302d6fa4ee0b963b4e437928afdc39d0ec03e5d6f8afaa1088c6689c895b3e6210fe9f9d353fa66e7cb5f13506eb9be100f

Download Submit
\Windows\system\DGrPSpT.exe

Filesize
1.9MB

MD5
a692eabb1249b1f000793de34dc24dd8

SHA1
ad0bd988dd3925dddd15bb68cde7d10510d57213

SHA256
1257fe9ae6d82d08ba5f4285bbbbc35625189d5a57b2a1a11cf815b109f689ba

SHA512
893b00fc65cfe1c43b8fc22683f5351c071956a2d9c43be306ee180a422974134048bcb99dbaa1e3d398aea0ca87871e06d4bd0e74e39c3fd0dcf45c3253636c

Download Submit
\Windows\system\FGchTTu.exe

Filesize
1.9MB

MD5
768632015977f83f86ecf2c67f893c8f

SHA1
3784c14a7ab3b4f7bd12ee9e8fbff96ff2ecffe6

SHA256
d4da40e9ff3fb5628a0934f8513e74241280afe221c98bf66800d6361abd44e7

SHA512
5854d0c00d903669e62860777597c2d23f3dfb66f9e3418b0b1913caeb1af41eff35fba5285bd5bbabedc83a61937af0329eb5d56ec17efcdd1a1f6a4d42e0a9

Download Submit
\Windows\system\FZQwhEW.exe

Filesize
1.9MB

MD5
d1c925897cfb8cd48ede403a1ed2f5a2

SHA1
31bd8ab1a192e3813eb6fcabdabb00a557a7a1e9

SHA256
90dafb28900610880e69dc03565e3b4823da8a06cd946b4c023376d2025bf9cb

SHA512
50ff1b0130919b5958bb0cfe0ccd243113818ea44de3e746f09cef91de6c45569ed5809bbe639165e376d35f7db6ab9aaaa66090094e60e74549f565d63a0195

Download Submit
\Windows\system\FcAtNnR.exe

Filesize
1.9MB

MD5
2b981bba6ee6013142718123c4d412ac

SHA1
eaa3fb57d894f81f5f4ae064207ee67c3c83c60c

SHA256
8471c2dfed4f05040b68933be47ba1b5a1d04e0b3005df39739c30861ca51f30

SHA512
78f97786bc45648102f255da793430baec81886573d1922a4678381e03cf04163443a6e5ba0306f9f38a407a983d23815ee2db446897e9f8c3eed4b5d390ab00

Download Submit
\Windows\system\KrdLQrZ.exe

Filesize
1.9MB

MD5
8bf1804e766eea6dc2de72d3811c3902

SHA1
91e0c3a7c2804a99eb85c74eab80a1399e121379

SHA256
fe3b91d605756384b13c2181604597b9ca6265b6bf78d5d9d3cc9dfddb29a5de

SHA512
f4db6c9b70a993ab8843944c0af5c17acb1217253a492d8800bcc43c1c00ebdc2225ccd07fe0d1b220e07c0d9e8cf8501692ec82d36b33c2e38b3756b2ed5f30

Download Submit
\Windows\system\OOLgKmj.exe

Filesize
1.9MB

MD5
2d55ee2c354dea176a0f4a1a2d6f857f

SHA1
e655ca4ec4fd98fee54d484a4407b2a94e8f96e2

SHA256
82e7e34fa656bd08a12ad0dbd834146d1fca704c74c31ba7fece6052b0325194

SHA512
da27e6bc6e4c10c35c0638b2c48d0be39c618781941aee3eb76e572b277c0ec970838cfffde606154996dd481960fbb65c506fe8e7650ea96579d5528482c38c

Download Submit
\Windows\system\OUyVzpb.exe

Filesize
1.9MB

MD5
154201fc30c5272e9a5e86d9140f91af

SHA1
2e945aa759c4df668f9383c467d7ea4a5bea1fc4

SHA256
617565ee3096de415c2f261ae623595d9caf064f6daa7cbcd50546d32b1b0bca

SHA512
fece140d11f416e8c1ec7e4a9e6a508993a464db37550a7ecc9afdbc30276aaee41ad2eb26118a30f00c47a979402a2b593735f1c5d8ecd0c6f905ba5ffac139

Download Submit
\Windows\system\QgakknT.exe

Filesize
1.9MB

MD5
54954b723bf96279a04f8533f04028a6

SHA1
eeb0acce34dfc2902a0a164ef19077b0757240de

SHA256
83688af2554403c01f862029c86526c1d342c5810e5c87d2d11ce4311f84a8a4

SHA512
4256a05e614a62ee53bd00285023da20a54d65aa3b035b11c0f44e0a1e1b1e7f68d871a0175e742c1af15d0339b4d47f14805cc098cfc8eec1010d727706dab9

Download Submit
\Windows\system\TAQyolA.exe

Filesize
1.9MB

MD5
9b3c64cc422e8f428cbb8cfc2279559b

SHA1
0fa0e84ca49c09f8cefa9f396274ec6859a2d7e9

SHA256
590f59d0bc37ebbcafd1aed02bc82635c95a9eeb1c4f54c86196239efc434f53

SHA512
111bd51ceb5eff08a213ab5c4f52eeb51329f5d73dadca9cf8e8c5709a1f14e632c21c5b87221a46b8c882bfaff8bea33bba363459fb417deb2302d10dc5e01d

Download Submit
\Windows\system\gcskadX.exe

Filesize
1.9MB

MD5
b71fad9294c2eb57d6c8e7d3f84153e7

SHA1
8944896f02b1186b5b513860dc5dca45e1373f13

SHA256
824a40d06ce00a7263a4afc22791e5264368be7fafca793b6f3bddcfdd39f674

SHA512
a899e60d0eeaddeb485527aa3f5747236638225b03967bdfaf22ce91b3cfb4d5901e66b22048fdf051d1bf7e831bf052bce06a7cfb89c4405a97cbd08332bbd3

Download Submit
\Windows\system\mMlJIwj.exe

Filesize
1.9MB

MD5
7db2a684e0e537cca37b77f1fc64bcb1

SHA1
3cb8c3e1fe689a28f541718f594e35a802a69e65

SHA256
24019b9e076cd1a2370fb4c501f51138cea7ff4937654cc8529d312ea2c9ced3

SHA512
32253acb2b6b922f7819426641dd6ede02ef19949b25ad61b444ca018126fd8efce84f983988fe0720b1d5a859002f4f8e8ff4c9c7fe87ff7e6917448a6c44b4

Download Submit
\Windows\system\pOwYtyw.exe

Filesize
1.9MB

MD5
1e3115151e783eaaabcdfb128ba0a90b

SHA1
2c8e55e5c26d5ff1489815330e61e2c6add6313b

SHA256
c4f26f785177fc69630adadf39651bc54ed1dbbc923b59bfea2328d4d42c04ef

SHA512
27d8c46929063cb3c7ea2ff8416b6210439551164a12930fe06c273cf89b87ea6ec047e087ca0d82c6203fcbaf9032b9fa4550271934274750fa7fe306003235

Download Submit
\Windows\system\qdWHZYD.exe

Filesize
1.9MB

MD5
f4ba946f68b777806f2307e9dd9af768

SHA1
3c9236cc9452094d465d939d953d3c7c12a0c4fb

SHA256
a035ef1483ed5ec40c0c5392e5913573150e4c6bba8814e51c062b1f12f984f1

SHA512
1e63dbe43f6f3ff1640e66dd4ae2d7c5466c88802f37502a8e515ca421b6e13f847c124d7b3095664b5f47b41d88792908115ff911a1bb976f3aa9e941b28054

Download Submit
\Windows\system\uIVpXOj.exe

Filesize
1.9MB

MD5
9d73a86867db0f412230a07dcbff33fb

SHA1
00642b54bd141d9c33db74ac2fa28791fc5fd551

SHA256
995a7b620c2d396216a71c8b2ac80382e1083f6637057ed0430ca5f6d321ecdb

SHA512
d302acb0e5a6adb561e406c24cf3ab6d00a9b402844a380602a96e24f6eed3278139601d046be86f5c3ef58e26f8aacfeb015145a649ae8b37e78ab7cb2b4d80

Download Submit
\Windows\system\urJIFDp.exe

Filesize
1.9MB

MD5
9a2bc3fd02e22a45c73d16a637f1b23a

SHA1
0f4630c2bf3ba3e2b6a4dc1ed3a43ed1e5b189ae

SHA256
b5ef8e02ca83913f69ef277efd1b6a5ffbe207c2ca5005c47ee9ca4aa3d2736f

SHA512
3f169dc60330285266520378f969012d3e3538f5650e8f859e5a1f970a762c7e9719d1c55be100f4b8042dfde636f5ebbe44bccf691f602c9684d0b4d3883754

Download Submit
\Windows\system\vhFSUUh.exe

Filesize
1.9MB

MD5
b150d37f1064486dd409d265d5aac5f7

SHA1
a99a5c48d7616be6db972cefe0b23d266f174679

SHA256
ea104eb27a95baaec7b3347071ac94191545b586abe1ad62812fd435fbe9fa9d

SHA512
95cf2ef56f279a86d131a9d17f2a46d067f67d4d121ef026e2226665d469872ce673621709b1538a601859e6cbfbb45b32aff191fc6927ab204e6b4b6213dbe7

Download Submit
memory/1304-43-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/1304-88-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/1304-58-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/1304-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1304-59-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/1304-1-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/1304-57-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/1304-92-0x0000000003330000-0x0000000003722000-memory.dmp

Filesize
3.9MB

Download
memory/1304-18-0x0000000002C00000-0x0000000002FF2000-memory.dmp

Filesize
3.9MB

Download
memory/1304-61-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/1304-87-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/1304-63-0x0000000002DE0000-0x00000000031D2000-memory.dmp

Filesize
3.9MB

Download
memory/1304-55-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/1440-47-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/1712-51-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

Filesize
32KB

Download
memory/1712-42-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/1984-35-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2016-62-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-84-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2480-60-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2488-82-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2576-66-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-54-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-56-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2912-65-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/3016-83-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download