xmrig | 49d0a4fd0cab726443716ac3354bcc3e9cd3e3031071208d92ade36a4101441f

Analysis

max time kernel
143s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
Size

1.9MB
MD5

0150a0e6a0c42841914bdb5245aad377
SHA1

bf84638f94ca046b60592852b66a86fda5ee2add
SHA256

49d0a4fd0cab726443716ac3354bcc3e9cd3e3031071208d92ade36a4101441f
SHA512

e0d4b634edd5ea995f03c6e7b7793f6b236482eadda41aa24e9384776157eb5155a15ae2b285b891c33d49be9373027c4311e56cf1e687eb8e504c3d64931e35
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHaf7:NAB8

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/memory/4956-217-0x00007FF6314C0000-0x00007FF6318B2000-memory.dmp	xmrig
behavioral2/memory/4928-406-0x00007FF715E90000-0x00007FF716282000-memory.dmp	xmrig
behavioral2/memory/2212-474-0x00007FF75D500000-0x00007FF75D8F2000-memory.dmp	xmrig
behavioral2/memory/3952-534-0x00007FF66DD40000-0x00007FF66E132000-memory.dmp	xmrig
behavioral2/memory/4988-537-0x00007FF644690000-0x00007FF644A82000-memory.dmp	xmrig
behavioral2/memory/372-634-0x00007FF6D6240000-0x00007FF6D6632000-memory.dmp	xmrig
behavioral2/memory/2952-653-0x00007FF745F30000-0x00007FF746322000-memory.dmp	xmrig
behavioral2/memory/1904-615-0x00007FF7EE220000-0x00007FF7EE612000-memory.dmp	xmrig
behavioral2/memory/4888-377-0x00007FF60F540000-0x00007FF60F932000-memory.dmp	xmrig
behavioral2/memory/1276-6391-0x00007FF6B20B0000-0x00007FF6B24A2000-memory.dmp	xmrig
behavioral2/memory/872-350-0x00007FF70CC10000-0x00007FF70D002000-memory.dmp	xmrig
behavioral2/memory/4520-328-0x00007FF7268C0000-0x00007FF726CB2000-memory.dmp	xmrig
behavioral2/memory/2552-325-0x00007FF6175F0000-0x00007FF6179E2000-memory.dmp	xmrig
behavioral2/memory/3564-282-0x00007FF68CC80000-0x00007FF68D072000-memory.dmp	xmrig
behavioral2/memory/1580-248-0x00007FF7FD6E0000-0x00007FF7FDAD2000-memory.dmp	xmrig
behavioral2/memory/1012-214-0x00007FF649680000-0x00007FF649A72000-memory.dmp	xmrig
behavioral2/memory/4332-93-0x00007FF646620000-0x00007FF646A12000-memory.dmp	xmrig
behavioral2/memory/952-90-0x00007FF748DB0000-0x00007FF7491A2000-memory.dmp	xmrig
behavioral2/memory/4884-71-0x00007FF611890000-0x00007FF611C82000-memory.dmp	xmrig
behavioral2/memory/1524-56-0x00007FF7232B0000-0x00007FF7236A2000-memory.dmp	xmrig
behavioral2/memory/3492-53-0x00007FF718480000-0x00007FF718872000-memory.dmp	xmrig
behavioral2/memory/3952-7788-0x00007FF66DD40000-0x00007FF66E132000-memory.dmp	xmrig
behavioral2/memory/1524-7795-0x00007FF7232B0000-0x00007FF7236A2000-memory.dmp	xmrig
behavioral2/memory/4884-7802-0x00007FF611890000-0x00007FF611C82000-memory.dmp	xmrig
behavioral2/memory/952-7805-0x00007FF748DB0000-0x00007FF7491A2000-memory.dmp	xmrig
behavioral2/memory/4520-7814-0x00007FF7268C0000-0x00007FF726CB2000-memory.dmp	xmrig
behavioral2/memory/4332-7810-0x00007FF646620000-0x00007FF646A12000-memory.dmp	xmrig
behavioral2/memory/3492-7793-0x00007FF718480000-0x00007FF718872000-memory.dmp	xmrig
behavioral2/memory/1580-7820-0x00007FF7FD6E0000-0x00007FF7FDAD2000-memory.dmp	xmrig
behavioral2/memory/4956-7891-0x00007FF6314C0000-0x00007FF6318B2000-memory.dmp	xmrig
behavioral2/memory/1904-7898-0x00007FF7EE220000-0x00007FF7EE612000-memory.dmp	xmrig
behavioral2/memory/2552-7882-0x00007FF6175F0000-0x00007FF6179E2000-memory.dmp	xmrig
behavioral2/memory/2212-7996-0x00007FF75D500000-0x00007FF75D8F2000-memory.dmp	xmrig
behavioral2/memory/4888-8017-0x00007FF60F540000-0x00007FF60F932000-memory.dmp	xmrig
behavioral2/memory/4928-7979-0x00007FF715E90000-0x00007FF716282000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3952	AcFIdxY.exe
3492	UsiLBqw.exe
1524	JNuLnkL.exe
4884	AdIjVGW.exe
952	rCXhKkp.exe
4332	Orzpezb.exe
4988	mcgINDA.exe
1276	rmRcEeF.exe
1012	OMWWkEh.exe
4956	JZzzkMA.exe
1580	KjKMTaC.exe
3564	KhTDyhQ.exe
1904	gYhafKu.exe
2552	XhHUuyZ.exe
4520	VTOmQTo.exe
372	aVHGmoZ.exe
872	yjQHJIX.exe
4888	IGWnUxY.exe
2952	rDgnfGZ.exe
4928	tzsVFAZ.exe
2212	WxcZQsz.exe
3640	ndoIhtK.exe
4392	yqCRSSo.exe
3352	WVSnIBZ.exe
2348	qXYeLSC.exe
456	vZrZISY.exe
4912	TxMybZK.exe
3836	xlYTXct.exe
3164	RjvFTTc.exe
4488	QbwzOQE.exe
4076	yAIazbi.exe
1896	LhBdctM.exe
2604	fuKXqCr.exe
1092	QYvpyXw.exe
316	UgRMywk.exe
3992	gHKPkob.exe
940	ZaJBNGN.exe
2256	HMZzXHb.exe
3560	IYpOuSD.exe
3780	zXRjJri.exe
3816	BcBvOKn.exe
3404	oLHnTsh.exe
5088	UVFYPTe.exe
4968	avgAIhA.exe
3768	qXnwDxv.exe
4124	gJtibZB.exe
5068	ALRwUfB.exe
5064	jYSnRwH.exe
2668	FoxSNNl.exe
1920	byXjunu.exe
568	CBrMihY.exe
3872	gSXINNa.exe
536	TuLzirm.exe
1112	NmMJHIv.exe
1648	rOLhtjt.exe
4320	WqHvthI.exe
3704	ksmMFQv.exe
3696	jZkIUun.exe
3300	tsNntln.exe
3456	YEUotzC.exe
4660	ZpdoEMa.exe
4900	xCmSKbq.exe
4456	IAZDVev.exe
3556	MOLOExd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3176-0-0x00007FF6FADA0000-0x00007FF6FB192000-memory.dmp	upx
behavioral2/files/0x0008000000023285-5.dat	upx
behavioral2/files/0x0008000000023411-14.dat	upx
behavioral2/files/0x0007000000023417-44.dat	upx
behavioral2/files/0x0007000000023414-43.dat	upx
behavioral2/files/0x000700000002341c-68.dat	upx
behavioral2/files/0x0007000000023420-86.dat	upx
behavioral2/memory/4956-217-0x00007FF6314C0000-0x00007FF6318B2000-memory.dmp	upx
behavioral2/memory/4928-406-0x00007FF715E90000-0x00007FF716282000-memory.dmp	upx
behavioral2/memory/2212-474-0x00007FF75D500000-0x00007FF75D8F2000-memory.dmp	upx
behavioral2/memory/3952-534-0x00007FF66DD40000-0x00007FF66E132000-memory.dmp	upx
behavioral2/memory/4988-537-0x00007FF644690000-0x00007FF644A82000-memory.dmp	upx
behavioral2/memory/372-634-0x00007FF6D6240000-0x00007FF6D6632000-memory.dmp	upx
behavioral2/memory/2952-653-0x00007FF745F30000-0x00007FF746322000-memory.dmp	upx
behavioral2/memory/1904-615-0x00007FF7EE220000-0x00007FF7EE612000-memory.dmp	upx
behavioral2/memory/4888-377-0x00007FF60F540000-0x00007FF60F932000-memory.dmp	upx
behavioral2/memory/1276-6391-0x00007FF6B20B0000-0x00007FF6B24A2000-memory.dmp	upx
behavioral2/memory/872-350-0x00007FF70CC10000-0x00007FF70D002000-memory.dmp	upx
behavioral2/memory/4520-328-0x00007FF7268C0000-0x00007FF726CB2000-memory.dmp	upx
behavioral2/memory/2552-325-0x00007FF6175F0000-0x00007FF6179E2000-memory.dmp	upx
behavioral2/memory/3564-282-0x00007FF68CC80000-0x00007FF68D072000-memory.dmp	upx
behavioral2/memory/1580-248-0x00007FF7FD6E0000-0x00007FF7FDAD2000-memory.dmp	upx
behavioral2/memory/1012-214-0x00007FF649680000-0x00007FF649A72000-memory.dmp	upx
behavioral2/files/0x0007000000023424-204.dat	upx
behavioral2/files/0x000700000002342c-203.dat	upx
behavioral2/files/0x0007000000023425-196.dat	upx
behavioral2/files/0x000700000002342b-192.dat	upx
behavioral2/files/0x0007000000023432-188.dat	upx
behavioral2/files/0x0007000000023431-184.dat	upx
behavioral2/files/0x0007000000023423-177.dat	upx
behavioral2/files/0x0007000000023429-175.dat	upx
behavioral2/files/0x0007000000023430-174.dat	upx
behavioral2/files/0x0007000000023422-154.dat	upx
behavioral2/files/0x000700000002342f-151.dat	upx
behavioral2/files/0x0007000000023428-149.dat	upx
behavioral2/files/0x000700000002342d-146.dat	upx
behavioral2/files/0x000700000002341b-136.dat	upx
behavioral2/files/0x000700000002342a-135.dat	upx
behavioral2/files/0x000700000002341e-128.dat	upx
behavioral2/files/0x0007000000023427-122.dat	upx
behavioral2/files/0x000700000002342e-148.dat	upx
behavioral2/files/0x0007000000023426-120.dat	upx
behavioral2/files/0x0007000000023421-119.dat	upx
behavioral2/memory/1276-147-0x00007FF6B20B0000-0x00007FF6B24A2000-memory.dmp	upx
behavioral2/files/0x0007000000023425-116.dat	upx
behavioral2/files/0x000700000002341a-109.dat	upx
behavioral2/files/0x000700000002341f-130.dat	upx
behavioral2/files/0x0007000000023419-101.dat	upx
behavioral2/memory/4332-93-0x00007FF646620000-0x00007FF646A12000-memory.dmp	upx
behavioral2/memory/952-90-0x00007FF748DB0000-0x00007FF7491A2000-memory.dmp	upx
behavioral2/files/0x0007000000023418-97.dat	upx
behavioral2/memory/4884-71-0x00007FF611890000-0x00007FF611C82000-memory.dmp	upx
behavioral2/files/0x000700000002341d-70.dat	upx
behavioral2/files/0x0007000000023416-64.dat	upx
behavioral2/memory/1524-56-0x00007FF7232B0000-0x00007FF7236A2000-memory.dmp	upx
behavioral2/memory/3492-53-0x00007FF718480000-0x00007FF718872000-memory.dmp	upx
behavioral2/files/0x0007000000023413-47.dat	upx
behavioral2/files/0x0007000000023415-58.dat	upx
behavioral2/files/0x0007000000023412-25.dat	upx
behavioral2/files/0x000800000002340e-18.dat	upx
behavioral2/memory/3952-7788-0x00007FF66DD40000-0x00007FF66E132000-memory.dmp	upx
behavioral2/memory/1524-7795-0x00007FF7232B0000-0x00007FF7236A2000-memory.dmp	upx
behavioral2/memory/4884-7802-0x00007FF611890000-0x00007FF611C82000-memory.dmp	upx
behavioral2/memory/952-7805-0x00007FF748DB0000-0x00007FF7491A2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZMaSAIy.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\TfWPKIw.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\EsNUSfr.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\ZdtmeAT.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\EgjKIpo.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\tBMDShC.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\Vfzbmgj.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\IemPBvS.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\vPxNjSL.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\SPngeJO.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\UeXBhDi.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\aGgLxjU.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\OeZQuQi.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\SqjTxsz.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\ythLdWO.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\JOrAnDD.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\LyXZvvr.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\uAntZpk.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\eetHJDy.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\TUIRWRP.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\LJzHvAK.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\MlZbmUW.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\YnjpzGp.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\qGXzQTR.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\abYnWtA.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\svnLmNv.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\yvJIAGo.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\nhlCvEw.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\gCInYrt.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\urZbyVx.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\rfqAxzw.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\LEktjcZ.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\zPbxbnR.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\SaDTrjr.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\vyoKykV.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\bIgAaTJ.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\eksZcWh.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\BptLimt.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\RCQreQK.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\XMStALM.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\ADwSYOq.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\kdAAwFG.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\sxatEmY.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\HhrEElx.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\nMPhpuN.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\CcWXDAz.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\BaOrkug.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\npdCAVL.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\RuHBZQZ.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\ssLsLRi.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\cJxfJqo.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\NIWTEKy.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\vhfnfQF.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\XBFZZHg.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\oJjiguj.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\vOfwImP.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\EUWdwuV.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\DFXtoQO.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\IUCufbJ.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\wjPGMnZ.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\zoUjscH.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\Aqxsqrk.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\ErUliJo.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
File created	C:\Windows\System\NNqGDUL.exe	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4444	powershell.exe
4444	powershell.exe
4444	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeLockMemoryPrivilege	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
11888	sihost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 4444	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	81
PID 3176 wrote to memory of 4444	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	81
PID 3176 wrote to memory of 3952	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	82
PID 3176 wrote to memory of 3952	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	82
PID 3176 wrote to memory of 3492	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	83
PID 3176 wrote to memory of 3492	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	83
PID 3176 wrote to memory of 1524	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	84
PID 3176 wrote to memory of 1524	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	84
PID 3176 wrote to memory of 4884	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	85
PID 3176 wrote to memory of 4884	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	85
PID 3176 wrote to memory of 952	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	86
PID 3176 wrote to memory of 952	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	86
PID 3176 wrote to memory of 4988	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	87
PID 3176 wrote to memory of 4988	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	87
PID 3176 wrote to memory of 4332	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	88
PID 3176 wrote to memory of 4332	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	88
PID 3176 wrote to memory of 1580	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	89
PID 3176 wrote to memory of 1580	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	89
PID 3176 wrote to memory of 1276	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	90
PID 3176 wrote to memory of 1276	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	90
PID 3176 wrote to memory of 1012	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	91
PID 3176 wrote to memory of 1012	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	91
PID 3176 wrote to memory of 4956	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	92
PID 3176 wrote to memory of 4956	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	92
PID 3176 wrote to memory of 3564	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	93
PID 3176 wrote to memory of 3564	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	93
PID 3176 wrote to memory of 1904	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	94
PID 3176 wrote to memory of 1904	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	94
PID 3176 wrote to memory of 2552	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	95
PID 3176 wrote to memory of 2552	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	95
PID 3176 wrote to memory of 4520	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	96
PID 3176 wrote to memory of 4520	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	96
PID 3176 wrote to memory of 372	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	97
PID 3176 wrote to memory of 372	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	97
PID 3176 wrote to memory of 872	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	98
PID 3176 wrote to memory of 872	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	98
PID 3176 wrote to memory of 4888	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	99
PID 3176 wrote to memory of 4888	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	99
PID 3176 wrote to memory of 3640	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	100
PID 3176 wrote to memory of 3640	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	100
PID 3176 wrote to memory of 2952	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	101
PID 3176 wrote to memory of 2952	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	101
PID 3176 wrote to memory of 4928	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	102
PID 3176 wrote to memory of 4928	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	102
PID 3176 wrote to memory of 4488	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	103
PID 3176 wrote to memory of 4488	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	103
PID 3176 wrote to memory of 2212	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	104
PID 3176 wrote to memory of 2212	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	104
PID 3176 wrote to memory of 4392	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	105
PID 3176 wrote to memory of 4392	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	105
PID 3176 wrote to memory of 3352	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	106
PID 3176 wrote to memory of 3352	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	106
PID 3176 wrote to memory of 2348	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	107
PID 3176 wrote to memory of 2348	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	107
PID 3176 wrote to memory of 456	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	108
PID 3176 wrote to memory of 456	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	108
PID 3176 wrote to memory of 4912	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	109
PID 3176 wrote to memory of 4912	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	109
PID 3176 wrote to memory of 3836	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	110
PID 3176 wrote to memory of 3836	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	110
PID 3176 wrote to memory of 3164	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	111
PID 3176 wrote to memory of 3164	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	111
PID 3176 wrote to memory of 4076	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	112
PID 3176 wrote to memory of 4076	3176	0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe	112

C:\Users\Admin\AppData\Local\Temp\0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0150a0e6a0c42841914bdb5245aad377_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4444
- C:\Windows\System\AcFIdxY.exe
  C:\Windows\System\AcFIdxY.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\UsiLBqw.exe
  C:\Windows\System\UsiLBqw.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\JNuLnkL.exe
  C:\Windows\System\JNuLnkL.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\AdIjVGW.exe
  C:\Windows\System\AdIjVGW.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\rCXhKkp.exe
  C:\Windows\System\rCXhKkp.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\mcgINDA.exe
  C:\Windows\System\mcgINDA.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\Orzpezb.exe
  C:\Windows\System\Orzpezb.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\KjKMTaC.exe
  C:\Windows\System\KjKMTaC.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\rmRcEeF.exe
  C:\Windows\System\rmRcEeF.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\OMWWkEh.exe
  C:\Windows\System\OMWWkEh.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\JZzzkMA.exe
  C:\Windows\System\JZzzkMA.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\KhTDyhQ.exe
  C:\Windows\System\KhTDyhQ.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\gYhafKu.exe
  C:\Windows\System\gYhafKu.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\XhHUuyZ.exe
  C:\Windows\System\XhHUuyZ.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\VTOmQTo.exe
  C:\Windows\System\VTOmQTo.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\aVHGmoZ.exe
  C:\Windows\System\aVHGmoZ.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\yjQHJIX.exe
  C:\Windows\System\yjQHJIX.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\IGWnUxY.exe
  C:\Windows\System\IGWnUxY.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\ndoIhtK.exe
  C:\Windows\System\ndoIhtK.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\rDgnfGZ.exe
  C:\Windows\System\rDgnfGZ.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\tzsVFAZ.exe
  C:\Windows\System\tzsVFAZ.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\QbwzOQE.exe
  C:\Windows\System\QbwzOQE.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\WxcZQsz.exe
  C:\Windows\System\WxcZQsz.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\yqCRSSo.exe
  C:\Windows\System\yqCRSSo.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\WVSnIBZ.exe
  C:\Windows\System\WVSnIBZ.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\qXYeLSC.exe
  C:\Windows\System\qXYeLSC.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\vZrZISY.exe
  C:\Windows\System\vZrZISY.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\TxMybZK.exe
  C:\Windows\System\TxMybZK.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\xlYTXct.exe
  C:\Windows\System\xlYTXct.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\RjvFTTc.exe
  C:\Windows\System\RjvFTTc.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\yAIazbi.exe
  C:\Windows\System\yAIazbi.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\LhBdctM.exe
  C:\Windows\System\LhBdctM.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\fuKXqCr.exe
  C:\Windows\System\fuKXqCr.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\QYvpyXw.exe
  C:\Windows\System\QYvpyXw.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\UgRMywk.exe
  C:\Windows\System\UgRMywk.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\gHKPkob.exe
  C:\Windows\System\gHKPkob.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\ZaJBNGN.exe
  C:\Windows\System\ZaJBNGN.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\HMZzXHb.exe
  C:\Windows\System\HMZzXHb.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\IYpOuSD.exe
  C:\Windows\System\IYpOuSD.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\zXRjJri.exe
  C:\Windows\System\zXRjJri.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\BcBvOKn.exe
  C:\Windows\System\BcBvOKn.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\oLHnTsh.exe
  C:\Windows\System\oLHnTsh.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\UVFYPTe.exe
  C:\Windows\System\UVFYPTe.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\avgAIhA.exe
  C:\Windows\System\avgAIhA.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\qXnwDxv.exe
  C:\Windows\System\qXnwDxv.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\gJtibZB.exe
  C:\Windows\System\gJtibZB.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\ALRwUfB.exe
  C:\Windows\System\ALRwUfB.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\jYSnRwH.exe
  C:\Windows\System\jYSnRwH.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\FoxSNNl.exe
  C:\Windows\System\FoxSNNl.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\byXjunu.exe
  C:\Windows\System\byXjunu.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\CBrMihY.exe
  C:\Windows\System\CBrMihY.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\gSXINNa.exe
  C:\Windows\System\gSXINNa.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\TuLzirm.exe
  C:\Windows\System\TuLzirm.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\NmMJHIv.exe
  C:\Windows\System\NmMJHIv.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\rOLhtjt.exe
  C:\Windows\System\rOLhtjt.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\WqHvthI.exe
  C:\Windows\System\WqHvthI.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\ksmMFQv.exe
  C:\Windows\System\ksmMFQv.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\jZkIUun.exe
  C:\Windows\System\jZkIUun.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\tsNntln.exe
  C:\Windows\System\tsNntln.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\YEUotzC.exe
  C:\Windows\System\YEUotzC.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\ZpdoEMa.exe
  C:\Windows\System\ZpdoEMa.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\xCmSKbq.exe
  C:\Windows\System\xCmSKbq.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\FniHGfS.exe
  C:\Windows\System\FniHGfS.exe
  2⤵
  PID:2364
- C:\Windows\System\IAZDVev.exe
  C:\Windows\System\IAZDVev.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\MOLOExd.exe
  C:\Windows\System\MOLOExd.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\qlMVKXP.exe
  C:\Windows\System\qlMVKXP.exe
  2⤵
  PID:2980
- C:\Windows\System\yEDiXVu.exe
  C:\Windows\System\yEDiXVu.exe
  2⤵
  PID:820
- C:\Windows\System\NVjXsTY.exe
  C:\Windows\System\NVjXsTY.exe
  2⤵
  PID:3488
- C:\Windows\System\tmLqxXv.exe
  C:\Windows\System\tmLqxXv.exe
  2⤵
  PID:4544
- C:\Windows\System\WrpRQhi.exe
  C:\Windows\System\WrpRQhi.exe
  2⤵
  PID:4064
- C:\Windows\System\jkhIUtp.exe
  C:\Windows\System\jkhIUtp.exe
  2⤵
  PID:4864
- C:\Windows\System\bqZbzqU.exe
  C:\Windows\System\bqZbzqU.exe
  2⤵
  PID:4364
- C:\Windows\System\ZppzfoR.exe
  C:\Windows\System\ZppzfoR.exe
  2⤵
  PID:2160
- C:\Windows\System\JZTbvhq.exe
  C:\Windows\System\JZTbvhq.exe
  2⤵
  PID:5132
- C:\Windows\System\guJefdo.exe
  C:\Windows\System\guJefdo.exe
  2⤵
  PID:5156
- C:\Windows\System\yHjDTxD.exe
  C:\Windows\System\yHjDTxD.exe
  2⤵
  PID:5184
- C:\Windows\System\yRttNoL.exe
  C:\Windows\System\yRttNoL.exe
  2⤵
  PID:5208
- C:\Windows\System\AZSIYPV.exe
  C:\Windows\System\AZSIYPV.exe
  2⤵
  PID:5228
- C:\Windows\System\mcdGZuM.exe
  C:\Windows\System\mcdGZuM.exe
  2⤵
  PID:5252
- C:\Windows\System\vBhqsJm.exe
  C:\Windows\System\vBhqsJm.exe
  2⤵
  PID:5276
- C:\Windows\System\AlaCIpR.exe
  C:\Windows\System\AlaCIpR.exe
  2⤵
  PID:5300
- C:\Windows\System\COIbFDL.exe
  C:\Windows\System\COIbFDL.exe
  2⤵
  PID:5316
- C:\Windows\System\xxsBvyA.exe
  C:\Windows\System\xxsBvyA.exe
  2⤵
  PID:5336
- C:\Windows\System\IyqmDzF.exe
  C:\Windows\System\IyqmDzF.exe
  2⤵
  PID:5404
- C:\Windows\System\BMzUvTr.exe
  C:\Windows\System\BMzUvTr.exe
  2⤵
  PID:5428
- C:\Windows\System\TeYUMBz.exe
  C:\Windows\System\TeYUMBz.exe
  2⤵
  PID:5448
- C:\Windows\System\uLLleRL.exe
  C:\Windows\System\uLLleRL.exe
  2⤵
  PID:5472
- C:\Windows\System\Hghbmjc.exe
  C:\Windows\System\Hghbmjc.exe
  2⤵
  PID:5492
- C:\Windows\System\zJDTDjP.exe
  C:\Windows\System\zJDTDjP.exe
  2⤵
  PID:5508
- C:\Windows\System\YbjeXly.exe
  C:\Windows\System\YbjeXly.exe
  2⤵
  PID:5532
- C:\Windows\System\minDdtq.exe
  C:\Windows\System\minDdtq.exe
  2⤵
  PID:5552
- C:\Windows\System\rIBbRUm.exe
  C:\Windows\System\rIBbRUm.exe
  2⤵
  PID:5576
- C:\Windows\System\ihXFlSY.exe
  C:\Windows\System\ihXFlSY.exe
  2⤵
  PID:5604
- C:\Windows\System\mYmmqvy.exe
  C:\Windows\System\mYmmqvy.exe
  2⤵
  PID:5624
- C:\Windows\System\GtqHTIS.exe
  C:\Windows\System\GtqHTIS.exe
  2⤵
  PID:5652
- C:\Windows\System\mDeGcfG.exe
  C:\Windows\System\mDeGcfG.exe
  2⤵
  PID:5672
- C:\Windows\System\epeAVML.exe
  C:\Windows\System\epeAVML.exe
  2⤵
  PID:5716
- C:\Windows\System\bAUSgAu.exe
  C:\Windows\System\bAUSgAu.exe
  2⤵
  PID:5740
- C:\Windows\System\NiZvfCH.exe
  C:\Windows\System\NiZvfCH.exe
  2⤵
  PID:5796
- C:\Windows\System\AywHvkY.exe
  C:\Windows\System\AywHvkY.exe
  2⤵
  PID:5828
- C:\Windows\System\dLuEfPt.exe
  C:\Windows\System\dLuEfPt.exe
  2⤵
  PID:5848
- C:\Windows\System\HFLeitR.exe
  C:\Windows\System\HFLeitR.exe
  2⤵
  PID:5928
- C:\Windows\System\XqDZTIu.exe
  C:\Windows\System\XqDZTIu.exe
  2⤵
  PID:5960
- C:\Windows\System\AFCCCuR.exe
  C:\Windows\System\AFCCCuR.exe
  2⤵
  PID:5976
- C:\Windows\System\cvKWEpE.exe
  C:\Windows\System\cvKWEpE.exe
  2⤵
  PID:5996
- C:\Windows\System\pAMyaLU.exe
  C:\Windows\System\pAMyaLU.exe
  2⤵
  PID:6016
- C:\Windows\System\FYAwGaI.exe
  C:\Windows\System\FYAwGaI.exe
  2⤵
  PID:6040
- C:\Windows\System\chIpjBE.exe
  C:\Windows\System\chIpjBE.exe
  2⤵
  PID:6056
- C:\Windows\System\xkJrfPs.exe
  C:\Windows\System\xkJrfPs.exe
  2⤵
  PID:6080
- C:\Windows\System\XJDCEjK.exe
  C:\Windows\System\XJDCEjK.exe
  2⤵
  PID:6104
- C:\Windows\System\UfWjZAk.exe
  C:\Windows\System\UfWjZAk.exe
  2⤵
  PID:6136
- C:\Windows\System\ndwoKoW.exe
  C:\Windows\System\ndwoKoW.exe
  2⤵
  PID:4996
- C:\Windows\System\DvVTHqC.exe
  C:\Windows\System\DvVTHqC.exe
  2⤵
  PID:4464
- C:\Windows\System\MNoPYRO.exe
  C:\Windows\System\MNoPYRO.exe
  2⤵
  PID:1792
- C:\Windows\System\cgawppa.exe
  C:\Windows\System\cgawppa.exe
  2⤵
  PID:4796
- C:\Windows\System\Vuehapi.exe
  C:\Windows\System\Vuehapi.exe
  2⤵
  PID:3500
- C:\Windows\System\Oczrfoi.exe
  C:\Windows\System\Oczrfoi.exe
  2⤵
  PID:3800
- C:\Windows\System\EvGBysg.exe
  C:\Windows\System\EvGBysg.exe
  2⤵
  PID:1528
- C:\Windows\System\xpapKhi.exe
  C:\Windows\System\xpapKhi.exe
  2⤵
  PID:500
- C:\Windows\System\efFZmlT.exe
  C:\Windows\System\efFZmlT.exe
  2⤵
  PID:4980
- C:\Windows\System\DMbELiJ.exe
  C:\Windows\System\DMbELiJ.exe
  2⤵
  PID:4676
- C:\Windows\System\rSHCzzk.exe
  C:\Windows\System\rSHCzzk.exe
  2⤵
  PID:4772
- C:\Windows\System\KOVCIiO.exe
  C:\Windows\System\KOVCIiO.exe
  2⤵
  PID:3276
- C:\Windows\System\dHNucAz.exe
  C:\Windows\System\dHNucAz.exe
  2⤵
  PID:1096
- C:\Windows\System\rQvxjDs.exe
  C:\Windows\System\rQvxjDs.exe
  2⤵
  PID:5140
- C:\Windows\System\nPRbrAh.exe
  C:\Windows\System\nPRbrAh.exe
  2⤵
  PID:5216
- C:\Windows\System\QuSTuXF.exe
  C:\Windows\System\QuSTuXF.exe
  2⤵
  PID:5236
- C:\Windows\System\VqqqpGj.exe
  C:\Windows\System\VqqqpGj.exe
  2⤵
  PID:5616
- C:\Windows\System\qDAqImw.exe
  C:\Windows\System\qDAqImw.exe
  2⤵
  PID:5644
- C:\Windows\System\tUvOVod.exe
  C:\Windows\System\tUvOVod.exe
  2⤵
  PID:2680
- C:\Windows\System\DdHtNiV.exe
  C:\Windows\System\DdHtNiV.exe
  2⤵
  PID:3988
- C:\Windows\System\lKnhJak.exe
  C:\Windows\System\lKnhJak.exe
  2⤵
  PID:2172
- C:\Windows\System\rQkujOd.exe
  C:\Windows\System\rQkujOd.exe
  2⤵
  PID:5176
- C:\Windows\System\hSxnTmG.exe
  C:\Windows\System\hSxnTmG.exe
  2⤵
  PID:5200
- C:\Windows\System\fGPMPEe.exe
  C:\Windows\System\fGPMPEe.exe
  2⤵
  PID:5288
- C:\Windows\System\dUNVllf.exe
  C:\Windows\System\dUNVllf.exe
  2⤵
  PID:5312
- C:\Windows\System\lBWuXUz.exe
  C:\Windows\System\lBWuXUz.exe
  2⤵
  PID:5328
- C:\Windows\System\wvyXJGL.exe
  C:\Windows\System\wvyXJGL.exe
  2⤵
  PID:5400
- C:\Windows\System\jiBzeeb.exe
  C:\Windows\System\jiBzeeb.exe
  2⤵
  PID:5436
- C:\Windows\System\mZKcJGH.exe
  C:\Windows\System\mZKcJGH.exe
  2⤵
  PID:5484
- C:\Windows\System\OIJjmBR.exe
  C:\Windows\System\OIJjmBR.exe
  2⤵
  PID:5524
- C:\Windows\System\ENkdjxj.exe
  C:\Windows\System\ENkdjxj.exe
  2⤵
  PID:6068
- C:\Windows\System\OaDcSOp.exe
  C:\Windows\System\OaDcSOp.exe
  2⤵
  PID:6132
- C:\Windows\System\hMcZcjb.exe
  C:\Windows\System\hMcZcjb.exe
  2⤵
  PID:1348
- C:\Windows\System\VKESDJc.exe
  C:\Windows\System\VKESDJc.exe
  2⤵
  PID:5772
- C:\Windows\System\bDsDsRi.exe
  C:\Windows\System\bDsDsRi.exe
  2⤵
  PID:6160
- C:\Windows\System\XGBMnaa.exe
  C:\Windows\System\XGBMnaa.exe
  2⤵
  PID:6176
- C:\Windows\System\BonKxzo.exe
  C:\Windows\System\BonKxzo.exe
  2⤵
  PID:6200
- C:\Windows\System\BHICvKx.exe
  C:\Windows\System\BHICvKx.exe
  2⤵
  PID:6220
- C:\Windows\System\shdHfUP.exe
  C:\Windows\System\shdHfUP.exe
  2⤵
  PID:6236
- C:\Windows\System\OCJuBYp.exe
  C:\Windows\System\OCJuBYp.exe
  2⤵
  PID:6260
- C:\Windows\System\UIOYEUr.exe
  C:\Windows\System\UIOYEUr.exe
  2⤵
  PID:6292
- C:\Windows\System\nhxkone.exe
  C:\Windows\System\nhxkone.exe
  2⤵
  PID:6308
- C:\Windows\System\wBKumJB.exe
  C:\Windows\System\wBKumJB.exe
  2⤵
  PID:6348
- C:\Windows\System\BlgQgIo.exe
  C:\Windows\System\BlgQgIo.exe
  2⤵
  PID:6376
- C:\Windows\System\ybdqzls.exe
  C:\Windows\System\ybdqzls.exe
  2⤵
  PID:6392
- C:\Windows\System\QKZRyRv.exe
  C:\Windows\System\QKZRyRv.exe
  2⤵
  PID:6416
- C:\Windows\System\VstUpxK.exe
  C:\Windows\System\VstUpxK.exe
  2⤵
  PID:6444
- C:\Windows\System\IXNJMzY.exe
  C:\Windows\System\IXNJMzY.exe
  2⤵
  PID:6460
- C:\Windows\System\WnoXQse.exe
  C:\Windows\System\WnoXQse.exe
  2⤵
  PID:6484
- C:\Windows\System\UtmbxJR.exe
  C:\Windows\System\UtmbxJR.exe
  2⤵
  PID:6508
- C:\Windows\System\CqqHFZQ.exe
  C:\Windows\System\CqqHFZQ.exe
  2⤵
  PID:6544
- C:\Windows\System\jObBDbG.exe
  C:\Windows\System\jObBDbG.exe
  2⤵
  PID:6560
- C:\Windows\System\HhhLIyL.exe
  C:\Windows\System\HhhLIyL.exe
  2⤵
  PID:6584
- C:\Windows\System\upsJxwx.exe
  C:\Windows\System\upsJxwx.exe
  2⤵
  PID:6604
- C:\Windows\System\paafCcH.exe
  C:\Windows\System\paafCcH.exe
  2⤵
  PID:6624
- C:\Windows\System\swIpoxD.exe
  C:\Windows\System\swIpoxD.exe
  2⤵
  PID:6644
- C:\Windows\System\aGuMiqD.exe
  C:\Windows\System\aGuMiqD.exe
  2⤵
  PID:6664
- C:\Windows\System\qyaOCOm.exe
  C:\Windows\System\qyaOCOm.exe
  2⤵
  PID:6684
- C:\Windows\System\uwIPfXH.exe
  C:\Windows\System\uwIPfXH.exe
  2⤵
  PID:6712
- C:\Windows\System\uMsDUVV.exe
  C:\Windows\System\uMsDUVV.exe
  2⤵
  PID:6728
- C:\Windows\System\gjXKwAJ.exe
  C:\Windows\System\gjXKwAJ.exe
  2⤵
  PID:6752
- C:\Windows\System\UWRcVkS.exe
  C:\Windows\System\UWRcVkS.exe
  2⤵
  PID:6776
- C:\Windows\System\IVNPJSt.exe
  C:\Windows\System\IVNPJSt.exe
  2⤵
  PID:6796
- C:\Windows\System\LGGDjwY.exe
  C:\Windows\System\LGGDjwY.exe
  2⤵
  PID:6820
- C:\Windows\System\flEFqfV.exe
  C:\Windows\System\flEFqfV.exe
  2⤵
  PID:6840
- C:\Windows\System\fvUVyoo.exe
  C:\Windows\System\fvUVyoo.exe
  2⤵
  PID:6864
- C:\Windows\System\HOnWIvs.exe
  C:\Windows\System\HOnWIvs.exe
  2⤵
  PID:6884
- C:\Windows\System\vgObOtQ.exe
  C:\Windows\System\vgObOtQ.exe
  2⤵
  PID:6908
- C:\Windows\System\ErNEIAf.exe
  C:\Windows\System\ErNEIAf.exe
  2⤵
  PID:6928
- C:\Windows\System\oRtPnxp.exe
  C:\Windows\System\oRtPnxp.exe
  2⤵
  PID:6948
- C:\Windows\System\UwwOBDo.exe
  C:\Windows\System\UwwOBDo.exe
  2⤵
  PID:6972
- C:\Windows\System\pcEHMtU.exe
  C:\Windows\System\pcEHMtU.exe
  2⤵
  PID:6996
- C:\Windows\System\gXNdBmu.exe
  C:\Windows\System\gXNdBmu.exe
  2⤵
  PID:7016
- C:\Windows\System\UNECODS.exe
  C:\Windows\System\UNECODS.exe
  2⤵
  PID:7040
- C:\Windows\System\JkoHBhB.exe
  C:\Windows\System\JkoHBhB.exe
  2⤵
  PID:7056
- C:\Windows\System\XzrRzHu.exe
  C:\Windows\System\XzrRzHu.exe
  2⤵
  PID:7088
- C:\Windows\System\NuJBVOx.exe
  C:\Windows\System\NuJBVOx.exe
  2⤵
  PID:7112
- C:\Windows\System\adHldlv.exe
  C:\Windows\System\adHldlv.exe
  2⤵
  PID:7128
- C:\Windows\System\QMwGovB.exe
  C:\Windows\System\QMwGovB.exe
  2⤵
  PID:7156
- C:\Windows\System\mSKTDtm.exe
  C:\Windows\System\mSKTDtm.exe
  2⤵
  PID:6124
- C:\Windows\System\PrxMMpt.exe
  C:\Windows\System\PrxMMpt.exe
  2⤵
  PID:2332
- C:\Windows\System\PdCTdlU.exe
  C:\Windows\System\PdCTdlU.exe
  2⤵
  PID:5572
- C:\Windows\System\wqEZnGm.exe
  C:\Windows\System\wqEZnGm.exe
  2⤵
  PID:5972
- C:\Windows\System\FkQHGcb.exe
  C:\Windows\System\FkQHGcb.exe
  2⤵
  PID:3340
- C:\Windows\System\vvigZgV.exe
  C:\Windows\System\vvigZgV.exe
  2⤵
  PID:5144
- C:\Windows\System\icvFwNL.exe
  C:\Windows\System\icvFwNL.exe
  2⤵
  PID:7104
- C:\Windows\System\rVRuQQc.exe
  C:\Windows\System\rVRuQQc.exe
  2⤵
  PID:5588
- C:\Windows\System\xHIBDun.exe
  C:\Windows\System\xHIBDun.exe
  2⤵
  PID:7172
- C:\Windows\System\ogPCzhR.exe
  C:\Windows\System\ogPCzhR.exe
  2⤵
  PID:7192
- C:\Windows\System\QYaTQvu.exe
  C:\Windows\System\QYaTQvu.exe
  2⤵
  PID:7212
- C:\Windows\System\fHaiKEc.exe
  C:\Windows\System\fHaiKEc.exe
  2⤵
  PID:7228
- C:\Windows\System\yTaLPTe.exe
  C:\Windows\System\yTaLPTe.exe
  2⤵
  PID:7248
- C:\Windows\System\TTlHwmh.exe
  C:\Windows\System\TTlHwmh.exe
  2⤵
  PID:7268
- C:\Windows\System\phAISXm.exe
  C:\Windows\System\phAISXm.exe
  2⤵
  PID:7284
- C:\Windows\System\iFSjTiX.exe
  C:\Windows\System\iFSjTiX.exe
  2⤵
  PID:7300
- C:\Windows\System\kHpzYRo.exe
  C:\Windows\System\kHpzYRo.exe
  2⤵
  PID:7316
- C:\Windows\System\rYYnwoj.exe
  C:\Windows\System\rYYnwoj.exe
  2⤵
  PID:7332
- C:\Windows\System\tIhLafx.exe
  C:\Windows\System\tIhLafx.exe
  2⤵
  PID:7348
- C:\Windows\System\KvSlxoB.exe
  C:\Windows\System\KvSlxoB.exe
  2⤵
  PID:7364
- C:\Windows\System\OyFXKSj.exe
  C:\Windows\System\OyFXKSj.exe
  2⤵
  PID:7384
- C:\Windows\System\kzgjHpI.exe
  C:\Windows\System\kzgjHpI.exe
  2⤵
  PID:7400
- C:\Windows\System\qRznLlG.exe
  C:\Windows\System\qRznLlG.exe
  2⤵
  PID:7420
- C:\Windows\System\QcdezxR.exe
  C:\Windows\System\QcdezxR.exe
  2⤵
  PID:7436
- C:\Windows\System\rpvEdBw.exe
  C:\Windows\System\rpvEdBw.exe
  2⤵
  PID:7452
- C:\Windows\System\WjcABdZ.exe
  C:\Windows\System\WjcABdZ.exe
  2⤵
  PID:7468
- C:\Windows\System\uWBOBgT.exe
  C:\Windows\System\uWBOBgT.exe
  2⤵
  PID:7496
- C:\Windows\System\zpIxnsw.exe
  C:\Windows\System\zpIxnsw.exe
  2⤵
  PID:7512
- C:\Windows\System\BKvdCDp.exe
  C:\Windows\System\BKvdCDp.exe
  2⤵
  PID:7564
- C:\Windows\System\oyNhyFf.exe
  C:\Windows\System\oyNhyFf.exe
  2⤵
  PID:7584
- C:\Windows\System\fyvJVEV.exe
  C:\Windows\System\fyvJVEV.exe
  2⤵
  PID:7616
- C:\Windows\System\PhUbNZj.exe
  C:\Windows\System\PhUbNZj.exe
  2⤵
  PID:7640
- C:\Windows\System\lYKwVkH.exe
  C:\Windows\System\lYKwVkH.exe
  2⤵
  PID:7664
- C:\Windows\System\qokPyKr.exe
  C:\Windows\System\qokPyKr.exe
  2⤵
  PID:7688
- C:\Windows\System\wRVySXc.exe
  C:\Windows\System\wRVySXc.exe
  2⤵
  PID:7712
- C:\Windows\System\xzqaxOB.exe
  C:\Windows\System\xzqaxOB.exe
  2⤵
  PID:7736
- C:\Windows\System\xwneJUA.exe
  C:\Windows\System\xwneJUA.exe
  2⤵
  PID:7752
- C:\Windows\System\YYVYdbD.exe
  C:\Windows\System\YYVYdbD.exe
  2⤵
  PID:7776
- C:\Windows\System\HeMWItI.exe
  C:\Windows\System\HeMWItI.exe
  2⤵
  PID:7836
- C:\Windows\System\KjUwzCc.exe
  C:\Windows\System\KjUwzCc.exe
  2⤵
  PID:7856
- C:\Windows\System\zFVrmvq.exe
  C:\Windows\System\zFVrmvq.exe
  2⤵
  PID:7876
- C:\Windows\System\ZhiJIqQ.exe
  C:\Windows\System\ZhiJIqQ.exe
  2⤵
  PID:7900
- C:\Windows\System\SSizVtL.exe
  C:\Windows\System\SSizVtL.exe
  2⤵
  PID:7932
- C:\Windows\System\UxZgDuG.exe
  C:\Windows\System\UxZgDuG.exe
  2⤵
  PID:7952
- C:\Windows\System\QvPhYIK.exe
  C:\Windows\System\QvPhYIK.exe
  2⤵
  PID:7976
- C:\Windows\System\TVGxxlI.exe
  C:\Windows\System\TVGxxlI.exe
  2⤵
  PID:8000
- C:\Windows\System\kOqxWiD.exe
  C:\Windows\System\kOqxWiD.exe
  2⤵
  PID:8024
- C:\Windows\System\YtjCzQB.exe
  C:\Windows\System\YtjCzQB.exe
  2⤵
  PID:8044
- C:\Windows\System\hKdEJJW.exe
  C:\Windows\System\hKdEJJW.exe
  2⤵
  PID:8068
- C:\Windows\System\bulkhDH.exe
  C:\Windows\System\bulkhDH.exe
  2⤵
  PID:8084
- C:\Windows\System\abPJCRo.exe
  C:\Windows\System\abPJCRo.exe
  2⤵
  PID:8108
- C:\Windows\System\NlHATmb.exe
  C:\Windows\System\NlHATmb.exe
  2⤵
  PID:8136
- C:\Windows\System\ynIKuVd.exe
  C:\Windows\System\ynIKuVd.exe
  2⤵
  PID:6452
- C:\Windows\System\SUMAypC.exe
  C:\Windows\System\SUMAypC.exe
  2⤵
  PID:7180
- C:\Windows\System\gHEOuiU.exe
  C:\Windows\System\gHEOuiU.exe
  2⤵
  PID:4284
- C:\Windows\System\wdmYBjU.exe
  C:\Windows\System\wdmYBjU.exe
  2⤵
  PID:1428
- C:\Windows\System\MeKqCLg.exe
  C:\Windows\System\MeKqCLg.exe
  2⤵
  PID:7184
- C:\Windows\System\CgOZAPt.exe
  C:\Windows\System\CgOZAPt.exe
  2⤵
  PID:7240
- C:\Windows\System\IttsNKr.exe
  C:\Windows\System\IttsNKr.exe
  2⤵
  PID:5864
- C:\Windows\System\XZGzSPO.exe
  C:\Windows\System\XZGzSPO.exe
  2⤵
  PID:5292
- C:\Windows\System\pJPTQYV.exe
  C:\Windows\System\pJPTQYV.exe
  2⤵
  PID:8
- C:\Windows\System\IpFqWOK.exe
  C:\Windows\System\IpFqWOK.exe
  2⤵
  PID:7292
- C:\Windows\System\lsJJtcR.exe
  C:\Windows\System\lsJJtcR.exe
  2⤵
  PID:7340
- C:\Windows\System\ERqiGcf.exe
  C:\Windows\System\ERqiGcf.exe
  2⤵
  PID:7376
- C:\Windows\System\GhahJdQ.exe
  C:\Windows\System\GhahJdQ.exe
  2⤵
  PID:7444
- C:\Windows\System\GOyiNpX.exe
  C:\Windows\System\GOyiNpX.exe
  2⤵
  PID:7720
- C:\Windows\System\GXrMaCv.exe
  C:\Windows\System\GXrMaCv.exe
  2⤵
  PID:7796
- C:\Windows\System\gJnQUfI.exe
  C:\Windows\System\gJnQUfI.exe
  2⤵
  PID:7576
- C:\Windows\System\LWmQiVx.exe
  C:\Windows\System\LWmQiVx.exe
  2⤵
  PID:7748
- C:\Windows\System\UYEQfjZ.exe
  C:\Windows\System\UYEQfjZ.exe
  2⤵
  PID:7612
- C:\Windows\System\xtgEfgo.exe
  C:\Windows\System\xtgEfgo.exe
  2⤵
  PID:7680
- C:\Windows\System\jctqBhT.exe
  C:\Windows\System\jctqBhT.exe
  2⤵
  PID:7768
- C:\Windows\System\uxZjfNP.exe
  C:\Windows\System\uxZjfNP.exe
  2⤵
  PID:7864
- C:\Windows\System\bebLypa.exe
  C:\Windows\System\bebLypa.exe
  2⤵
  PID:7892
- C:\Windows\System\iItcSzf.exe
  C:\Windows\System\iItcSzf.exe
  2⤵
  PID:7948
- C:\Windows\System\gyUYJap.exe
  C:\Windows\System\gyUYJap.exe
  2⤵
  PID:6720
- C:\Windows\System\jHVzzYB.exe
  C:\Windows\System\jHVzzYB.exe
  2⤵
  PID:8020
- C:\Windows\System\AVsefUl.exe
  C:\Windows\System\AVsefUl.exe
  2⤵
  PID:8076
- C:\Windows\System\GBYYgxf.exe
  C:\Windows\System\GBYYgxf.exe
  2⤵
  PID:400
- C:\Windows\System\URfKfEs.exe
  C:\Windows\System\URfKfEs.exe
  2⤵
  PID:6736
- C:\Windows\System\hZfLflR.exe
  C:\Windows\System\hZfLflR.exe
  2⤵
  PID:3284
- C:\Windows\System\WCSkGmU.exe
  C:\Windows\System\WCSkGmU.exe
  2⤵
  PID:5096
- C:\Windows\System\zGaJOvM.exe
  C:\Windows\System\zGaJOvM.exe
  2⤵
  PID:1620
- C:\Windows\System\dpFzSGv.exe
  C:\Windows\System\dpFzSGv.exe
  2⤵
  PID:784
- C:\Windows\System\OwGgvPk.exe
  C:\Windows\System\OwGgvPk.exe
  2⤵
  PID:4860
- C:\Windows\System\NGoBBlh.exe
  C:\Windows\System\NGoBBlh.exe
  2⤵
  PID:3884
- C:\Windows\System\kAjXwsH.exe
  C:\Windows\System\kAjXwsH.exe
  2⤵
  PID:5076
- C:\Windows\System\XzBOPIN.exe
  C:\Windows\System\XzBOPIN.exe
  2⤵
  PID:7504
- C:\Windows\System\kwdkKYJ.exe
  C:\Windows\System\kwdkKYJ.exe
  2⤵
  PID:4612
- C:\Windows\System\IDkwxic.exe
  C:\Windows\System\IDkwxic.exe
  2⤵
  PID:3972
- C:\Windows\System\nnKpuYu.exe
  C:\Windows\System\nnKpuYu.exe
  2⤵
  PID:7592
- C:\Windows\System\AbTvbMG.exe
  C:\Windows\System\AbTvbMG.exe
  2⤵
  PID:7704
- C:\Windows\System\FeXsyvV.exe
  C:\Windows\System\FeXsyvV.exe
  2⤵
  PID:8172
- C:\Windows\System\IRtmJeA.exe
  C:\Windows\System\IRtmJeA.exe
  2⤵
  PID:8104
- C:\Windows\System\HIEIbXS.exe
  C:\Windows\System\HIEIbXS.exe
  2⤵
  PID:7784
- C:\Windows\System\EGLndfR.exe
  C:\Windows\System\EGLndfR.exe
  2⤵
  PID:8212
- C:\Windows\System\JqApzjc.exe
  C:\Windows\System\JqApzjc.exe
  2⤵
  PID:8236
- C:\Windows\System\zwCCCkH.exe
  C:\Windows\System\zwCCCkH.exe
  2⤵
  PID:8252
- C:\Windows\System\fRPqHvh.exe
  C:\Windows\System\fRPqHvh.exe
  2⤵
  PID:8276
- C:\Windows\System\ulUMjEO.exe
  C:\Windows\System\ulUMjEO.exe
  2⤵
  PID:8300
- C:\Windows\System\rdAHqWy.exe
  C:\Windows\System\rdAHqWy.exe
  2⤵
  PID:8320
- C:\Windows\System\wjWPLlV.exe
  C:\Windows\System\wjWPLlV.exe
  2⤵
  PID:8344
- C:\Windows\System\lRGaLWb.exe
  C:\Windows\System\lRGaLWb.exe
  2⤵
  PID:8364
- C:\Windows\System\RoxjoGe.exe
  C:\Windows\System\RoxjoGe.exe
  2⤵
  PID:8388
- C:\Windows\System\xbyVNgm.exe
  C:\Windows\System\xbyVNgm.exe
  2⤵
  PID:8408
- C:\Windows\System\JSNxVGm.exe
  C:\Windows\System\JSNxVGm.exe
  2⤵
  PID:8432
- C:\Windows\System\NuZOVnZ.exe
  C:\Windows\System\NuZOVnZ.exe
  2⤵
  PID:8456
- C:\Windows\System\HpDjGus.exe
  C:\Windows\System\HpDjGus.exe
  2⤵
  PID:8480
- C:\Windows\System\eYayvvH.exe
  C:\Windows\System\eYayvvH.exe
  2⤵
  PID:8500
- C:\Windows\System\ZUQdawx.exe
  C:\Windows\System\ZUQdawx.exe
  2⤵
  PID:8520
- C:\Windows\System\VVlgFEP.exe
  C:\Windows\System\VVlgFEP.exe
  2⤵
  PID:8556
- C:\Windows\System\KVUuKcr.exe
  C:\Windows\System\KVUuKcr.exe
  2⤵
  PID:8576
- C:\Windows\System\lVZjIpp.exe
  C:\Windows\System\lVZjIpp.exe
  2⤵
  PID:8596
- C:\Windows\System\ltoLqHt.exe
  C:\Windows\System\ltoLqHt.exe
  2⤵
  PID:8620
- C:\Windows\System\gfCafcp.exe
  C:\Windows\System\gfCafcp.exe
  2⤵
  PID:8636
- C:\Windows\System\JeFBhYB.exe
  C:\Windows\System\JeFBhYB.exe
  2⤵
  PID:8652
- C:\Windows\System\eognVGS.exe
  C:\Windows\System\eognVGS.exe
  2⤵
  PID:8672
- C:\Windows\System\LVywpkm.exe
  C:\Windows\System\LVywpkm.exe
  2⤵
  PID:8692
- C:\Windows\System\sotEzvv.exe
  C:\Windows\System\sotEzvv.exe
  2⤵
  PID:8712
- C:\Windows\System\WqUXtJv.exe
  C:\Windows\System\WqUXtJv.exe
  2⤵
  PID:8740
- C:\Windows\System\WNEWNPO.exe
  C:\Windows\System\WNEWNPO.exe
  2⤵
  PID:8768
- C:\Windows\System\ZkZYEIX.exe
  C:\Windows\System\ZkZYEIX.exe
  2⤵
  PID:8784
- C:\Windows\System\XmdIZrj.exe
  C:\Windows\System\XmdIZrj.exe
  2⤵
  PID:8804
- C:\Windows\System\epiLhUO.exe
  C:\Windows\System\epiLhUO.exe
  2⤵
  PID:8824
- C:\Windows\System\kxEQIiv.exe
  C:\Windows\System\kxEQIiv.exe
  2⤵
  PID:8848
- C:\Windows\System\CxgrXBv.exe
  C:\Windows\System\CxgrXBv.exe
  2⤵
  PID:8872
- C:\Windows\System\xZMnlri.exe
  C:\Windows\System\xZMnlri.exe
  2⤵
  PID:8896
- C:\Windows\System\eetHJDy.exe
  C:\Windows\System\eetHJDy.exe
  2⤵
  PID:8920
- C:\Windows\System\RFtkjPv.exe
  C:\Windows\System\RFtkjPv.exe
  2⤵
  PID:8936
- C:\Windows\System\ufkqdNN.exe
  C:\Windows\System\ufkqdNN.exe
  2⤵
  PID:8964
- C:\Windows\System\ZBzPjGu.exe
  C:\Windows\System\ZBzPjGu.exe
  2⤵
  PID:8984
- C:\Windows\System\tDYKoZR.exe
  C:\Windows\System\tDYKoZR.exe
  2⤵
  PID:9004
- C:\Windows\System\CRaIwHX.exe
  C:\Windows\System\CRaIwHX.exe
  2⤵
  PID:9036
- C:\Windows\System\XNyxVpy.exe
  C:\Windows\System\XNyxVpy.exe
  2⤵
  PID:9052
- C:\Windows\System\dqelRHJ.exe
  C:\Windows\System\dqelRHJ.exe
  2⤵
  PID:9076
- C:\Windows\System\RsRDSQg.exe
  C:\Windows\System\RsRDSQg.exe
  2⤵
  PID:9100
- C:\Windows\System\uDhqMTw.exe
  C:\Windows\System\uDhqMTw.exe
  2⤵
  PID:9120
- C:\Windows\System\DuIDtNn.exe
  C:\Windows\System\DuIDtNn.exe
  2⤵
  PID:9140
- C:\Windows\System\WIxTAqm.exe
  C:\Windows\System\WIxTAqm.exe
  2⤵
  PID:9160
- C:\Windows\System\dnfdTMZ.exe
  C:\Windows\System\dnfdTMZ.exe
  2⤵
  PID:9180
- C:\Windows\System\vReuRBA.exe
  C:\Windows\System\vReuRBA.exe
  2⤵
  PID:9200
- C:\Windows\System\HAObLYC.exe
  C:\Windows\System\HAObLYC.exe
  2⤵
  PID:7460
- C:\Windows\System\HiuTFzL.exe
  C:\Windows\System\HiuTFzL.exe
  2⤵
  PID:7224
- C:\Windows\System\nJRWwdv.exe
  C:\Windows\System\nJRWwdv.exe
  2⤵
  PID:7684
- C:\Windows\System\hDQkWsX.exe
  C:\Windows\System\hDQkWsX.exe
  2⤵
  PID:3044
- C:\Windows\System\KXORioL.exe
  C:\Windows\System\KXORioL.exe
  2⤵
  PID:5956
- C:\Windows\System\EMuofNI.exe
  C:\Windows\System\EMuofNI.exe
  2⤵
  PID:7328
- C:\Windows\System\lmScJJM.exe
  C:\Windows\System\lmScJJM.exe
  2⤵
  PID:7580
- C:\Windows\System\WQMZnvx.exe
  C:\Windows\System\WQMZnvx.exe
  2⤵
  PID:8260
- C:\Windows\System\xZAhAjV.exe
  C:\Windows\System\xZAhAjV.exe
  2⤵
  PID:4000
- C:\Windows\System\aGgLxjU.exe
  C:\Windows\System\aGgLxjU.exe
  2⤵
  PID:7872
- C:\Windows\System\ovQMkCC.exe
  C:\Windows\System\ovQMkCC.exe
  2⤵
  PID:3196
- C:\Windows\System\HfGMjJY.exe
  C:\Windows\System\HfGMjJY.exe
  2⤵
  PID:7204
- C:\Windows\System\DOymTPe.exe
  C:\Windows\System\DOymTPe.exe
  2⤵
  PID:7944
- C:\Windows\System\PnGhUTm.exe
  C:\Windows\System\PnGhUTm.exe
  2⤵
  PID:8572
- C:\Windows\System\ZzgPlUQ.exe
  C:\Windows\System\ZzgPlUQ.exe
  2⤵
  PID:8648
- C:\Windows\System\SzNzNGy.exe
  C:\Windows\System\SzNzNGy.exe
  2⤵
  PID:8708
- C:\Windows\System\Kwcgtan.exe
  C:\Windows\System\Kwcgtan.exe
  2⤵
  PID:8756
- C:\Windows\System\TAGKXmo.exe
  C:\Windows\System\TAGKXmo.exe
  2⤵
  PID:3844
- C:\Windows\System\sPdRKoK.exe
  C:\Windows\System\sPdRKoK.exe
  2⤵
  PID:8816
- C:\Windows\System\jkhGZdi.exe
  C:\Windows\System\jkhGZdi.exe
  2⤵
  PID:4768
- C:\Windows\System\NrZIpWz.exe
  C:\Windows\System\NrZIpWz.exe
  2⤵
  PID:7708
- C:\Windows\System\MhqEtKv.exe
  C:\Windows\System\MhqEtKv.exe
  2⤵
  PID:8972
- C:\Windows\System\vCrajtv.exe
  C:\Windows\System\vCrajtv.exe
  2⤵
  PID:9224
- C:\Windows\System\TDfOaTE.exe
  C:\Windows\System\TDfOaTE.exe
  2⤵
  PID:9248
- C:\Windows\System\veSPRCB.exe
  C:\Windows\System\veSPRCB.exe
  2⤵
  PID:9272
- C:\Windows\System\DCVJEXB.exe
  C:\Windows\System\DCVJEXB.exe
  2⤵
  PID:9296
- C:\Windows\System\jirbaMK.exe
  C:\Windows\System\jirbaMK.exe
  2⤵
  PID:9316
- C:\Windows\System\KVyNQLI.exe
  C:\Windows\System\KVyNQLI.exe
  2⤵
  PID:9340
- C:\Windows\System\RNdIJib.exe
  C:\Windows\System\RNdIJib.exe
  2⤵
  PID:9364
- C:\Windows\System\imYRlTU.exe
  C:\Windows\System\imYRlTU.exe
  2⤵
  PID:9384
- C:\Windows\System\GLUqzeG.exe
  C:\Windows\System\GLUqzeG.exe
  2⤵
  PID:9408
- C:\Windows\System\qjceFbn.exe
  C:\Windows\System\qjceFbn.exe
  2⤵
  PID:9428
- C:\Windows\System\ZiWmAhz.exe
  C:\Windows\System\ZiWmAhz.exe
  2⤵
  PID:9452
- C:\Windows\System\yxejXGb.exe
  C:\Windows\System\yxejXGb.exe
  2⤵
  PID:9476
- C:\Windows\System\XxRSpOH.exe
  C:\Windows\System\XxRSpOH.exe
  2⤵
  PID:9496
- C:\Windows\System\YFUnkbS.exe
  C:\Windows\System\YFUnkbS.exe
  2⤵
  PID:9520
- C:\Windows\System\LToJWrP.exe
  C:\Windows\System\LToJWrP.exe
  2⤵
  PID:9540
- C:\Windows\System\QnonsFo.exe
  C:\Windows\System\QnonsFo.exe
  2⤵
  PID:9560
- C:\Windows\System\FZVKJXC.exe
  C:\Windows\System\FZVKJXC.exe
  2⤵
  PID:9584
- C:\Windows\System\mPaPmza.exe
  C:\Windows\System\mPaPmza.exe
  2⤵
  PID:9608
- C:\Windows\System\HrkGIZA.exe
  C:\Windows\System\HrkGIZA.exe
  2⤵
  PID:9632
- C:\Windows\System\oGwQONi.exe
  C:\Windows\System\oGwQONi.exe
  2⤵
  PID:9652
- C:\Windows\System\HcFLiGv.exe
  C:\Windows\System\HcFLiGv.exe
  2⤵
  PID:9668
- C:\Windows\System\LwhnEmm.exe
  C:\Windows\System\LwhnEmm.exe
  2⤵
  PID:9684
- C:\Windows\System\EpaaIqV.exe
  C:\Windows\System\EpaaIqV.exe
  2⤵
  PID:9700
- C:\Windows\System\wbdMtSE.exe
  C:\Windows\System\wbdMtSE.exe
  2⤵
  PID:9716
- C:\Windows\System\hGgxnSx.exe
  C:\Windows\System\hGgxnSx.exe
  2⤵
  PID:9732
- C:\Windows\System\zIrUCnF.exe
  C:\Windows\System\zIrUCnF.exe
  2⤵
  PID:9748
- C:\Windows\System\WQflGxz.exe
  C:\Windows\System\WQflGxz.exe
  2⤵
  PID:10204
- C:\Windows\System\RYtVqOv.exe
  C:\Windows\System\RYtVqOv.exe
  2⤵
  PID:9132
- C:\Windows\System\qbmBsNX.exe
  C:\Windows\System\qbmBsNX.exe
  2⤵
  PID:9196
- C:\Windows\System\HlIopcR.exe
  C:\Windows\System\HlIopcR.exe
  2⤵
  PID:8752
- C:\Windows\System\aeIWfRr.exe
  C:\Windows\System\aeIWfRr.exe
  2⤵
  PID:7280
- C:\Windows\System\VjTrxoU.exe
  C:\Windows\System\VjTrxoU.exe
  2⤵
  PID:8372
- C:\Windows\System\OfuIJat.exe
  C:\Windows\System\OfuIJat.exe
  2⤵
  PID:8380
- C:\Windows\System\eHYXVcd.exe
  C:\Windows\System\eHYXVcd.exe
  2⤵
  PID:7628
- C:\Windows\System\VCgPPoY.exe
  C:\Windows\System\VCgPPoY.exe
  2⤵
  PID:8800
- C:\Windows\System\uQSaZmx.exe
  C:\Windows\System\uQSaZmx.exe
  2⤵
  PID:8552
- C:\Windows\System\DngKwRH.exe
  C:\Windows\System\DngKwRH.exe
  2⤵
  PID:8628
- C:\Windows\System\oeNbePr.exe
  C:\Windows\System\oeNbePr.exe
  2⤵
  PID:9424
- C:\Windows\System\jYDKaqY.exe
  C:\Windows\System\jYDKaqY.exe
  2⤵
  PID:5516
- C:\Windows\System\hQzrKCf.exe
  C:\Windows\System\hQzrKCf.exe
  2⤵
  PID:8268
- C:\Windows\System\KJEmzRg.exe
  C:\Windows\System\KJEmzRg.exe
  2⤵
  PID:8908
- C:\Windows\System\BxYbOLe.exe
  C:\Windows\System\BxYbOLe.exe
  2⤵
  PID:9812
- C:\Windows\System\hOEUTOt.exe
  C:\Windows\System\hOEUTOt.exe
  2⤵
  PID:1432
- C:\Windows\System\AaJtwBD.exe
  C:\Windows\System\AaJtwBD.exe
  2⤵
  PID:9060
- C:\Windows\System\GVJrNUH.exe
  C:\Windows\System\GVJrNUH.exe
  2⤵
  PID:9268
- C:\Windows\System\HRIqOhy.exe
  C:\Windows\System\HRIqOhy.exe
  2⤵
  PID:9352
- C:\Windows\System\qiDApiH.exe
  C:\Windows\System\qiDApiH.exe
  2⤵
  PID:9156
- C:\Windows\System\LeukBBm.exe
  C:\Windows\System\LeukBBm.exe
  2⤵
  PID:9448
- C:\Windows\System\lQVoePS.exe
  C:\Windows\System\lQVoePS.exe
  2⤵
  PID:4588
- C:\Windows\System\HakhOot.exe
  C:\Windows\System\HakhOot.exe
  2⤵
  PID:9580
- C:\Windows\System\AZolErd.exe
  C:\Windows\System\AZolErd.exe
  2⤵
  PID:9712
- C:\Windows\System\RFAZIzc.exe
  C:\Windows\System\RFAZIzc.exe
  2⤵
  PID:9840
- C:\Windows\System\sWjnpxt.exe
  C:\Windows\System\sWjnpxt.exe
  2⤵
  PID:10092
- C:\Windows\System\hCfCkNk.exe
  C:\Windows\System\hCfCkNk.exe
  2⤵
  PID:10252
- C:\Windows\System\ruRwngT.exe
  C:\Windows\System\ruRwngT.exe
  2⤵
  PID:10272
- C:\Windows\System\JceKLfo.exe
  C:\Windows\System\JceKLfo.exe
  2⤵
  PID:10288
- C:\Windows\System\XZDonEi.exe
  C:\Windows\System\XZDonEi.exe
  2⤵
  PID:10308
- C:\Windows\System\AjBEfhi.exe
  C:\Windows\System\AjBEfhi.exe
  2⤵
  PID:10324
- C:\Windows\System\ggrrugX.exe
  C:\Windows\System\ggrrugX.exe
  2⤵
  PID:10340
- C:\Windows\System\AXGjehx.exe
  C:\Windows\System\AXGjehx.exe
  2⤵
  PID:10360
- C:\Windows\System\GxCvsGr.exe
  C:\Windows\System\GxCvsGr.exe
  2⤵
  PID:10380
- C:\Windows\System\QmNYsYS.exe
  C:\Windows\System\QmNYsYS.exe
  2⤵
  PID:10424
- C:\Windows\System\gTatTYe.exe
  C:\Windows\System\gTatTYe.exe
  2⤵
  PID:10448
- C:\Windows\System\kxceAro.exe
  C:\Windows\System\kxceAro.exe
  2⤵
  PID:10472
- C:\Windows\System\QxkHuHj.exe
  C:\Windows\System\QxkHuHj.exe
  2⤵
  PID:10504
- C:\Windows\System\rQgRwpR.exe
  C:\Windows\System\rQgRwpR.exe
  2⤵
  PID:10520
- C:\Windows\System\xpVUQcK.exe
  C:\Windows\System\xpVUQcK.exe
  2⤵
  PID:10552
- C:\Windows\System\CCisIZn.exe
  C:\Windows\System\CCisIZn.exe
  2⤵
  PID:10576
- C:\Windows\System\ETnQhoP.exe
  C:\Windows\System\ETnQhoP.exe
  2⤵
  PID:10596
- C:\Windows\System\qcWSocA.exe
  C:\Windows\System\qcWSocA.exe
  2⤵
  PID:10620
- C:\Windows\System\GubvEDv.exe
  C:\Windows\System\GubvEDv.exe
  2⤵
  PID:10644
- C:\Windows\System\fyLmakN.exe
  C:\Windows\System\fyLmakN.exe
  2⤵
  PID:10676
- C:\Windows\System\urxcnCg.exe
  C:\Windows\System\urxcnCg.exe
  2⤵
  PID:10700
- C:\Windows\System\tYXOxmT.exe
  C:\Windows\System\tYXOxmT.exe
  2⤵
  PID:10724
- C:\Windows\System\UFctPgy.exe
  C:\Windows\System\UFctPgy.exe
  2⤵
  PID:10740
- C:\Windows\System\UEcdkUj.exe
  C:\Windows\System\UEcdkUj.exe
  2⤵
  PID:10764
- C:\Windows\System\DFFsBOg.exe
  C:\Windows\System\DFFsBOg.exe
  2⤵
  PID:10784
- C:\Windows\System\qZybYzA.exe
  C:\Windows\System\qZybYzA.exe
  2⤵
  PID:10816
- C:\Windows\System\prnCMXs.exe
  C:\Windows\System\prnCMXs.exe
  2⤵
  PID:10832
- C:\Windows\System\vbuSaxN.exe
  C:\Windows\System\vbuSaxN.exe
  2⤵
  PID:10864
- C:\Windows\System\yuuVUyL.exe
  C:\Windows\System\yuuVUyL.exe
  2⤵
  PID:10880
- C:\Windows\System\rcNPCXi.exe
  C:\Windows\System\rcNPCXi.exe
  2⤵
  PID:10900
- C:\Windows\System\tIhGUkE.exe
  C:\Windows\System\tIhGUkE.exe
  2⤵
  PID:10924
- C:\Windows\System\VjUktqU.exe
  C:\Windows\System\VjUktqU.exe
  2⤵
  PID:10952
- C:\Windows\System\ahiUAUh.exe
  C:\Windows\System\ahiUAUh.exe
  2⤵
  PID:10968
- C:\Windows\System\uApJkuX.exe
  C:\Windows\System\uApJkuX.exe
  2⤵
  PID:10996
- C:\Windows\System\MRUbWTq.exe
  C:\Windows\System\MRUbWTq.exe
  2⤵
  PID:11016
- C:\Windows\System\IcZWacq.exe
  C:\Windows\System\IcZWacq.exe
  2⤵
  PID:11044
- C:\Windows\System\FZHvEMB.exe
  C:\Windows\System\FZHvEMB.exe
  2⤵
  PID:11064
- C:\Windows\System\jwTjrtf.exe
  C:\Windows\System\jwTjrtf.exe
  2⤵
  PID:11084
- C:\Windows\System\sAGpJgU.exe
  C:\Windows\System\sAGpJgU.exe
  2⤵
  PID:11104
- C:\Windows\System\OxMNLuk.exe
  C:\Windows\System\OxMNLuk.exe
  2⤵
  PID:11120
- C:\Windows\System\uggwkAC.exe
  C:\Windows\System\uggwkAC.exe
  2⤵
  PID:11148
- C:\Windows\System\DtaRdGY.exe
  C:\Windows\System\DtaRdGY.exe
  2⤵
  PID:11168
- C:\Windows\System\fkyNMtY.exe
  C:\Windows\System\fkyNMtY.exe
  2⤵
  PID:11192
- C:\Windows\System\JdTloEf.exe
  C:\Windows\System\JdTloEf.exe
  2⤵
  PID:11216
- C:\Windows\System\YpGcykl.exe
  C:\Windows\System\YpGcykl.exe
  2⤵
  PID:11236
- C:\Windows\System\GaDldmW.exe
  C:\Windows\System\GaDldmW.exe
  2⤵
  PID:11256
- C:\Windows\System\KEtHGOA.exe
  C:\Windows\System\KEtHGOA.exe
  2⤵
  PID:9348
- C:\Windows\System\McPCQCx.exe
  C:\Windows\System\McPCQCx.exe
  2⤵
  PID:10176
- C:\Windows\System\zHKhPMn.exe
  C:\Windows\System\zHKhPMn.exe
  2⤵
  PID:9232
- C:\Windows\System\IwdIoRf.exe
  C:\Windows\System\IwdIoRf.exe
  2⤵
  PID:4992
- C:\Windows\System\UwUHqKI.exe
  C:\Windows\System\UwUHqKI.exe
  2⤵
  PID:9660
- C:\Windows\System\vMucJVd.exe
  C:\Windows\System\vMucJVd.exe
  2⤵
  PID:9552
- C:\Windows\System\QOzdqgI.exe
  C:\Windows\System\QOzdqgI.exe
  2⤵
  PID:7940
- C:\Windows\System\jIgQChf.exe
  C:\Windows\System\jIgQChf.exe
  2⤵
  PID:9968
- C:\Windows\System\xZCrADi.exe
  C:\Windows\System\xZCrADi.exe
  2⤵
  PID:8608
- C:\Windows\System\egGfPMT.exe
  C:\Windows\System\egGfPMT.exe
  2⤵
  PID:9176
- C:\Windows\System\rBSuzxd.exe
  C:\Windows\System\rBSuzxd.exe
  2⤵
  PID:9680
- C:\Windows\System\UnByawg.exe
  C:\Windows\System\UnByawg.exe
  2⤵
  PID:9244
- C:\Windows\System\zbmHbYa.exe
  C:\Windows\System\zbmHbYa.exe
  2⤵
  PID:7260
- C:\Windows\System\qBiKTMh.exe
  C:\Windows\System\qBiKTMh.exe
  2⤵
  PID:9404
- C:\Windows\System\ygRPnCH.exe
  C:\Windows\System\ygRPnCH.exe
  2⤵
  PID:336
- C:\Windows\System\MWaMzVN.exe
  C:\Windows\System\MWaMzVN.exe
  2⤵
  PID:9744
- C:\Windows\System\lMfbkNM.exe
  C:\Windows\System\lMfbkNM.exe
  2⤵
  PID:2352
- C:\Windows\System\hfxjJSY.exe
  C:\Windows\System\hfxjJSY.exe
  2⤵
  PID:10316
- C:\Windows\System\fWJnnbO.exe
  C:\Windows\System\fWJnnbO.exe
  2⤵
  PID:10432
- C:\Windows\System\JBsUnGy.exe
  C:\Windows\System\JBsUnGy.exe
  2⤵
  PID:9920
- C:\Windows\System\jdqtrGR.exe
  C:\Windows\System\jdqtrGR.exe
  2⤵
  PID:7964
- C:\Windows\System\mFBkyhT.exe
  C:\Windows\System\mFBkyhT.exe
  2⤵
  PID:9532
- C:\Windows\System\NerXWQT.exe
  C:\Windows\System\NerXWQT.exe
  2⤵
  PID:9396
- C:\Windows\System\ilmlTtZ.exe
  C:\Windows\System\ilmlTtZ.exe
  2⤵
  PID:10736
- C:\Windows\System\wcZfvDt.exe
  C:\Windows\System\wcZfvDt.exe
  2⤵
  PID:8688
- C:\Windows\System\xjPLUIR.exe
  C:\Windows\System\xjPLUIR.exe
  2⤵
  PID:8868
- C:\Windows\System\baPLafP.exe
  C:\Windows\System\baPLafP.exe
  2⤵
  PID:10932
- C:\Windows\System\MwCQYiY.exe
  C:\Windows\System\MwCQYiY.exe
  2⤵
  PID:9028
- C:\Windows\System\HdUJYmJ.exe
  C:\Windows\System\HdUJYmJ.exe
  2⤵
  PID:488
- C:\Windows\System\XBpSzGy.exe
  C:\Windows\System\XBpSzGy.exe
  2⤵
  PID:11052
- C:\Windows\System\eCXDkRX.exe
  C:\Windows\System\eCXDkRX.exe
  2⤵
  PID:9088
- C:\Windows\System\Dzajhba.exe
  C:\Windows\System\Dzajhba.exe
  2⤵
  PID:9128
- C:\Windows\System\BZwKHdh.exe
  C:\Windows\System\BZwKHdh.exe
  2⤵
  PID:11232
- C:\Windows\System\CXkFKah.exe
  C:\Windows\System\CXkFKah.exe
  2⤵
  PID:11276
- C:\Windows\System\zVUaoOq.exe
  C:\Windows\System\zVUaoOq.exe
  2⤵
  PID:11300
- C:\Windows\System\YmughHF.exe
  C:\Windows\System\YmughHF.exe
  2⤵
  PID:11316
- C:\Windows\System\DyCQhTn.exe
  C:\Windows\System\DyCQhTn.exe
  2⤵
  PID:11336
- C:\Windows\System\xCFTEUk.exe
  C:\Windows\System\xCFTEUk.exe
  2⤵
  PID:11356
- C:\Windows\System\GJFFSKZ.exe
  C:\Windows\System\GJFFSKZ.exe
  2⤵
  PID:11380
- C:\Windows\System\mLDgcKj.exe
  C:\Windows\System\mLDgcKj.exe
  2⤵
  PID:11400
- C:\Windows\System\yzhIaeI.exe
  C:\Windows\System\yzhIaeI.exe
  2⤵
  PID:11420
- C:\Windows\System\DhgKIDr.exe
  C:\Windows\System\DhgKIDr.exe
  2⤵
  PID:11444
- C:\Windows\System\pWajdkz.exe
  C:\Windows\System\pWajdkz.exe
  2⤵
  PID:11464
- C:\Windows\System\OZgtVtV.exe
  C:\Windows\System\OZgtVtV.exe
  2⤵
  PID:11484
- C:\Windows\System\QxiCNbl.exe
  C:\Windows\System\QxiCNbl.exe
  2⤵
  PID:11508
- C:\Windows\System\ADPqAOf.exe
  C:\Windows\System\ADPqAOf.exe
  2⤵
  PID:11528
- C:\Windows\System\rKlAupo.exe
  C:\Windows\System\rKlAupo.exe
  2⤵
  PID:11548
- C:\Windows\System\VvNlwQK.exe
  C:\Windows\System\VvNlwQK.exe
  2⤵
  PID:11572
- C:\Windows\System\RJiqpSJ.exe
  C:\Windows\System\RJiqpSJ.exe
  2⤵
  PID:11592
- C:\Windows\System\jCmIesR.exe
  C:\Windows\System\jCmIesR.exe
  2⤵
  PID:11612
- C:\Windows\System\oXWCqhc.exe
  C:\Windows\System\oXWCqhc.exe
  2⤵
  PID:11632
- C:\Windows\System\TnSctJh.exe
  C:\Windows\System\TnSctJh.exe
  2⤵
  PID:11656
- C:\Windows\System\kzjMaAv.exe
  C:\Windows\System\kzjMaAv.exe
  2⤵
  PID:11680
- C:\Windows\System\eRAlEXu.exe
  C:\Windows\System\eRAlEXu.exe
  2⤵
  PID:11708
- C:\Windows\System\eLQkHDE.exe
  C:\Windows\System\eLQkHDE.exe
  2⤵
  PID:11732
- C:\Windows\System\wXJBvSx.exe
  C:\Windows\System\wXJBvSx.exe
  2⤵
  PID:11756
- C:\Windows\System\akoRsJn.exe
  C:\Windows\System\akoRsJn.exe
  2⤵
  PID:11780
- C:\Windows\System\MpgxORw.exe
  C:\Windows\System\MpgxORw.exe
  2⤵
  PID:11800
- C:\Windows\System\wStwZKC.exe
  C:\Windows\System\wStwZKC.exe
  2⤵
  PID:11824
- C:\Windows\System\WRgLtzE.exe
  C:\Windows\System\WRgLtzE.exe
  2⤵
  PID:11848
- C:\Windows\System\AblzIlp.exe
  C:\Windows\System\AblzIlp.exe
  2⤵
  PID:11868
- C:\Windows\System\XwmXwls.exe
  C:\Windows\System\XwmXwls.exe
  2⤵
  PID:11892
- C:\Windows\System\vtrjpmJ.exe
  C:\Windows\System\vtrjpmJ.exe
  2⤵
  PID:11912
- C:\Windows\System\TYIbjIW.exe
  C:\Windows\System\TYIbjIW.exe
  2⤵
  PID:11932
- C:\Windows\System\BpqDCqi.exe
  C:\Windows\System\BpqDCqi.exe
  2⤵
  PID:11956
- C:\Windows\System\uifRWho.exe
  C:\Windows\System\uifRWho.exe
  2⤵
  PID:11984
- C:\Windows\System\BCkeuZR.exe
  C:\Windows\System\BCkeuZR.exe
  2⤵
  PID:12004
- C:\Windows\System\QqAfPhd.exe
  C:\Windows\System\QqAfPhd.exe
  2⤵
  PID:12024
- C:\Windows\System\GfetMKI.exe
  C:\Windows\System\GfetMKI.exe
  2⤵
  PID:12044
- C:\Windows\System\rYQKpOk.exe
  C:\Windows\System\rYQKpOk.exe
  2⤵
  PID:12072
- C:\Windows\System\TRvgEeD.exe
  C:\Windows\System\TRvgEeD.exe
  2⤵
  PID:12096
- C:\Windows\System\uMJQcil.exe
  C:\Windows\System\uMJQcil.exe
  2⤵
  PID:12116
- C:\Windows\System\cgzjaxE.exe
  C:\Windows\System\cgzjaxE.exe
  2⤵
  PID:12140
- C:\Windows\System\poNLLCi.exe
  C:\Windows\System\poNLLCi.exe
  2⤵
  PID:12176
- C:\Windows\System\LeuFeBd.exe
  C:\Windows\System\LeuFeBd.exe
  2⤵
  PID:12192
- C:\Windows\System\blFOPNL.exe
  C:\Windows\System\blFOPNL.exe
  2⤵
  PID:12208
- C:\Windows\System\JCnwzzB.exe
  C:\Windows\System\JCnwzzB.exe
  2⤵
  PID:12228
- C:\Windows\System\SXdgNEq.exe
  C:\Windows\System\SXdgNEq.exe
  2⤵
  PID:12244
- C:\Windows\System\wDPFplQ.exe
  C:\Windows\System\wDPFplQ.exe
  2⤵
  PID:12264
- C:\Windows\System\yEGyziV.exe
  C:\Windows\System\yEGyziV.exe
  2⤵
  PID:9864
- C:\Windows\System\NcOGZaI.exe
  C:\Windows\System\NcOGZaI.exe
  2⤵
  PID:10296
- C:\Windows\System\NLvXmOX.exe
  C:\Windows\System\NLvXmOX.exe
  2⤵
  PID:10352
- C:\Windows\System\cioItCE.exe
  C:\Windows\System\cioItCE.exe
  2⤵
  PID:10212
- C:\Windows\System\UlkUKaB.exe
  C:\Windows\System\UlkUKaB.exe
  2⤵
  PID:10540
- C:\Windows\System\EmQsFny.exe
  C:\Windows\System\EmQsFny.exe
  2⤵
  PID:10592
- C:\Windows\System\yusMGiQ.exe
  C:\Windows\System\yusMGiQ.exe
  2⤵
  PID:10672
- C:\Windows\System\oYgJtwg.exe
  C:\Windows\System\oYgJtwg.exe
  2⤵
  PID:10756
- C:\Windows\System\VxZZORd.exe
  C:\Windows\System\VxZZORd.exe
  2⤵
  PID:8888
- C:\Windows\System\mDrItZN.exe
  C:\Windows\System\mDrItZN.exe
  2⤵
  PID:10808
- C:\Windows\System\jKuvQkR.exe
  C:\Windows\System\jKuvQkR.exe
  2⤵
  PID:10848
- C:\Windows\System\GAEkNGk.exe
  C:\Windows\System\GAEkNGk.exe
  2⤵
  PID:10936
- C:\Windows\System\KqaxoCU.exe
  C:\Windows\System\KqaxoCU.exe
  2⤵
  PID:11012
- C:\Windows\System\WCcBHso.exe
  C:\Windows\System\WCcBHso.exe
  2⤵
  PID:11060
- C:\Windows\System\cVivnHF.exe
  C:\Windows\System\cVivnHF.exe
  2⤵
  PID:11092
- C:\Windows\System\RVHWBzj.exe
  C:\Windows\System\RVHWBzj.exe
  2⤵
  PID:11112
- C:\Windows\System\FjKMkNO.exe
  C:\Windows\System\FjKMkNO.exe
  2⤵
  PID:9444
- C:\Windows\System\nMnZPAG.exe
  C:\Windows\System\nMnZPAG.exe
  2⤵
  PID:10020
- C:\Windows\System\yykCbgD.exe
  C:\Windows\System\yykCbgD.exe
  2⤵
  PID:2700
- C:\Windows\System\pfAtvmL.exe
  C:\Windows\System\pfAtvmL.exe
  2⤵
  PID:8844
- C:\Windows\System\UkRryQE.exe
  C:\Windows\System\UkRryQE.exe
  2⤵
  PID:12308
- C:\Windows\System\xrPJEEb.exe
  C:\Windows\System\xrPJEEb.exe
  2⤵
  PID:12336
- C:\Windows\System\buLaaiN.exe
  C:\Windows\System\buLaaiN.exe
  2⤵
  PID:12356
- C:\Windows\System\ThuhbuO.exe
  C:\Windows\System\ThuhbuO.exe
  2⤵
  PID:12380
- C:\Windows\System\PpSCyWS.exe
  C:\Windows\System\PpSCyWS.exe
  2⤵
  PID:12404
- C:\Windows\System\iuWsyhz.exe
  C:\Windows\System\iuWsyhz.exe
  2⤵
  PID:12424
- C:\Windows\System\mQlCGNq.exe
  C:\Windows\System\mQlCGNq.exe
  2⤵
  PID:12452
- C:\Windows\System\KGxzaMo.exe
  C:\Windows\System\KGxzaMo.exe
  2⤵
  PID:12472
- C:\Windows\System\YeewCNG.exe
  C:\Windows\System\YeewCNG.exe
  2⤵
  PID:12492
- C:\Windows\System\YlIZBnx.exe
  C:\Windows\System\YlIZBnx.exe
  2⤵
  PID:12516
- C:\Windows\System\cwQEbuX.exe
  C:\Windows\System\cwQEbuX.exe
  2⤵
  PID:12536
- C:\Windows\System\ZomiCYJ.exe
  C:\Windows\System\ZomiCYJ.exe
  2⤵
  PID:12560
- C:\Windows\System\rdrjlxl.exe
  C:\Windows\System\rdrjlxl.exe
  2⤵
  PID:12584
- C:\Windows\System\NHnXeFg.exe
  C:\Windows\System\NHnXeFg.exe
  2⤵
  PID:12604
- C:\Windows\System\CbduxJv.exe
  C:\Windows\System\CbduxJv.exe
  2⤵
  PID:12628
- C:\Windows\System\EZSWVkN.exe
  C:\Windows\System\EZSWVkN.exe
  2⤵
  PID:12652
- C:\Windows\System\svClWlp.exe
  C:\Windows\System\svClWlp.exe
  2⤵
  PID:12684
- C:\Windows\System\pHxbOCk.exe
  C:\Windows\System\pHxbOCk.exe
  2⤵
  PID:12708
- C:\Windows\System\qaavfjh.exe
  C:\Windows\System\qaavfjh.exe
  2⤵
  PID:11008
- C:\Windows\System\nCenBiq.exe
  C:\Windows\System\nCenBiq.exe
  2⤵
  PID:2336
- C:\Windows\System\BcTggmd.exe
  C:\Windows\System\BcTggmd.exe
  2⤵
  PID:4472
- C:\Windows\System\OhrJlsP.exe
  C:\Windows\System\OhrJlsP.exe
  2⤵
  PID:12860
- C:\Windows\System\fbkbAWE.exe
  C:\Windows\System\fbkbAWE.exe
  2⤵
  PID:12808
- C:\Windows\System\KYwPxGz.exe
  C:\Windows\System\KYwPxGz.exe
  2⤵
  PID:12160
- C:\Windows\System\BCCBZDY.exe
  C:\Windows\System\BCCBZDY.exe
  2⤵
  PID:12368
- C:\Windows\System\feRyThd.exe
  C:\Windows\System\feRyThd.exe
  2⤵
  PID:8060
- C:\Windows\System\ONuWIgW.exe
  C:\Windows\System\ONuWIgW.exe
  2⤵
  PID:9568
- C:\Windows\System\MsoQjRh.exe
  C:\Windows\System\MsoQjRh.exe
  2⤵
  PID:10780
- C:\Windows\System\VQHkNnt.exe
  C:\Windows\System\VQHkNnt.exe
  2⤵
  PID:9084
- C:\Windows\System\uYGllMJ.exe
  C:\Windows\System\uYGllMJ.exe
  2⤵
  PID:9592
- C:\Windows\System\QJziHAh.exe
  C:\Windows\System\QJziHAh.exe
  2⤵
  PID:12148
- C:\Windows\System\fnXuiRA.exe
  C:\Windows\System\fnXuiRA.exe
  2⤵
  PID:8612
- C:\Windows\System\UDMFIQC.exe
  C:\Windows\System\UDMFIQC.exe
  2⤵
  PID:11704
- C:\Windows\System\ANzRbVV.exe
  C:\Windows\System\ANzRbVV.exe
  2⤵
  PID:11496
- C:\Windows\System\nkGeyoY.exe
  C:\Windows\System\nkGeyoY.exe
  2⤵
  PID:2732
- C:\Windows\System\nNpwmzw.exe
  C:\Windows\System\nNpwmzw.exe
  2⤵
  PID:12920
- C:\Windows\System\Torwhts.exe
  C:\Windows\System\Torwhts.exe
  2⤵
  PID:844
- C:\Windows\System\OtcxKXL.exe
  C:\Windows\System\OtcxKXL.exe
  2⤵
  PID:13124
- C:\Windows\System\fKUXNQi.exe
  C:\Windows\System\fKUXNQi.exe
  2⤵
  PID:1916
- C:\Windows\System\yBJaMUp.exe
  C:\Windows\System\yBJaMUp.exe
  2⤵
  PID:10052
- C:\Windows\System\eGygJqp.exe
  C:\Windows\System\eGygJqp.exe
  2⤵
  PID:1204
- C:\Windows\System\alYvZZC.exe
  C:\Windows\System\alYvZZC.exe
  2⤵
  PID:13096
- C:\Windows\System\lLSlecp.exe
  C:\Windows\System\lLSlecp.exe
  2⤵
  PID:8448
- C:\Windows\System\LiZEowt.exe
  C:\Windows\System\LiZEowt.exe
  2⤵
  PID:2968
- C:\Windows\System\YteOmim.exe
  C:\Windows\System\YteOmim.exe
  2⤵
  PID:13236
- C:\Windows\System\bWobwZh.exe
  C:\Windows\System\bWobwZh.exe
  2⤵
  PID:11964
- C:\Windows\System\DzUxRRb.exe
  C:\Windows\System\DzUxRRb.exe
  2⤵
  PID:10896
- C:\Windows\System\lvBXFoq.exe
  C:\Windows\System\lvBXFoq.exe
  2⤵
  PID:3344
- C:\Windows\System\qttxuoX.exe
  C:\Windows\System\qttxuoX.exe
  2⤵
  PID:10708
- C:\Windows\System\MlykNjD.exe
  C:\Windows\System\MlykNjD.exe
  2⤵
  PID:4040
- C:\Windows\System\OnlwsAY.exe
  C:\Windows\System\OnlwsAY.exe
  2⤵
  PID:4072
- C:\Windows\System\ZjYibhv.exe
  C:\Windows\System\ZjYibhv.exe
  2⤵
  PID:4100
- C:\Windows\System\lpGzxMv.exe
  C:\Windows\System\lpGzxMv.exe
  2⤵
  PID:4176
- C:\Windows\System\Knwhjsz.exe
  C:\Windows\System\Knwhjsz.exe
  2⤵
  PID:11744
- C:\Windows\System\ExTHsyE.exe
  C:\Windows\System\ExTHsyE.exe
  2⤵
  PID:4272
- C:\Windows\System\nUhfiDB.exe
  C:\Windows\System\nUhfiDB.exe
  2⤵
  PID:12104
- C:\Windows\System\AmRSPds.exe
  C:\Windows\System\AmRSPds.exe
  2⤵
  PID:2240
- C:\Windows\System\xckHhZn.exe
  C:\Windows\System\xckHhZn.exe
  2⤵
  PID:12304
- C:\Windows\System\flnmmFr.exe
  C:\Windows\System\flnmmFr.exe
  2⤵
  PID:12488
- C:\Windows\System\lymxiQS.exe
  C:\Windows\System\lymxiQS.exe
  2⤵
  PID:12316
- C:\Windows\System\Qrtjfck.exe
  C:\Windows\System\Qrtjfck.exe
  2⤵
  PID:12704
- C:\Windows\System\PCMAYdv.exe
  C:\Windows\System\PCMAYdv.exe
  2⤵
  PID:11348
- C:\Windows\System\Swgiqbs.exe
  C:\Windows\System\Swgiqbs.exe
  2⤵
  PID:5560
- C:\Windows\System\iIxFdUH.exe
  C:\Windows\System\iIxFdUH.exe
  2⤵
  PID:2724
- C:\Windows\System\HNvOnvt.exe
  C:\Windows\System\HNvOnvt.exe
  2⤵
  PID:5776
- C:\Windows\System\iHhGPYc.exe
  C:\Windows\System\iHhGPYc.exe
  2⤵
  PID:3996
- C:\Windows\System\HFXhNIK.exe
  C:\Windows\System\HFXhNIK.exe
  2⤵
  PID:11668
- C:\Windows\System\vuUgcsx.exe
  C:\Windows\System\vuUgcsx.exe
  2⤵
  PID:2740
- C:\Windows\System\IMwRmOV.exe
  C:\Windows\System\IMwRmOV.exe
  2⤵
  PID:11832
- C:\Windows\System\vFVKkyp.exe
  C:\Windows\System\vFVKkyp.exe
  2⤵
  PID:6536
- C:\Windows\System\gXporny.exe
  C:\Windows\System\gXporny.exe
  2⤵
  PID:11268
- C:\Windows\System\venoAkP.exe
  C:\Windows\System\venoAkP.exe
  2⤵
  PID:12432
- C:\Windows\System\HmmFWwK.exe
  C:\Windows\System\HmmFWwK.exe
  2⤵
  PID:3812
- C:\Windows\System\fhrwkMo.exe
  C:\Windows\System\fhrwkMo.exe
  2⤵
  PID:13072
- C:\Windows\System\LWLHJvV.exe
  C:\Windows\System\LWLHJvV.exe
  2⤵
  PID:3580
- C:\Windows\System\rONgYMV.exe
  C:\Windows\System\rONgYMV.exe
  2⤵
  PID:3984
- C:\Windows\System\TRIEjmS.exe
  C:\Windows\System\TRIEjmS.exe
  2⤵
  PID:5044
- C:\Windows\System\rAffndr.exe
  C:\Windows\System\rAffndr.exe
  2⤵
  PID:3692
- C:\Windows\System\YIyBShf.exe
  C:\Windows\System\YIyBShf.exe
  2⤵
  PID:4112
- C:\Windows\System\YYfOcDz.exe
  C:\Windows\System\YYfOcDz.exe
  2⤵
  PID:12724
- C:\Windows\System\JWriedi.exe
  C:\Windows\System\JWriedi.exe
  2⤵
  PID:3252
- C:\Windows\System\cUsSwmS.exe
  C:\Windows\System\cUsSwmS.exe
  2⤵
  PID:12568
- C:\Windows\System\kaafYWb.exe
  C:\Windows\System\kaafYWb.exe
  2⤵
  PID:12528
- C:\Windows\System\bdeuOiV.exe
  C:\Windows\System\bdeuOiV.exe
  2⤵
  PID:3680
- C:\Windows\System\PcLRdiI.exe
  C:\Windows\System\PcLRdiI.exe
  2⤵
  PID:12184
- C:\Windows\System\yNMALfN.exe
  C:\Windows\System\yNMALfN.exe
  2⤵
  PID:12220
- C:\Windows\System\wRygQoF.exe
  C:\Windows\System\wRygQoF.exe
  2⤵
  PID:4092
- C:\Windows\System\aGOUids.exe
  C:\Windows\System\aGOUids.exe
  2⤵
  PID:3688
- C:\Windows\System\jLUytUY.exe
  C:\Windows\System\jLUytUY.exe
  2⤵
  PID:2868
- C:\Windows\System\QuTExBD.exe
  C:\Windows\System\QuTExBD.exe
  2⤵
  PID:3540
- C:\Windows\System\jNDnlqV.exe
  C:\Windows\System\jNDnlqV.exe
  2⤵
  PID:4812
- C:\Windows\System\mhpyMOy.exe
  C:\Windows\System\mhpyMOy.exe
  2⤵
  PID:6152
- C:\Windows\System\fgPrZgC.exe
  C:\Windows\System\fgPrZgC.exe
  2⤵
  PID:2372
- C:\Windows\System\CVezczc.exe
  C:\Windows\System\CVezczc.exe
  2⤵
  PID:3416
- C:\Windows\System\sTMSCkW.exe
  C:\Windows\System\sTMSCkW.exe
  2⤵
  PID:2620
- C:\Windows\System\mgndcys.exe
  C:\Windows\System\mgndcys.exe
  2⤵
  PID:4760
- C:\Windows\System\UMpHxXn.exe
  C:\Windows\System\UMpHxXn.exe
  2⤵
  PID:4552
- C:\Windows\System\GzBDZtF.exe
  C:\Windows\System\GzBDZtF.exe
  2⤵
  PID:2228
- C:\Windows\System\BtrDNkO.exe
  C:\Windows\System\BtrDNkO.exe
  2⤵
  PID:2360
- C:\Windows\System\vDUaMCo.exe
  C:\Windows\System\vDUaMCo.exe
  2⤵
  PID:3272
- C:\Windows\System\hYUdwGw.exe
  C:\Windows\System\hYUdwGw.exe
  2⤵
  PID:12928
- C:\Windows\System\ATWYEVM.exe
  C:\Windows\System\ATWYEVM.exe
  2⤵
  PID:4476
- C:\Windows\System\dImSEmz.exe
  C:\Windows\System\dImSEmz.exe
  2⤵
  PID:4304
- C:\Windows\System\TxUxyMw.exe
  C:\Windows\System\TxUxyMw.exe
  2⤵
  PID:10720
- C:\Windows\System\nQCkQbY.exe
  C:\Windows\System\nQCkQbY.exe
  2⤵
  PID:10516
- C:\Windows\System\llBMBOw.exe
  C:\Windows\System\llBMBOw.exe
  2⤵
  PID:7264
- C:\Windows\System\SGCfqhX.exe
  C:\Windows\System\SGCfqhX.exe
  2⤵
  PID:12840
- C:\Windows\System\MuxGyOo.exe
  C:\Windows\System\MuxGyOo.exe
  2⤵
  PID:2480
- C:\Windows\System\IYgKJvm.exe
  C:\Windows\System\IYgKJvm.exe
  2⤵
  PID:396
- C:\Windows\System\FExYrkF.exe
  C:\Windows\System\FExYrkF.exe
  2⤵
  PID:1908
- C:\Windows\System\cWWYvwA.exe
  C:\Windows\System\cWWYvwA.exe
  2⤵
  PID:4600
- C:\Windows\System\vnqZESR.exe
  C:\Windows\System\vnqZESR.exe
  2⤵
  PID:3852
- C:\Windows\System\LCtRGCO.exe
  C:\Windows\System\LCtRGCO.exe
  2⤵
  PID:13232
- C:\Windows\System\Anakais.exe
  C:\Windows\System\Anakais.exe
  2⤵
  PID:2508
- C:\Windows\System\sZPVcFd.exe
  C:\Windows\System\sZPVcFd.exe
  2⤵
  PID:2096
- C:\Windows\System\ciSBbxB.exe
  C:\Windows\System\ciSBbxB.exe
  2⤵
  PID:880
- C:\Windows\System\wOddxbC.exe
  C:\Windows\System\wOddxbC.exe
  2⤵
  PID:2568
- C:\Windows\System\ibAFgnm.exe
  C:\Windows\System\ibAFgnm.exe
  2⤵
  PID:3084
- C:\Windows\System\GGVWotv.exe
  C:\Windows\System\GGVWotv.exe
  2⤵
  PID:2548
- C:\Windows\System\NxPtAJV.exe
  C:\Windows\System\NxPtAJV.exe
  2⤵
  PID:4264
- C:\Windows\System\qXpMbXF.exe
  C:\Windows\System\qXpMbXF.exe
  2⤵
  PID:4632
- C:\Windows\System\vbRNHbN.exe
  C:\Windows\System\vbRNHbN.exe
  2⤵
  PID:2496
- C:\Windows\System\xDRSybv.exe
  C:\Windows\System\xDRSybv.exe
  2⤵
  PID:4584
- C:\Windows\System\SoJSwjf.exe
  C:\Windows\System\SoJSwjf.exe
  2⤵
  PID:2824
- C:\Windows\System\fJFxXOE.exe
  C:\Windows\System\fJFxXOE.exe
  2⤵
  PID:6832
- C:\Windows\System\rOghWAc.exe
  C:\Windows\System\rOghWAc.exe
  2⤵
  PID:4672
- C:\Windows\System\MHeayCE.exe
  C:\Windows\System\MHeayCE.exe
  2⤵
  PID:1736
- C:\Windows\System\tEpgEIB.exe
  C:\Windows\System\tEpgEIB.exe
  2⤵
  PID:2964
- C:\Windows\System\LABdUUR.exe
  C:\Windows\System\LABdUUR.exe
  2⤵
  PID:2164
- C:\Windows\System\DrxbJwE.exe
  C:\Windows\System\DrxbJwE.exe
  2⤵
  PID:5296
- C:\Windows\System\LYJkFgZ.exe
  C:\Windows\System\LYJkFgZ.exe
  2⤵
  PID:3088
- C:\Windows\System\BtpwIIQ.exe
  C:\Windows\System\BtpwIIQ.exe
  2⤵
  PID:4940
- C:\Windows\System\cLWnmWi.exe
  C:\Windows\System\cLWnmWi.exe
  2⤵
  PID:1596
- C:\Windows\System\khQwcDs.exe
  C:\Windows\System\khQwcDs.exe
  2⤵
  PID:5332
- C:\Windows\System\IGgvMxm.exe
  C:\Windows\System\IGgvMxm.exe
  2⤵
  PID:412
- C:\Windows\System\gdWRykJ.exe
  C:\Windows\System\gdWRykJ.exe
  2⤵
  PID:5040
- C:\Windows\System\YjcvScI.exe
  C:\Windows\System\YjcvScI.exe
  2⤵
  PID:1888
- C:\Windows\System\fpHvCyM.exe
  C:\Windows\System\fpHvCyM.exe
  2⤵
  PID:5892
- C:\Windows\System\lgkrnPM.exe
  C:\Windows\System\lgkrnPM.exe
  2⤵
  PID:5380
- C:\Windows\System\ftBlJxn.exe
  C:\Windows\System\ftBlJxn.exe
  2⤵
  PID:3004
- C:\Windows\System\Ppmrpap.exe
  C:\Windows\System\Ppmrpap.exe
  2⤵
  PID:5640
- C:\Windows\System\VcHLQMd.exe
  C:\Windows\System\VcHLQMd.exe
  2⤵
  PID:4964
- C:\Windows\System\jChwScN.exe
  C:\Windows\System\jChwScN.exe
  2⤵
  PID:5984
- C:\Windows\System\pERcBZo.exe
  C:\Windows\System\pERcBZo.exe
  2⤵
  PID:5812
- C:\Windows\System\WcUvuet.exe
  C:\Windows\System\WcUvuet.exe
  2⤵
  PID:2920
- C:\Windows\System\KTyAJZf.exe
  C:\Windows\System\KTyAJZf.exe
  2⤵
  PID:12948
- C:\Windows\System\GlBXVVJ.exe
  C:\Windows\System\GlBXVVJ.exe
  2⤵
  PID:6196
- C:\Windows\System\AVGxUsa.exe
  C:\Windows\System\AVGxUsa.exe
  2⤵
  PID:5916
- C:\Windows\System\nyHhkym.exe
  C:\Windows\System\nyHhkym.exe
  2⤵
  PID:5692
- C:\Windows\System\UibWVGZ.exe
  C:\Windows\System\UibWVGZ.exe
  2⤵
  PID:5204
- C:\Windows\System\fqmbClG.exe
  C:\Windows\System\fqmbClG.exe
  2⤵
  PID:5792
- C:\Windows\System\TANdqzO.exe
  C:\Windows\System\TANdqzO.exe
  2⤵
  PID:1692
- C:\Windows\System\XwsxTtH.exe
  C:\Windows\System\XwsxTtH.exe
  2⤵
  PID:4904
- C:\Windows\System\sMnkFhC.exe
  C:\Windows\System\sMnkFhC.exe
  2⤵
  PID:5764
- C:\Windows\System\WHFffra.exe
  C:\Windows\System\WHFffra.exe
  2⤵
  PID:5736
- C:\Windows\System\rQfvCqR.exe
  C:\Windows\System\rQfvCqR.exe
  2⤵
  PID:3132
- C:\Windows\System\ZFufcTG.exe
  C:\Windows\System\ZFufcTG.exe
  2⤵
  PID:5548
- C:\Windows\System\lwmhpDk.exe
  C:\Windows\System\lwmhpDk.exe
  2⤵
  PID:6004
- C:\Windows\System\iiRaiFT.exe
  C:\Windows\System\iiRaiFT.exe
  2⤵
  PID:6528
- C:\Windows\System\GfMrpVK.exe
  C:\Windows\System\GfMrpVK.exe
  2⤵
  PID:5768
- C:\Windows\System\LEdZTqd.exe
  C:\Windows\System\LEdZTqd.exe
  2⤵
  PID:5860
- C:\Windows\System\feEhzZX.exe
  C:\Windows\System\feEhzZX.exe
  2⤵
  PID:5632
- C:\Windows\System\ucaJQLv.exe
  C:\Windows\System\ucaJQLv.exe
  2⤵
  PID:6860
- C:\Windows\System\IiePYpK.exe
  C:\Windows\System\IiePYpK.exe
  2⤵
  PID:6284
- C:\Windows\System\QIfcBiN.exe
  C:\Windows\System\QIfcBiN.exe
  2⤵
  PID:6696
- C:\Windows\System\YKfWcFo.exe
  C:\Windows\System\YKfWcFo.exe
  2⤵
  PID:6360
- C:\Windows\System\JStsbRL.exe
  C:\Windows\System\JStsbRL.exe
  2⤵
  PID:4684
- C:\Windows\System\dVPvHra.exe
  C:\Windows\System\dVPvHra.exe
  2⤵
  PID:6876
- C:\Windows\System\PTfgSqv.exe
  C:\Windows\System\PTfgSqv.exe
  2⤵
  PID:6924
- C:\Windows\System\oQVUZdA.exe
  C:\Windows\System\oQVUZdA.exe
  2⤵
  PID:7008
- C:\Windows\System\OsQQlVa.exe
  C:\Windows\System\OsQQlVa.exe
  2⤵
  PID:6244
- C:\Windows\System\uiBzbCP.exe
  C:\Windows\System\uiBzbCP.exe
  2⤵
  PID:11436
- C:\Windows\System\NaInysY.exe
  C:\Windows\System\NaInysY.exe
  2⤵
  PID:12636
- C:\Windows\System\mWkaPjP.exe
  C:\Windows\System\mWkaPjP.exe
  2⤵
  PID:5660
- C:\Windows\System\SASnlbo.exe
  C:\Windows\System\SASnlbo.exe
  2⤵
  PID:6188
- C:\Windows\System\JMhONAt.exe
  C:\Windows\System\JMhONAt.exe
  2⤵
  PID:6324
- C:\Windows\System\sIBKnDJ.exe
  C:\Windows\System\sIBKnDJ.exe
  2⤵
  PID:1944
- C:\Windows\System\AVOXmSH.exe
  C:\Windows\System\AVOXmSH.exe
  2⤵
  PID:5324
- C:\Windows\System\pXRzlyl.exe
  C:\Windows\System\pXRzlyl.exe
  2⤵
  PID:5268
- C:\Windows\System\vIaOMWO.exe
  C:\Windows\System\vIaOMWO.exe
  2⤵
  PID:6848
- C:\Windows\System\kbunglv.exe
  C:\Windows\System\kbunglv.exe
  2⤵
  PID:6852
- C:\Windows\System\DtWAuWn.exe
  C:\Windows\System\DtWAuWn.exe
  2⤵
  PID:6656
- C:\Windows\System\JkNcLWT.exe
  C:\Windows\System\JkNcLWT.exe
  2⤵
  PID:5748
- C:\Windows\System\aSRvyJp.exe
  C:\Windows\System\aSRvyJp.exe
  2⤵
  PID:4004
- C:\Windows\System\ycXyAnB.exe
  C:\Windows\System\ycXyAnB.exe
  2⤵
  PID:7108
- C:\Windows\System\yjxmTJU.exe
  C:\Windows\System\yjxmTJU.exe
  2⤵
  PID:6012
- C:\Windows\System\VNFrRKL.exe
  C:\Windows\System\VNFrRKL.exe
  2⤵
  PID:6600
- C:\Windows\System\PuLuupm.exe
  C:\Windows\System\PuLuupm.exe
  2⤵
  PID:7148
- C:\Windows\System\EvTifjW.exe
  C:\Windows\System\EvTifjW.exe
  2⤵
  PID:6228
- C:\Windows\System\KWnndWF.exe
  C:\Windows\System\KWnndWF.exe
  2⤵
  PID:7208
- C:\Windows\System\CGunvGK.exe
  C:\Windows\System\CGunvGK.exe
  2⤵
  PID:7188
- C:\Windows\System\fLbOkct.exe
  C:\Windows\System\fLbOkct.exe
  2⤵
  PID:4144
- C:\Windows\System\rpBcIAD.exe
  C:\Windows\System\rpBcIAD.exe
  2⤵
  PID:9912
- C:\Windows\System\FYKbdfj.exe
  C:\Windows\System\FYKbdfj.exe
  2⤵
  PID:12640
- C:\Windows\System\NHVDZNM.exe
  C:\Windows\System\NHVDZNM.exe
  2⤵
  PID:7632
- C:\Windows\System\NJJcEdc.exe
  C:\Windows\System\NJJcEdc.exe
  2⤵
  PID:6404
- C:\Windows\System\hYZQYTF.exe
  C:\Windows\System\hYZQYTF.exe
  2⤵
  PID:7968
- C:\Windows\System\QjvqOci.exe
  C:\Windows\System\QjvqOci.exe
  2⤵
  PID:7996
- C:\Windows\System\fDwxYXU.exe
  C:\Windows\System\fDwxYXU.exe
  2⤵
  PID:7556
- C:\Windows\System\gUekdsD.exe
  C:\Windows\System\gUekdsD.exe
  2⤵
  PID:8152
- C:\Windows\System\rwgNZZV.exe
  C:\Windows\System\rwgNZZV.exe
  2⤵
  PID:5456
- C:\Windows\System\IwDoiOb.exe
  C:\Windows\System\IwDoiOb.exe
  2⤵
  PID:8176
- C:\Windows\System\HvcFpAK.exe
  C:\Windows\System\HvcFpAK.exe
  2⤵
  PID:6944
- C:\Windows\System\KJJeEBO.exe
  C:\Windows\System\KJJeEBO.exe
  2⤵
  PID:6424
- C:\Windows\System\JfxUcnU.exe
  C:\Windows\System\JfxUcnU.exe
  2⤵
  PID:6856
- C:\Windows\System\MEXVOHk.exe
  C:\Windows\System\MEXVOHk.exe
  2⤵
  PID:6892
- C:\Windows\System\RGHtexn.exe
  C:\Windows\System\RGHtexn.exe
  2⤵
  PID:2484
- C:\Windows\System\iUKneqx.exe
  C:\Windows\System\iUKneqx.exe
  2⤵
  PID:3756
- C:\Windows\System\LZtWpzq.exe
  C:\Windows\System\LZtWpzq.exe
  2⤵
  PID:6724
- C:\Windows\System\XertvKJ.exe
  C:\Windows\System\XertvKJ.exe
  2⤵
  PID:3128
- C:\Windows\System\XhUCPvG.exe
  C:\Windows\System\XhUCPvG.exe
  2⤵
  PID:1064
- C:\Windows\System\OOGuqFZ.exe
  C:\Windows\System\OOGuqFZ.exe
  2⤵
  PID:7508
- C:\Windows\System\jRFKbrm.exe
  C:\Windows\System\jRFKbrm.exe
  2⤵
  PID:7536
- C:\Windows\System\VRPEmMT.exe
  C:\Windows\System\VRPEmMT.exe
  2⤵
  PID:8036
- C:\Windows\System\qYrUBYO.exe
  C:\Windows\System\qYrUBYO.exe
  2⤵
  PID:3860
- C:\Windows\System\pHfiZjo.exe
  C:\Windows\System\pHfiZjo.exe
  2⤵
  PID:7408
- C:\Windows\System\YrSoaQx.exe
  C:\Windows\System\YrSoaQx.exe
  2⤵
  PID:4380
- C:\Windows\System\uVMuoUj.exe
  C:\Windows\System\uVMuoUj.exe
  2⤵
  PID:5388
- C:\Windows\System\OyTBmlt.exe
  C:\Windows\System\OyTBmlt.exe
  2⤵
  PID:8452
- C:\Windows\System\SPzIQDc.exe
  C:\Windows\System\SPzIQDc.exe
  2⤵
  PID:8540
- C:\Windows\System\uQNwxyT.exe
  C:\Windows\System\uQNwxyT.exe
  2⤵
  PID:8352
- C:\Windows\System\SeEgYtL.exe
  C:\Windows\System\SeEgYtL.exe
  2⤵
  PID:7912
- C:\Windows\System\rUGRURL.exe
  C:\Windows\System\rUGRURL.exe
  2⤵
  PID:9016
- C:\Windows\System\vtyHgBa.exe
  C:\Windows\System\vtyHgBa.exe
  2⤵
  PID:8724
- C:\Windows\System\QIproWP.exe
  C:\Windows\System\QIproWP.exe
  2⤵
  PID:8812
- C:\Windows\System\hLqQwpF.exe
  C:\Windows\System\hLqQwpF.exe
  2⤵
  PID:8148
- C:\Windows\System\QkkPKiA.exe
  C:\Windows\System\QkkPKiA.exe
  2⤵
  PID:9236
- C:\Windows\System\UmqpAOG.exe
  C:\Windows\System\UmqpAOG.exe
  2⤵
  PID:9400
- C:\Windows\System\UoCOPTF.exe
  C:\Windows\System\UoCOPTF.exe
  2⤵
  PID:6500
- C:\Windows\System\UgqGWCz.exe
  C:\Windows\System\UgqGWCz.exe
  2⤵
  PID:9868
- C:\Windows\System\mlYiOzU.exe
  C:\Windows\System\mlYiOzU.exe
  2⤵
  PID:9908
- C:\Windows\System\CNhpQmO.exe
  C:\Windows\System\CNhpQmO.exe
  2⤵
  PID:6248
- C:\Windows\System\wuKGkmv.exe
  C:\Windows\System\wuKGkmv.exe
  2⤵
  PID:9988
- C:\Windows\System\YZBypdb.exe
  C:\Windows\System\YZBypdb.exe
  2⤵
  PID:5804
- C:\Windows\System\POorDKg.exe
  C:\Windows\System\POorDKg.exe
  2⤵
  PID:9784
- C:\Windows\System\DojRdxh.exe
  C:\Windows\System\DojRdxh.exe
  2⤵
  PID:9824
- C:\Windows\System\TsBHTvl.exe
  C:\Windows\System\TsBHTvl.exe
  2⤵
  PID:8336
- C:\Windows\System\vYjUQwZ.exe
  C:\Windows\System\vYjUQwZ.exe
  2⤵
  PID:10196
- C:\Windows\System\VsoLioI.exe
  C:\Windows\System\VsoLioI.exe
  2⤵
  PID:9932
- C:\Windows\System\ojpSeMy.exe
  C:\Windows\System\ojpSeMy.exe
  2⤵
  PID:6168
- C:\Windows\System\JNvMkFs.exe
  C:\Windows\System\JNvMkFs.exe
  2⤵
  PID:12328
- C:\Windows\System\aUArCIv.exe
  C:\Windows\System\aUArCIv.exe
  2⤵
  PID:7312
- C:\Windows\System\bEWduSo.exe
  C:\Windows\System\bEWduSo.exe
  2⤵
  PID:9880
- C:\Windows\System\ItPFsVH.exe
  C:\Windows\System\ItPFsVH.exe
  2⤵
  PID:7356
- C:\Windows\System\DkXRLCs.exe
  C:\Windows\System\DkXRLCs.exe
  2⤵
  PID:10168
- C:\Windows\System\YzqhkYf.exe
  C:\Windows\System\YzqhkYf.exe
  2⤵
  PID:10200
- C:\Windows\System\vHMhcwf.exe
  C:\Windows\System\vHMhcwf.exe
  2⤵
  PID:6660
- C:\Windows\System\JCKDHIW.exe
  C:\Windows\System\JCKDHIW.exe
  2⤵
  PID:5936
- C:\Windows\System\FNUhSFa.exe
  C:\Windows\System\FNUhSFa.exe
  2⤵
  PID:9020
- C:\Windows\System\TWhyWgr.exe
  C:\Windows\System\TWhyWgr.exe
  2⤵
  PID:4608
- C:\Windows\System\kLYqYQz.exe
  C:\Windows\System\kLYqYQz.exe
  2⤵
  PID:7676
- C:\Windows\System\gcWDLQb.exe
  C:\Windows\System\gcWDLQb.exe
  2⤵
  PID:8120
- C:\Windows\System\ejgrybu.exe
  C:\Windows\System\ejgrybu.exe
  2⤵
  PID:8264
- C:\Windows\System\FRkanus.exe
  C:\Windows\System\FRkanus.exe
  2⤵
  PID:12620
- C:\Windows\System\XkoFeno.exe
  C:\Windows\System\XkoFeno.exe
  2⤵
  PID:9096
- C:\Windows\System\rEpMvsC.exe
  C:\Windows\System\rEpMvsC.exe
  2⤵
  PID:8700
- C:\Windows\System\gsyMWZH.exe
  C:\Windows\System\gsyMWZH.exe
  2⤵
  PID:11004
- C:\Windows\System\MPZlllw.exe
  C:\Windows\System\MPZlllw.exe
  2⤵
  PID:6872
- C:\Windows\System\sbAsuGj.exe
  C:\Windows\System\sbAsuGj.exe
  2⤵
  PID:9484
- C:\Windows\System\yVFUtKG.exe
  C:\Windows\System\yVFUtKG.exe
  2⤵
  PID:9788
- C:\Windows\System\JMsPunJ.exe
  C:\Windows\System\JMsPunJ.exe
  2⤵
  PID:9600
- C:\Windows\System\wkuVGCj.exe
  C:\Windows\System\wkuVGCj.exe
  2⤵
  PID:6792
- C:\Windows\System\KEFnzPY.exe
  C:\Windows\System\KEFnzPY.exe
  2⤵
  PID:8832
- C:\Windows\System\vaOVgYi.exe
  C:\Windows\System\vaOVgYi.exe
  2⤵
  PID:9416
- C:\Windows\System\OplrKgJ.exe
  C:\Windows\System\OplrKgJ.exe
  2⤵
  PID:10260
- C:\Windows\System\jEiMDiK.exe
  C:\Windows\System\jEiMDiK.exe
  2⤵
  PID:9508
- C:\Windows\System\GLLaPJV.exe
  C:\Windows\System\GLLaPJV.exe
  2⤵
  PID:9548
- C:\Windows\System\pYiEhmN.exe
  C:\Windows\System\pYiEhmN.exe
  2⤵
  PID:11568
- C:\Windows\System\YywXAvg.exe
  C:\Windows\System\YywXAvg.exe
  2⤵
  PID:6492
- C:\Windows\System\PskPCfy.exe
  C:\Windows\System\PskPCfy.exe
  2⤵
  PID:12728
- C:\Windows\System\QdeDtsQ.exe
  C:\Windows\System\QdeDtsQ.exe
  2⤵
  PID:11788
- C:\Windows\System\hNOQOnf.exe
  C:\Windows\System\hNOQOnf.exe
  2⤵
  PID:7076
- C:\Windows\System\JyDePOa.exe
  C:\Windows\System\JyDePOa.exe
  2⤵
  PID:12124
- C:\Windows\System\CqWYluM.exe
  C:\Windows\System\CqWYluM.exe
  2⤵
  PID:5240
- C:\Windows\System\uHbYGqg.exe
  C:\Windows\System\uHbYGqg.exe
  2⤵
  PID:1796
- C:\Windows\System\DPEvfcT.exe
  C:\Windows\System\DPEvfcT.exe
  2⤵
  PID:8100
- C:\Windows\System\yQGFSwo.exe
  C:\Windows\System\yQGFSwo.exe
  2⤵
  PID:12324
- C:\Windows\System\STsziDw.exe
  C:\Windows\System\STsziDw.exe
  2⤵
  PID:12412
- C:\Windows\System\WRBNCMi.exe
  C:\Windows\System\WRBNCMi.exe
  2⤵
  PID:7492
- C:\Windows\System\KLtekDL.exe
  C:\Windows\System\KLtekDL.exe
  2⤵
  PID:13024
- C:\Windows\System\hGiowWd.exe
  C:\Windows\System\hGiowWd.exe
  2⤵
  PID:10484
- C:\Windows\System\RLsAgLq.exe
  C:\Windows\System\RLsAgLq.exe
  2⤵
  PID:8780
- C:\Windows\System\MzRxVWh.exe
  C:\Windows\System\MzRxVWh.exe
  2⤵
  PID:7812
- C:\Windows\System\uDcdUlB.exe
  C:\Windows\System\uDcdUlB.exe
  2⤵
  PID:13308
- C:\Windows\System\yBXLCYV.exe
  C:\Windows\System\yBXLCYV.exe
  2⤵
  PID:13160
- C:\Windows\System\jPLXUsC.exe
  C:\Windows\System\jPLXUsC.exe
  2⤵
  PID:13200
- C:\Windows\System\ZiMlBTC.exe
  C:\Windows\System\ZiMlBTC.exe
  2⤵
  PID:4352
- C:\Windows\System\qcjNkwU.exe
  C:\Windows\System\qcjNkwU.exe
  2⤵
  PID:8644
- C:\Windows\System\xIXwith.exe
  C:\Windows\System\xIXwith.exe
  2⤵
  PID:9936
- C:\Windows\System\OHbmeNE.exe
  C:\Windows\System\OHbmeNE.exe
  2⤵
  PID:12552
- C:\Windows\System\UVoLhMS.exe
  C:\Windows\System\UVoLhMS.exe
  2⤵
  PID:13148
- C:\Windows\System\FheBiti.exe
  C:\Windows\System\FheBiti.exe
  2⤵
  PID:8532
- C:\Windows\System\nfwDZzy.exe
  C:\Windows\System\nfwDZzy.exe
  2⤵
  PID:9604
- C:\Windows\System\QVKXnlC.exe
  C:\Windows\System\QVKXnlC.exe
  2⤵
  PID:12576
- C:\Windows\System\bEYsbJE.exe
  C:\Windows\System\bEYsbJE.exe
  2⤵
  PID:8860
- C:\Windows\System\aLfmFsH.exe
  C:\Windows\System\aLfmFsH.exe
  2⤵
  PID:9312
- C:\Windows\System\WNmRMMj.exe
  C:\Windows\System\WNmRMMj.exe
  2⤵
  PID:10060
- C:\Windows\System\mMEnCtb.exe
  C:\Windows\System\mMEnCtb.exe
  2⤵
  PID:12784
- C:\Windows\System\xdCVBeQ.exe
  C:\Windows\System\xdCVBeQ.exe
  2⤵
  PID:9516
- C:\Windows\System\VhrLtJA.exe
  C:\Windows\System\VhrLtJA.exe
  2⤵
  PID:9836
- C:\Windows\System\ocdSRZr.exe
  C:\Windows\System\ocdSRZr.exe
  2⤵
  PID:10400
- C:\Windows\System\cVCPkwn.exe
  C:\Windows\System\cVCPkwn.exe
  2⤵
  PID:12916
- C:\Windows\System\rvjbeIn.exe
  C:\Windows\System\rvjbeIn.exe
  2⤵
  PID:9960
- C:\Windows\System\uydsSNB.exe
  C:\Windows\System\uydsSNB.exe
  2⤵
  PID:9308
- C:\Windows\System\XleWilt.exe
  C:\Windows\System\XleWilt.exe
  2⤵
  PID:10444
- C:\Windows\System\atlqmGV.exe
  C:\Windows\System\atlqmGV.exe
  2⤵
  PID:11540
- C:\Windows\System\DfXXbOd.exe
  C:\Windows\System\DfXXbOd.exe
  2⤵
  PID:9092
- C:\Windows\System\epdQNVf.exe
  C:\Windows\System\epdQNVf.exe
  2⤵
  PID:11432
- C:\Windows\System\gKMKyvS.exe
  C:\Windows\System\gKMKyvS.exe
  2⤵
  PID:11752
- C:\Windows\System\hFIqUFF.exe
  C:\Windows\System\hFIqUFF.exe
  2⤵
  PID:11836
- C:\Windows\System\MRxbAfS.exe
  C:\Windows\System\MRxbAfS.exe
  2⤵
  PID:13104
- C:\Windows\System\qDJPFaz.exe
  C:\Windows\System\qDJPFaz.exe
  2⤵
  PID:3752
- C:\Windows\System\QiHljxa.exe
  C:\Windows\System\QiHljxa.exe
  2⤵
  PID:10464
- C:\Windows\System\VgRsGqm.exe
  C:\Windows\System\VgRsGqm.exe
  2⤵
  PID:12132
- C:\Windows\System\dLBsTRs.exe
  C:\Windows\System\dLBsTRs.exe
  2⤵
  PID:11224
- C:\Windows\System\qZeBGVU.exe
  C:\Windows\System\qZeBGVU.exe
  2⤵
  PID:6540
- C:\Windows\System\aNMemPm.exe
  C:\Windows\System\aNMemPm.exe
  2⤵
  PID:10348
- C:\Windows\System\ZlaWrAW.exe
  C:\Windows\System\ZlaWrAW.exe
  2⤵
  PID:10920
- C:\Windows\System\BiKfLxA.exe
  C:\Windows\System\BiKfLxA.exe
  2⤵
  PID:6516
- C:\Windows\System\VahEqzk.exe
  C:\Windows\System\VahEqzk.exe
  2⤵
  PID:11624
- C:\Windows\System\FQUUagL.exe
  C:\Windows\System\FQUUagL.exe
  2⤵
  PID:2080
- C:\Windows\System\GrYqdPK.exe
  C:\Windows\System\GrYqdPK.exe
  2⤵
  PID:9616
- C:\Windows\System\phOkLJk.exe
  C:\Windows\System\phOkLJk.exe
  2⤵
  PID:9808
- C:\Windows\System\aYOWwGo.exe
  C:\Windows\System\aYOWwGo.exe
  2⤵
  PID:1100
- C:\Windows\System\DFtxkuH.exe
  C:\Windows\System\DFtxkuH.exe
  2⤵
  PID:11292
- C:\Windows\System\YlTQXVU.exe
  C:\Windows\System\YlTQXVU.exe
  2⤵
  PID:12376
- C:\Windows\System\hRUNrRk.exe
  C:\Windows\System\hRUNrRk.exe
  2⤵
  PID:11284
- C:\Windows\System\owWWwce.exe
  C:\Windows\System\owWWwce.exe
  2⤵
  PID:5420
- C:\Windows\System\SOkueJw.exe
  C:\Windows\System\SOkueJw.exe
  2⤵
  PID:4048
- C:\Windows\System\MBdevqn.exe
  C:\Windows\System\MBdevqn.exe
  2⤵
  PID:11688
- C:\Windows\System\ApZWNhh.exe
  C:\Windows\System\ApZWNhh.exe
  2⤵
  PID:8516
- C:\Windows\System\ljhDhWG.exe
  C:\Windows\System\ljhDhWG.exe
  2⤵
  PID:6532
- C:\Windows\System\GTFgvzU.exe
  C:\Windows\System\GTFgvzU.exe
  2⤵
  PID:10080
- C:\Windows\System\HvSSpRv.exe
  C:\Windows\System\HvSSpRv.exe
  2⤵
  PID:11944
- C:\Windows\System\agWOaMQ.exe
  C:\Windows\System\agWOaMQ.exe
  2⤵
  PID:12876
- C:\Windows\System\BQVbqTD.exe
  C:\Windows\System\BQVbqTD.exe
  2⤵
  PID:12864
- C:\Windows\System\rubyiqF.exe
  C:\Windows\System\rubyiqF.exe
  2⤵
  PID:7244
- C:\Windows\System\fXhKSdI.exe
  C:\Windows\System\fXhKSdI.exe
  2⤵
  PID:10656
- C:\Windows\System\TvBlBQz.exe
  C:\Windows\System\TvBlBQz.exe
  2⤵
  PID:4704
- C:\Windows\System\NPiEiNN.exe
  C:\Windows\System\NPiEiNN.exe
  2⤵
  PID:4108
- C:\Windows\System\myanRIv.exe
  C:\Windows\System\myanRIv.exe
  2⤵
  PID:12216
- C:\Windows\System\LpOmXAA.exe
  C:\Windows\System\LpOmXAA.exe
  2⤵
  PID:12988
- C:\Windows\System\JVwPoOQ.exe
  C:\Windows\System\JVwPoOQ.exe
  2⤵
  PID:12592
- C:\Windows\System\ECKdQDH.exe
  C:\Windows\System\ECKdQDH.exe
  2⤵
  PID:12912
- C:\Windows\System\ukzYwVt.exe
  C:\Windows\System\ukzYwVt.exe
  2⤵
  PID:12300
- C:\Windows\System\nIXIziq.exe
  C:\Windows\System\nIXIziq.exe
  2⤵
  PID:10488
- C:\Windows\System\QqLVsPv.exe
  C:\Windows\System\QqLVsPv.exe
  2⤵
  PID:13080
- C:\Windows\System\JqfXehF.exe
  C:\Windows\System\JqfXehF.exe
  2⤵
  PID:10232
- C:\Windows\System\bHNSYdU.exe
  C:\Windows\System\bHNSYdU.exe
  2⤵
  PID:13100
- C:\Windows\System\NwMLrUA.exe
  C:\Windows\System\NwMLrUA.exe
  2⤵
  PID:13188
- C:\Windows\System\qwDCLKM.exe
  C:\Windows\System\qwDCLKM.exe
  2⤵
  PID:8008
- C:\Windows\System\QevXDDa.exe
  C:\Windows\System\QevXDDa.exe
  2⤵
  PID:6672
- C:\Windows\System\CzObztC.exe
  C:\Windows\System\CzObztC.exe
  2⤵
  PID:1268
- C:\Windows\System\RowGQlJ.exe
  C:\Windows\System\RowGQlJ.exe
  2⤵
  PID:8980
- C:\Windows\System\HYMOMip.exe
  C:\Windows\System\HYMOMip.exe
  2⤵
  PID:11200
- C:\Windows\System\KJcMrJZ.exe
  C:\Windows\System\KJcMrJZ.exe
  2⤵
  PID:11772
- C:\Windows\System\MOFenyQ.exe
  C:\Windows\System\MOFenyQ.exe
  2⤵
  PID:10140
- C:\Windows\System\cZwQyaA.exe
  C:\Windows\System\cZwQyaA.exe
  2⤵
  PID:8764
- C:\Windows\System\QuFvKuD.exe
  C:\Windows\System\QuFvKuD.exe
  2⤵
  PID:12000
- C:\Windows\System\ManJLOB.exe
  C:\Windows\System\ManJLOB.exe
  2⤵
  PID:4540
- C:\Windows\System\PcfMXnS.exe
  C:\Windows\System\PcfMXnS.exe
  2⤵
  PID:8468
- C:\Windows\System\qUtbjwN.exe
  C:\Windows\System\qUtbjwN.exe
  2⤵
  PID:11604
- C:\Windows\System\CCoKzuw.exe
  C:\Windows\System\CCoKzuw.exe
  2⤵
  PID:11080
- C:\Windows\System\aOQiIDB.exe
  C:\Windows\System\aOQiIDB.exe
  2⤵
  PID:12996
- C:\Windows\System\jKoayiL.exe
  C:\Windows\System\jKoayiL.exe
  2⤵
  PID:2664
- C:\Windows\System\qKHKVpP.exe
  C:\Windows\System\qKHKVpP.exe
  2⤵
  PID:10976
- C:\Windows\System\GRYwUIY.exe
  C:\Windows\System\GRYwUIY.exe
  2⤵
  PID:11764
- C:\Windows\System\uIMVPNJ.exe
  C:\Windows\System\uIMVPNJ.exe
  2⤵
  PID:10716
- C:\Windows\System\BRiYOuO.exe
  C:\Windows\System\BRiYOuO.exe
  2⤵
  PID:12816
- C:\Windows\System\kAtHCQj.exe
  C:\Windows\System\kAtHCQj.exe
  2⤵
  PID:7800
- C:\Windows\System\VHmfMiK.exe
  C:\Windows\System\VHmfMiK.exe
  2⤵
  PID:11096
- C:\Windows\System\UhEMtyF.exe
  C:\Windows\System\UhEMtyF.exe
  2⤵
  PID:9044
- C:\Windows\System\YPsJCcR.exe
  C:\Windows\System\YPsJCcR.exe
  2⤵
  PID:12016
- C:\Windows\System\XnvQTSX.exe
  C:\Windows\System\XnvQTSX.exe
  2⤵
  PID:6456
- C:\Windows\System\lAWlioY.exe
  C:\Windows\System\lAWlioY.exe
  2⤵
  PID:9328
- C:\Windows\System\yCsheLa.exe
  C:\Windows\System\yCsheLa.exe
  2⤵
  PID:11408
- C:\Windows\System\sWudqLq.exe
  C:\Windows\System\sWudqLq.exe
  2⤵
  PID:9900
- C:\Windows\System\GTsatxP.exe
  C:\Windows\System\GTsatxP.exe
  2⤵
  PID:10068
- C:\Windows\System\sEuYSCi.exe
  C:\Windows\System\sEuYSCi.exe
  2⤵
  PID:12888
- C:\Windows\System\DOzTvQI.exe
  C:\Windows\System\DOzTvQI.exe
  2⤵
  PID:3732
- C:\Windows\System\ksKHNDo.exe
  C:\Windows\System\ksKHNDo.exe
  2⤵
  PID:896
- C:\Windows\System\QDNjRvD.exe
  C:\Windows\System\QDNjRvD.exe
  2⤵
  PID:8796
- C:\Windows\System\aUOGXCY.exe
  C:\Windows\System\aUOGXCY.exe
  2⤵
  PID:12372
- C:\Windows\System\OaFSaev.exe
  C:\Windows\System\OaFSaev.exe
  2⤵
  PID:10224
- C:\Windows\System\WDzhoFV.exe
  C:\Windows\System\WDzhoFV.exe
  2⤵
  PID:12828
- C:\Windows\System\qBOKpsZ.exe
  C:\Windows\System\qBOKpsZ.exe
  2⤵
  PID:4268
- C:\Windows\System\BdHvUNG.exe
  C:\Windows\System\BdHvUNG.exe
  2⤵
  PID:5052
- C:\Windows\System\rbFkGrs.exe
  C:\Windows\System\rbFkGrs.exe
  2⤵
  PID:12436
- C:\Windows\System\TfSCvWx.exe
  C:\Windows\System\TfSCvWx.exe
  2⤵
  PID:10268
- C:\Windows\System\hKtkwLz.exe
  C:\Windows\System\hKtkwLz.exe
  2⤵
  PID:7532
- C:\Windows\System\RxIRFkD.exe
  C:\Windows\System\RxIRFkD.exe
  2⤵
  PID:12756
- C:\Windows\System\bxAIDUb.exe
  C:\Windows\System\bxAIDUb.exe
  2⤵
  PID:10844
- C:\Windows\System\BuguHXf.exe
  C:\Windows\System\BuguHXf.exe
  2⤵
  PID:13304
- C:\Windows\System\ctezohB.exe
  C:\Windows\System\ctezohB.exe
  2⤵
  PID:13092
- C:\Windows\System\bJzEYlC.exe
  C:\Windows\System\bJzEYlC.exe
  2⤵
  PID:5528
- C:\Windows\System\ImwiWvj.exe
  C:\Windows\System\ImwiWvj.exe
  2⤵
  PID:3104
- C:\Windows\System\KmKYvrO.exe
  C:\Windows\System\KmKYvrO.exe
  2⤵
  PID:10236
- C:\Windows\System\yaZOBNz.exe
  C:\Windows\System\yaZOBNz.exe
  2⤵
  PID:10480
- C:\Windows\System\VKfllhb.exe
  C:\Windows\System\VKfllhb.exe
  2⤵
  PID:9556
- C:\Windows\System\IYkqnKT.exe
  C:\Windows\System\IYkqnKT.exe
  2⤵
  PID:3412
- C:\Windows\System\GOLTrcY.exe
  C:\Windows\System\GOLTrcY.exe
  2⤵
  PID:9112
- C:\Windows\System\arSiMVm.exe
  C:\Windows\System\arSiMVm.exe
  2⤵
  PID:10940
- C:\Windows\System\ykuQodL.exe
  C:\Windows\System\ykuQodL.exe
  2⤵
  PID:8792
- C:\Windows\System\fzWqHUd.exe
  C:\Windows\System\fzWqHUd.exe
  2⤵
  PID:12260
- C:\Windows\System\BVZXxpX.exe
  C:\Windows\System\BVZXxpX.exe
  2⤵
  PID:7152
- C:\Windows\System\wCNmjzj.exe
  C:\Windows\System\wCNmjzj.exe
  2⤵
  PID:12152
- C:\Windows\System\EVYWRSS.exe
  C:\Windows\System\EVYWRSS.exe
  2⤵
  PID:4944
- C:\Windows\System\ZRiaruc.exe
  C:\Windows\System\ZRiaruc.exe
  2⤵
  PID:4348
- C:\Windows\System\ETxNeJc.exe
  C:\Windows\System\ETxNeJc.exe
  2⤵
  PID:13224
- C:\Windows\System\XtWSnQX.exe
  C:\Windows\System\XtWSnQX.exe
  2⤵
  PID:10124
- C:\Windows\System\SKXiYcZ.exe
  C:\Windows\System\SKXiYcZ.exe
  2⤵
  PID:3684
- C:\Windows\System\NsetuKV.exe
  C:\Windows\System\NsetuKV.exe
  2⤵
  PID:13036
- C:\Windows\System\yDBbqfI.exe
  C:\Windows\System\yDBbqfI.exe
  2⤵
  PID:13064
- C:\Windows\System\ztSYBeV.exe
  C:\Windows\System\ztSYBeV.exe
  2⤵
  PID:11696
- C:\Windows\System\YBvgLrp.exe
  C:\Windows\System\YBvgLrp.exe
  2⤵
  PID:12776
- C:\Windows\System\rkGrbSC.exe
  C:\Windows\System\rkGrbSC.exe
  2⤵
  PID:10660
- C:\Windows\System\PWBemKH.exe
  C:\Windows\System\PWBemKH.exe
  2⤵
  PID:12128
- C:\Windows\System\WDnCyga.exe
  C:\Windows\System\WDnCyga.exe
  2⤵
  PID:9464
- C:\Windows\System\cxvobDd.exe
  C:\Windows\System\cxvobDd.exe
  2⤵
  PID:12580
- C:\Windows\System\jrPxFrk.exe
  C:\Windows\System\jrPxFrk.exe
  2⤵
  PID:10420
- C:\Windows\System\jghUaVb.exe
  C:\Windows\System\jghUaVb.exe
  2⤵
  PID:3832
- C:\Windows\System\hWmLHEp.exe
  C:\Windows\System\hWmLHEp.exe
  2⤵
  PID:1932
- C:\Windows\System\qIDvgIm.exe
  C:\Windows\System\qIDvgIm.exe
  2⤵
  PID:3212
- C:\Windows\System\MALfILp.exe
  C:\Windows\System\MALfILp.exe
  2⤵
  PID:11476
- C:\Windows\System\ImBAbYX.exe
  C:\Windows\System\ImBAbYX.exe
  2⤵
  PID:9212
- C:\Windows\System\dnHpfkP.exe
  C:\Windows\System\dnHpfkP.exe
  2⤵
  PID:10992
- C:\Windows\System\IFxiiuW.exe
  C:\Windows\System\IFxiiuW.exe
  2⤵
  PID:11920
- C:\Windows\System\wDOyYrx.exe
  C:\Windows\System\wDOyYrx.exe
  2⤵
  PID:2304
- C:\Windows\System\smXCkcz.exe
  C:\Windows\System\smXCkcz.exe
  2⤵
  PID:2908
- C:\Windows\System\cCRKlzL.exe
  C:\Windows\System\cCRKlzL.exe
  2⤵
  PID:4116
- C:\Windows\System\cIOVMbt.exe
  C:\Windows\System\cIOVMbt.exe
  2⤵
  PID:9692
- C:\Windows\System\ATKRnwC.exe
  C:\Windows\System\ATKRnwC.exe
  2⤵
  PID:3552
- C:\Windows\System\whDcNtm.exe
  C:\Windows\System\whDcNtm.exe
  2⤵
  PID:9596
- C:\Windows\System\tUsvCVL.exe
  C:\Windows\System\tUsvCVL.exe
  2⤵
  PID:2588
- C:\Windows\System\lpFVhlV.exe
  C:\Windows\System\lpFVhlV.exe
  2⤵
  PID:13316
- C:\Windows\System\CZIIAZn.exe
  C:\Windows\System\CZIIAZn.exe
  2⤵
  PID:13344
- C:\Windows\System\JJrqlQa.exe
  C:\Windows\System\JJrqlQa.exe
  2⤵
  PID:13372
- C:\Windows\System\gsiGfKk.exe
  C:\Windows\System\gsiGfKk.exe
  2⤵
  PID:13464
- C:\Windows\System\rqpcWHN.exe
  C:\Windows\System\rqpcWHN.exe
  2⤵
  PID:13480
- C:\Windows\System\ILxenxW.exe
  C:\Windows\System\ILxenxW.exe
  2⤵
  PID:13520
- C:\Windows\System\zyGCDKA.exe
  C:\Windows\System\zyGCDKA.exe
  2⤵
  PID:13548
- C:\Windows\System\pvNxpns.exe
  C:\Windows\System\pvNxpns.exe
  2⤵
  PID:13576
- C:\Windows\System\RXSfRWt.exe
  C:\Windows\System\RXSfRWt.exe
  2⤵
  PID:13604
- C:\Windows\System\tOxKiMv.exe
  C:\Windows\System\tOxKiMv.exe
  2⤵
  PID:13632
- C:\Windows\System\dRpgNKz.exe
  C:\Windows\System\dRpgNKz.exe
  2⤵
  PID:13660
- C:\Windows\System\IGZQVwI.exe
  C:\Windows\System\IGZQVwI.exe
  2⤵
  PID:13688
- C:\Windows\System\UhDGMAP.exe
  C:\Windows\System\UhDGMAP.exe
  2⤵
  PID:13716
- C:\Windows\System\FEUAmQb.exe
  C:\Windows\System\FEUAmQb.exe
  2⤵
  PID:13744
- C:\Windows\System\IGgakHT.exe
  C:\Windows\System\IGgakHT.exe
  2⤵
  PID:13772
- C:\Windows\System\AFXNdNp.exe
  C:\Windows\System\AFXNdNp.exe
  2⤵
  PID:13800
- C:\Windows\System\DyUYpId.exe
  C:\Windows\System\DyUYpId.exe
  2⤵
  PID:13828
- C:\Windows\System\UlfYTbI.exe
  C:\Windows\System\UlfYTbI.exe
  2⤵
  PID:13884
- C:\Windows\System\ojECmXe.exe
  C:\Windows\System\ojECmXe.exe
  2⤵
  PID:13760
- C:\Windows\System\SvBeoUW.exe
  C:\Windows\System\SvBeoUW.exe
  2⤵
  PID:5128
- C:\Windows\System\sdQBYxE.exe
  C:\Windows\System\sdQBYxE.exe
  2⤵
  PID:14092
- C:\Windows\System\HWlsmbm.exe
  C:\Windows\System\HWlsmbm.exe
  2⤵
  PID:14136
- C:\Windows\System\zwAowQY.exe
  C:\Windows\System\zwAowQY.exe
  2⤵
  PID:14196
- C:\Windows\System\tqjqjUD.exe
  C:\Windows\System\tqjqjUD.exe
  2⤵
  PID:14320
- C:\Windows\System\tVkrZGV.exe
  C:\Windows\System\tVkrZGV.exe
  2⤵
  PID:3636
- C:\Windows\System\aJouqXX.exe
  C:\Windows\System\aJouqXX.exe
  2⤵
  PID:1364
- C:\Windows\System\qSiyMKF.exe
  C:\Windows\System\qSiyMKF.exe
  2⤵
  PID:4416
- C:\Windows\System\CgRBfcZ.exe
  C:\Windows\System\CgRBfcZ.exe
  2⤵
  PID:13740
- C:\Windows\System\PQmWeVK.exe
  C:\Windows\System\PQmWeVK.exe
  2⤵
  PID:5172
- C:\Windows\System\MVTxDfH.exe
  C:\Windows\System\MVTxDfH.exe
  2⤵
  PID:13852
- C:\Windows\System\RPjCirA.exe
  C:\Windows\System\RPjCirA.exe
  2⤵
  PID:14084
- C:\Windows\System\bivUknH.exe
  C:\Windows\System\bivUknH.exe
  2⤵
  PID:14144
- C:\Windows\System\vbRLnkN.exe
  C:\Windows\System\vbRLnkN.exe
  2⤵
  PID:14328
- C:\Windows\System\rocJYZr.exe
  C:\Windows\System\rocJYZr.exe
  2⤵
  PID:13436

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:11888

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 516 -p 9580 -ip 9580
1⤵
PID:13096

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 540 -p 2800 -ip 2800
1⤵
PID:1204

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4dq1ufgc.vag.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AcFIdxY.exe

Filesize
1.9MB

MD5
d56e4777b71ccf588a913e903f93e0b9

SHA1
d52f87af5f8c65cdbb3b40932fb7e5dbfb812b89

SHA256
d6b2fb35b7408ea14798f7ff3e34544001b16df8895be5836c0b6d4e0bec8b91

SHA512
de88d7fc06c124c5339d12fe1f2b55db316574b11b0bcc6089bde508513edd5b532dbe22222951691856b953b3a9f53d47b3799e5dd5b94122486c3e5ebf495c

Download Submit
C:\Windows\System\AdIjVGW.exe

Filesize
1.9MB

MD5
fb9baf87922985c3878e9816b2352b14

SHA1
609f18a63fe953c6db8f23807b1a537ca0d2a9da

SHA256
955a9277cb38bfe2d6c3b2fb26240aeee74ce6c915d200a21366e722269f652f

SHA512
424fe4656a406dee33bcb68be8f595d2eb64f2d2d519affaeeb2a124e718f4e2ece2d8135a411df203ca5202bf380a7a4d992bdc8db01de5923d50c6d2b455c1

Download Submit
C:\Windows\System\IGWnUxY.exe

Filesize
1.9MB

MD5
444670a5040b7a19434396b7cb0e0240

SHA1
95834d9bbcf82c382c8a007680af6d4ab2e9ec06

SHA256
61508407ef4fe5e7e111b73f3f1b9cbb286922689dbf4ae57ffca1f5883682c6

SHA512
49cc97035b8dca506f90792cf9705dd248c9c727ba400d6f32c0374095b95cc18909ad98c30e9445eb5358b7f346e7de71b6d2612f6b5f4b71d1fdc9b368c280

Download Submit
C:\Windows\System\JNuLnkL.exe

Filesize
1.9MB

MD5
a8de91cabcd8cfbea9e7b6aeda666244

SHA1
66e9d27675209ab392dff175d7bf83e71c6f1483

SHA256
828f4d1c53d1c5a2d34f439e01a752587f232d6a2fbc9d1f9ccfeb64a2fad3d9

SHA512
b62cde99431cb01ffb1e9de70c5cd18699d666306459d74d9aa0a5a0b6b2783fbfc4c2a907b63cf79a85f228c4296611bac765d761a85eaf706b71a0fab6d7cf

Download Submit
C:\Windows\System\JZzzkMA.exe

Filesize
1.9MB

MD5
96d79171fce0f1126308b28a95937433

SHA1
baccb0b028dbf469c04d0bc2bf8d82dc3b5ffb51

SHA256
4804fc0d723e7094f4494ae7580d7922da73cfdf2b31862e1e83f4389779349a

SHA512
98b9f88ae3fbc1c8d588768e83b32f5599ce241d53ca3c920dab598f1a81e26d6421c07ad630176f7e3dd03e3363f44da64c1bd9da4d533011b2cb7f94915258

Download Submit
C:\Windows\System\KhTDyhQ.exe

Filesize
1.9MB

MD5
9d00f30f6efb2dd3ef8b735bbef5e221

SHA1
de858909ab8e2b2435aa481509d90ffb21cd8180

SHA256
0fc3ca5b3330087a1ef0e2f846479d44032927e0afaac3670a0fb8b12efa8016

SHA512
5fb1effc84a0d708ec5afe21f307e9a3ac71c75c8321f4ebe39c72af314c2398a5c15c25e87959491c1a17db7fb417c13e11bea96ae45745280ab489d17ffcc8

Download Submit
C:\Windows\System\KjKMTaC.exe

Filesize
1.9MB

MD5
c700a99f2cfefebf7f2ac94980ff53fc

SHA1
7463be505a07b572666bdad7da7b8ad1e241432e

SHA256
de59e028f5bb2072f14c3f51fde5cbd67b0a58ac98a70edcd1ce01e209bfe728

SHA512
84cda2b641f29370209c53ce90f619cac44e4879eb1234b98b0e601a3c9d56fb5b62b14664182fb1bc89445d1aa15dc776c2d9743b89ea2ad3b920887684cc87

Download Submit
C:\Windows\System\LGUVoWi.exe

Filesize
8B

MD5
30a9dfceb37577cb23b97b50ee0ca790

SHA1
b56360a546aafbfa7ce003cd05916a7ab7239259

SHA256
44dda0d0cfe87b066fcb3ae3e2b0cbc86f86ca0fdd14c7ce736c7a63fedce1f4

SHA512
f1ae1743e6029aabc9e7387b476be46b30f000874bca6e0907b605cfb329a40abfc7d4eb3d891027c469be0356b370267e0531be7c50ab8183a5aad8ce1cbe57

Download Submit
C:\Windows\System\LhBdctM.exe

Filesize
1.9MB

MD5
b659b83884dbac5d74f7771af9f30261

SHA1
7f446e73b88e7c97276b392160201b8b0c9adeb7

SHA256
4c9e09ee74825f348b6b4c7ac11d486cd2d39829fa8505caac2bdc622d356802

SHA512
dae2e4401b9f230eac6f00ac5c00aa4509b74e0c569144ccb779c388d1d6da9649a83aff08131cbdd22465f209f592f42a20c8dd9fcd3477f98462f9134bb6f5

Download Submit
C:\Windows\System\OMWWkEh.exe

Filesize
1.9MB

MD5
06a2f5f8912223421b398369fa826689

SHA1
a06a3fe31c11ee84f9e232b1d3394194148c033f

SHA256
8359641628d7dbc70c6219bf6c9c871c2a6e2dedce807a1208b5585e5898cf5e

SHA512
5bbd320f43bf57b2bc6d627b99f8fda5ced50fd2f39aa110723879f4412f76df251a2a9a38c3c02add72fc9d64fb655551ceb210d61d74234e18e66239b7c0f8

Download Submit
C:\Windows\System\Orzpezb.exe

Filesize
1.9MB

MD5
2f37c16506d0d53b3bc46ff59fcadcf7

SHA1
b024d3e96358d3a40ed4dd973d29adcc6f2d9fb3

SHA256
291d7aaca31282571373bff4ce0ecbda9098698e268f45c02a0da234df813bae

SHA512
6c2b64ad474672e949736e8a043fa86840c7e7bdad06f91e96e1be81073ef548f08c6140d0f62eff33410901ae417637e3680f49ec4a3ccf9e616d59b891d25d

Download Submit
C:\Windows\System\QAegPlg.exe

Filesize
18B

MD5
12d764af0242c5e9d5789b2b47191cab

SHA1
27c955d8895a3dd74067d2c8c2ddd4db89461025

SHA256
22fad68840942c3468f5bd85214408fef29e825f9fa4402f948647dd9bfcfbbf

SHA512
345f6542208a71772d6f12acd8a7a946bff3a5b0364922fdfdbb97f70b74edd2676762bb63e6f4b3817ce1c84a3d722837cfba2c47e6d30027d13c7c41912d58

Download Submit
C:\Windows\System\QYvpyXw.exe

Filesize
1.9MB

MD5
e823c707d8be24ea060209ce5c565aee

SHA1
8f600e6ffea62bad94644fb2808985ec193746eb

SHA256
28daf83ae119ce3bf3d635c51757d15d50bee9d7426a2ac30772b566a75ee9c9

SHA512
0de2ba1ab7dfc62516c3e3e0fd4f8c5d2b48012c4150fd60ee509d8e68e20ee900d82a87a20bd8d27b85d7232877ca10be7847ab4eb751e855bda4831512fc5e

Download Submit
C:\Windows\System\QbwzOQE.exe

Filesize
1.9MB

MD5
cb9fbc9f8891455b407310d03f826980

SHA1
98d7a135231cdbbf85ba69dcfbe15578b8eeb7d4

SHA256
9f57680694189844f2039845c532d6f7e69939b07a01930542d9d7be986b6a82

SHA512
15e12ff025b1d0337c37e7b77baf0371365a8d0999af24b1ebe7a2c1577b3537040c7268aaa11557ee2601c208447b18572c82d28fc49709487536abb8e7f028

Download Submit
C:\Windows\System\RjvFTTc.exe

Filesize
1.9MB

MD5
ff0fd2459ac160ced754130e7607cfd0

SHA1
8acdaaa72d1428d7a097981e5c7802b4bc386983

SHA256
9e307bc0fe28e77c03eff0440536897f275bc98da689a1b34331edef411c676e

SHA512
fbba30976959b12313617018c378835f296aba9f4f2a5d7718796e9009ec756ffdb45d9f1da1872f0e395a914e61cec063fab3bf8a7d134478a047d45831249f

Download Submit
C:\Windows\System\TxMybZK.exe

Filesize
1.9MB

MD5
ccf6f77e8b171cf0809d46d272b6424f

SHA1
682ebb3dd9030b666ccbce23e022c50c4fa51c41

SHA256
0e188855cf0b246623d9a0f3d323a43f709e10db6b39b79e5b4994978866bdfd

SHA512
bf4fb3d21929211299d896902c32a1328523044cac5eabc22593657e2a8bda66c88adaada0b7eafacc59b51f0d4f5889d63358a9a6481da1e72842a32121f1fa

Download Submit
C:\Windows\System\UgRMywk.exe

Filesize
1.9MB

MD5
c22003ac41c7a1216e17363a61b13b85

SHA1
504860e17bea620085de5f56f644a30e4febeaa8

SHA256
e5eb12dd3c590f6d5913906ffb9aa05d14e5e49c900a668af94f04684e076ebd

SHA512
b033aec66173f9994888ae6786725d4e7ea3cb52e1cf86cb402cd69750f2d1945d976b6b45d26f9a72e80ab514243d73b6116d45807c7072096b91fb60950dca

Download Submit
C:\Windows\System\UsiLBqw.exe

Filesize
1.9MB

MD5
59108725e742a2752a83da8471cc65b5

SHA1
932e32da84418529f3e9fa9c24457633613babbf

SHA256
51c3123c38484cb4d469a03ec035550e9c72388313358540f43c760b986bea98

SHA512
4f89bb0100cf6fe2fc4371283318da9eb25aab5efb0f1d3d3052e6699469b6f78e0983b86b554b1f9b3751d473d58f85b127c58e687be93ac6273039a6ac03f9

Download Submit
C:\Windows\System\VTOmQTo.exe

Filesize
1.9MB

MD5
aadf70ff835ff719d248f75ecd4039b8

SHA1
59a3207f6bb9efe4220fdb80e2e4b090d08680a5

SHA256
9120532cf3f0d5a8f155d5864a96e1574c128fb6caff6084336be18186917368

SHA512
e3c2988093c65a24891ac9d53b578c6fc40906279f440605d573b0d86a974850add5b6df531bbce7771aab1afafa7d5b6c8682d151a0bdfd8653c9b36041a5ce

Download Submit
C:\Windows\System\WVSnIBZ.exe

Filesize
1.9MB

MD5
1b0321d3455d9c956ebf64d2425586f9

SHA1
735f897545769067466152389efdf924d664e2dc

SHA256
a3673ef1daa7f87b71245bf0a7532d50c7cc2d4db6a07c311f6495419e1fd818

SHA512
73a33c2cd185c82cdf297c859434aa4b27afac997b08524ec8da2f18b10fd43ba1977b207155f2689420b0279dda08cef5f8730f126f55a1b4988aa5d6bf655c

Download Submit
C:\Windows\System\WxcZQsz.exe

Filesize
1.9MB

MD5
01102183abff89fef8d11f77801581aa

SHA1
2965e79aa1cbf041aafe906ff0c76aab722618ea

SHA256
626a26dbc94ee1bfd988e797e02a78194bfa1b476293ce263a2ccdc1b9f93c85

SHA512
6a6c42b0fe0ca44344eea6ae80ea88c16420d70485340ec22043fa7818feb7b9a474022598971660d63aa7af2c00c4c361dbdcd3713f0fec205ff9442cb42d83

Download Submit
C:\Windows\System\WxcZQsz.exe

Filesize
1.9MB

MD5
3a7731aacc516570da465c013e234e93

SHA1
34aa6d8f8b86ce8f263dae0503daeb4c71346e4a

SHA256
73f7051bea3b5786066b459c0763e411f86d3577c203db5088456fb4078ba3c5

SHA512
094d0fe7f4fc845a497184765701a017ca4e6c5cfc98c9667766d4d4d4b5a3f7192efd999376cb4e42593ed6894fce749ae3754069c128389c74f640cef9745f

Download Submit
C:\Windows\System\XhHUuyZ.exe

Filesize
1.9MB

MD5
9e689d46e70f0c24cc2e64ad0d1574a8

SHA1
682bd33e098925d5523f68f1d4dbeece45e01a9b

SHA256
b545d064b664dc6673832827fc28f5db25bac8b70a22db536566ca7513b3de34

SHA512
612637b79dbff58ece11c3a6aada2bb0bcc90df39fcbe889b9da266c6a7902948d531ccd9ac3b4dbbe19a7129acf05304c14aa1c1c87a4b3106a499d2f57fd0d

Download Submit
C:\Windows\System\aVHGmoZ.exe

Filesize
1.9MB

MD5
5aec6aadc9dfe3c78a01a403a0a78f1e

SHA1
f0e3cd443c3b6751757d75a64a70ca222cbd1847

SHA256
4516016118d2517452d03045f6e62463cccc9b7b23e8382a728ea1720c8f1a92

SHA512
8cecd3b31a5ea9d0838a3658b1fbdef1cefa4076793b77e2e03bb0a329d061f55154298659fd957746f9cff27fb46e5af649957c45cca6549084ce89df7742b2

Download Submit
C:\Windows\System\fuKXqCr.exe

Filesize
1.9MB

MD5
b70a92c55a8d27efc75be1c6fa8a5f8a

SHA1
d55b74ca529589d6f3565d390a381fc329a67bf0

SHA256
20df94f6285991f7c8beb83ebda7bd613d541cfbf9019fd706f133ff71e5ea97

SHA512
de7a39717a7bf1f990613af95e979dfb70362fa1f1a9d33fcaec8bec9d127d1eae04b86dea5a755a0f74350e000eb2bbed1bdaf1acfb4501c3f1fc5de26e1964

Download Submit
C:\Windows\System\gHKPkob.exe

Filesize
1.9MB

MD5
4990867a2601a131e50e11a80f87d4fd

SHA1
50413261cc78a97cb7d1fc9ba0b4d7d4b6683279

SHA256
e108ba875c8ca38c2e71d80854e270351819d5c52104b5fc4d7fb54bc3a92baa

SHA512
95e5c18c2a57b01859ffff7e42f61122672341ffa0e85e0516be990c12d0d4173bbb08d6ccf589f9bee33c1889ca4d517162f524f349046ba633caec8395acbf

Download Submit
C:\Windows\System\gYhafKu.exe

Filesize
1.9MB

MD5
4ced098d6f6d7f7821b4f079eba12721

SHA1
fffdfe71852acc334643e33150c43f348feaa520

SHA256
759011904bdfa9c6836c57d9df4afaf5f4e6f5238e38f2477072ef826db45d90

SHA512
ff383aa67fba0e4d74072874a85be75ce6a976f30ac235a88fb5f018cba84e29d282ad93f42492298ac0d190289191fee02aeb84468219356e184ffcf85209ed

Download Submit
C:\Windows\System\mcgINDA.exe

Filesize
1.9MB

MD5
e5989e3ec80005d210848bb23fc1c73d

SHA1
14e3f03bfe2b48bba31089e4555e7675f949c879

SHA256
579648c4d1cbd3312a4cd8ee660681ffe85ed4e02639b92f6c9d27129d6f4b66

SHA512
62621b94df8ed2e004cd06b66e3afd917c90366f907fb4bbedbea359e5375967d6d8ce1522a957bc92fa006aa958d66c55b58be74d69fcd3983b579f270b199d

Download Submit
C:\Windows\System\ndoIhtK.exe

Filesize
1.9MB

MD5
d78225f85a7aa8b3c3e8032a389a5b37

SHA1
c743fc10fc7848ee74d932f56d31e48ee8002830

SHA256
b6f007619b697d4ae424f6b4bf012842e2ca3e3f512cbb31042124899a74a16e

SHA512
d3e97c1b6826e50990bb9cd1e405cb24bf99a75a6694698d29a2054b3831866c7c93c1acd5f179116180d80b8ccbce505f139d45fc55c12412a64a02608ee8b3

Download Submit
C:\Windows\System\qXYeLSC.exe

Filesize
1.9MB

MD5
3a6ca36e6cd3e499220c7b41614eeef5

SHA1
672b61fd1b73b92b7c1d7a4bab4ac5e0b93e7ea2

SHA256
f99d4da2641e8533744a56a489ea2460b8c2e57f1f0d735df4c71ecdb03fcb8c

SHA512
96d043222643357f1e342e133f4d82ea6eb0b86b160b017320f976fcd1c3afd07e43e20db7a4d7dc49d6c7cb4462dc6c834e002a4c99e3046d9ebdd2d3d27c7e

Download Submit
C:\Windows\System\rCXhKkp.exe

Filesize
1.9MB

MD5
d2a46d5dc0c0921e493a13cdde26a44d

SHA1
6a4a42701b4dd5bdbad9e3019c925e1a662288c5

SHA256
2c1af43410dc293c9d2fb15c802e0bda0fc889dce31aaa0421167e5831406631

SHA512
6f01acbf84b4416ff27a421e2f2ef5100246bad05eb9545700fc0eb25e13b5f382f4f249c65e35d76b545ff2988cef598705436ae87d12b3a2b757a26fcb90db

Download Submit
C:\Windows\System\rDgnfGZ.exe

Filesize
1.9MB

MD5
40b76e76f847d1d388278e7e176bff0d

SHA1
3dcb4c3c68325607f713fc51b533f78e873488e9

SHA256
b9ba376389c7f997c7e05bdf3dc367e659232ac5127a74e52d05df2b6b9e6817

SHA512
43250ae36d284e61878efd56b2431e7b36f6c701d10a416c4c0bc1ad474ed911a66f05214e71e53b17d9f9585c6d018f09b17b2ce60a85fbe3e2c844d016599e

Download Submit
C:\Windows\System\rmRcEeF.exe

Filesize
1.9MB

MD5
1c268b36bdd6af731ffd62312a97fafd

SHA1
a558368f47df482109fbff1e8c246450cc606c43

SHA256
4272b1f8f76c7f44087296c010931d5db76f561b7d4dbf667814dc16c2dac924

SHA512
e7196724d722c8fef9f08ee8fd4d6c2fdb82af5f91eed97648482b573c0a5fb069703daafc349fa5866eb8c1e36ec110e849bf35898e7a146b944010f2c54704

Download Submit
C:\Windows\System\tzsVFAZ.exe

Filesize
1.9MB

MD5
af121fbe1baf637cf7596fd7a55e367b

SHA1
4b16a2b69b021039bc0579944ca2c5c9d86ca559

SHA256
154cc8aa09568e1985f30e7e5795c027f0f028f20ef120ab956310eb817fcf86

SHA512
11f67e8be8524c2014587e987e24dbb9639a4f14f6930318425a772c06651ef133e16bdecff6047680903b2e2a9c5d0a6369262dcadff7b64b58de1a879a38d0

Download Submit
C:\Windows\System\vZrZISY.exe

Filesize
1.9MB

MD5
542ce960ad8116a883a5fdadabc021dc

SHA1
45e25d2196539e1330237195e123903c5db90b16

SHA256
76ef69c6a1d6d436689b52f5142ded0860fa56f18b792e748cff89ea2c814d99

SHA512
5248762ce35f4a476ca2670505e6c98149e1c3dcb64f02c0f22ee2556240a65b643110f3e72375866b81d76fd09d1598aefea3b5d5c0652d7251bb9b566bacca

Download Submit
C:\Windows\System\xlYTXct.exe

Filesize
1.9MB

MD5
c2bcf70f8d5ba8d21a8ec68239ee194a

SHA1
f7449e06943444d6d40349a6fe2b3bbfc6ad7fe1

SHA256
84363dae428929bef7834aa8ca9f6a9718778b4c680f54bde4b179bd4a4d6289

SHA512
aceffc927ffdc090bf3212c1de6d9211a4d7f0a26ba43b607c2c0dd15a99472b2aedfc0ab0010d16e4b9c1af6724c0fbe017bfd6bb50e0f42f5fe6d2c3e1e17c

Download Submit
C:\Windows\System\yAIazbi.exe

Filesize
1.9MB

MD5
8022ef417c5dde724da07e96d1717b04

SHA1
733f0bcaecdaa8eed7c50bae4c5bfa4b0e5142f5

SHA256
0b95d10ddb39a1d9165e5b0d7ba7b8bfd15338a3ee3ce1a2e32e9d1b080516c1

SHA512
44f2a42bc45f8c811a656b50e202d018f755e18e0a2dc962db2ccbed89834517b883f9ce7c297e15056dcd4b70e11b5302050ed201a7f53c8a0759c57b1986ab

Download Submit
C:\Windows\System\yjQHJIX.exe

Filesize
1.9MB

MD5
3c9279df8961f77f9507ef828f549f6b

SHA1
c71e0706aeb8a7681281270a3876fa40d6ffb336

SHA256
0124fdc9d993f0dc38cbedad62f138d630798a081109d946787539a50d554ad4

SHA512
d0e037133ae2cb9f6d15e07c264de08a55c419017679fb758b5453c33bf4d6043e7e5ef7b5b22199024422406d2048341cb15cd35654cd97a97ea6aae7a9703d

Download Submit
C:\Windows\System\yqCRSSo.exe

Filesize
1.9MB

MD5
ca5338d7fbbb5cd6c124b6dd83c673cc

SHA1
ce5fe66e74a92e5a5954aba89309a018be493da2

SHA256
29a6aed87097a78b8ede93f10d1b98f1e48ddb746ad3bfb8b1fc8d7de37f25fa

SHA512
c58cf3a5fb841075ef79c62e5d1e525fa38653084f8837f5f76e70cb3e6c8d3040e2ddeccf049a80fa3d2a56462d23a72051829b63750d9a4f11e47972c0669a

Download Submit
memory/372-634-0x00007FF6D6240000-0x00007FF6D6632000-memory.dmp

Filesize
3.9MB

Download
memory/872-350-0x00007FF70CC10000-0x00007FF70D002000-memory.dmp

Filesize
3.9MB

Download
memory/952-90-0x00007FF748DB0000-0x00007FF7491A2000-memory.dmp

Filesize
3.9MB

Download
memory/952-7805-0x00007FF748DB0000-0x00007FF7491A2000-memory.dmp

Filesize
3.9MB

Download
memory/1012-214-0x00007FF649680000-0x00007FF649A72000-memory.dmp

Filesize
3.9MB

Download
memory/1276-6391-0x00007FF6B20B0000-0x00007FF6B24A2000-memory.dmp

Filesize
3.9MB

Download
memory/1276-147-0x00007FF6B20B0000-0x00007FF6B24A2000-memory.dmp

Filesize
3.9MB

Download
memory/1524-7795-0x00007FF7232B0000-0x00007FF7236A2000-memory.dmp

Filesize
3.9MB

Download
memory/1524-56-0x00007FF7232B0000-0x00007FF7236A2000-memory.dmp

Filesize
3.9MB

Download
memory/1580-248-0x00007FF7FD6E0000-0x00007FF7FDAD2000-memory.dmp

Filesize
3.9MB

Download
memory/1580-7820-0x00007FF7FD6E0000-0x00007FF7FDAD2000-memory.dmp

Filesize
3.9MB

Download
memory/1904-7898-0x00007FF7EE220000-0x00007FF7EE612000-memory.dmp

Filesize
3.9MB

Download
memory/1904-615-0x00007FF7EE220000-0x00007FF7EE612000-memory.dmp

Filesize
3.9MB

Download
memory/2212-474-0x00007FF75D500000-0x00007FF75D8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2212-7996-0x00007FF75D500000-0x00007FF75D8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-325-0x00007FF6175F0000-0x00007FF6179E2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-7882-0x00007FF6175F0000-0x00007FF6179E2000-memory.dmp

Filesize
3.9MB

Download
memory/2952-653-0x00007FF745F30000-0x00007FF746322000-memory.dmp

Filesize
3.9MB

Download
memory/3176-0-0x00007FF6FADA0000-0x00007FF6FB192000-memory.dmp

Filesize
3.9MB

Download
memory/3176-1-0x0000016A90930000-0x0000016A90940000-memory.dmp

Filesize
64KB

Download
memory/3492-53-0x00007FF718480000-0x00007FF718872000-memory.dmp

Filesize
3.9MB

Download
memory/3492-7793-0x00007FF718480000-0x00007FF718872000-memory.dmp

Filesize
3.9MB

Download
memory/3564-282-0x00007FF68CC80000-0x00007FF68D072000-memory.dmp

Filesize
3.9MB

Download
memory/3952-534-0x00007FF66DD40000-0x00007FF66E132000-memory.dmp

Filesize
3.9MB

Download
memory/3952-7788-0x00007FF66DD40000-0x00007FF66E132000-memory.dmp

Filesize
3.9MB

Download
memory/4332-93-0x00007FF646620000-0x00007FF646A12000-memory.dmp

Filesize
3.9MB

Download
memory/4332-7810-0x00007FF646620000-0x00007FF646A12000-memory.dmp

Filesize
3.9MB

Download
memory/4444-34-0x00007FFA54790000-0x00007FFA55251000-memory.dmp

Filesize
10.8MB

Download
memory/4444-39-0x00000273C8450000-0x00000273C8460000-memory.dmp

Filesize
64KB

Download
memory/4444-253-0x00000273C83C0000-0x00000273C83E2000-memory.dmp

Filesize
136KB

Download
memory/4520-328-0x00007FF7268C0000-0x00007FF726CB2000-memory.dmp

Filesize
3.9MB

Download
memory/4520-7814-0x00007FF7268C0000-0x00007FF726CB2000-memory.dmp

Filesize
3.9MB

Download
memory/4884-71-0x00007FF611890000-0x00007FF611C82000-memory.dmp

Filesize
3.9MB

Download
memory/4884-7802-0x00007FF611890000-0x00007FF611C82000-memory.dmp

Filesize
3.9MB

Download
memory/4888-377-0x00007FF60F540000-0x00007FF60F932000-memory.dmp

Filesize
3.9MB

Download
memory/4888-8017-0x00007FF60F540000-0x00007FF60F932000-memory.dmp

Filesize
3.9MB

Download
memory/4928-406-0x00007FF715E90000-0x00007FF716282000-memory.dmp

Filesize
3.9MB

Download
memory/4928-7979-0x00007FF715E90000-0x00007FF716282000-memory.dmp

Filesize
3.9MB

Download
memory/4956-7891-0x00007FF6314C0000-0x00007FF6318B2000-memory.dmp

Filesize
3.9MB

Download
memory/4956-217-0x00007FF6314C0000-0x00007FF6318B2000-memory.dmp

Filesize
3.9MB

Download
memory/4988-537-0x00007FF644690000-0x00007FF644A82000-memory.dmp

Filesize
3.9MB

Download