xmrig | 1c77e6f5580aaecfbcd1b6bb04d7e4821168c279d5535d0e60e66021c97f5c45

Analysis

max time kernel
136s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

015541e186f159092af55fb0442a215d_JaffaCakes118.exe
Size

1.9MB
MD5

015541e186f159092af55fb0442a215d
SHA1

da343ddff6eb683bf70e892993934f6834db21a1
SHA256

1c77e6f5580aaecfbcd1b6bb04d7e4821168c279d5535d0e60e66021c97f5c45
SHA512

049d613936170d9d57c6bcf15f682322f9c67215dad72d95782a93880d7c7eac373e754e918ffefba46be1f984de615beaf1b20f808a1b35d74b59d196f22f94
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl/jTK:NAB3

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 17 IoCs

miner

resource	yara_rule
behavioral2/memory/4376-35-0x00007FF763F10000-0x00007FF764302000-memory.dmp	xmrig
behavioral2/memory/1944-41-0x00007FF60B1E0000-0x00007FF60B5D2000-memory.dmp	xmrig
behavioral2/memory/2232-65-0x00007FF716180000-0x00007FF716572000-memory.dmp	xmrig
behavioral2/memory/1292-63-0x00007FF694030000-0x00007FF694422000-memory.dmp	xmrig
behavioral2/memory/1664-49-0x00007FF607FD0000-0x00007FF6083C2000-memory.dmp	xmrig
behavioral2/memory/4832-43-0x00007FF6CC240000-0x00007FF6CC632000-memory.dmp	xmrig
behavioral2/memory/3864-126-0x00007FF6B1610000-0x00007FF6B1A02000-memory.dmp	xmrig
behavioral2/memory/4916-146-0x00007FF69E1E0000-0x00007FF69E5D2000-memory.dmp	xmrig
behavioral2/memory/4748-141-0x00007FF7CA710000-0x00007FF7CAB02000-memory.dmp	xmrig
behavioral2/memory/3140-134-0x00007FF7A41A0000-0x00007FF7A4592000-memory.dmp	xmrig
behavioral2/memory/4828-2696-0x00007FF6BA4E0000-0x00007FF6BA8D2000-memory.dmp	xmrig
behavioral2/memory/1516-3109-0x00007FF723040000-0x00007FF723432000-memory.dmp	xmrig
behavioral2/memory/2940-3107-0x00007FF770BF0000-0x00007FF770FE2000-memory.dmp	xmrig
behavioral2/memory/4156-3499-0x00007FF6CD650000-0x00007FF6CDA42000-memory.dmp	xmrig
behavioral2/memory/1084-3500-0x00007FF61E970000-0x00007FF61ED62000-memory.dmp	xmrig
behavioral2/memory/3492-3903-0x00007FF699AF0000-0x00007FF699EE2000-memory.dmp	xmrig
behavioral2/memory/4916-5608-0x00007FF69E1E0000-0x00007FF69E5D2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2236	vkWxcvD.exe
4376	ChgVNoD.exe
1944	gchpXPV.exe
1292	RAMDTHC.exe
4832	NyaOcIz.exe
1664	CeNypdb.exe
2232	MrSRVIU.exe
4828	fmtsVDy.exe
2940	WmlsSzU.exe
1516	nMWsCyL.exe
3900	UwGnaCA.exe
3864	IkzGpoI.exe
400	ZOpjNrE.exe
788	HVYMkrd.exe
3140	YOBhIhD.exe
4156	HIoJTaF.exe
4748	QqUbEeo.exe
1084	oDQJjzJ.exe
4916	IJKCAuU.exe
3492	eUYcxbv.exe
2544	vTtEteu.exe
3016	sCAPckI.exe
3940	aIlzkSD.exe
3516	JuYhEYE.exe
4216	qrnjzrg.exe
2320	SOKjHos.exe
2740	zCGlbiU.exe
4472	OYMjvsg.exe
3416	KanziIt.exe
4676	OHVEtmt.exe
1700	DdHgNev.exe
4032	RgmqKEk.exe
2916	oguDfDG.exe
884	CmOcqDi.exe
3124	KvfLVpt.exe
5088	bjCGiML.exe
4280	dQnYHOH.exe
1980	pskVtvo.exe
2088	HfWVrDf.exe
1268	MWksBAq.exe
2592	faZIiiy.exe
4380	QUsWJdl.exe
1936	IMqQqlv.exe
4544	rcrzToU.exe
2968	FlfnRPe.exe
1656	JnjnZBV.exe
4884	VEUStVz.exe
4972	UtHorOo.exe
2280	ZCEjuLo.exe
3412	ThzJnGu.exe
5024	GnOMCMX.exe
4176	pvRyMGu.exe
1680	NMvBugk.exe
2976	QSOIQjS.exe
4592	qedLzhq.exe
4948	eawCPwJ.exe
3960	GPRxJDF.exe
4288	eUvCHjr.exe
5108	motMNdr.exe
1912	ocOGjay.exe
2312	SCSdtEd.exe
2180	aTgnPMi.exe
3844	hNpiqPk.exe
3556	pUlgvUE.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1080-0-0x00007FF7FC160000-0x00007FF7FC552000-memory.dmp	upx
behavioral2/memory/2236-11-0x00007FF6EAFC0000-0x00007FF6EB3B2000-memory.dmp	upx
behavioral2/files/0x000e000000023b8a-8.dat	upx
behavioral2/files/0x000a000000023b98-13.dat	upx
behavioral2/files/0x000a000000023b9a-24.dat	upx
behavioral2/files/0x000a000000023b99-25.dat	upx
behavioral2/memory/4376-35-0x00007FF763F10000-0x00007FF764302000-memory.dmp	upx
behavioral2/memory/1944-41-0x00007FF60B1E0000-0x00007FF60B5D2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-47.dat	upx
behavioral2/memory/4828-62-0x00007FF6BA4E0000-0x00007FF6BA8D2000-memory.dmp	upx
behavioral2/memory/2232-65-0x00007FF716180000-0x00007FF716572000-memory.dmp	upx
behavioral2/files/0x000a000000023b9e-67.dat	upx
behavioral2/memory/2940-66-0x00007FF770BF0000-0x00007FF770FE2000-memory.dmp	upx
behavioral2/memory/1292-63-0x00007FF694030000-0x00007FF694422000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-60.dat	upx
behavioral2/memory/1664-49-0x00007FF607FD0000-0x00007FF6083C2000-memory.dmp	upx
behavioral2/memory/4832-43-0x00007FF6CC240000-0x00007FF6CC632000-memory.dmp	upx
behavioral2/files/0x000a000000023b9b-42.dat	upx
behavioral2/files/0x000a000000023b97-15.dat	upx
behavioral2/files/0x000a000000023b9f-71.dat	upx
behavioral2/files/0x000b000000023b94-84.dat	upx
behavioral2/files/0x000a000000023ba4-102.dat	upx
behavioral2/memory/4156-105-0x00007FF6CD650000-0x00007FF6CDA42000-memory.dmp	upx
behavioral2/memory/788-103-0x00007FF747C70000-0x00007FF748062000-memory.dmp	upx
behavioral2/files/0x000a000000023ba3-101.dat	upx
behavioral2/files/0x000a000000023ba2-100.dat	upx
behavioral2/memory/400-96-0x00007FF7136A0000-0x00007FF713A92000-memory.dmp	upx
behavioral2/files/0x000b000000023ba1-99.dat	upx
behavioral2/memory/3900-91-0x00007FF78C650000-0x00007FF78CA42000-memory.dmp	upx
behavioral2/files/0x000b000000023ba0-92.dat	upx
behavioral2/memory/1516-83-0x00007FF723040000-0x00007FF723432000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-112.dat	upx
behavioral2/files/0x000a000000023ba5-111.dat	upx
behavioral2/memory/3492-121-0x00007FF699AF0000-0x00007FF699EE2000-memory.dmp	upx
behavioral2/memory/3864-126-0x00007FF6B1610000-0x00007FF6B1A02000-memory.dmp	upx
behavioral2/files/0x000a000000023ba7-129.dat	upx
behavioral2/files/0x000a000000023ba8-137.dat	upx
behavioral2/memory/2544-147-0x00007FF798B70000-0x00007FF798F62000-memory.dmp	upx
behavioral2/files/0x000a000000023bac-154.dat	upx
behavioral2/files/0x000a000000023bab-152.dat	upx
behavioral2/files/0x000a000000023baa-150.dat	upx
behavioral2/files/0x000a000000023ba9-148.dat	upx
behavioral2/memory/4916-146-0x00007FF69E1E0000-0x00007FF69E5D2000-memory.dmp	upx
behavioral2/memory/4748-141-0x00007FF7CA710000-0x00007FF7CAB02000-memory.dmp	upx
behavioral2/memory/3140-134-0x00007FF7A41A0000-0x00007FF7A4592000-memory.dmp	upx
behavioral2/memory/1084-113-0x00007FF61E970000-0x00007FF61ED62000-memory.dmp	upx
behavioral2/files/0x000a000000023bad-158.dat	upx
behavioral2/files/0x000a000000023bae-163.dat	upx
behavioral2/files/0x000a000000023baf-171.dat	upx
behavioral2/files/0x000a000000023bb0-174.dat	upx
behavioral2/files/0x000a000000023bb1-179.dat	upx
behavioral2/files/0x000a000000023bb2-182.dat	upx
behavioral2/files/0x000a000000023bb3-187.dat	upx
behavioral2/files/0x000a000000023bb4-193.dat	upx
behavioral2/memory/4828-2696-0x00007FF6BA4E0000-0x00007FF6BA8D2000-memory.dmp	upx
behavioral2/memory/1516-3109-0x00007FF723040000-0x00007FF723432000-memory.dmp	upx
behavioral2/memory/2940-3107-0x00007FF770BF0000-0x00007FF770FE2000-memory.dmp	upx
behavioral2/memory/4156-3499-0x00007FF6CD650000-0x00007FF6CDA42000-memory.dmp	upx
behavioral2/memory/1084-3500-0x00007FF61E970000-0x00007FF61ED62000-memory.dmp	upx
behavioral2/memory/3492-3903-0x00007FF699AF0000-0x00007FF699EE2000-memory.dmp	upx
behavioral2/memory/4916-5608-0x00007FF69E1E0000-0x00007FF69E5D2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vvjSSdr.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\jmVoYrd.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\RvNahvo.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\tJUeMNA.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\yGeiKPp.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\KMXIYkS.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\wZUzCsR.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\aeLdXzR.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\SAtyive.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\CaHzwnr.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\QzGQDLv.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\oWcGolt.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\uBTKVOO.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\qNfIAWL.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\MshujVW.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\dxmTMvN.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\PgWrVQP.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\KfLHfBs.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\VJKnRXY.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\nqWCKvi.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\sGhqkAZ.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\MSsDHba.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\yZQVwIB.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\XGVNAGn.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\hjvbcdH.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\JDjdFAl.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\VcSiubd.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\GEoCHoI.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\cJVNkEU.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\JtyLvfx.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\JMuWkIw.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\qJHMmIg.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\qrALLPM.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\ShbvAFO.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\mPWNumr.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\RTWXFiB.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\mwvrnDw.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\hUqzRAc.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\BZFiLjk.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\rlmnCMx.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\EbEQmjm.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\TWCGTIw.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\sAXZNjM.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\PhHMawN.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\lkVsqBT.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\MLszIRy.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\VKsGHfj.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\PPVkQLZ.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\qThpYGw.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\eIPeeKm.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\hOCjCbm.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\vNBoMeh.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\qPRrKqu.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\bRxauxi.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\ZDYoBZo.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\MkxQfBd.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\DeWHSBZ.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\mmCtrna.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\hnvCMka.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\FkmoAYb.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\reTtFnd.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\qUXHALF.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\vbkGlnY.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
File created	C:\Windows\System\fhwQxlK.exe	015541e186f159092af55fb0442a215d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3660	powershell.exe
3660	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe
Token: SeDebugPrivilege	3660	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 3660	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	85
PID 1080 wrote to memory of 3660	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	85
PID 1080 wrote to memory of 2236	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	86
PID 1080 wrote to memory of 2236	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	86
PID 1080 wrote to memory of 4376	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	87
PID 1080 wrote to memory of 4376	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	87
PID 1080 wrote to memory of 1944	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	88
PID 1080 wrote to memory of 1944	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	88
PID 1080 wrote to memory of 1292	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	89
PID 1080 wrote to memory of 1292	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	89
PID 1080 wrote to memory of 4832	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	90
PID 1080 wrote to memory of 4832	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	90
PID 1080 wrote to memory of 1664	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	91
PID 1080 wrote to memory of 1664	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	91
PID 1080 wrote to memory of 2232	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	92
PID 1080 wrote to memory of 2232	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	92
PID 1080 wrote to memory of 4828	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	93
PID 1080 wrote to memory of 4828	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	93
PID 1080 wrote to memory of 2940	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	94
PID 1080 wrote to memory of 2940	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	94
PID 1080 wrote to memory of 1516	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	95
PID 1080 wrote to memory of 1516	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	95
PID 1080 wrote to memory of 3900	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	96
PID 1080 wrote to memory of 3900	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	96
PID 1080 wrote to memory of 3864	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	97
PID 1080 wrote to memory of 3864	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	97
PID 1080 wrote to memory of 400	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	98
PID 1080 wrote to memory of 400	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	98
PID 1080 wrote to memory of 788	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	99
PID 1080 wrote to memory of 788	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	99
PID 1080 wrote to memory of 3140	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	100
PID 1080 wrote to memory of 3140	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	100
PID 1080 wrote to memory of 4156	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	101
PID 1080 wrote to memory of 4156	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	101
PID 1080 wrote to memory of 4748	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	102
PID 1080 wrote to memory of 4748	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	102
PID 1080 wrote to memory of 1084	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	103
PID 1080 wrote to memory of 1084	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	103
PID 1080 wrote to memory of 4916	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	104
PID 1080 wrote to memory of 4916	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	104
PID 1080 wrote to memory of 3492	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	105
PID 1080 wrote to memory of 3492	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	105
PID 1080 wrote to memory of 2544	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	106
PID 1080 wrote to memory of 2544	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	106
PID 1080 wrote to memory of 3016	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	107
PID 1080 wrote to memory of 3016	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	107
PID 1080 wrote to memory of 3940	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	108
PID 1080 wrote to memory of 3940	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	108
PID 1080 wrote to memory of 3516	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	109
PID 1080 wrote to memory of 3516	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	109
PID 1080 wrote to memory of 4216	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	110
PID 1080 wrote to memory of 4216	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	110
PID 1080 wrote to memory of 2320	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	111
PID 1080 wrote to memory of 2320	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	111
PID 1080 wrote to memory of 2740	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	112
PID 1080 wrote to memory of 2740	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	112
PID 1080 wrote to memory of 4472	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	113
PID 1080 wrote to memory of 4472	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	113
PID 1080 wrote to memory of 3416	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	114
PID 1080 wrote to memory of 3416	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	114
PID 1080 wrote to memory of 4676	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	115
PID 1080 wrote to memory of 4676	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	115
PID 1080 wrote to memory of 1700	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	117
PID 1080 wrote to memory of 1700	1080	015541e186f159092af55fb0442a215d_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\015541e186f159092af55fb0442a215d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\015541e186f159092af55fb0442a215d_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3660
- C:\Windows\System\vkWxcvD.exe
  C:\Windows\System\vkWxcvD.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\ChgVNoD.exe
  C:\Windows\System\ChgVNoD.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\gchpXPV.exe
  C:\Windows\System\gchpXPV.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\RAMDTHC.exe
  C:\Windows\System\RAMDTHC.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\NyaOcIz.exe
  C:\Windows\System\NyaOcIz.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\CeNypdb.exe
  C:\Windows\System\CeNypdb.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\MrSRVIU.exe
  C:\Windows\System\MrSRVIU.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\fmtsVDy.exe
  C:\Windows\System\fmtsVDy.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\WmlsSzU.exe
  C:\Windows\System\WmlsSzU.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\nMWsCyL.exe
  C:\Windows\System\nMWsCyL.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\UwGnaCA.exe
  C:\Windows\System\UwGnaCA.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\IkzGpoI.exe
  C:\Windows\System\IkzGpoI.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\ZOpjNrE.exe
  C:\Windows\System\ZOpjNrE.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\HVYMkrd.exe
  C:\Windows\System\HVYMkrd.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\YOBhIhD.exe
  C:\Windows\System\YOBhIhD.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\HIoJTaF.exe
  C:\Windows\System\HIoJTaF.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\QqUbEeo.exe
  C:\Windows\System\QqUbEeo.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\oDQJjzJ.exe
  C:\Windows\System\oDQJjzJ.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\IJKCAuU.exe
  C:\Windows\System\IJKCAuU.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\eUYcxbv.exe
  C:\Windows\System\eUYcxbv.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\vTtEteu.exe
  C:\Windows\System\vTtEteu.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\sCAPckI.exe
  C:\Windows\System\sCAPckI.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\aIlzkSD.exe
  C:\Windows\System\aIlzkSD.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\JuYhEYE.exe
  C:\Windows\System\JuYhEYE.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\qrnjzrg.exe
  C:\Windows\System\qrnjzrg.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\SOKjHos.exe
  C:\Windows\System\SOKjHos.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\zCGlbiU.exe
  C:\Windows\System\zCGlbiU.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\OYMjvsg.exe
  C:\Windows\System\OYMjvsg.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\KanziIt.exe
  C:\Windows\System\KanziIt.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\OHVEtmt.exe
  C:\Windows\System\OHVEtmt.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\DdHgNev.exe
  C:\Windows\System\DdHgNev.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\RgmqKEk.exe
  C:\Windows\System\RgmqKEk.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\oguDfDG.exe
  C:\Windows\System\oguDfDG.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\CmOcqDi.exe
  C:\Windows\System\CmOcqDi.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\KvfLVpt.exe
  C:\Windows\System\KvfLVpt.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\bjCGiML.exe
  C:\Windows\System\bjCGiML.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\dQnYHOH.exe
  C:\Windows\System\dQnYHOH.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\pskVtvo.exe
  C:\Windows\System\pskVtvo.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\HfWVrDf.exe
  C:\Windows\System\HfWVrDf.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\MWksBAq.exe
  C:\Windows\System\MWksBAq.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\faZIiiy.exe
  C:\Windows\System\faZIiiy.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\QUsWJdl.exe
  C:\Windows\System\QUsWJdl.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\IMqQqlv.exe
  C:\Windows\System\IMqQqlv.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\rcrzToU.exe
  C:\Windows\System\rcrzToU.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\FlfnRPe.exe
  C:\Windows\System\FlfnRPe.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\JnjnZBV.exe
  C:\Windows\System\JnjnZBV.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\VEUStVz.exe
  C:\Windows\System\VEUStVz.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\UtHorOo.exe
  C:\Windows\System\UtHorOo.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\ZCEjuLo.exe
  C:\Windows\System\ZCEjuLo.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\ThzJnGu.exe
  C:\Windows\System\ThzJnGu.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\GnOMCMX.exe
  C:\Windows\System\GnOMCMX.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\pvRyMGu.exe
  C:\Windows\System\pvRyMGu.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\NMvBugk.exe
  C:\Windows\System\NMvBugk.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\QSOIQjS.exe
  C:\Windows\System\QSOIQjS.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\qedLzhq.exe
  C:\Windows\System\qedLzhq.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\eawCPwJ.exe
  C:\Windows\System\eawCPwJ.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\GPRxJDF.exe
  C:\Windows\System\GPRxJDF.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\eUvCHjr.exe
  C:\Windows\System\eUvCHjr.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\motMNdr.exe
  C:\Windows\System\motMNdr.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\ocOGjay.exe
  C:\Windows\System\ocOGjay.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\SCSdtEd.exe
  C:\Windows\System\SCSdtEd.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\aTgnPMi.exe
  C:\Windows\System\aTgnPMi.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\hNpiqPk.exe
  C:\Windows\System\hNpiqPk.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\pUlgvUE.exe
  C:\Windows\System\pUlgvUE.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\LwGxOCn.exe
  C:\Windows\System\LwGxOCn.exe
  2⤵
  PID:2704
- C:\Windows\System\pGeXuml.exe
  C:\Windows\System\pGeXuml.exe
  2⤵
  PID:4360
- C:\Windows\System\AyzKCqp.exe
  C:\Windows\System\AyzKCqp.exe
  2⤵
  PID:2464
- C:\Windows\System\ahPJlPy.exe
  C:\Windows\System\ahPJlPy.exe
  2⤵
  PID:3424
- C:\Windows\System\TEGNoOc.exe
  C:\Windows\System\TEGNoOc.exe
  2⤵
  PID:4164
- C:\Windows\System\SwEciAM.exe
  C:\Windows\System\SwEciAM.exe
  2⤵
  PID:5076
- C:\Windows\System\vFQgAwT.exe
  C:\Windows\System\vFQgAwT.exe
  2⤵
  PID:2664
- C:\Windows\System\ZKBbOTo.exe
  C:\Windows\System\ZKBbOTo.exe
  2⤵
  PID:428
- C:\Windows\System\qjnFcZv.exe
  C:\Windows\System\qjnFcZv.exe
  2⤵
  PID:552
- C:\Windows\System\HIkMDty.exe
  C:\Windows\System\HIkMDty.exe
  2⤵
  PID:2240
- C:\Windows\System\YnPbhLd.exe
  C:\Windows\System\YnPbhLd.exe
  2⤵
  PID:4960
- C:\Windows\System\GWPXvfM.exe
  C:\Windows\System\GWPXvfM.exe
  2⤵
  PID:2376
- C:\Windows\System\tvnAIvZ.exe
  C:\Windows\System\tvnAIvZ.exe
  2⤵
  PID:2908
- C:\Windows\System\vyjygcZ.exe
  C:\Windows\System\vyjygcZ.exe
  2⤵
  PID:4416
- C:\Windows\System\GjQolbX.exe
  C:\Windows\System\GjQolbX.exe
  2⤵
  PID:1608
- C:\Windows\System\CTJVdSR.exe
  C:\Windows\System\CTJVdSR.exe
  2⤵
  PID:2192
- C:\Windows\System\KOFAiRn.exe
  C:\Windows\System\KOFAiRn.exe
  2⤵
  PID:4568
- C:\Windows\System\YQKEgqJ.exe
  C:\Windows\System\YQKEgqJ.exe
  2⤵
  PID:4488
- C:\Windows\System\rqtjZkM.exe
  C:\Windows\System\rqtjZkM.exe
  2⤵
  PID:2600
- C:\Windows\System\BWxFKpR.exe
  C:\Windows\System\BWxFKpR.exe
  2⤵
  PID:4256
- C:\Windows\System\tEMzcIh.exe
  C:\Windows\System\tEMzcIh.exe
  2⤵
  PID:1752
- C:\Windows\System\LvvaaLB.exe
  C:\Windows\System\LvvaaLB.exe
  2⤵
  PID:1360
- C:\Windows\System\YvyEWEq.exe
  C:\Windows\System\YvyEWEq.exe
  2⤵
  PID:1272
- C:\Windows\System\wafMhIz.exe
  C:\Windows\System\wafMhIz.exe
  2⤵
  PID:1448
- C:\Windows\System\fRHGPGU.exe
  C:\Windows\System\fRHGPGU.exe
  2⤵
  PID:2308
- C:\Windows\System\AjxZlZW.exe
  C:\Windows\System\AjxZlZW.exe
  2⤵
  PID:4172
- C:\Windows\System\lmLEqxo.exe
  C:\Windows\System\lmLEqxo.exe
  2⤵
  PID:1892
- C:\Windows\System\prOGktk.exe
  C:\Windows\System\prOGktk.exe
  2⤵
  PID:3976
- C:\Windows\System\UbJNAlg.exe
  C:\Windows\System\UbJNAlg.exe
  2⤵
  PID:2428
- C:\Windows\System\CBbBUMR.exe
  C:\Windows\System\CBbBUMR.exe
  2⤵
  PID:5148
- C:\Windows\System\whDHgcv.exe
  C:\Windows\System\whDHgcv.exe
  2⤵
  PID:5176
- C:\Windows\System\dSRRSjR.exe
  C:\Windows\System\dSRRSjR.exe
  2⤵
  PID:5192
- C:\Windows\System\TOGTpge.exe
  C:\Windows\System\TOGTpge.exe
  2⤵
  PID:5220
- C:\Windows\System\tZRnJMO.exe
  C:\Windows\System\tZRnJMO.exe
  2⤵
  PID:5244
- C:\Windows\System\vcVBXPX.exe
  C:\Windows\System\vcVBXPX.exe
  2⤵
  PID:5276
- C:\Windows\System\IpMMolt.exe
  C:\Windows\System\IpMMolt.exe
  2⤵
  PID:5308
- C:\Windows\System\dCmCzph.exe
  C:\Windows\System\dCmCzph.exe
  2⤵
  PID:5332
- C:\Windows\System\dvLfmgD.exe
  C:\Windows\System\dvLfmgD.exe
  2⤵
  PID:5356
- C:\Windows\System\ckSaNwo.exe
  C:\Windows\System\ckSaNwo.exe
  2⤵
  PID:5380
- C:\Windows\System\fsRfsnR.exe
  C:\Windows\System\fsRfsnR.exe
  2⤵
  PID:5428
- C:\Windows\System\dDVnOkk.exe
  C:\Windows\System\dDVnOkk.exe
  2⤵
  PID:5456
- C:\Windows\System\aPpQFaQ.exe
  C:\Windows\System\aPpQFaQ.exe
  2⤵
  PID:5472
- C:\Windows\System\bHxrdEb.exe
  C:\Windows\System\bHxrdEb.exe
  2⤵
  PID:5500
- C:\Windows\System\TCyhfBK.exe
  C:\Windows\System\TCyhfBK.exe
  2⤵
  PID:5524
- C:\Windows\System\qUtdtTJ.exe
  C:\Windows\System\qUtdtTJ.exe
  2⤵
  PID:5548
- C:\Windows\System\fcZXISB.exe
  C:\Windows\System\fcZXISB.exe
  2⤵
  PID:5648
- C:\Windows\System\LGSgQZU.exe
  C:\Windows\System\LGSgQZU.exe
  2⤵
  PID:5672
- C:\Windows\System\qcbGovc.exe
  C:\Windows\System\qcbGovc.exe
  2⤵
  PID:5692
- C:\Windows\System\jrsvVVc.exe
  C:\Windows\System\jrsvVVc.exe
  2⤵
  PID:5708
- C:\Windows\System\wUmeWnk.exe
  C:\Windows\System\wUmeWnk.exe
  2⤵
  PID:5732
- C:\Windows\System\OCuydpZ.exe
  C:\Windows\System\OCuydpZ.exe
  2⤵
  PID:5764
- C:\Windows\System\smDKKat.exe
  C:\Windows\System\smDKKat.exe
  2⤵
  PID:5812
- C:\Windows\System\OFInNwL.exe
  C:\Windows\System\OFInNwL.exe
  2⤵
  PID:5840
- C:\Windows\System\aRibeIN.exe
  C:\Windows\System\aRibeIN.exe
  2⤵
  PID:5864
- C:\Windows\System\iIHOnDI.exe
  C:\Windows\System\iIHOnDI.exe
  2⤵
  PID:5880
- C:\Windows\System\WJVTJLv.exe
  C:\Windows\System\WJVTJLv.exe
  2⤵
  PID:5904
- C:\Windows\System\YcTmDjo.exe
  C:\Windows\System\YcTmDjo.exe
  2⤵
  PID:5928
- C:\Windows\System\mgQvUZB.exe
  C:\Windows\System\mgQvUZB.exe
  2⤵
  PID:5952
- C:\Windows\System\LUVCERy.exe
  C:\Windows\System\LUVCERy.exe
  2⤵
  PID:5972
- C:\Windows\System\AmvKOMa.exe
  C:\Windows\System\AmvKOMa.exe
  2⤵
  PID:6032
- C:\Windows\System\RGsUwwW.exe
  C:\Windows\System\RGsUwwW.exe
  2⤵
  PID:6064
- C:\Windows\System\HYERMXq.exe
  C:\Windows\System\HYERMXq.exe
  2⤵
  PID:6100
- C:\Windows\System\trBJKrI.exe
  C:\Windows\System\trBJKrI.exe
  2⤵
  PID:6120
- C:\Windows\System\EVzSjdR.exe
  C:\Windows\System\EVzSjdR.exe
  2⤵
  PID:2896
- C:\Windows\System\ZLlkkeE.exe
  C:\Windows\System\ZLlkkeE.exe
  2⤵
  PID:5160
- C:\Windows\System\pvPXTiM.exe
  C:\Windows\System\pvPXTiM.exe
  2⤵
  PID:5188
- C:\Windows\System\FdPdJve.exe
  C:\Windows\System\FdPdJve.exe
  2⤵
  PID:5228
- C:\Windows\System\bgqOUPB.exe
  C:\Windows\System\bgqOUPB.exe
  2⤵
  PID:5320
- C:\Windows\System\KaYyfnV.exe
  C:\Windows\System\KaYyfnV.exe
  2⤵
  PID:5408
- C:\Windows\System\JMuWkIw.exe
  C:\Windows\System\JMuWkIw.exe
  2⤵
  PID:5480
- C:\Windows\System\dlXzRuv.exe
  C:\Windows\System\dlXzRuv.exe
  2⤵
  PID:5520
- C:\Windows\System\gHOaeVG.exe
  C:\Windows\System\gHOaeVG.exe
  2⤵
  PID:5564
- C:\Windows\System\OOxGSUI.exe
  C:\Windows\System\OOxGSUI.exe
  2⤵
  PID:5628
- C:\Windows\System\TPtFnzt.exe
  C:\Windows\System\TPtFnzt.exe
  2⤵
  PID:5760
- C:\Windows\System\ZKqevXZ.exe
  C:\Windows\System\ZKqevXZ.exe
  2⤵
  PID:5776
- C:\Windows\System\oHQLeEa.exe
  C:\Windows\System\oHQLeEa.exe
  2⤵
  PID:5836
- C:\Windows\System\vsjWZep.exe
  C:\Windows\System\vsjWZep.exe
  2⤵
  PID:5896
- C:\Windows\System\SCboVZI.exe
  C:\Windows\System\SCboVZI.exe
  2⤵
  PID:5984
- C:\Windows\System\rKPmYlN.exe
  C:\Windows\System\rKPmYlN.exe
  2⤵
  PID:6052
- C:\Windows\System\PBcZiVF.exe
  C:\Windows\System\PBcZiVF.exe
  2⤵
  PID:6080
- C:\Windows\System\HpmoShg.exe
  C:\Windows\System\HpmoShg.exe
  2⤵
  PID:6112
- C:\Windows\System\yVDJQXd.exe
  C:\Windows\System\yVDJQXd.exe
  2⤵
  PID:1076
- C:\Windows\System\gnTquUg.exe
  C:\Windows\System\gnTquUg.exe
  2⤵
  PID:5284
- C:\Windows\System\SDjxRvZ.exe
  C:\Windows\System\SDjxRvZ.exe
  2⤵
  PID:5416
- C:\Windows\System\chowOEz.exe
  C:\Windows\System\chowOEz.exe
  2⤵
  PID:5516
- C:\Windows\System\tLjhhrk.exe
  C:\Windows\System\tLjhhrk.exe
  2⤵
  PID:6060
- C:\Windows\System\uUaVRKj.exe
  C:\Windows\System\uUaVRKj.exe
  2⤵
  PID:6140
- C:\Windows\System\oWpuouD.exe
  C:\Windows\System\oWpuouD.exe
  2⤵
  PID:5352
- C:\Windows\System\GJzYIOJ.exe
  C:\Windows\System\GJzYIOJ.exe
  2⤵
  PID:5608
- C:\Windows\System\jcedCYw.exe
  C:\Windows\System\jcedCYw.exe
  2⤵
  PID:6028
- C:\Windows\System\pqjsZDr.exe
  C:\Windows\System\pqjsZDr.exe
  2⤵
  PID:6092
- C:\Windows\System\GtEcpTn.exe
  C:\Windows\System\GtEcpTn.exe
  2⤵
  PID:6164
- C:\Windows\System\fxsplgX.exe
  C:\Windows\System\fxsplgX.exe
  2⤵
  PID:6184
- C:\Windows\System\ldZlXXA.exe
  C:\Windows\System\ldZlXXA.exe
  2⤵
  PID:6228
- C:\Windows\System\AUviAeA.exe
  C:\Windows\System\AUviAeA.exe
  2⤵
  PID:6248
- C:\Windows\System\iAHTuem.exe
  C:\Windows\System\iAHTuem.exe
  2⤵
  PID:6264
- C:\Windows\System\xutaDqV.exe
  C:\Windows\System\xutaDqV.exe
  2⤵
  PID:6288
- C:\Windows\System\yAXDLAa.exe
  C:\Windows\System\yAXDLAa.exe
  2⤵
  PID:6308
- C:\Windows\System\MlaFzsp.exe
  C:\Windows\System\MlaFzsp.exe
  2⤵
  PID:6348
- C:\Windows\System\wVTlsgV.exe
  C:\Windows\System\wVTlsgV.exe
  2⤵
  PID:6380
- C:\Windows\System\WUrpOEK.exe
  C:\Windows\System\WUrpOEK.exe
  2⤵
  PID:6424
- C:\Windows\System\PJxRlzE.exe
  C:\Windows\System\PJxRlzE.exe
  2⤵
  PID:6444
- C:\Windows\System\TQXfshE.exe
  C:\Windows\System\TQXfshE.exe
  2⤵
  PID:6460
- C:\Windows\System\uDwEBst.exe
  C:\Windows\System\uDwEBst.exe
  2⤵
  PID:6488
- C:\Windows\System\WaVdEfM.exe
  C:\Windows\System\WaVdEfM.exe
  2⤵
  PID:6504
- C:\Windows\System\GQAsBUr.exe
  C:\Windows\System\GQAsBUr.exe
  2⤵
  PID:6528
- C:\Windows\System\yHzUTRv.exe
  C:\Windows\System\yHzUTRv.exe
  2⤵
  PID:6544
- C:\Windows\System\CyYHJan.exe
  C:\Windows\System\CyYHJan.exe
  2⤵
  PID:6564
- C:\Windows\System\kcvQYwr.exe
  C:\Windows\System\kcvQYwr.exe
  2⤵
  PID:6588
- C:\Windows\System\MPvfQJe.exe
  C:\Windows\System\MPvfQJe.exe
  2⤵
  PID:6608
- C:\Windows\System\InpBTOj.exe
  C:\Windows\System\InpBTOj.exe
  2⤵
  PID:6628
- C:\Windows\System\SXxKBbY.exe
  C:\Windows\System\SXxKBbY.exe
  2⤵
  PID:6652
- C:\Windows\System\wXtzBvS.exe
  C:\Windows\System\wXtzBvS.exe
  2⤵
  PID:6700
- C:\Windows\System\uLDrfsi.exe
  C:\Windows\System\uLDrfsi.exe
  2⤵
  PID:6748
- C:\Windows\System\ztUJUAv.exe
  C:\Windows\System\ztUJUAv.exe
  2⤵
  PID:6788
- C:\Windows\System\pABOpSi.exe
  C:\Windows\System\pABOpSi.exe
  2⤵
  PID:6808
- C:\Windows\System\TOQKqaB.exe
  C:\Windows\System\TOQKqaB.exe
  2⤵
  PID:6856
- C:\Windows\System\LOtNyPR.exe
  C:\Windows\System\LOtNyPR.exe
  2⤵
  PID:6892
- C:\Windows\System\pMSksih.exe
  C:\Windows\System\pMSksih.exe
  2⤵
  PID:6908
- C:\Windows\System\nQjJSdx.exe
  C:\Windows\System\nQjJSdx.exe
  2⤵
  PID:6932
- C:\Windows\System\ZTVCfzM.exe
  C:\Windows\System\ZTVCfzM.exe
  2⤵
  PID:6952
- C:\Windows\System\fdAuNSH.exe
  C:\Windows\System\fdAuNSH.exe
  2⤵
  PID:6988
- C:\Windows\System\IdcdLwO.exe
  C:\Windows\System\IdcdLwO.exe
  2⤵
  PID:7012
- C:\Windows\System\HvviZWv.exe
  C:\Windows\System\HvviZWv.exe
  2⤵
  PID:7028
- C:\Windows\System\AOZcvma.exe
  C:\Windows\System\AOZcvma.exe
  2⤵
  PID:7052
- C:\Windows\System\EQUnuqM.exe
  C:\Windows\System\EQUnuqM.exe
  2⤵
  PID:7068
- C:\Windows\System\QXRDSEP.exe
  C:\Windows\System\QXRDSEP.exe
  2⤵
  PID:7084
- C:\Windows\System\MAAyLZe.exe
  C:\Windows\System\MAAyLZe.exe
  2⤵
  PID:7108
- C:\Windows\System\Pwdzbuw.exe
  C:\Windows\System\Pwdzbuw.exe
  2⤵
  PID:5920
- C:\Windows\System\DkVgSNW.exe
  C:\Windows\System\DkVgSNW.exe
  2⤵
  PID:6180
- C:\Windows\System\UIMOAXq.exe
  C:\Windows\System\UIMOAXq.exe
  2⤵
  PID:6276
- C:\Windows\System\bpwXcIy.exe
  C:\Windows\System\bpwXcIy.exe
  2⤵
  PID:6304
- C:\Windows\System\KVQIOXL.exe
  C:\Windows\System\KVQIOXL.exe
  2⤵
  PID:6368
- C:\Windows\System\HLZQTIi.exe
  C:\Windows\System\HLZQTIi.exe
  2⤵
  PID:6500
- C:\Windows\System\upmlmrq.exe
  C:\Windows\System\upmlmrq.exe
  2⤵
  PID:6596
- C:\Windows\System\AAiURhv.exe
  C:\Windows\System\AAiURhv.exe
  2⤵
  PID:6624
- C:\Windows\System\VcniuTn.exe
  C:\Windows\System\VcniuTn.exe
  2⤵
  PID:6696
- C:\Windows\System\hwTIuDc.exe
  C:\Windows\System\hwTIuDc.exe
  2⤵
  PID:6796
- C:\Windows\System\XiTNcWu.exe
  C:\Windows\System\XiTNcWu.exe
  2⤵
  PID:6836
- C:\Windows\System\cfcHupO.exe
  C:\Windows\System\cfcHupO.exe
  2⤵
  PID:6840
- C:\Windows\System\avhitre.exe
  C:\Windows\System\avhitre.exe
  2⤵
  PID:6900
- C:\Windows\System\sEnqkkI.exe
  C:\Windows\System\sEnqkkI.exe
  2⤵
  PID:6948
- C:\Windows\System\kUKjYAa.exe
  C:\Windows\System\kUKjYAa.exe
  2⤵
  PID:7020
- C:\Windows\System\htFECSh.exe
  C:\Windows\System\htFECSh.exe
  2⤵
  PID:7104
- C:\Windows\System\wiTQGKs.exe
  C:\Windows\System\wiTQGKs.exe
  2⤵
  PID:6172
- C:\Windows\System\sGVMLyW.exe
  C:\Windows\System\sGVMLyW.exe
  2⤵
  PID:6152
- C:\Windows\System\xYiGeKF.exe
  C:\Windows\System\xYiGeKF.exe
  2⤵
  PID:6244
- C:\Windows\System\nOZFAOc.exe
  C:\Windows\System\nOZFAOc.exe
  2⤵
  PID:6756
- C:\Windows\System\EHjKrEa.exe
  C:\Windows\System\EHjKrEa.exe
  2⤵
  PID:6648
- C:\Windows\System\uaigNgu.exe
  C:\Windows\System\uaigNgu.exe
  2⤵
  PID:6924
- C:\Windows\System\nIfFwia.exe
  C:\Windows\System\nIfFwia.exe
  2⤵
  PID:6972
- C:\Windows\System\agEtrgz.exe
  C:\Windows\System\agEtrgz.exe
  2⤵
  PID:7040
- C:\Windows\System\FrvDyqp.exe
  C:\Windows\System\FrvDyqp.exe
  2⤵
  PID:7080
- C:\Windows\System\vhAeRei.exe
  C:\Windows\System\vhAeRei.exe
  2⤵
  PID:7184
- C:\Windows\System\NrIfbDD.exe
  C:\Windows\System\NrIfbDD.exe
  2⤵
  PID:7200
- C:\Windows\System\aNTeXFD.exe
  C:\Windows\System\aNTeXFD.exe
  2⤵
  PID:7220
- C:\Windows\System\zrySBKp.exe
  C:\Windows\System\zrySBKp.exe
  2⤵
  PID:7244
- C:\Windows\System\HUOwsnV.exe
  C:\Windows\System\HUOwsnV.exe
  2⤵
  PID:7264
- C:\Windows\System\rRHAtlA.exe
  C:\Windows\System\rRHAtlA.exe
  2⤵
  PID:7280
- C:\Windows\System\wCCKNmv.exe
  C:\Windows\System\wCCKNmv.exe
  2⤵
  PID:7304
- C:\Windows\System\HxpJzBx.exe
  C:\Windows\System\HxpJzBx.exe
  2⤵
  PID:7328
- C:\Windows\System\QcHVoWz.exe
  C:\Windows\System\QcHVoWz.exe
  2⤵
  PID:7396
- C:\Windows\System\nXdLvLM.exe
  C:\Windows\System\nXdLvLM.exe
  2⤵
  PID:7424
- C:\Windows\System\wgKWlfH.exe
  C:\Windows\System\wgKWlfH.exe
  2⤵
  PID:7504
- C:\Windows\System\NXziwpM.exe
  C:\Windows\System\NXziwpM.exe
  2⤵
  PID:7524
- C:\Windows\System\BhQmMRf.exe
  C:\Windows\System\BhQmMRf.exe
  2⤵
  PID:7548
- C:\Windows\System\CLTnMci.exe
  C:\Windows\System\CLTnMci.exe
  2⤵
  PID:7572
- C:\Windows\System\LSlCekh.exe
  C:\Windows\System\LSlCekh.exe
  2⤵
  PID:7588
- C:\Windows\System\yPCLCPO.exe
  C:\Windows\System\yPCLCPO.exe
  2⤵
  PID:7612
- C:\Windows\System\WcZazmC.exe
  C:\Windows\System\WcZazmC.exe
  2⤵
  PID:7652
- C:\Windows\System\LjjiUJQ.exe
  C:\Windows\System\LjjiUJQ.exe
  2⤵
  PID:7672
- C:\Windows\System\sNXBLvy.exe
  C:\Windows\System\sNXBLvy.exe
  2⤵
  PID:7692
- C:\Windows\System\LYqNSZO.exe
  C:\Windows\System\LYqNSZO.exe
  2⤵
  PID:7780
- C:\Windows\System\gtxWpvZ.exe
  C:\Windows\System\gtxWpvZ.exe
  2⤵
  PID:7820
- C:\Windows\System\HWAfHDA.exe
  C:\Windows\System\HWAfHDA.exe
  2⤵
  PID:7900
- C:\Windows\System\SnZvYiE.exe
  C:\Windows\System\SnZvYiE.exe
  2⤵
  PID:7924
- C:\Windows\System\EVqPeuS.exe
  C:\Windows\System\EVqPeuS.exe
  2⤵
  PID:7948
- C:\Windows\System\RLTrYjp.exe
  C:\Windows\System\RLTrYjp.exe
  2⤵
  PID:7972
- C:\Windows\System\htxydia.exe
  C:\Windows\System\htxydia.exe
  2⤵
  PID:8008
- C:\Windows\System\VhTidUi.exe
  C:\Windows\System\VhTidUi.exe
  2⤵
  PID:8028
- C:\Windows\System\ShasXKY.exe
  C:\Windows\System\ShasXKY.exe
  2⤵
  PID:8048
- C:\Windows\System\gKFgDGH.exe
  C:\Windows\System\gKFgDGH.exe
  2⤵
  PID:8084
- C:\Windows\System\swxmmVb.exe
  C:\Windows\System\swxmmVb.exe
  2⤵
  PID:8156
- C:\Windows\System\BLEtfqO.exe
  C:\Windows\System\BLEtfqO.exe
  2⤵
  PID:8180
- C:\Windows\System\FdXmwDX.exe
  C:\Windows\System\FdXmwDX.exe
  2⤵
  PID:6844
- C:\Windows\System\mDyisNx.exe
  C:\Windows\System\mDyisNx.exe
  2⤵
  PID:6764
- C:\Windows\System\sWsScWq.exe
  C:\Windows\System\sWsScWq.exe
  2⤵
  PID:6680
- C:\Windows\System\xfUGaEr.exe
  C:\Windows\System\xfUGaEr.exe
  2⤵
  PID:5372
- C:\Windows\System\NeXDRAP.exe
  C:\Windows\System\NeXDRAP.exe
  2⤵
  PID:6416
- C:\Windows\System\QvMMFSM.exe
  C:\Windows\System\QvMMFSM.exe
  2⤵
  PID:6780
- C:\Windows\System\faRBMdM.exe
  C:\Windows\System\faRBMdM.exe
  2⤵
  PID:6512
- C:\Windows\System\QTughzv.exe
  C:\Windows\System\QTughzv.exe
  2⤵
  PID:7276
- C:\Windows\System\IptyIba.exe
  C:\Windows\System\IptyIba.exe
  2⤵
  PID:7100
- C:\Windows\System\JfiHVrY.exe
  C:\Windows\System\JfiHVrY.exe
  2⤵
  PID:7412
- C:\Windows\System\HosQlaS.exe
  C:\Windows\System\HosQlaS.exe
  2⤵
  PID:7440
- C:\Windows\System\ShDYBtt.exe
  C:\Windows\System\ShDYBtt.exe
  2⤵
  PID:7480
- C:\Windows\System\vYnDTdd.exe
  C:\Windows\System\vYnDTdd.exe
  2⤵
  PID:7756
- C:\Windows\System\ZRABnOS.exe
  C:\Windows\System\ZRABnOS.exe
  2⤵
  PID:7568
- C:\Windows\System\umMzxGz.exe
  C:\Windows\System\umMzxGz.exe
  2⤵
  PID:7732
- C:\Windows\System\Nyhzrkd.exe
  C:\Windows\System\Nyhzrkd.exe
  2⤵
  PID:7908
- C:\Windows\System\zhNCjPk.exe
  C:\Windows\System\zhNCjPk.exe
  2⤵
  PID:7968
- C:\Windows\System\opnQAyv.exe
  C:\Windows\System\opnQAyv.exe
  2⤵
  PID:7996
- C:\Windows\System\KaiDZjO.exe
  C:\Windows\System\KaiDZjO.exe
  2⤵
  PID:8020
- C:\Windows\System\oRJOwbE.exe
  C:\Windows\System\oRJOwbE.exe
  2⤵
  PID:8108
- C:\Windows\System\ihBkBDT.exe
  C:\Windows\System\ihBkBDT.exe
  2⤵
  PID:8152
- C:\Windows\System\qhvjjXz.exe
  C:\Windows\System\qhvjjXz.exe
  2⤵
  PID:7180
- C:\Windows\System\jtZExfs.exe
  C:\Windows\System\jtZExfs.exe
  2⤵
  PID:6436
- C:\Windows\System\wxgcCGd.exe
  C:\Windows\System\wxgcCGd.exe
  2⤵
  PID:7060
- C:\Windows\System\zaAgsXR.exe
  C:\Windows\System\zaAgsXR.exe
  2⤵
  PID:7272
- C:\Windows\System\kVZgCBq.exe
  C:\Windows\System\kVZgCBq.exe
  2⤵
  PID:7516
- C:\Windows\System\kfMEhkJ.exe
  C:\Windows\System\kfMEhkJ.exe
  2⤵
  PID:7960
- C:\Windows\System\DcXFZep.exe
  C:\Windows\System\DcXFZep.exe
  2⤵
  PID:8072
- C:\Windows\System\lScufxk.exe
  C:\Windows\System\lScufxk.exe
  2⤵
  PID:8044
- C:\Windows\System\SDyyrBh.exe
  C:\Windows\System\SDyyrBh.exe
  2⤵
  PID:8116
- C:\Windows\System\rjABFBj.exe
  C:\Windows\System\rjABFBj.exe
  2⤵
  PID:7360
- C:\Windows\System\EKmNRHP.exe
  C:\Windows\System\EKmNRHP.exe
  2⤵
  PID:6220
- C:\Windows\System\HNfEFDX.exe
  C:\Windows\System\HNfEFDX.exe
  2⤵
  PID:7772
- C:\Windows\System\oThlVaU.exe
  C:\Windows\System\oThlVaU.exe
  2⤵
  PID:7944
- C:\Windows\System\TBsOxKS.exe
  C:\Windows\System\TBsOxKS.exe
  2⤵
  PID:8080
- C:\Windows\System\OkejfAW.exe
  C:\Windows\System\OkejfAW.exe
  2⤵
  PID:8212
- C:\Windows\System\wGyJNTc.exe
  C:\Windows\System\wGyJNTc.exe
  2⤵
  PID:8244
- C:\Windows\System\RKBbqfo.exe
  C:\Windows\System\RKBbqfo.exe
  2⤵
  PID:8276
- C:\Windows\System\FZrmnkW.exe
  C:\Windows\System\FZrmnkW.exe
  2⤵
  PID:8300
- C:\Windows\System\EZEuPek.exe
  C:\Windows\System\EZEuPek.exe
  2⤵
  PID:8320
- C:\Windows\System\TLtHEEk.exe
  C:\Windows\System\TLtHEEk.exe
  2⤵
  PID:8360
- C:\Windows\System\XYsRoPT.exe
  C:\Windows\System\XYsRoPT.exe
  2⤵
  PID:8408
- C:\Windows\System\LtumWdq.exe
  C:\Windows\System\LtumWdq.exe
  2⤵
  PID:8432
- C:\Windows\System\uxFCTPr.exe
  C:\Windows\System\uxFCTPr.exe
  2⤵
  PID:8480
- C:\Windows\System\kjMAZcO.exe
  C:\Windows\System\kjMAZcO.exe
  2⤵
  PID:8500
- C:\Windows\System\CcvDdRM.exe
  C:\Windows\System\CcvDdRM.exe
  2⤵
  PID:8528
- C:\Windows\System\sMEKRTW.exe
  C:\Windows\System\sMEKRTW.exe
  2⤵
  PID:8548
- C:\Windows\System\teYetSl.exe
  C:\Windows\System\teYetSl.exe
  2⤵
  PID:8576
- C:\Windows\System\afClhzi.exe
  C:\Windows\System\afClhzi.exe
  2⤵
  PID:8616
- C:\Windows\System\bmlJZia.exe
  C:\Windows\System\bmlJZia.exe
  2⤵
  PID:8640
- C:\Windows\System\hExeIsd.exe
  C:\Windows\System\hExeIsd.exe
  2⤵
  PID:8680
- C:\Windows\System\NXmmnFk.exe
  C:\Windows\System\NXmmnFk.exe
  2⤵
  PID:8704
- C:\Windows\System\wZLXTYJ.exe
  C:\Windows\System\wZLXTYJ.exe
  2⤵
  PID:8724
- C:\Windows\System\XCXZvSr.exe
  C:\Windows\System\XCXZvSr.exe
  2⤵
  PID:8748
- C:\Windows\System\GowQhYQ.exe
  C:\Windows\System\GowQhYQ.exe
  2⤵
  PID:8776
- C:\Windows\System\sPDqbvN.exe
  C:\Windows\System\sPDqbvN.exe
  2⤵
  PID:8808
- C:\Windows\System\TmHPFps.exe
  C:\Windows\System\TmHPFps.exe
  2⤵
  PID:8824
- C:\Windows\System\dIQYMoj.exe
  C:\Windows\System\dIQYMoj.exe
  2⤵
  PID:8844
- C:\Windows\System\daHJmnA.exe
  C:\Windows\System\daHJmnA.exe
  2⤵
  PID:8872
- C:\Windows\System\YYRimWs.exe
  C:\Windows\System\YYRimWs.exe
  2⤵
  PID:8912
- C:\Windows\System\mcSuLNz.exe
  C:\Windows\System\mcSuLNz.exe
  2⤵
  PID:8932
- C:\Windows\System\ssJqhJQ.exe
  C:\Windows\System\ssJqhJQ.exe
  2⤵
  PID:8980
- C:\Windows\System\VJUYixz.exe
  C:\Windows\System\VJUYixz.exe
  2⤵
  PID:9000
- C:\Windows\System\oLeueVR.exe
  C:\Windows\System\oLeueVR.exe
  2⤵
  PID:9036
- C:\Windows\System\duWSJRc.exe
  C:\Windows\System\duWSJRc.exe
  2⤵
  PID:9056
- C:\Windows\System\mOSPnvD.exe
  C:\Windows\System\mOSPnvD.exe
  2⤵
  PID:9084
- C:\Windows\System\kYXsdCZ.exe
  C:\Windows\System\kYXsdCZ.exe
  2⤵
  PID:9108
- C:\Windows\System\SFJlQUx.exe
  C:\Windows\System\SFJlQUx.exe
  2⤵
  PID:9128
- C:\Windows\System\aDIaOjY.exe
  C:\Windows\System\aDIaOjY.exe
  2⤵
  PID:9156
- C:\Windows\System\yQURhyi.exe
  C:\Windows\System\yQURhyi.exe
  2⤵
  PID:9184
- C:\Windows\System\pvRfDHT.exe
  C:\Windows\System\pvRfDHT.exe
  2⤵
  PID:9204
- C:\Windows\System\CyPjvIx.exe
  C:\Windows\System\CyPjvIx.exe
  2⤵
  PID:8220
- C:\Windows\System\YXxIFoi.exe
  C:\Windows\System\YXxIFoi.exe
  2⤵
  PID:8292
- C:\Windows\System\ZFhUGDr.exe
  C:\Windows\System\ZFhUGDr.exe
  2⤵
  PID:7076
- C:\Windows\System\YdPwdfb.exe
  C:\Windows\System\YdPwdfb.exe
  2⤵
  PID:8384
- C:\Windows\System\souYcET.exe
  C:\Windows\System\souYcET.exe
  2⤵
  PID:8496
- C:\Windows\System\hojdsev.exe
  C:\Windows\System\hojdsev.exe
  2⤵
  PID:8572
- C:\Windows\System\dFrFEPA.exe
  C:\Windows\System\dFrFEPA.exe
  2⤵
  PID:8608
- C:\Windows\System\ejvZdFq.exe
  C:\Windows\System\ejvZdFq.exe
  2⤵
  PID:8660
- C:\Windows\System\nUlQoyH.exe
  C:\Windows\System\nUlQoyH.exe
  2⤵
  PID:8712
- C:\Windows\System\QJgxpDg.exe
  C:\Windows\System\QJgxpDg.exe
  2⤵
  PID:8764
- C:\Windows\System\szGyqPq.exe
  C:\Windows\System\szGyqPq.exe
  2⤵
  PID:8852
- C:\Windows\System\THrSAXL.exe
  C:\Windows\System\THrSAXL.exe
  2⤵
  PID:8860
- C:\Windows\System\fmWxeZE.exe
  C:\Windows\System\fmWxeZE.exe
  2⤵
  PID:8940
- C:\Windows\System\HZwPERA.exe
  C:\Windows\System\HZwPERA.exe
  2⤵
  PID:8976
- C:\Windows\System\KljMwOH.exe
  C:\Windows\System\KljMwOH.exe
  2⤵
  PID:9032
- C:\Windows\System\FkYhLHE.exe
  C:\Windows\System\FkYhLHE.exe
  2⤵
  PID:9124
- C:\Windows\System\heBWkIq.exe
  C:\Windows\System\heBWkIq.exe
  2⤵
  PID:8288
- C:\Windows\System\acdTLAc.exe
  C:\Windows\System\acdTLAc.exe
  2⤵
  PID:8440
- C:\Windows\System\dsIirqP.exe
  C:\Windows\System\dsIirqP.exe
  2⤵
  PID:8516
- C:\Windows\System\wWPnDMS.exe
  C:\Windows\System\wWPnDMS.exe
  2⤵
  PID:8696
- C:\Windows\System\qgxsyOv.exe
  C:\Windows\System\qgxsyOv.exe
  2⤵
  PID:8892
- C:\Windows\System\QFbwCaz.exe
  C:\Windows\System\QFbwCaz.exe
  2⤵
  PID:8840
- C:\Windows\System\xHmPNHX.exe
  C:\Windows\System\xHmPNHX.exe
  2⤵
  PID:624
- C:\Windows\System\mIlQXOz.exe
  C:\Windows\System\mIlQXOz.exe
  2⤵
  PID:9168
- C:\Windows\System\IIhPOKr.exe
  C:\Windows\System\IIhPOKr.exe
  2⤵
  PID:9104
- C:\Windows\System\PpLyRgn.exe
  C:\Windows\System\PpLyRgn.exe
  2⤵
  PID:9048
- C:\Windows\System\mKkhLxD.exe
  C:\Windows\System\mKkhLxD.exe
  2⤵
  PID:8992
- C:\Windows\System\OnlAhDO.exe
  C:\Windows\System\OnlAhDO.exe
  2⤵
  PID:9240
- C:\Windows\System\YaUcPYz.exe
  C:\Windows\System\YaUcPYz.exe
  2⤵
  PID:9256
- C:\Windows\System\PasGXCA.exe
  C:\Windows\System\PasGXCA.exe
  2⤵
  PID:9276
- C:\Windows\System\BXXqIwV.exe
  C:\Windows\System\BXXqIwV.exe
  2⤵
  PID:9308
- C:\Windows\System\WEDUfxi.exe
  C:\Windows\System\WEDUfxi.exe
  2⤵
  PID:9324
- C:\Windows\System\wVcUAsp.exe
  C:\Windows\System\wVcUAsp.exe
  2⤵
  PID:9352
- C:\Windows\System\qnVdXIB.exe
  C:\Windows\System\qnVdXIB.exe
  2⤵
  PID:9368
- C:\Windows\System\fCoXjbM.exe
  C:\Windows\System\fCoXjbM.exe
  2⤵
  PID:9392
- C:\Windows\System\YcxXQSh.exe
  C:\Windows\System\YcxXQSh.exe
  2⤵
  PID:9436
- C:\Windows\System\gOsCifB.exe
  C:\Windows\System\gOsCifB.exe
  2⤵
  PID:9480
- C:\Windows\System\lfDldqk.exe
  C:\Windows\System\lfDldqk.exe
  2⤵
  PID:9500
- C:\Windows\System\ylSsDRb.exe
  C:\Windows\System\ylSsDRb.exe
  2⤵
  PID:9524
- C:\Windows\System\UktekyA.exe
  C:\Windows\System\UktekyA.exe
  2⤵
  PID:9544
- C:\Windows\System\obOoYPR.exe
  C:\Windows\System\obOoYPR.exe
  2⤵
  PID:9568
- C:\Windows\System\YaOGCbZ.exe
  C:\Windows\System\YaOGCbZ.exe
  2⤵
  PID:9600
- C:\Windows\System\KkGKqZV.exe
  C:\Windows\System\KkGKqZV.exe
  2⤵
  PID:9620
- C:\Windows\System\sZKsXta.exe
  C:\Windows\System\sZKsXta.exe
  2⤵
  PID:9684
- C:\Windows\System\OLxXgcb.exe
  C:\Windows\System\OLxXgcb.exe
  2⤵
  PID:9708
- C:\Windows\System\qjrnXGw.exe
  C:\Windows\System\qjrnXGw.exe
  2⤵
  PID:9732
- C:\Windows\System\lhRcWSv.exe
  C:\Windows\System\lhRcWSv.exe
  2⤵
  PID:9776
- C:\Windows\System\QgPYsbJ.exe
  C:\Windows\System\QgPYsbJ.exe
  2⤵
  PID:9792
- C:\Windows\System\nQHfFWp.exe
  C:\Windows\System\nQHfFWp.exe
  2⤵
  PID:9812
- C:\Windows\System\BWEWMdl.exe
  C:\Windows\System\BWEWMdl.exe
  2⤵
  PID:9852
- C:\Windows\System\fhEXrtq.exe
  C:\Windows\System\fhEXrtq.exe
  2⤵
  PID:9868
- C:\Windows\System\lvUNeez.exe
  C:\Windows\System\lvUNeez.exe
  2⤵
  PID:9956
- C:\Windows\System\nZTFlwz.exe
  C:\Windows\System\nZTFlwz.exe
  2⤵
  PID:9972
- C:\Windows\System\HHsnyHu.exe
  C:\Windows\System\HHsnyHu.exe
  2⤵
  PID:9988
- C:\Windows\System\qGtXgOz.exe
  C:\Windows\System\qGtXgOz.exe
  2⤵
  PID:10008
- C:\Windows\System\WiTZGiO.exe
  C:\Windows\System\WiTZGiO.exe
  2⤵
  PID:10028
- C:\Windows\System\Acndxjn.exe
  C:\Windows\System\Acndxjn.exe
  2⤵
  PID:10044
- C:\Windows\System\ftQJkeH.exe
  C:\Windows\System\ftQJkeH.exe
  2⤵
  PID:10064
- C:\Windows\System\mdEiUru.exe
  C:\Windows\System\mdEiUru.exe
  2⤵
  PID:10092
- C:\Windows\System\tqzppNJ.exe
  C:\Windows\System\tqzppNJ.exe
  2⤵
  PID:10112
- C:\Windows\System\aeBcogc.exe
  C:\Windows\System\aeBcogc.exe
  2⤵
  PID:10188
- C:\Windows\System\ZVbcyCC.exe
  C:\Windows\System\ZVbcyCC.exe
  2⤵
  PID:10204
- C:\Windows\System\sTQizvm.exe
  C:\Windows\System\sTQizvm.exe
  2⤵
  PID:10232
- C:\Windows\System\dvdZTBg.exe
  C:\Windows\System\dvdZTBg.exe
  2⤵
  PID:9232
- C:\Windows\System\KjSMsPG.exe
  C:\Windows\System\KjSMsPG.exe
  2⤵
  PID:9268
- C:\Windows\System\PdeiYqA.exe
  C:\Windows\System\PdeiYqA.exe
  2⤵
  PID:9332
- C:\Windows\System\hBiCriW.exe
  C:\Windows\System\hBiCriW.exe
  2⤵
  PID:9420
- C:\Windows\System\NDXqdjX.exe
  C:\Windows\System\NDXqdjX.exe
  2⤵
  PID:9468
- C:\Windows\System\mGRsEqK.exe
  C:\Windows\System\mGRsEqK.exe
  2⤵
  PID:9496
- C:\Windows\System\YxVQjJN.exe
  C:\Windows\System\YxVQjJN.exe
  2⤵
  PID:9520
- C:\Windows\System\NIuyKKB.exe
  C:\Windows\System\NIuyKKB.exe
  2⤵
  PID:9584
- C:\Windows\System\kWnKmNr.exe
  C:\Windows\System\kWnKmNr.exe
  2⤵
  PID:9692
- C:\Windows\System\HnDGZbm.exe
  C:\Windows\System\HnDGZbm.exe
  2⤵
  PID:440
- C:\Windows\System\sLmQYIl.exe
  C:\Windows\System\sLmQYIl.exe
  2⤵
  PID:9836
- C:\Windows\System\Jxeeevi.exe
  C:\Windows\System\Jxeeevi.exe
  2⤵
  PID:972
- C:\Windows\System\MhqybGs.exe
  C:\Windows\System\MhqybGs.exe
  2⤵
  PID:9948
- C:\Windows\System\BpXsicb.exe
  C:\Windows\System\BpXsicb.exe
  2⤵
  PID:10016
- C:\Windows\System\ZRcMNiW.exe
  C:\Windows\System\ZRcMNiW.exe
  2⤵
  PID:10040
- C:\Windows\System\KcUpObm.exe
  C:\Windows\System\KcUpObm.exe
  2⤵
  PID:10104
- C:\Windows\System\XRMZGkb.exe
  C:\Windows\System\XRMZGkb.exe
  2⤵
  PID:10176
- C:\Windows\System\GnxlSJi.exe
  C:\Windows\System\GnxlSJi.exe
  2⤵
  PID:1900
- C:\Windows\System\otmCDzO.exe
  C:\Windows\System\otmCDzO.exe
  2⤵
  PID:9248
- C:\Windows\System\DLsWEhI.exe
  C:\Windows\System\DLsWEhI.exe
  2⤵
  PID:3716
- C:\Windows\System\dFpZdmv.exe
  C:\Windows\System\dFpZdmv.exe
  2⤵
  PID:9652
- C:\Windows\System\Annrlbw.exe
  C:\Windows\System\Annrlbw.exe
  2⤵
  PID:9768
- C:\Windows\System\DhwHdBW.exe
  C:\Windows\System\DhwHdBW.exe
  2⤵
  PID:9808
- C:\Windows\System\TtqtxOH.exe
  C:\Windows\System\TtqtxOH.exe
  2⤵
  PID:10024
- C:\Windows\System\AoGjPTM.exe
  C:\Windows\System\AoGjPTM.exe
  2⤵
  PID:9980
- C:\Windows\System\dQXbmbj.exe
  C:\Windows\System\dQXbmbj.exe
  2⤵
  PID:10084
- C:\Windows\System\bkAjLHp.exe
  C:\Windows\System\bkAjLHp.exe
  2⤵
  PID:1444
- C:\Windows\System\SmZLgXB.exe
  C:\Windows\System\SmZLgXB.exe
  2⤵
  PID:9848
- C:\Windows\System\iydXwgS.exe
  C:\Windows\System\iydXwgS.exe
  2⤵
  PID:9964
- C:\Windows\System\GGrUBAa.exe
  C:\Windows\System\GGrUBAa.exe
  2⤵
  PID:10136
- C:\Windows\System\ySosZMb.exe
  C:\Windows\System\ySosZMb.exe
  2⤵
  PID:10252
- C:\Windows\System\kSdxhBR.exe
  C:\Windows\System\kSdxhBR.exe
  2⤵
  PID:10292
- C:\Windows\System\PFzZjBQ.exe
  C:\Windows\System\PFzZjBQ.exe
  2⤵
  PID:10320
- C:\Windows\System\uWmMFln.exe
  C:\Windows\System\uWmMFln.exe
  2⤵
  PID:10340
- C:\Windows\System\hGGPGIE.exe
  C:\Windows\System\hGGPGIE.exe
  2⤵
  PID:10368
- C:\Windows\System\ozzGKdd.exe
  C:\Windows\System\ozzGKdd.exe
  2⤵
  PID:10388
- C:\Windows\System\vYjeNVj.exe
  C:\Windows\System\vYjeNVj.exe
  2⤵
  PID:10428
- C:\Windows\System\dsTmGQR.exe
  C:\Windows\System\dsTmGQR.exe
  2⤵
  PID:10484
- C:\Windows\System\rYNukHW.exe
  C:\Windows\System\rYNukHW.exe
  2⤵
  PID:10508
- C:\Windows\System\txloCql.exe
  C:\Windows\System\txloCql.exe
  2⤵
  PID:10532
- C:\Windows\System\QGnpryU.exe
  C:\Windows\System\QGnpryU.exe
  2⤵
  PID:10564
- C:\Windows\System\oplfOvN.exe
  C:\Windows\System\oplfOvN.exe
  2⤵
  PID:10584
- C:\Windows\System\KnnLwpl.exe
  C:\Windows\System\KnnLwpl.exe
  2⤵
  PID:10604
- C:\Windows\System\tGqIuCF.exe
  C:\Windows\System\tGqIuCF.exe
  2⤵
  PID:10628
- C:\Windows\System\sDMElRX.exe
  C:\Windows\System\sDMElRX.exe
  2⤵
  PID:10648
- C:\Windows\System\tuQjSPI.exe
  C:\Windows\System\tuQjSPI.exe
  2⤵
  PID:10668
- C:\Windows\System\EhwROio.exe
  C:\Windows\System\EhwROio.exe
  2⤵
  PID:10700
- C:\Windows\System\CyniWzN.exe
  C:\Windows\System\CyniWzN.exe
  2⤵
  PID:10760
- C:\Windows\System\ufOoEyp.exe
  C:\Windows\System\ufOoEyp.exe
  2⤵
  PID:10792
- C:\Windows\System\DyiNmpx.exe
  C:\Windows\System\DyiNmpx.exe
  2⤵
  PID:10812
- C:\Windows\System\GNiwVOv.exe
  C:\Windows\System\GNiwVOv.exe
  2⤵
  PID:10836
- C:\Windows\System\RHFTNwd.exe
  C:\Windows\System\RHFTNwd.exe
  2⤵
  PID:10880
- C:\Windows\System\TNDvpQN.exe
  C:\Windows\System\TNDvpQN.exe
  2⤵
  PID:10916
- C:\Windows\System\tmFfUbF.exe
  C:\Windows\System\tmFfUbF.exe
  2⤵
  PID:10936
- C:\Windows\System\pvIFQsZ.exe
  C:\Windows\System\pvIFQsZ.exe
  2⤵
  PID:10960
- C:\Windows\System\oNpokvc.exe
  C:\Windows\System\oNpokvc.exe
  2⤵
  PID:11000
- C:\Windows\System\WBymAzP.exe
  C:\Windows\System\WBymAzP.exe
  2⤵
  PID:11020
- C:\Windows\System\yGeiKPp.exe
  C:\Windows\System\yGeiKPp.exe
  2⤵
  PID:11040
- C:\Windows\System\sbXcIlo.exe
  C:\Windows\System\sbXcIlo.exe
  2⤵
  PID:11068
- C:\Windows\System\IxMDNWw.exe
  C:\Windows\System\IxMDNWw.exe
  2⤵
  PID:11088
- C:\Windows\System\PSSOYrd.exe
  C:\Windows\System\PSSOYrd.exe
  2⤵
  PID:11180
- C:\Windows\System\JqzaUsm.exe
  C:\Windows\System\JqzaUsm.exe
  2⤵
  PID:11196
- C:\Windows\System\JkYTBHr.exe
  C:\Windows\System\JkYTBHr.exe
  2⤵
  PID:11212
- C:\Windows\System\JudeRxx.exe
  C:\Windows\System\JudeRxx.exe
  2⤵
  PID:11228
- C:\Windows\System\hGOeQEP.exe
  C:\Windows\System\hGOeQEP.exe
  2⤵
  PID:11244
- C:\Windows\System\OzDPLVM.exe
  C:\Windows\System\OzDPLVM.exe
  2⤵
  PID:11260
- C:\Windows\System\BdCgIdM.exe
  C:\Windows\System\BdCgIdM.exe
  2⤵
  PID:10308
- C:\Windows\System\fdFCnIY.exe
  C:\Windows\System\fdFCnIY.exe
  2⤵
  PID:9432
- C:\Windows\System\cxNtbGM.exe
  C:\Windows\System\cxNtbGM.exe
  2⤵
  PID:10332
- C:\Windows\System\SKNUAKj.exe
  C:\Windows\System\SKNUAKj.exe
  2⤵
  PID:10284
- C:\Windows\System\lauwyED.exe
  C:\Windows\System\lauwyED.exe
  2⤵
  PID:10552
- C:\Windows\System\zVJqGhP.exe
  C:\Windows\System\zVJqGhP.exe
  2⤵
  PID:10664
- C:\Windows\System\awGrkRa.exe
  C:\Windows\System\awGrkRa.exe
  2⤵
  PID:10788
- C:\Windows\System\nbEKIqw.exe
  C:\Windows\System\nbEKIqw.exe
  2⤵
  PID:10808
- C:\Windows\System\nzpXZyZ.exe
  C:\Windows\System\nzpXZyZ.exe
  2⤵
  PID:2964
- C:\Windows\System\fYJbiit.exe
  C:\Windows\System\fYJbiit.exe
  2⤵
  PID:10872
- C:\Windows\System\rDURNDp.exe
  C:\Windows\System\rDURNDp.exe
  2⤵
  PID:11036
- C:\Windows\System\urQKuUL.exe
  C:\Windows\System\urQKuUL.exe
  2⤵
  PID:11108
- C:\Windows\System\QhjnCeP.exe
  C:\Windows\System\QhjnCeP.exe
  2⤵
  PID:11160
- C:\Windows\System\lFIBATv.exe
  C:\Windows\System\lFIBATv.exe
  2⤵
  PID:10196
- C:\Windows\System\oubRfdk.exe
  C:\Windows\System\oubRfdk.exe
  2⤵
  PID:10348
- C:\Windows\System\lNyumln.exe
  C:\Windows\System\lNyumln.exe
  2⤵
  PID:11104
- C:\Windows\System\phzooWS.exe
  C:\Windows\System\phzooWS.exe
  2⤵
  PID:11112
- C:\Windows\System\CsLLYPd.exe
  C:\Windows\System\CsLLYPd.exe
  2⤵
  PID:11256
- C:\Windows\System\HxlzRYD.exe
  C:\Windows\System\HxlzRYD.exe
  2⤵
  PID:10444
- C:\Windows\System\tJNWplb.exe
  C:\Windows\System\tJNWplb.exe
  2⤵
  PID:10548
- C:\Windows\System\cdfMyDV.exe
  C:\Windows\System\cdfMyDV.exe
  2⤵
  PID:10852
- C:\Windows\System\VCGNeJh.exe
  C:\Windows\System\VCGNeJh.exe
  2⤵
  PID:10928
- C:\Windows\System\CmzirEI.exe
  C:\Windows\System\CmzirEI.exe
  2⤵
  PID:11056
- C:\Windows\System\fTDFlPc.exe
  C:\Windows\System\fTDFlPc.exe
  2⤵
  PID:11140
- C:\Windows\System\OFNDJNd.exe
  C:\Windows\System\OFNDJNd.exe
  2⤵
  PID:11192
- C:\Windows\System\GuJbETQ.exe
  C:\Windows\System\GuJbETQ.exe
  2⤵
  PID:11172
- C:\Windows\System\PdnTrOm.exe
  C:\Windows\System\PdnTrOm.exe
  2⤵
  PID:10424
- C:\Windows\System\zZHVkxr.exe
  C:\Windows\System\zZHVkxr.exe
  2⤵
  PID:11060
- C:\Windows\System\rXOAeQO.exe
  C:\Windows\System\rXOAeQO.exe
  2⤵
  PID:11096
- C:\Windows\System\DLgXibe.exe
  C:\Windows\System\DLgXibe.exe
  2⤵
  PID:11296
- C:\Windows\System\uBAyBTV.exe
  C:\Windows\System\uBAyBTV.exe
  2⤵
  PID:11316
- C:\Windows\System\prilUco.exe
  C:\Windows\System\prilUco.exe
  2⤵
  PID:11340
- C:\Windows\System\zPGMSly.exe
  C:\Windows\System\zPGMSly.exe
  2⤵
  PID:11356
- C:\Windows\System\qejibCF.exe
  C:\Windows\System\qejibCF.exe
  2⤵
  PID:11380
- C:\Windows\System\eAGOhDq.exe
  C:\Windows\System\eAGOhDq.exe
  2⤵
  PID:11404
- C:\Windows\System\RKyaHOQ.exe
  C:\Windows\System\RKyaHOQ.exe
  2⤵
  PID:11420
- C:\Windows\System\auNKKXs.exe
  C:\Windows\System\auNKKXs.exe
  2⤵
  PID:11480
- C:\Windows\System\HEMoSjU.exe
  C:\Windows\System\HEMoSjU.exe
  2⤵
  PID:11496
- C:\Windows\System\ArgPMDi.exe
  C:\Windows\System\ArgPMDi.exe
  2⤵
  PID:11512
- C:\Windows\System\hvXErWO.exe
  C:\Windows\System\hvXErWO.exe
  2⤵
  PID:11536
- C:\Windows\System\zTHAXLA.exe
  C:\Windows\System\zTHAXLA.exe
  2⤵
  PID:11580
- C:\Windows\System\iVQwpSk.exe
  C:\Windows\System\iVQwpSk.exe
  2⤵
  PID:11620
- C:\Windows\System\tiVhaXA.exe
  C:\Windows\System\tiVhaXA.exe
  2⤵
  PID:11664
- C:\Windows\System\ovnwxPw.exe
  C:\Windows\System\ovnwxPw.exe
  2⤵
  PID:11704
- C:\Windows\System\gcEgRFD.exe
  C:\Windows\System\gcEgRFD.exe
  2⤵
  PID:11748
- C:\Windows\System\KnepQgx.exe
  C:\Windows\System\KnepQgx.exe
  2⤵
  PID:11768
- C:\Windows\System\iNWwNJL.exe
  C:\Windows\System\iNWwNJL.exe
  2⤵
  PID:11788
- C:\Windows\System\UUClemO.exe
  C:\Windows\System\UUClemO.exe
  2⤵
  PID:11812
- C:\Windows\System\nGLmWPI.exe
  C:\Windows\System\nGLmWPI.exe
  2⤵
  PID:11828
- C:\Windows\System\VORpLBY.exe
  C:\Windows\System\VORpLBY.exe
  2⤵
  PID:11848
- C:\Windows\System\Fjseqxs.exe
  C:\Windows\System\Fjseqxs.exe
  2⤵
  PID:11876
- C:\Windows\System\GFcqlfp.exe
  C:\Windows\System\GFcqlfp.exe
  2⤵
  PID:11904
- C:\Windows\System\AwOxpno.exe
  C:\Windows\System\AwOxpno.exe
  2⤵
  PID:11948
- C:\Windows\System\FsZNdMD.exe
  C:\Windows\System\FsZNdMD.exe
  2⤵
  PID:11988
- C:\Windows\System\VnpjXRB.exe
  C:\Windows\System\VnpjXRB.exe
  2⤵
  PID:12012
- C:\Windows\System\Qofcrur.exe
  C:\Windows\System\Qofcrur.exe
  2⤵
  PID:12052
- C:\Windows\System\FkZadYD.exe
  C:\Windows\System\FkZadYD.exe
  2⤵
  PID:12080
- C:\Windows\System\vhLClUD.exe
  C:\Windows\System\vhLClUD.exe
  2⤵
  PID:12100
- C:\Windows\System\DJrWubx.exe
  C:\Windows\System\DJrWubx.exe
  2⤵
  PID:12124
- C:\Windows\System\UAgotRy.exe
  C:\Windows\System\UAgotRy.exe
  2⤵
  PID:12148
- C:\Windows\System\zTwsjjc.exe
  C:\Windows\System\zTwsjjc.exe
  2⤵
  PID:12168
- C:\Windows\System\JjReVXF.exe
  C:\Windows\System\JjReVXF.exe
  2⤵
  PID:12208
- C:\Windows\System\QfWfSwM.exe
  C:\Windows\System\QfWfSwM.exe
  2⤵
  PID:12248
- C:\Windows\System\fVWredd.exe
  C:\Windows\System\fVWredd.exe
  2⤵
  PID:12268
- C:\Windows\System\OcilNNq.exe
  C:\Windows\System\OcilNNq.exe
  2⤵
  PID:3232
- C:\Windows\System\qaLDywj.exe
  C:\Windows\System\qaLDywj.exe
  2⤵
  PID:11308
- C:\Windows\System\snGiVbx.exe
  C:\Windows\System\snGiVbx.exe
  2⤵
  PID:11348
- C:\Windows\System\GsETmKX.exe
  C:\Windows\System\GsETmKX.exe
  2⤵
  PID:11368
- C:\Windows\System\ysNvUkB.exe
  C:\Windows\System\ysNvUkB.exe
  2⤵
  PID:11444
- C:\Windows\System\NSkBWMA.exe
  C:\Windows\System\NSkBWMA.exe
  2⤵
  PID:11556
- C:\Windows\System\Ksxnjqs.exe
  C:\Windows\System\Ksxnjqs.exe
  2⤵
  PID:11532
- C:\Windows\System\Znewjbi.exe
  C:\Windows\System\Znewjbi.exe
  2⤵
  PID:11592
- C:\Windows\System\BaTBeAH.exe
  C:\Windows\System\BaTBeAH.exe
  2⤵
  PID:4788
- C:\Windows\System\SriGFbx.exe
  C:\Windows\System\SriGFbx.exe
  2⤵
  PID:1600
- C:\Windows\System\nCDwKuG.exe
  C:\Windows\System\nCDwKuG.exe
  2⤵
  PID:11692
- C:\Windows\System\CgdQwgG.exe
  C:\Windows\System\CgdQwgG.exe
  2⤵
  PID:11760
- C:\Windows\System\IPEjKIU.exe
  C:\Windows\System\IPEjKIU.exe
  2⤵
  PID:11784
- C:\Windows\System\jQdxoJi.exe
  C:\Windows\System\jQdxoJi.exe
  2⤵
  PID:11884
- C:\Windows\System\YJjtUbr.exe
  C:\Windows\System\YJjtUbr.exe
  2⤵
  PID:11900
- C:\Windows\System\YAWVmvT.exe
  C:\Windows\System\YAWVmvT.exe
  2⤵
  PID:11976
- C:\Windows\System\drBWDZT.exe
  C:\Windows\System\drBWDZT.exe
  2⤵
  PID:12108
- C:\Windows\System\eBIiLEG.exe
  C:\Windows\System\eBIiLEG.exe
  2⤵
  PID:12164
- C:\Windows\System\SqnQVIw.exe
  C:\Windows\System\SqnQVIw.exe
  2⤵
  PID:12196
- C:\Windows\System\qBosGnc.exe
  C:\Windows\System\qBosGnc.exe
  2⤵
  PID:12264
- C:\Windows\System\SDUrTjd.exe
  C:\Windows\System\SDUrTjd.exe
  2⤵
  PID:11292
- C:\Windows\System\RqPGHll.exe
  C:\Windows\System\RqPGHll.exe
  2⤵
  PID:11508
- C:\Windows\System\GnRoYOa.exe
  C:\Windows\System\GnRoYOa.exe
  2⤵
  PID:1432
- C:\Windows\System\ywiQAJQ.exe
  C:\Windows\System\ywiQAJQ.exe
  2⤵
  PID:2796
- C:\Windows\System\RRdMJdz.exe
  C:\Windows\System\RRdMJdz.exe
  2⤵
  PID:11804
- C:\Windows\System\MrScEGv.exe
  C:\Windows\System\MrScEGv.exe
  2⤵
  PID:12008
- C:\Windows\System\piTaNkK.exe
  C:\Windows\System\piTaNkK.exe
  2⤵
  PID:12044
- C:\Windows\System\DyedgmW.exe
  C:\Windows\System\DyedgmW.exe
  2⤵
  PID:12092
- C:\Windows\System\RwSSxDa.exe
  C:\Windows\System\RwSSxDa.exe
  2⤵
  PID:12156
- C:\Windows\System\ZASRAeq.exe
  C:\Windows\System\ZASRAeq.exe
  2⤵
  PID:11672
- C:\Windows\System\ZsZLEFH.exe
  C:\Windows\System\ZsZLEFH.exe
  2⤵
  PID:11780
- C:\Windows\System\ldIsGeW.exe
  C:\Windows\System\ldIsGeW.exe
  2⤵
  PID:12236
- C:\Windows\System\jXjlwbZ.exe
  C:\Windows\System\jXjlwbZ.exe
  2⤵
  PID:12276
- C:\Windows\System\qNVJQVS.exe
  C:\Windows\System\qNVJQVS.exe
  2⤵
  PID:12300
- C:\Windows\System\blInMrR.exe
  C:\Windows\System\blInMrR.exe
  2⤵
  PID:12320
- C:\Windows\System\MSmVFIF.exe
  C:\Windows\System\MSmVFIF.exe
  2⤵
  PID:12360
- C:\Windows\System\GcTbYBm.exe
  C:\Windows\System\GcTbYBm.exe
  2⤵
  PID:12400
- C:\Windows\System\pmMvvFW.exe
  C:\Windows\System\pmMvvFW.exe
  2⤵
  PID:12420
- C:\Windows\System\yvFuBkf.exe
  C:\Windows\System\yvFuBkf.exe
  2⤵
  PID:12440
- C:\Windows\System\vVKinPG.exe
  C:\Windows\System\vVKinPG.exe
  2⤵
  PID:12460
- C:\Windows\System\bCYAHlR.exe
  C:\Windows\System\bCYAHlR.exe
  2⤵
  PID:12512
- C:\Windows\System\gNQGUwQ.exe
  C:\Windows\System\gNQGUwQ.exe
  2⤵
  PID:12544
- C:\Windows\System\kFHrnIV.exe
  C:\Windows\System\kFHrnIV.exe
  2⤵
  PID:12572
- C:\Windows\System\iDCnaMK.exe
  C:\Windows\System\iDCnaMK.exe
  2⤵
  PID:12592
- C:\Windows\System\ZoGVHPf.exe
  C:\Windows\System\ZoGVHPf.exe
  2⤵
  PID:12620
- C:\Windows\System\eGsiumf.exe
  C:\Windows\System\eGsiumf.exe
  2⤵
  PID:12664
- C:\Windows\System\NBKYXhT.exe
  C:\Windows\System\NBKYXhT.exe
  2⤵
  PID:12708
- C:\Windows\System\WjZeJVH.exe
  C:\Windows\System\WjZeJVH.exe
  2⤵
  PID:12732
- C:\Windows\System\rVgANxP.exe
  C:\Windows\System\rVgANxP.exe
  2⤵
  PID:12752
- C:\Windows\System\qtjJPtT.exe
  C:\Windows\System\qtjJPtT.exe
  2⤵
  PID:12780
- C:\Windows\System\FKLbkIL.exe
  C:\Windows\System\FKLbkIL.exe
  2⤵
  PID:12800
- C:\Windows\System\qjeUmUg.exe
  C:\Windows\System\qjeUmUg.exe
  2⤵
  PID:12828
- C:\Windows\System\lxCCBZX.exe
  C:\Windows\System\lxCCBZX.exe
  2⤵
  PID:12848
- C:\Windows\System\hBKZcqc.exe
  C:\Windows\System\hBKZcqc.exe
  2⤵
  PID:12920
- C:\Windows\System\LLdnDsC.exe
  C:\Windows\System\LLdnDsC.exe
  2⤵
  PID:12944
- C:\Windows\System\QLSovwq.exe
  C:\Windows\System\QLSovwq.exe
  2⤵
  PID:12960
- C:\Windows\System\hzwIoYV.exe
  C:\Windows\System\hzwIoYV.exe
  2⤵
  PID:12992
- C:\Windows\System\HKHKsYu.exe
  C:\Windows\System\HKHKsYu.exe
  2⤵
  PID:13012
- C:\Windows\System\ACuTLhG.exe
  C:\Windows\System\ACuTLhG.exe
  2⤵
  PID:13032
- C:\Windows\System\dcJugvJ.exe
  C:\Windows\System\dcJugvJ.exe
  2⤵
  PID:13056
- C:\Windows\System\tHZawZe.exe
  C:\Windows\System\tHZawZe.exe
  2⤵
  PID:13076
- C:\Windows\System\luyWCWg.exe
  C:\Windows\System\luyWCWg.exe
  2⤵
  PID:13092
- C:\Windows\System\LbnHOcU.exe
  C:\Windows\System\LbnHOcU.exe
  2⤵
  PID:13116
- C:\Windows\System\mDHZcdH.exe
  C:\Windows\System\mDHZcdH.exe
  2⤵
  PID:13140
- C:\Windows\System\HJXKbNG.exe
  C:\Windows\System\HJXKbNG.exe
  2⤵
  PID:13160
- C:\Windows\System\yfqmZbD.exe
  C:\Windows\System\yfqmZbD.exe
  2⤵
  PID:13204
- C:\Windows\System\xvAxarW.exe
  C:\Windows\System\xvAxarW.exe
  2⤵
  PID:13224
- C:\Windows\System\VOUShqZ.exe
  C:\Windows\System\VOUShqZ.exe
  2⤵
  PID:13244
- C:\Windows\System\NeyedwP.exe
  C:\Windows\System\NeyedwP.exe
  2⤵
  PID:13264
- C:\Windows\System\ykLVoVq.exe
  C:\Windows\System\ykLVoVq.exe
  2⤵
  PID:13292
- C:\Windows\System\qrVbbQL.exe
  C:\Windows\System\qrVbbQL.exe
  2⤵
  PID:11548
- C:\Windows\System\ckrzFod.exe
  C:\Windows\System\ckrzFod.exe
  2⤵
  PID:12316
- C:\Windows\System\joCPkPr.exe
  C:\Windows\System\joCPkPr.exe
  2⤵
  PID:12388
- C:\Windows\System\njxPqLx.exe
  C:\Windows\System\njxPqLx.exe
  2⤵
  PID:12416
- C:\Windows\System\giVuCto.exe
  C:\Windows\System\giVuCto.exe
  2⤵
  PID:12452
- C:\Windows\System\uUOKnBD.exe
  C:\Windows\System\uUOKnBD.exe
  2⤵
  PID:12540
- C:\Windows\System\SIatelq.exe
  C:\Windows\System\SIatelq.exe
  2⤵
  PID:12584
- C:\Windows\System\YvJEabv.exe
  C:\Windows\System\YvJEabv.exe
  2⤵
  PID:12700
- C:\Windows\System\DyugDdM.exe
  C:\Windows\System\DyugDdM.exe
  2⤵
  PID:12792
- C:\Windows\System\dbghxws.exe
  C:\Windows\System\dbghxws.exe
  2⤵
  PID:12884
- C:\Windows\System\wwGYqBL.exe
  C:\Windows\System\wwGYqBL.exe
  2⤵
  PID:12928
- C:\Windows\System\YCDvxYL.exe
  C:\Windows\System\YCDvxYL.exe
  2⤵
  PID:12988
- C:\Windows\System\icjJneR.exe
  C:\Windows\System\icjJneR.exe
  2⤵
  PID:13000
- C:\Windows\System\BYaVRaw.exe
  C:\Windows\System\BYaVRaw.exe
  2⤵
  PID:13068
- C:\Windows\System\JYIbnKE.exe
  C:\Windows\System\JYIbnKE.exe
  2⤵
  PID:13156
- C:\Windows\System\VIcDPIp.exe
  C:\Windows\System\VIcDPIp.exe
  2⤵
  PID:12640
- C:\Windows\System\YuYQbhr.exe
  C:\Windows\System\YuYQbhr.exe
  2⤵
  PID:4500
- C:\Windows\System\FMDaUHJ.exe
  C:\Windows\System\FMDaUHJ.exe
  2⤵
  PID:4008
- C:\Windows\System\QQpMFZK.exe
  C:\Windows\System\QQpMFZK.exe
  2⤵
  PID:3308
- C:\Windows\System\ekQMqvh.exe
  C:\Windows\System\ekQMqvh.exe
  2⤵
  PID:12724
- C:\Windows\System\saEGUKU.exe
  C:\Windows\System\saEGUKU.exe
  2⤵
  PID:4980
- C:\Windows\System\EaPOQgk.exe
  C:\Windows\System\EaPOQgk.exe
  2⤵
  PID:13024
- C:\Windows\System\cJwzsHF.exe
  C:\Windows\System\cJwzsHF.exe
  2⤵
  PID:4940
- C:\Windows\System\whlObNg.exe
  C:\Windows\System\whlObNg.exe
  2⤵
  PID:2684
- C:\Windows\System\yKFLxKZ.exe
  C:\Windows\System\yKFLxKZ.exe
  2⤵
  PID:1768
- C:\Windows\System\ExltJWD.exe
  C:\Windows\System\ExltJWD.exe
  2⤵
  PID:12936
- C:\Windows\System\XaVKwPh.exe
  C:\Windows\System\XaVKwPh.exe
  2⤵
  PID:13124
- C:\Windows\System\ipexkRu.exe
  C:\Windows\System\ipexkRu.exe
  2⤵
  PID:2820
- C:\Windows\System\zmODVpu.exe
  C:\Windows\System\zmODVpu.exe
  2⤵
  PID:4452
- C:\Windows\System\WTcURkT.exe
  C:\Windows\System\WTcURkT.exe
  2⤵
  PID:3264
- C:\Windows\System\jXHVNsM.exe
  C:\Windows\System\jXHVNsM.exe
  2⤵
  PID:6736
- C:\Windows\System\nwDPddv.exe
  C:\Windows\System\nwDPddv.exe
  2⤵
  PID:5368
- C:\Windows\System\KEpvTWb.exe
  C:\Windows\System\KEpvTWb.exe
  2⤵
  PID:3268
- C:\Windows\System\YNpqXHO.exe
  C:\Windows\System\YNpqXHO.exe
  2⤵
  PID:12952
- C:\Windows\System\qmelTrd.exe
  C:\Windows\System\qmelTrd.exe
  2⤵
  PID:5632
- C:\Windows\System\JhJAClf.exe
  C:\Windows\System\JhJAClf.exe
  2⤵
  PID:4232
- C:\Windows\System\gIyzYpz.exe
  C:\Windows\System\gIyzYpz.exe
  2⤵
  PID:13236
- C:\Windows\System\jRRKZsQ.exe
  C:\Windows\System\jRRKZsQ.exe
  2⤵
  PID:1412
- C:\Windows\System\oLlcdbN.exe
  C:\Windows\System\oLlcdbN.exe
  2⤵
  PID:13216
- C:\Windows\System\YMScEsm.exe
  C:\Windows\System\YMScEsm.exe
  2⤵
  PID:1788
- C:\Windows\System\bdYKVkJ.exe
  C:\Windows\System\bdYKVkJ.exe
  2⤵
  PID:4868
- C:\Windows\System\pcYpIYm.exe
  C:\Windows\System\pcYpIYm.exe
  2⤵
  PID:2124
- C:\Windows\System\gsZMXsM.exe
  C:\Windows\System\gsZMXsM.exe
  2⤵
  PID:2660
- C:\Windows\System\OEofitd.exe
  C:\Windows\System\OEofitd.exe
  2⤵
  PID:9380
- C:\Windows\System\ALYjSMH.exe
  C:\Windows\System\ALYjSMH.exe
  2⤵
  PID:8104
- C:\Windows\System\QbLuSJj.exe
  C:\Windows\System\QbLuSJj.exe
  2⤵
  PID:2608
- C:\Windows\System\bnNFJWK.exe
  C:\Windows\System\bnNFJWK.exe
  2⤵
  PID:4508
- C:\Windows\System\ELbkHik.exe
  C:\Windows\System\ELbkHik.exe
  2⤵
  PID:2208
- C:\Windows\System\SeLEXNC.exe
  C:\Windows\System\SeLEXNC.exe
  2⤵
  PID:5164
- C:\Windows\System\omGVyhI.exe
  C:\Windows\System\omGVyhI.exe
  2⤵
  PID:5288
- C:\Windows\System\hJldFsg.exe
  C:\Windows\System\hJldFsg.exe
  2⤵
  PID:6260
- C:\Windows\System\hBhyIqL.exe
  C:\Windows\System\hBhyIqL.exe
  2⤵
  PID:4316
- C:\Windows\System\ERdnYJi.exe
  C:\Windows\System\ERdnYJi.exe
  2⤵
  PID:13308
- C:\Windows\System\vQeOlpL.exe
  C:\Windows\System\vQeOlpL.exe
  2⤵
  PID:10720
- C:\Windows\System\ywwbBpr.exe
  C:\Windows\System\ywwbBpr.exe
  2⤵
  PID:8928
- C:\Windows\System\uAUfmne.exe
  C:\Windows\System\uAUfmne.exe
  2⤵
  PID:10132
- C:\Windows\System\NVUdWCN.exe
  C:\Windows\System\NVUdWCN.exe
  2⤵
  PID:10864
- C:\Windows\System\rKOMmPL.exe
  C:\Windows\System\rKOMmPL.exe
  2⤵
  PID:7608
- C:\Windows\System\lDQRrFp.exe
  C:\Windows\System\lDQRrFp.exe
  2⤵
  PID:7812
- C:\Windows\System\cAcrobf.exe
  C:\Windows\System\cAcrobf.exe
  2⤵
  PID:9800
- C:\Windows\System\xJzkZYu.exe
  C:\Windows\System\xJzkZYu.exe
  2⤵
  PID:3788
- C:\Windows\System\oMwuKyT.exe
  C:\Windows\System\oMwuKyT.exe
  2⤵
  PID:7848
- C:\Windows\System\vhBuZZp.exe
  C:\Windows\System\vhBuZZp.exe
  2⤵
  PID:4484
- C:\Windows\System\wqoNizX.exe
  C:\Windows\System\wqoNizX.exe
  2⤵
  PID:4536
- C:\Windows\System\MdphJRk.exe
  C:\Windows\System\MdphJRk.exe
  2⤵
  PID:9400
- C:\Windows\System\PEUMFAz.exe
  C:\Windows\System\PEUMFAz.exe
  2⤵
  PID:12680
- C:\Windows\System\qzivxbO.exe
  C:\Windows\System\qzivxbO.exe
  2⤵
  PID:8400
- C:\Windows\System\YoOMdDJ.exe
  C:\Windows\System\YoOMdDJ.exe
  2⤵
  PID:8472
- C:\Windows\System\UoVPYzk.exe
  C:\Windows\System\UoVPYzk.exe
  2⤵
  PID:8452
- C:\Windows\System\OumLxZk.exe
  C:\Windows\System\OumLxZk.exe
  2⤵
  PID:5136
- C:\Windows\System\vtPrktP.exe
  C:\Windows\System\vtPrktP.exe
  2⤵
  PID:9284
- C:\Windows\System\ZVDFgrI.exe
  C:\Windows\System\ZVDFgrI.exe
  2⤵
  PID:6012
- C:\Windows\System\cAxkQKk.exe
  C:\Windows\System\cAxkQKk.exe
  2⤵
  PID:7316
- C:\Windows\System\zmEDuyu.exe
  C:\Windows\System\zmEDuyu.exe
  2⤵
  PID:10544
- C:\Windows\System\gvCqWNR.exe
  C:\Windows\System\gvCqWNR.exe
  2⤵
  PID:8796
- C:\Windows\System\mhHxuGT.exe
  C:\Windows\System\mhHxuGT.exe
  2⤵
  PID:8964
- C:\Windows\System\QBbFEdA.exe
  C:\Windows\System\QBbFEdA.exe
  2⤵
  PID:4976
- C:\Windows\System\DqkeFtA.exe
  C:\Windows\System\DqkeFtA.exe
  2⤵
  PID:9016
- C:\Windows\System\vxWfzCx.exe
  C:\Windows\System\vxWfzCx.exe
  2⤵
  PID:9932
- C:\Windows\System\IlrSpZz.exe
  C:\Windows\System\IlrSpZz.exe
  2⤵
  PID:10908
- C:\Windows\System\SFohzCA.exe
  C:\Windows\System\SFohzCA.exe
  2⤵
  PID:11148
- C:\Windows\System\aUPNaGz.exe
  C:\Windows\System\aUPNaGz.exe
  2⤵
  PID:3176
- C:\Windows\System\AGBGxPu.exe
  C:\Windows\System\AGBGxPu.exe
  2⤵
  PID:9300
- C:\Windows\System\SkhynVU.exe
  C:\Windows\System\SkhynVU.exe
  2⤵
  PID:13180
- C:\Windows\System\pLdVHie.exe
  C:\Windows\System\pLdVHie.exe
  2⤵
  PID:7828
- C:\Windows\System\TKnkvVJ.exe
  C:\Windows\System\TKnkvVJ.exe
  2⤵
  PID:8380
- C:\Windows\System\bPVUtcp.exe
  C:\Windows\System\bPVUtcp.exe
  2⤵
  PID:7892
- C:\Windows\System\bVrnJSG.exe
  C:\Windows\System\bVrnJSG.exe
  2⤵
  PID:1884
- C:\Windows\System\TRGNJTS.exe
  C:\Windows\System\TRGNJTS.exe
  2⤵
  PID:9288
- C:\Windows\System\GQinXMI.exe
  C:\Windows\System\GQinXMI.exe
  2⤵
  PID:11372
- C:\Windows\System\yHNDEBR.exe
  C:\Windows\System\yHNDEBR.exe
  2⤵
  PID:4820
- C:\Windows\System\hwLOHhr.exe
  C:\Windows\System\hwLOHhr.exe
  2⤵
  PID:1520
- C:\Windows\System\nxYeWAW.exe
  C:\Windows\System\nxYeWAW.exe
  2⤵
  PID:3488
- C:\Windows\System\pmWCOkt.exe
  C:\Windows\System\pmWCOkt.exe
  2⤵
  PID:10216
- C:\Windows\System\oYPQSwf.exe
  C:\Windows\System\oYPQSwf.exe
  2⤵
  PID:10528
- C:\Windows\System\iMVewcn.exe
  C:\Windows\System\iMVewcn.exe
  2⤵
  PID:4520
- C:\Windows\System\tVrQnPq.exe
  C:\Windows\System\tVrQnPq.exe
  2⤵
  PID:11644
- C:\Windows\System\dAtpwpG.exe
  C:\Windows\System\dAtpwpG.exe
  2⤵
  PID:2984
- C:\Windows\System\FFQOHGA.exe
  C:\Windows\System\FFQOHGA.exe
  2⤵
  PID:8200
- C:\Windows\System\ISyEdBu.exe
  C:\Windows\System\ISyEdBu.exe
  2⤵
  PID:1956
- C:\Windows\System\KsjVuwy.exe
  C:\Windows\System\KsjVuwy.exe
  2⤵
  PID:7228
- C:\Windows\System\TuNUcFz.exe
  C:\Windows\System\TuNUcFz.exe
  2⤵
  PID:11776
- C:\Windows\System\dhoiwsG.exe
  C:\Windows\System\dhoiwsG.exe
  2⤵
  PID:11892
- C:\Windows\System\ntlKOqB.exe
  C:\Windows\System\ntlKOqB.exe
  2⤵
  PID:8832
- C:\Windows\System\IfVEqyT.exe
  C:\Windows\System\IfVEqyT.exe
  2⤵
  PID:6432
- C:\Windows\System\JdBZSaN.exe
  C:\Windows\System\JdBZSaN.exe
  2⤵
  PID:5452
- C:\Windows\System\tPOkSaV.exe
  C:\Windows\System\tPOkSaV.exe
  2⤵
  PID:11288
- C:\Windows\System\DgLnMxy.exe
  C:\Windows\System\DgLnMxy.exe
  2⤵
  PID:5616
- C:\Windows\System\VbBQqIR.exe
  C:\Windows\System\VbBQqIR.exe
  2⤵
  PID:5744
- C:\Windows\System\KMEYcNG.exe
  C:\Windows\System\KMEYcNG.exe
  2⤵
  PID:12096
- C:\Windows\System\ayGhfoJ.exe
  C:\Windows\System\ayGhfoJ.exe
  2⤵
  PID:11460
- C:\Windows\System\oLTGVvH.exe
  C:\Windows\System\oLTGVvH.exe
  2⤵
  PID:6004
- C:\Windows\System\mDEAfmg.exe
  C:\Windows\System\mDEAfmg.exe
  2⤵
  PID:4984
- C:\Windows\System\XbqZPJZ.exe
  C:\Windows\System\XbqZPJZ.exe
  2⤵
  PID:5728
- C:\Windows\System\jgHINpN.exe
  C:\Windows\System\jgHINpN.exe
  2⤵
  PID:2676
- C:\Windows\System\nvETXUy.exe
  C:\Windows\System\nvETXUy.exe
  2⤵
  PID:2732
- C:\Windows\System\BRjNXNv.exe
  C:\Windows\System\BRjNXNv.exe
  2⤵
  PID:9860
- C:\Windows\System\culIgmA.exe
  C:\Windows\System\culIgmA.exe
  2⤵
  PID:7300
- C:\Windows\System\XNwLgOP.exe
  C:\Windows\System\XNwLgOP.exe
  2⤵
  PID:6020
- C:\Windows\System\tKEQQqZ.exe
  C:\Windows\System\tKEQQqZ.exe
  2⤵
  PID:11016
- C:\Windows\System\RTuKyOr.exe
  C:\Windows\System\RTuKyOr.exe
  2⤵
  PID:12604
- C:\Windows\System\fYGZfYK.exe
  C:\Windows\System\fYGZfYK.exe
  2⤵
  PID:4468
- C:\Windows\System\MdkYKle.exe
  C:\Windows\System\MdkYKle.exe
  2⤵
  PID:5484
- C:\Windows\System\cCFNgOI.exe
  C:\Windows\System\cCFNgOI.exe
  2⤵
  PID:6616
- C:\Windows\System\MGCsRvl.exe
  C:\Windows\System\MGCsRvl.exe
  2⤵
  PID:5788
- C:\Windows\System\ayFsbjv.exe
  C:\Windows\System\ayFsbjv.exe
  2⤵
  PID:7340
- C:\Windows\System\QFBBNNg.exe
  C:\Windows\System\QFBBNNg.exe
  2⤵
  PID:12692
- C:\Windows\System\GoLVKUm.exe
  C:\Windows\System\GoLVKUm.exe
  2⤵
  PID:12912
- C:\Windows\System\PPUgVsl.exe
  C:\Windows\System\PPUgVsl.exe
  2⤵
  PID:5680
- C:\Windows\System\AVeGwut.exe
  C:\Windows\System\AVeGwut.exe
  2⤵
  PID:5612
- C:\Windows\System\IhrcDeL.exe
  C:\Windows\System\IhrcDeL.exe
  2⤵
  PID:12972
- C:\Windows\System\JvmkPEM.exe
  C:\Windows\System\JvmkPEM.exe
  2⤵
  PID:8904
- C:\Windows\System\HJlbzKT.exe
  C:\Windows\System\HJlbzKT.exe
  2⤵
  PID:7620
- C:\Windows\System\AvsoNwS.exe
  C:\Windows\System\AvsoNwS.exe
  2⤵
  PID:13148
- C:\Windows\System\bpQLPgx.exe
  C:\Windows\System\bpQLPgx.exe
  2⤵
  PID:5200
- C:\Windows\System\DjpSEOH.exe
  C:\Windows\System\DjpSEOH.exe
  2⤵
  PID:5876
- C:\Windows\System\nbAEqjK.exe
  C:\Windows\System\nbAEqjK.exe
  2⤵
  PID:10752
- C:\Windows\System\URKzwuU.exe
  C:\Windows\System\URKzwuU.exe
  2⤵
  PID:6400
- C:\Windows\System\kPFGuBe.exe
  C:\Windows\System\kPFGuBe.exe
  2⤵
  PID:12760
- C:\Windows\System\EIJSdeJ.exe
  C:\Windows\System\EIJSdeJ.exe
  2⤵
  PID:5184
- C:\Windows\System\crdHpBm.exe
  C:\Windows\System\crdHpBm.exe
  2⤵
  PID:7916
- C:\Windows\System\QaqLnvG.exe
  C:\Windows\System\QaqLnvG.exe
  2⤵
  PID:13052
- C:\Windows\System\UwnSuds.exe
  C:\Windows\System\UwnSuds.exe
  2⤵
  PID:9596
- C:\Windows\System\iRJhihl.exe
  C:\Windows\System\iRJhihl.exe
  2⤵
  PID:12048
- C:\Windows\System\IdPZafd.exe
  C:\Windows\System\IdPZafd.exe
  2⤵
  PID:6576
- C:\Windows\System\YdIwmgc.exe
  C:\Windows\System\YdIwmgc.exe
  2⤵
  PID:3924
- C:\Windows\System\LXgvjJy.exe
  C:\Windows\System\LXgvjJy.exe
  2⤵
  PID:704
- C:\Windows\System\RxBRobx.exe
  C:\Windows\System\RxBRobx.exe
  2⤵
  PID:6668
- C:\Windows\System\JsxcutK.exe
  C:\Windows\System\JsxcutK.exe
  2⤵
  PID:6876
- C:\Windows\System\SAgTpma.exe
  C:\Windows\System\SAgTpma.exe
  2⤵
  PID:7484
- C:\Windows\System\MbQzoGM.exe
  C:\Windows\System\MbQzoGM.exe
  2⤵
  PID:2456
- C:\Windows\System\bdojpDp.exe
  C:\Windows\System\bdojpDp.exe
  2⤵
  PID:7140
- C:\Windows\System\fbvQKww.exe
  C:\Windows\System\fbvQKww.exe
  2⤵
  PID:7096
- C:\Windows\System\emcZuoh.exe
  C:\Windows\System\emcZuoh.exe
  2⤵
  PID:6968
- C:\Windows\System\ldxDfXX.exe
  C:\Windows\System\ldxDfXX.exe
  2⤵
  PID:6200
- C:\Windows\System\dGnvDrv.exe
  C:\Windows\System\dGnvDrv.exe
  2⤵
  PID:11956
- C:\Windows\System\jHCUNwr.exe
  C:\Windows\System\jHCUNwr.exe
  2⤵
  PID:12024
- C:\Windows\System\QgRxzhk.exe
  C:\Windows\System\QgRxzhk.exe
  2⤵
  PID:6344
- C:\Windows\System\GHhoQlW.exe
  C:\Windows\System\GHhoQlW.exe
  2⤵
  PID:6472
- C:\Windows\System\PKrenzv.exe
  C:\Windows\System\PKrenzv.exe
  2⤵
  PID:12220
- C:\Windows\System\APguhPy.exe
  C:\Windows\System\APguhPy.exe
  2⤵
  PID:2956
- C:\Windows\System\QvswoCY.exe
  C:\Windows\System\QvswoCY.exe
  2⤵
  PID:11656
- C:\Windows\System\kxsQQKq.exe
  C:\Windows\System\kxsQQKq.exe
  2⤵
  PID:7120
- C:\Windows\System\WdaiAXc.exe
  C:\Windows\System\WdaiAXc.exe
  2⤵
  PID:6732
- C:\Windows\System\BUWeqrY.exe
  C:\Windows\System\BUWeqrY.exe
  2⤵
  PID:6336
- C:\Windows\System\LiyVdNT.exe
  C:\Windows\System\LiyVdNT.exe
  2⤵
  PID:5540
- C:\Windows\System\kssvIYe.exe
  C:\Windows\System\kssvIYe.exe
  2⤵
  PID:5560
- C:\Windows\System\gFbAVCc.exe
  C:\Windows\System\gFbAVCc.exe
  2⤵
  PID:2336
- C:\Windows\System\kXCgSwX.exe
  C:\Windows\System\kXCgSwX.exe
  2⤵
  PID:12608
- C:\Windows\System\OYEbUHZ.exe
  C:\Windows\System\OYEbUHZ.exe
  2⤵
  PID:12648
- C:\Windows\System\JEnzgEo.exe
  C:\Windows\System\JEnzgEo.exe
  2⤵
  PID:7460
- C:\Windows\System\PxEYmUE.exe
  C:\Windows\System\PxEYmUE.exe
  2⤵
  PID:7320
- C:\Windows\System\nQdXGaH.exe
  C:\Windows\System\nQdXGaH.exe
  2⤵
  PID:7336
- C:\Windows\System\UoLxjFv.exe
  C:\Windows\System\UoLxjFv.exe
  2⤵
  PID:10776
- C:\Windows\System\jlIjzkR.exe
  C:\Windows\System\jlIjzkR.exe
  2⤵
  PID:11144
- C:\Windows\System\OESJnFv.exe
  C:\Windows\System\OESJnFv.exe
  2⤵
  PID:5208
- C:\Windows\System\IhrhOvu.exe
  C:\Windows\System\IhrhOvu.exe
  2⤵
  PID:7640
- C:\Windows\System\XWZIWax.exe
  C:\Windows\System\XWZIWax.exe
  2⤵
  PID:5936
- C:\Windows\System\pgKaLSR.exe
  C:\Windows\System\pgKaLSR.exe
  2⤵
  PID:7876
- C:\Windows\System\qYJliDQ.exe
  C:\Windows\System\qYJliDQ.exe
  2⤵
  PID:10480
- C:\Windows\System\WrrnnZw.exe
  C:\Windows\System\WrrnnZw.exe
  2⤵
  PID:7808
- C:\Windows\System\unlVdOd.exe
  C:\Windows\System\unlVdOd.exe
  2⤵
  PID:7764
- C:\Windows\System\tHxLinq.exe
  C:\Windows\System\tHxLinq.exe
  2⤵
  PID:7856
- C:\Windows\System\QOEykLt.exe
  C:\Windows\System\QOEykLt.exe
  2⤵
  PID:5096
- C:\Windows\System\OmIISsM.exe
  C:\Windows\System\OmIISsM.exe
  2⤵
  PID:7964
- C:\Windows\System\XOcpLBE.exe
  C:\Windows\System\XOcpLBE.exe
  2⤵
  PID:5128
- C:\Windows\System\svtcHBo.exe
  C:\Windows\System\svtcHBo.exe
  2⤵
  PID:5848
- C:\Windows\System\qdAXbQT.exe
  C:\Windows\System\qdAXbQT.exe
  2⤵
  PID:7912
- C:\Windows\System\mPqunpO.exe
  C:\Windows\System\mPqunpO.exe
  2⤵
  PID:12536
- C:\Windows\System\dVarSzE.exe
  C:\Windows\System\dVarSzE.exe
  2⤵
  PID:12820
- C:\Windows\System\agoTgLc.exe
  C:\Windows\System\agoTgLc.exe
  2⤵
  PID:7684
- C:\Windows\System\tvXVWIg.exe
  C:\Windows\System\tvXVWIg.exe
  2⤵
  PID:7324
- C:\Windows\System\JAzoDwO.exe
  C:\Windows\System\JAzoDwO.exe
  2⤵
  PID:2436
- C:\Windows\System\SVkDYyq.exe
  C:\Windows\System\SVkDYyq.exe
  2⤵
  PID:7544
- C:\Windows\System\ysqgwLK.exe
  C:\Windows\System\ysqgwLK.exe
  2⤵
  PID:13048
- C:\Windows\System\vbnkfOs.exe
  C:\Windows\System\vbnkfOs.exe
  2⤵
  PID:8536
- C:\Windows\System\GppHdVq.exe
  C:\Windows\System\GppHdVq.exe
  2⤵
  PID:8176
- C:\Windows\System\LTlPCgT.exe
  C:\Windows\System\LTlPCgT.exe
  2⤵
  PID:1232
- C:\Windows\System\DVsISHV.exe
  C:\Windows\System\DVsISHV.exe
  2⤵
  PID:8340
- C:\Windows\System\jOWwTWW.exe
  C:\Windows\System\jOWwTWW.exe
  2⤵
  PID:8416
- C:\Windows\System\DYnsIXl.exe
  C:\Windows\System\DYnsIXl.exe
  2⤵
  PID:11744
- C:\Windows\System\MQZaPwW.exe
  C:\Windows\System\MQZaPwW.exe
  2⤵
  PID:8420
- C:\Windows\System\NRIILYb.exe
  C:\Windows\System\NRIILYb.exe
  2⤵
  PID:8668
- C:\Windows\System\KHAeWob.exe
  C:\Windows\System\KHAeWob.exe
  2⤵
  PID:6372
- C:\Windows\System\odnbsWg.exe
  C:\Windows\System\odnbsWg.exe
  2⤵
  PID:12088
- C:\Windows\System\bWzSsga.exe
  C:\Windows\System\bWzSsga.exe
  2⤵
  PID:224
- C:\Windows\System\SWBeqeG.exe
  C:\Windows\System\SWBeqeG.exe
  2⤵
  PID:6480
- C:\Windows\System\xzmMmGT.exe
  C:\Windows\System\xzmMmGT.exe
  2⤵
  PID:9660
- C:\Windows\System\VlZsCUP.exe
  C:\Windows\System\VlZsCUP.exe
  2⤵
  PID:5992
- C:\Windows\System\pJiTEgQ.exe
  C:\Windows\System\pJiTEgQ.exe
  2⤵
  PID:5576
- C:\Windows\System\gbbilKW.exe
  C:\Windows\System\gbbilKW.exe
  2⤵
  PID:9200
- C:\Windows\System\sZLBjzd.exe
  C:\Windows\System\sZLBjzd.exe
  2⤵
  PID:8336
- C:\Windows\System\SVGYyBZ.exe
  C:\Windows\System\SVGYyBZ.exe
  2⤵
  PID:5544
- C:\Windows\System\kEgpiGY.exe
  C:\Windows\System\kEgpiGY.exe
  2⤵
  PID:5292
- C:\Windows\System\QgjndND.exe
  C:\Windows\System\QgjndND.exe
  2⤵
  PID:8800
- C:\Windows\System\lschpsy.exe
  C:\Windows\System\lschpsy.exe
  2⤵
  PID:1496
- C:\Windows\System\dYzCYcP.exe
  C:\Windows\System\dYzCYcP.exe
  2⤵
  PID:7444
- C:\Windows\System\JUqDEJY.exe
  C:\Windows\System\JUqDEJY.exe
  2⤵
  PID:7476
- C:\Windows\System\ewDiClL.exe
  C:\Windows\System\ewDiClL.exe
  2⤵
  PID:10756
- C:\Windows\System\teslRjV.exe
  C:\Windows\System\teslRjV.exe
  2⤵
  PID:7628
- C:\Windows\System\AtxavuL.exe
  C:\Windows\System\AtxavuL.exe
  2⤵
  PID:4516
- C:\Windows\System\otoPQrw.exe
  C:\Windows\System\otoPQrw.exe
  2⤵
  PID:7868
- C:\Windows\System\QSFgQTM.exe
  C:\Windows\System\QSFgQTM.exe
  2⤵
  PID:7792
- C:\Windows\System\rifFxZE.exe
  C:\Windows\System\rifFxZE.exe
  2⤵
  PID:4756
- C:\Windows\System\JazGrKc.exe
  C:\Windows\System\JazGrKc.exe
  2⤵
  PID:8024
- C:\Windows\System\IhppPgM.exe
  C:\Windows\System\IhppPgM.exe
  2⤵
  PID:9456
- C:\Windows\System\CHHRhzC.exe
  C:\Windows\System\CHHRhzC.exe
  2⤵
  PID:10976
- C:\Windows\System\MpzoEiy.exe
  C:\Windows\System\MpzoEiy.exe
  2⤵
  PID:9348
- C:\Windows\System\lUudsip.exe
  C:\Windows\System\lUudsip.exe
  2⤵
  PID:8068
- C:\Windows\System\GpnVpsZ.exe
  C:\Windows\System\GpnVpsZ.exe
  2⤵
  PID:5140
- C:\Windows\System\mqOshJh.exe
  C:\Windows\System\mqOshJh.exe
  2⤵
  PID:6212
- C:\Windows\System\DiPgcus.exe
  C:\Windows\System\DiPgcus.exe
  2⤵
  PID:9760
- C:\Windows\System\tBOfWTo.exe
  C:\Windows\System\tBOfWTo.exe
  2⤵
  PID:9828
- C:\Windows\System\jXztVWU.exe
  C:\Windows\System\jXztVWU.exe
  2⤵
  PID:9636
- C:\Windows\System\kjXFHhA.exe
  C:\Windows\System\kjXFHhA.exe
  2⤵
  PID:9680
- C:\Windows\System\DGNFyVG.exe
  C:\Windows\System\DGNFyVG.exe
  2⤵
  PID:12896
- C:\Windows\System\ZfemhaM.exe
  C:\Windows\System\ZfemhaM.exe
  2⤵
  PID:6980
- C:\Windows\System\gmVjmIe.exe
  C:\Windows\System\gmVjmIe.exe
  2⤵
  PID:3180
- C:\Windows\System\xTSNgdZ.exe
  C:\Windows\System\xTSNgdZ.exe
  2⤵
  PID:10144
- C:\Windows\System\jvJeSTw.exe
  C:\Windows\System\jvJeSTw.exe
  2⤵
  PID:6496
- C:\Windows\System\rZRGxUJ.exe
  C:\Windows\System\rZRGxUJ.exe
  2⤵
  PID:11928
- C:\Windows\System\fkyETJQ.exe
  C:\Windows\System\fkyETJQ.exe
  2⤵
  PID:7132
- C:\Windows\System\JPcDFXW.exe
  C:\Windows\System\JPcDFXW.exe
  2⤵
  PID:9744
- C:\Windows\System\REPfaky.exe
  C:\Windows\System\REPfaky.exe
  2⤵
  PID:9672
- C:\Windows\System\OIsdJex.exe
  C:\Windows\System\OIsdJex.exe
  2⤵
  PID:1876
- C:\Windows\System\HthIPrg.exe
  C:\Windows\System\HthIPrg.exe
  2⤵
  PID:10124
- C:\Windows\System\QlrrzFs.exe
  C:\Windows\System\QlrrzFs.exe
  2⤵
  PID:8960
- C:\Windows\System\KUPVgUe.exe
  C:\Windows\System\KUPVgUe.exe
  2⤵
  PID:10060
- C:\Windows\System\lveiWfp.exe
  C:\Windows\System\lveiWfp.exe
  2⤵
  PID:8956
- C:\Windows\System\nQTdxPt.exe
  C:\Windows\System\nQTdxPt.exe
  2⤵
  PID:9384
- C:\Windows\System\eUVroIu.exe
  C:\Windows\System\eUVroIu.exe
  2⤵
  PID:10168
- C:\Windows\System\MXsZQnl.exe
  C:\Windows\System\MXsZQnl.exe
  2⤵
  PID:10384
- C:\Windows\System\QSPRIZW.exe
  C:\Windows\System\QSPRIZW.exe
  2⤵
  PID:7720
- C:\Windows\System\bSiEKOP.exe
  C:\Windows\System\bSiEKOP.exe
  2⤵
  PID:9136
- C:\Windows\System\NzomxmX.exe
  C:\Windows\System\NzomxmX.exe
  2⤵
  PID:5300
- C:\Windows\System\BPhrrlj.exe
  C:\Windows\System\BPhrrlj.exe
  2⤵
  PID:2392
- C:\Windows\System\FlaClLA.exe
  C:\Windows\System\FlaClLA.exe
  2⤵
  PID:10408
- C:\Windows\System\LOnTpbK.exe
  C:\Windows\System\LOnTpbK.exe
  2⤵
  PID:7956
- C:\Windows\System\zhtGdfe.exe
  C:\Windows\System\zhtGdfe.exe
  2⤵
  PID:12764
- C:\Windows\System\tuYslrb.exe
  C:\Windows\System\tuYslrb.exe
  2⤵
  PID:10712
- C:\Windows\System\mRRzEGx.exe
  C:\Windows\System\mRRzEGx.exe
  2⤵
  PID:9488
- C:\Windows\System\kItgrLB.exe
  C:\Windows\System\kItgrLB.exe
  2⤵
  PID:9824
- C:\Windows\System\sWERrbo.exe
  C:\Windows\System\sWERrbo.exe
  2⤵
  PID:9120
- C:\Windows\System\MdyOiye.exe
  C:\Windows\System\MdyOiye.exe
  2⤵
  PID:9740
- C:\Windows\System\eKEeyrl.exe
  C:\Windows\System\eKEeyrl.exe
  2⤵
  PID:10996
- C:\Windows\System\yWmTJMu.exe
  C:\Windows\System\yWmTJMu.exe
  2⤵
  PID:11052
- C:\Windows\System\RtWVpfC.exe
  C:\Windows\System\RtWVpfC.exe
  2⤵
  PID:6396
- C:\Windows\System\pZoAmLE.exe
  C:\Windows\System\pZoAmLE.exe
  2⤵
  PID:4572
- C:\Windows\System\UDHuxss.exe
  C:\Windows\System\UDHuxss.exe
  2⤵
  PID:4352
- C:\Windows\System\IpyQiZr.exe
  C:\Windows\System\IpyQiZr.exe
  2⤵
  PID:3632
- C:\Windows\System\bnEnZdX.exe
  C:\Windows\System\bnEnZdX.exe
  2⤵
  PID:10580
- C:\Windows\System\nraVfWn.exe
  C:\Windows\System\nraVfWn.exe
  2⤵
  PID:6236
- C:\Windows\System\PkbKREG.exe
  C:\Windows\System\PkbKREG.exe
  2⤵
  PID:10660
- C:\Windows\System\nVhPQKD.exe
  C:\Windows\System\nVhPQKD.exe
  2⤵
  PID:10644
- C:\Windows\System\rkMRinM.exe
  C:\Windows\System\rkMRinM.exe
  2⤵
  PID:1300
- C:\Windows\System\jBaGZAw.exe
  C:\Windows\System\jBaGZAw.exe
  2⤵
  PID:9096
- C:\Windows\System\KGIhhvs.exe
  C:\Windows\System\KGIhhvs.exe
  2⤵
  PID:12224
- C:\Windows\System\AmLtkfM.exe
  C:\Windows\System\AmLtkfM.exe
  2⤵
  PID:6708
- C:\Windows\System\hQUnoKs.exe
  C:\Windows\System\hQUnoKs.exe
  2⤵
  PID:4180
- C:\Windows\System\KgGqpVw.exe
  C:\Windows\System\KgGqpVw.exe
  2⤵
  PID:11124
- C:\Windows\System\lxWvTgX.exe
  C:\Windows\System\lxWvTgX.exe
  2⤵
  PID:1144
- C:\Windows\System\uJqpLIO.exe
  C:\Windows\System\uJqpLIO.exe
  2⤵
  PID:10312
- C:\Windows\System\WRtwZmQ.exe
  C:\Windows\System\WRtwZmQ.exe
  2⤵
  PID:10744
- C:\Windows\System\inufoBX.exe
  C:\Windows\System\inufoBX.exe
  2⤵
  PID:7648
- C:\Windows\System\EyFJfBj.exe
  C:\Windows\System\EyFJfBj.exe
  2⤵
  PID:7984
- C:\Windows\System\mTdQeLt.exe
  C:\Windows\System\mTdQeLt.exe
  2⤵
  PID:11268
- C:\Windows\System\vBxhSXs.exe
  C:\Windows\System\vBxhSXs.exe
  2⤵
  PID:7864
- C:\Windows\System\MjjvELi.exe
  C:\Windows\System\MjjvELi.exe
  2⤵
  PID:7668
- C:\Windows\System\cahWOya.exe
  C:\Windows\System\cahWOya.exe
  2⤵
  PID:10728
- C:\Windows\System\ojGWTYw.exe
  C:\Windows\System\ojGWTYw.exe
  2⤵
  PID:11544
- C:\Windows\System\VWNhNfP.exe
  C:\Windows\System\VWNhNfP.exe
  2⤵
  PID:11596
- C:\Windows\System\eMlDTHL.exe
  C:\Windows\System\eMlDTHL.exe
  2⤵
  PID:10476
- C:\Windows\System\skfTQIB.exe
  C:\Windows\System\skfTQIB.exe
  2⤵
  PID:10600
- C:\Windows\System\aZvjavT.exe
  C:\Windows\System\aZvjavT.exe
  2⤵
  PID:10724
- C:\Windows\System\tERZpNQ.exe
  C:\Windows\System\tERZpNQ.exe
  2⤵
  PID:8376
- C:\Windows\System\EJfnYVp.exe
  C:\Windows\System\EJfnYVp.exe
  2⤵
  PID:11888
- C:\Windows\System\ZElNWNz.exe
  C:\Windows\System\ZElNWNz.exe
  2⤵
  PID:6560
- C:\Windows\System\cZAkEiP.exe
  C:\Windows\System\cZAkEiP.exe
  2⤵
  PID:5792
- C:\Windows\System\xHjlvyi.exe
  C:\Windows\System\xHjlvyi.exe
  2⤵
  PID:8944
- C:\Windows\System\ASMrhLG.exe
  C:\Windows\System\ASMrhLG.exe
  2⤵
  PID:7404
- C:\Windows\System\MLAmBgE.exe
  C:\Windows\System\MLAmBgE.exe
  2⤵
  PID:7888
- C:\Windows\System\eNSVeTx.exe
  C:\Windows\System\eNSVeTx.exe
  2⤵
  PID:12040
- C:\Windows\System\qICwUhb.exe
  C:\Windows\System\qICwUhb.exe
  2⤵
  PID:10956
- C:\Windows\System\mYDzQVP.exe
  C:\Windows\System\mYDzQVP.exe
  2⤵
  PID:11284
- C:\Windows\System\pSeNNwI.exe
  C:\Windows\System\pSeNNwI.exe
  2⤵
  PID:700
- C:\Windows\System\zigQqJH.exe
  C:\Windows\System\zigQqJH.exe
  2⤵
  PID:8256
- C:\Windows\System\cuVbuII.exe
  C:\Windows\System\cuVbuII.exe
  2⤵
  PID:10736
- C:\Windows\System\wkPSMGu.exe
  C:\Windows\System\wkPSMGu.exe
  2⤵
  PID:11680
- C:\Windows\System\TRroIhV.exe
  C:\Windows\System\TRroIhV.exe
  2⤵
  PID:11600
- C:\Windows\System\aSnSJKU.exe
  C:\Windows\System\aSnSJKU.exe
  2⤵
  PID:10416
- C:\Windows\System\HvysJpR.exe
  C:\Windows\System\HvysJpR.exe
  2⤵
  PID:10904
- C:\Windows\System\RLBcsEQ.exe
  C:\Windows\System\RLBcsEQ.exe
  2⤵
  PID:12244
- C:\Windows\System\iiPyiJk.exe
  C:\Windows\System\iiPyiJk.exe
  2⤵
  PID:12032
- C:\Windows\System\bBjWaPF.exe
  C:\Windows\System\bBjWaPF.exe
  2⤵
  PID:11636
- C:\Windows\System\OlQgpHa.exe
  C:\Windows\System\OlQgpHa.exe
  2⤵
  PID:5600
- C:\Windows\System\jlFYzTa.exe
  C:\Windows\System\jlFYzTa.exe
  2⤵
  PID:11660
- C:\Windows\System\vSCEvbx.exe
  C:\Windows\System\vSCEvbx.exe
  2⤵
  PID:10524
- C:\Windows\System\PNBEhQb.exe
  C:\Windows\System\PNBEhQb.exe
  2⤵
  PID:10452
- C:\Windows\System\rRphUbm.exe
  C:\Windows\System\rRphUbm.exe
  2⤵
  PID:4660
- C:\Windows\System\ApGoDAg.exe
  C:\Windows\System\ApGoDAg.exe
  2⤵
  PID:9632
- C:\Windows\System\bhYaAOz.exe
  C:\Windows\System\bhYaAOz.exe
  2⤵
  PID:3992
- C:\Windows\System\RNXlxmN.exe
  C:\Windows\System\RNXlxmN.exe
  2⤵
  PID:9008
- C:\Windows\System\WvfHiOw.exe
  C:\Windows\System\WvfHiOw.exe
  2⤵
  PID:11156
- C:\Windows\System\AhDNogW.exe
  C:\Windows\System\AhDNogW.exe
  2⤵
  PID:12484
- C:\Windows\System\tZXEpon.exe
  C:\Windows\System\tZXEpon.exe
  2⤵
  PID:8868
- C:\Windows\System\wHAbMuI.exe
  C:\Windows\System\wHAbMuI.exe
  2⤵
  PID:11652
- C:\Windows\System\lZOntOq.exe
  C:\Windows\System\lZOntOq.exe
  2⤵
  PID:8188
- C:\Windows\System\MLpellU.exe
  C:\Windows\System\MLpellU.exe
  2⤵
  PID:4344
- C:\Windows\System\XWdbcTy.exe
  C:\Windows\System\XWdbcTy.exe
  2⤵
  PID:11364
- C:\Windows\System\HcfIyVq.exe
  C:\Windows\System\HcfIyVq.exe
  2⤵
  PID:8204
- C:\Windows\System\zqqVeqO.exe
  C:\Windows\System\zqqVeqO.exe
  2⤵
  PID:10952
- C:\Windows\System\PftOXdg.exe
  C:\Windows\System\PftOXdg.exe
  2⤵
  PID:12368
- C:\Windows\System\EETTERI.exe
  C:\Windows\System\EETTERI.exe
  2⤵
  PID:13356
- C:\Windows\System\vdxtPtJ.exe
  C:\Windows\System\vdxtPtJ.exe
  2⤵
  PID:13392
- C:\Windows\System\dNNIWtX.exe
  C:\Windows\System\dNNIWtX.exe
  2⤵
  PID:13428
- C:\Windows\System\jlaMrVE.exe
  C:\Windows\System\jlaMrVE.exe
  2⤵
  PID:13480
- C:\Windows\System\IvcmcUH.exe
  C:\Windows\System\IvcmcUH.exe
  2⤵
  PID:13508
- C:\Windows\System\ddSfSdp.exe
  C:\Windows\System\ddSfSdp.exe
  2⤵
  PID:13540
- C:\Windows\System\smZdUvv.exe
  C:\Windows\System\smZdUvv.exe
  2⤵
  PID:13572
- C:\Windows\System\mhOrwLi.exe
  C:\Windows\System\mhOrwLi.exe
  2⤵
  PID:13600
- C:\Windows\System\PbjCGTJ.exe
  C:\Windows\System\PbjCGTJ.exe
  2⤵
  PID:13628
- C:\Windows\System\ixlVqSw.exe
  C:\Windows\System\ixlVqSw.exe
  2⤵
  PID:13652
- C:\Windows\System\mTmsxZd.exe
  C:\Windows\System\mTmsxZd.exe
  2⤵
  PID:13676
- C:\Windows\System\wykmqde.exe
  C:\Windows\System\wykmqde.exe
  2⤵
  PID:13696
- C:\Windows\System\YNwrxcc.exe
  C:\Windows\System\YNwrxcc.exe
  2⤵
  PID:13728
- C:\Windows\System\mqDNdBs.exe
  C:\Windows\System\mqDNdBs.exe
  2⤵
  PID:13760
- C:\Windows\System\nUFNwbz.exe
  C:\Windows\System\nUFNwbz.exe
  2⤵
  PID:13788
- C:\Windows\System\qvOvKRs.exe
  C:\Windows\System\qvOvKRs.exe
  2⤵
  PID:13824
- C:\Windows\System\ooytBVR.exe
  C:\Windows\System\ooytBVR.exe
  2⤵
  PID:13848
- C:\Windows\System\jOyrUML.exe
  C:\Windows\System\jOyrUML.exe
  2⤵
  PID:13880
- C:\Windows\System\OHnqfhw.exe
  C:\Windows\System\OHnqfhw.exe
  2⤵
  PID:13916
- C:\Windows\System\YCWreYZ.exe
  C:\Windows\System\YCWreYZ.exe
  2⤵
  PID:13944
- C:\Windows\System\SJHckBu.exe
  C:\Windows\System\SJHckBu.exe
  2⤵
  PID:13976
- C:\Windows\System\AVxHiFK.exe
  C:\Windows\System\AVxHiFK.exe
  2⤵
  PID:14008
- C:\Windows\System\TLOYyGl.exe
  C:\Windows\System\TLOYyGl.exe
  2⤵
  PID:14044
- C:\Windows\System\VvtLMqL.exe
  C:\Windows\System\VvtLMqL.exe
  2⤵
  PID:14084
- C:\Windows\System\UcRfjfF.exe
  C:\Windows\System\UcRfjfF.exe
  2⤵
  PID:14128
- C:\Windows\System\ZapkjGH.exe
  C:\Windows\System\ZapkjGH.exe
  2⤵
  PID:14184
- C:\Windows\System\MJhkHKZ.exe
  C:\Windows\System\MJhkHKZ.exe
  2⤵
  PID:14228
- C:\Windows\System\nVNsnxD.exe
  C:\Windows\System\nVNsnxD.exe
  2⤵
  PID:14260
- C:\Windows\System\LxHxGGi.exe
  C:\Windows\System\LxHxGGi.exe
  2⤵
  PID:14300
- C:\Windows\System\VbeLNwc.exe
  C:\Windows\System\VbeLNwc.exe
  2⤵
  PID:14332
- C:\Windows\System\LNFhSvs.exe
  C:\Windows\System\LNFhSvs.exe
  2⤵
  PID:12984
- C:\Windows\System\oSQhlbm.exe
  C:\Windows\System\oSQhlbm.exe
  2⤵
  PID:3548
- C:\Windows\System\uCITfLc.exe
  C:\Windows\System\uCITfLc.exe
  2⤵
  PID:12564
- C:\Windows\System\KuPgilO.exe
  C:\Windows\System\KuPgilO.exe
  2⤵
  PID:3388
- C:\Windows\System\AxzPiOR.exe
  C:\Windows\System\AxzPiOR.exe
  2⤵
  PID:13072
- C:\Windows\System\DiTuLuS.exe
  C:\Windows\System\DiTuLuS.exe
  2⤵
  PID:13320
- C:\Windows\System\xlLycIR.exe
  C:\Windows\System\xlLycIR.exe
  2⤵
  PID:11412
- C:\Windows\System\zvvxvzs.exe
  C:\Windows\System\zvvxvzs.exe
  2⤵
  PID:12472
- C:\Windows\System\kkRFANM.exe
  C:\Windows\System\kkRFANM.exe
  2⤵
  PID:4276
- C:\Windows\System\HoUGlOi.exe
  C:\Windows\System\HoUGlOi.exe
  2⤵
  PID:13488
- C:\Windows\System\btnnCqs.exe
  C:\Windows\System\btnnCqs.exe
  2⤵
  PID:13772
- C:\Windows\System\swNKjap.exe
  C:\Windows\System\swNKjap.exe
  2⤵
  PID:13780
- C:\Windows\System\KoTxlWh.exe
  C:\Windows\System\KoTxlWh.exe
  2⤵
  PID:13084
- C:\Windows\System\brXFpwD.exe
  C:\Windows\System\brXFpwD.exe
  2⤵
  PID:13424
- C:\Windows\System\KOTpOaU.exe
  C:\Windows\System\KOTpOaU.exe
  2⤵
  PID:13684
- C:\Windows\System\XJIApgc.exe
  C:\Windows\System\XJIApgc.exe
  2⤵
  PID:13720
- C:\Windows\System\cxXTTWr.exe
  C:\Windows\System\cxXTTWr.exe
  2⤵
  PID:13648
- C:\Windows\System\lrvbYan.exe
  C:\Windows\System\lrvbYan.exe
  2⤵
  PID:9668
- C:\Windows\System\VRNokrj.exe
  C:\Windows\System\VRNokrj.exe
  2⤵
  PID:13968
- C:\Windows\System\IqEnFOn.exe
  C:\Windows\System\IqEnFOn.exe
  2⤵
  PID:14240
- C:\Windows\System\enbdGVT.exe
  C:\Windows\System\enbdGVT.exe
  2⤵
  PID:14092
- C:\Windows\System\kVbkcLy.exe
  C:\Windows\System\kVbkcLy.exe
  2⤵
  PID:14316
- C:\Windows\System\YmtuKhX.exe
  C:\Windows\System\YmtuKhX.exe
  2⤵
  PID:11824
- C:\Windows\System\TxMCeaH.exe
  C:\Windows\System\TxMCeaH.exe
  2⤵
  PID:13376
- C:\Windows\System\qHUvLaH.exe
  C:\Windows\System\qHUvLaH.exe
  2⤵
  PID:13460
- C:\Windows\System\CILHfvn.exe
  C:\Windows\System\CILHfvn.exe
  2⤵
  PID:13748
- C:\Windows\System\ZkCmlsv.exe
  C:\Windows\System\ZkCmlsv.exe
  2⤵
  PID:13556
- C:\Windows\System\mHrhpkw.exe
  C:\Windows\System\mHrhpkw.exe
  2⤵
  PID:13352
- C:\Windows\System\qgsayNf.exe
  C:\Windows\System\qgsayNf.exe
  2⤵
  PID:13740
- C:\Windows\System\TqDtlEu.exe
  C:\Windows\System\TqDtlEu.exe
  2⤵
  PID:13924
- C:\Windows\System\CMQyGnU.exe
  C:\Windows\System\CMQyGnU.exe
  2⤵
  PID:14116
- C:\Windows\System\cCmCYsx.exe
  C:\Windows\System\cCmCYsx.exe
  2⤵
  PID:14256
- C:\Windows\System\LZzkrlf.exe
  C:\Windows\System\LZzkrlf.exe
  2⤵
  PID:14268
- C:\Windows\System\CxnknjH.exe
  C:\Windows\System\CxnknjH.exe
  2⤵
  PID:13344
- C:\Windows\System\JZVQeWD.exe
  C:\Windows\System\JZVQeWD.exe
  2⤵
  PID:2020
- C:\Windows\System\orbotWU.exe
  C:\Windows\System\orbotWU.exe
  2⤵
  PID:12660
- C:\Windows\System\XySKJvK.exe
  C:\Windows\System\XySKJvK.exe
  2⤵
  PID:10420
- C:\Windows\System\dIoXoYC.exe
  C:\Windows\System\dIoXoYC.exe
  2⤵
  PID:14072
- C:\Windows\System\HlAhMss.exe
  C:\Windows\System\HlAhMss.exe
  2⤵
  PID:13936
- C:\Windows\System\XNXgGWW.exe
  C:\Windows\System\XNXgGWW.exe
  2⤵
  PID:13500
- C:\Windows\System\HrQxbAT.exe
  C:\Windows\System\HrQxbAT.exe
  2⤵
  PID:13560
- C:\Windows\System\etnNisD.exe
  C:\Windows\System\etnNisD.exe
  2⤵
  PID:13440
- C:\Windows\System\QbrAVsi.exe
  C:\Windows\System\QbrAVsi.exe
  2⤵
  PID:12616
- C:\Windows\System\rGGmkSd.exe
  C:\Windows\System\rGGmkSd.exe
  2⤵
  PID:14360
- C:\Windows\System\HqduJFR.exe
  C:\Windows\System\HqduJFR.exe
  2⤵
  PID:14424
- C:\Windows\System\pOtcSBK.exe
  C:\Windows\System\pOtcSBK.exe
  2⤵
  PID:14452
- C:\Windows\System\kuipTLT.exe
  C:\Windows\System\kuipTLT.exe
  2⤵
  PID:14468
- C:\Windows\System\SzsZRjh.exe
  C:\Windows\System\SzsZRjh.exe
  2⤵
  PID:14508
- C:\Windows\System\mYdIAne.exe
  C:\Windows\System\mYdIAne.exe
  2⤵
  PID:14536
- C:\Windows\System\DGOCDOQ.exe
  C:\Windows\System\DGOCDOQ.exe
  2⤵
  PID:14556
- C:\Windows\System\FwMZBbL.exe
  C:\Windows\System\FwMZBbL.exe
  2⤵
  PID:14580
- C:\Windows\System\OzSdlYz.exe
  C:\Windows\System\OzSdlYz.exe
  2⤵
  PID:14608
- C:\Windows\System\xNaUBwH.exe
  C:\Windows\System\xNaUBwH.exe
  2⤵
  PID:14648
- C:\Windows\System\pitiZpV.exe
  C:\Windows\System\pitiZpV.exe
  2⤵
  PID:14672
- C:\Windows\System\JZvsjrf.exe
  C:\Windows\System\JZvsjrf.exe
  2⤵
  PID:14704
- C:\Windows\System\MeVqLVc.exe
  C:\Windows\System\MeVqLVc.exe
  2⤵
  PID:14748
- C:\Windows\System\TmHJgJI.exe
  C:\Windows\System\TmHJgJI.exe
  2⤵
  PID:14764
- C:\Windows\System\Xlhjjiq.exe
  C:\Windows\System\Xlhjjiq.exe
  2⤵
  PID:14780
- C:\Windows\System\snVrrcH.exe
  C:\Windows\System\snVrrcH.exe
  2⤵
  PID:14796
- C:\Windows\System\uJPbcck.exe
  C:\Windows\System\uJPbcck.exe
  2⤵
  PID:14812
- C:\Windows\System\reuuvRK.exe
  C:\Windows\System\reuuvRK.exe
  2⤵
  PID:14828
- C:\Windows\System\UzXgXLG.exe
  C:\Windows\System\UzXgXLG.exe
  2⤵
  PID:14860
- C:\Windows\System\HvYXbcT.exe
  C:\Windows\System\HvYXbcT.exe
  2⤵
  PID:14896
- C:\Windows\System\HYibRQh.exe
  C:\Windows\System\HYibRQh.exe
  2⤵
  PID:14952
- C:\Windows\System\ERfeBPI.exe
  C:\Windows\System\ERfeBPI.exe
  2⤵
  PID:14968
- C:\Windows\System\xJUUkFp.exe
  C:\Windows\System\xJUUkFp.exe
  2⤵
  PID:15004
- C:\Windows\System\lVUIAfa.exe
  C:\Windows\System\lVUIAfa.exe
  2⤵
  PID:15040
- C:\Windows\System\RUfraDn.exe
  C:\Windows\System\RUfraDn.exe
  2⤵
  PID:15076
- C:\Windows\System\mWRcyIy.exe
  C:\Windows\System\mWRcyIy.exe
  2⤵
  PID:15100
- C:\Windows\System\aGzfqLj.exe
  C:\Windows\System\aGzfqLj.exe
  2⤵
  PID:15120
- C:\Windows\System\DlibUTP.exe
  C:\Windows\System\DlibUTP.exe
  2⤵
  PID:15144
- C:\Windows\System\TFLqKrd.exe
  C:\Windows\System\TFLqKrd.exe
  2⤵
  PID:15172
- C:\Windows\System\ensGHdM.exe
  C:\Windows\System\ensGHdM.exe
  2⤵
  PID:15208
- C:\Windows\System\SbZmvkR.exe
  C:\Windows\System\SbZmvkR.exe
  2⤵
  PID:15232
- C:\Windows\System\oxfQvIK.exe
  C:\Windows\System\oxfQvIK.exe
  2⤵
  PID:15268
- C:\Windows\System\XfWVllv.exe
  C:\Windows\System\XfWVllv.exe
  2⤵
  PID:15300
- C:\Windows\System\dRwToVU.exe
  C:\Windows\System\dRwToVU.exe
  2⤵
  PID:15332
- C:\Windows\System\DSQgxUI.exe
  C:\Windows\System\DSQgxUI.exe
  2⤵
  PID:15352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0jxrggny.3az.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CeNypdb.exe

Filesize
1.9MB

MD5
29b844ac32ed2185dd4ca64d6a2dfd29

SHA1
e8cb94b206f491017b5543b45867a3fd5da43bad

SHA256
0dbef4581d3cddb1c6a4e796eba8c7e2a7983163bd6d49ab2e228d98e91e0c94

SHA512
94993b07690644c41c3bbafdc8fcc67ee9af6254b83742c32ff1332f3ee71e9ad1368dd50967d39ca40528149ebe4efc86137e7a71a62c68c3f9851e4a86bd9e

Download Submit
C:\Windows\System\ChgVNoD.exe

Filesize
1.9MB

MD5
47c9897ec25bc7da626837d12d91bb72

SHA1
eaa39f98269059a98453e9193f3a682d8b9859c8

SHA256
405ce6ae342bb562c5a74ec29d3488f9429bf11f0ca21990f8a03cc2d8a10bf2

SHA512
d4182ff7c0adead85fc9f83ba0fb3f1b27eb499b9a57cc93b023cb6c5ecaf27047172cc33eede0ceb162cfb67ab76b5aa0e2ba065d6ac0b7f8c4f3b30fc90761

Download Submit
C:\Windows\System\DdHgNev.exe

Filesize
1.9MB

MD5
2239a0bc1e9683f7710a1db57e67e085

SHA1
61a28d6a113e7c0f2729fbc920a67d2b4cf264da

SHA256
207e69d31cd8634878b998d278a6bfbb7a3a57a7e260031a0170529a65ce64b9

SHA512
913211bcee8421446876e288e2a15dbb0c2bdee39287ede568829fff7064831327da6449182ad9dabf835dd7d16b3e05de580a631d466199c080534ac8b9a13b

Download Submit
C:\Windows\System\HIoJTaF.exe

Filesize
1.9MB

MD5
d1aa46566f016c0f25a82696ace6a3e6

SHA1
aac9eb92fc1889d8ab74b73b96de8bf71870ec04

SHA256
777f87d8c47b414d816ec02e7b443ce28b830213c7040462d9c192708b82b1cc

SHA512
7810da567d2135dce83b79ec130504dfda9ca6ce14022397d0d224e2571de0cb2d7ac21b22463648362ce4f7ea9427cc64cc1832773896de57122731bd24c4e9

Download Submit
C:\Windows\System\HVYMkrd.exe

Filesize
1.9MB

MD5
10502ffa640d0e62974e601a70dcbad3

SHA1
65ee0a7838bf8ff1a37d6f319bc8033f4000885a

SHA256
81382e01bb973a679b904373f34795c36af8d7342d3eb1d5b928f85721d3b9f5

SHA512
b62a89161b8963888ddcb368dc92f938d43af6b0c669f2b2a4c5a8100cf146978d80891169b5e82db62f9da8223b47d16c7c6cc5c1bb4a32ab5d34377b2e16a8

Download Submit
C:\Windows\System\IJKCAuU.exe

Filesize
1.9MB

MD5
db6e3505ee852736ac61c7364f521c36

SHA1
ea619a2d73202dd18cdb09baad32f7fb9dfc5c21

SHA256
87f415e36f91c435629005cd2ffb5d3baa3033a3e1e7a1055bac5c09aecf27ed

SHA512
79407975566fb1540644f30cdcbfdca96bdc1a6f2944c99a899c6651e10ae6eea16cddb80c7cadde9413c2f6fd3de5c7ad82fb8646dc92b5c0f29d0cb6fcf8d1

Download Submit
C:\Windows\System\IkzGpoI.exe

Filesize
1.9MB

MD5
d592226c4475802a9c0d3aa91ceaa483

SHA1
8c3e0a0b1e8d92610bff4f5b05d6a5d8c7a81024

SHA256
7ab106fd702a6432d47a4a1fd838451e47bac43e5a965f3d74fce6b32b33fbee

SHA512
5549591384527567dea113a369e8079c6ebb35f63e4fe2c2f86a34d52d45d976ae102cf7893eb47f37d2ff0e3383d2c173f01483cb0c1416da3ba499f1939a08

Download Submit
C:\Windows\System\JuYhEYE.exe

Filesize
1.9MB

MD5
c2712d030887a9186d418d778398fb8f

SHA1
10c2560af427e50d452d6bae8236ba997cb3d45b

SHA256
25c86d68a3e9f14cf7ab4dc153218d731d7b94bd766e006de7cd2c9d14ce9f45

SHA512
8e58d43e31f7852118c737197777467605a20fdedefb78cf765e6fb0e63a4c9c6343b1a1b8af272fe527ea4748cf9fdad74c27031bae7cb05bca4fb4adcf1b88

Download Submit
C:\Windows\System\KanziIt.exe

Filesize
1.9MB

MD5
2b3999ddd9eee7eb64d20d3d8dc8df47

SHA1
fd89fb83757a333bcbae6312647440663dfc2c0f

SHA256
9804849f4e4abdb2a03feb1cc9310d22fd8f85b9dd37ba0048c7900ffa91fafb

SHA512
6a8b398a128b61f877f6979508f8fa7a50f1b6b0d6b0a93eb40685aa7781f28ae1441dc941fa630c939baa0b675020f7017e12cd0a94154486fee577246380c8

Download Submit
C:\Windows\System\MrSRVIU.exe

Filesize
1.9MB

MD5
1ad552daf03fd33e927268a7e5f603ba

SHA1
2e54acb413b967a79ed1460680fe69ba6bb3ad53

SHA256
7fcbe6a57e622ccef543705beebd017feddfc3e5a803c52e9a53ce899607a4d2

SHA512
72be4a889e9da6ab45ca80c54d6869820a8ae7d0348892448fe8456e1f3c08c20340d26215854b7b5097cc6fcfe72ec80614c8d78c05b0e481aeb0e6d592d831

Download Submit
C:\Windows\System\NyaOcIz.exe

Filesize
1.9MB

MD5
48c52e47ba6e10665dc12e43f6fb5740

SHA1
cb6921b0913718c7d6dbc870ef01c6fffb397fe3

SHA256
cf66938826ba72346952991ffef3745a40d70fe09379a91cc7fcc51613b29aae

SHA512
5b6950b676eb50446ed89be7981f26e986ece1b4cd52082a5b47547eb6014c3b8b1af97e1b01a63a0b24b1852a4d85a73ff430aa69f78b56b1fb7f242c278370

Download Submit
C:\Windows\System\OHVEtmt.exe

Filesize
1.9MB

MD5
dd00ad7179a669677cfc771e5b40937a

SHA1
9d053e0fac1802376bf2f96d330a8131bde1969f

SHA256
84cf77359264d2f1773ff94f645e12d3c6cf34c58268b94de2448a9cbe4a46ec

SHA512
526512072270ed0b829f5c8174a7913da5568ce062b0ea20419a07bc6a8409bab79c271547dd46838fb8954145709318f68e3e01c10e4263a3029ccec7209f8a

Download Submit
C:\Windows\System\OMkFJKY.exe

Filesize
18B

MD5
0ccf85372d6f08655cc5b8a1bfb286c6

SHA1
19c0d15afa3a1724e4aad3aeb560d62824d96ee6

SHA256
e346037445c26dd1dcaee6ec19c9921976440e12a46b5265512a2ebbe020b707

SHA512
46b3e86ab66175e5bdeaa19cae91f567d8c433aabd58be58bf936f08366e274c54b36c7ca0cfdeb255aae1ffab900a8353ef7f99aee465b682ac697979899e2c

Download Submit
C:\Windows\System\OYMjvsg.exe

Filesize
1.9MB

MD5
70f6ff585bddb4063a0f6e82a0a89329

SHA1
37dcf19166f3e851c563dba9d0f5e59ea2e7c09d

SHA256
54a58575768a5fcd13d457015cc5b605a66c30511eae5d518cf93afbcef7a6a5

SHA512
4c0241f9d5331eac59523b51a42cd1bff5549ba0d1fef1008b0a1e70cf8f985734ad0d1341d0d77dd93b0bfaad441682cc1fc65b678922e169ae52c8edbed2ba

Download Submit
C:\Windows\System\QqUbEeo.exe

Filesize
1.9MB

MD5
2f8c533aab51f6dc15751753393e3a1d

SHA1
6b356107886ebe08a6eb597c8f6ce4e5637b9f99

SHA256
56e1242c469c0bba4348d4b80e008943ffcc6cd91d9372d17c86231b21c84c3a

SHA512
06709383ab94ab4a5ab48c3f4d4058eb4c3e72a10ffbccee230f3b5bc09098a41173466e49b616476591a89e45f09695e7cc0918ce3a682ad3e5e2143ccea643

Download Submit
C:\Windows\System\RAMDTHC.exe

Filesize
1.9MB

MD5
2a79a2993cf003b40d6870023e034bce

SHA1
7c45116809b2188dc593fb63ce65446db84e7a83

SHA256
6fafb908c76f27b5e2bf0d269da1012d04d09b90c9843ceb16c5c483c9cd36ca

SHA512
940bf4529985dff609ed5d83402aadf3dbdb0068ce9b047d52742235155e6907c05d643dac9c34310c47892aff16570e307d8135875f84d5113e298f8a4ebb17

Download Submit
C:\Windows\System\RgmqKEk.exe

Filesize
1.9MB

MD5
961aeb0a3175b6d2616e671b110f6be1

SHA1
370692d306de733b0cef2315564a81eca6812cd6

SHA256
1a16bc8647a31a95bfd974c21a93222bbc8bdb5d418f4453fb9cc6565ac4950b

SHA512
a15028f653a676f0cf488542c3c3e3f1bac7a1ef89ae6ecc650e89b2492b57fe3f764c622ca35a72559f3869cf323e5145515d699d8dcda72dc83a8f4cf566ed

Download Submit
C:\Windows\System\SOKjHos.exe

Filesize
1.9MB

MD5
3f04b0cb83ddd6d2bfc4e01a8c42896d

SHA1
01f8436741c92fcc284329d8afbb38c6a9388819

SHA256
722fc05272e5142d7e002a224572d29293140267dcd57d75e85f1dc2eba914c0

SHA512
3b8c565d55d5ec8b688cbe0c32e399400dc0f31186517e87cf3ce3ee3a66de9d7b0edd233536ce0ff0629e449d8973cb3701aba4ba7eaea0b32411d1d331c040

Download Submit
C:\Windows\System\UwGnaCA.exe

Filesize
1.9MB

MD5
88e4bff5dbc8326002eed086fec3c420

SHA1
338b6cb8bb5766a3a2b2ad83216a84376d8aca8c

SHA256
c184d6c550444d74e70321e53f10b46bb5ab35ba489487e6b0d0f993e0a999f9

SHA512
b35e668bad478770a4c601fa556d973cbcf2ae9e941442bcc5d0386db5573f97efb28cade8192bd27651d964ef0ae8a5be278a9189b78cccdfed0ab4a4b2606f

Download Submit
C:\Windows\System\WmlsSzU.exe

Filesize
1.9MB

MD5
bf00a47f9607009c2e92964e788ea44d

SHA1
8b86b52c386272bd40b2c4548ba878ecf5e59361

SHA256
aa5d7eefb97546cec4fbe86bb9462a91f7e400644e198a2081954feac2b49153

SHA512
fe5e4b7ca27ffe3b3bf21441926fc0a3491995d0fbf4379af2524ae3b27187335b8e6cc49cdc648828113b12d5360992d4f76ba638b4f920c3210ce3d100c5e0

Download Submit
C:\Windows\System\YOBhIhD.exe

Filesize
1.9MB

MD5
2c610ebfa54f5af881748b4fe38af4fe

SHA1
016d4f9a4e41c79593e2d4820c030657e894a2f4

SHA256
e7587a2ee24736df15f856d61091369e673a13c8302627dda264847b6c2377fa

SHA512
4fda9bc5a81b233b44cb5d4cc4c71ee271ec4250a395641cde8070f1efb7d57f1039c3d924daf885078861934a43c95c1d3048b58eade660966ddf640f365e99

Download Submit
C:\Windows\System\YazQZqY.exe

Filesize
8B

MD5
0a4d9fd0cc8fe1472d155d5d981ff235

SHA1
137003f778b74f1b96494293112b43e4307e765e

SHA256
4707e767d70e4899759ce8aba6535007a27f8c132e3f3e05b8b8ae03c23dd080

SHA512
ad9c5b802b25d2a28cbec3d4cc246b638fad901bd44704bb559f8a0cf5c0d25f339a2e2fe9f4b8bbba249477fc11b0b14c51d97cfa76d081fb255f90811dd5c7

Download Submit
C:\Windows\System\ZOpjNrE.exe

Filesize
1.9MB

MD5
bb640e51e503af4204d6f203771e5be3

SHA1
ec8658eaf4a7e63f1acbd2e5ef9f407c071e73e8

SHA256
1ee00a6fa24dada64165d9a9b543138bbb14530f211103518acd91c655c39411

SHA512
ebc3135248b94abbf02a59ac5046a86478470b5bcf077161013a3dd5ce928ab50a6a155c1a3cdf12665b3f8f45b8a2586e4a68135f6ecd708bd80639f3eb051d

Download Submit
C:\Windows\System\aIlzkSD.exe

Filesize
1.9MB

MD5
d8a6f901b40f3f809beb39188731ff84

SHA1
f68d545beb122dc880aa82fad445c649846a7bf7

SHA256
795d72ff2d0ce7b600c852b582071c1c2d3f534f74445b2c8eb4e170ecadf0e5

SHA512
a7888db13fedf8ed0eb9e7209bb0c2cf42e9ff8df7cb328f0a91096e5022ee88fb8bc18f8b643518f10172d5c97f9367acb74d9fbd8b1e49a1a2bc52b88d2f9a

Download Submit
C:\Windows\System\eUYcxbv.exe

Filesize
1.9MB

MD5
403d9ad2d78cc655594e53b5a6af26f1

SHA1
b605e5c0df2f6e4ecba4629767642c2eec5035a9

SHA256
eb26d890f42443c4ad199250fad9344b9c2f7a13e95ef207ea46880ae00bddee

SHA512
d6c5ea7ffa208ebeaca65d330f5f2508f28e89862c753b900c2e3e1ec2e5bf6b9ef7e2358f39b6830f6b783635537367eca5193276404da095b979ded641a5aa

Download Submit
C:\Windows\System\fmtsVDy.exe

Filesize
1.9MB

MD5
73d4444a9df9cd4db00cf3eb607e8279

SHA1
0c5420d13dfafec9ce6c9bf1cac75466b22e296b

SHA256
db1056c4d25f785eab83650a55a331b1eb570e70f68259b90fffe83e0b630f00

SHA512
c9ae1425e02e290bc1bf42c4e0dd240a99e3cf32a61df86821cbc1c0fe748983e2e8819df2ddd7000eb2f3d10b123d3970ba54851d9e8e0599b3faaa8b73f80e

Download Submit
C:\Windows\System\gchpXPV.exe

Filesize
1.9MB

MD5
25a0c9c8809014ee85f536efbd5959c9

SHA1
813cef16e24fccfab9585e867140be4b6af76c35

SHA256
9c65ae7847a655116fc6d47d7064cb24df1019a3fb92f1711f820c4ee9adbff9

SHA512
89fa828c0f8f5252650839b5ff96baa383eae24bf462c92fa8c4f8e6c2c2483c3afe0b9b1afe8b4020018876600b321a6604534f327b0c26257e0a301f3b2c4c

Download Submit
C:\Windows\System\nMWsCyL.exe

Filesize
1.9MB

MD5
8c1015ebec9547e6ed5feffd76ee9b58

SHA1
2ad6992853f08acddc2d74b942de59b2ac49145c

SHA256
0e1c2373067c16893c970de5ac8ddc70f0a521933e3975b6322b952975a7496c

SHA512
2035fbde5e84515b072ad4aa67bee1cd58ba449ea7f063999ad6a02c5f2fb88f82a81f748b154c8e7b877587ca213400bd61dc6f20c4b89170dbb6741ff56fdb

Download Submit
C:\Windows\System\oDQJjzJ.exe

Filesize
1.9MB

MD5
9af6d8de42955fe2a5b94fd1971922b2

SHA1
70cca26433a57d8e69ec1751b24342a50854fb1c

SHA256
a3cdd8745173396c33eaa4c0fbd69d7433cd6726f19c8b6d6e95e188f1ae7359

SHA512
475a11443a72e5d6213d25b893829cc292ed81657cb1f5a4d6957b49cb71d71cfde256ef11e49607498c4572db292cff8e8380fab1f9c57d9092b293fb016be6

Download Submit
C:\Windows\System\qrnjzrg.exe

Filesize
1.9MB

MD5
10fc68a855b1b9577b0be5aaa646fe6e

SHA1
1e586eccec0a0b1130317d4445b700cec1000843

SHA256
4dfb9a67e7dc386c48c5023b60ce4f0760ae70d5a1707358cc5bd7bfc70afa17

SHA512
8e5eee2dde43673d7526fc1d32dc20d86ff97d235e83aba6f9d69f8e14fd31f894d3a77b2caff36b900e331779e8aaa28edcc8d1b6533a124e887bc74d4f547b

Download Submit
C:\Windows\System\sCAPckI.exe

Filesize
1.9MB

MD5
7ed1b2eb4b4e3e5a47c9b6d60cde1e27

SHA1
6c6fd1d52a9eb292466c7e185a88344ef91917af

SHA256
d1341c051feb3e5f1a49a880b040d0b3d254f6df34c6b780381963eedf9e2e1b

SHA512
95c042ff5e5b1786bf91ae5b2c5764e8f5f234c314c707acd999296924b9828e64b9dfeacdba0e23592543480867a5ae65380c8a5fde0a9af344abe47d5cf871

Download Submit
C:\Windows\System\vTtEteu.exe

Filesize
1.9MB

MD5
48ffea95854bd07baa0b636b2ed5f303

SHA1
6fe4482abac809ca4caf2e5d9a4612a7763a83e9

SHA256
d05f2ecc6a373d3dc30babe4c43712b24de67509bdd06d3f610472d59f583c8b

SHA512
7584f0762bab7254cefe18721fcbe6b54418a94e323e89745ce0932c5fff38dbb9c2e44fcceac4c7c44449cc9f7aaef851c1ba1a8ded323fd5ae3baa6ebaafe5

Download Submit
C:\Windows\System\vkWxcvD.exe

Filesize
1.9MB

MD5
0dec13191f89ffc6609043d82c69fe0c

SHA1
362d65cfb4363739df20c40474e155b32dc9d1b1

SHA256
193401ae495bc8778f3dd25e6778d9507608f7485fc66a5b77b1f07cf927b3ef

SHA512
3fb5bce35087bf312f5f7668e0f5851befe89321be4561193afa5c35e5bef0401ef21034a97a790483deabc3edf0c998ad213863ad51d84d889566f7933443ae

Download Submit
C:\Windows\System\zCGlbiU.exe

Filesize
1.9MB

MD5
8c38137ef87762961d5ceb80c7b5bc6d

SHA1
1aea57ce37999eaa6bb7e02d4461e6c52111eded

SHA256
b1797314713dd8d7037fe814bd1633fffb4463d4060e436fdb9dfdcb152ff187

SHA512
282179ad9fffe9a457075b3238dce53ced3a7fbfd4a84fc424e043dedf8482a2274a46a0a557d2d8e8b5823c83a2f24ca9faeecb05a457fda7946ee366bd0be8

Download Submit
memory/400-96-0x00007FF7136A0000-0x00007FF713A92000-memory.dmp

Filesize
3.9MB

Download
memory/788-103-0x00007FF747C70000-0x00007FF748062000-memory.dmp

Filesize
3.9MB

Download
memory/1080-1-0x000001AD3A6C0000-0x000001AD3A6D0000-memory.dmp

Filesize
64KB

Download
memory/1080-0-0x00007FF7FC160000-0x00007FF7FC552000-memory.dmp

Filesize
3.9MB

Download
memory/1084-3500-0x00007FF61E970000-0x00007FF61ED62000-memory.dmp

Filesize
3.9MB

Download
memory/1084-113-0x00007FF61E970000-0x00007FF61ED62000-memory.dmp

Filesize
3.9MB

Download
memory/1292-63-0x00007FF694030000-0x00007FF694422000-memory.dmp

Filesize
3.9MB

Download
memory/1516-83-0x00007FF723040000-0x00007FF723432000-memory.dmp

Filesize
3.9MB

Download
memory/1516-3109-0x00007FF723040000-0x00007FF723432000-memory.dmp

Filesize
3.9MB

Download
memory/1664-49-0x00007FF607FD0000-0x00007FF6083C2000-memory.dmp

Filesize
3.9MB

Download
memory/1944-41-0x00007FF60B1E0000-0x00007FF60B5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2232-65-0x00007FF716180000-0x00007FF716572000-memory.dmp

Filesize
3.9MB

Download
memory/2236-11-0x00007FF6EAFC0000-0x00007FF6EB3B2000-memory.dmp

Filesize
3.9MB

Download
memory/2544-147-0x00007FF798B70000-0x00007FF798F62000-memory.dmp

Filesize
3.9MB

Download
memory/2940-3107-0x00007FF770BF0000-0x00007FF770FE2000-memory.dmp

Filesize
3.9MB

Download
memory/2940-66-0x00007FF770BF0000-0x00007FF770FE2000-memory.dmp

Filesize
3.9MB

Download
memory/3140-134-0x00007FF7A41A0000-0x00007FF7A4592000-memory.dmp

Filesize
3.9MB

Download
memory/3492-121-0x00007FF699AF0000-0x00007FF699EE2000-memory.dmp

Filesize
3.9MB

Download
memory/3492-3903-0x00007FF699AF0000-0x00007FF699EE2000-memory.dmp

Filesize
3.9MB

Download
memory/3660-29-0x00007FFAFE3C0000-0x00007FFAFEE81000-memory.dmp

Filesize
10.8MB

Download
memory/3660-36-0x000001B5983C0000-0x000001B5983D0000-memory.dmp

Filesize
64KB

Download
memory/3660-64-0x000001B5FDF60000-0x000001B5FDF82000-memory.dmp

Filesize
136KB

Download
memory/3660-1597-0x00007FFAFE3C0000-0x00007FFAFEE81000-memory.dmp

Filesize
10.8MB

Download
memory/3864-126-0x00007FF6B1610000-0x00007FF6B1A02000-memory.dmp

Filesize
3.9MB

Download
memory/3900-91-0x00007FF78C650000-0x00007FF78CA42000-memory.dmp

Filesize
3.9MB

Download
memory/4156-3499-0x00007FF6CD650000-0x00007FF6CDA42000-memory.dmp

Filesize
3.9MB

Download
memory/4156-105-0x00007FF6CD650000-0x00007FF6CDA42000-memory.dmp

Filesize
3.9MB

Download
memory/4376-35-0x00007FF763F10000-0x00007FF764302000-memory.dmp

Filesize
3.9MB

Download
memory/4748-141-0x00007FF7CA710000-0x00007FF7CAB02000-memory.dmp

Filesize
3.9MB

Download
memory/4828-62-0x00007FF6BA4E0000-0x00007FF6BA8D2000-memory.dmp

Filesize
3.9MB

Download
memory/4828-2696-0x00007FF6BA4E0000-0x00007FF6BA8D2000-memory.dmp

Filesize
3.9MB

Download
memory/4832-43-0x00007FF6CC240000-0x00007FF6CC632000-memory.dmp

Filesize
3.9MB

Download
memory/4916-5608-0x00007FF69E1E0000-0x00007FF69E5D2000-memory.dmp

Filesize
3.9MB

Download
memory/4916-146-0x00007FF69E1E0000-0x00007FF69E5D2000-memory.dmp

Filesize
3.9MB

Download