xmrig | d7fa01281398b842507a9493e22f65cb40b9098c024d2720ebafbf6e4f07021a

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 18:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
Size

1.9MB
MD5

0158856e5f93b80c6af9d86291d1f98a
SHA1

9779130689636df3755ec8a7482213089035db8f
SHA256

d7fa01281398b842507a9493e22f65cb40b9098c024d2720ebafbf6e4f07021a
SHA512

6fd4cd0071ab43e58ea716e90ca2ab747500170e802babc0c07b479432db34085373bba5cf64f0d3518063f5801c6ed53180ddbfd2c7a2d04cc6aeaa75494ef2
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Ul:NABa

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 36 IoCs

miner

resource	yara_rule
behavioral2/memory/2804-536-0x00007FF7EFE10000-0x00007FF7F0202000-memory.dmp	xmrig
behavioral2/memory/3952-594-0x00007FF7C6DE0000-0x00007FF7C71D2000-memory.dmp	xmrig
behavioral2/memory/4600-598-0x00007FF701480000-0x00007FF701872000-memory.dmp	xmrig
behavioral2/memory/1996-601-0x00007FF625420000-0x00007FF625812000-memory.dmp	xmrig
behavioral2/memory/3600-600-0x00007FF6BB990000-0x00007FF6BBD82000-memory.dmp	xmrig
behavioral2/memory/5016-599-0x00007FF62CAF0000-0x00007FF62CEE2000-memory.dmp	xmrig
behavioral2/memory/4948-597-0x00007FF67FE70000-0x00007FF680262000-memory.dmp	xmrig
behavioral2/memory/3252-596-0x00007FF6A76E0000-0x00007FF6A7AD2000-memory.dmp	xmrig
behavioral2/memory/1856-595-0x00007FF61F520000-0x00007FF61F912000-memory.dmp	xmrig
behavioral2/memory/3248-593-0x00007FF674090000-0x00007FF674482000-memory.dmp	xmrig
behavioral2/memory/3904-592-0x00007FF6D9FF0000-0x00007FF6DA3E2000-memory.dmp	xmrig
behavioral2/memory/4548-591-0x00007FF6C0CA0000-0x00007FF6C1092000-memory.dmp	xmrig
behavioral2/memory/4556-450-0x00007FF7A95A0000-0x00007FF7A9992000-memory.dmp	xmrig
behavioral2/memory/2484-376-0x00007FF77EC80000-0x00007FF77F072000-memory.dmp	xmrig
behavioral2/memory/4256-375-0x00007FF6FDE90000-0x00007FF6FE282000-memory.dmp	xmrig
behavioral2/memory/4488-308-0x00007FF661280000-0x00007FF661672000-memory.dmp	xmrig
behavioral2/memory/2656-258-0x00007FF772A10000-0x00007FF772E02000-memory.dmp	xmrig
behavioral2/memory/4852-255-0x00007FF7E0470000-0x00007FF7E0862000-memory.dmp	xmrig
behavioral2/memory/232-202-0x00007FF7B1800000-0x00007FF7B1BF2000-memory.dmp	xmrig
behavioral2/memory/3488-147-0x00007FF6BBA90000-0x00007FF6BBE82000-memory.dmp	xmrig
behavioral2/memory/4392-94-0x00007FF6D0240000-0x00007FF6D0632000-memory.dmp	xmrig
behavioral2/memory/2656-4975-0x00007FF772A10000-0x00007FF772E02000-memory.dmp	xmrig
behavioral2/memory/4852-5062-0x00007FF7E0470000-0x00007FF7E0862000-memory.dmp	xmrig
behavioral2/memory/2804-5031-0x00007FF7EFE10000-0x00007FF7F0202000-memory.dmp	xmrig
behavioral2/memory/232-5121-0x00007FF7B1800000-0x00007FF7B1BF2000-memory.dmp	xmrig
behavioral2/memory/3600-5124-0x00007FF6BB990000-0x00007FF6BBD82000-memory.dmp	xmrig
behavioral2/memory/3904-5133-0x00007FF6D9FF0000-0x00007FF6DA3E2000-memory.dmp	xmrig
behavioral2/memory/4600-5142-0x00007FF701480000-0x00007FF701872000-memory.dmp	xmrig
behavioral2/memory/4256-5151-0x00007FF6FDE90000-0x00007FF6FE282000-memory.dmp	xmrig
behavioral2/memory/1856-5154-0x00007FF61F520000-0x00007FF61F912000-memory.dmp	xmrig
behavioral2/memory/1996-5177-0x00007FF625420000-0x00007FF625812000-memory.dmp	xmrig
behavioral2/memory/4948-5183-0x00007FF67FE70000-0x00007FF680262000-memory.dmp	xmrig
behavioral2/memory/4548-5173-0x00007FF6C0CA0000-0x00007FF6C1092000-memory.dmp	xmrig
behavioral2/memory/3952-5147-0x00007FF7C6DE0000-0x00007FF7C71D2000-memory.dmp	xmrig
behavioral2/memory/3248-5145-0x00007FF674090000-0x00007FF674482000-memory.dmp	xmrig
behavioral2/memory/3252-5150-0x00007FF6A76E0000-0x00007FF6A7AD2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4392	nwNMCEz.exe
3488	PUbPjgY.exe
5016	GDUfzGY.exe
232	uruRcoj.exe
4852	mwYVytT.exe
2656	sGlAjdr.exe
4488	HhAtfdf.exe
4256	zSzHVgN.exe
2484	WOYmlZo.exe
4556	FCGAArv.exe
2804	VlRmFbM.exe
4548	LFjcHNW.exe
3600	JXtwFhJ.exe
3904	eQJmhGE.exe
3248	JSfGuEJ.exe
3952	WmKFbwZ.exe
1856	VXfQKLX.exe
3252	lNBULVF.exe
4948	OYuePYs.exe
4600	PPJUlgz.exe
1996	cBmIIZN.exe
2812	qQJOTcF.exe
2544	kpOUhyW.exe
1876	uKHexzA.exe
1112	ruEeuwG.exe
3840	fZLsWld.exe
1408	oiCzDcP.exe
4436	AabXylK.exe
4288	ykcGkKh.exe
1760	wtnwhJf.exe
3196	vKttIRj.exe
1848	hJxFait.exe
3156	oYeDCZR.exe
1604	WJEvPLZ.exe
4560	TMmteDA.exe
8	CJpUBpR.exe
2176	faYxozc.exe
3144	gDlrpnt.exe
3088	NWOjwHo.exe
4900	ldaQzvm.exe
4400	spfxNaZ.exe
3668	JcgOxWz.exe
3148	HsNLHlF.exe
3816	osNNIyy.exe
4568	IYgKRvt.exe
3492	okiQauu.exe
4516	jhFmvsU.exe
3516	UmLhgRv.exe
1808	nQCsJDe.exe
3440	JTXPncd.exe
3732	TuDFsuT.exe
3200	LbXvVOq.exe
4896	lpPxFdF.exe
4944	QCArTXO.exe
4584	juUdwIU.exe
4820	IZaIjJQ.exe
2920	GPCsIFK.exe
5048	JzKLDPg.exe
5100	dvHfbYT.exe
2936	pyjMpXA.exe
3460	ATfLouk.exe
4276	sETlrDK.exe
32	uocRXip.exe
484	xBXgUvq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/908-0-0x00007FF6F69F0000-0x00007FF6F6DE2000-memory.dmp	upx
behavioral2/files/0x0009000000023b1b-7.dat	upx
behavioral2/files/0x000a000000023b89-13.dat	upx
behavioral2/files/0x000a000000023b8a-18.dat	upx
behavioral2/files/0x000a000000023b8d-67.dat	upx
behavioral2/files/0x000a000000023ba1-134.dat	upx
behavioral2/memory/2804-536-0x00007FF7EFE10000-0x00007FF7F0202000-memory.dmp	upx
behavioral2/memory/3952-594-0x00007FF7C6DE0000-0x00007FF7C71D2000-memory.dmp	upx
behavioral2/memory/4600-598-0x00007FF701480000-0x00007FF701872000-memory.dmp	upx
behavioral2/memory/1996-601-0x00007FF625420000-0x00007FF625812000-memory.dmp	upx
behavioral2/memory/3600-600-0x00007FF6BB990000-0x00007FF6BBD82000-memory.dmp	upx
behavioral2/memory/5016-599-0x00007FF62CAF0000-0x00007FF62CEE2000-memory.dmp	upx
behavioral2/memory/4948-597-0x00007FF67FE70000-0x00007FF680262000-memory.dmp	upx
behavioral2/memory/3252-596-0x00007FF6A76E0000-0x00007FF6A7AD2000-memory.dmp	upx
behavioral2/memory/1856-595-0x00007FF61F520000-0x00007FF61F912000-memory.dmp	upx
behavioral2/memory/3248-593-0x00007FF674090000-0x00007FF674482000-memory.dmp	upx
behavioral2/memory/3904-592-0x00007FF6D9FF0000-0x00007FF6DA3E2000-memory.dmp	upx
behavioral2/memory/4548-591-0x00007FF6C0CA0000-0x00007FF6C1092000-memory.dmp	upx
behavioral2/memory/4556-450-0x00007FF7A95A0000-0x00007FF7A9992000-memory.dmp	upx
behavioral2/memory/2484-376-0x00007FF77EC80000-0x00007FF77F072000-memory.dmp	upx
behavioral2/memory/4256-375-0x00007FF6FDE90000-0x00007FF6FE282000-memory.dmp	upx
behavioral2/memory/4488-308-0x00007FF661280000-0x00007FF661672000-memory.dmp	upx
behavioral2/memory/2656-258-0x00007FF772A10000-0x00007FF772E02000-memory.dmp	upx
behavioral2/memory/4852-255-0x00007FF7E0470000-0x00007FF7E0862000-memory.dmp	upx
behavioral2/files/0x000a000000023bae-204.dat	upx
behavioral2/memory/232-202-0x00007FF7B1800000-0x00007FF7B1BF2000-memory.dmp	upx
behavioral2/files/0x000a000000023bad-198.dat	upx
behavioral2/files/0x000a000000023baa-187.dat	upx
behavioral2/files/0x000a000000023bab-186.dat	upx
behavioral2/files/0x000a000000023ba9-183.dat	upx
behavioral2/files/0x000a000000023ba8-177.dat	upx
behavioral2/files/0x000a000000023b9e-173.dat	upx
behavioral2/files/0x000a000000023ba6-172.dat	upx
behavioral2/files/0x000a000000023b98-159.dat	upx
behavioral2/files/0x000a000000023ba5-155.dat	upx
behavioral2/files/0x000a000000023ba4-148.dat	upx
behavioral2/memory/3488-147-0x00007FF6BBA90000-0x00007FF6BBE82000-memory.dmp	upx
behavioral2/files/0x000a000000023ba3-146.dat	upx
behavioral2/files/0x000a000000023ba2-140.dat	upx
behavioral2/files/0x000a000000023bac-190.dat	upx
behavioral2/files/0x000a000000023b95-130.dat	upx
behavioral2/files/0x000a000000023b94-126.dat	upx
behavioral2/files/0x000a000000023b9f-123.dat	upx
behavioral2/files/0x000a000000023b93-179.dat	upx
behavioral2/files/0x000a000000023b97-165.dat	upx
behavioral2/files/0x000a000000023b91-108.dat	upx
behavioral2/files/0x000a000000023b96-106.dat	upx
behavioral2/files/0x000a000000023b8f-102.dat	upx
behavioral2/files/0x000a000000023b90-101.dat	upx
behavioral2/files/0x000a000000023b9a-97.dat	upx
behavioral2/memory/4392-94-0x00007FF6D0240000-0x00007FF6D0632000-memory.dmp	upx
behavioral2/files/0x000a000000023ba0-122.dat	upx
behavioral2/files/0x000a000000023b99-87.dat	upx
behavioral2/files/0x000a000000023b9d-111.dat	upx
behavioral2/files/0x000a000000023b8e-79.dat	upx
behavioral2/files/0x000a000000023b9c-107.dat	upx
behavioral2/files/0x000a000000023b9b-98.dat	upx
behavioral2/files/0x000a000000023b8b-69.dat	upx
behavioral2/files/0x000a000000023b92-54.dat	upx
behavioral2/files/0x000a000000023b8c-39.dat	upx
behavioral2/files/0x000a000000023b88-17.dat	upx
behavioral2/memory/2656-4975-0x00007FF772A10000-0x00007FF772E02000-memory.dmp	upx
behavioral2/memory/4852-5062-0x00007FF7E0470000-0x00007FF7E0862000-memory.dmp	upx
behavioral2/memory/2804-5031-0x00007FF7EFE10000-0x00007FF7F0202000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FeeAIUr.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\SFBxijs.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\rDHmcij.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\ryJElKV.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\NuMWECg.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\YMjQONG.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\WqbBPdD.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\NiNLIFc.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\KUObMck.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\NmWBOEb.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\mdtOxEB.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\cCNVCiq.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\mWiQMoL.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\efazRdw.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\FgrZqTF.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\wGHHoal.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\bKVufSR.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\ZmxOqnJ.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\lcRNBJb.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\GhDKhfT.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\ISyBmRw.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\cBAICCe.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\yBRzpIb.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\dArxwWM.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\uLzhBuQ.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\gfCkuSb.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\DsAKqqm.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\HaREhYB.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\IJMvgLj.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\IGTiJOM.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\mznaUoJ.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\izzGZkx.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\FFKWMvL.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\biQUcUv.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\LtqHBiE.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\gPHtomb.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\AYuHCEc.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\bPzkYbc.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\ABWebiD.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\ZspbHxA.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\iMiyNle.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\PbSUWFt.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\koHjKfH.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\UfTnhxI.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\sCUnfdg.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\ZoBjewj.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\foKGZiD.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\yLUzaeg.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\maFztaB.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\jkhPbYY.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\pyiXHBH.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\mclqNsw.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\PPJhLXF.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\ItfCzzr.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\ZUrphoy.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\sKzfiUA.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\rAlGHkg.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\kNlFsDJ.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\LazmHMc.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\UHNrkcK.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\RmumGah.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\ACjvNSc.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\VwZdMqX.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
File created	C:\Windows\System\wbkvNIJ.exe	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3588	powershell.exe
3588	powershell.exe
3588	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeLockMemoryPrivilege	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 3588	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	87
PID 908 wrote to memory of 3588	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	87
PID 908 wrote to memory of 4392	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	88
PID 908 wrote to memory of 4392	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	88
PID 908 wrote to memory of 3488	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	89
PID 908 wrote to memory of 3488	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	89
PID 908 wrote to memory of 5016	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	90
PID 908 wrote to memory of 5016	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	90
PID 908 wrote to memory of 232	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	91
PID 908 wrote to memory of 232	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	91
PID 908 wrote to memory of 4852	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	92
PID 908 wrote to memory of 4852	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	92
PID 908 wrote to memory of 2656	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	93
PID 908 wrote to memory of 2656	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	93
PID 908 wrote to memory of 4488	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	94
PID 908 wrote to memory of 4488	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	94
PID 908 wrote to memory of 4256	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	95
PID 908 wrote to memory of 4256	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	95
PID 908 wrote to memory of 3248	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	96
PID 908 wrote to memory of 3248	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	96
PID 908 wrote to memory of 2484	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	97
PID 908 wrote to memory of 2484	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	97
PID 908 wrote to memory of 4556	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	98
PID 908 wrote to memory of 4556	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	98
PID 908 wrote to memory of 2804	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	99
PID 908 wrote to memory of 2804	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	99
PID 908 wrote to memory of 4548	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	100
PID 908 wrote to memory of 4548	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	100
PID 908 wrote to memory of 3600	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	101
PID 908 wrote to memory of 3600	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	101
PID 908 wrote to memory of 3904	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	102
PID 908 wrote to memory of 3904	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	102
PID 908 wrote to memory of 3952	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	103
PID 908 wrote to memory of 3952	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	103
PID 908 wrote to memory of 1856	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	104
PID 908 wrote to memory of 1856	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	104
PID 908 wrote to memory of 3252	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	105
PID 908 wrote to memory of 3252	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	105
PID 908 wrote to memory of 4948	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	106
PID 908 wrote to memory of 4948	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	106
PID 908 wrote to memory of 4600	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	107
PID 908 wrote to memory of 4600	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	107
PID 908 wrote to memory of 1996	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	108
PID 908 wrote to memory of 1996	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	108
PID 908 wrote to memory of 2812	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	109
PID 908 wrote to memory of 2812	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	109
PID 908 wrote to memory of 2544	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	110
PID 908 wrote to memory of 2544	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	110
PID 908 wrote to memory of 1876	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	111
PID 908 wrote to memory of 1876	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	111
PID 908 wrote to memory of 1112	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	112
PID 908 wrote to memory of 1112	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	112
PID 908 wrote to memory of 3840	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	113
PID 908 wrote to memory of 3840	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	113
PID 908 wrote to memory of 1408	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	114
PID 908 wrote to memory of 1408	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	114
PID 908 wrote to memory of 4436	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	115
PID 908 wrote to memory of 4436	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	115
PID 908 wrote to memory of 4288	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	116
PID 908 wrote to memory of 4288	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	116
PID 908 wrote to memory of 1760	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	117
PID 908 wrote to memory of 1760	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	117
PID 908 wrote to memory of 3196	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	118
PID 908 wrote to memory of 3196	908	0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe	118

C:\Users\Admin\AppData\Local\Temp\0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0158856e5f93b80c6af9d86291d1f98a_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3588
- C:\Windows\System\nwNMCEz.exe
  C:\Windows\System\nwNMCEz.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\PUbPjgY.exe
  C:\Windows\System\PUbPjgY.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\GDUfzGY.exe
  C:\Windows\System\GDUfzGY.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\uruRcoj.exe
  C:\Windows\System\uruRcoj.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\mwYVytT.exe
  C:\Windows\System\mwYVytT.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\sGlAjdr.exe
  C:\Windows\System\sGlAjdr.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\HhAtfdf.exe
  C:\Windows\System\HhAtfdf.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\zSzHVgN.exe
  C:\Windows\System\zSzHVgN.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\JSfGuEJ.exe
  C:\Windows\System\JSfGuEJ.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\WOYmlZo.exe
  C:\Windows\System\WOYmlZo.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\FCGAArv.exe
  C:\Windows\System\FCGAArv.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\VlRmFbM.exe
  C:\Windows\System\VlRmFbM.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\LFjcHNW.exe
  C:\Windows\System\LFjcHNW.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\JXtwFhJ.exe
  C:\Windows\System\JXtwFhJ.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\eQJmhGE.exe
  C:\Windows\System\eQJmhGE.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\WmKFbwZ.exe
  C:\Windows\System\WmKFbwZ.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\VXfQKLX.exe
  C:\Windows\System\VXfQKLX.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\lNBULVF.exe
  C:\Windows\System\lNBULVF.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\OYuePYs.exe
  C:\Windows\System\OYuePYs.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\PPJUlgz.exe
  C:\Windows\System\PPJUlgz.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\cBmIIZN.exe
  C:\Windows\System\cBmIIZN.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\qQJOTcF.exe
  C:\Windows\System\qQJOTcF.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\kpOUhyW.exe
  C:\Windows\System\kpOUhyW.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\uKHexzA.exe
  C:\Windows\System\uKHexzA.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\ruEeuwG.exe
  C:\Windows\System\ruEeuwG.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\fZLsWld.exe
  C:\Windows\System\fZLsWld.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\oiCzDcP.exe
  C:\Windows\System\oiCzDcP.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\AabXylK.exe
  C:\Windows\System\AabXylK.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\ykcGkKh.exe
  C:\Windows\System\ykcGkKh.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\wtnwhJf.exe
  C:\Windows\System\wtnwhJf.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\vKttIRj.exe
  C:\Windows\System\vKttIRj.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\hJxFait.exe
  C:\Windows\System\hJxFait.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\IYgKRvt.exe
  C:\Windows\System\IYgKRvt.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\oYeDCZR.exe
  C:\Windows\System\oYeDCZR.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\WJEvPLZ.exe
  C:\Windows\System\WJEvPLZ.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\TMmteDA.exe
  C:\Windows\System\TMmteDA.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\CJpUBpR.exe
  C:\Windows\System\CJpUBpR.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\faYxozc.exe
  C:\Windows\System\faYxozc.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\gDlrpnt.exe
  C:\Windows\System\gDlrpnt.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\NWOjwHo.exe
  C:\Windows\System\NWOjwHo.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\ldaQzvm.exe
  C:\Windows\System\ldaQzvm.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\GPCsIFK.exe
  C:\Windows\System\GPCsIFK.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\spfxNaZ.exe
  C:\Windows\System\spfxNaZ.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\dvHfbYT.exe
  C:\Windows\System\dvHfbYT.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\JcgOxWz.exe
  C:\Windows\System\JcgOxWz.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\HsNLHlF.exe
  C:\Windows\System\HsNLHlF.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\ATfLouk.exe
  C:\Windows\System\ATfLouk.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\osNNIyy.exe
  C:\Windows\System\osNNIyy.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\okiQauu.exe
  C:\Windows\System\okiQauu.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\jhFmvsU.exe
  C:\Windows\System\jhFmvsU.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\UmLhgRv.exe
  C:\Windows\System\UmLhgRv.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\nQCsJDe.exe
  C:\Windows\System\nQCsJDe.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\JTXPncd.exe
  C:\Windows\System\JTXPncd.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\TuDFsuT.exe
  C:\Windows\System\TuDFsuT.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\LbXvVOq.exe
  C:\Windows\System\LbXvVOq.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\lpPxFdF.exe
  C:\Windows\System\lpPxFdF.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\QCArTXO.exe
  C:\Windows\System\QCArTXO.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\juUdwIU.exe
  C:\Windows\System\juUdwIU.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\IZaIjJQ.exe
  C:\Windows\System\IZaIjJQ.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\JzKLDPg.exe
  C:\Windows\System\JzKLDPg.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\lrpGrCc.exe
  C:\Windows\System\lrpGrCc.exe
  2⤵
  PID:1660
- C:\Windows\System\pyjMpXA.exe
  C:\Windows\System\pyjMpXA.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\fXSYoFz.exe
  C:\Windows\System\fXSYoFz.exe
  2⤵
  PID:4296
- C:\Windows\System\sETlrDK.exe
  C:\Windows\System\sETlrDK.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\uocRXip.exe
  C:\Windows\System\uocRXip.exe
  2⤵
  - Executes dropped EXE
  PID:32
- C:\Windows\System\xBXgUvq.exe
  C:\Windows\System\xBXgUvq.exe
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Windows\System\anmAKyu.exe
  C:\Windows\System\anmAKyu.exe
  2⤵
  PID:1504
- C:\Windows\System\NGrPQbz.exe
  C:\Windows\System\NGrPQbz.exe
  2⤵
  PID:1120
- C:\Windows\System\cFmQctL.exe
  C:\Windows\System\cFmQctL.exe
  2⤵
  PID:4740
- C:\Windows\System\oPqnEOD.exe
  C:\Windows\System\oPqnEOD.exe
  2⤵
  PID:4904
- C:\Windows\System\yZRSqhJ.exe
  C:\Windows\System\yZRSqhJ.exe
  2⤵
  PID:2648
- C:\Windows\System\YMinUep.exe
  C:\Windows\System\YMinUep.exe
  2⤵
  PID:2316
- C:\Windows\System\PFpxyQK.exe
  C:\Windows\System\PFpxyQK.exe
  2⤵
  PID:768
- C:\Windows\System\edrZbwq.exe
  C:\Windows\System\edrZbwq.exe
  2⤵
  PID:2420
- C:\Windows\System\eEqULgR.exe
  C:\Windows\System\eEqULgR.exe
  2⤵
  PID:3412
- C:\Windows\System\epgYjgr.exe
  C:\Windows\System\epgYjgr.exe
  2⤵
  PID:4992
- C:\Windows\System\KoreRFh.exe
  C:\Windows\System\KoreRFh.exe
  2⤵
  PID:4228
- C:\Windows\System\fCvwiuI.exe
  C:\Windows\System\fCvwiuI.exe
  2⤵
  PID:2012
- C:\Windows\System\xxvwZZL.exe
  C:\Windows\System\xxvwZZL.exe
  2⤵
  PID:2472
- C:\Windows\System\TUyrIeP.exe
  C:\Windows\System\TUyrIeP.exe
  2⤵
  PID:780
- C:\Windows\System\XIWvAHs.exe
  C:\Windows\System\XIWvAHs.exe
  2⤵
  PID:4032
- C:\Windows\System\vAskffZ.exe
  C:\Windows\System\vAskffZ.exe
  2⤵
  PID:2064
- C:\Windows\System\kvIwKgO.exe
  C:\Windows\System\kvIwKgO.exe
  2⤵
  PID:2660
- C:\Windows\System\iykPLGI.exe
  C:\Windows\System\iykPLGI.exe
  2⤵
  PID:3524
- C:\Windows\System\eniNZOH.exe
  C:\Windows\System\eniNZOH.exe
  2⤵
  PID:5124
- C:\Windows\System\IebzsTs.exe
  C:\Windows\System\IebzsTs.exe
  2⤵
  PID:5156
- C:\Windows\System\JftdmgM.exe
  C:\Windows\System\JftdmgM.exe
  2⤵
  PID:5180
- C:\Windows\System\cRZZjEO.exe
  C:\Windows\System\cRZZjEO.exe
  2⤵
  PID:5212
- C:\Windows\System\lKzcDDn.exe
  C:\Windows\System\lKzcDDn.exe
  2⤵
  PID:5236
- C:\Windows\System\xmzHkTq.exe
  C:\Windows\System\xmzHkTq.exe
  2⤵
  PID:5260
- C:\Windows\System\oPmfuQX.exe
  C:\Windows\System\oPmfuQX.exe
  2⤵
  PID:5284
- C:\Windows\System\dsbYZKp.exe
  C:\Windows\System\dsbYZKp.exe
  2⤵
  PID:5304
- C:\Windows\System\akfrGAC.exe
  C:\Windows\System\akfrGAC.exe
  2⤵
  PID:5340
- C:\Windows\System\SfSnEFC.exe
  C:\Windows\System\SfSnEFC.exe
  2⤵
  PID:5360
- C:\Windows\System\IAPtcup.exe
  C:\Windows\System\IAPtcup.exe
  2⤵
  PID:5376
- C:\Windows\System\KATFqNL.exe
  C:\Windows\System\KATFqNL.exe
  2⤵
  PID:5404
- C:\Windows\System\ebzOCmD.exe
  C:\Windows\System\ebzOCmD.exe
  2⤵
  PID:5424
- C:\Windows\System\JiqMDyo.exe
  C:\Windows\System\JiqMDyo.exe
  2⤵
  PID:5448
- C:\Windows\System\BJyrOFs.exe
  C:\Windows\System\BJyrOFs.exe
  2⤵
  PID:5472
- C:\Windows\System\lUWfufJ.exe
  C:\Windows\System\lUWfufJ.exe
  2⤵
  PID:5508
- C:\Windows\System\RRJCdJt.exe
  C:\Windows\System\RRJCdJt.exe
  2⤵
  PID:5532
- C:\Windows\System\ybcaTxB.exe
  C:\Windows\System\ybcaTxB.exe
  2⤵
  PID:5556
- C:\Windows\System\jFIqyaR.exe
  C:\Windows\System\jFIqyaR.exe
  2⤵
  PID:5576
- C:\Windows\System\mUKfXAx.exe
  C:\Windows\System\mUKfXAx.exe
  2⤵
  PID:5604
- C:\Windows\System\cGIwhWJ.exe
  C:\Windows\System\cGIwhWJ.exe
  2⤵
  PID:5628
- C:\Windows\System\fBDJhlk.exe
  C:\Windows\System\fBDJhlk.exe
  2⤵
  PID:5648
- C:\Windows\System\vvysvHu.exe
  C:\Windows\System\vvysvHu.exe
  2⤵
  PID:5680
- C:\Windows\System\smHKpsE.exe
  C:\Windows\System\smHKpsE.exe
  2⤵
  PID:5696
- C:\Windows\System\nEscPZI.exe
  C:\Windows\System\nEscPZI.exe
  2⤵
  PID:5720
- C:\Windows\System\qRkTGmx.exe
  C:\Windows\System\qRkTGmx.exe
  2⤵
  PID:5768
- C:\Windows\System\eoITsfK.exe
  C:\Windows\System\eoITsfK.exe
  2⤵
  PID:5792
- C:\Windows\System\aGSRAAD.exe
  C:\Windows\System\aGSRAAD.exe
  2⤵
  PID:5808
- C:\Windows\System\xBxaQDb.exe
  C:\Windows\System\xBxaQDb.exe
  2⤵
  PID:5832
- C:\Windows\System\lxwecEs.exe
  C:\Windows\System\lxwecEs.exe
  2⤵
  PID:5856
- C:\Windows\System\ybKPZfi.exe
  C:\Windows\System\ybKPZfi.exe
  2⤵
  PID:5876
- C:\Windows\System\FLYOLvX.exe
  C:\Windows\System\FLYOLvX.exe
  2⤵
  PID:5896
- C:\Windows\System\kgxuGSB.exe
  C:\Windows\System\kgxuGSB.exe
  2⤵
  PID:5928
- C:\Windows\System\AUcIBGa.exe
  C:\Windows\System\AUcIBGa.exe
  2⤵
  PID:5948
- C:\Windows\System\BjntgQp.exe
  C:\Windows\System\BjntgQp.exe
  2⤵
  PID:5968
- C:\Windows\System\fpdELkH.exe
  C:\Windows\System\fpdELkH.exe
  2⤵
  PID:5988
- C:\Windows\System\CRwuWJx.exe
  C:\Windows\System\CRwuWJx.exe
  2⤵
  PID:6012
- C:\Windows\System\KiOhlnc.exe
  C:\Windows\System\KiOhlnc.exe
  2⤵
  PID:6048
- C:\Windows\System\QOpuNdE.exe
  C:\Windows\System\QOpuNdE.exe
  2⤵
  PID:6064
- C:\Windows\System\XfrNYGd.exe
  C:\Windows\System\XfrNYGd.exe
  2⤵
  PID:6092
- C:\Windows\System\IpYzJii.exe
  C:\Windows\System\IpYzJii.exe
  2⤵
  PID:6112
- C:\Windows\System\DmkvuXR.exe
  C:\Windows\System\DmkvuXR.exe
  2⤵
  PID:6140
- C:\Windows\System\XRXvsLB.exe
  C:\Windows\System\XRXvsLB.exe
  2⤵
  PID:352
- C:\Windows\System\CPTSpzY.exe
  C:\Windows\System\CPTSpzY.exe
  2⤵
  PID:1308
- C:\Windows\System\ffBcszv.exe
  C:\Windows\System\ffBcszv.exe
  2⤵
  PID:1332
- C:\Windows\System\KUTBFrK.exe
  C:\Windows\System\KUTBFrK.exe
  2⤵
  PID:1040
- C:\Windows\System\RpcEdSD.exe
  C:\Windows\System\RpcEdSD.exe
  2⤵
  PID:3540
- C:\Windows\System\yWyzLMY.exe
  C:\Windows\System\yWyzLMY.exe
  2⤵
  PID:4420
- C:\Windows\System\pENsgFG.exe
  C:\Windows\System\pENsgFG.exe
  2⤵
  PID:3596
- C:\Windows\System\CUhLLaQ.exe
  C:\Windows\System\CUhLLaQ.exe
  2⤵
  PID:3416
- C:\Windows\System\FZBGZvG.exe
  C:\Windows\System\FZBGZvG.exe
  2⤵
  PID:5152
- C:\Windows\System\dEdHfBr.exe
  C:\Windows\System\dEdHfBr.exe
  2⤵
  PID:4384
- C:\Windows\System\ngsxsmv.exe
  C:\Windows\System\ngsxsmv.exe
  2⤵
  PID:4912
- C:\Windows\System\VqHfKIP.exe
  C:\Windows\System\VqHfKIP.exe
  2⤵
  PID:1068
- C:\Windows\System\TFfwEti.exe
  C:\Windows\System\TFfwEti.exe
  2⤵
  PID:5368
- C:\Windows\System\FmIsHQy.exe
  C:\Windows\System\FmIsHQy.exe
  2⤵
  PID:5008
- C:\Windows\System\LdvQUab.exe
  C:\Windows\System\LdvQUab.exe
  2⤵
  PID:4724
- C:\Windows\System\bWrpyyi.exe
  C:\Windows\System\bWrpyyi.exe
  2⤵
  PID:5612
- C:\Windows\System\WOPzUPa.exe
  C:\Windows\System\WOPzUPa.exe
  2⤵
  PID:5664
- C:\Windows\System\jeitHUs.exe
  C:\Windows\System\jeitHUs.exe
  2⤵
  PID:3028
- C:\Windows\System\yZcFqZt.exe
  C:\Windows\System\yZcFqZt.exe
  2⤵
  PID:5272
- C:\Windows\System\YJYzdBW.exe
  C:\Windows\System\YJYzdBW.exe
  2⤵
  PID:4648
- C:\Windows\System\WpclDwZ.exe
  C:\Windows\System\WpclDwZ.exe
  2⤵
  PID:1824
- C:\Windows\System\zVOklaC.exe
  C:\Windows\System\zVOklaC.exe
  2⤵
  PID:5036
- C:\Windows\System\PPPmyUq.exe
  C:\Windows\System\PPPmyUq.exe
  2⤵
  PID:5924
- C:\Windows\System\Uwrtckg.exe
  C:\Windows\System\Uwrtckg.exe
  2⤵
  PID:6160
- C:\Windows\System\QpCnPFq.exe
  C:\Windows\System\QpCnPFq.exe
  2⤵
  PID:6184
- C:\Windows\System\NrjApRF.exe
  C:\Windows\System\NrjApRF.exe
  2⤵
  PID:6204
- C:\Windows\System\EUUUgYY.exe
  C:\Windows\System\EUUUgYY.exe
  2⤵
  PID:6224
- C:\Windows\System\BqiBsmR.exe
  C:\Windows\System\BqiBsmR.exe
  2⤵
  PID:6240
- C:\Windows\System\aPrfrVC.exe
  C:\Windows\System\aPrfrVC.exe
  2⤵
  PID:6268
- C:\Windows\System\rrxcXYs.exe
  C:\Windows\System\rrxcXYs.exe
  2⤵
  PID:6296
- C:\Windows\System\EsWnETh.exe
  C:\Windows\System\EsWnETh.exe
  2⤵
  PID:6320
- C:\Windows\System\YoYgCAN.exe
  C:\Windows\System\YoYgCAN.exe
  2⤵
  PID:6348
- C:\Windows\System\DvTOsVL.exe
  C:\Windows\System\DvTOsVL.exe
  2⤵
  PID:6364
- C:\Windows\System\RyZBKBY.exe
  C:\Windows\System\RyZBKBY.exe
  2⤵
  PID:6388
- C:\Windows\System\GnLXiAh.exe
  C:\Windows\System\GnLXiAh.exe
  2⤵
  PID:6412
- C:\Windows\System\ODyYakx.exe
  C:\Windows\System\ODyYakx.exe
  2⤵
  PID:6436
- C:\Windows\System\UFIraEm.exe
  C:\Windows\System\UFIraEm.exe
  2⤵
  PID:6452
- C:\Windows\System\gZJOkBh.exe
  C:\Windows\System\gZJOkBh.exe
  2⤵
  PID:6480
- C:\Windows\System\okaKbGP.exe
  C:\Windows\System\okaKbGP.exe
  2⤵
  PID:6496
- C:\Windows\System\StqJiiJ.exe
  C:\Windows\System\StqJiiJ.exe
  2⤵
  PID:6524
- C:\Windows\System\DwlqrQt.exe
  C:\Windows\System\DwlqrQt.exe
  2⤵
  PID:6540
- C:\Windows\System\OatXbKA.exe
  C:\Windows\System\OatXbKA.exe
  2⤵
  PID:6560
- C:\Windows\System\IHkZVIo.exe
  C:\Windows\System\IHkZVIo.exe
  2⤵
  PID:6588
- C:\Windows\System\DFFtLZw.exe
  C:\Windows\System\DFFtLZw.exe
  2⤵
  PID:6604
- C:\Windows\System\RsxlKUl.exe
  C:\Windows\System\RsxlKUl.exe
  2⤵
  PID:6624
- C:\Windows\System\nNoKvgN.exe
  C:\Windows\System\nNoKvgN.exe
  2⤵
  PID:6644
- C:\Windows\System\wDsOTQn.exe
  C:\Windows\System\wDsOTQn.exe
  2⤵
  PID:6664
- C:\Windows\System\iTydkVu.exe
  C:\Windows\System\iTydkVu.exe
  2⤵
  PID:6720
- C:\Windows\System\FyfhyWl.exe
  C:\Windows\System\FyfhyWl.exe
  2⤵
  PID:6748
- C:\Windows\System\YfUENvC.exe
  C:\Windows\System\YfUENvC.exe
  2⤵
  PID:6772
- C:\Windows\System\PiJGxXo.exe
  C:\Windows\System\PiJGxXo.exe
  2⤵
  PID:6796
- C:\Windows\System\CkIZGYr.exe
  C:\Windows\System\CkIZGYr.exe
  2⤵
  PID:6812
- C:\Windows\System\vWNYyBr.exe
  C:\Windows\System\vWNYyBr.exe
  2⤵
  PID:6836
- C:\Windows\System\QeZZEBZ.exe
  C:\Windows\System\QeZZEBZ.exe
  2⤵
  PID:6856
- C:\Windows\System\WzIFmkU.exe
  C:\Windows\System\WzIFmkU.exe
  2⤵
  PID:6880
- C:\Windows\System\TzXCIZC.exe
  C:\Windows\System\TzXCIZC.exe
  2⤵
  PID:6908
- C:\Windows\System\twqYOUB.exe
  C:\Windows\System\twqYOUB.exe
  2⤵
  PID:6928
- C:\Windows\System\YpffOvA.exe
  C:\Windows\System\YpffOvA.exe
  2⤵
  PID:6948
- C:\Windows\System\qFGXkOI.exe
  C:\Windows\System\qFGXkOI.exe
  2⤵
  PID:6972
- C:\Windows\System\QSECrSu.exe
  C:\Windows\System\QSECrSu.exe
  2⤵
  PID:6992
- C:\Windows\System\kFwcsey.exe
  C:\Windows\System\kFwcsey.exe
  2⤵
  PID:7012
- C:\Windows\System\ZxTZvAP.exe
  C:\Windows\System\ZxTZvAP.exe
  2⤵
  PID:7036
- C:\Windows\System\axAoYAX.exe
  C:\Windows\System\axAoYAX.exe
  2⤵
  PID:7068
- C:\Windows\System\iiTxqhC.exe
  C:\Windows\System\iiTxqhC.exe
  2⤵
  PID:7092
- C:\Windows\System\YAvLMUv.exe
  C:\Windows\System\YAvLMUv.exe
  2⤵
  PID:7108
- C:\Windows\System\MUboMrb.exe
  C:\Windows\System\MUboMrb.exe
  2⤵
  PID:7132
- C:\Windows\System\FEwgfWd.exe
  C:\Windows\System\FEwgfWd.exe
  2⤵
  PID:7156
- C:\Windows\System\hHsdFbE.exe
  C:\Windows\System\hHsdFbE.exe
  2⤵
  PID:1484
- C:\Windows\System\PqCkCyl.exe
  C:\Windows\System\PqCkCyl.exe
  2⤵
  PID:6088
- C:\Windows\System\XfrZdXY.exe
  C:\Windows\System\XfrZdXY.exe
  2⤵
  PID:4424
- C:\Windows\System\pSjGQmX.exe
  C:\Windows\System\pSjGQmX.exe
  2⤵
  PID:4708
- C:\Windows\System\QSDcxMo.exe
  C:\Windows\System\QSDcxMo.exe
  2⤵
  PID:5144
- C:\Windows\System\OWvWrAU.exe
  C:\Windows\System\OWvWrAU.exe
  2⤵
  PID:5388
- C:\Windows\System\MCsbYhX.exe
  C:\Windows\System\MCsbYhX.exe
  2⤵
  PID:5956
- C:\Windows\System\QAJzGPR.exe
  C:\Windows\System\QAJzGPR.exe
  2⤵
  PID:6020
- C:\Windows\System\LiiqyYa.exe
  C:\Windows\System\LiiqyYa.exe
  2⤵
  PID:5416
- C:\Windows\System\ClwgFvU.exe
  C:\Windows\System\ClwgFvU.exe
  2⤵
  PID:5440
- C:\Windows\System\JADZnHR.exe
  C:\Windows\System\JADZnHR.exe
  2⤵
  PID:6384
- C:\Windows\System\sifdAHr.exe
  C:\Windows\System\sifdAHr.exe
  2⤵
  PID:6444
- C:\Windows\System\fWBzuNd.exe
  C:\Windows\System\fWBzuNd.exe
  2⤵
  PID:5520
- C:\Windows\System\fNYUiTt.exe
  C:\Windows\System\fNYUiTt.exe
  2⤵
  PID:5544
- C:\Windows\System\edqayEK.exe
  C:\Windows\System\edqayEK.exe
  2⤵
  PID:5640
- C:\Windows\System\XuUvCfi.exe
  C:\Windows\System\XuUvCfi.exe
  2⤵
  PID:5728
- C:\Windows\System\FFjfDbi.exe
  C:\Windows\System\FFjfDbi.exe
  2⤵
  PID:5776
- C:\Windows\System\OFPGhVn.exe
  C:\Windows\System\OFPGhVn.exe
  2⤵
  PID:5804
- C:\Windows\System\JNeKRar.exe
  C:\Windows\System\JNeKRar.exe
  2⤵
  PID:5848
- C:\Windows\System\PtrnBeD.exe
  C:\Windows\System\PtrnBeD.exe
  2⤵
  PID:5232
- C:\Windows\System\NQAxfwU.exe
  C:\Windows\System\NQAxfwU.exe
  2⤵
  PID:6476
- C:\Windows\System\IoawOsr.exe
  C:\Windows\System\IoawOsr.exe
  2⤵
  PID:6508
- C:\Windows\System\uflTxvT.exe
  C:\Windows\System\uflTxvT.exe
  2⤵
  PID:6660
- C:\Windows\System\gVHOLPC.exe
  C:\Windows\System\gVHOLPC.exe
  2⤵
  PID:6756
- C:\Windows\System\JZaUgWn.exe
  C:\Windows\System\JZaUgWn.exe
  2⤵
  PID:6916
- C:\Windows\System\ztcXJyP.exe
  C:\Windows\System\ztcXJyP.exe
  2⤵
  PID:7116
- C:\Windows\System\yrhUJeE.exe
  C:\Windows\System\yrhUJeE.exe
  2⤵
  PID:656
- C:\Windows\System\ylFwkPH.exe
  C:\Windows\System\ylFwkPH.exe
  2⤵
  PID:6532
- C:\Windows\System\EvsmUOY.exe
  C:\Windows\System\EvsmUOY.exe
  2⤵
  PID:6576
- C:\Windows\System\zyOeLYZ.exe
  C:\Windows\System\zyOeLYZ.exe
  2⤵
  PID:6640
- C:\Windows\System\gubAwtn.exe
  C:\Windows\System\gubAwtn.exe
  2⤵
  PID:6732
- C:\Windows\System\qcxSppI.exe
  C:\Windows\System\qcxSppI.exe
  2⤵
  PID:6804
- C:\Windows\System\ljzARbg.exe
  C:\Windows\System\ljzARbg.exe
  2⤵
  PID:6872
- C:\Windows\System\BnODrjB.exe
  C:\Windows\System\BnODrjB.exe
  2⤵
  PID:6936
- C:\Windows\System\kiBaOOq.exe
  C:\Windows\System\kiBaOOq.exe
  2⤵
  PID:7000
- C:\Windows\System\hFCzKbj.exe
  C:\Windows\System\hFCzKbj.exe
  2⤵
  PID:7048
- C:\Windows\System\vrHtQWW.exe
  C:\Windows\System\vrHtQWW.exe
  2⤵
  PID:7124
- C:\Windows\System\kDArWIY.exe
  C:\Windows\System\kDArWIY.exe
  2⤵
  PID:6060
- C:\Windows\System\JugewEh.exe
  C:\Windows\System\JugewEh.exe
  2⤵
  PID:404
- C:\Windows\System\Opzokgc.exe
  C:\Windows\System\Opzokgc.exe
  2⤵
  PID:7184
- C:\Windows\System\nBfBihl.exe
  C:\Windows\System\nBfBihl.exe
  2⤵
  PID:7204
- C:\Windows\System\KDgrmDf.exe
  C:\Windows\System\KDgrmDf.exe
  2⤵
  PID:7228
- C:\Windows\System\oJYspGy.exe
  C:\Windows\System\oJYspGy.exe
  2⤵
  PID:7248
- C:\Windows\System\kFZDMoQ.exe
  C:\Windows\System\kFZDMoQ.exe
  2⤵
  PID:7268
- C:\Windows\System\zGtkdbP.exe
  C:\Windows\System\zGtkdbP.exe
  2⤵
  PID:7292
- C:\Windows\System\hdwFUcZ.exe
  C:\Windows\System\hdwFUcZ.exe
  2⤵
  PID:7316
- C:\Windows\System\FWjnvyb.exe
  C:\Windows\System\FWjnvyb.exe
  2⤵
  PID:7336
- C:\Windows\System\OUUgxBF.exe
  C:\Windows\System\OUUgxBF.exe
  2⤵
  PID:7356
- C:\Windows\System\uVjcVVQ.exe
  C:\Windows\System\uVjcVVQ.exe
  2⤵
  PID:7380
- C:\Windows\System\vUoxIoy.exe
  C:\Windows\System\vUoxIoy.exe
  2⤵
  PID:7404
- C:\Windows\System\ZSIzsZS.exe
  C:\Windows\System\ZSIzsZS.exe
  2⤵
  PID:7424
- C:\Windows\System\cdKPnGE.exe
  C:\Windows\System\cdKPnGE.exe
  2⤵
  PID:7444
- C:\Windows\System\uOApjqe.exe
  C:\Windows\System\uOApjqe.exe
  2⤵
  PID:7468
- C:\Windows\System\lxCJTzB.exe
  C:\Windows\System\lxCJTzB.exe
  2⤵
  PID:7492
- C:\Windows\System\IOGdHgP.exe
  C:\Windows\System\IOGdHgP.exe
  2⤵
  PID:7512
- C:\Windows\System\LduxBdw.exe
  C:\Windows\System\LduxBdw.exe
  2⤵
  PID:7532
- C:\Windows\System\FkliXCO.exe
  C:\Windows\System\FkliXCO.exe
  2⤵
  PID:7560
- C:\Windows\System\LfPhYQC.exe
  C:\Windows\System\LfPhYQC.exe
  2⤵
  PID:7588
- C:\Windows\System\tPoOOdY.exe
  C:\Windows\System\tPoOOdY.exe
  2⤵
  PID:7604
- C:\Windows\System\PsfIcmp.exe
  C:\Windows\System\PsfIcmp.exe
  2⤵
  PID:7628
- C:\Windows\System\ObLLsOL.exe
  C:\Windows\System\ObLLsOL.exe
  2⤵
  PID:7652
- C:\Windows\System\iUMxyYx.exe
  C:\Windows\System\iUMxyYx.exe
  2⤵
  PID:7676
- C:\Windows\System\QwzRBrl.exe
  C:\Windows\System\QwzRBrl.exe
  2⤵
  PID:7696
- C:\Windows\System\BdyuOBw.exe
  C:\Windows\System\BdyuOBw.exe
  2⤵
  PID:7720
- C:\Windows\System\sIsxFcd.exe
  C:\Windows\System\sIsxFcd.exe
  2⤵
  PID:7744
- C:\Windows\System\glFYfki.exe
  C:\Windows\System\glFYfki.exe
  2⤵
  PID:7764
- C:\Windows\System\aUmdKKB.exe
  C:\Windows\System\aUmdKKB.exe
  2⤵
  PID:7788
- C:\Windows\System\UXyZGYe.exe
  C:\Windows\System\UXyZGYe.exe
  2⤵
  PID:7812
- C:\Windows\System\oNmYLhx.exe
  C:\Windows\System\oNmYLhx.exe
  2⤵
  PID:7836
- C:\Windows\System\frTZcIi.exe
  C:\Windows\System\frTZcIi.exe
  2⤵
  PID:7852
- C:\Windows\System\nUkuFSO.exe
  C:\Windows\System\nUkuFSO.exe
  2⤵
  PID:7872
- C:\Windows\System\qQpvPza.exe
  C:\Windows\System\qQpvPza.exe
  2⤵
  PID:7896
- C:\Windows\System\kVucYRi.exe
  C:\Windows\System\kVucYRi.exe
  2⤵
  PID:7916
- C:\Windows\System\JMljomd.exe
  C:\Windows\System\JMljomd.exe
  2⤵
  PID:7944
- C:\Windows\System\CCAkBoN.exe
  C:\Windows\System\CCAkBoN.exe
  2⤵
  PID:7960
- C:\Windows\System\MEoGKNR.exe
  C:\Windows\System\MEoGKNR.exe
  2⤵
  PID:7980
- C:\Windows\System\ULhYFvM.exe
  C:\Windows\System\ULhYFvM.exe
  2⤵
  PID:7996
- C:\Windows\System\uzgmnLQ.exe
  C:\Windows\System\uzgmnLQ.exe
  2⤵
  PID:8016
- C:\Windows\System\EEaDrra.exe
  C:\Windows\System\EEaDrra.exe
  2⤵
  PID:8032
- C:\Windows\System\YYmIuqA.exe
  C:\Windows\System\YYmIuqA.exe
  2⤵
  PID:8048
- C:\Windows\System\skrJGuw.exe
  C:\Windows\System\skrJGuw.exe
  2⤵
  PID:8068
- C:\Windows\System\ycargLv.exe
  C:\Windows\System\ycargLv.exe
  2⤵
  PID:8088
- C:\Windows\System\QmUqNEd.exe
  C:\Windows\System\QmUqNEd.exe
  2⤵
  PID:8104
- C:\Windows\System\OvknVRr.exe
  C:\Windows\System\OvknVRr.exe
  2⤵
  PID:8124
- C:\Windows\System\DbInpDT.exe
  C:\Windows\System\DbInpDT.exe
  2⤵
  PID:8144
- C:\Windows\System\hkPalfl.exe
  C:\Windows\System\hkPalfl.exe
  2⤵
  PID:8164
- C:\Windows\System\tasFqRf.exe
  C:\Windows\System\tasFqRf.exe
  2⤵
  PID:8180
- C:\Windows\System\VgIlCWT.exe
  C:\Windows\System\VgIlCWT.exe
  2⤵
  PID:8204
- C:\Windows\System\EGGhmmy.exe
  C:\Windows\System\EGGhmmy.exe
  2⤵
  PID:8228
- C:\Windows\System\UaVaTsi.exe
  C:\Windows\System\UaVaTsi.exe
  2⤵
  PID:8252
- C:\Windows\System\ykTLByT.exe
  C:\Windows\System\ykTLByT.exe
  2⤵
  PID:8268
- C:\Windows\System\iqRYQPK.exe
  C:\Windows\System\iqRYQPK.exe
  2⤵
  PID:8512
- C:\Windows\System\ECqRkSX.exe
  C:\Windows\System\ECqRkSX.exe
  2⤵
  PID:8532
- C:\Windows\System\EiCbNAr.exe
  C:\Windows\System\EiCbNAr.exe
  2⤵
  PID:8548
- C:\Windows\System\LVdrzaD.exe
  C:\Windows\System\LVdrzaD.exe
  2⤵
  PID:8568
- C:\Windows\System\YNWbfJK.exe
  C:\Windows\System\YNWbfJK.exe
  2⤵
  PID:8588
- C:\Windows\System\LtEAOqm.exe
  C:\Windows\System\LtEAOqm.exe
  2⤵
  PID:8608
- C:\Windows\System\ukNXCer.exe
  C:\Windows\System\ukNXCer.exe
  2⤵
  PID:8628
- C:\Windows\System\drjFSOm.exe
  C:\Windows\System\drjFSOm.exe
  2⤵
  PID:8652
- C:\Windows\System\epjDytd.exe
  C:\Windows\System\epjDytd.exe
  2⤵
  PID:8668
- C:\Windows\System\pKdMBIz.exe
  C:\Windows\System\pKdMBIz.exe
  2⤵
  PID:8700
- C:\Windows\System\GDBDxrs.exe
  C:\Windows\System\GDBDxrs.exe
  2⤵
  PID:8728
- C:\Windows\System\HBIZbeV.exe
  C:\Windows\System\HBIZbeV.exe
  2⤵
  PID:8756
- C:\Windows\System\pcXFDTf.exe
  C:\Windows\System\pcXFDTf.exe
  2⤵
  PID:8792
- C:\Windows\System\FCBZOnN.exe
  C:\Windows\System\FCBZOnN.exe
  2⤵
  PID:8812
- C:\Windows\System\OkvEHKu.exe
  C:\Windows\System\OkvEHKu.exe
  2⤵
  PID:8840
- C:\Windows\System\dCiMFjM.exe
  C:\Windows\System\dCiMFjM.exe
  2⤵
  PID:8868
- C:\Windows\System\kRVUWYb.exe
  C:\Windows\System\kRVUWYb.exe
  2⤵
  PID:8904
- C:\Windows\System\BJaVtgU.exe
  C:\Windows\System\BJaVtgU.exe
  2⤵
  PID:9020
- C:\Windows\System\WwregIs.exe
  C:\Windows\System\WwregIs.exe
  2⤵
  PID:9036
- C:\Windows\System\xkJKeCj.exe
  C:\Windows\System\xkJKeCj.exe
  2⤵
  PID:9052
- C:\Windows\System\SXCfcye.exe
  C:\Windows\System\SXCfcye.exe
  2⤵
  PID:9068
- C:\Windows\System\RpLWArL.exe
  C:\Windows\System\RpLWArL.exe
  2⤵
  PID:9088
- C:\Windows\System\LsMdAAv.exe
  C:\Windows\System\LsMdAAv.exe
  2⤵
  PID:9104
- C:\Windows\System\aDhVgVU.exe
  C:\Windows\System\aDhVgVU.exe
  2⤵
  PID:9120
- C:\Windows\System\wGNByuL.exe
  C:\Windows\System\wGNByuL.exe
  2⤵
  PID:9136
- C:\Windows\System\iLbtVeN.exe
  C:\Windows\System\iLbtVeN.exe
  2⤵
  PID:9152
- C:\Windows\System\mTRYwsl.exe
  C:\Windows\System\mTRYwsl.exe
  2⤵
  PID:9168
- C:\Windows\System\DLYjAIg.exe
  C:\Windows\System\DLYjAIg.exe
  2⤵
  PID:9184
- C:\Windows\System\wWodear.exe
  C:\Windows\System\wWodear.exe
  2⤵
  PID:9204
- C:\Windows\System\BwfyLKJ.exe
  C:\Windows\System\BwfyLKJ.exe
  2⤵
  PID:6220
- C:\Windows\System\ZrmWGiU.exe
  C:\Windows\System\ZrmWGiU.exe
  2⤵
  PID:7076
- C:\Windows\System\KuPVcMy.exe
  C:\Windows\System\KuPVcMy.exe
  2⤵
  PID:6828
- C:\Windows\System\zejfREK.exe
  C:\Windows\System\zejfREK.exe
  2⤵
  PID:7412
- C:\Windows\System\DtSAyCA.exe
  C:\Windows\System\DtSAyCA.exe
  2⤵
  PID:7460
- C:\Windows\System\uIMpLKP.exe
  C:\Windows\System\uIMpLKP.exe
  2⤵
  PID:7508
- C:\Windows\System\ASwuOot.exe
  C:\Windows\System\ASwuOot.exe
  2⤵
  PID:7556
- C:\Windows\System\NCSlEBu.exe
  C:\Windows\System\NCSlEBu.exe
  2⤵
  PID:8056
- C:\Windows\System\CnJgOWb.exe
  C:\Windows\System\CnJgOWb.exe
  2⤵
  PID:6492
- C:\Windows\System\ozzvyuc.exe
  C:\Windows\System\ozzvyuc.exe
  2⤵
  PID:7196
- C:\Windows\System\OXMKGeS.exe
  C:\Windows\System\OXMKGeS.exe
  2⤵
  PID:7708
- C:\Windows\System\fORysvf.exe
  C:\Windows\System\fORysvf.exe
  2⤵
  PID:7780
- C:\Windows\System\AAQhXMa.exe
  C:\Windows\System\AAQhXMa.exe
  2⤵
  PID:7880
- C:\Windows\System\eBtNYiI.exe
  C:\Windows\System\eBtNYiI.exe
  2⤵
  PID:8220
- C:\Windows\System\ZkndEvu.exe
  C:\Windows\System\ZkndEvu.exe
  2⤵
  PID:8520
- C:\Windows\System\lVnJXhg.exe
  C:\Windows\System\lVnJXhg.exe
  2⤵
  PID:8636
- C:\Windows\System\EimJTmt.exe
  C:\Windows\System\EimJTmt.exe
  2⤵
  PID:8772
- C:\Windows\System\PxaGDJg.exe
  C:\Windows\System\PxaGDJg.exe
  2⤵
  PID:8936
- C:\Windows\System\hNDATcE.exe
  C:\Windows\System\hNDATcE.exe
  2⤵
  PID:7712
- C:\Windows\System\PpMvRQR.exe
  C:\Windows\System\PpMvRQR.exe
  2⤵
  PID:7804
- C:\Windows\System\LZkauzz.exe
  C:\Windows\System\LZkauzz.exe
  2⤵
  PID:7868
- C:\Windows\System\FXraXQb.exe
  C:\Windows\System\FXraXQb.exe
  2⤵
  PID:7936
- C:\Windows\System\GBjgxAV.exe
  C:\Windows\System\GBjgxAV.exe
  2⤵
  PID:8064
- C:\Windows\System\vfCZodl.exe
  C:\Windows\System\vfCZodl.exe
  2⤵
  PID:8160
- C:\Windows\System\TVTwTSs.exe
  C:\Windows\System\TVTwTSs.exe
  2⤵
  PID:6176
- C:\Windows\System\FaWrcZq.exe
  C:\Windows\System\FaWrcZq.exe
  2⤵
  PID:6280
- C:\Windows\System\ILMwQcz.exe
  C:\Windows\System\ILMwQcz.exe
  2⤵
  PID:6372
- C:\Windows\System\AKpbSZl.exe
  C:\Windows\System\AKpbSZl.exe
  2⤵
  PID:9276
- C:\Windows\System\SEWzvYb.exe
  C:\Windows\System\SEWzvYb.exe
  2⤵
  PID:9292
- C:\Windows\System\noDFDvD.exe
  C:\Windows\System\noDFDvD.exe
  2⤵
  PID:9308
- C:\Windows\System\oMevcVZ.exe
  C:\Windows\System\oMevcVZ.exe
  2⤵
  PID:9328
- C:\Windows\System\cvPKwfF.exe
  C:\Windows\System\cvPKwfF.exe
  2⤵
  PID:9348
- C:\Windows\System\iKSrdqj.exe
  C:\Windows\System\iKSrdqj.exe
  2⤵
  PID:9368
- C:\Windows\System\fGOxTCY.exe
  C:\Windows\System\fGOxTCY.exe
  2⤵
  PID:9392
- C:\Windows\System\kVcLJUz.exe
  C:\Windows\System\kVcLJUz.exe
  2⤵
  PID:9416
- C:\Windows\System\OYtrGYU.exe
  C:\Windows\System\OYtrGYU.exe
  2⤵
  PID:9436
- C:\Windows\System\eaCTwhu.exe
  C:\Windows\System\eaCTwhu.exe
  2⤵
  PID:9452
- C:\Windows\System\aLBNmgV.exe
  C:\Windows\System\aLBNmgV.exe
  2⤵
  PID:9480
- C:\Windows\System\QHrVHXG.exe
  C:\Windows\System\QHrVHXG.exe
  2⤵
  PID:9496
- C:\Windows\System\rnFZNTQ.exe
  C:\Windows\System\rnFZNTQ.exe
  2⤵
  PID:9512
- C:\Windows\System\dKwjoWh.exe
  C:\Windows\System\dKwjoWh.exe
  2⤵
  PID:9528
- C:\Windows\System\qnPGxKz.exe
  C:\Windows\System\qnPGxKz.exe
  2⤵
  PID:9544
- C:\Windows\System\MGEcucr.exe
  C:\Windows\System\MGEcucr.exe
  2⤵
  PID:9568
- C:\Windows\System\ebkPkUl.exe
  C:\Windows\System\ebkPkUl.exe
  2⤵
  PID:9592
- C:\Windows\System\pGezZdg.exe
  C:\Windows\System\pGezZdg.exe
  2⤵
  PID:9620
- C:\Windows\System\uHsgCIE.exe
  C:\Windows\System\uHsgCIE.exe
  2⤵
  PID:9640
- C:\Windows\System\JyfYuuG.exe
  C:\Windows\System\JyfYuuG.exe
  2⤵
  PID:9664
- C:\Windows\System\oHarklr.exe
  C:\Windows\System\oHarklr.exe
  2⤵
  PID:9680
- C:\Windows\System\HrnBfsz.exe
  C:\Windows\System\HrnBfsz.exe
  2⤵
  PID:10168
- C:\Windows\System\WNSdFdQ.exe
  C:\Windows\System\WNSdFdQ.exe
  2⤵
  PID:1268
- C:\Windows\System\QXmhweh.exe
  C:\Windows\System\QXmhweh.exe
  2⤵
  PID:6256
- C:\Windows\System\PXagldo.exe
  C:\Windows\System\PXagldo.exe
  2⤵
  PID:6336
- C:\Windows\System\ItSAFXS.exe
  C:\Windows\System\ItSAFXS.exe
  2⤵
  PID:6516
- C:\Windows\System\ocMRsHj.exe
  C:\Windows\System\ocMRsHj.exe
  2⤵
  PID:6600
- C:\Windows\System\gADdybM.exe
  C:\Windows\System\gADdybM.exe
  2⤵
  PID:7216
- C:\Windows\System\jSRgyuk.exe
  C:\Windows\System\jSRgyuk.exe
  2⤵
  PID:7276
- C:\Windows\System\bEGFSpI.exe
  C:\Windows\System\bEGFSpI.exe
  2⤵
  PID:7308
- C:\Windows\System\FXnFZcr.exe
  C:\Windows\System\FXnFZcr.exe
  2⤵
  PID:7368
- C:\Windows\System\JFAmyXq.exe
  C:\Windows\System\JFAmyXq.exe
  2⤵
  PID:7572
- C:\Windows\System\whQfZWE.exe
  C:\Windows\System\whQfZWE.exe
  2⤵
  PID:7620
- C:\Windows\System\wDsDaRJ.exe
  C:\Windows\System\wDsDaRJ.exe
  2⤵
  PID:7668
- C:\Windows\System\ButEzAV.exe
  C:\Windows\System\ButEzAV.exe
  2⤵
  PID:9164
- C:\Windows\System\BmDFnCX.exe
  C:\Windows\System\BmDFnCX.exe
  2⤵
  PID:9212
- C:\Windows\System\Xbwjlvn.exe
  C:\Windows\System\Xbwjlvn.exe
  2⤵
  PID:7568
- C:\Windows\System\hbNlEvt.exe
  C:\Windows\System\hbNlEvt.exe
  2⤵
  PID:7256
- C:\Windows\System\CPWHkMB.exe
  C:\Windows\System\CPWHkMB.exe
  2⤵
  PID:8996
- C:\Windows\System\kpFKGGr.exe
  C:\Windows\System\kpFKGGr.exe
  2⤵
  PID:8264
- C:\Windows\System\jOXvskN.exe
  C:\Windows\System\jOXvskN.exe
  2⤵
  PID:8492
- C:\Windows\System\SPESwsN.exe
  C:\Windows\System\SPESwsN.exe
  2⤵
  PID:8544
- C:\Windows\System\upBqsOe.exe
  C:\Windows\System\upBqsOe.exe
  2⤵
  PID:7524
- C:\Windows\System\DrAmdij.exe
  C:\Windows\System\DrAmdij.exe
  2⤵
  PID:10324
- C:\Windows\System\WcPLxNQ.exe
  C:\Windows\System\WcPLxNQ.exe
  2⤵
  PID:10344
- C:\Windows\System\rWWPAsc.exe
  C:\Windows\System\rWWPAsc.exe
  2⤵
  PID:10360
- C:\Windows\System\PMBKmwN.exe
  C:\Windows\System\PMBKmwN.exe
  2⤵
  PID:10376
- C:\Windows\System\LNHxJeX.exe
  C:\Windows\System\LNHxJeX.exe
  2⤵
  PID:10392
- C:\Windows\System\gIsUIif.exe
  C:\Windows\System\gIsUIif.exe
  2⤵
  PID:10420
- C:\Windows\System\yUvnDLr.exe
  C:\Windows\System\yUvnDLr.exe
  2⤵
  PID:10436
- C:\Windows\System\OkdfnXy.exe
  C:\Windows\System\OkdfnXy.exe
  2⤵
  PID:10600
- C:\Windows\System\KODPEAh.exe
  C:\Windows\System\KODPEAh.exe
  2⤵
  PID:10620
- C:\Windows\System\CGCUyme.exe
  C:\Windows\System\CGCUyme.exe
  2⤵
  PID:10716
- C:\Windows\System\PeWvKtH.exe
  C:\Windows\System\PeWvKtH.exe
  2⤵
  PID:10736
- C:\Windows\System\AtAkcxQ.exe
  C:\Windows\System\AtAkcxQ.exe
  2⤵
  PID:10760
- C:\Windows\System\kkobkDQ.exe
  C:\Windows\System\kkobkDQ.exe
  2⤵
  PID:10784
- C:\Windows\System\KxVPUIg.exe
  C:\Windows\System\KxVPUIg.exe
  2⤵
  PID:10800
- C:\Windows\System\jTFtvaP.exe
  C:\Windows\System\jTFtvaP.exe
  2⤵
  PID:10816
- C:\Windows\System\OXjkzBn.exe
  C:\Windows\System\OXjkzBn.exe
  2⤵
  PID:10832
- C:\Windows\System\qlTUXlR.exe
  C:\Windows\System\qlTUXlR.exe
  2⤵
  PID:10852
- C:\Windows\System\CqxZeSP.exe
  C:\Windows\System\CqxZeSP.exe
  2⤵
  PID:10868
- C:\Windows\System\RdCBNra.exe
  C:\Windows\System\RdCBNra.exe
  2⤵
  PID:10884
- C:\Windows\System\zidTBvC.exe
  C:\Windows\System\zidTBvC.exe
  2⤵
  PID:10904
- C:\Windows\System\ZlWPCjp.exe
  C:\Windows\System\ZlWPCjp.exe
  2⤵
  PID:10924
- C:\Windows\System\lxCeQFA.exe
  C:\Windows\System\lxCeQFA.exe
  2⤵
  PID:10948
- C:\Windows\System\SZvYXAr.exe
  C:\Windows\System\SZvYXAr.exe
  2⤵
  PID:10972
- C:\Windows\System\KBhCMvt.exe
  C:\Windows\System\KBhCMvt.exe
  2⤵
  PID:10996
- C:\Windows\System\KkBMUMN.exe
  C:\Windows\System\KkBMUMN.exe
  2⤵
  PID:11016
- C:\Windows\System\vDAsNmH.exe
  C:\Windows\System\vDAsNmH.exe
  2⤵
  PID:11040
- C:\Windows\System\bouElkf.exe
  C:\Windows\System\bouElkf.exe
  2⤵
  PID:11060
- C:\Windows\System\GRYzNFX.exe
  C:\Windows\System\GRYzNFX.exe
  2⤵
  PID:11084
- C:\Windows\System\PmfIrGr.exe
  C:\Windows\System\PmfIrGr.exe
  2⤵
  PID:11108
- C:\Windows\System\RqEyhiE.exe
  C:\Windows\System\RqEyhiE.exe
  2⤵
  PID:11132
- C:\Windows\System\NKYuOWR.exe
  C:\Windows\System\NKYuOWR.exe
  2⤵
  PID:11156
- C:\Windows\System\tgSxSGU.exe
  C:\Windows\System\tgSxSGU.exe
  2⤵
  PID:11176
- C:\Windows\System\MfyPMRE.exe
  C:\Windows\System\MfyPMRE.exe
  2⤵
  PID:11200
- C:\Windows\System\Tauttbj.exe
  C:\Windows\System\Tauttbj.exe
  2⤵
  PID:11232
- C:\Windows\System\tCdmXnD.exe
  C:\Windows\System\tCdmXnD.exe
  2⤵
  PID:11256
- C:\Windows\System\gBWkWnY.exe
  C:\Windows\System\gBWkWnY.exe
  2⤵
  PID:6896
- C:\Windows\System\zlnyhFU.exe
  C:\Windows\System\zlnyhFU.exe
  2⤵
  PID:7044
- C:\Windows\System\FQxGmYc.exe
  C:\Windows\System\FQxGmYc.exe
  2⤵
  PID:7152
- C:\Windows\System\xCshZNB.exe
  C:\Windows\System\xCshZNB.exe
  2⤵
  PID:7172
- C:\Windows\System\yAdCbRh.exe
  C:\Windows\System\yAdCbRh.exe
  2⤵
  PID:7364
- C:\Windows\System\JiTOfSu.exe
  C:\Windows\System\JiTOfSu.exe
  2⤵
  PID:7260
- C:\Windows\System\RrvDlNL.exe
  C:\Windows\System\RrvDlNL.exe
  2⤵
  PID:2340
- C:\Windows\System\EKBglvr.exe
  C:\Windows\System\EKBglvr.exe
  2⤵
  PID:3896
- C:\Windows\System\AUytdpU.exe
  C:\Windows\System\AUytdpU.exe
  2⤵
  PID:6360
- C:\Windows\System\klcYLgD.exe
  C:\Windows\System\klcYLgD.exe
  2⤵
  PID:9244
- C:\Windows\System\owzQZng.exe
  C:\Windows\System\owzQZng.exe
  2⤵
  PID:9288
- C:\Windows\System\EaMwHOz.exe
  C:\Windows\System\EaMwHOz.exe
  2⤵
  PID:9336
- C:\Windows\System\boPeTFr.exe
  C:\Windows\System\boPeTFr.exe
  2⤵
  PID:9384
- C:\Windows\System\KjuHUsM.exe
  C:\Windows\System\KjuHUsM.exe
  2⤵
  PID:9432
- C:\Windows\System\FpuWAAR.exe
  C:\Windows\System\FpuWAAR.exe
  2⤵
  PID:9464
- C:\Windows\System\BpmCYUj.exe
  C:\Windows\System\BpmCYUj.exe
  2⤵
  PID:9504
- C:\Windows\System\XhPoyFQ.exe
  C:\Windows\System\XhPoyFQ.exe
  2⤵
  PID:9540
- C:\Windows\System\FnFcsXw.exe
  C:\Windows\System\FnFcsXw.exe
  2⤵
  PID:9588
- C:\Windows\System\PTLIqeP.exe
  C:\Windows\System\PTLIqeP.exe
  2⤵
  PID:9648
- C:\Windows\System\TZLreaV.exe
  C:\Windows\System\TZLreaV.exe
  2⤵
  PID:9688
- C:\Windows\System\hxACaLx.exe
  C:\Windows\System\hxACaLx.exe
  2⤵
  PID:9732
- C:\Windows\System\ibGGrEM.exe
  C:\Windows\System\ibGGrEM.exe
  2⤵
  PID:9780
- C:\Windows\System\QJPCYxH.exe
  C:\Windows\System\QJPCYxH.exe
  2⤵
  PID:9844
- C:\Windows\System\PNsELFo.exe
  C:\Windows\System\PNsELFo.exe
  2⤵
  PID:10276
- C:\Windows\System\GUhbkAf.exe
  C:\Windows\System\GUhbkAf.exe
  2⤵
  PID:7284
- C:\Windows\System\zBhtiXx.exe
  C:\Windows\System\zBhtiXx.exe
  2⤵
  PID:9160
- C:\Windows\System\ZhayjLG.exe
  C:\Windows\System\ZhayjLG.exe
  2⤵
  PID:9916
- C:\Windows\System\RRLuUEu.exe
  C:\Windows\System\RRLuUEu.exe
  2⤵
  PID:9956
- C:\Windows\System\IjZFQCk.exe
  C:\Windows\System\IjZFQCk.exe
  2⤵
  PID:1288
- C:\Windows\System\tnEaAtH.exe
  C:\Windows\System\tnEaAtH.exe
  2⤵
  PID:6328
- C:\Windows\System\JTfpxnH.exe
  C:\Windows\System\JTfpxnH.exe
  2⤵
  PID:6960
- C:\Windows\System\DOrOcDe.exe
  C:\Windows\System\DOrOcDe.exe
  2⤵
  PID:10752
- C:\Windows\System\mvYkTLo.exe
  C:\Windows\System\mvYkTLo.exe
  2⤵
  PID:10916
- C:\Windows\System\JUBVEwM.exe
  C:\Windows\System\JUBVEwM.exe
  2⤵
  PID:10984
- C:\Windows\System\pwzVVVY.exe
  C:\Windows\System\pwzVVVY.exe
  2⤵
  PID:11076
- C:\Windows\System\lBxLunc.exe
  C:\Windows\System\lBxLunc.exe
  2⤵
  PID:11120
- C:\Windows\System\njAaSio.exe
  C:\Windows\System\njAaSio.exe
  2⤵
  PID:6780
- C:\Windows\System\WUHtJux.exe
  C:\Windows\System\WUHtJux.exe
  2⤵
  PID:7480
- C:\Windows\System\PxQFFmD.exe
  C:\Windows\System\PxQFFmD.exe
  2⤵
  PID:8528
- C:\Windows\System\tQTwXrO.exe
  C:\Windows\System\tQTwXrO.exe
  2⤵
  PID:8176
- C:\Windows\System\QzJHyen.exe
  C:\Windows\System\QzJHyen.exe
  2⤵
  PID:7348
- C:\Windows\System\IUnSEMj.exe
  C:\Windows\System\IUnSEMj.exe
  2⤵
  PID:9128
- C:\Windows\System\jEqrJAA.exe
  C:\Windows\System\jEqrJAA.exe
  2⤵
  PID:7456
- C:\Windows\System\synmTbK.exe
  C:\Windows\System\synmTbK.exe
  2⤵
  PID:10260
- C:\Windows\System\kgBnBUy.exe
  C:\Windows\System\kgBnBUy.exe
  2⤵
  PID:10848
- C:\Windows\System\qzLUzCI.exe
  C:\Windows\System\qzLUzCI.exe
  2⤵
  PID:9488
- C:\Windows\System\DWFmPhM.exe
  C:\Windows\System\DWFmPhM.exe
  2⤵
  PID:9524
- C:\Windows\System\OQWrfMW.exe
  C:\Windows\System\OQWrfMW.exe
  2⤵
  PID:10944
- C:\Windows\System\AFxOUTM.exe
  C:\Windows\System\AFxOUTM.exe
  2⤵
  PID:9660
- C:\Windows\System\nTKMQlf.exe
  C:\Windows\System\nTKMQlf.exe
  2⤵
  PID:9716
- C:\Windows\System\uuLJLqS.exe
  C:\Windows\System\uuLJLqS.exe
  2⤵
  PID:11068
- C:\Windows\System\vLxWzek.exe
  C:\Windows\System\vLxWzek.exe
  2⤵
  PID:10672
- C:\Windows\System\WbFZgtk.exe
  C:\Windows\System\WbFZgtk.exe
  2⤵
  PID:10704
- C:\Windows\System\uLcdoVP.exe
  C:\Windows\System\uLcdoVP.exe
  2⤵
  PID:10744
- C:\Windows\System\gDsVtMZ.exe
  C:\Windows\System\gDsVtMZ.exe
  2⤵
  PID:10796
- C:\Windows\System\TJupKKB.exe
  C:\Windows\System\TJupKKB.exe
  2⤵
  PID:11100
- C:\Windows\System\oOtRHtA.exe
  C:\Windows\System\oOtRHtA.exe
  2⤵
  PID:11012
- C:\Windows\System\GYvblqi.exe
  C:\Windows\System\GYvblqi.exe
  2⤵
  PID:11056
- C:\Windows\System\XGgNtcS.exe
  C:\Windows\System\XGgNtcS.exe
  2⤵
  PID:6216
- C:\Windows\System\WskaYqd.exe
  C:\Windows\System\WskaYqd.exe
  2⤵
  PID:9576
- C:\Windows\System\NiVDRWy.exe
  C:\Windows\System\NiVDRWy.exe
  2⤵
  PID:6488
- C:\Windows\System\wusRCYH.exe
  C:\Windows\System\wusRCYH.exe
  2⤵
  PID:11240
- C:\Windows\System\UxxjRzZ.exe
  C:\Windows\System\UxxjRzZ.exe
  2⤵
  PID:11048
- C:\Windows\System\BQWMbAH.exe
  C:\Windows\System\BQWMbAH.exe
  2⤵
  PID:11288
- C:\Windows\System\GJZCThg.exe
  C:\Windows\System\GJZCThg.exe
  2⤵
  PID:11320
- C:\Windows\System\sgPxDwx.exe
  C:\Windows\System\sgPxDwx.exe
  2⤵
  PID:11344
- C:\Windows\System\scGJiUY.exe
  C:\Windows\System\scGJiUY.exe
  2⤵
  PID:11360
- C:\Windows\System\zrhgnvm.exe
  C:\Windows\System\zrhgnvm.exe
  2⤵
  PID:11384
- C:\Windows\System\AGBSHzt.exe
  C:\Windows\System\AGBSHzt.exe
  2⤵
  PID:11432
- C:\Windows\System\ZEPQoCw.exe
  C:\Windows\System\ZEPQoCw.exe
  2⤵
  PID:11460
- C:\Windows\System\DPWNJwH.exe
  C:\Windows\System\DPWNJwH.exe
  2⤵
  PID:11484
- C:\Windows\System\UYjWxqK.exe
  C:\Windows\System\UYjWxqK.exe
  2⤵
  PID:11504
- C:\Windows\System\aGBFNim.exe
  C:\Windows\System\aGBFNim.exe
  2⤵
  PID:11528
- C:\Windows\System\VLRFIAp.exe
  C:\Windows\System\VLRFIAp.exe
  2⤵
  PID:11544
- C:\Windows\System\lEUADpF.exe
  C:\Windows\System\lEUADpF.exe
  2⤵
  PID:11568
- C:\Windows\System\xvkaFaM.exe
  C:\Windows\System\xvkaFaM.exe
  2⤵
  PID:11592
- C:\Windows\System\ghdEFlS.exe
  C:\Windows\System\ghdEFlS.exe
  2⤵
  PID:11616
- C:\Windows\System\HFYISKi.exe
  C:\Windows\System\HFYISKi.exe
  2⤵
  PID:11640
- C:\Windows\System\gOqqcNb.exe
  C:\Windows\System\gOqqcNb.exe
  2⤵
  PID:11668
- C:\Windows\System\ltawzDQ.exe
  C:\Windows\System\ltawzDQ.exe
  2⤵
  PID:11692
- C:\Windows\System\gdDUFbQ.exe
  C:\Windows\System\gdDUFbQ.exe
  2⤵
  PID:11708
- C:\Windows\System\mScbdma.exe
  C:\Windows\System\mScbdma.exe
  2⤵
  PID:11732
- C:\Windows\System\tTahfnI.exe
  C:\Windows\System\tTahfnI.exe
  2⤵
  PID:11760
- C:\Windows\System\GfEhNZy.exe
  C:\Windows\System\GfEhNZy.exe
  2⤵
  PID:11776
- C:\Windows\System\yxtqzAV.exe
  C:\Windows\System\yxtqzAV.exe
  2⤵
  PID:11808
- C:\Windows\System\zbcjwbH.exe
  C:\Windows\System\zbcjwbH.exe
  2⤵
  PID:11832
- C:\Windows\System\ZAzzJDT.exe
  C:\Windows\System\ZAzzJDT.exe
  2⤵
  PID:11852
- C:\Windows\System\Rlibfrx.exe
  C:\Windows\System\Rlibfrx.exe
  2⤵
  PID:11880
- C:\Windows\System\ShZzpUo.exe
  C:\Windows\System\ShZzpUo.exe
  2⤵
  PID:11908
- C:\Windows\System\cVnRdCD.exe
  C:\Windows\System\cVnRdCD.exe
  2⤵
  PID:11932
- C:\Windows\System\bmyYUEx.exe
  C:\Windows\System\bmyYUEx.exe
  2⤵
  PID:11956
- C:\Windows\System\yRkbDkc.exe
  C:\Windows\System\yRkbDkc.exe
  2⤵
  PID:11980
- C:\Windows\System\LVTuqIb.exe
  C:\Windows\System\LVTuqIb.exe
  2⤵
  PID:12000
- C:\Windows\System\utBFdQi.exe
  C:\Windows\System\utBFdQi.exe
  2⤵
  PID:12024
- C:\Windows\System\hfpCBvu.exe
  C:\Windows\System\hfpCBvu.exe
  2⤵
  PID:12044
- C:\Windows\System\ziwwsPz.exe
  C:\Windows\System\ziwwsPz.exe
  2⤵
  PID:12064
- C:\Windows\System\btLmWjt.exe
  C:\Windows\System\btLmWjt.exe
  2⤵
  PID:12092
- C:\Windows\System\QAVvBJN.exe
  C:\Windows\System\QAVvBJN.exe
  2⤵
  PID:12124
- C:\Windows\System\tcqCDGA.exe
  C:\Windows\System\tcqCDGA.exe
  2⤵
  PID:12152
- C:\Windows\System\xiZVgDa.exe
  C:\Windows\System\xiZVgDa.exe
  2⤵
  PID:12172
- C:\Windows\System\lDoLHMH.exe
  C:\Windows\System\lDoLHMH.exe
  2⤵
  PID:12200
- C:\Windows\System\hwbrDJA.exe
  C:\Windows\System\hwbrDJA.exe
  2⤵
  PID:12224
- C:\Windows\System\anUTWAl.exe
  C:\Windows\System\anUTWAl.exe
  2⤵
  PID:12240
- C:\Windows\System\TlzMNLv.exe
  C:\Windows\System\TlzMNLv.exe
  2⤵
  PID:12256
- C:\Windows\System\fIbQZvQ.exe
  C:\Windows\System\fIbQZvQ.exe
  2⤵
  PID:12272
- C:\Windows\System\ShdUXYT.exe
  C:\Windows\System\ShdUXYT.exe
  2⤵
  PID:8212
- C:\Windows\System\PFjjjgz.exe
  C:\Windows\System\PFjjjgz.exe
  2⤵
  PID:336
- C:\Windows\System\qdMNjXi.exe
  C:\Windows\System\qdMNjXi.exe
  2⤵
  PID:9268
- C:\Windows\System\PZOcXlK.exe
  C:\Windows\System\PZOcXlK.exe
  2⤵
  PID:8116
- C:\Windows\System\pwsQkoJ.exe
  C:\Windows\System\pwsQkoJ.exe
  2⤵
  PID:9344
- C:\Windows\System\ZfYNnnC.exe
  C:\Windows\System\ZfYNnnC.exe
  2⤵
  PID:10668
- C:\Windows\System\ipDETJh.exe
  C:\Windows\System\ipDETJh.exe
  2⤵
  PID:10824
- C:\Windows\System\NTJZjTp.exe
  C:\Windows\System\NTJZjTp.exe
  2⤵
  PID:9824
- C:\Windows\System\fisqYKh.exe
  C:\Windows\System\fisqYKh.exe
  2⤵
  PID:12308
- C:\Windows\System\dawgLfC.exe
  C:\Windows\System\dawgLfC.exe
  2⤵
  PID:12328
- C:\Windows\System\ZZNOinA.exe
  C:\Windows\System\ZZNOinA.exe
  2⤵
  PID:12356
- C:\Windows\System\UpTlvuG.exe
  C:\Windows\System\UpTlvuG.exe
  2⤵
  PID:12384
- C:\Windows\System\SYvyZGk.exe
  C:\Windows\System\SYvyZGk.exe
  2⤵
  PID:12404
- C:\Windows\System\yQNWIxv.exe
  C:\Windows\System\yQNWIxv.exe
  2⤵
  PID:12428
- C:\Windows\System\OBzFVYN.exe
  C:\Windows\System\OBzFVYN.exe
  2⤵
  PID:12452
- C:\Windows\System\pdPDOdk.exe
  C:\Windows\System\pdPDOdk.exe
  2⤵
  PID:12468
- C:\Windows\System\vzacKIG.exe
  C:\Windows\System\vzacKIG.exe
  2⤵
  PID:12500
- C:\Windows\System\ANUMvLW.exe
  C:\Windows\System\ANUMvLW.exe
  2⤵
  PID:12548
- C:\Windows\System\LZPAZhk.exe
  C:\Windows\System\LZPAZhk.exe
  2⤵
  PID:12564
- C:\Windows\System\CIiGIOZ.exe
  C:\Windows\System\CIiGIOZ.exe
  2⤵
  PID:12588
- C:\Windows\System\CYziiDI.exe
  C:\Windows\System\CYziiDI.exe
  2⤵
  PID:12612
- C:\Windows\System\aRuWQIE.exe
  C:\Windows\System\aRuWQIE.exe
  2⤵
  PID:12628
- C:\Windows\System\oVHmEOQ.exe
  C:\Windows\System\oVHmEOQ.exe
  2⤵
  PID:12652
- C:\Windows\System\YBLgyvL.exe
  C:\Windows\System\YBLgyvL.exe
  2⤵
  PID:12716
- C:\Windows\System\yAGCoqS.exe
  C:\Windows\System\yAGCoqS.exe
  2⤵
  PID:12740
- C:\Windows\System\FzvcKkf.exe
  C:\Windows\System\FzvcKkf.exe
  2⤵
  PID:12760
- C:\Windows\System\VhkEVHD.exe
  C:\Windows\System\VhkEVHD.exe
  2⤵
  PID:12788
- C:\Windows\System\nIuwGZR.exe
  C:\Windows\System\nIuwGZR.exe
  2⤵
  PID:12808
- C:\Windows\System\kxnGrQg.exe
  C:\Windows\System\kxnGrQg.exe
  2⤵
  PID:12832
- C:\Windows\System\uUTwAxf.exe
  C:\Windows\System\uUTwAxf.exe
  2⤵
  PID:12860
- C:\Windows\System\TYuBxae.exe
  C:\Windows\System\TYuBxae.exe
  2⤵
  PID:12880
- C:\Windows\System\TOBFnYq.exe
  C:\Windows\System\TOBFnYq.exe
  2⤵
  PID:12900
- C:\Windows\System\zunbVIT.exe
  C:\Windows\System\zunbVIT.exe
  2⤵
  PID:12920
- C:\Windows\System\FfxPpAR.exe
  C:\Windows\System\FfxPpAR.exe
  2⤵
  PID:12948
- C:\Windows\System\MVCmpOe.exe
  C:\Windows\System\MVCmpOe.exe
  2⤵
  PID:12972
- C:\Windows\System\yDMMGom.exe
  C:\Windows\System\yDMMGom.exe
  2⤵
  PID:12996
- C:\Windows\System\TtbeChq.exe
  C:\Windows\System\TtbeChq.exe
  2⤵
  PID:13020
- C:\Windows\System\FLDAcpB.exe
  C:\Windows\System\FLDAcpB.exe
  2⤵
  PID:13040
- C:\Windows\System\xbTNYfU.exe
  C:\Windows\System\xbTNYfU.exe
  2⤵
  PID:13056
- C:\Windows\System\LUXyCJR.exe
  C:\Windows\System\LUXyCJR.exe
  2⤵
  PID:13076
- C:\Windows\System\cZCwlEU.exe
  C:\Windows\System\cZCwlEU.exe
  2⤵
  PID:13096
- C:\Windows\System\ySKOSFr.exe
  C:\Windows\System\ySKOSFr.exe
  2⤵
  PID:13116
- C:\Windows\System\btQYMYK.exe
  C:\Windows\System\btQYMYK.exe
  2⤵
  PID:13136
- C:\Windows\System\QCkLIAO.exe
  C:\Windows\System\QCkLIAO.exe
  2⤵
  PID:13156
- C:\Windows\System\GCPzayJ.exe
  C:\Windows\System\GCPzayJ.exe
  2⤵
  PID:13176
- C:\Windows\System\bLqCyTn.exe
  C:\Windows\System\bLqCyTn.exe
  2⤵
  PID:13200
- C:\Windows\System\mNgtIeM.exe
  C:\Windows\System\mNgtIeM.exe
  2⤵
  PID:13216
- C:\Windows\System\cHIibcG.exe
  C:\Windows\System\cHIibcG.exe
  2⤵
  PID:13236
- C:\Windows\System\FeKuEEl.exe
  C:\Windows\System\FeKuEEl.exe
  2⤵
  PID:13256
- C:\Windows\System\YCWPWtm.exe
  C:\Windows\System\YCWPWtm.exe
  2⤵
  PID:13280
- C:\Windows\System\wJAuOmu.exe
  C:\Windows\System\wJAuOmu.exe
  2⤵
  PID:13304
- C:\Windows\System\fEHEQYy.exe
  C:\Windows\System\fEHEQYy.exe
  2⤵
  PID:7548
- C:\Windows\System\aSKpTHm.exe
  C:\Windows\System\aSKpTHm.exe
  2⤵
  PID:11304
- C:\Windows\System\FXtAneJ.exe
  C:\Windows\System\FXtAneJ.exe
  2⤵
  PID:11328
- C:\Windows\System\RUtGafS.exe
  C:\Windows\System\RUtGafS.exe
  2⤵
  PID:1104
- C:\Windows\System\OdPAGIT.exe
  C:\Windows\System\OdPAGIT.exe
  2⤵
  PID:12512
- C:\Windows\System\vJURkOW.exe
  C:\Windows\System\vJURkOW.exe
  2⤵
  PID:12560
- C:\Windows\System\PnUcyav.exe
  C:\Windows\System\PnUcyav.exe
  2⤵
  PID:12596
- C:\Windows\System\VniBLtK.exe
  C:\Windows\System\VniBLtK.exe
  2⤵
  PID:12660
- C:\Windows\System\ZiWPKSM.exe
  C:\Windows\System\ZiWPKSM.exe
  2⤵
  PID:12704
- C:\Windows\System\pLMWftF.exe
  C:\Windows\System\pLMWftF.exe
  2⤵
  PID:12768
- C:\Windows\System\yNvYpnp.exe
  C:\Windows\System\yNvYpnp.exe
  2⤵
  PID:12804
- C:\Windows\System\kLZgegr.exe
  C:\Windows\System\kLZgegr.exe
  2⤵
  PID:12872
- C:\Windows\System\NJekygP.exe
  C:\Windows\System\NJekygP.exe
  2⤵
  PID:10712
- C:\Windows\System\DGCPhod.exe
  C:\Windows\System\DGCPhod.exe
  2⤵
  PID:11128
- C:\Windows\System\TzpnfjD.exe
  C:\Windows\System\TzpnfjD.exe
  2⤵
  PID:12448
- C:\Windows\System\yMhIZNt.exe
  C:\Windows\System\yMhIZNt.exe
  2⤵
  PID:3512
- C:\Windows\System\Tjwmjwf.exe
  C:\Windows\System\Tjwmjwf.exe
  2⤵
  PID:4872
- C:\Windows\System\QfocZBL.exe
  C:\Windows\System\QfocZBL.exe
  2⤵
  PID:9064
- C:\Windows\System\CDJboCL.exe
  C:\Windows\System\CDJboCL.exe
  2⤵
  PID:13212
- C:\Windows\System\LBBmXcz.exe
  C:\Windows\System\LBBmXcz.exe
  2⤵
  PID:11740
- C:\Windows\System\hPIcwyT.exe
  C:\Windows\System\hPIcwyT.exe
  2⤵
  PID:11452
- C:\Windows\System\toWCnbp.exe
  C:\Windows\System\toWCnbp.exe
  2⤵
  PID:11556
- C:\Windows\System\jALRhSS.exe
  C:\Windows\System\jALRhSS.exe
  2⤵
  PID:10312
- C:\Windows\System\nXiHHYi.exe
  C:\Windows\System\nXiHHYi.exe
  2⤵
  PID:11656
- C:\Windows\System\vubrNXs.exe
  C:\Windows\System\vubrNXs.exe
  2⤵
  PID:4364
- C:\Windows\System\WeGlEJS.exe
  C:\Windows\System\WeGlEJS.exe
  2⤵
  PID:13288
- C:\Windows\System\PVRAojM.exe
  C:\Windows\System\PVRAojM.exe
  2⤵
  PID:5056
- C:\Windows\System\JvWwTAp.exe
  C:\Windows\System\JvWwTAp.exe
  2⤵
  PID:3976
- C:\Windows\System\cwvqLkO.exe
  C:\Windows\System\cwvqLkO.exe
  2⤵
  PID:12108
- C:\Windows\System\XoONnny.exe
  C:\Windows\System\XoONnny.exe
  2⤵
  PID:872
- C:\Windows\System\gJBTtXe.exe
  C:\Windows\System\gJBTtXe.exe
  2⤵
  PID:1096
- C:\Windows\System\PwEoylZ.exe
  C:\Windows\System\PwEoylZ.exe
  2⤵
  PID:12556
- C:\Windows\System\EdmbHVG.exe
  C:\Windows\System\EdmbHVG.exe
  2⤵
  PID:12636
- C:\Windows\System\uWGYVHJ.exe
  C:\Windows\System\uWGYVHJ.exe
  2⤵
  PID:12700
- C:\Windows\System\BILmZyF.exe
  C:\Windows\System\BILmZyF.exe
  2⤵
  PID:12800
- C:\Windows\System\qclDzWz.exe
  C:\Windows\System\qclDzWz.exe
  2⤵
  PID:4764
- C:\Windows\System\bsCReav.exe
  C:\Windows\System\bsCReav.exe
  2⤵
  PID:944
- C:\Windows\System\otVFzHO.exe
  C:\Windows\System\otVFzHO.exe
  2⤵
  PID:13028
- C:\Windows\System\CJfowBu.exe
  C:\Windows\System\CJfowBu.exe
  2⤵
  PID:4984
- C:\Windows\System\gMEtnLK.exe
  C:\Windows\System\gMEtnLK.exe
  2⤵
  PID:11376
- C:\Windows\System\fNgLwjQ.exe
  C:\Windows\System\fNgLwjQ.exe
  2⤵
  PID:4196
- C:\Windows\System\vRFolKv.exe
  C:\Windows\System\vRFolKv.exe
  2⤵
  PID:13172
- C:\Windows\System\nVUhMAT.exe
  C:\Windows\System\nVUhMAT.exe
  2⤵
  PID:10728
- C:\Windows\System\FLMNotc.exe
  C:\Windows\System\FLMNotc.exe
  2⤵
  PID:13276
- C:\Windows\System\IVcoZgY.exe
  C:\Windows\System\IVcoZgY.exe
  2⤵
  PID:5584
- C:\Windows\System\wrrdLLC.exe
  C:\Windows\System\wrrdLLC.exe
  2⤵
  PID:5908
- C:\Windows\System\fFlMoPa.exe
  C:\Windows\System\fFlMoPa.exe
  2⤵
  PID:11168
- C:\Windows\System\XtIuBvJ.exe
  C:\Windows\System\XtIuBvJ.exe
  2⤵
  PID:11340
- C:\Windows\System\ZeuYHkt.exe
  C:\Windows\System\ZeuYHkt.exe
  2⤵
  PID:1248
- C:\Windows\System\URIRPGy.exe
  C:\Windows\System\URIRPGy.exe
  2⤵
  PID:2988
- C:\Windows\System\tDhkPiR.exe
  C:\Windows\System\tDhkPiR.exe
  2⤵
  PID:1688
- C:\Windows\System\NRUJlYg.exe
  C:\Windows\System\NRUJlYg.exe
  2⤵
  PID:5080
- C:\Windows\System\iCRGxpz.exe
  C:\Windows\System\iCRGxpz.exe
  2⤵
  PID:4404
- C:\Windows\System\KyrxRgM.exe
  C:\Windows\System\KyrxRgM.exe
  2⤵
  PID:11276
- C:\Windows\System\nOXHwih.exe
  C:\Windows\System\nOXHwih.exe
  2⤵
  PID:4988
- C:\Windows\System\QbHqcHq.exe
  C:\Windows\System\QbHqcHq.exe
  2⤵
  PID:4876
- C:\Windows\System\sAewGFI.exe
  C:\Windows\System\sAewGFI.exe
  2⤵
  PID:12956
- C:\Windows\System\aDuwChk.exe
  C:\Windows\System\aDuwChk.exe
  2⤵
  PID:10876
- C:\Windows\System\lGibjId.exe
  C:\Windows\System\lGibjId.exe
  2⤵
  PID:13188
- C:\Windows\System\ubPRikf.exe
  C:\Windows\System\ubPRikf.exe
  2⤵
  PID:13128
- C:\Windows\System\JvFUvvE.exe
  C:\Windows\System\JvFUvvE.exe
  2⤵
  PID:2944
- C:\Windows\System\GHdVYMn.exe
  C:\Windows\System\GHdVYMn.exe
  2⤵
  PID:6788
- C:\Windows\System\gaJPlAK.exe
  C:\Windows\System\gaJPlAK.exe
  2⤵
  PID:12984
- C:\Windows\System\NRDxzxQ.exe
  C:\Windows\System\NRDxzxQ.exe
  2⤵
  PID:4868
- C:\Windows\System\VLHLpVg.exe
  C:\Windows\System\VLHLpVg.exe
  2⤵
  PID:5188
- C:\Windows\System\UCSaDeZ.exe
  C:\Windows\System\UCSaDeZ.exe
  2⤵
  PID:2800
- C:\Windows\System\jcfCPKf.exe
  C:\Windows\System\jcfCPKf.exe
  2⤵
  PID:8004
- C:\Windows\System\zpLwuCQ.exe
  C:\Windows\System\zpLwuCQ.exe
  2⤵
  PID:12608
- C:\Windows\System\gyqVptH.exe
  C:\Windows\System\gyqVptH.exe
  2⤵
  PID:11476
- C:\Windows\System\cuwHoEs.exe
  C:\Windows\System\cuwHoEs.exe
  2⤵
  PID:680
- C:\Windows\System\ifmFpBB.exe
  C:\Windows\System\ifmFpBB.exe
  2⤵
  PID:2408
- C:\Windows\System\yHNktyO.exe
  C:\Windows\System\yHNktyO.exe
  2⤵
  PID:5136
- C:\Windows\System\fFUlMYS.exe
  C:\Windows\System\fFUlMYS.exe
  2⤵
  PID:11916
- C:\Windows\System\nbxDeeZ.exe
  C:\Windows\System\nbxDeeZ.exe
  2⤵
  PID:12852
- C:\Windows\System\hRlbYka.exe
  C:\Windows\System\hRlbYka.exe
  2⤵
  PID:13848
- C:\Windows\System\WfQofpe.exe
  C:\Windows\System\WfQofpe.exe
  2⤵
  PID:14112
- C:\Windows\System\SxsEssZ.exe
  C:\Windows\System\SxsEssZ.exe
  2⤵
  PID:14280
- C:\Windows\System\yYSqpEw.exe
  C:\Windows\System\yYSqpEw.exe
  2⤵
  PID:14312
- C:\Windows\System\SfTLrBM.exe
  C:\Windows\System\SfTLrBM.exe
  2⤵
  PID:14332
- C:\Windows\System\PIPNBHK.exe
  C:\Windows\System\PIPNBHK.exe
  2⤵
  PID:2296
- C:\Windows\System\NqAVxfG.exe
  C:\Windows\System\NqAVxfG.exe
  2⤵
  PID:13496
- C:\Windows\System\DzxWPpU.exe
  C:\Windows\System\DzxWPpU.exe
  2⤵
  PID:13596
- C:\Windows\System\TBcIOpE.exe
  C:\Windows\System\TBcIOpE.exe
  2⤵
  PID:4268
- C:\Windows\System\DqeHYgG.exe
  C:\Windows\System\DqeHYgG.exe
  2⤵
  PID:1744
- C:\Windows\System\LDjOjvb.exe
  C:\Windows\System\LDjOjvb.exe
  2⤵
  PID:13968
- C:\Windows\System\lIMzhOG.exe
  C:\Windows\System\lIMzhOG.exe
  2⤵
  PID:14000
- C:\Windows\System\XTeQLcY.exe
  C:\Windows\System\XTeQLcY.exe
  2⤵
  PID:14016
- C:\Windows\System\axzIPFC.exe
  C:\Windows\System\axzIPFC.exe
  2⤵
  PID:14040
- C:\Windows\System\VbBcBuk.exe
  C:\Windows\System\VbBcBuk.exe
  2⤵
  PID:14072
- C:\Windows\System\AHwfSvK.exe
  C:\Windows\System\AHwfSvK.exe
  2⤵
  PID:14092
- C:\Windows\System\HcdbBIT.exe
  C:\Windows\System\HcdbBIT.exe
  2⤵
  PID:14160
- C:\Windows\System\XzVnrQh.exe
  C:\Windows\System\XzVnrQh.exe
  2⤵
  PID:3756
- C:\Windows\System\hXBZZcM.exe
  C:\Windows\System\hXBZZcM.exe
  2⤵
  PID:2308
- C:\Windows\System\dMNPAXn.exe
  C:\Windows\System\dMNPAXn.exe
  2⤵
  PID:14216
- C:\Windows\System\wSzYfkw.exe
  C:\Windows\System\wSzYfkw.exe
  2⤵
  PID:13316
- C:\Windows\System\mPPjxsx.exe
  C:\Windows\System\mPPjxsx.exe
  2⤵
  PID:3140
- C:\Windows\System\NeltxlS.exe
  C:\Windows\System\NeltxlS.exe
  2⤵
  PID:11600
- C:\Windows\System\LjIHgTM.exe
  C:\Windows\System\LjIHgTM.exe
  2⤵
  PID:13428
- C:\Windows\System\jZADwNG.exe
  C:\Windows\System\jZADwNG.exe
  2⤵
  PID:13364
- C:\Windows\System\gImszzV.exe
  C:\Windows\System\gImszzV.exe
  2⤵
  PID:13360
- C:\Windows\System\ZjfsOSG.exe
  C:\Windows\System\ZjfsOSG.exe
  2⤵
  PID:13376
- C:\Windows\System\lRtZKxG.exe
  C:\Windows\System\lRtZKxG.exe
  2⤵
  PID:13444
- C:\Windows\System\IuXPTfd.exe
  C:\Windows\System\IuXPTfd.exe
  2⤵
  PID:13604
- C:\Windows\System\xmSUnnm.exe
  C:\Windows\System\xmSUnnm.exe
  2⤵
  PID:13612
- C:\Windows\System\xZAcmCW.exe
  C:\Windows\System\xZAcmCW.exe
  2⤵
  PID:13712
- C:\Windows\System\YkGHnme.exe
  C:\Windows\System\YkGHnme.exe
  2⤵
  PID:5072
- C:\Windows\System\pQjLTJF.exe
  C:\Windows\System\pQjLTJF.exe
  2⤵
  PID:2248
- C:\Windows\System\yNMYNQi.exe
  C:\Windows\System\yNMYNQi.exe
  2⤵
  PID:940
- C:\Windows\System\NhplOoB.exe
  C:\Windows\System\NhplOoB.exe
  2⤵
  PID:13680
- C:\Windows\System\ONnwPyU.exe
  C:\Windows\System\ONnwPyU.exe
  2⤵
  PID:13720
- C:\Windows\System\xNfvxZF.exe
  C:\Windows\System\xNfvxZF.exe
  2⤵
  PID:13768
- C:\Windows\System\UoafGTF.exe
  C:\Windows\System\UoafGTF.exe
  2⤵
  PID:13792
- C:\Windows\System\fokQAHV.exe
  C:\Windows\System\fokQAHV.exe
  2⤵
  PID:3232
- C:\Windows\System\tYnszny.exe
  C:\Windows\System\tYnszny.exe
  2⤵
  PID:4540
- C:\Windows\System\QjBbKAq.exe
  C:\Windows\System\QjBbKAq.exe
  2⤵
  PID:14204
- C:\Windows\System\QrLHERT.exe
  C:\Windows\System\QrLHERT.exe
  2⤵
  PID:1072
- C:\Windows\System\SBOgruG.exe
  C:\Windows\System\SBOgruG.exe
  2⤵
  PID:3728
- C:\Windows\System\MdjIvWE.exe
  C:\Windows\System\MdjIvWE.exe
  2⤵
  PID:14268
- C:\Windows\System\KADtuel.exe
  C:\Windows\System\KADtuel.exe
  2⤵
  PID:4524
- C:\Windows\System\gbDhdgn.exe
  C:\Windows\System\gbDhdgn.exe
  2⤵
  PID:4116
- C:\Windows\System\Vqgptaw.exe
  C:\Windows\System\Vqgptaw.exe
  2⤵
  PID:8716
- C:\Windows\System\BsGazqb.exe
  C:\Windows\System\BsGazqb.exe
  2⤵
  PID:13404
- C:\Windows\System\jbTXNOG.exe
  C:\Windows\System\jbTXNOG.exe
  2⤵
  PID:13408
- C:\Windows\System\EPXXGhV.exe
  C:\Windows\System\EPXXGhV.exe
  2⤵
  PID:5400
- C:\Windows\System\ZPjUqsr.exe
  C:\Windows\System\ZPjUqsr.exe
  2⤵
  PID:5024
- C:\Windows\System\crfioNs.exe
  C:\Windows\System\crfioNs.exe
  2⤵
  PID:13620
- C:\Windows\System\VhefBat.exe
  C:\Windows\System\VhefBat.exe
  2⤵
  PID:5248
- C:\Windows\System\xkFoMde.exe
  C:\Windows\System\xkFoMde.exe
  2⤵
  PID:13520
- C:\Windows\System\pdqwseJ.exe
  C:\Windows\System\pdqwseJ.exe
  2⤵
  PID:13804
- C:\Windows\System\GZYwcjX.exe
  C:\Windows\System\GZYwcjX.exe
  2⤵
  PID:4068
- C:\Windows\System\YiVbaVj.exe
  C:\Windows\System\YiVbaVj.exe
  2⤵
  PID:6132
- C:\Windows\System\gJjRscM.exe
  C:\Windows\System\gJjRscM.exe
  2⤵
  PID:5644
- C:\Windows\System\WOTFuGl.exe
  C:\Windows\System\WOTFuGl.exe
  2⤵
  PID:2404
- C:\Windows\System\gZFqRZq.exe
  C:\Windows\System\gZFqRZq.exe
  2⤵
  PID:5844
- C:\Windows\System\SFpRnLq.exe
  C:\Windows\System\SFpRnLq.exe
  2⤵
  PID:5964
- C:\Windows\System\sLKeLhn.exe
  C:\Windows\System\sLKeLhn.exe
  2⤵
  PID:5600
- C:\Windows\System\UgxddPo.exe
  C:\Windows\System\UgxddPo.exe
  2⤵
  PID:5596
- C:\Windows\System\jRZCrTJ.exe
  C:\Windows\System\jRZCrTJ.exe
  2⤵
  PID:14068
- C:\Windows\System\BqxWPnu.exe
  C:\Windows\System\BqxWPnu.exe
  2⤵
  PID:6852
- C:\Windows\System\AubRfCH.exe
  C:\Windows\System\AubRfCH.exe
  2⤵
  PID:6680
- C:\Windows\System\oThWIVW.exe
  C:\Windows\System\oThWIVW.exe
  2⤵
  PID:5224
- C:\Windows\System\KuTRyoA.exe
  C:\Windows\System\KuTRyoA.exe
  2⤵
  PID:5740
- C:\Windows\System\hcnUtkb.exe
  C:\Windows\System\hcnUtkb.exe
  2⤵
  PID:13992
- C:\Windows\System\xSrhUwk.exe
  C:\Windows\System\xSrhUwk.exe
  2⤵
  PID:5064
- C:\Windows\System\tNQppBi.exe
  C:\Windows\System\tNQppBi.exe
  2⤵
  PID:5084
- C:\Windows\System\hhlGsnK.exe
  C:\Windows\System\hhlGsnK.exe
  2⤵
  PID:6904
- C:\Windows\System\qnnzCMM.exe
  C:\Windows\System\qnnzCMM.exe
  2⤵
  PID:992
- C:\Windows\System\KjPgtHE.exe
  C:\Windows\System\KjPgtHE.exe
  2⤵
  PID:6964
- C:\Windows\System\RTKGNCk.exe
  C:\Windows\System\RTKGNCk.exe
  2⤵
  PID:7148
- C:\Windows\System\cWwSsLh.exe
  C:\Windows\System\cWwSsLh.exe
  2⤵
  PID:6468
- C:\Windows\System\AKPfwJI.exe
  C:\Windows\System\AKPfwJI.exe
  2⤵
  PID:14236
- C:\Windows\System\QtSazgy.exe
  C:\Windows\System\QtSazgy.exe
  2⤵
  PID:800
- C:\Windows\System\MhbZjmn.exe
  C:\Windows\System\MhbZjmn.exe
  2⤵
  PID:1336
- C:\Windows\System\PReHDMW.exe
  C:\Windows\System\PReHDMW.exe
  2⤵
  PID:6520
- C:\Windows\System\nYhReAi.exe
  C:\Windows\System\nYhReAi.exe
  2⤵
  PID:14316
- C:\Windows\System\eMWbhvd.exe
  C:\Windows\System\eMWbhvd.exe
  2⤵
  PID:6740
- C:\Windows\System\XITrYxU.exe
  C:\Windows\System\XITrYxU.exe
  2⤵
  PID:14276
- C:\Windows\System\KYgOyaV.exe
  C:\Windows\System\KYgOyaV.exe
  2⤵
  PID:13556
- C:\Windows\System\qNhsLCZ.exe
  C:\Windows\System\qNhsLCZ.exe
  2⤵
  PID:14140
- C:\Windows\System\uZgLEVL.exe
  C:\Windows\System\uZgLEVL.exe
  2⤵
  PID:1648
- C:\Windows\System\cvnuHNV.exe
  C:\Windows\System\cvnuHNV.exe
  2⤵
  PID:5256
- C:\Windows\System\oWJbgYG.exe
  C:\Windows\System\oWJbgYG.exe
  2⤵
  PID:13716
- C:\Windows\System\gGqvGuP.exe
  C:\Windows\System\gGqvGuP.exe
  2⤵
  PID:13988
- C:\Windows\System\oppdbSX.exe
  C:\Windows\System\oppdbSX.exe
  2⤵
  PID:5412
- C:\Windows\System\xMZxtWJ.exe
  C:\Windows\System\xMZxtWJ.exe
  2⤵
  PID:13932
- C:\Windows\System\OQPNush.exe
  C:\Windows\System\OQPNush.exe
  2⤵
  PID:14028
- C:\Windows\System\CfoUXvU.exe
  C:\Windows\System\CfoUXvU.exe
  2⤵
  PID:14116
- C:\Windows\System\gWHxrma.exe
  C:\Windows\System\gWHxrma.exe
  2⤵
  PID:5944
- C:\Windows\System\sSkzhmD.exe
  C:\Windows\System\sSkzhmD.exe
  2⤵
  PID:628
- C:\Windows\System\tyWdjOu.exe
  C:\Windows\System\tyWdjOu.exe
  2⤵
  PID:14220
- C:\Windows\System\SELtmhH.exe
  C:\Windows\System\SELtmhH.exe
  2⤵
  PID:13816
- C:\Windows\System\hfxQqjJ.exe
  C:\Windows\System\hfxQqjJ.exe
  2⤵
  PID:1572
- C:\Windows\System\EWVBJhu.exe
  C:\Windows\System\EWVBJhu.exe
  2⤵
  PID:7396
- C:\Windows\System\GgKmPFg.exe
  C:\Windows\System\GgKmPFg.exe
  2⤵
  PID:8360
- C:\Windows\System\ZIuJNbi.exe
  C:\Windows\System\ZIuJNbi.exe
  2⤵
  PID:6696
- C:\Windows\System\JtcgkHK.exe
  C:\Windows\System\JtcgkHK.exe
  2⤵
  PID:8400
- C:\Windows\System\wbtDixl.exe
  C:\Windows\System\wbtDixl.exe
  2⤵
  PID:6284
- C:\Windows\System\YfuAwJd.exe
  C:\Windows\System\YfuAwJd.exe
  2⤵
  PID:4372
- C:\Windows\System\GhgMHOv.exe
  C:\Windows\System\GhgMHOv.exe
  2⤵
  PID:8436
- C:\Windows\System\WGyCCjn.exe
  C:\Windows\System\WGyCCjn.exe
  2⤵
  PID:8456
- C:\Windows\System\nkJyVtd.exe
  C:\Windows\System\nkJyVtd.exe
  2⤵
  PID:3920
- C:\Windows\System\ZgyItVa.exe
  C:\Windows\System\ZgyItVa.exe
  2⤵
  PID:5296
- C:\Windows\System\OhneEPt.exe
  C:\Windows\System\OhneEPt.exe
  2⤵
  PID:8676
- C:\Windows\System\LIYCPtO.exe
  C:\Windows\System\LIYCPtO.exe
  2⤵
  PID:7024
- C:\Windows\System\EsmcMfN.exe
  C:\Windows\System\EsmcMfN.exe
  2⤵
  PID:14300
- C:\Windows\System\BjKZaMN.exe
  C:\Windows\System\BjKZaMN.exe
  2⤵
  PID:7120
- C:\Windows\System\adBSAxB.exe
  C:\Windows\System\adBSAxB.exe
  2⤵
  PID:13356
- C:\Windows\System\hWGUIzl.exe
  C:\Windows\System\hWGUIzl.exe
  2⤵
  PID:2464
- C:\Windows\System\nOPNfbz.exe
  C:\Windows\System\nOPNfbz.exe
  2⤵
  PID:8696
- C:\Windows\System\lbEsguz.exe
  C:\Windows\System\lbEsguz.exe
  2⤵
  PID:5976
- C:\Windows\System\ANxeXCg.exe
  C:\Windows\System\ANxeXCg.exe
  2⤵
  PID:6252
- C:\Windows\System\cZusLVo.exe
  C:\Windows\System\cZusLVo.exe
  2⤵
  PID:14132
- C:\Windows\System\mEPHoho.exe
  C:\Windows\System\mEPHoho.exe
  2⤵
  PID:8884
- C:\Windows\System\DuURVgB.exe
  C:\Windows\System\DuURVgB.exe
  2⤵
  PID:2168
- C:\Windows\System\cuvKFfd.exe
  C:\Windows\System\cuvKFfd.exe
  2⤵
  PID:7672
- C:\Windows\System\ghepVHg.exe
  C:\Windows\System\ghepVHg.exe
  2⤵
  PID:1780
- C:\Windows\System\hZBTBiN.exe
  C:\Windows\System\hZBTBiN.exe
  2⤵
  PID:3020
- C:\Windows\System\fShfIOp.exe
  C:\Windows\System\fShfIOp.exe
  2⤵
  PID:13576
- C:\Windows\System\jImzkTG.exe
  C:\Windows\System\jImzkTG.exe
  2⤵
  PID:5268
- C:\Windows\System\JTRVtlt.exe
  C:\Windows\System\JTRVtlt.exe
  2⤵
  PID:14324
- C:\Windows\System\DxueljG.exe
  C:\Windows\System\DxueljG.exe
  2⤵
  PID:8980
- C:\Windows\System\VPGcdZA.exe
  C:\Windows\System\VPGcdZA.exe
  2⤵
  PID:13928
- C:\Windows\System\swLYhOE.exe
  C:\Windows\System\swLYhOE.exe
  2⤵
  PID:8304
- C:\Windows\System\hpqhXkx.exe
  C:\Windows\System\hpqhXkx.exe
  2⤵
  PID:4300
- C:\Windows\System\QxbhtwF.exe
  C:\Windows\System\QxbhtwF.exe
  2⤵
  PID:900
- C:\Windows\System\iRiBjLi.exe
  C:\Windows\System\iRiBjLi.exe
  2⤵
  PID:472
- C:\Windows\System\qsYKPEW.exe
  C:\Windows\System\qsYKPEW.exe
  2⤵
  PID:7288
- C:\Windows\System\BqwbHYO.exe
  C:\Windows\System\BqwbHYO.exe
  2⤵
  PID:8352
- C:\Windows\System\QqgFzHR.exe
  C:\Windows\System\QqgFzHR.exe
  2⤵
  PID:2764
- C:\Windows\System\MKQeKYW.exe
  C:\Windows\System\MKQeKYW.exe
  2⤵
  PID:3652
- C:\Windows\System\LtPWQDu.exe
  C:\Windows\System\LtPWQDu.exe
  2⤵
  PID:1948
- C:\Windows\System\ofemoZy.exe
  C:\Windows\System\ofemoZy.exe
  2⤵
  PID:3260
- C:\Windows\System\QNMVkJf.exe
  C:\Windows\System\QNMVkJf.exe
  2⤵
  PID:8288
- C:\Windows\System\rDlWOdv.exe
  C:\Windows\System\rDlWOdv.exe
  2⤵
  PID:5872
- C:\Windows\System\vWjZmGd.exe
  C:\Windows\System\vWjZmGd.exe
  2⤵
  PID:8376
- C:\Windows\System\cfEqTnv.exe
  C:\Windows\System\cfEqTnv.exe
  2⤵
  PID:8880
- C:\Windows\System\IDmGnQl.exe
  C:\Windows\System\IDmGnQl.exe
  2⤵
  PID:8396
- C:\Windows\System\wQPVMfv.exe
  C:\Windows\System\wQPVMfv.exe
  2⤵
  PID:7976
- C:\Windows\System\wcNIUqp.exe
  C:\Windows\System\wcNIUqp.exe
  2⤵
  PID:6988
- C:\Windows\System\dNUcmDR.exe
  C:\Windows\System\dNUcmDR.exe
  2⤵
  PID:6656
- C:\Windows\System\iYBvDay.exe
  C:\Windows\System\iYBvDay.exe
  2⤵
  PID:7740
- C:\Windows\System\HoleyfG.exe
  C:\Windows\System\HoleyfG.exe
  2⤵
  PID:5320
- C:\Windows\System\KKGWeIa.exe
  C:\Windows\System\KKGWeIa.exe
  2⤵
  PID:9920
- C:\Windows\System\sVdsjGl.exe
  C:\Windows\System\sVdsjGl.exe
  2⤵
  PID:5564
- C:\Windows\System\zFHRnfY.exe
  C:\Windows\System\zFHRnfY.exe
  2⤵
  PID:8916
- C:\Windows\System\bSBiloo.exe
  C:\Windows\System\bSBiloo.exe
  2⤵
  PID:9948
- C:\Windows\System\YysVisL.exe
  C:\Windows\System\YysVisL.exe
  2⤵
  PID:7716
- C:\Windows\System\nhFvVlQ.exe
  C:\Windows\System\nhFvVlQ.exe
  2⤵
  PID:2416
- C:\Windows\System\feqntGp.exe
  C:\Windows\System\feqntGp.exe
  2⤵
  PID:8328
- C:\Windows\System\DLDmMwY.exe
  C:\Windows\System\DLDmMwY.exe
  2⤵
  PID:10040
- C:\Windows\System\JVdYsTh.exe
  C:\Windows\System\JVdYsTh.exe
  2⤵
  PID:8988
- C:\Windows\System\KXLsbgk.exe
  C:\Windows\System\KXLsbgk.exe
  2⤵
  PID:9980
- C:\Windows\System\TqqqirX.exe
  C:\Windows\System\TqqqirX.exe
  2⤵
  PID:8336
- C:\Windows\System\HpRXsab.exe
  C:\Windows\System\HpRXsab.exe
  2⤵
  PID:8296
- C:\Windows\System\HQEXrrx.exe
  C:\Windows\System\HQEXrrx.exe
  2⤵
  PID:9408
- C:\Windows\System\wDvQBID.exe
  C:\Windows\System\wDvQBID.exe
  2⤵
  PID:7576
- C:\Windows\System\FRJIQyU.exe
  C:\Windows\System\FRJIQyU.exe
  2⤵
  PID:10092
- C:\Windows\System\qTLkxWi.exe
  C:\Windows\System\qTLkxWi.exe
  2⤵
  PID:9816
- C:\Windows\System\iQlPhBI.exe
  C:\Windows\System\iQlPhBI.exe
  2⤵
  PID:3468
- C:\Windows\System\cIFzbPI.exe
  C:\Windows\System\cIFzbPI.exe
  2⤵
  PID:10136
- C:\Windows\System\penjjuI.exe
  C:\Windows\System\penjjuI.exe
  2⤵
  PID:9692
- C:\Windows\System\iDNWCyJ.exe
  C:\Windows\System\iDNWCyJ.exe
  2⤵
  PID:9932
- C:\Windows\System\jqItCyX.exe
  C:\Windows\System\jqItCyX.exe
  2⤵
  PID:10188
- C:\Windows\System\YFJbuaJ.exe
  C:\Windows\System\YFJbuaJ.exe
  2⤵
  PID:7616
- C:\Windows\System\OIHyUAg.exe
  C:\Windows\System\OIHyUAg.exe
  2⤵
  PID:9868
- C:\Windows\System\GvNseOb.exe
  C:\Windows\System\GvNseOb.exe
  2⤵
  PID:9976
- C:\Windows\System\swyVRLf.exe
  C:\Windows\System\swyVRLf.exe
  2⤵
  PID:9872
- C:\Windows\System\wvDhNZN.exe
  C:\Windows\System\wvDhNZN.exe
  2⤵
  PID:5824
- C:\Windows\System\wmyvFBZ.exe
  C:\Windows\System\wmyvFBZ.exe
  2⤵
  PID:8748
- C:\Windows\System\XYVbYiw.exe
  C:\Windows\System\XYVbYiw.exe
  2⤵
  PID:8968
- C:\Windows\System\JOBdeqP.exe
  C:\Windows\System\JOBdeqP.exe
  2⤵
  PID:10084
- C:\Windows\System\mljdMKk.exe
  C:\Windows\System\mljdMKk.exe
  2⤵
  PID:9248
- C:\Windows\System\MqGtoxX.exe
  C:\Windows\System\MqGtoxX.exe
  2⤵
  PID:8972
- C:\Windows\System\iPJyBwy.exe
  C:\Windows\System\iPJyBwy.exe
  2⤵
  PID:6000
- C:\Windows\System\lOggxuk.exe
  C:\Windows\System\lOggxuk.exe
  2⤵
  PID:10072
- C:\Windows\System\tYZrzqr.exe
  C:\Windows\System\tYZrzqr.exe
  2⤵
  PID:6728
- C:\Windows\System\TgmFPJp.exe
  C:\Windows\System\TgmFPJp.exe
  2⤵
  PID:6460
- C:\Windows\System\lFUtJgA.exe
  C:\Windows\System\lFUtJgA.exe
  2⤵
  PID:7324
- C:\Windows\System\ISuWBCD.exe
  C:\Windows\System\ISuWBCD.exe
  2⤵
  PID:5764
- C:\Windows\System\DpPtEUW.exe
  C:\Windows\System\DpPtEUW.exe
  2⤵
  PID:8196
- C:\Windows\System\POVbABh.exe
  C:\Windows\System\POVbABh.exe
  2⤵
  PID:8976
- C:\Windows\System\CzPwpOc.exe
  C:\Windows\System\CzPwpOc.exe
  2⤵
  PID:1508
- C:\Windows\System\lVyIkbz.exe
  C:\Windows\System\lVyIkbz.exe
  2⤵
  PID:10080
- C:\Windows\System\rmCDHql.exe
  C:\Windows\System\rmCDHql.exe
  2⤵
  PID:8664
- C:\Windows\System\GRJAMVc.exe
  C:\Windows\System\GRJAMVc.exe
  2⤵
  PID:6040
- C:\Windows\System\UnTxoHb.exe
  C:\Windows\System\UnTxoHb.exe
  2⤵
  PID:8424
- C:\Windows\System\nJPGtjx.exe
  C:\Windows\System\nJPGtjx.exe
  2⤵
  PID:10180
- C:\Windows\System\SYDGJnf.exe
  C:\Windows\System\SYDGJnf.exe
  2⤵
  PID:9556
- C:\Windows\System\SYgMmSO.exe
  C:\Windows\System\SYgMmSO.exe
  2⤵
  PID:1616
- C:\Windows\System\CIvaqhW.exe
  C:\Windows\System\CIvaqhW.exe
  2⤵
  PID:924
- C:\Windows\System\xFVbNbC.exe
  C:\Windows\System\xFVbNbC.exe
  2⤵
  PID:10248
- C:\Windows\System\OzBQVnU.exe
  C:\Windows\System\OzBQVnU.exe
  2⤵
  PID:10416
- C:\Windows\System\vnsZCaA.exe
  C:\Windows\System\vnsZCaA.exe
  2⤵
  PID:10408
- C:\Windows\System\BaKWMeC.exe
  C:\Windows\System\BaKWMeC.exe
  2⤵
  PID:7052
- C:\Windows\System\ZavGsYQ.exe
  C:\Windows\System\ZavGsYQ.exe
  2⤵
  PID:7452
- C:\Windows\System\PdGEEZm.exe
  C:\Windows\System\PdGEEZm.exe
  2⤵
  PID:7500
- C:\Windows\System\PtJvaQn.exe
  C:\Windows\System\PtJvaQn.exe
  2⤵
  PID:10780
- C:\Windows\System\WYratJk.exe
  C:\Windows\System\WYratJk.exe
  2⤵
  PID:11224
- C:\Windows\System\IruhHSr.exe
  C:\Windows\System\IruhHSr.exe
  2⤵
  PID:5540
- C:\Windows\System\qntVPdt.exe
  C:\Windows\System\qntVPdt.exe
  2⤵
  PID:13964
- C:\Windows\System\JQOwZDr.exe
  C:\Windows\System\JQOwZDr.exe
  2⤵
  PID:10500
- C:\Windows\System\viEKdHV.exe
  C:\Windows\System\viEKdHV.exe
  2⤵
  PID:7692
- C:\Windows\System\hXjUBJL.exe
  C:\Windows\System\hXjUBJL.exe
  2⤵
  PID:9744
- C:\Windows\System\EivKJZL.exe
  C:\Windows\System\EivKJZL.exe
  2⤵
  PID:10748
- C:\Windows\System\ExKieWV.exe
  C:\Windows\System\ExKieWV.exe
  2⤵
  PID:8712
- C:\Windows\System\wDrXVqC.exe
  C:\Windows\System\wDrXVqC.exe
  2⤵
  PID:5688
- C:\Windows\System\ZJOLKmJ.exe
  C:\Windows\System\ZJOLKmJ.exe
  2⤵
  PID:8012
- C:\Windows\System\MbEVzyx.exe
  C:\Windows\System\MbEVzyx.exe
  2⤵
  PID:9468
- C:\Windows\System\WRwgZzF.exe
  C:\Windows\System\WRwgZzF.exe
  2⤵
  PID:5800
- C:\Windows\System\dgcTiBM.exe
  C:\Windows\System\dgcTiBM.exe
  2⤵
  PID:9792
- C:\Windows\System\lGwWfgW.exe
  C:\Windows\System\lGwWfgW.exe
  2⤵
  PID:9760
- C:\Windows\System\jBKqOHw.exe
  C:\Windows\System\jBKqOHw.exe
  2⤵
  PID:10308
- C:\Windows\System\ESeJUhy.exe
  C:\Windows\System\ESeJUhy.exe
  2⤵
  PID:5920
- C:\Windows\System\kKzgcTZ.exe
  C:\Windows\System\kKzgcTZ.exe
  2⤵
  PID:9708
- C:\Windows\System\XBBqpOa.exe
  C:\Windows\System\XBBqpOa.exe
  2⤵
  PID:11152
- C:\Windows\System\mOOZjua.exe
  C:\Windows\System\mOOZjua.exe
  2⤵
  PID:9804
- C:\Windows\System\quGmCqS.exe
  C:\Windows\System\quGmCqS.exe
  2⤵
  PID:10292
- C:\Windows\System\IavuZFB.exe
  C:\Windows\System\IavuZFB.exe
  2⤵
  PID:9832
- C:\Windows\System\rnzlrHJ.exe
  C:\Windows\System\rnzlrHJ.exe
  2⤵
  PID:10548
- C:\Windows\System\bUSpiKo.exe
  C:\Windows\System\bUSpiKo.exe
  2⤵
  PID:9304
- C:\Windows\System\MlcBTeX.exe
  C:\Windows\System\MlcBTeX.exe
  2⤵
  PID:10592
- C:\Windows\System\iRUzJQk.exe
  C:\Windows\System\iRUzJQk.exe
  2⤵
  PID:9084
- C:\Windows\System\iOfyZfi.exe
  C:\Windows\System\iOfyZfi.exe
  2⤵
  PID:10372
- C:\Windows\System\MIdxNWa.exe
  C:\Windows\System\MIdxNWa.exe
  2⤵
  PID:9016
- C:\Windows\System\qNCnJXT.exe
  C:\Windows\System\qNCnJXT.exe
  2⤵
  PID:10932
- C:\Windows\System\GKfvsbe.exe
  C:\Windows\System\GKfvsbe.exe
  2⤵
  PID:8808
- C:\Windows\System\hrRnjUF.exe
  C:\Windows\System\hrRnjUF.exe
  2⤵
  PID:8292
- C:\Windows\System\DkGDszz.exe
  C:\Windows\System\DkGDszz.exe
  2⤵
  PID:10632
- C:\Windows\System\bGzZmml.exe
  C:\Windows\System\bGzZmml.exe
  2⤵
  PID:8140
- C:\Windows\System\DCWkAtg.exe
  C:\Windows\System\DCWkAtg.exe
  2⤵
  PID:11284
- C:\Windows\System\QMFbrEy.exe
  C:\Windows\System\QMFbrEy.exe
  2⤵
  PID:6956
- C:\Windows\System\rTCQbhy.exe
  C:\Windows\System\rTCQbhy.exe
  2⤵
  PID:5348
- C:\Windows\System\xfWnYBH.exe
  C:\Windows\System\xfWnYBH.exe
  2⤵
  PID:9756
- C:\Windows\System\fSPjIzN.exe
  C:\Windows\System\fSPjIzN.exe
  2⤵
  PID:8100
- C:\Windows\System\QfVtOot.exe
  C:\Windows\System\QfVtOot.exe
  2⤵
  PID:10316
- C:\Windows\System\TPcQyPu.exe
  C:\Windows\System\TPcQyPu.exe
  2⤵
  PID:8692
- C:\Windows\System\eIVXJLY.exe
  C:\Windows\System\eIVXJLY.exe
  2⤵
  PID:9900
- C:\Windows\System\faYplbr.exe
  C:\Windows\System\faYplbr.exe
  2⤵
  PID:8320
- C:\Windows\System\dulgzxJ.exe
  C:\Windows\System\dulgzxJ.exe
  2⤵
  PID:10968
- C:\Windows\System\FJQFimj.exe
  C:\Windows\System\FJQFimj.exe
  2⤵
  PID:11396
- C:\Windows\System\YeJlZfq.exe
  C:\Windows\System\YeJlZfq.exe
  2⤵
  PID:9864
- C:\Windows\System\eyTAyMV.exe
  C:\Windows\System\eyTAyMV.exe
  2⤵
  PID:12372
- C:\Windows\System\dWCGcDT.exe
  C:\Windows\System\dWCGcDT.exe
  2⤵
  PID:12380
- C:\Windows\System\fUNaiGQ.exe
  C:\Windows\System\fUNaiGQ.exe
  2⤵
  PID:11336
- C:\Windows\System\bFZpYcL.exe
  C:\Windows\System\bFZpYcL.exe
  2⤵
  PID:2916
- C:\Windows\System\KEildDh.exe
  C:\Windows\System\KEildDh.exe
  2⤵
  PID:12352
- C:\Windows\System\aQhnRiZ.exe
  C:\Windows\System\aQhnRiZ.exe
  2⤵
  PID:11952
- C:\Windows\System\kODIlxm.exe
  C:\Windows\System\kODIlxm.exe
  2⤵
  PID:11500
- C:\Windows\System\tNFuVJx.exe
  C:\Windows\System\tNFuVJx.exe
  2⤵
  PID:11448
- C:\Windows\System\ypPsvUs.exe
  C:\Windows\System\ypPsvUs.exe
  2⤵
  PID:8752
- C:\Windows\System\decpcpy.exe
  C:\Windows\System\decpcpy.exe
  2⤵
  PID:9748
- C:\Windows\System\cyIHJAY.exe
  C:\Windows\System\cyIHJAY.exe
  2⤵
  PID:11820
- C:\Windows\System\GFUwjwo.exe
  C:\Windows\System\GFUwjwo.exe
  2⤵
  PID:10232
- C:\Windows\System\aKFvDgF.exe
  C:\Windows\System\aKFvDgF.exe
  2⤵
  PID:3984
- C:\Windows\System\ysUSLns.exe
  C:\Windows\System\ysUSLns.exe
  2⤵
  PID:12784
- C:\Windows\System\uSdHnqX.exe
  C:\Windows\System\uSdHnqX.exe
  2⤵
  PID:7736
- C:\Windows\System\SoKBAOZ.exe
  C:\Windows\System\SoKBAOZ.exe
  2⤵
  PID:8848
- C:\Windows\System\ULkgOnU.exe
  C:\Windows\System\ULkgOnU.exe
  2⤵
  PID:7912
- C:\Windows\System\GeVCfGI.exe
  C:\Windows\System\GeVCfGI.exe
  2⤵
  PID:11416
- C:\Windows\System\NsTcDHV.exe
  C:\Windows\System\NsTcDHV.exe
  2⤵
  PID:12664
- C:\Windows\System\buqjAuk.exe
  C:\Windows\System\buqjAuk.exe
  2⤵
  PID:9404
- C:\Windows\System\OYWjrCc.exe
  C:\Windows\System\OYWjrCc.exe
  2⤵
  PID:7344
- C:\Windows\System\smUNxOD.exe
  C:\Windows\System\smUNxOD.exe
  2⤵
  PID:12968
- C:\Windows\System\joKSkWw.exe
  C:\Windows\System\joKSkWw.exe
  2⤵
  PID:12340
- C:\Windows\System\NdjWFgv.exe
  C:\Windows\System\NdjWFgv.exe
  2⤵
  PID:12572
- C:\Windows\System\gFPmiGs.exe
  C:\Windows\System\gFPmiGs.exe
  2⤵
  PID:10584
- C:\Windows\System\SarksSQ.exe
  C:\Windows\System\SarksSQ.exe
  2⤵
  PID:12516
- C:\Windows\System\YqPBGxd.exe
  C:\Windows\System\YqPBGxd.exe
  2⤵
  PID:10400
- C:\Windows\System\HzSvFSd.exe
  C:\Windows\System\HzSvFSd.exe
  2⤵
  PID:3480
- C:\Windows\System\FKKIerd.exe
  C:\Windows\System\FKKIerd.exe
  2⤵
  PID:7992
- C:\Windows\System\VBerLnp.exe
  C:\Windows\System\VBerLnp.exe
  2⤵
  PID:12236
- C:\Windows\System\vWzcmip.exe
  C:\Windows\System\vWzcmip.exe
  2⤵
  PID:5324
- C:\Windows\System\FmGMtEx.exe
  C:\Windows\System\FmGMtEx.exe
  2⤵
  PID:10452
- C:\Windows\System\FPDjPYp.exe
  C:\Windows\System\FPDjPYp.exe
  2⤵
  PID:12828
- C:\Windows\System\FOhpLSk.exe
  C:\Windows\System\FOhpLSk.exe
  2⤵
  PID:11400
- C:\Windows\System\LkARIyD.exe
  C:\Windows\System\LkARIyD.exe
  2⤵
  PID:12484
- C:\Windows\System\fTppTgc.exe
  C:\Windows\System\fTppTgc.exe
  2⤵
  PID:11184
- C:\Windows\System\SgQyGDm.exe
  C:\Windows\System\SgQyGDm.exe
  2⤵
  PID:10936
- C:\Windows\System\bjbbKxV.exe
  C:\Windows\System\bjbbKxV.exe
  2⤵
  PID:9180
- C:\Windows\System\AnARbMq.exe
  C:\Windows\System\AnARbMq.exe
  2⤵
  PID:6124
- C:\Windows\System\iiOjsWI.exe
  C:\Windows\System\iiOjsWI.exe
  2⤵
  PID:11412
- C:\Windows\System\qgVtHcc.exe
  C:\Windows\System\qgVtHcc.exe
  2⤵
  PID:7128
- C:\Windows\System\gGGtYsl.exe
  C:\Windows\System\gGGtYsl.exe
  2⤵
  PID:11752
- C:\Windows\System\HICTaSB.exe
  C:\Windows\System\HICTaSB.exe
  2⤵
  PID:11008
- C:\Windows\System\JLilSOQ.exe
  C:\Windows\System\JLilSOQ.exe
  2⤵
  PID:12528
- C:\Windows\System\arOenQZ.exe
  C:\Windows\System\arOenQZ.exe
  2⤵
  PID:10776
- C:\Windows\System\AWcNxID.exe
  C:\Windows\System\AWcNxID.exe
  2⤵
  PID:9448
- C:\Windows\System\nFoOEVS.exe
  C:\Windows\System\nFoOEVS.exe
  2⤵
  PID:13092
- C:\Windows\System\fkaIuPU.exe
  C:\Windows\System\fkaIuPU.exe
  2⤵
  PID:11684
- C:\Windows\System\xhIiyAw.exe
  C:\Windows\System\xhIiyAw.exe
  2⤵
  PID:10612
- C:\Windows\System\mTjKHHz.exe
  C:\Windows\System\mTjKHHz.exe
  2⤵
  PID:12084
- C:\Windows\System\qWjVIhI.exe
  C:\Windows\System\qWjVIhI.exe
  2⤵
  PID:10176
- C:\Windows\System\KOvzVYK.exe
  C:\Windows\System\KOvzVYK.exe
  2⤵
  PID:12488
- C:\Windows\System\JUECBZb.exe
  C:\Windows\System\JUECBZb.exe
  2⤵
  PID:11392
- C:\Windows\System\fGirFre.exe
  C:\Windows\System\fGirFre.exe
  2⤵
  PID:9224
- C:\Windows\System\VukQJhU.exe
  C:\Windows\System\VukQJhU.exe
  2⤵
  PID:5524
- C:\Windows\System\xnwQRfV.exe
  C:\Windows\System\xnwQRfV.exe
  2⤵
  PID:10456
- C:\Windows\System\RmcLTMK.exe
  C:\Windows\System\RmcLTMK.exe
  2⤵
  PID:12856
- C:\Windows\System\TcrlsjB.exe
  C:\Windows\System\TcrlsjB.exe
  2⤵
  PID:12192
- C:\Windows\System\RhnKOZv.exe
  C:\Windows\System\RhnKOZv.exe
  2⤵
  PID:11928
- C:\Windows\System\PfeAGZz.exe
  C:\Windows\System\PfeAGZz.exe
  2⤵
  PID:12220
- C:\Windows\System\EljZbgI.exe
  C:\Windows\System\EljZbgI.exe
  2⤵
  PID:11468
- C:\Windows\System\uemwNAE.exe
  C:\Windows\System\uemwNAE.exe
  2⤵
  PID:9376
- C:\Windows\System\mHahqmE.exe
  C:\Windows\System\mHahqmE.exe
  2⤵
  PID:7888
- C:\Windows\System\hRdVAfW.exe
  C:\Windows\System\hRdVAfW.exe
  2⤵
  PID:11896
- C:\Windows\System\NMcVLQK.exe
  C:\Windows\System\NMcVLQK.exe
  2⤵
  PID:12180
- C:\Windows\System\mNYDJmz.exe
  C:\Windows\System\mNYDJmz.exe
  2⤵
  PID:10352
- C:\Windows\System\qcswRql.exe
  C:\Windows\System\qcswRql.exe
  2⤵
  PID:11768
- C:\Windows\System\whAXvPi.exe
  C:\Windows\System\whAXvPi.exe
  2⤵
  PID:12840
- C:\Windows\System\FwykCmJ.exe
  C:\Windows\System\FwykCmJ.exe
  2⤵
  PID:11420
- C:\Windows\System\xRsCyxZ.exe
  C:\Windows\System\xRsCyxZ.exe
  2⤵
  PID:12676
- C:\Windows\System\zracUxJ.exe
  C:\Windows\System\zracUxJ.exe
  2⤵
  PID:11584
- C:\Windows\System\gpuJLiY.exe
  C:\Windows\System\gpuJLiY.exe
  2⤵
  PID:4172
- C:\Windows\System\SkOSvtm.exe
  C:\Windows\System\SkOSvtm.exe
  2⤵
  PID:11948
- C:\Windows\System\oKutYFV.exe
  C:\Windows\System\oKutYFV.exe
  2⤵
  PID:9476
- C:\Windows\System\RIXFgHs.exe
  C:\Windows\System\RIXFgHs.exe
  2⤵
  PID:12376
- C:\Windows\System\NEIQVev.exe
  C:\Windows\System\NEIQVev.exe
  2⤵
  PID:13068
- C:\Windows\System\uwQhWww.exe
  C:\Windows\System\uwQhWww.exe
  2⤵
  PID:13036
- C:\Windows\System\JInURee.exe
  C:\Windows\System\JInURee.exe
  2⤵
  PID:3112
- C:\Windows\System\IKnhuxs.exe
  C:\Windows\System\IKnhuxs.exe
  2⤵
  PID:13192
- C:\Windows\System\tMsbkou.exe
  C:\Windows\System\tMsbkou.exe
  2⤵
  PID:12140
- C:\Windows\System\JuQhwbL.exe
  C:\Windows\System\JuQhwbL.exe
  2⤵
  PID:9632
- C:\Windows\System\IWQjnSM.exe
  C:\Windows\System\IWQjnSM.exe
  2⤵
  PID:11472
- C:\Windows\System\keePcKc.exe
  C:\Windows\System\keePcKc.exe
  2⤵
  PID:1540
- C:\Windows\System\pcBefMr.exe
  C:\Windows\System\pcBefMr.exe
  2⤵
  PID:11784
- C:\Windows\System\Blmljxv.exe
  C:\Windows\System\Blmljxv.exe
  2⤵
  PID:3544
- C:\Windows\System\dfNrPmX.exe
  C:\Windows\System\dfNrPmX.exe
  2⤵
  PID:5088
- C:\Windows\System\hPpakIJ.exe
  C:\Windows\System\hPpakIJ.exe
  2⤵
  PID:4316
- C:\Windows\System\VVFdcDW.exe
  C:\Windows\System\VVFdcDW.exe
  2⤵
  PID:12644
- C:\Windows\System\fpidvNs.exe
  C:\Windows\System\fpidvNs.exe
  2⤵
  PID:12264
- C:\Windows\System\PwHRdwA.exe
  C:\Windows\System\PwHRdwA.exe
  2⤵
  PID:14372
- C:\Windows\System\HeMMdiV.exe
  C:\Windows\System\HeMMdiV.exe
  2⤵
  PID:14404
- C:\Windows\System\ZzdbhNW.exe
  C:\Windows\System\ZzdbhNW.exe
  2⤵
  PID:14424
- C:\Windows\System\CByWcZk.exe
  C:\Windows\System\CByWcZk.exe
  2⤵
  PID:14440
- C:\Windows\System\AWwiHoe.exe
  C:\Windows\System\AWwiHoe.exe
  2⤵
  PID:14468
- C:\Windows\System\DXgBOdb.exe
  C:\Windows\System\DXgBOdb.exe
  2⤵
  PID:14504
- C:\Windows\System\sOZcIuR.exe
  C:\Windows\System\sOZcIuR.exe
  2⤵
  PID:14544
- C:\Windows\System\mYMBMQr.exe
  C:\Windows\System\mYMBMQr.exe
  2⤵
  PID:14568
- C:\Windows\System\eZjMhSJ.exe
  C:\Windows\System\eZjMhSJ.exe
  2⤵
  PID:14600
- C:\Windows\System\SjAVRDV.exe
  C:\Windows\System\SjAVRDV.exe
  2⤵
  PID:14632
- C:\Windows\System\HSIvzLU.exe
  C:\Windows\System\HSIvzLU.exe
  2⤵
  PID:14656
- C:\Windows\System\Pufcfwa.exe
  C:\Windows\System\Pufcfwa.exe
  2⤵
  PID:14692
- C:\Windows\System\RmVvfMJ.exe
  C:\Windows\System\RmVvfMJ.exe
  2⤵
  PID:14716
- C:\Windows\System\smuIrpD.exe
  C:\Windows\System\smuIrpD.exe
  2⤵
  PID:14740
- C:\Windows\System\JBnwsoR.exe
  C:\Windows\System\JBnwsoR.exe
  2⤵
  PID:14772
- C:\Windows\System\jUdOUHh.exe
  C:\Windows\System\jUdOUHh.exe
  2⤵
  PID:14808
- C:\Windows\System\xkHZcvA.exe
  C:\Windows\System\xkHZcvA.exe
  2⤵
  PID:14832
- C:\Windows\System\CgcJggA.exe
  C:\Windows\System\CgcJggA.exe
  2⤵
  PID:14864
- C:\Windows\System\sbqwyhl.exe
  C:\Windows\System\sbqwyhl.exe
  2⤵
  PID:14908
- C:\Windows\System\CRCWYdJ.exe
  C:\Windows\System\CRCWYdJ.exe
  2⤵
  PID:14936
- C:\Windows\System\gjAmtQI.exe
  C:\Windows\System\gjAmtQI.exe
  2⤵
  PID:14952
- C:\Windows\System\QdCJOTr.exe
  C:\Windows\System\QdCJOTr.exe
  2⤵
  PID:14980
- C:\Windows\System\Yqcehkc.exe
  C:\Windows\System\Yqcehkc.exe
  2⤵
  PID:15044
- C:\Windows\System\hbkNgks.exe
  C:\Windows\System\hbkNgks.exe
  2⤵
  PID:15080
- C:\Windows\System\EvbZgUs.exe
  C:\Windows\System\EvbZgUs.exe
  2⤵
  PID:15116
- C:\Windows\System\pMCfqxo.exe
  C:\Windows\System\pMCfqxo.exe
  2⤵
  PID:15144
- C:\Windows\System\XMWDLFR.exe
  C:\Windows\System\XMWDLFR.exe
  2⤵
  PID:15172
- C:\Windows\System\mKeEYvO.exe
  C:\Windows\System\mKeEYvO.exe
  2⤵
  PID:15208
- C:\Windows\System\zpruvfP.exe
  C:\Windows\System\zpruvfP.exe
  2⤵
  PID:15228
- C:\Windows\System\gBNEwAz.exe
  C:\Windows\System\gBNEwAz.exe
  2⤵
  PID:15268
- C:\Windows\System\hrWZdDa.exe
  C:\Windows\System\hrWZdDa.exe
  2⤵
  PID:15300
- C:\Windows\System\qTcwupJ.exe
  C:\Windows\System\qTcwupJ.exe
  2⤵
  PID:15320
- C:\Windows\System\eUyPMYJ.exe
  C:\Windows\System\eUyPMYJ.exe
  2⤵
  PID:12136
- C:\Windows\System\DXSOcpf.exe
  C:\Windows\System\DXSOcpf.exe
  2⤵
  PID:14388
- C:\Windows\System\mAXbIeD.exe
  C:\Windows\System\mAXbIeD.exe
  2⤵
  PID:14644
- C:\Windows\System\STMVzPs.exe
  C:\Windows\System\STMVzPs.exe
  2⤵
  PID:14704
- C:\Windows\System\SVuNjjT.exe
  C:\Windows\System\SVuNjjT.exe
  2⤵
  PID:14728
- C:\Windows\System\mPMkKRm.exe
  C:\Windows\System\mPMkKRm.exe
  2⤵
  PID:1552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yy5f3npb.pyx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AabXylK.exe

Filesize
1.9MB

MD5
6dde64c757a0f1c667ebee24c75d8de3

SHA1
a987b384f69d9697e85e8e29e5389092523214b5

SHA256
121350805fe0b5707e1ede8c87da04029e8b0d64bf49cee7ade057cc1aedb955

SHA512
6a5aed5ea8d922e171d8474d6dbd8f035d339cbc5c54203751ea3e65d33e7f9dd4d7ff44896bcd41a633edaa822f4e83bf132ca42fd293dde19d8dc891c670c9

Download Submit
C:\Windows\System\AcescUG.exe

Filesize
18B

MD5
5db3df0964e5c695675f39e99d1f288b

SHA1
84b597ea47f1f6b13b223cbb576a55e47a79cfaa

SHA256
15f5f6f9d4846d3bfaf7f8740e9c849aebfecfea6fc86fee82eb18d6ec03fd9f

SHA512
f71b3480e977c4ca4affaaec3f3bd31e3598fdd986ea7bafee42b5d6a8676e69449256bbab19fc0cc61412a454871e6b79cebb0c5e3610b9e98c4f089888aa18

Download Submit
C:\Windows\System\CJpUBpR.exe

Filesize
1.9MB

MD5
b3681f208dd71e37c81040024a5c339d

SHA1
4aac7eae42b45844437e6322640bf356a30c2a8a

SHA256
1c787d9f7502e6a0a9c762d0617d3f70c918e8de5dc01aacdb3fd2a3d19cee17

SHA512
4626d679b0dcaf96278ed16004764e63b5bab7be78e292ff577dc296730a4a20275774777fd38404a1e9ba190b8753dae23d0260bb23821616740276a951607a

Download Submit
C:\Windows\System\EMlloew.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\System\FCGAArv.exe

Filesize
1.9MB

MD5
a52ef96d284b92e6021a590a42f066a2

SHA1
b1f9c9d561b7dcdbe023e0f1ac575466bce003c0

SHA256
f6aabe239b5a8b2892ad15bb8a3a0137eddf6bbd2c6f7a786823f0a7ed5fe849

SHA512
f7913d77e6cbad9c291425752625c4256bac1c12592c6895a8e13d621eab1172aec2ad1fd7907f9a40328181b384b818a402800d3b760eadbd5eb401e2cf4b68

Download Submit
C:\Windows\System\GDUfzGY.exe

Filesize
1.9MB

MD5
7025dda32cd26eb4ab42f33c0efad6ac

SHA1
4f39cf30cf5d61ac9f560650ed4e179a9abc9ca5

SHA256
d271fdd24ee2fb95e8ba1eed7569bd7880026f451ecd955b869fcaa2cb7c3390

SHA512
2f2c63431c3738bc83ea11127d6326da447e4eda51f9103aa2bf8a9a176391a51035c16e6d6e236146b70992aec27f1ceb9df63de7a5961607e6a51b43b6c8de

Download Submit
C:\Windows\System\HhAtfdf.exe

Filesize
1.9MB

MD5
1c11a99a105deaf3b3764aefe0d25e98

SHA1
61f8bac0f134f1de45f124ccdd958e9ba2fef162

SHA256
d5003cf46844c28736324ced7a8904bd50d3c20a9f16276b7a239f10ad1ce226

SHA512
0209ee8217a0047df729fc8a7361efb98ca20e7a0849e460ec65eb66a23adadd55beea3ca80a73046ca1ea7c81e105b2dd3ea453351e761795e04485aa49168d

Download Submit
C:\Windows\System\JSfGuEJ.exe

Filesize
1.9MB

MD5
8717d8daa27b0095303f4d2cd532883e

SHA1
c84d9148ba23b51f38218c4abe04ad84e3ab4f8b

SHA256
dfa224da4186e8efc160f956d9e8a646c52fbdc6feca2a7f5aae2425f6dfb9d0

SHA512
7b3ababa9d966d24d5cc1a6b1bec42118391267b50aba435891dc1b7a8b386a4a0d909b875456a3a26adf9e9723e426135ddcfa57ea228fefe9e0f275e341b3d

Download Submit
C:\Windows\System\JXtwFhJ.exe

Filesize
1.9MB

MD5
70479717ccee6dfb80ec1693de95093d

SHA1
8c2d4c9275a7e083e1195dbb82a08475487ceed6

SHA256
9267baa5b247efbe1853c88390bf5e0c7a912ab7ad82a43adf946011fb3e8e0e

SHA512
d70fdf93e5f142a6e9e325af0c6ca01a990e476cc143c9dcf673a5463af883453eea088dadd856216a99960243d0ed7a6db0d6169ab7c3bd24ab93c69dff2e00

Download Submit
C:\Windows\System\LFjcHNW.exe

Filesize
1.9MB

MD5
ac2ea3fa1ddf5c2b2b331cec6aa2203c

SHA1
0dd6edc31eb10443f1ebc29bfa3e2d5de5529b99

SHA256
efd70cf9378d6c8dec89ee8e5b572b9ffd63f6727a7044a963a9ea367a178399

SHA512
7c22ce2c16f0e84594a5fe6fb6947be9f5051f156e83f682f41f40361b31eee9f3878e733dc89ecbcdb45be1dcffaf7250f2fb41a10c9c9c1809a48449a2cdbc

Download Submit
C:\Windows\System\NWOjwHo.exe

Filesize
1.9MB

MD5
ead5e111fab8cdde50ab4d8e45db97f0

SHA1
8116958dd31bf7fa1f0995bad26cae3f59f6ac66

SHA256
a263c6ddf07ef76dc11c06a7d81df6e1f5fde925c1172ba37f10a8b157eb6b05

SHA512
f820fd14e0c78713038da1eeee7a914423f7eb6eefd02aec96a9d3f8c6cdda7996ac86f361f89371b5c4085f34f9dbc53617ddc7f8356db945371be7b25a5d17

Download Submit
C:\Windows\System\OYuePYs.exe

Filesize
1.9MB

MD5
469876be60515237a9d7d10112dc558c

SHA1
c01f72fb3ee0e817e0b5b7c75b43add87f2a3624

SHA256
3e96ee0b2715310165eb397c6686b3ac25cedcb8e2d8ea03a17998eb738bcbc6

SHA512
a56de258a65b6b300aba62b684e8fd27e37c7d6a7e31fe15a9cad7864e10aa396891a36b3a46ae9685585ed4f9205f43163c6038b7f3327bac2dcddf26074eb9

Download Submit
C:\Windows\System\PPJUlgz.exe

Filesize
1.9MB

MD5
cfbb6c24b225fe74336105d3a57fca2a

SHA1
3ba15a231feab441944e92d62ac3a3bb9396fc01

SHA256
105b00217dfc7673e9b37dc5cfacb36972ca93b028bfb8ca501af0757c184cfb

SHA512
415655b2d5c76e52aec179b8e4db025300dcb720d80e597f4b6e98389b989bdbe7194428c64acd6195c688ea86cc420c7c54cb69bbd0ce43716279f3123ffb80

Download Submit
C:\Windows\System\PUbPjgY.exe

Filesize
1.9MB

MD5
d55edc11257c167f22f2ea433a689cf8

SHA1
98dc764d11c0688b1a5eee368f7a32c4b759ce53

SHA256
d6700c8adc47018f119cb05af86aa33cbd9ee57d1709c633d9042aa807ebe35a

SHA512
bcb1cb189dd12ebbf2e69f785e4f2c039991bfadc9f49b4ea230392775bd7509783116527526697150b1d220e67df2ec1cc60b85b6e35b4b2f4e3b976759a50e

Download Submit
C:\Windows\System\TMmteDA.exe

Filesize
1.9MB

MD5
d290047d57d84295a2314f8e844bbe0a

SHA1
23d957434a2dec4c5bb542cbb0d07502dfdd350e

SHA256
6b7fb373eddd2dc85edef4da06694a82f2704ec828c050a9e61088c93ee6ae6d

SHA512
d63c1750c34d110f38f12ea90989812c49be693e44d127e8b613ec1be0c4f3cc1f0dacb5d1520bdd8ada85fa70cd9ab38badb5517c31156552cb7a3856f3fb51

Download Submit
C:\Windows\System\VXfQKLX.exe

Filesize
1.9MB

MD5
63f90c5e8b315707137df0e44c347bfd

SHA1
243e919c44ce960f67d4688ea0ada14c6552708b

SHA256
51707d37b6f3535286b92ac8e6a74dfb811fb3206aff639f235073a1ca25a1f6

SHA512
2a7bef06fe09fdf7ba0d401b0fde60a6e3e9a35be1a49df4ca7a67ae5217b66bcaf1a4b4280ae8836c9cd85e58d738d1cb234fe36ae4102c6afff00b56d9e819

Download Submit
C:\Windows\System\VlRmFbM.exe

Filesize
1.9MB

MD5
1e10f3bd1fd496398ea059ec3a106487

SHA1
af2cbd759b64c343af97c0529481b1f939b4b0e8

SHA256
d22f2ff34de031dee65b6e06ec61636fc6f9f3fe13c9ed2fcfb18528dbe8107f

SHA512
d7b7628f5cc483f79f5585834d71e9ed2e157f4d3b34c6d0141da2e1439e9145596f48330e8d54d9856390140150c1d4dd781366cba01c3228ff55a465fe6587

Download Submit
C:\Windows\System\WJEvPLZ.exe

Filesize
1.9MB

MD5
344cba418d747165916d4d5bc866fc2d

SHA1
f476a22c820aa8e21aad2af593153cae17a34de2

SHA256
c71dadbd4f502351ac867806a7487d6e5cc7c808d66a0d44a5c7f3fce6c5420f

SHA512
b3a83ebfd6d1cf90f2ffb82aa8db04b4d29ea2075a84567c1e053d10b7bd63118693a0fa391a1aa219a6dec777ba40b4331092147de497ba241b0d0cc7ed2a26

Download Submit
C:\Windows\System\WOYmlZo.exe

Filesize
1.9MB

MD5
519a80ac445e45fe6aadb2ab6352e733

SHA1
542ea72dcc307360bd93e450645ecffe7ea95033

SHA256
f9400e31ebb0ca28794e3bd087eb6959f0501685626df079607229bcf2f92e33

SHA512
2496ee254543661aef74b97ce724ab0af29df4503abd0b6e1bc563b346ac69aa381babcd11e023fa4dbccf5bdb830c7a4e3975a40cd7fa59c5f09646a215bdae

Download Submit
C:\Windows\System\WmKFbwZ.exe

Filesize
1.9MB

MD5
bce6965c7f33723a5251f7f52c5af24d

SHA1
ce84466bb04e56ae32c6ebb775a0190fdcfffa82

SHA256
bd4bd21a5cc1cde9a3152aaf112ee28a12a9708319b8f0051a643d8b0f69451a

SHA512
d20f27714e5920ce5e1921d2ea082ff4d4a40919b81f16b8c2f34a5e5e8ce966e4a61695832034ea4566c892c5f245f655485dcbcfd16b221446c3bf7f02d0f2

Download Submit
C:\Windows\System\cBmIIZN.exe

Filesize
1.9MB

MD5
2be4479d0880519063535ec86b5c62ee

SHA1
7cda61b51631a136c39e08e178053807c0371991

SHA256
02b243b0e2f328b90f77e5dfd0a4b60b8ee6f72dbb622ed6eeb6b3fc6c00a151

SHA512
69b9b02883663a01cc3b8ff1c8960f8be62767f351c6ad0c94f3b34b0fc238779678821a4427eb145f2026d5c0945d7924ae9ce8ed8284c4440cb17e16980523

Download Submit
C:\Windows\System\eQJmhGE.exe

Filesize
1.9MB

MD5
b253398209861c639f883bf6d5f1a9f1

SHA1
fae161933abeb561d0949499716eb9dc2ad8118f

SHA256
8ddfc8245a4f0672b7c5e292fed02a71150ef27f5ad9dcc3da2f6d0ae74d2fb3

SHA512
572ea5c4ce9e0eaf5e3ee29ba47f72501864efc940630f0eaaa25e6fd9bafd137911104fbc81f251221d62e042280886e80d3c9b40b46d3db183c7b9b24b7a21

Download Submit
C:\Windows\System\fZLsWld.exe

Filesize
1.9MB

MD5
5b5dd37b868f0b5410283f008fa74803

SHA1
6bdcf81e254a67276ce9aa09a23f9a099c376c74

SHA256
55e47fc5c437d75d8eccf0460533258cfd2e76e861b4f8eb88381f7c80a10da0

SHA512
f03440957dbf32383c9ecb08dd16f8258d9c1290bf5d3b86de2216bf6737fb6454fa22d427925468a5f15e6c161538153401792aff920451f2a9d75cff201162

Download Submit
C:\Windows\System\faYxozc.exe

Filesize
1.9MB

MD5
985c969f0b868f9a65b0bb64a5285baf

SHA1
4f91a9d991b692a687cb6df15fe05e2652ba350b

SHA256
9b87012d0018cbd3b8354e54deb690a6f7b33e460838b2d1de1be73a87774a49

SHA512
4f2137428cac57b5b96d919bd092758f38d718e742f87e491d88c34f874d28b606c4548779c05978a27fa74d3258e49b61aaf457067736db07b4e74a972cf2c0

Download Submit
C:\Windows\System\gDlrpnt.exe

Filesize
1.9MB

MD5
5459eea3315aa060f0b8929d957f3c0e

SHA1
3336aea1834a7bfe0d1804ed910dfdeddc6b80d4

SHA256
583c05bff743c16b979c55eac36ce115dd3cfa3165950d9bfac58d304e872d75

SHA512
ad21197cb860baa2abbc2fdaa5adbb89d2028e768500771150a5856a894a1bb3be3b908d3cc086fca96ddec2b95024ad9bae12e2b18b54088e48aa301ae82e91

Download Submit
C:\Windows\System\hJxFait.exe

Filesize
1.9MB

MD5
d167ea2f9cb77efeb8bef101506d0176

SHA1
a145c8a26615f1d72b6e2c7d4cbf388d5509a2d1

SHA256
d57b7df7374437e6f314dfcf38fafa91e042d253d42d1ce1172ef37e76d409e2

SHA512
e87c19da10c9acbd550b380bf938529ba5be9195f8e72fec45cd7b6775d136a7a43eb28ef10c6ca8288c65f88ade669cf681adb7d1852083a109631c5fcb3401

Download Submit
C:\Windows\System\kpOUhyW.exe

Filesize
1.9MB

MD5
ee3fe74d373ffc3deab7b52c47dae8fd

SHA1
6eb9065027c58c7f5ba4b3478a237b88de4f0479

SHA256
1c2969b2a19c3c16e67f2ede434f6dfd0927a629f5d8f5aa305f03ff7678d7ab

SHA512
8a93b444c1b79e3dd852a182ee41a04e36304e6c571724a56030bd1753133c321cc4019a65183aa88e6b70386aa6b8651a8d0bbd2f90d2e9c80a2e4aab76c3ef

Download Submit
C:\Windows\System\lNBULVF.exe

Filesize
1.9MB

MD5
7151ff3cd850f226fba2f59b27267ff9

SHA1
8083b96baf69a07bb8fe9557e19ab6e999115cab

SHA256
926a5bc83fdc6a2eb84ad89ea5e911090faaf0452222388a7b721d8a3d3cf971

SHA512
8a9ced388b59368ead50ba6790e5250bbb9b7c111a5df1d941b7fa653ae20b6c4e05d93c7b2f4a427c15377af622e531943b7709b2d2de75ad21852648e8a3c1

Download Submit
C:\Windows\System\mwYVytT.exe

Filesize
1.9MB

MD5
40a35a5f17270ce9975d90897d75331a

SHA1
06c7e70804226381a252cafd6cf1826edec84963

SHA256
e06b25c49e1e00cc7dd95fdbe90aa9d83e1bd40b93634e727c1b4680454d3505

SHA512
a97307a9c3743d36c3c5a037d467ae6f83198169d0e09586478f6f23be42eed2f350e541cc56d5c6f73a39f7582924c212b114120074bbb163e944f40fab49e4

Download Submit
C:\Windows\System\nwNMCEz.exe

Filesize
1.9MB

MD5
3ed4baf2415146f7a6cc0ec285a03ba5

SHA1
f0d44dcc0dc15c0da5629cd43b5372a45b7f4359

SHA256
fb9b0205d9477346dba9c91cda32e3f1347eeffbb718a28cdbda9e78e5e01610

SHA512
2b6a69d6b002c1a03dda2b0a6738d63d07e084e6502d2e7b5e0432e581226b86bdcf5005b9648f3f09f46044b6d216ccdcd06f2c8ec1095b3a211e7f86494479

Download Submit
C:\Windows\System\oYeDCZR.exe

Filesize
1.9MB

MD5
f448cd91492ceec62948609ee2c82bb5

SHA1
4adb85a0477d05e379e94507a30934322e6f68c4

SHA256
989e760d2e3f329af494f1202ff3a157d995a97007102465c6663dfcdbcbc995

SHA512
afa146118d411242664c5b3b034f627e120b519680e7e9035979759d90b25c1b6f46dd9a3da816616d8151c63bb9017b2c3f1dfefd43ce009b6a39afe466e0f0

Download Submit
C:\Windows\System\oiCzDcP.exe

Filesize
1.9MB

MD5
3a177c7992bb39da6d20528783e6a5c1

SHA1
0f32322525c84df4883c2e5107a327482da7b169

SHA256
4bf7a39924c1d658538f4acb9dda20fddfde61ae55cbfa235398ed94effe1c59

SHA512
eaf0dce670766369af35612cfc0c142db8a75a85349117fdc582c235648da563cf82ec4ab1365248634aed29e2df0b29d0f35bd0d9dd943b6af9d141fa80ec53

Download Submit
C:\Windows\System\qQJOTcF.exe

Filesize
1.9MB

MD5
90ee1bfd999871ff292dbbdc3d93c2fd

SHA1
9b3aaf7383b40c7aeddaf2cc360535d09bdbc619

SHA256
cb460953abf07f50e64bee866cef0c9f2635a69abe1f8cbd5b454fdeb1a3cbc6

SHA512
416f248c3918bd5a75e0b3544b4deeb037b0cdd229f1fe2e3598beb357287fb932424fa68c9cd018ba05a25d27cf4e5c74bba500c8e0a1aa56815e3ff8645a13

Download Submit
C:\Windows\System\ruEeuwG.exe

Filesize
1.9MB

MD5
0b7bc896b032a2c00b80d82e33e86c3e

SHA1
71ad4af2bf882d2ecf2856014c53b08e1f3f601e

SHA256
3148cde1b651865eb1f98c2b819f25716c3113020ef9803a45c33518e346d8fb

SHA512
cb95c7a7a37f960c169eb69258b9add3180fe48db44ae39b58c17aa486c017373fb328e85bd50790174577256ccef9b1bc96bdfd55987e864007ceea6af0a411

Download Submit
C:\Windows\System\sGlAjdr.exe

Filesize
1.9MB

MD5
e91399a4060d0e2a3db4f44d965716bf

SHA1
b22dda51afb675708702e8b9bba8060bf8af59ba

SHA256
ffcbe4a0b72fad445a532680306ac6897d154c946294dc004d518145ac21ba64

SHA512
a97390818b06dca3631678b37b67a13ae445927399200f0df3715306a6658d1cebaad51b5349abb9813e1a480b797a1ea99100ed126b74b15c01f9409cff9045

Download Submit
C:\Windows\System\uKHexzA.exe

Filesize
1.9MB

MD5
c9ea1233e4e1797a06da27a1fe09c876

SHA1
221dd97a52d2c2f915426d309f155b284f08f84a

SHA256
bef446a2122f39d36559006765c14894f47c62d2b00903a659d91e0c012413e8

SHA512
ce1208fd018dc3cbaa141c1f235a96395299ff3c69924ad4eaed1634403b0ca014b7c0f9dcda3b6703f732c1c2fc7aab85848e81706490b70b9e255d42bab5c6

Download Submit
C:\Windows\System\uruRcoj.exe

Filesize
1.9MB

MD5
8ae8e09ee77286f7d1913f0e77e21363

SHA1
e43718713d8e786e280443c18fdf0a9f11610da4

SHA256
c63756fc19b007758071474284a8b79d92d37933de7f705493c5e1a72584223f

SHA512
d85f33ebb1439bcfbb4f3e1d3255a1f0c4fd62db8f4dfa1c74dd11d95254c3551c25c1663e2bcd36efa7fae4a437736abf1b2f15cd3a2ba4c6216f0bafc0cccd

Download Submit
C:\Windows\System\vKttIRj.exe

Filesize
1.9MB

MD5
ac45dc0dc46316c3cb5f349ee349127d

SHA1
7721b43b1a20a40aaff0dd8554a668431aebb5f0

SHA256
911890422c18986f0b9d649a4b4774f6e96030270f4636744a0fd3603e0bd60c

SHA512
effcfaff18c60de5464e219a8d46711502c72a324386140fb1418db65952d87289832b131405797d923b65c0bce8b03d8b3e342c86c7cd6ae01149c11ed69594

Download Submit
C:\Windows\System\wtnwhJf.exe

Filesize
1.9MB

MD5
d992758998fb6ebb127fffed4e0c25a5

SHA1
b56f649b28b9af776cb39a8b23da14f1d4af301b

SHA256
87de5818a340b5bf559073b6f50da32457b62569cb65093cabdfda0254e1d095

SHA512
f4b58eb9f21714ca709507ddd7e4532654826507fa494df9f707425eac7cdeb830df6b29926212d6886f087cd0dd65f09a73fa6d40d313c5a4e4d0dae7f0ee8e

Download Submit
C:\Windows\System\ykcGkKh.exe

Filesize
1.9MB

MD5
5480e43021b43126cfc51cf3e8d83fdb

SHA1
9333790a880d7227cb4049eb656b5e80fd1d7ddb

SHA256
ce632544c6bb3a86e1857022856c1eddfa815b85cb770445c8758c264b4597fe

SHA512
a82d8864da68c63f43128670306627d1e3f83bf780b613c29a018d59e502bb08f43561052f34be841295062a33cac9c3d04c097cca6e0adec344bf05bf6c34eb

Download Submit
C:\Windows\System\zSzHVgN.exe

Filesize
1.9MB

MD5
e2932c0cf6a2a79a64e8d5130eead082

SHA1
986cf105fb077c2409301a97cd614c1395d8212d

SHA256
775e34099050cdfd242561d78db7e6f01ac90e44b0b9d079036afe74ea82290d

SHA512
6c54fc5f1669b5774e323f9a1b8149c1bd1617d456d532b05890e9a4e75fe47af84c97dd99175ac6479182a10320b792039df77495fea8e6d10bc2ea2dae17b5

Download Submit
memory/232-5121-0x00007FF7B1800000-0x00007FF7B1BF2000-memory.dmp

Filesize
3.9MB

Download
memory/232-202-0x00007FF7B1800000-0x00007FF7B1BF2000-memory.dmp

Filesize
3.9MB

Download
memory/908-1-0x00000295BC700000-0x00000295BC710000-memory.dmp

Filesize
64KB

Download
memory/908-0-0x00007FF6F69F0000-0x00007FF6F6DE2000-memory.dmp

Filesize
3.9MB

Download
memory/1856-5154-0x00007FF61F520000-0x00007FF61F912000-memory.dmp

Filesize
3.9MB

Download
memory/1856-595-0x00007FF61F520000-0x00007FF61F912000-memory.dmp

Filesize
3.9MB

Download
memory/1996-601-0x00007FF625420000-0x00007FF625812000-memory.dmp

Filesize
3.9MB

Download
memory/1996-5177-0x00007FF625420000-0x00007FF625812000-memory.dmp

Filesize
3.9MB

Download
memory/2484-376-0x00007FF77EC80000-0x00007FF77F072000-memory.dmp

Filesize
3.9MB

Download
memory/2656-4975-0x00007FF772A10000-0x00007FF772E02000-memory.dmp

Filesize
3.9MB

Download
memory/2656-258-0x00007FF772A10000-0x00007FF772E02000-memory.dmp

Filesize
3.9MB

Download
memory/2804-536-0x00007FF7EFE10000-0x00007FF7F0202000-memory.dmp

Filesize
3.9MB

Download
memory/2804-5031-0x00007FF7EFE10000-0x00007FF7F0202000-memory.dmp

Filesize
3.9MB

Download
memory/3248-5145-0x00007FF674090000-0x00007FF674482000-memory.dmp

Filesize
3.9MB

Download
memory/3248-593-0x00007FF674090000-0x00007FF674482000-memory.dmp

Filesize
3.9MB

Download
memory/3252-596-0x00007FF6A76E0000-0x00007FF6A7AD2000-memory.dmp

Filesize
3.9MB

Download
memory/3252-5150-0x00007FF6A76E0000-0x00007FF6A7AD2000-memory.dmp

Filesize
3.9MB

Download
memory/3488-147-0x00007FF6BBA90000-0x00007FF6BBE82000-memory.dmp

Filesize
3.9MB

Download
memory/3588-59-0x00007FFE009D0000-0x00007FFE01491000-memory.dmp

Filesize
10.8MB

Download
memory/3588-62-0x000001B8461D0000-0x000001B8461E0000-memory.dmp

Filesize
64KB

Download
memory/3588-512-0x000001B846140000-0x000001B846162000-memory.dmp

Filesize
136KB

Download
memory/3600-5124-0x00007FF6BB990000-0x00007FF6BBD82000-memory.dmp

Filesize
3.9MB

Download
memory/3600-600-0x00007FF6BB990000-0x00007FF6BBD82000-memory.dmp

Filesize
3.9MB

Download
memory/3904-592-0x00007FF6D9FF0000-0x00007FF6DA3E2000-memory.dmp

Filesize
3.9MB

Download
memory/3904-5133-0x00007FF6D9FF0000-0x00007FF6DA3E2000-memory.dmp

Filesize
3.9MB

Download
memory/3952-5147-0x00007FF7C6DE0000-0x00007FF7C71D2000-memory.dmp

Filesize
3.9MB

Download
memory/3952-594-0x00007FF7C6DE0000-0x00007FF7C71D2000-memory.dmp

Filesize
3.9MB

Download
memory/4256-5151-0x00007FF6FDE90000-0x00007FF6FE282000-memory.dmp

Filesize
3.9MB

Download
memory/4256-375-0x00007FF6FDE90000-0x00007FF6FE282000-memory.dmp

Filesize
3.9MB

Download
memory/4392-94-0x00007FF6D0240000-0x00007FF6D0632000-memory.dmp

Filesize
3.9MB

Download
memory/4488-308-0x00007FF661280000-0x00007FF661672000-memory.dmp

Filesize
3.9MB

Download
memory/4548-5173-0x00007FF6C0CA0000-0x00007FF6C1092000-memory.dmp

Filesize
3.9MB

Download
memory/4548-591-0x00007FF6C0CA0000-0x00007FF6C1092000-memory.dmp

Filesize
3.9MB

Download
memory/4556-450-0x00007FF7A95A0000-0x00007FF7A9992000-memory.dmp

Filesize
3.9MB

Download
memory/4600-5142-0x00007FF701480000-0x00007FF701872000-memory.dmp

Filesize
3.9MB

Download
memory/4600-598-0x00007FF701480000-0x00007FF701872000-memory.dmp

Filesize
3.9MB

Download
memory/4852-5062-0x00007FF7E0470000-0x00007FF7E0862000-memory.dmp

Filesize
3.9MB

Download
memory/4852-255-0x00007FF7E0470000-0x00007FF7E0862000-memory.dmp

Filesize
3.9MB

Download
memory/4948-5183-0x00007FF67FE70000-0x00007FF680262000-memory.dmp

Filesize
3.9MB

Download
memory/4948-597-0x00007FF67FE70000-0x00007FF680262000-memory.dmp

Filesize
3.9MB

Download
memory/5016-599-0x00007FF62CAF0000-0x00007FF62CEE2000-memory.dmp

Filesize
3.9MB

Download