xmrig | db0c74fbc19c487a5e3b3c0df08d36e5f3d3c262ddd828d4671fcb14aed335ce

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
Size

1.8MB
MD5

017953679d5dc3716b0bfe4b2577a9a4
SHA1

6650fd71039fc7beef5e8e0bb9db2163ff8ce88e
SHA256

db0c74fbc19c487a5e3b3c0df08d36e5f3d3c262ddd828d4671fcb14aed335ce
SHA512

b8b9aa5274a079ebe8cfb8fad5513267a17d359e12860b8790ada054d8536f1ef57f7f6f60ec62ce05fdb194400c171ea377189c79e2c36c892c997b9a8815a0
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrI5A:NAB6

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 27 IoCs

miner

resource	yara_rule
behavioral2/memory/1044-471-0x00007FF729CE0000-0x00007FF72A0D2000-memory.dmp	xmrig
behavioral2/memory/3272-470-0x00007FF677F70000-0x00007FF678362000-memory.dmp	xmrig
behavioral2/memory/2036-472-0x00007FF7B03E0000-0x00007FF7B07D2000-memory.dmp	xmrig
behavioral2/memory/1488-473-0x00007FF703080000-0x00007FF703472000-memory.dmp	xmrig
behavioral2/memory/4848-42-0x00007FF749AF0000-0x00007FF749EE2000-memory.dmp	xmrig
behavioral2/memory/4400-37-0x00007FF645170000-0x00007FF645562000-memory.dmp	xmrig
behavioral2/memory/3004-34-0x00007FF7D5440000-0x00007FF7D5832000-memory.dmp	xmrig
behavioral2/memory/888-32-0x00007FF7EAF60000-0x00007FF7EB352000-memory.dmp	xmrig
behavioral2/memory/1344-474-0x00007FF607190000-0x00007FF607582000-memory.dmp	xmrig
behavioral2/memory/4252-475-0x00007FF6417E0000-0x00007FF641BD2000-memory.dmp	xmrig
behavioral2/memory/2392-476-0x00007FF79A320000-0x00007FF79A712000-memory.dmp	xmrig
behavioral2/memory/2300-486-0x00007FF6C4960000-0x00007FF6C4D52000-memory.dmp	xmrig
behavioral2/memory/3584-483-0x00007FF7FED70000-0x00007FF7FF162000-memory.dmp	xmrig
behavioral2/memory/4904-492-0x00007FF7FB9E0000-0x00007FF7FBDD2000-memory.dmp	xmrig
behavioral2/memory/3824-497-0x00007FF76F100000-0x00007FF76F4F2000-memory.dmp	xmrig
behavioral2/memory/4728-502-0x00007FF6A4290000-0x00007FF6A4682000-memory.dmp	xmrig
behavioral2/memory/4504-510-0x00007FF6014B0000-0x00007FF6018A2000-memory.dmp	xmrig
behavioral2/memory/2400-516-0x00007FF754540000-0x00007FF754932000-memory.dmp	xmrig
behavioral2/memory/2640-526-0x00007FF605E30000-0x00007FF606222000-memory.dmp	xmrig
behavioral2/memory/1476-532-0x00007FF73B260000-0x00007FF73B652000-memory.dmp	xmrig
behavioral2/memory/4860-4631-0x00007FF6CAA30000-0x00007FF6CAE22000-memory.dmp	xmrig
behavioral2/memory/2036-6504-0x00007FF7B03E0000-0x00007FF7B07D2000-memory.dmp	xmrig
behavioral2/memory/2392-6606-0x00007FF79A320000-0x00007FF79A712000-memory.dmp	xmrig
behavioral2/memory/3824-6620-0x00007FF76F100000-0x00007FF76F4F2000-memory.dmp	xmrig
behavioral2/memory/4728-6641-0x00007FF6A4290000-0x00007FF6A4682000-memory.dmp	xmrig
behavioral2/memory/4504-6654-0x00007FF6014B0000-0x00007FF6018A2000-memory.dmp	xmrig
behavioral2/memory/2400-6668-0x00007FF754540000-0x00007FF754932000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4400	xSPKOfT.exe
888	eOXkBCi.exe
3004	WKPsrsx.exe
4848	LivKGKV.exe
4860	riFpPos.exe
3272	XAwLhjV.exe
1476	ueZXvZg.exe
1044	ntpAAsS.exe
2036	eptYKtw.exe
1488	vdCjNNa.exe
1344	ZacXWed.exe
4252	ZgdQETz.exe
2392	MCQNuVt.exe
3584	FkXnGFm.exe
2300	QNOQUod.exe
4904	ChhcWAJ.exe
3824	JQuoVmq.exe
4728	EfJqDSE.exe
4504	VfkSDGn.exe
2400	TIkgpBS.exe
2640	YLhNVUA.exe
4592	bRnFCem.exe
2396	YStfCuF.exe
4432	vrvHidS.exe
1144	CpkZrgC.exe
1644	HzMUbUT.exe
3016	LvaUNyS.exe
900	PXzwiyx.exe
2312	mBkNJXS.exe
1952	rJSDSdn.exe
968	FkgQFuO.exe
1884	EYhMPHv.exe
2372	zcLFkhF.exe
1040	jQcVqAY.exe
4060	cKMvRXn.exe
2904	MXasYya.exe
3028	xJFRrRk.exe
1984	tYCdCIn.exe
1004	qdHqNOv.exe
2604	WaWpHCv.exe
4052	zAASHyG.exe
3364	DLYzfQr.exe
3448	uSQHdHs.exe
4304	sqlnsLG.exe
452	tIiIeKn.exe
2120	fMmCWoG.exe
2828	ZBhzDLn.exe
1208	soOvreI.exe
2948	CDwqyEU.exe
1236	gdSKMSs.exe
3312	HPLYxpF.exe
4072	rqWUaKM.exe
4844	CxbLhQM.exe
3424	PaHYtuM.exe
1928	peToBPj.exe
3652	cYFsHzJ.exe
976	dzOzzUt.exe
1332	CDiZtgH.exe
3108	bWvKMsc.exe
1420	hEVvllN.exe
3924	uObftET.exe
3472	mmOHstZ.exe
876	ESBVScF.exe
1980	CaLlNni.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4776-0-0x00007FF713CF0000-0x00007FF7140E2000-memory.dmp	upx
behavioral2/files/0x000b000000023bb1-5.dat	upx
behavioral2/files/0x0031000000023bb6-7.dat	upx
behavioral2/files/0x0031000000023bb7-33.dat	upx
behavioral2/files/0x000b000000023bb9-40.dat	upx
behavioral2/files/0x0032000000023bb8-53.dat	upx
behavioral2/files/0x000a000000023bbb-58.dat	upx
behavioral2/files/0x000a000000023bbc-64.dat	upx
behavioral2/files/0x000a000000023bbe-73.dat	upx
behavioral2/files/0x000a000000023bbf-81.dat	upx
behavioral2/files/0x000a000000023bc3-96.dat	upx
behavioral2/files/0x000a000000023bc4-103.dat	upx
behavioral2/files/0x000a000000023bc5-111.dat	upx
behavioral2/files/0x000a000000023bc7-122.dat	upx
behavioral2/files/0x000a000000023bd4-181.dat	upx
behavioral2/memory/1044-471-0x00007FF729CE0000-0x00007FF72A0D2000-memory.dmp	upx
behavioral2/memory/3272-470-0x00007FF677F70000-0x00007FF678362000-memory.dmp	upx
behavioral2/memory/2036-472-0x00007FF7B03E0000-0x00007FF7B07D2000-memory.dmp	upx
behavioral2/memory/1488-473-0x00007FF703080000-0x00007FF703472000-memory.dmp	upx
behavioral2/files/0x000a000000023bd3-178.dat	upx
behavioral2/files/0x000a000000023bd2-176.dat	upx
behavioral2/files/0x000a000000023bd1-172.dat	upx
behavioral2/files/0x000a000000023bd0-167.dat	upx
behavioral2/files/0x000a000000023bcf-162.dat	upx
behavioral2/files/0x000a000000023bce-157.dat	upx
behavioral2/files/0x000a000000023bcd-152.dat	upx
behavioral2/files/0x000a000000023bcc-146.dat	upx
behavioral2/files/0x000a000000023bcb-142.dat	upx
behavioral2/files/0x000a000000023bca-137.dat	upx
behavioral2/files/0x000a000000023bc9-132.dat	upx
behavioral2/files/0x000a000000023bc8-126.dat	upx
behavioral2/files/0x000a000000023bc6-117.dat	upx
behavioral2/files/0x000a000000023bc2-97.dat	upx
behavioral2/files/0x000a000000023bc1-91.dat	upx
behavioral2/files/0x000a000000023bc0-87.dat	upx
behavioral2/files/0x000a000000023bbd-69.dat	upx
behavioral2/files/0x000a000000023bba-51.dat	upx
behavioral2/memory/4860-47-0x00007FF6CAA30000-0x00007FF6CAE22000-memory.dmp	upx
behavioral2/memory/4848-42-0x00007FF749AF0000-0x00007FF749EE2000-memory.dmp	upx
behavioral2/memory/4400-37-0x00007FF645170000-0x00007FF645562000-memory.dmp	upx
behavioral2/memory/3004-34-0x00007FF7D5440000-0x00007FF7D5832000-memory.dmp	upx
behavioral2/memory/888-32-0x00007FF7EAF60000-0x00007FF7EB352000-memory.dmp	upx
behavioral2/files/0x000a000000023bb5-14.dat	upx
behavioral2/memory/1344-474-0x00007FF607190000-0x00007FF607582000-memory.dmp	upx
behavioral2/memory/4252-475-0x00007FF6417E0000-0x00007FF641BD2000-memory.dmp	upx
behavioral2/memory/2392-476-0x00007FF79A320000-0x00007FF79A712000-memory.dmp	upx
behavioral2/memory/2300-486-0x00007FF6C4960000-0x00007FF6C4D52000-memory.dmp	upx
behavioral2/memory/3584-483-0x00007FF7FED70000-0x00007FF7FF162000-memory.dmp	upx
behavioral2/memory/4904-492-0x00007FF7FB9E0000-0x00007FF7FBDD2000-memory.dmp	upx
behavioral2/memory/3824-497-0x00007FF76F100000-0x00007FF76F4F2000-memory.dmp	upx
behavioral2/memory/4728-502-0x00007FF6A4290000-0x00007FF6A4682000-memory.dmp	upx
behavioral2/memory/4504-510-0x00007FF6014B0000-0x00007FF6018A2000-memory.dmp	upx
behavioral2/memory/2400-516-0x00007FF754540000-0x00007FF754932000-memory.dmp	upx
behavioral2/memory/2640-526-0x00007FF605E30000-0x00007FF606222000-memory.dmp	upx
behavioral2/memory/1476-532-0x00007FF73B260000-0x00007FF73B652000-memory.dmp	upx
behavioral2/memory/4860-4631-0x00007FF6CAA30000-0x00007FF6CAE22000-memory.dmp	upx
behavioral2/memory/2036-6504-0x00007FF7B03E0000-0x00007FF7B07D2000-memory.dmp	upx
behavioral2/memory/2392-6606-0x00007FF79A320000-0x00007FF79A712000-memory.dmp	upx
behavioral2/memory/3824-6620-0x00007FF76F100000-0x00007FF76F4F2000-memory.dmp	upx
behavioral2/memory/4728-6641-0x00007FF6A4290000-0x00007FF6A4682000-memory.dmp	upx
behavioral2/memory/4504-6654-0x00007FF6014B0000-0x00007FF6018A2000-memory.dmp	upx
behavioral2/memory/2400-6668-0x00007FF754540000-0x00007FF754932000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QkXrkeR.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\iWKkVpV.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\yskwKya.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\rFRtUfX.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\kpBoVQL.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\HLSmwHy.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\QzQUSSb.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\IsNxehK.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\bkjumTX.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\gYamTcW.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\BgRSDdC.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\BtpJnSl.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\KeImTOI.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\LmJgPKy.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\CGILBvy.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\XyTTuQf.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\DYKSexy.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\XQUIapl.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\RRIBJNu.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\hNlzALV.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\TkMpMse.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\sWNsPqz.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\PypWuvn.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\YUzfjUx.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\wZWBTsu.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\QkQckfY.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\EcbgGsO.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\ZqzRabZ.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\uBgvHYn.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\SAhAUaS.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\TMFGhXr.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\nWiWJFU.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\niKEnEQ.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\dMWZfWD.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\jCSFgyd.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\lAkWlJV.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\hdQMxHG.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\jAxOKbu.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\DljMrtN.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\WhhNonH.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\VGIHmEg.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\AVVWNHT.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\TKgehaP.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\aLBCwCR.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\CdEEwHV.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\kBsxuJP.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\AaqKOfA.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\wblxSBL.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\kKjDOXx.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\YMbPYmY.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\QtFLpdh.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\fihcnWG.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\GNRMdnk.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\FcGYNnW.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\LnAZoYm.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\REoSJsE.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\lKJxfWE.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\DLYPZkL.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\DbYFqUf.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\ZlTKtYQ.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\sYZxmPv.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\jrkYgBY.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\YxnbrWL.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\OWWjHrb.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1356	powershell.exe
1356	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
Token: SeDebugPrivilege	1356	powershell.exe
Token: SeLockMemoryPrivilege	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 1356	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	85
PID 4776 wrote to memory of 1356	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	85
PID 4776 wrote to memory of 4400	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	86
PID 4776 wrote to memory of 4400	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	86
PID 4776 wrote to memory of 888	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	87
PID 4776 wrote to memory of 888	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	87
PID 4776 wrote to memory of 3004	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	88
PID 4776 wrote to memory of 3004	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	88
PID 4776 wrote to memory of 4848	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	89
PID 4776 wrote to memory of 4848	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	89
PID 4776 wrote to memory of 4860	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	90
PID 4776 wrote to memory of 4860	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	90
PID 4776 wrote to memory of 3272	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	91
PID 4776 wrote to memory of 3272	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	91
PID 4776 wrote to memory of 1476	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	92
PID 4776 wrote to memory of 1476	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	92
PID 4776 wrote to memory of 1044	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	93
PID 4776 wrote to memory of 1044	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	93
PID 4776 wrote to memory of 2036	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	94
PID 4776 wrote to memory of 2036	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	94
PID 4776 wrote to memory of 1488	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	95
PID 4776 wrote to memory of 1488	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	95
PID 4776 wrote to memory of 1344	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	96
PID 4776 wrote to memory of 1344	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	96
PID 4776 wrote to memory of 4252	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	97
PID 4776 wrote to memory of 4252	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	97
PID 4776 wrote to memory of 2392	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	98
PID 4776 wrote to memory of 2392	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	98
PID 4776 wrote to memory of 3584	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	99
PID 4776 wrote to memory of 3584	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	99
PID 4776 wrote to memory of 2300	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	100
PID 4776 wrote to memory of 2300	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	100
PID 4776 wrote to memory of 4904	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	101
PID 4776 wrote to memory of 4904	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	101
PID 4776 wrote to memory of 3824	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	102
PID 4776 wrote to memory of 3824	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	102
PID 4776 wrote to memory of 4728	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	103
PID 4776 wrote to memory of 4728	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	103
PID 4776 wrote to memory of 4504	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	104
PID 4776 wrote to memory of 4504	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	104
PID 4776 wrote to memory of 2400	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	105
PID 4776 wrote to memory of 2400	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	105
PID 4776 wrote to memory of 2640	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	106
PID 4776 wrote to memory of 2640	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	106
PID 4776 wrote to memory of 4592	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	107
PID 4776 wrote to memory of 4592	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	107
PID 4776 wrote to memory of 2396	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	108
PID 4776 wrote to memory of 2396	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	108
PID 4776 wrote to memory of 4432	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	109
PID 4776 wrote to memory of 4432	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	109
PID 4776 wrote to memory of 1144	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	110
PID 4776 wrote to memory of 1144	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	110
PID 4776 wrote to memory of 1644	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	111
PID 4776 wrote to memory of 1644	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	111
PID 4776 wrote to memory of 3016	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	112
PID 4776 wrote to memory of 3016	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	112
PID 4776 wrote to memory of 900	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	113
PID 4776 wrote to memory of 900	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	113
PID 4776 wrote to memory of 2312	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	114
PID 4776 wrote to memory of 2312	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	114
PID 4776 wrote to memory of 1952	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	115
PID 4776 wrote to memory of 1952	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	115
PID 4776 wrote to memory of 968	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	116
PID 4776 wrote to memory of 968	4776	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1356
- C:\Windows\System\xSPKOfT.exe
  C:\Windows\System\xSPKOfT.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\eOXkBCi.exe
  C:\Windows\System\eOXkBCi.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\WKPsrsx.exe
  C:\Windows\System\WKPsrsx.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\LivKGKV.exe
  C:\Windows\System\LivKGKV.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\riFpPos.exe
  C:\Windows\System\riFpPos.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\XAwLhjV.exe
  C:\Windows\System\XAwLhjV.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\ueZXvZg.exe
  C:\Windows\System\ueZXvZg.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\ntpAAsS.exe
  C:\Windows\System\ntpAAsS.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\eptYKtw.exe
  C:\Windows\System\eptYKtw.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\vdCjNNa.exe
  C:\Windows\System\vdCjNNa.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\ZacXWed.exe
  C:\Windows\System\ZacXWed.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\ZgdQETz.exe
  C:\Windows\System\ZgdQETz.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\MCQNuVt.exe
  C:\Windows\System\MCQNuVt.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\FkXnGFm.exe
  C:\Windows\System\FkXnGFm.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\QNOQUod.exe
  C:\Windows\System\QNOQUod.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\ChhcWAJ.exe
  C:\Windows\System\ChhcWAJ.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\JQuoVmq.exe
  C:\Windows\System\JQuoVmq.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\EfJqDSE.exe
  C:\Windows\System\EfJqDSE.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\VfkSDGn.exe
  C:\Windows\System\VfkSDGn.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\TIkgpBS.exe
  C:\Windows\System\TIkgpBS.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\YLhNVUA.exe
  C:\Windows\System\YLhNVUA.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\bRnFCem.exe
  C:\Windows\System\bRnFCem.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\YStfCuF.exe
  C:\Windows\System\YStfCuF.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\vrvHidS.exe
  C:\Windows\System\vrvHidS.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\CpkZrgC.exe
  C:\Windows\System\CpkZrgC.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\HzMUbUT.exe
  C:\Windows\System\HzMUbUT.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\LvaUNyS.exe
  C:\Windows\System\LvaUNyS.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\PXzwiyx.exe
  C:\Windows\System\PXzwiyx.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\mBkNJXS.exe
  C:\Windows\System\mBkNJXS.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\rJSDSdn.exe
  C:\Windows\System\rJSDSdn.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\FkgQFuO.exe
  C:\Windows\System\FkgQFuO.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\EYhMPHv.exe
  C:\Windows\System\EYhMPHv.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\zcLFkhF.exe
  C:\Windows\System\zcLFkhF.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\jQcVqAY.exe
  C:\Windows\System\jQcVqAY.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\cKMvRXn.exe
  C:\Windows\System\cKMvRXn.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\MXasYya.exe
  C:\Windows\System\MXasYya.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\xJFRrRk.exe
  C:\Windows\System\xJFRrRk.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\tYCdCIn.exe
  C:\Windows\System\tYCdCIn.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\qdHqNOv.exe
  C:\Windows\System\qdHqNOv.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\WaWpHCv.exe
  C:\Windows\System\WaWpHCv.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\zAASHyG.exe
  C:\Windows\System\zAASHyG.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\DLYzfQr.exe
  C:\Windows\System\DLYzfQr.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\uSQHdHs.exe
  C:\Windows\System\uSQHdHs.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\sqlnsLG.exe
  C:\Windows\System\sqlnsLG.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\tIiIeKn.exe
  C:\Windows\System\tIiIeKn.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\fMmCWoG.exe
  C:\Windows\System\fMmCWoG.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\ZBhzDLn.exe
  C:\Windows\System\ZBhzDLn.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\soOvreI.exe
  C:\Windows\System\soOvreI.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\CDwqyEU.exe
  C:\Windows\System\CDwqyEU.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\gdSKMSs.exe
  C:\Windows\System\gdSKMSs.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\HPLYxpF.exe
  C:\Windows\System\HPLYxpF.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\rqWUaKM.exe
  C:\Windows\System\rqWUaKM.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\CxbLhQM.exe
  C:\Windows\System\CxbLhQM.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\PaHYtuM.exe
  C:\Windows\System\PaHYtuM.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\peToBPj.exe
  C:\Windows\System\peToBPj.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\cYFsHzJ.exe
  C:\Windows\System\cYFsHzJ.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\dzOzzUt.exe
  C:\Windows\System\dzOzzUt.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\CDiZtgH.exe
  C:\Windows\System\CDiZtgH.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\bWvKMsc.exe
  C:\Windows\System\bWvKMsc.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\hEVvllN.exe
  C:\Windows\System\hEVvllN.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\uObftET.exe
  C:\Windows\System\uObftET.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\mmOHstZ.exe
  C:\Windows\System\mmOHstZ.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\ESBVScF.exe
  C:\Windows\System\ESBVScF.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\CaLlNni.exe
  C:\Windows\System\CaLlNni.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\ThQChTV.exe
  C:\Windows\System\ThQChTV.exe
  2⤵
  PID:532
- C:\Windows\System\XbqFeNb.exe
  C:\Windows\System\XbqFeNb.exe
  2⤵
  PID:2672
- C:\Windows\System\wzoBbcO.exe
  C:\Windows\System\wzoBbcO.exe
  2⤵
  PID:4368
- C:\Windows\System\fCWGnvI.exe
  C:\Windows\System\fCWGnvI.exe
  2⤵
  PID:4968
- C:\Windows\System\obliZAt.exe
  C:\Windows\System\obliZAt.exe
  2⤵
  PID:3508
- C:\Windows\System\kzWPIBC.exe
  C:\Windows\System\kzWPIBC.exe
  2⤵
  PID:4544
- C:\Windows\System\zMddQik.exe
  C:\Windows\System\zMddQik.exe
  2⤵
  PID:2276
- C:\Windows\System\EujQLmn.exe
  C:\Windows\System\EujQLmn.exe
  2⤵
  PID:3220
- C:\Windows\System\muJpAaI.exe
  C:\Windows\System\muJpAaI.exe
  2⤵
  PID:4344
- C:\Windows\System\DDISlcs.exe
  C:\Windows\System\DDISlcs.exe
  2⤵
  PID:556
- C:\Windows\System\gSVJqqE.exe
  C:\Windows\System\gSVJqqE.exe
  2⤵
  PID:852
- C:\Windows\System\gJdIZEK.exe
  C:\Windows\System\gJdIZEK.exe
  2⤵
  PID:1312
- C:\Windows\System\AWaaSXX.exe
  C:\Windows\System\AWaaSXX.exe
  2⤵
  PID:1260
- C:\Windows\System\YHXmrOZ.exe
  C:\Windows\System\YHXmrOZ.exe
  2⤵
  PID:5128
- C:\Windows\System\ZqTYqgR.exe
  C:\Windows\System\ZqTYqgR.exe
  2⤵
  PID:5152
- C:\Windows\System\ZolvAAy.exe
  C:\Windows\System\ZolvAAy.exe
  2⤵
  PID:5184
- C:\Windows\System\WndCLIC.exe
  C:\Windows\System\WndCLIC.exe
  2⤵
  PID:5212
- C:\Windows\System\xarjhhA.exe
  C:\Windows\System\xarjhhA.exe
  2⤵
  PID:5240
- C:\Windows\System\hvFMJdq.exe
  C:\Windows\System\hvFMJdq.exe
  2⤵
  PID:5272
- C:\Windows\System\IJnsQVF.exe
  C:\Windows\System\IJnsQVF.exe
  2⤵
  PID:5296
- C:\Windows\System\QZnIJET.exe
  C:\Windows\System\QZnIJET.exe
  2⤵
  PID:5324
- C:\Windows\System\kDyuJJq.exe
  C:\Windows\System\kDyuJJq.exe
  2⤵
  PID:5356
- C:\Windows\System\VJTbMCM.exe
  C:\Windows\System\VJTbMCM.exe
  2⤵
  PID:5380
- C:\Windows\System\HpZPgQq.exe
  C:\Windows\System\HpZPgQq.exe
  2⤵
  PID:5408
- C:\Windows\System\pbjMMUV.exe
  C:\Windows\System\pbjMMUV.exe
  2⤵
  PID:5436
- C:\Windows\System\HrNwxrQ.exe
  C:\Windows\System\HrNwxrQ.exe
  2⤵
  PID:5464
- C:\Windows\System\mjDnyjp.exe
  C:\Windows\System\mjDnyjp.exe
  2⤵
  PID:5492
- C:\Windows\System\TAKjvKr.exe
  C:\Windows\System\TAKjvKr.exe
  2⤵
  PID:5520
- C:\Windows\System\CPpKaeU.exe
  C:\Windows\System\CPpKaeU.exe
  2⤵
  PID:5548
- C:\Windows\System\ikOQrlZ.exe
  C:\Windows\System\ikOQrlZ.exe
  2⤵
  PID:5576
- C:\Windows\System\cFomyXh.exe
  C:\Windows\System\cFomyXh.exe
  2⤵
  PID:5604
- C:\Windows\System\lobxXOv.exe
  C:\Windows\System\lobxXOv.exe
  2⤵
  PID:5632
- C:\Windows\System\FQZakLq.exe
  C:\Windows\System\FQZakLq.exe
  2⤵
  PID:5660
- C:\Windows\System\ByuMOll.exe
  C:\Windows\System\ByuMOll.exe
  2⤵
  PID:5688
- C:\Windows\System\HUNybiI.exe
  C:\Windows\System\HUNybiI.exe
  2⤵
  PID:5716
- C:\Windows\System\DPrlFtI.exe
  C:\Windows\System\DPrlFtI.exe
  2⤵
  PID:5744
- C:\Windows\System\llmtYeY.exe
  C:\Windows\System\llmtYeY.exe
  2⤵
  PID:5772
- C:\Windows\System\OPGBqfz.exe
  C:\Windows\System\OPGBqfz.exe
  2⤵
  PID:5804
- C:\Windows\System\ZZTbZiU.exe
  C:\Windows\System\ZZTbZiU.exe
  2⤵
  PID:5828
- C:\Windows\System\HYEbEcc.exe
  C:\Windows\System\HYEbEcc.exe
  2⤵
  PID:5856
- C:\Windows\System\NHARzjn.exe
  C:\Windows\System\NHARzjn.exe
  2⤵
  PID:5884
- C:\Windows\System\JIXuvMb.exe
  C:\Windows\System\JIXuvMb.exe
  2⤵
  PID:5912
- C:\Windows\System\POaNpbV.exe
  C:\Windows\System\POaNpbV.exe
  2⤵
  PID:5940
- C:\Windows\System\pBRusom.exe
  C:\Windows\System\pBRusom.exe
  2⤵
  PID:5968
- C:\Windows\System\ahQStEm.exe
  C:\Windows\System\ahQStEm.exe
  2⤵
  PID:6000
- C:\Windows\System\UpDwSNe.exe
  C:\Windows\System\UpDwSNe.exe
  2⤵
  PID:6024
- C:\Windows\System\ZQNQGUS.exe
  C:\Windows\System\ZQNQGUS.exe
  2⤵
  PID:6052
- C:\Windows\System\imXKQbw.exe
  C:\Windows\System\imXKQbw.exe
  2⤵
  PID:6104
- C:\Windows\System\qfhoNHM.exe
  C:\Windows\System\qfhoNHM.exe
  2⤵
  PID:6120
- C:\Windows\System\RFvdTwx.exe
  C:\Windows\System\RFvdTwx.exe
  2⤵
  PID:6136
- C:\Windows\System\YlAJlGz.exe
  C:\Windows\System\YlAJlGz.exe
  2⤵
  PID:2676
- C:\Windows\System\sInRpob.exe
  C:\Windows\System\sInRpob.exe
  2⤵
  PID:4612
- C:\Windows\System\BSiWtQG.exe
  C:\Windows\System\BSiWtQG.exe
  2⤵
  PID:2284
- C:\Windows\System\ExJuVbP.exe
  C:\Windows\System\ExJuVbP.exe
  2⤵
  PID:1120
- C:\Windows\System\HjSPKOo.exe
  C:\Windows\System\HjSPKOo.exe
  2⤵
  PID:5140
- C:\Windows\System\JoiBUoq.exe
  C:\Windows\System\JoiBUoq.exe
  2⤵
  PID:5200
- C:\Windows\System\Pnttbcq.exe
  C:\Windows\System\Pnttbcq.exe
  2⤵
  PID:5256
- C:\Windows\System\prIxahz.exe
  C:\Windows\System\prIxahz.exe
  2⤵
  PID:5312
- C:\Windows\System\hJNdJmO.exe
  C:\Windows\System\hJNdJmO.exe
  2⤵
  PID:5376
- C:\Windows\System\jHwdtss.exe
  C:\Windows\System\jHwdtss.exe
  2⤵
  PID:5448
- C:\Windows\System\COPmsmJ.exe
  C:\Windows\System\COPmsmJ.exe
  2⤵
  PID:5504
- C:\Windows\System\zQusgtZ.exe
  C:\Windows\System\zQusgtZ.exe
  2⤵
  PID:5540
- C:\Windows\System\PDLsgLL.exe
  C:\Windows\System\PDLsgLL.exe
  2⤵
  PID:5596
- C:\Windows\System\aFfTArg.exe
  C:\Windows\System\aFfTArg.exe
  2⤵
  PID:5644
- C:\Windows\System\gagQdDp.exe
  C:\Windows\System\gagQdDp.exe
  2⤵
  PID:5704
- C:\Windows\System\ZHwOANV.exe
  C:\Windows\System\ZHwOANV.exe
  2⤵
  PID:5784
- C:\Windows\System\JGsiPiE.exe
  C:\Windows\System\JGsiPiE.exe
  2⤵
  PID:4160
- C:\Windows\System\WepcKHS.exe
  C:\Windows\System\WepcKHS.exe
  2⤵
  PID:6064
- C:\Windows\System\PjYiOyH.exe
  C:\Windows\System\PjYiOyH.exe
  2⤵
  PID:6072
- C:\Windows\System\GOMEplW.exe
  C:\Windows\System\GOMEplW.exe
  2⤵
  PID:3128
- C:\Windows\System\IIdhjya.exe
  C:\Windows\System\IIdhjya.exe
  2⤵
  PID:1128
- C:\Windows\System\jONzdWV.exe
  C:\Windows\System\jONzdWV.exe
  2⤵
  PID:5168
- C:\Windows\System\CIhvWWO.exe
  C:\Windows\System\CIhvWWO.exe
  2⤵
  PID:2772
- C:\Windows\System\IrQaxom.exe
  C:\Windows\System\IrQaxom.exe
  2⤵
  PID:4200
- C:\Windows\System\EqsDibk.exe
  C:\Windows\System\EqsDibk.exe
  2⤵
  PID:3124
- C:\Windows\System\kWVTYEf.exe
  C:\Windows\System\kWVTYEf.exe
  2⤵
  PID:5424
- C:\Windows\System\uhPWiXC.exe
  C:\Windows\System\uhPWiXC.exe
  2⤵
  PID:5512
- C:\Windows\System\DTQzNai.exe
  C:\Windows\System\DTQzNai.exe
  2⤵
  PID:3480
- C:\Windows\System\aBibRXD.exe
  C:\Windows\System\aBibRXD.exe
  2⤵
  PID:812
- C:\Windows\System\NqMSkdw.exe
  C:\Windows\System\NqMSkdw.exe
  2⤵
  PID:1008
- C:\Windows\System\KHQFLBB.exe
  C:\Windows\System\KHQFLBB.exe
  2⤵
  PID:3720
- C:\Windows\System\vzLkeZt.exe
  C:\Windows\System\vzLkeZt.exe
  2⤵
  PID:1064
- C:\Windows\System\PaqfiRN.exe
  C:\Windows\System\PaqfiRN.exe
  2⤵
  PID:4876
- C:\Windows\System\MHeVMFM.exe
  C:\Windows\System\MHeVMFM.exe
  2⤵
  PID:316
- C:\Windows\System\dyfQxVg.exe
  C:\Windows\System\dyfQxVg.exe
  2⤵
  PID:4892
- C:\Windows\System\kmjhdUU.exe
  C:\Windows\System\kmjhdUU.exe
  2⤵
  PID:1492
- C:\Windows\System\ZxzNXMK.exe
  C:\Windows\System\ZxzNXMK.exe
  2⤵
  PID:5364
- C:\Windows\System\ZHZTzkH.exe
  C:\Windows\System\ZHZTzkH.exe
  2⤵
  PID:2424
- C:\Windows\System\VdPZTnP.exe
  C:\Windows\System\VdPZTnP.exe
  2⤵
  PID:5116
- C:\Windows\System\kWJUNNf.exe
  C:\Windows\System\kWJUNNf.exe
  2⤵
  PID:1124
- C:\Windows\System\jhGrbdB.exe
  C:\Windows\System\jhGrbdB.exe
  2⤵
  PID:3276
- C:\Windows\System\GudUmJQ.exe
  C:\Windows\System\GudUmJQ.exe
  2⤵
  PID:3996
- C:\Windows\System\jvRHWSC.exe
  C:\Windows\System\jvRHWSC.exe
  2⤵
  PID:4088
- C:\Windows\System\ctSDekt.exe
  C:\Windows\System\ctSDekt.exe
  2⤵
  PID:5176
- C:\Windows\System\QfkuJoy.exe
  C:\Windows\System\QfkuJoy.exe
  2⤵
  PID:5980
- C:\Windows\System\QDLjznD.exe
  C:\Windows\System\QDLjznD.exe
  2⤵
  PID:1156
- C:\Windows\System\qSFmVQq.exe
  C:\Windows\System\qSFmVQq.exe
  2⤵
  PID:4840
- C:\Windows\System\sUQcBwz.exe
  C:\Windows\System\sUQcBwz.exe
  2⤵
  PID:2200
- C:\Windows\System\RVwxRGH.exe
  C:\Windows\System\RVwxRGH.exe
  2⤵
  PID:6132
- C:\Windows\System\bYosdmR.exe
  C:\Windows\System\bYosdmR.exe
  2⤵
  PID:6160
- C:\Windows\System\bdWClIQ.exe
  C:\Windows\System\bdWClIQ.exe
  2⤵
  PID:6204
- C:\Windows\System\LcyscVj.exe
  C:\Windows\System\LcyscVj.exe
  2⤵
  PID:6228
- C:\Windows\System\jLTuiGs.exe
  C:\Windows\System\jLTuiGs.exe
  2⤵
  PID:6248
- C:\Windows\System\DiJFkWr.exe
  C:\Windows\System\DiJFkWr.exe
  2⤵
  PID:6276
- C:\Windows\System\urpvFfD.exe
  C:\Windows\System\urpvFfD.exe
  2⤵
  PID:6308
- C:\Windows\System\FQIZDAQ.exe
  C:\Windows\System\FQIZDAQ.exe
  2⤵
  PID:6324
- C:\Windows\System\vurbNkT.exe
  C:\Windows\System\vurbNkT.exe
  2⤵
  PID:6360
- C:\Windows\System\TpKHxjR.exe
  C:\Windows\System\TpKHxjR.exe
  2⤵
  PID:6396
- C:\Windows\System\hGcxfSR.exe
  C:\Windows\System\hGcxfSR.exe
  2⤵
  PID:6412
- C:\Windows\System\IQkcjxU.exe
  C:\Windows\System\IQkcjxU.exe
  2⤵
  PID:6436
- C:\Windows\System\mfpcKEo.exe
  C:\Windows\System\mfpcKEo.exe
  2⤵
  PID:6456
- C:\Windows\System\lorFVAo.exe
  C:\Windows\System\lorFVAo.exe
  2⤵
  PID:6520
- C:\Windows\System\qnuxNuC.exe
  C:\Windows\System\qnuxNuC.exe
  2⤵
  PID:6552
- C:\Windows\System\oQflOza.exe
  C:\Windows\System\oQflOza.exe
  2⤵
  PID:6572
- C:\Windows\System\rKUaEgj.exe
  C:\Windows\System\rKUaEgj.exe
  2⤵
  PID:6592
- C:\Windows\System\USwgGdU.exe
  C:\Windows\System\USwgGdU.exe
  2⤵
  PID:6608
- C:\Windows\System\dLMSVVB.exe
  C:\Windows\System\dLMSVVB.exe
  2⤵
  PID:6636
- C:\Windows\System\MIHWqjB.exe
  C:\Windows\System\MIHWqjB.exe
  2⤵
  PID:6660
- C:\Windows\System\llmVgAz.exe
  C:\Windows\System\llmVgAz.exe
  2⤵
  PID:6740
- C:\Windows\System\jXJjMXz.exe
  C:\Windows\System\jXJjMXz.exe
  2⤵
  PID:6760
- C:\Windows\System\QcZZZOJ.exe
  C:\Windows\System\QcZZZOJ.exe
  2⤵
  PID:6784
- C:\Windows\System\lahtjWk.exe
  C:\Windows\System\lahtjWk.exe
  2⤵
  PID:6804
- C:\Windows\System\gHBExlw.exe
  C:\Windows\System\gHBExlw.exe
  2⤵
  PID:6832
- C:\Windows\System\IsgtDvz.exe
  C:\Windows\System\IsgtDvz.exe
  2⤵
  PID:6860
- C:\Windows\System\wwiZVoD.exe
  C:\Windows\System\wwiZVoD.exe
  2⤵
  PID:6876
- C:\Windows\System\bPyfmzz.exe
  C:\Windows\System\bPyfmzz.exe
  2⤵
  PID:6892
- C:\Windows\System\CiWlMVb.exe
  C:\Windows\System\CiWlMVb.exe
  2⤵
  PID:6928
- C:\Windows\System\rwcdYEH.exe
  C:\Windows\System\rwcdYEH.exe
  2⤵
  PID:6944
- C:\Windows\System\NEusLhs.exe
  C:\Windows\System\NEusLhs.exe
  2⤵
  PID:6984
- C:\Windows\System\VmJEIiA.exe
  C:\Windows\System\VmJEIiA.exe
  2⤵
  PID:7028
- C:\Windows\System\ndyPaNb.exe
  C:\Windows\System\ndyPaNb.exe
  2⤵
  PID:7044
- C:\Windows\System\hUppeOm.exe
  C:\Windows\System\hUppeOm.exe
  2⤵
  PID:7068
- C:\Windows\System\QqpjiwK.exe
  C:\Windows\System\QqpjiwK.exe
  2⤵
  PID:7092
- C:\Windows\System\KruccNx.exe
  C:\Windows\System\KruccNx.exe
  2⤵
  PID:7132
- C:\Windows\System\oYSXzdb.exe
  C:\Windows\System\oYSXzdb.exe
  2⤵
  PID:7148
- C:\Windows\System\HRdrYjs.exe
  C:\Windows\System\HRdrYjs.exe
  2⤵
  PID:6176
- C:\Windows\System\hjPkXRr.exe
  C:\Windows\System\hjPkXRr.exe
  2⤵
  PID:6268
- C:\Windows\System\GbPpIxl.exe
  C:\Windows\System\GbPpIxl.exe
  2⤵
  PID:6304
- C:\Windows\System\mdOFSFc.exe
  C:\Windows\System\mdOFSFc.exe
  2⤵
  PID:6356
- C:\Windows\System\yhOHMHj.exe
  C:\Windows\System\yhOHMHj.exe
  2⤵
  PID:6404
- C:\Windows\System\aMrbqoO.exe
  C:\Windows\System\aMrbqoO.exe
  2⤵
  PID:6536
- C:\Windows\System\FUlmtRl.exe
  C:\Windows\System\FUlmtRl.exe
  2⤵
  PID:6496
- C:\Windows\System\OpgTiQs.exe
  C:\Windows\System\OpgTiQs.exe
  2⤵
  PID:6648
- C:\Windows\System\IkGdxAn.exe
  C:\Windows\System\IkGdxAn.exe
  2⤵
  PID:6700
- C:\Windows\System\GULXwKm.exe
  C:\Windows\System\GULXwKm.exe
  2⤵
  PID:6748
- C:\Windows\System\esrinaz.exe
  C:\Windows\System\esrinaz.exe
  2⤵
  PID:6796
- C:\Windows\System\WtxOvlh.exe
  C:\Windows\System\WtxOvlh.exe
  2⤵
  PID:6840
- C:\Windows\System\gKaBtAt.exe
  C:\Windows\System\gKaBtAt.exe
  2⤵
  PID:6872
- C:\Windows\System\EeOExOV.exe
  C:\Windows\System\EeOExOV.exe
  2⤵
  PID:7016
- C:\Windows\System\YrXOPNK.exe
  C:\Windows\System\YrXOPNK.exe
  2⤵
  PID:7036
- C:\Windows\System\FaTSMiT.exe
  C:\Windows\System\FaTSMiT.exe
  2⤵
  PID:7088
- C:\Windows\System\IozKxxd.exe
  C:\Windows\System\IozKxxd.exe
  2⤵
  PID:7140
- C:\Windows\System\UIAYExv.exe
  C:\Windows\System\UIAYExv.exe
  2⤵
  PID:6156
- C:\Windows\System\vRztWLy.exe
  C:\Windows\System\vRztWLy.exe
  2⤵
  PID:6444
- C:\Windows\System\BHYeAIq.exe
  C:\Windows\System\BHYeAIq.exe
  2⤵
  PID:6428
- C:\Windows\System\ERlPzDU.exe
  C:\Windows\System\ERlPzDU.exe
  2⤵
  PID:6728
- C:\Windows\System\ajIAOIR.exe
  C:\Windows\System\ajIAOIR.exe
  2⤵
  PID:6856
- C:\Windows\System\mjqZeeh.exe
  C:\Windows\System\mjqZeeh.exe
  2⤵
  PID:7120
- C:\Windows\System\vjZAZrW.exe
  C:\Windows\System\vjZAZrW.exe
  2⤵
  PID:6420
- C:\Windows\System\AhiJCYn.exe
  C:\Windows\System\AhiJCYn.exe
  2⤵
  PID:6600
- C:\Windows\System\jogfcIQ.exe
  C:\Windows\System\jogfcIQ.exe
  2⤵
  PID:6632
- C:\Windows\System\lAUDfza.exe
  C:\Windows\System\lAUDfza.exe
  2⤵
  PID:6564
- C:\Windows\System\bRSYuri.exe
  C:\Windows\System\bRSYuri.exe
  2⤵
  PID:7184
- C:\Windows\System\ODGWyTB.exe
  C:\Windows\System\ODGWyTB.exe
  2⤵
  PID:7208
- C:\Windows\System\GnROxbN.exe
  C:\Windows\System\GnROxbN.exe
  2⤵
  PID:7224
- C:\Windows\System\EFvQrGJ.exe
  C:\Windows\System\EFvQrGJ.exe
  2⤵
  PID:7256
- C:\Windows\System\lXIPpNf.exe
  C:\Windows\System\lXIPpNf.exe
  2⤵
  PID:7272
- C:\Windows\System\zPcOUmG.exe
  C:\Windows\System\zPcOUmG.exe
  2⤵
  PID:7320
- C:\Windows\System\fNfLQFV.exe
  C:\Windows\System\fNfLQFV.exe
  2⤵
  PID:7340
- C:\Windows\System\TDkhGhh.exe
  C:\Windows\System\TDkhGhh.exe
  2⤵
  PID:7392
- C:\Windows\System\HgqWAfi.exe
  C:\Windows\System\HgqWAfi.exe
  2⤵
  PID:7412
- C:\Windows\System\jXbrkOa.exe
  C:\Windows\System\jXbrkOa.exe
  2⤵
  PID:7432
- C:\Windows\System\NusERSd.exe
  C:\Windows\System\NusERSd.exe
  2⤵
  PID:7460
- C:\Windows\System\UQZmmUN.exe
  C:\Windows\System\UQZmmUN.exe
  2⤵
  PID:7484
- C:\Windows\System\ikaVTXs.exe
  C:\Windows\System\ikaVTXs.exe
  2⤵
  PID:7504
- C:\Windows\System\yZeENrJ.exe
  C:\Windows\System\yZeENrJ.exe
  2⤵
  PID:7556
- C:\Windows\System\mJEsoMS.exe
  C:\Windows\System\mJEsoMS.exe
  2⤵
  PID:7576
- C:\Windows\System\FzigETk.exe
  C:\Windows\System\FzigETk.exe
  2⤵
  PID:7596
- C:\Windows\System\zKWEfcb.exe
  C:\Windows\System\zKWEfcb.exe
  2⤵
  PID:7616
- C:\Windows\System\ESPhpyF.exe
  C:\Windows\System\ESPhpyF.exe
  2⤵
  PID:7636
- C:\Windows\System\fikhUsE.exe
  C:\Windows\System\fikhUsE.exe
  2⤵
  PID:7720
- C:\Windows\System\jVnlFiu.exe
  C:\Windows\System\jVnlFiu.exe
  2⤵
  PID:7764
- C:\Windows\System\bFSxjid.exe
  C:\Windows\System\bFSxjid.exe
  2⤵
  PID:7788
- C:\Windows\System\smvJMXZ.exe
  C:\Windows\System\smvJMXZ.exe
  2⤵
  PID:7812
- C:\Windows\System\lyaLRjb.exe
  C:\Windows\System\lyaLRjb.exe
  2⤵
  PID:7828
- C:\Windows\System\vDNiLJx.exe
  C:\Windows\System\vDNiLJx.exe
  2⤵
  PID:7852
- C:\Windows\System\qUAoCAT.exe
  C:\Windows\System\qUAoCAT.exe
  2⤵
  PID:7892
- C:\Windows\System\YZJTmsn.exe
  C:\Windows\System\YZJTmsn.exe
  2⤵
  PID:7916
- C:\Windows\System\oaMITIu.exe
  C:\Windows\System\oaMITIu.exe
  2⤵
  PID:7940
- C:\Windows\System\rDTrlZL.exe
  C:\Windows\System\rDTrlZL.exe
  2⤵
  PID:7972
- C:\Windows\System\RmxwBSD.exe
  C:\Windows\System\RmxwBSD.exe
  2⤵
  PID:7988
- C:\Windows\System\ziJHPDS.exe
  C:\Windows\System\ziJHPDS.exe
  2⤵
  PID:8012
- C:\Windows\System\eqIerzJ.exe
  C:\Windows\System\eqIerzJ.exe
  2⤵
  PID:8040
- C:\Windows\System\rooSNwb.exe
  C:\Windows\System\rooSNwb.exe
  2⤵
  PID:8056
- C:\Windows\System\aLHohEW.exe
  C:\Windows\System\aLHohEW.exe
  2⤵
  PID:8092
- C:\Windows\System\kjBbQAl.exe
  C:\Windows\System\kjBbQAl.exe
  2⤵
  PID:8112
- C:\Windows\System\mUtszkN.exe
  C:\Windows\System\mUtszkN.exe
  2⤵
  PID:8164
- C:\Windows\System\bJyiwMO.exe
  C:\Windows\System\bJyiwMO.exe
  2⤵
  PID:8184
- C:\Windows\System\viLzxUX.exe
  C:\Windows\System\viLzxUX.exe
  2⤵
  PID:6628
- C:\Windows\System\VXDnFRf.exe
  C:\Windows\System\VXDnFRf.exe
  2⤵
  PID:7236
- C:\Windows\System\EjdnRfa.exe
  C:\Windows\System\EjdnRfa.exe
  2⤵
  PID:7216
- C:\Windows\System\GisEcfQ.exe
  C:\Windows\System\GisEcfQ.exe
  2⤵
  PID:7336
- C:\Windows\System\ibvERIJ.exe
  C:\Windows\System\ibvERIJ.exe
  2⤵
  PID:7408
- C:\Windows\System\RtgOGdK.exe
  C:\Windows\System\RtgOGdK.exe
  2⤵
  PID:7468
- C:\Windows\System\vVKYiGO.exe
  C:\Windows\System\vVKYiGO.exe
  2⤵
  PID:7568
- C:\Windows\System\izQfbIo.exe
  C:\Windows\System\izQfbIo.exe
  2⤵
  PID:7612
- C:\Windows\System\iCvKRRA.exe
  C:\Windows\System\iCvKRRA.exe
  2⤵
  PID:7668
- C:\Windows\System\bcaoFLm.exe
  C:\Windows\System\bcaoFLm.exe
  2⤵
  PID:7776
- C:\Windows\System\xWzzHRO.exe
  C:\Windows\System\xWzzHRO.exe
  2⤵
  PID:7824
- C:\Windows\System\HAhonsB.exe
  C:\Windows\System\HAhonsB.exe
  2⤵
  PID:7848
- C:\Windows\System\DyTqEIZ.exe
  C:\Windows\System\DyTqEIZ.exe
  2⤵
  PID:7872
- C:\Windows\System\MOifEeI.exe
  C:\Windows\System\MOifEeI.exe
  2⤵
  PID:8032
- C:\Windows\System\wAwvcdS.exe
  C:\Windows\System\wAwvcdS.exe
  2⤵
  PID:8052
- C:\Windows\System\LEVeryG.exe
  C:\Windows\System\LEVeryG.exe
  2⤵
  PID:8136
- C:\Windows\System\QXjlavi.exe
  C:\Windows\System\QXjlavi.exe
  2⤵
  PID:3076
- C:\Windows\System\ZcImznc.exe
  C:\Windows\System\ZcImznc.exe
  2⤵
  PID:7108
- C:\Windows\System\jdNiPej.exe
  C:\Windows\System\jdNiPej.exe
  2⤵
  PID:7520
- C:\Windows\System\gGABael.exe
  C:\Windows\System\gGABael.exe
  2⤵
  PID:7760
- C:\Windows\System\VHAtolD.exe
  C:\Windows\System\VHAtolD.exe
  2⤵
  PID:7756
- C:\Windows\System\LVGsRkK.exe
  C:\Windows\System\LVGsRkK.exe
  2⤵
  PID:7840
- C:\Windows\System\SXRxZOo.exe
  C:\Windows\System\SXRxZOo.exe
  2⤵
  PID:7220
- C:\Windows\System\YBkFNXv.exe
  C:\Windows\System\YBkFNXv.exe
  2⤵
  PID:7268
- C:\Windows\System\KDyUTGp.exe
  C:\Windows\System\KDyUTGp.exe
  2⤵
  PID:7376
- C:\Windows\System\CeQolXR.exe
  C:\Windows\System\CeQolXR.exe
  2⤵
  PID:8104
- C:\Windows\System\LDZyILY.exe
  C:\Windows\System\LDZyILY.exe
  2⤵
  PID:8160
- C:\Windows\System\YAGDJAi.exe
  C:\Windows\System\YAGDJAi.exe
  2⤵
  PID:8196
- C:\Windows\System\sZWnrBl.exe
  C:\Windows\System\sZWnrBl.exe
  2⤵
  PID:8212
- C:\Windows\System\cypJEur.exe
  C:\Windows\System\cypJEur.exe
  2⤵
  PID:8228
- C:\Windows\System\DhGrmvP.exe
  C:\Windows\System\DhGrmvP.exe
  2⤵
  PID:8264
- C:\Windows\System\UkhHgWp.exe
  C:\Windows\System\UkhHgWp.exe
  2⤵
  PID:8284
- C:\Windows\System\mbqjGWU.exe
  C:\Windows\System\mbqjGWU.exe
  2⤵
  PID:8324
- C:\Windows\System\OfGAkqZ.exe
  C:\Windows\System\OfGAkqZ.exe
  2⤵
  PID:8348
- C:\Windows\System\ocNZVfO.exe
  C:\Windows\System\ocNZVfO.exe
  2⤵
  PID:8364
- C:\Windows\System\embYZMP.exe
  C:\Windows\System\embYZMP.exe
  2⤵
  PID:8420
- C:\Windows\System\eBUcvbC.exe
  C:\Windows\System\eBUcvbC.exe
  2⤵
  PID:8436
- C:\Windows\System\sptsZAm.exe
  C:\Windows\System\sptsZAm.exe
  2⤵
  PID:8468
- C:\Windows\System\bhRfamV.exe
  C:\Windows\System\bhRfamV.exe
  2⤵
  PID:8500
- C:\Windows\System\wRMuTOp.exe
  C:\Windows\System\wRMuTOp.exe
  2⤵
  PID:8524
- C:\Windows\System\VNURrOE.exe
  C:\Windows\System\VNURrOE.exe
  2⤵
  PID:8544
- C:\Windows\System\MxkgxTK.exe
  C:\Windows\System\MxkgxTK.exe
  2⤵
  PID:8576
- C:\Windows\System\ZnKNUZK.exe
  C:\Windows\System\ZnKNUZK.exe
  2⤵
  PID:8612
- C:\Windows\System\jUfgvUT.exe
  C:\Windows\System\jUfgvUT.exe
  2⤵
  PID:8636
- C:\Windows\System\IFLFuko.exe
  C:\Windows\System\IFLFuko.exe
  2⤵
  PID:8656
- C:\Windows\System\gXVUBhI.exe
  C:\Windows\System\gXVUBhI.exe
  2⤵
  PID:8688
- C:\Windows\System\mNLZfnk.exe
  C:\Windows\System\mNLZfnk.exe
  2⤵
  PID:8708
- C:\Windows\System\aPmBpkp.exe
  C:\Windows\System\aPmBpkp.exe
  2⤵
  PID:8744
- C:\Windows\System\khruRqi.exe
  C:\Windows\System\khruRqi.exe
  2⤵
  PID:8816
- C:\Windows\System\CEDfAzg.exe
  C:\Windows\System\CEDfAzg.exe
  2⤵
  PID:8840
- C:\Windows\System\NtnQmUT.exe
  C:\Windows\System\NtnQmUT.exe
  2⤵
  PID:8856
- C:\Windows\System\yprqLdz.exe
  C:\Windows\System\yprqLdz.exe
  2⤵
  PID:8884
- C:\Windows\System\EcqfRdO.exe
  C:\Windows\System\EcqfRdO.exe
  2⤵
  PID:8912
- C:\Windows\System\MEyrDdb.exe
  C:\Windows\System\MEyrDdb.exe
  2⤵
  PID:8928
- C:\Windows\System\hGtLIVm.exe
  C:\Windows\System\hGtLIVm.exe
  2⤵
  PID:8956
- C:\Windows\System\uZtCOtn.exe
  C:\Windows\System\uZtCOtn.exe
  2⤵
  PID:8972
- C:\Windows\System\cDIRMWY.exe
  C:\Windows\System\cDIRMWY.exe
  2⤵
  PID:9000
- C:\Windows\System\AKoKSCJ.exe
  C:\Windows\System\AKoKSCJ.exe
  2⤵
  PID:9020
- C:\Windows\System\emHTQot.exe
  C:\Windows\System\emHTQot.exe
  2⤵
  PID:9044
- C:\Windows\System\HhyjBXb.exe
  C:\Windows\System\HhyjBXb.exe
  2⤵
  PID:9060
- C:\Windows\System\LELWLJq.exe
  C:\Windows\System\LELWLJq.exe
  2⤵
  PID:9084
- C:\Windows\System\zMuwXuj.exe
  C:\Windows\System\zMuwXuj.exe
  2⤵
  PID:9100
- C:\Windows\System\GWDciNh.exe
  C:\Windows\System\GWDciNh.exe
  2⤵
  PID:9164
- C:\Windows\System\flZpqmS.exe
  C:\Windows\System\flZpqmS.exe
  2⤵
  PID:9184
- C:\Windows\System\qZBpFxN.exe
  C:\Windows\System\qZBpFxN.exe
  2⤵
  PID:9204
- C:\Windows\System\shIbbcr.exe
  C:\Windows\System\shIbbcr.exe
  2⤵
  PID:7660
- C:\Windows\System\WUTYZZg.exe
  C:\Windows\System\WUTYZZg.exe
  2⤵
  PID:7984
- C:\Windows\System\EXQsGaE.exe
  C:\Windows\System\EXQsGaE.exe
  2⤵
  PID:8332
- C:\Windows\System\rsauAsX.exe
  C:\Windows\System\rsauAsX.exe
  2⤵
  PID:8496
- C:\Windows\System\TSSzFrv.exe
  C:\Windows\System\TSSzFrv.exe
  2⤵
  PID:8516
- C:\Windows\System\ZtPNZdf.exe
  C:\Windows\System\ZtPNZdf.exe
  2⤵
  PID:8652
- C:\Windows\System\snGXaxx.exe
  C:\Windows\System\snGXaxx.exe
  2⤵
  PID:8700
- C:\Windows\System\FQvTtJX.exe
  C:\Windows\System\FQvTtJX.exe
  2⤵
  PID:8736
- C:\Windows\System\UIwTQUK.exe
  C:\Windows\System\UIwTQUK.exe
  2⤵
  PID:8864
- C:\Windows\System\NtglsQl.exe
  C:\Windows\System\NtglsQl.exe
  2⤵
  PID:8944
- C:\Windows\System\CPFVHws.exe
  C:\Windows\System\CPFVHws.exe
  2⤵
  PID:9016
- C:\Windows\System\GTLpFju.exe
  C:\Windows\System\GTLpFju.exe
  2⤵
  PID:9036
- C:\Windows\System\rkAkFPL.exe
  C:\Windows\System\rkAkFPL.exe
  2⤵
  PID:9136
- C:\Windows\System\DTUvXeo.exe
  C:\Windows\System\DTUvXeo.exe
  2⤵
  PID:9172
- C:\Windows\System\mvjvoRM.exe
  C:\Windows\System\mvjvoRM.exe
  2⤵
  PID:9180
- C:\Windows\System\LnAhafZ.exe
  C:\Windows\System\LnAhafZ.exe
  2⤵
  PID:8260
- C:\Windows\System\gcUaMnv.exe
  C:\Windows\System\gcUaMnv.exe
  2⤵
  PID:8320
- C:\Windows\System\diqFXWE.exe
  C:\Windows\System\diqFXWE.exe
  2⤵
  PID:8620
- C:\Windows\System\OjEeyWR.exe
  C:\Windows\System\OjEeyWR.exe
  2⤵
  PID:8732
- C:\Windows\System\bfnRPaV.exe
  C:\Windows\System\bfnRPaV.exe
  2⤵
  PID:8824
- C:\Windows\System\pLkrMET.exe
  C:\Windows\System\pLkrMET.exe
  2⤵
  PID:9012
- C:\Windows\System\sZQWQiA.exe
  C:\Windows\System\sZQWQiA.exe
  2⤵
  PID:9092
- C:\Windows\System\ZtKbEsL.exe
  C:\Windows\System\ZtKbEsL.exe
  2⤵
  PID:9176
- C:\Windows\System\AsoDHUu.exe
  C:\Windows\System\AsoDHUu.exe
  2⤵
  PID:8456
- C:\Windows\System\aDQuwXv.exe
  C:\Windows\System\aDQuwXv.exe
  2⤵
  PID:8964
- C:\Windows\System\vMCUmNQ.exe
  C:\Windows\System\vMCUmNQ.exe
  2⤵
  PID:9192
- C:\Windows\System\sPrLHGq.exe
  C:\Windows\System\sPrLHGq.exe
  2⤵
  PID:9236
- C:\Windows\System\ebFDPgB.exe
  C:\Windows\System\ebFDPgB.exe
  2⤵
  PID:9256
- C:\Windows\System\bHQzsFU.exe
  C:\Windows\System\bHQzsFU.exe
  2⤵
  PID:9288
- C:\Windows\System\myCIdxJ.exe
  C:\Windows\System\myCIdxJ.exe
  2⤵
  PID:9304
- C:\Windows\System\kIPcLqE.exe
  C:\Windows\System\kIPcLqE.exe
  2⤵
  PID:9332
- C:\Windows\System\fgYAhvv.exe
  C:\Windows\System\fgYAhvv.exe
  2⤵
  PID:9356
- C:\Windows\System\CaamvUy.exe
  C:\Windows\System\CaamvUy.exe
  2⤵
  PID:9396
- C:\Windows\System\AcodcQZ.exe
  C:\Windows\System\AcodcQZ.exe
  2⤵
  PID:9416
- C:\Windows\System\yHMggMN.exe
  C:\Windows\System\yHMggMN.exe
  2⤵
  PID:9436
- C:\Windows\System\SKZzegy.exe
  C:\Windows\System\SKZzegy.exe
  2⤵
  PID:9456
- C:\Windows\System\oJTEvBc.exe
  C:\Windows\System\oJTEvBc.exe
  2⤵
  PID:9476
- C:\Windows\System\KLOTfcz.exe
  C:\Windows\System\KLOTfcz.exe
  2⤵
  PID:9508
- C:\Windows\System\vTvhtnb.exe
  C:\Windows\System\vTvhtnb.exe
  2⤵
  PID:9528
- C:\Windows\System\RkarAzx.exe
  C:\Windows\System\RkarAzx.exe
  2⤵
  PID:9620
- C:\Windows\System\UgUrcFg.exe
  C:\Windows\System\UgUrcFg.exe
  2⤵
  PID:9664
- C:\Windows\System\srNUpdk.exe
  C:\Windows\System\srNUpdk.exe
  2⤵
  PID:9684
- C:\Windows\System\iFTIkKC.exe
  C:\Windows\System\iFTIkKC.exe
  2⤵
  PID:9716
- C:\Windows\System\sQLGQyx.exe
  C:\Windows\System\sQLGQyx.exe
  2⤵
  PID:9744
- C:\Windows\System\bxFGCkV.exe
  C:\Windows\System\bxFGCkV.exe
  2⤵
  PID:9772
- C:\Windows\System\TyQVyEE.exe
  C:\Windows\System\TyQVyEE.exe
  2⤵
  PID:9792
- C:\Windows\System\hqjfftn.exe
  C:\Windows\System\hqjfftn.exe
  2⤵
  PID:9828
- C:\Windows\System\FTACoeK.exe
  C:\Windows\System\FTACoeK.exe
  2⤵
  PID:9844
- C:\Windows\System\hkjJjNw.exe
  C:\Windows\System\hkjJjNw.exe
  2⤵
  PID:9864
- C:\Windows\System\pNVypQW.exe
  C:\Windows\System\pNVypQW.exe
  2⤵
  PID:9888
- C:\Windows\System\jNkjKSZ.exe
  C:\Windows\System\jNkjKSZ.exe
  2⤵
  PID:9912
- C:\Windows\System\pQejBTT.exe
  C:\Windows\System\pQejBTT.exe
  2⤵
  PID:9932
- C:\Windows\System\YYPpVdJ.exe
  C:\Windows\System\YYPpVdJ.exe
  2⤵
  PID:9992
- C:\Windows\System\UmgyBHK.exe
  C:\Windows\System\UmgyBHK.exe
  2⤵
  PID:10028
- C:\Windows\System\djjfYlZ.exe
  C:\Windows\System\djjfYlZ.exe
  2⤵
  PID:10060
- C:\Windows\System\StVpcip.exe
  C:\Windows\System\StVpcip.exe
  2⤵
  PID:10076
- C:\Windows\System\OimEoyV.exe
  C:\Windows\System\OimEoyV.exe
  2⤵
  PID:10124
- C:\Windows\System\qPKhrUQ.exe
  C:\Windows\System\qPKhrUQ.exe
  2⤵
  PID:10164
- C:\Windows\System\wVrtJQv.exe
  C:\Windows\System\wVrtJQv.exe
  2⤵
  PID:10180
- C:\Windows\System\WctjODL.exe
  C:\Windows\System\WctjODL.exe
  2⤵
  PID:10200
- C:\Windows\System\lxnjsGn.exe
  C:\Windows\System\lxnjsGn.exe
  2⤵
  PID:10216
- C:\Windows\System\PuBpOLK.exe
  C:\Windows\System\PuBpOLK.exe
  2⤵
  PID:8292
- C:\Windows\System\jtSvmPA.exe
  C:\Windows\System\jtSvmPA.exe
  2⤵
  PID:8876
- C:\Windows\System\VJwiqZS.exe
  C:\Windows\System\VJwiqZS.exe
  2⤵
  PID:8568
- C:\Windows\System\JhUnktk.exe
  C:\Windows\System\JhUnktk.exe
  2⤵
  PID:9572
- C:\Windows\System\AfyHyCh.exe
  C:\Windows\System\AfyHyCh.exe
  2⤵
  PID:9636
- C:\Windows\System\scPcxyN.exe
  C:\Windows\System\scPcxyN.exe
  2⤵
  PID:9676
- C:\Windows\System\ucAhSdt.exe
  C:\Windows\System\ucAhSdt.exe
  2⤵
  PID:3436
- C:\Windows\System\lkdVeDS.exe
  C:\Windows\System\lkdVeDS.exe
  2⤵
  PID:9736
- C:\Windows\System\GNHfMqs.exe
  C:\Windows\System\GNHfMqs.exe
  2⤵
  PID:9816
- C:\Windows\System\lDiobCI.exe
  C:\Windows\System\lDiobCI.exe
  2⤵
  PID:9852
- C:\Windows\System\ggMybAI.exe
  C:\Windows\System\ggMybAI.exe
  2⤵
  PID:9836
- C:\Windows\System\fCSnwGa.exe
  C:\Windows\System\fCSnwGa.exe
  2⤵
  PID:9880
- C:\Windows\System\LJedmRO.exe
  C:\Windows\System\LJedmRO.exe
  2⤵
  PID:9924
- C:\Windows\System\zxMXLRI.exe
  C:\Windows\System\zxMXLRI.exe
  2⤵
  PID:9944
- C:\Windows\System\WjCBxfU.exe
  C:\Windows\System\WjCBxfU.exe
  2⤵
  PID:10016
- C:\Windows\System\OelmMXf.exe
  C:\Windows\System\OelmMXf.exe
  2⤵
  PID:10068
- C:\Windows\System\qIvTprT.exe
  C:\Windows\System\qIvTprT.exe
  2⤵
  PID:10048
- C:\Windows\System\pyCqvIZ.exe
  C:\Windows\System\pyCqvIZ.exe
  2⤵
  PID:10120
- C:\Windows\System\enqsQHN.exe
  C:\Windows\System\enqsQHN.exe
  2⤵
  PID:10144
- C:\Windows\System\ZGDWZnC.exe
  C:\Windows\System\ZGDWZnC.exe
  2⤵
  PID:10172
- C:\Windows\System\ndFzNOh.exe
  C:\Windows\System\ndFzNOh.exe
  2⤵
  PID:9252
- C:\Windows\System\maSytUG.exe
  C:\Windows\System\maSytUG.exe
  2⤵
  PID:9444
- C:\Windows\System\iGYtOVP.exe
  C:\Windows\System\iGYtOVP.exe
  2⤵
  PID:10252
- C:\Windows\System\jZqdCfy.exe
  C:\Windows\System\jZqdCfy.exe
  2⤵
  PID:10268
- C:\Windows\System\EKHfzOR.exe
  C:\Windows\System\EKHfzOR.exe
  2⤵
  PID:10284
- C:\Windows\System\COIDane.exe
  C:\Windows\System\COIDane.exe
  2⤵
  PID:10300
- C:\Windows\System\eXfLMdR.exe
  C:\Windows\System\eXfLMdR.exe
  2⤵
  PID:10316
- C:\Windows\System\UyncCkl.exe
  C:\Windows\System\UyncCkl.exe
  2⤵
  PID:10336
- C:\Windows\System\nNfjOfW.exe
  C:\Windows\System\nNfjOfW.exe
  2⤵
  PID:10352
- C:\Windows\System\uxTLpBu.exe
  C:\Windows\System\uxTLpBu.exe
  2⤵
  PID:10372
- C:\Windows\System\hlzSXhO.exe
  C:\Windows\System\hlzSXhO.exe
  2⤵
  PID:10440
- C:\Windows\System\BRUfqHw.exe
  C:\Windows\System\BRUfqHw.exe
  2⤵
  PID:10464
- C:\Windows\System\WmctNjk.exe
  C:\Windows\System\WmctNjk.exe
  2⤵
  PID:10480
- C:\Windows\System\LpyHTku.exe
  C:\Windows\System\LpyHTku.exe
  2⤵
  PID:10504
- C:\Windows\System\QDnrNTq.exe
  C:\Windows\System\QDnrNTq.exe
  2⤵
  PID:10528
- C:\Windows\System\UEWFKTK.exe
  C:\Windows\System\UEWFKTK.exe
  2⤵
  PID:10556
- C:\Windows\System\gNXLcJH.exe
  C:\Windows\System\gNXLcJH.exe
  2⤵
  PID:10576
- C:\Windows\System\BkAcupA.exe
  C:\Windows\System\BkAcupA.exe
  2⤵
  PID:10780
- C:\Windows\System\zWAGkiC.exe
  C:\Windows\System\zWAGkiC.exe
  2⤵
  PID:10808
- C:\Windows\System\HNbGjhR.exe
  C:\Windows\System\HNbGjhR.exe
  2⤵
  PID:10900
- C:\Windows\System\DsdCbzs.exe
  C:\Windows\System\DsdCbzs.exe
  2⤵
  PID:10936
- C:\Windows\System\BLGFhfw.exe
  C:\Windows\System\BLGFhfw.exe
  2⤵
  PID:10956
- C:\Windows\System\DAdTKIy.exe
  C:\Windows\System\DAdTKIy.exe
  2⤵
  PID:11000
- C:\Windows\System\emOKfLn.exe
  C:\Windows\System\emOKfLn.exe
  2⤵
  PID:11060
- C:\Windows\System\bIBdUwg.exe
  C:\Windows\System\bIBdUwg.exe
  2⤵
  PID:11092
- C:\Windows\System\AICgGZW.exe
  C:\Windows\System\AICgGZW.exe
  2⤵
  PID:11112
- C:\Windows\System\xFZsaFz.exe
  C:\Windows\System\xFZsaFz.exe
  2⤵
  PID:11148
- C:\Windows\System\GAtZtiJ.exe
  C:\Windows\System\GAtZtiJ.exe
  2⤵
  PID:11168
- C:\Windows\System\JDgxAiN.exe
  C:\Windows\System\JDgxAiN.exe
  2⤵
  PID:11228
- C:\Windows\System\kSkcnKb.exe
  C:\Windows\System\kSkcnKb.exe
  2⤵
  PID:9228
- C:\Windows\System\umSsgRr.exe
  C:\Windows\System\umSsgRr.exe
  2⤵
  PID:4452
- C:\Windows\System\qocrqJI.exe
  C:\Windows\System\qocrqJI.exe
  2⤵
  PID:3340
- C:\Windows\System\tyozGvQ.exe
  C:\Windows\System\tyozGvQ.exe
  2⤵
  PID:10392
- C:\Windows\System\CgccqsU.exe
  C:\Windows\System\CgccqsU.exe
  2⤵
  PID:9520
- C:\Windows\System\jCxncHz.exe
  C:\Windows\System\jCxncHz.exe
  2⤵
  PID:9300
- C:\Windows\System\cpqemkq.exe
  C:\Windows\System\cpqemkq.exe
  2⤵
  PID:9404
- C:\Windows\System\AtOdhmr.exe
  C:\Windows\System\AtOdhmr.exe
  2⤵
  PID:9552
- C:\Windows\System\kPNWAIx.exe
  C:\Windows\System\kPNWAIx.exe
  2⤵
  PID:9784
- C:\Windows\System\QsOKmYE.exe
  C:\Windows\System\QsOKmYE.exe
  2⤵
  PID:9812
- C:\Windows\System\qhynSAC.exe
  C:\Windows\System\qhynSAC.exe
  2⤵
  PID:9980
- C:\Windows\System\dKqyvLJ.exe
  C:\Windows\System\dKqyvLJ.exe
  2⤵
  PID:10116
- C:\Windows\System\OdWrApo.exe
  C:\Windows\System\OdWrApo.exe
  2⤵
  PID:10260
- C:\Windows\System\XLyhzaQ.exe
  C:\Windows\System\XLyhzaQ.exe
  2⤵
  PID:10308
- C:\Windows\System\SXqYbGW.exe
  C:\Windows\System\SXqYbGW.exe
  2⤵
  PID:10496
- C:\Windows\System\mKIztWj.exe
  C:\Windows\System\mKIztWj.exe
  2⤵
  PID:10460
- C:\Windows\System\yqrIvfd.exe
  C:\Windows\System\yqrIvfd.exe
  2⤵
  PID:10996
- C:\Windows\System\YOPAhJe.exe
  C:\Windows\System\YOPAhJe.exe
  2⤵
  PID:11024
- C:\Windows\System\LZDndeV.exe
  C:\Windows\System\LZDndeV.exe
  2⤵
  PID:11084
- C:\Windows\System\aCmQxRY.exe
  C:\Windows\System\aCmQxRY.exe
  2⤵
  PID:11216
- C:\Windows\System\BoMbfbC.exe
  C:\Windows\System\BoMbfbC.exe
  2⤵
  PID:10364
- C:\Windows\System\ibZAgUA.exe
  C:\Windows\System\ibZAgUA.exe
  2⤵
  PID:9468
- C:\Windows\System\CIFyBPV.exe
  C:\Windows\System\CIFyBPV.exe
  2⤵
  PID:9296
- C:\Windows\System\wwFIqXT.exe
  C:\Windows\System\wwFIqXT.exe
  2⤵
  PID:9740
- C:\Windows\System\thiUWSG.exe
  C:\Windows\System\thiUWSG.exe
  2⤵
  PID:10084
- C:\Windows\System\DExPizv.exe
  C:\Windows\System\DExPizv.exe
  2⤵
  PID:10244
- C:\Windows\System\gsCiqUf.exe
  C:\Windows\System\gsCiqUf.exe
  2⤵
  PID:10436
- C:\Windows\System\argDWGG.exe
  C:\Windows\System\argDWGG.exe
  2⤵
  PID:10648
- C:\Windows\System\NmuSSSI.exe
  C:\Windows\System\NmuSSSI.exe
  2⤵
  PID:10512
- C:\Windows\System\QCkMUQe.exe
  C:\Windows\System\QCkMUQe.exe
  2⤵
  PID:10544
- C:\Windows\System\pOMzoLL.exe
  C:\Windows\System\pOMzoLL.exe
  2⤵
  PID:10608
- C:\Windows\System\Mkwvbpv.exe
  C:\Windows\System\Mkwvbpv.exe
  2⤵
  PID:10672
- C:\Windows\System\zfRYTKh.exe
  C:\Windows\System\zfRYTKh.exe
  2⤵
  PID:10712
- C:\Windows\System\RAtVUtM.exe
  C:\Windows\System\RAtVUtM.exe
  2⤵
  PID:10796
- C:\Windows\System\PDIXOxX.exe
  C:\Windows\System\PDIXOxX.exe
  2⤵
  PID:10968
- C:\Windows\System\YlwLEUo.exe
  C:\Windows\System\YlwLEUo.exe
  2⤵
  PID:11080
- C:\Windows\System\IFbrMfE.exe
  C:\Windows\System\IFbrMfE.exe
  2⤵
  PID:11252
- C:\Windows\System\bsRdlpK.exe
  C:\Windows\System\bsRdlpK.exe
  2⤵
  PID:9324
- C:\Windows\System\wRIgFqU.exe
  C:\Windows\System\wRIgFqU.exe
  2⤵
  PID:10328
- C:\Windows\System\xnIpJwy.exe
  C:\Windows\System\xnIpJwy.exe
  2⤵
  PID:10148
- C:\Windows\System\WUbVdiw.exe
  C:\Windows\System\WUbVdiw.exe
  2⤵
  PID:4468
- C:\Windows\System\YjuarJk.exe
  C:\Windows\System\YjuarJk.exe
  2⤵
  PID:10524
- C:\Windows\System\aBNnEqU.exe
  C:\Windows\System\aBNnEqU.exe
  2⤵
  PID:10616
- C:\Windows\System\OIKxrjm.exe
  C:\Windows\System\OIKxrjm.exe
  2⤵
  PID:10972
- C:\Windows\System\JimrmhI.exe
  C:\Windows\System\JimrmhI.exe
  2⤵
  PID:11076
- C:\Windows\System\nSriPns.exe
  C:\Windows\System\nSriPns.exe
  2⤵
  PID:9452
- C:\Windows\System\yAIdaAy.exe
  C:\Windows\System\yAIdaAy.exe
  2⤵
  PID:10432
- C:\Windows\System\PVRWDHU.exe
  C:\Windows\System\PVRWDHU.exe
  2⤵
  PID:10488
- C:\Windows\System\nLxgNSO.exe
  C:\Windows\System\nLxgNSO.exe
  2⤵
  PID:11268
- C:\Windows\System\cebFjHf.exe
  C:\Windows\System\cebFjHf.exe
  2⤵
  PID:11296
- C:\Windows\System\bhDjQPI.exe
  C:\Windows\System\bhDjQPI.exe
  2⤵
  PID:11324
- C:\Windows\System\jbDzRUQ.exe
  C:\Windows\System\jbDzRUQ.exe
  2⤵
  PID:11424
- C:\Windows\System\hjHvgHk.exe
  C:\Windows\System\hjHvgHk.exe
  2⤵
  PID:11444
- C:\Windows\System\KVmwuVf.exe
  C:\Windows\System\KVmwuVf.exe
  2⤵
  PID:11460
- C:\Windows\System\qnLSYsN.exe
  C:\Windows\System\qnLSYsN.exe
  2⤵
  PID:11476
- C:\Windows\System\icLJbLf.exe
  C:\Windows\System\icLJbLf.exe
  2⤵
  PID:11496
- C:\Windows\System\APXciWD.exe
  C:\Windows\System\APXciWD.exe
  2⤵
  PID:11520
- C:\Windows\System\qxIxfIB.exe
  C:\Windows\System\qxIxfIB.exe
  2⤵
  PID:11540
- C:\Windows\System\VAUWOuG.exe
  C:\Windows\System\VAUWOuG.exe
  2⤵
  PID:11592
- C:\Windows\System\duWAZfE.exe
  C:\Windows\System\duWAZfE.exe
  2⤵
  PID:11608
- C:\Windows\System\SvTEPBu.exe
  C:\Windows\System\SvTEPBu.exe
  2⤵
  PID:11632
- C:\Windows\System\wJalUdy.exe
  C:\Windows\System\wJalUdy.exe
  2⤵
  PID:11652
- C:\Windows\System\UwWfCeM.exe
  C:\Windows\System\UwWfCeM.exe
  2⤵
  PID:11696
- C:\Windows\System\CTXaGdD.exe
  C:\Windows\System\CTXaGdD.exe
  2⤵
  PID:11740
- C:\Windows\System\GcJzohG.exe
  C:\Windows\System\GcJzohG.exe
  2⤵
  PID:11768
- C:\Windows\System\WiNAyvU.exe
  C:\Windows\System\WiNAyvU.exe
  2⤵
  PID:11788
- C:\Windows\System\tLhZQtw.exe
  C:\Windows\System\tLhZQtw.exe
  2⤵
  PID:11836
- C:\Windows\System\ElnmUZY.exe
  C:\Windows\System\ElnmUZY.exe
  2⤵
  PID:11860
- C:\Windows\System\HWKRUfg.exe
  C:\Windows\System\HWKRUfg.exe
  2⤵
  PID:11880
- C:\Windows\System\mEDLvXd.exe
  C:\Windows\System\mEDLvXd.exe
  2⤵
  PID:11900
- C:\Windows\System\LPNUzSF.exe
  C:\Windows\System\LPNUzSF.exe
  2⤵
  PID:11916
- C:\Windows\System\rXitmLJ.exe
  C:\Windows\System\rXitmLJ.exe
  2⤵
  PID:11952
- C:\Windows\System\yvBjqig.exe
  C:\Windows\System\yvBjqig.exe
  2⤵
  PID:11988
- C:\Windows\System\pIDeSSJ.exe
  C:\Windows\System\pIDeSSJ.exe
  2⤵
  PID:12012
- C:\Windows\System\oMFVIug.exe
  C:\Windows\System\oMFVIug.exe
  2⤵
  PID:12032
- C:\Windows\System\IFWpJpZ.exe
  C:\Windows\System\IFWpJpZ.exe
  2⤵
  PID:12056
- C:\Windows\System\DfTOTYK.exe
  C:\Windows\System\DfTOTYK.exe
  2⤵
  PID:12084
- C:\Windows\System\hVCiFia.exe
  C:\Windows\System\hVCiFia.exe
  2⤵
  PID:12104
- C:\Windows\System\oTITLoH.exe
  C:\Windows\System\oTITLoH.exe
  2⤵
  PID:12144
- C:\Windows\System\mgvQYKB.exe
  C:\Windows\System\mgvQYKB.exe
  2⤵
  PID:12184
- C:\Windows\System\VhZCmyd.exe
  C:\Windows\System\VhZCmyd.exe
  2⤵
  PID:12208
- C:\Windows\System\eoPFaYI.exe
  C:\Windows\System\eoPFaYI.exe
  2⤵
  PID:12228
- C:\Windows\System\gwIAlhf.exe
  C:\Windows\System\gwIAlhf.exe
  2⤵
  PID:12252
- C:\Windows\System\HbqjNQa.exe
  C:\Windows\System\HbqjNQa.exe
  2⤵
  PID:12276
- C:\Windows\System\QUAvwWM.exe
  C:\Windows\System\QUAvwWM.exe
  2⤵
  PID:11276
- C:\Windows\System\YGUHiYE.exe
  C:\Windows\System\YGUHiYE.exe
  2⤵
  PID:11348
- C:\Windows\System\XsxZViC.exe
  C:\Windows\System\XsxZViC.exe
  2⤵
  PID:11356
- C:\Windows\System\bSGSwuZ.exe
  C:\Windows\System\bSGSwuZ.exe
  2⤵
  PID:11516
- C:\Windows\System\FYWOmpf.exe
  C:\Windows\System\FYWOmpf.exe
  2⤵
  PID:11560
- C:\Windows\System\FSLmDIO.exe
  C:\Windows\System\FSLmDIO.exe
  2⤵
  PID:11648
- C:\Windows\System\aNkSxkh.exe
  C:\Windows\System\aNkSxkh.exe
  2⤵
  PID:11724
- C:\Windows\System\oxrzMeN.exe
  C:\Windows\System\oxrzMeN.exe
  2⤵
  PID:11800
- C:\Windows\System\VrvUlll.exe
  C:\Windows\System\VrvUlll.exe
  2⤵
  PID:11852
- C:\Windows\System\gAUIALl.exe
  C:\Windows\System\gAUIALl.exe
  2⤵
  PID:1896
- C:\Windows\System\Hnjtpld.exe
  C:\Windows\System\Hnjtpld.exe
  2⤵
  PID:11924
- C:\Windows\System\XcQAFlz.exe
  C:\Windows\System\XcQAFlz.exe
  2⤵
  PID:12008
- C:\Windows\System\FpRIRjP.exe
  C:\Windows\System\FpRIRjP.exe
  2⤵
  PID:12044
- C:\Windows\System\vrAphre.exe
  C:\Windows\System\vrAphre.exe
  2⤵
  PID:12080
- C:\Windows\System\WgjPqsE.exe
  C:\Windows\System\WgjPqsE.exe
  2⤵
  PID:12192
- C:\Windows\System\JCPgVON.exe
  C:\Windows\System\JCPgVON.exe
  2⤵
  PID:12200
- C:\Windows\System\DvGMzGS.exe
  C:\Windows\System\DvGMzGS.exe
  2⤵
  PID:10224
- C:\Windows\System\FmXNAyW.exe
  C:\Windows\System\FmXNAyW.exe
  2⤵
  PID:11624
- C:\Windows\System\ltwmRUR.exe
  C:\Windows\System\ltwmRUR.exe
  2⤵
  PID:11680
- C:\Windows\System\YSIiDXI.exe
  C:\Windows\System\YSIiDXI.exe
  2⤵
  PID:1068
- C:\Windows\System\nwrZhzV.exe
  C:\Windows\System\nwrZhzV.exe
  2⤵
  PID:12100
- C:\Windows\System\tACuvUF.exe
  C:\Windows\System\tACuvUF.exe
  2⤵
  PID:12072
- C:\Windows\System\TqxiJJw.exe
  C:\Windows\System\TqxiJJw.exe
  2⤵
  PID:4296
- C:\Windows\System\FYktuji.exe
  C:\Windows\System\FYktuji.exe
  2⤵
  PID:11600
- C:\Windows\System\OynTHOK.exe
  C:\Windows\System\OynTHOK.exe
  2⤵
  PID:11832
- C:\Windows\System\hVGeieO.exe
  C:\Windows\System\hVGeieO.exe
  2⤵
  PID:11964
- C:\Windows\System\PwGRTBb.exe
  C:\Windows\System\PwGRTBb.exe
  2⤵
  PID:11436
- C:\Windows\System\XzpHGLY.exe
  C:\Windows\System\XzpHGLY.exe
  2⤵
  PID:3972
- C:\Windows\System\hStUBrN.exe
  C:\Windows\System\hStUBrN.exe
  2⤵
  PID:4552
- C:\Windows\System\sXTFqpW.exe
  C:\Windows\System\sXTFqpW.exe
  2⤵
  PID:12312
- C:\Windows\System\IVEZaoW.exe
  C:\Windows\System\IVEZaoW.exe
  2⤵
  PID:12344
- C:\Windows\System\OmsZVeT.exe
  C:\Windows\System\OmsZVeT.exe
  2⤵
  PID:12364
- C:\Windows\System\yOwPtmA.exe
  C:\Windows\System\yOwPtmA.exe
  2⤵
  PID:12392
- C:\Windows\System\LTHnLlF.exe
  C:\Windows\System\LTHnLlF.exe
  2⤵
  PID:12436
- C:\Windows\System\VSbcnTf.exe
  C:\Windows\System\VSbcnTf.exe
  2⤵
  PID:12472
- C:\Windows\System\bwvJXIm.exe
  C:\Windows\System\bwvJXIm.exe
  2⤵
  PID:12512
- C:\Windows\System\iBABZhy.exe
  C:\Windows\System\iBABZhy.exe
  2⤵
  PID:12540
- C:\Windows\System\wHApIzW.exe
  C:\Windows\System\wHApIzW.exe
  2⤵
  PID:12560
- C:\Windows\System\OgEacTa.exe
  C:\Windows\System\OgEacTa.exe
  2⤵
  PID:12588
- C:\Windows\System\mZjdLAW.exe
  C:\Windows\System\mZjdLAW.exe
  2⤵
  PID:12608
- C:\Windows\System\rJGkUzr.exe
  C:\Windows\System\rJGkUzr.exe
  2⤵
  PID:12640
- C:\Windows\System\UxmTNCp.exe
  C:\Windows\System\UxmTNCp.exe
  2⤵
  PID:12660
- C:\Windows\System\uevqpPS.exe
  C:\Windows\System\uevqpPS.exe
  2⤵
  PID:12684
- C:\Windows\System\biZOoJd.exe
  C:\Windows\System\biZOoJd.exe
  2⤵
  PID:12708
- C:\Windows\System\byXQfcs.exe
  C:\Windows\System\byXQfcs.exe
  2⤵
  PID:12744
- C:\Windows\System\WbJmGQT.exe
  C:\Windows\System\WbJmGQT.exe
  2⤵
  PID:12800
- C:\Windows\System\WlUECqp.exe
  C:\Windows\System\WlUECqp.exe
  2⤵
  PID:12824
- C:\Windows\System\nAnTraP.exe
  C:\Windows\System\nAnTraP.exe
  2⤵
  PID:12868
- C:\Windows\System\YQDOXsV.exe
  C:\Windows\System\YQDOXsV.exe
  2⤵
  PID:12888
- C:\Windows\System\QlvLlpH.exe
  C:\Windows\System\QlvLlpH.exe
  2⤵
  PID:12920
- C:\Windows\System\izAlvnv.exe
  C:\Windows\System\izAlvnv.exe
  2⤵
  PID:12944
- C:\Windows\System\CAJAlEb.exe
  C:\Windows\System\CAJAlEb.exe
  2⤵
  PID:12976
- C:\Windows\System\wNxLyQm.exe
  C:\Windows\System\wNxLyQm.exe
  2⤵
  PID:13024
- C:\Windows\System\mOOwHbC.exe
  C:\Windows\System\mOOwHbC.exe
  2⤵
  PID:13044
- C:\Windows\System\vVbkdaW.exe
  C:\Windows\System\vVbkdaW.exe
  2⤵
  PID:13064
- C:\Windows\System\zBASVCI.exe
  C:\Windows\System\zBASVCI.exe
  2⤵
  PID:13084
- C:\Windows\System\hhgAOUw.exe
  C:\Windows\System\hhgAOUw.exe
  2⤵
  PID:13100
- C:\Windows\System\AjQYaEI.exe
  C:\Windows\System\AjQYaEI.exe
  2⤵
  PID:13120
- C:\Windows\System\BIgcFKH.exe
  C:\Windows\System\BIgcFKH.exe
  2⤵
  PID:13152
- C:\Windows\System\dBumzFW.exe
  C:\Windows\System\dBumzFW.exe
  2⤵
  PID:13264
- C:\Windows\System\javszNE.exe
  C:\Windows\System\javszNE.exe
  2⤵
  PID:12332
- C:\Windows\System\GhNUDOS.exe
  C:\Windows\System\GhNUDOS.exe
  2⤵
  PID:12352
- C:\Windows\System\kOgMoUP.exe
  C:\Windows\System\kOgMoUP.exe
  2⤵
  PID:12464
- C:\Windows\System\dWRwoQG.exe
  C:\Windows\System\dWRwoQG.exe
  2⤵
  PID:12528
- C:\Windows\System\BgyhVXr.exe
  C:\Windows\System\BgyhVXr.exe
  2⤵
  PID:12972
- C:\Windows\System\WStbPUC.exe
  C:\Windows\System\WStbPUC.exe
  2⤵
  PID:13032
- C:\Windows\System\YYCwNzF.exe
  C:\Windows\System\YYCwNzF.exe
  2⤵
  PID:13080
- C:\Windows\System\daPHVot.exe
  C:\Windows\System\daPHVot.exe
  2⤵
  PID:13148
- C:\Windows\System\jZgjAHR.exe
  C:\Windows\System\jZgjAHR.exe
  2⤵
  PID:13208
- C:\Windows\System\PCaTQEs.exe
  C:\Windows\System\PCaTQEs.exe
  2⤵
  PID:13216
- C:\Windows\System\WPrJmnC.exe
  C:\Windows\System\WPrJmnC.exe
  2⤵
  PID:13252
- C:\Windows\System\CgWNyZZ.exe
  C:\Windows\System\CgWNyZZ.exe
  2⤵
  PID:12048
- C:\Windows\System\ZGKEXrb.exe
  C:\Windows\System\ZGKEXrb.exe
  2⤵
  PID:12380
- C:\Windows\System\XrBleCI.exe
  C:\Windows\System\XrBleCI.exe
  2⤵
  PID:12580
- C:\Windows\System\skANhZH.exe
  C:\Windows\System\skANhZH.exe
  2⤵
  PID:12680
- C:\Windows\System\BBgNgTr.exe
  C:\Windows\System\BBgNgTr.exe
  2⤵
  PID:13076
- C:\Windows\System\ifPRyRR.exe
  C:\Windows\System\ifPRyRR.exe
  2⤵
  PID:13056
- C:\Windows\System\GtoNBRv.exe
  C:\Windows\System\GtoNBRv.exe
  2⤵
  PID:13192
- C:\Windows\System\WqHmniR.exe
  C:\Windows\System\WqHmniR.exe
  2⤵
  PID:1856
- C:\Windows\System\xliBeQf.exe
  C:\Windows\System\xliBeQf.exe
  2⤵
  PID:13040
- C:\Windows\System\aInhRUr.exe
  C:\Windows\System\aInhRUr.exe
  2⤵
  PID:12532
- C:\Windows\System\xHbtYBA.exe
  C:\Windows\System\xHbtYBA.exe
  2⤵
  PID:4268
- C:\Windows\System\CtnbyGm.exe
  C:\Windows\System\CtnbyGm.exe
  2⤵
  PID:2520
- C:\Windows\System\fDpvbns.exe
  C:\Windows\System\fDpvbns.exe
  2⤵
  PID:12820
- C:\Windows\System\qldJbpm.exe
  C:\Windows\System\qldJbpm.exe
  2⤵
  PID:5040
- C:\Windows\System\gufmEQN.exe
  C:\Windows\System\gufmEQN.exe
  2⤵
  PID:13304
- C:\Windows\System\GWZQnie.exe
  C:\Windows\System\GWZQnie.exe
  2⤵
  PID:12556
- C:\Windows\System\esIegMQ.exe
  C:\Windows\System\esIegMQ.exe
  2⤵
  PID:4796
- C:\Windows\System\pTQgGan.exe
  C:\Windows\System\pTQgGan.exe
  2⤵
  PID:3628
- C:\Windows\System\vFamruv.exe
  C:\Windows\System\vFamruv.exe
  2⤵
  PID:5852
- C:\Windows\System\DQooXBn.exe
  C:\Windows\System\DQooXBn.exe
  2⤵
  PID:1756
- C:\Windows\System\qgCAXfV.exe
  C:\Windows\System\qgCAXfV.exe
  2⤵
  PID:5892
- C:\Windows\System\kmrEOJH.exe
  C:\Windows\System\kmrEOJH.exe
  2⤵
  PID:12916
- C:\Windows\System\miaqfqA.exe
  C:\Windows\System\miaqfqA.exe
  2⤵
  PID:6080
- C:\Windows\System\RYhnbku.exe
  C:\Windows\System\RYhnbku.exe
  2⤵
  PID:5792
- C:\Windows\System\IDUuWQo.exe
  C:\Windows\System\IDUuWQo.exe
  2⤵
  PID:12772
- C:\Windows\System\SsHwxBI.exe
  C:\Windows\System\SsHwxBI.exe
  2⤵
  PID:12308
- C:\Windows\System\rPpsMME.exe
  C:\Windows\System\rPpsMME.exe
  2⤵
  PID:13008
- C:\Windows\System\HHzAAFP.exe
  C:\Windows\System\HHzAAFP.exe
  2⤵
  PID:1396
- C:\Windows\System\imqgmqi.exe
  C:\Windows\System\imqgmqi.exe
  2⤵
  PID:12360
- C:\Windows\System\RGTUXbv.exe
  C:\Windows\System\RGTUXbv.exe
  2⤵
  PID:12604
- C:\Windows\System\xtqfZVY.exe
  C:\Windows\System\xtqfZVY.exe
  2⤵
  PID:5812
- C:\Windows\System\JoaaOpt.exe
  C:\Windows\System\JoaaOpt.exe
  2⤵
  PID:12764
- C:\Windows\System\TxUWlyb.exe
  C:\Windows\System\TxUWlyb.exe
  2⤵
  PID:13212
- C:\Windows\System\ZkuTeMU.exe
  C:\Windows\System\ZkuTeMU.exe
  2⤵
  PID:5104
- C:\Windows\System\XbJhbpH.exe
  C:\Windows\System\XbJhbpH.exe
  2⤵
  PID:5000
- C:\Windows\System\FiIGQuS.exe
  C:\Windows\System\FiIGQuS.exe
  2⤵
  PID:3468
- C:\Windows\System\mDsBZFs.exe
  C:\Windows\System\mDsBZFs.exe
  2⤵
  PID:2456
- C:\Windows\System\ZkFMkwk.exe
  C:\Windows\System\ZkFMkwk.exe
  2⤵
  PID:3976
- C:\Windows\System\YsOlBuj.exe
  C:\Windows\System\YsOlBuj.exe
  2⤵
  PID:7696
- C:\Windows\System\HQHHAmK.exe
  C:\Windows\System\HQHHAmK.exe
  2⤵
  PID:2920
- C:\Windows\System\aMghNUx.exe
  C:\Windows\System\aMghNUx.exe
  2⤵
  PID:6084
- C:\Windows\System\eGCQySL.exe
  C:\Windows\System\eGCQySL.exe
  2⤵
  PID:7868
- C:\Windows\System\UYXWCCs.exe
  C:\Windows\System\UYXWCCs.exe
  2⤵
  PID:7280
- C:\Windows\System\AIIIOFu.exe
  C:\Windows\System\AIIIOFu.exe
  2⤵
  PID:12452
- C:\Windows\System\GALHbAz.exe
  C:\Windows\System\GALHbAz.exe
  2⤵
  PID:1532
- C:\Windows\System\XJWFHlY.exe
  C:\Windows\System\XJWFHlY.exe
  2⤵
  PID:3236
- C:\Windows\System\aHPqvCq.exe
  C:\Windows\System\aHPqvCq.exe
  2⤵
  PID:8080
- C:\Windows\System\bumoMcH.exe
  C:\Windows\System\bumoMcH.exe
  2⤵
  PID:7496
- C:\Windows\System\eXEkdnz.exe
  C:\Windows\System\eXEkdnz.exe
  2⤵
  PID:4248
- C:\Windows\System\nSkbvkO.exe
  C:\Windows\System\nSkbvkO.exe
  2⤵
  PID:3968
- C:\Windows\System\jWOXXbI.exe
  C:\Windows\System\jWOXXbI.exe
  2⤵
  PID:7284
- C:\Windows\System\aebUUxD.exe
  C:\Windows\System\aebUUxD.exe
  2⤵
  PID:6848
- C:\Windows\System\UIajjQe.exe
  C:\Windows\System\UIajjQe.exe
  2⤵
  PID:1972
- C:\Windows\System\pztIysY.exe
  C:\Windows\System\pztIysY.exe
  2⤵
  PID:12676
- C:\Windows\System\MmFHqTN.exe
  C:\Windows\System\MmFHqTN.exe
  2⤵
  PID:624
- C:\Windows\System\Avcdwmf.exe
  C:\Windows\System\Avcdwmf.exe
  2⤵
  PID:636
- C:\Windows\System\glyyAWO.exe
  C:\Windows\System\glyyAWO.exe
  2⤵
  PID:4644
- C:\Windows\System\StVIsrC.exe
  C:\Windows\System\StVIsrC.exe
  2⤵
  PID:6128
- C:\Windows\System\OGyRFCf.exe
  C:\Windows\System\OGyRFCf.exe
  2⤵
  PID:2180
- C:\Windows\System\rNjJKys.exe
  C:\Windows\System\rNjJKys.exe
  2⤵
  PID:8644
- C:\Windows\System\TeHMxZu.exe
  C:\Windows\System\TeHMxZu.exe
  2⤵
  PID:336
- C:\Windows\System\padlhJs.exe
  C:\Windows\System\padlhJs.exe
  2⤵
  PID:8764
- C:\Windows\System\mwVEVDt.exe
  C:\Windows\System\mwVEVDt.exe
  2⤵
  PID:8784
- C:\Windows\System\ZYVfSEY.exe
  C:\Windows\System\ZYVfSEY.exe
  2⤵
  PID:7204
- C:\Windows\System\yNlHGke.exe
  C:\Windows\System\yNlHGke.exe
  2⤵
  PID:3284
- C:\Windows\System\NFccPgo.exe
  C:\Windows\System\NFccPgo.exe
  2⤵
  PID:7476
- C:\Windows\System\bBopnPw.exe
  C:\Windows\System\bBopnPw.exe
  2⤵
  PID:7748
- C:\Windows\System\eYYHHQg.exe
  C:\Windows\System\eYYHHQg.exe
  2⤵
  PID:1848
- C:\Windows\System\hPstDWH.exe
  C:\Windows\System\hPstDWH.exe
  2⤵
  PID:980
- C:\Windows\System\wlEqghN.exe
  C:\Windows\System\wlEqghN.exe
  2⤵
  PID:1704
- C:\Windows\System\vMUergu.exe
  C:\Windows\System\vMUergu.exe
  2⤵
  PID:8536
- C:\Windows\System\pTavNdN.exe
  C:\Windows\System\pTavNdN.exe
  2⤵
  PID:8796
- C:\Windows\System\pvuxNnI.exe
  C:\Windows\System\pvuxNnI.exe
  2⤵
  PID:4352
- C:\Windows\System\mlgEgDP.exe
  C:\Windows\System\mlgEgDP.exe
  2⤵
  PID:8000
- C:\Windows\System\GGTDvUo.exe
  C:\Windows\System\GGTDvUo.exe
  2⤵
  PID:3688
- C:\Windows\System\LzUMZbI.exe
  C:\Windows\System\LzUMZbI.exe
  2⤵
  PID:4648
- C:\Windows\System\IuMXFws.exe
  C:\Windows\System\IuMXFws.exe
  2⤵
  PID:6316
- C:\Windows\System\XPfmZEC.exe
  C:\Windows\System\XPfmZEC.exe
  2⤵
  PID:8272
- C:\Windows\System\iELtEOJ.exe
  C:\Windows\System\iELtEOJ.exe
  2⤵
  PID:4952
- C:\Windows\System\rKDixAF.exe
  C:\Windows\System\rKDixAF.exe
  2⤵
  PID:1652
- C:\Windows\System\mNxSiXW.exe
  C:\Windows\System\mNxSiXW.exe
  2⤵
  PID:1340
- C:\Windows\System\KSFBLkV.exe
  C:\Windows\System\KSFBLkV.exe
  2⤵
  PID:1544
- C:\Windows\System\aVBHRFY.exe
  C:\Windows\System\aVBHRFY.exe
  2⤵
  PID:8720
- C:\Windows\System\SLMWEvY.exe
  C:\Windows\System\SLMWEvY.exe
  2⤵
  PID:2420
- C:\Windows\System\QfdSPUE.exe
  C:\Windows\System\QfdSPUE.exe
  2⤵
  PID:9692
- C:\Windows\System\glFgAQW.exe
  C:\Windows\System\glFgAQW.exe
  2⤵
  PID:5136
- C:\Windows\System\DWpqkWk.exe
  C:\Windows\System\DWpqkWk.exe
  2⤵
  PID:5236
- C:\Windows\System\XiEEDiQ.exe
  C:\Windows\System\XiEEDiQ.exe
  2⤵
  PID:1292
- C:\Windows\System\PXiiAfh.exe
  C:\Windows\System\PXiiAfh.exe
  2⤵
  PID:5304
- C:\Windows\System\bjwOxQq.exe
  C:\Windows\System\bjwOxQq.exe
  2⤵
  PID:7784
- C:\Windows\System\ryPCJjm.exe
  C:\Windows\System\ryPCJjm.exe
  2⤵
  PID:5432
- C:\Windows\System\LjbmvDO.exe
  C:\Windows\System\LjbmvDO.exe
  2⤵
  PID:2988
- C:\Windows\System\heGaSwD.exe
  C:\Windows\System\heGaSwD.exe
  2⤵
  PID:5472
- C:\Windows\System\gDPSrKx.exe
  C:\Windows\System\gDPSrKx.exe
  2⤵
  PID:5544
- C:\Windows\System\ItwmubC.exe
  C:\Windows\System\ItwmubC.exe
  2⤵
  PID:6696
- C:\Windows\System\XtJLGSg.exe
  C:\Windows\System\XtJLGSg.exe
  2⤵
  PID:5640
- C:\Windows\System\dXPmnMZ.exe
  C:\Windows\System\dXPmnMZ.exe
  2⤵
  PID:5068
- C:\Windows\System\LNVpXSF.exe
  C:\Windows\System\LNVpXSF.exe
  2⤵
  PID:9564
- C:\Windows\System\qQCTqxa.exe
  C:\Windows\System\qQCTqxa.exe
  2⤵
  PID:5836
- C:\Windows\System\hfnYEkR.exe
  C:\Windows\System\hfnYEkR.exe
  2⤵
  PID:5920
- C:\Windows\System\PQeKGZf.exe
  C:\Windows\System\PQeKGZf.exe
  2⤵
  PID:9732
- C:\Windows\System\ejNdndk.exe
  C:\Windows\System\ejNdndk.exe
  2⤵
  PID:5208
- C:\Windows\System\lATAgLI.exe
  C:\Windows\System\lATAgLI.exe
  2⤵
  PID:11236
- C:\Windows\System\ilMJuFn.exe
  C:\Windows\System\ilMJuFn.exe
  2⤵
  PID:4868
- C:\Windows\System\jpfJxSv.exe
  C:\Windows\System\jpfJxSv.exe
  2⤵
  PID:3368
- C:\Windows\System\ROtxfHb.exe
  C:\Windows\System\ROtxfHb.exe
  2⤵
  PID:9484
- C:\Windows\System\tWNWHFb.exe
  C:\Windows\System\tWNWHFb.exe
  2⤵
  PID:5316
- C:\Windows\System\snsMZTQ.exe
  C:\Windows\System\snsMZTQ.exe
  2⤵
  PID:9276
- C:\Windows\System\RYuSeXE.exe
  C:\Windows\System\RYuSeXE.exe
  2⤵
  PID:9652
- C:\Windows\System\CPPEqUJ.exe
  C:\Windows\System\CPPEqUJ.exe
  2⤵
  PID:2888
- C:\Windows\System\fSwxKwr.exe
  C:\Windows\System\fSwxKwr.exe
  2⤵
  PID:11188
- C:\Windows\System\aFHZxjE.exe
  C:\Windows\System\aFHZxjE.exe
  2⤵
  PID:11844
- C:\Windows\System\bYTJtdW.exe
  C:\Windows\System\bYTJtdW.exe
  2⤵
  PID:11484
- C:\Windows\System\OUTjzDF.exe
  C:\Windows\System\OUTjzDF.exe
  2⤵
  PID:5336
- C:\Windows\System\kvOlpgf.exe
  C:\Windows\System\kvOlpgf.exe
  2⤵
  PID:4036
- C:\Windows\System\jAjNLXf.exe
  C:\Windows\System\jAjNLXf.exe
  2⤵
  PID:8676
- C:\Windows\System\yKDSUbA.exe
  C:\Windows\System\yKDSUbA.exe
  2⤵
  PID:5620
- C:\Windows\System\eBlSLQU.exe
  C:\Windows\System\eBlSLQU.exe
  2⤵
  PID:12000
- C:\Windows\System\KAbnGbo.exe
  C:\Windows\System\KAbnGbo.exe
  2⤵
  PID:12096
- C:\Windows\System\ZFBGQkh.exe
  C:\Windows\System\ZFBGQkh.exe
  2⤵
  PID:5848
- C:\Windows\System\JwkEZap.exe
  C:\Windows\System\JwkEZap.exe
  2⤵
  PID:11344
- C:\Windows\System\OJRXYxC.exe
  C:\Windows\System\OJRXYxC.exe
  2⤵
  PID:3452
- C:\Windows\System\kIHntZV.exe
  C:\Windows\System\kIHntZV.exe
  2⤵
  PID:3132
- C:\Windows\System\ImdAJEx.exe
  C:\Windows\System\ImdAJEx.exe
  2⤵
  PID:4228
- C:\Windows\System\NoORmuC.exe
  C:\Windows\System\NoORmuC.exe
  2⤵
  PID:11256
- C:\Windows\System\hDvfBEe.exe
  C:\Windows\System\hDvfBEe.exe
  2⤵
  PID:5600
- C:\Windows\System\hKWWQql.exe
  C:\Windows\System\hKWWQql.exe
  2⤵
  PID:3172
- C:\Windows\System\IPJSeVU.exe
  C:\Windows\System\IPJSeVU.exe
  2⤵
  PID:9492
- C:\Windows\System\CWliAFZ.exe
  C:\Windows\System\CWliAFZ.exe
  2⤵
  PID:4864
- C:\Windows\System\BRaBJSG.exe
  C:\Windows\System\BRaBJSG.exe
  2⤵
  PID:10964
- C:\Windows\System\buzNlBu.exe
  C:\Windows\System\buzNlBu.exe
  2⤵
  PID:5180
- C:\Windows\System\ojCXCNc.exe
  C:\Windows\System\ojCXCNc.exe
  2⤵
  PID:12836
- C:\Windows\System\BZGxJIc.exe
  C:\Windows\System\BZGxJIc.exe
  2⤵
  PID:4376
- C:\Windows\System\GRTITiJ.exe
  C:\Windows\System\GRTITiJ.exe
  2⤵
  PID:5976
- C:\Windows\System\VFNGpre.exe
  C:\Windows\System\VFNGpre.exe
  2⤵
  PID:11404
- C:\Windows\System\hNzyHLw.exe
  C:\Windows\System\hNzyHLw.exe
  2⤵
  PID:6100
- C:\Windows\System\sdezaUv.exe
  C:\Windows\System\sdezaUv.exe
  2⤵
  PID:13060
- C:\Windows\System\zmecfSk.exe
  C:\Windows\System\zmecfSk.exe
  2⤵
  PID:12296
- C:\Windows\System\RLYzQZr.exe
  C:\Windows\System\RLYzQZr.exe
  2⤵
  PID:12416
- C:\Windows\System\JttyHmH.exe
  C:\Windows\System\JttyHmH.exe
  2⤵
  PID:12668
- C:\Windows\System\wMOLQSM.exe
  C:\Windows\System\wMOLQSM.exe
  2⤵
  PID:10776
- C:\Windows\System\lCUJFlW.exe
  C:\Windows\System\lCUJFlW.exe
  2⤵
  PID:3504
- C:\Windows\System\fxfVNyN.exe
  C:\Windows\System\fxfVNyN.exe
  2⤵
  PID:12740
- C:\Windows\System\TKEFkpE.exe
  C:\Windows\System\TKEFkpE.exe
  2⤵
  PID:11388
- C:\Windows\System\XaThBiH.exe
  C:\Windows\System\XaThBiH.exe
  2⤵
  PID:5896
- C:\Windows\System\JxTVmOi.exe
  C:\Windows\System\JxTVmOi.exe
  2⤵
  PID:5284
- C:\Windows\System\sAPuhBP.exe
  C:\Windows\System\sAPuhBP.exe
  2⤵
  PID:12812
- C:\Windows\System\uKkZMrf.exe
  C:\Windows\System\uKkZMrf.exe
  2⤵
  PID:2720
- C:\Windows\System\gxcFRWE.exe
  C:\Windows\System\gxcFRWE.exe
  2⤵
  PID:4520
- C:\Windows\System\ZKojxEY.exe
  C:\Windows\System\ZKojxEY.exe
  2⤵
  PID:5760
- C:\Windows\System\APYFUyY.exe
  C:\Windows\System\APYFUyY.exe
  2⤵
  PID:2176
- C:\Windows\System\UdyLUtZ.exe
  C:\Windows\System\UdyLUtZ.exe
  2⤵
  PID:11548
- C:\Windows\System\AYpajiz.exe
  C:\Windows\System\AYpajiz.exe
  2⤵
  PID:6424
- C:\Windows\System\qNxazbA.exe
  C:\Windows\System\qNxazbA.exe
  2⤵
  PID:12480
- C:\Windows\System\stHXjrI.exe
  C:\Windows\System\stHXjrI.exe
  2⤵
  PID:6956
- C:\Windows\System\WOOrtpH.exe
  C:\Windows\System\WOOrtpH.exe
  2⤵
  PID:5196
- C:\Windows\System\DZtTbZE.exe
  C:\Windows\System\DZtTbZE.exe
  2⤵
  PID:6480
- C:\Windows\System\UVEhdki.exe
  C:\Windows\System\UVEhdki.exe
  2⤵
  PID:12616
- C:\Windows\System\kdlaBOw.exe
  C:\Windows\System\kdlaBOw.exe
  2⤵
  PID:11240
- C:\Windows\System\KGiGhUo.exe
  C:\Windows\System\KGiGhUo.exe
  2⤵
  PID:7056
- C:\Windows\System\zwrlZDR.exe
  C:\Windows\System\zwrlZDR.exe
  2⤵
  PID:5292
- C:\Windows\System\RwrPbSZ.exe
  C:\Windows\System\RwrPbSZ.exe
  2⤵
  PID:7156
- C:\Windows\System\OdgBTdR.exe
  C:\Windows\System\OdgBTdR.exe
  2⤵
  PID:6952
- C:\Windows\System\ULpjgar.exe
  C:\Windows\System\ULpjgar.exe
  2⤵
  PID:6656
- C:\Windows\System\aejmUgG.exe
  C:\Windows\System\aejmUgG.exe
  2⤵
  PID:9704
- C:\Windows\System\kpRyZUI.exe
  C:\Windows\System\kpRyZUI.exe
  2⤵
  PID:6884
- C:\Windows\System\YptcwKy.exe
  C:\Windows\System\YptcwKy.exe
  2⤵
  PID:5992
- C:\Windows\System\lKJoVef.exe
  C:\Windows\System\lKJoVef.exe
  2⤵
  PID:12224
- C:\Windows\System\CvOppdc.exe
  C:\Windows\System\CvOppdc.exe
  2⤵
  PID:7200
- C:\Windows\System\RHhXIyY.exe
  C:\Windows\System\RHhXIyY.exe
  2⤵
  PID:7304
- C:\Windows\System\XLhAiLh.exe
  C:\Windows\System\XLhAiLh.exe
  2⤵
  PID:7324
- C:\Windows\System\jNlOtou.exe
  C:\Windows\System\jNlOtou.exe
  2⤵
  PID:11728
- C:\Windows\System\cRUuWnn.exe
  C:\Windows\System\cRUuWnn.exe
  2⤵
  PID:7512
- C:\Windows\System\jqfyhGQ.exe
  C:\Windows\System\jqfyhGQ.exe
  2⤵
  PID:6180
- C:\Windows\System\lozUUhV.exe
  C:\Windows\System\lozUUhV.exe
  2⤵
  PID:7548
- C:\Windows\System\WeGDBTn.exe
  C:\Windows\System\WeGDBTn.exe
  2⤵
  PID:7352
- C:\Windows\System\tjLPDcr.exe
  C:\Windows\System\tjLPDcr.exe
  2⤵
  PID:2816
- C:\Windows\System\TxjqEsl.exe
  C:\Windows\System\TxjqEsl.exe
  2⤵
  PID:5988
- C:\Windows\System\qhjjLUn.exe
  C:\Windows\System\qhjjLUn.exe
  2⤵
  PID:6076
- C:\Windows\System\hxfqEAJ.exe
  C:\Windows\System\hxfqEAJ.exe
  2⤵
  PID:8892
- C:\Windows\System\QLZXdmY.exe
  C:\Windows\System\QLZXdmY.exe
  2⤵
  PID:712
- C:\Windows\System\SIjCsKq.exe
  C:\Windows\System\SIjCsKq.exe
  2⤵
  PID:12404
- C:\Windows\System\koozywG.exe
  C:\Windows\System\koozywG.exe
  2⤵
  PID:7980
- C:\Windows\System\PqwvhSx.exe
  C:\Windows\System\PqwvhSx.exe
  2⤵
  PID:7332
- C:\Windows\System\DnUjUyj.exe
  C:\Windows\System\DnUjUyj.exe
  2⤵
  PID:7100
- C:\Windows\System\KKHPzjz.exe
  C:\Windows\System\KKHPzjz.exe
  2⤵
  PID:6236
- C:\Windows\System\YDjOuoL.exe
  C:\Windows\System\YDjOuoL.exe
  2⤵
  PID:5344
- C:\Windows\System\MPpQoVF.exe
  C:\Windows\System\MPpQoVF.exe
  2⤵
  PID:10664
- C:\Windows\System\rYCSeQQ.exe
  C:\Windows\System\rYCSeQQ.exe
  2⤵
  PID:8312
- C:\Windows\System\xbGDyyD.exe
  C:\Windows\System\xbGDyyD.exe
  2⤵
  PID:8476
- C:\Windows\System\fuIRunW.exe
  C:\Windows\System\fuIRunW.exe
  2⤵
  PID:8464
- C:\Windows\System\cqNGdan.exe
  C:\Windows\System\cqNGdan.exe
  2⤵
  PID:6812
- C:\Windows\System\GBAyNNS.exe
  C:\Windows\System\GBAyNNS.exe
  2⤵
  PID:6620
- C:\Windows\System\JVLizZQ.exe
  C:\Windows\System\JVLizZQ.exe
  2⤵
  PID:6580
- C:\Windows\System\GgCVosT.exe
  C:\Windows\System\GgCVosT.exe
  2⤵
  PID:5984
- C:\Windows\System\OdrzBDs.exe
  C:\Windows\System\OdrzBDs.exe
  2⤵
  PID:5568
- C:\Windows\System\mRVaxBH.exe
  C:\Windows\System\mRVaxBH.exe
  2⤵
  PID:5672
- C:\Windows\System\bBeKWMA.exe
  C:\Windows\System\bBeKWMA.exe
  2⤵
  PID:9116
- C:\Windows\System\srPKSLk.exe
  C:\Windows\System\srPKSLk.exe
  2⤵
  PID:6260
- C:\Windows\System\ljWxfel.exe
  C:\Windows\System\ljWxfel.exe
  2⤵
  PID:8256
- C:\Windows\System\zNsFiQy.exe
  C:\Windows\System\zNsFiQy.exe
  2⤵
  PID:8048
- C:\Windows\System\gfoJVmY.exe
  C:\Windows\System\gfoJVmY.exe
  2⤵
  PID:4032
- C:\Windows\System\KjHtLWK.exe
  C:\Windows\System\KjHtLWK.exe
  2⤵
  PID:11468
- C:\Windows\System\UyCqbFm.exe
  C:\Windows\System\UyCqbFm.exe
  2⤵
  PID:9096
- C:\Windows\System\zLWZCBd.exe
  C:\Windows\System\zLWZCBd.exe
  2⤵
  PID:6168
- C:\Windows\System\YrJWgDZ.exe
  C:\Windows\System\YrJWgDZ.exe
  2⤵
  PID:1280
- C:\Windows\System\hISvcqa.exe
  C:\Windows\System\hISvcqa.exe
  2⤵
  PID:9268
- C:\Windows\System\DglYlHl.exe
  C:\Windows\System\DglYlHl.exe
  2⤵
  PID:9280
- C:\Windows\System\UCRFhxE.exe
  C:\Windows\System\UCRFhxE.exe
  2⤵
  PID:7736
- C:\Windows\System\Chwlppw.exe
  C:\Windows\System\Chwlppw.exe
  2⤵
  PID:7888
- C:\Windows\System\tNkvUzP.exe
  C:\Windows\System\tNkvUzP.exe
  2⤵
  PID:9596
- C:\Windows\System\twLsADM.exe
  C:\Windows\System\twLsADM.exe
  2⤵
  PID:9800
- C:\Windows\System\CulUifJ.exe
  C:\Windows\System\CulUifJ.exe
  2⤵
  PID:8108
- C:\Windows\System\YnDRxGJ.exe
  C:\Windows\System\YnDRxGJ.exe
  2⤵
  PID:10056
- C:\Windows\System\gOEmWlO.exe
  C:\Windows\System\gOEmWlO.exe
  2⤵
  PID:10132
- C:\Windows\System\GNKQQdv.exe
  C:\Windows\System\GNKQQdv.exe
  2⤵
  PID:8128
- C:\Windows\System\jiphAoL.exe
  C:\Windows\System\jiphAoL.exe
  2⤵
  PID:8244
- C:\Windows\System\lbkTwUs.exe
  C:\Windows\System\lbkTwUs.exe
  2⤵
  PID:12584
- C:\Windows\System\meEpwGH.exe
  C:\Windows\System\meEpwGH.exe
  2⤵
  PID:10388
- C:\Windows\System\mxgYZCD.exe
  C:\Windows\System\mxgYZCD.exe
  2⤵
  PID:8632
- C:\Windows\System\svksGwR.exe
  C:\Windows\System\svksGwR.exe
  2⤵
  PID:6348
- C:\Windows\System\UoOOjbV.exe
  C:\Windows\System\UoOOjbV.exe
  2⤵
  PID:10748
- C:\Windows\System\WJjIzjf.exe
  C:\Windows\System\WJjIzjf.exe
  2⤵
  PID:8768
- C:\Windows\System\xGbKfgX.exe
  C:\Windows\System\xGbKfgX.exe
  2⤵
  PID:9080
- C:\Windows\System\qamKEoi.exe
  C:\Windows\System\qamKEoi.exe
  2⤵
  PID:10828
- C:\Windows\System\IsyyCKJ.exe
  C:\Windows\System\IsyyCKJ.exe
  2⤵
  PID:6692
- C:\Windows\System\ZCDSFRq.exe
  C:\Windows\System\ZCDSFRq.exe
  2⤵
  PID:3492
- C:\Windows\System\PpsFgDW.exe
  C:\Windows\System\PpsFgDW.exe
  2⤵
  PID:9112
- C:\Windows\System\yvhUYZT.exe
  C:\Windows\System\yvhUYZT.exe
  2⤵
  PID:7356
- C:\Windows\System\tozwicN.exe
  C:\Windows\System\tozwicN.exe
  2⤵
  PID:10692
- C:\Windows\System\BxmaZUT.exe
  C:\Windows\System\BxmaZUT.exe
  2⤵
  PID:11044
- C:\Windows\System\mHggmqS.exe
  C:\Windows\System\mHggmqS.exe
  2⤵
  PID:11016
- C:\Windows\System\AVvgpbt.exe
  C:\Windows\System\AVvgpbt.exe
  2⤵
  PID:11048
- C:\Windows\System\AGgxUuC.exe
  C:\Windows\System\AGgxUuC.exe
  2⤵
  PID:4476
- C:\Windows\System\sChwbMB.exe
  C:\Windows\System\sChwbMB.exe
  2⤵
  PID:8604
- C:\Windows\System\jayMOYf.exe
  C:\Windows\System\jayMOYf.exe
  2⤵
  PID:9448
- C:\Windows\System\FiQdohU.exe
  C:\Windows\System\FiQdohU.exe
  2⤵
  PID:7540
- C:\Windows\System\GIsVhRc.exe
  C:\Windows\System\GIsVhRc.exe
  2⤵
  PID:8360
- C:\Windows\System\gQItCTE.exe
  C:\Windows\System\gQItCTE.exe
  2⤵
  PID:6148
- C:\Windows\System\jJZtzye.exe
  C:\Windows\System\jJZtzye.exe
  2⤵
  PID:1920
- C:\Windows\System\yoyVjYR.exe
  C:\Windows\System\yoyVjYR.exe
  2⤵
  PID:9540
- C:\Windows\System\esUaqLU.exe
  C:\Windows\System\esUaqLU.exe
  2⤵
  PID:9392
- C:\Windows\System\MdCenbd.exe
  C:\Windows\System\MdCenbd.exe
  2⤵
  PID:9612
- C:\Windows\System\eocZYDq.exe
  C:\Windows\System\eocZYDq.exe
  2⤵
  PID:9616
- C:\Windows\System\Mdvuztv.exe
  C:\Windows\System\Mdvuztv.exe
  2⤵
  PID:3144
- C:\Windows\System\LHNvvun.exe
  C:\Windows\System\LHNvvun.exe
  2⤵
  PID:12456
- C:\Windows\System\jpYdsgA.exe
  C:\Windows\System\jpYdsgA.exe
  2⤵
  PID:9904
- C:\Windows\System\ghfVZJD.exe
  C:\Windows\System\ghfVZJD.exe
  2⤵
  PID:6904
- C:\Windows\System\LbEDEXa.exe
  C:\Windows\System\LbEDEXa.exe
  2⤵
  PID:10044
- C:\Windows\System\eMcjnPd.exe
  C:\Windows\System\eMcjnPd.exe
  2⤵
  PID:9524
- C:\Windows\System\VafNKZW.exe
  C:\Windows\System\VafNKZW.exe
  2⤵
  PID:11308
- C:\Windows\System\cVUXgnS.exe
  C:\Windows\System\cVUXgnS.exe
  2⤵
  PID:7912
- C:\Windows\System\LeQxqbL.exe
  C:\Windows\System\LeQxqbL.exe
  2⤵
  PID:10788
- C:\Windows\System\WBgqhCb.exe
  C:\Windows\System\WBgqhCb.exe
  2⤵
  PID:6532
- C:\Windows\System\iHcmWiI.exe
  C:\Windows\System\iHcmWiI.exe
  2⤵
  PID:10412
- C:\Windows\System\xXohyLh.exe
  C:\Windows\System\xXohyLh.exe
  2⤵
  PID:10740
- C:\Windows\System\dWMpZbV.exe
  C:\Windows\System\dWMpZbV.exe
  2⤵
  PID:10416
- C:\Windows\System\nEmuLFo.exe
  C:\Windows\System\nEmuLFo.exe
  2⤵
  PID:10540
- C:\Windows\System\NamwDlh.exe
  C:\Windows\System\NamwDlh.exe
  2⤵
  PID:10588
- C:\Windows\System\LJolMSv.exe
  C:\Windows\System\LJolMSv.exe
  2⤵
  PID:6800
- C:\Windows\System\fvRkrQO.exe
  C:\Windows\System\fvRkrQO.exe
  2⤵
  PID:11804
- C:\Windows\System\DBaRevR.exe
  C:\Windows\System\DBaRevR.exe
  2⤵
  PID:8996
- C:\Windows\System\XfPRvhO.exe
  C:\Windows\System\XfPRvhO.exe
  2⤵
  PID:10668
- C:\Windows\System\MKTSsyF.exe
  C:\Windows\System\MKTSsyF.exe
  2⤵
  PID:9148
- C:\Windows\System\IpkcZhb.exe
  C:\Windows\System\IpkcZhb.exe
  2⤵
  PID:2064
- C:\Windows\System\wnkqmUU.exe
  C:\Windows\System\wnkqmUU.exe
  2⤵
  PID:10988
- C:\Windows\System\NXldYyp.exe
  C:\Windows\System\NXldYyp.exe
  2⤵
  PID:11512
- C:\Windows\System\vLAbJht.exe
  C:\Windows\System\vLAbJht.exe
  2⤵
  PID:3372
- C:\Windows\System\HTdFkvq.exe
  C:\Windows\System\HTdFkvq.exe
  2⤵
  PID:11868
- C:\Windows\System\AULTZrL.exe
  C:\Windows\System\AULTZrL.exe
  2⤵
  PID:8948
- C:\Windows\System\eJUTMtb.exe
  C:\Windows\System\eJUTMtb.exe
  2⤵
  PID:9068
- C:\Windows\System\pwihxkG.exe
  C:\Windows\System\pwihxkG.exe
  2⤵
  PID:7648
- C:\Windows\System\CrkCqiU.exe
  C:\Windows\System\CrkCqiU.exe
  2⤵
  PID:9108
- C:\Windows\System\FOYrHQA.exe
  C:\Windows\System\FOYrHQA.exe
  2⤵
  PID:12884
- C:\Windows\System\fhbAAPj.exe
  C:\Windows\System\fhbAAPj.exe
  2⤵
  PID:11180
- C:\Windows\System\cSaDDMj.exe
  C:\Windows\System\cSaDDMj.exe
  2⤵
  PID:9328
- C:\Windows\System\TEhHqPy.exe
  C:\Windows\System\TEhHqPy.exe
  2⤵
  PID:9388
- C:\Windows\System\EjczAAE.exe
  C:\Windows\System\EjczAAE.exe
  2⤵
  PID:116
- C:\Windows\System\RKAJUok.exe
  C:\Windows\System\RKAJUok.exe
  2⤵
  PID:3176
- C:\Windows\System\CTgfAca.exe
  C:\Windows\System\CTgfAca.exe
  2⤵
  PID:9656
- C:\Windows\System\doLxQrt.exe
  C:\Windows\System\doLxQrt.exe
  2⤵
  PID:12384
- C:\Windows\System\WarHqeM.exe
  C:\Windows\System\WarHqeM.exe
  2⤵
  PID:9964
- C:\Windows\System\xjPAHGd.exe
  C:\Windows\System\xjPAHGd.exe
  2⤵
  PID:10896
- C:\Windows\System\uuwxaoB.exe
  C:\Windows\System\uuwxaoB.exe
  2⤵
  PID:6684
- C:\Windows\System\Lsugivo.exe
  C:\Windows\System\Lsugivo.exe
  2⤵
  PID:10232
- C:\Windows\System\hBFrkMj.exe
  C:\Windows\System\hBFrkMj.exe
  2⤵
  PID:10992
- C:\Windows\System\yvhNQEf.exe
  C:\Windows\System\yvhNQEf.exe
  2⤵
  PID:10156
- C:\Windows\System\TUPoSeX.exe
  C:\Windows\System\TUPoSeX.exe
  2⤵
  PID:7116
- C:\Windows\System\VfCHFLa.exe
  C:\Windows\System\VfCHFLa.exe
  2⤵
  PID:9608
- C:\Windows\System\CWpMaah.exe
  C:\Windows\System\CWpMaah.exe
  2⤵
  PID:12656
- C:\Windows\System\ILHHRPx.exe
  C:\Windows\System\ILHHRPx.exe
  2⤵
  PID:10752
- C:\Windows\System\GTkvpxl.exe
  C:\Windows\System\GTkvpxl.exe
  2⤵
  PID:10604
- C:\Windows\System\pVmVNKl.exe
  C:\Windows\System\pVmVNKl.exe
  2⤵
  PID:11432
- C:\Windows\System\TOhDZpG.exe
  C:\Windows\System\TOhDZpG.exe
  2⤵
  PID:12412
- C:\Windows\System\zgibCOx.exe
  C:\Windows\System\zgibCOx.exe
  2⤵
  PID:11932
- C:\Windows\System\khdbWuv.exe
  C:\Windows\System\khdbWuv.exe
  2⤵
  PID:12724
- C:\Windows\System\LftvnCe.exe
  C:\Windows\System\LftvnCe.exe
  2⤵
  PID:12112
- C:\Windows\System\UvOpYNV.exe
  C:\Windows\System\UvOpYNV.exe
  2⤵
  PID:12248
- C:\Windows\System\RkJgGLg.exe
  C:\Windows\System\RkJgGLg.exe
  2⤵
  PID:11100
- C:\Windows\System\yaMfFps.exe
  C:\Windows\System\yaMfFps.exe
  2⤵
  PID:10984
- C:\Windows\System\pJbuLnu.exe
  C:\Windows\System\pJbuLnu.exe
  2⤵
  PID:12196
- C:\Windows\System\tIyYHls.exe
  C:\Windows\System\tIyYHls.exe
  2⤵
  PID:10848
- C:\Windows\System\SJPIXws.exe
  C:\Windows\System\SJPIXws.exe
  2⤵
  PID:7296
- C:\Windows\System\jSzeKki.exe
  C:\Windows\System\jSzeKki.exe
  2⤵
  PID:8608
- C:\Windows\System\EUNkGSn.exe
  C:\Windows\System\EUNkGSn.exe
  2⤵
  PID:12132
- C:\Windows\System\Rcjycas.exe
  C:\Windows\System\Rcjycas.exe
  2⤵
  PID:8648
- C:\Windows\System\GNRNkQW.exe
  C:\Windows\System\GNRNkQW.exe
  2⤵
  PID:7680
- C:\Windows\System\bsmpufV.exe
  C:\Windows\System\bsmpufV.exe
  2⤵
  PID:6044
- C:\Windows\System\aspPKrD.exe
  C:\Windows\System\aspPKrD.exe
  2⤵
  PID:7244
- C:\Windows\System\FEsalYi.exe
  C:\Windows\System\FEsalYi.exe
  2⤵
  PID:10832
- C:\Windows\System\wkvhKaH.exe
  C:\Windows\System\wkvhKaH.exe
  2⤵
  PID:1988
- C:\Windows\System\vSJpMUb.exe
  C:\Windows\System\vSJpMUb.exe
  2⤵
  PID:10696
- C:\Windows\System\AnkjXBb.exe
  C:\Windows\System\AnkjXBb.exe
  2⤵
  PID:4808
- C:\Windows\System\QJgqyKg.exe
  C:\Windows\System\QJgqyKg.exe
  2⤵
  PID:8444
- C:\Windows\System\eAwcIEY.exe
  C:\Windows\System\eAwcIEY.exe
  2⤵
  PID:8376
- C:\Windows\System\wvoOzFi.exe
  C:\Windows\System\wvoOzFi.exe
  2⤵
  PID:9632
- C:\Windows\System\VdtaFKC.exe
  C:\Windows\System\VdtaFKC.exe
  2⤵
  PID:7592
- C:\Windows\System\KXsBjkH.exe
  C:\Windows\System\KXsBjkH.exe
  2⤵
  PID:9600
- C:\Windows\System\OuXmNtv.exe
  C:\Windows\System\OuXmNtv.exe
  2⤵
  PID:4784
- C:\Windows\System\sJNyerD.exe
  C:\Windows\System\sJNyerD.exe
  2⤵
  PID:10292
- C:\Windows\System\cbtgvfa.exe
  C:\Windows\System\cbtgvfa.exe
  2⤵
  PID:6916
- C:\Windows\System\clVFONR.exe
  C:\Windows\System\clVFONR.exe
  2⤵
  PID:12116
- C:\Windows\System\gnPXcLa.exe
  C:\Windows\System\gnPXcLa.exe
  2⤵
  PID:13196
- C:\Windows\System\cIjLwXJ.exe
  C:\Windows\System\cIjLwXJ.exe
  2⤵
  PID:6488
- C:\Windows\System\HlUIdzO.exe
  C:\Windows\System\HlUIdzO.exe
  2⤵
  PID:9952
- C:\Windows\System\CxTgQfR.exe
  C:\Windows\System\CxTgQfR.exe
  2⤵
  PID:10516
- C:\Windows\System\cQvzhrc.exe
  C:\Windows\System\cQvzhrc.exe
  2⤵
  PID:11052
- C:\Windows\System\ugEeVmi.exe
  C:\Windows\System\ugEeVmi.exe
  2⤵
  PID:12140
- C:\Windows\System\octMmjo.exe
  C:\Windows\System\octMmjo.exe
  2⤵
  PID:11376
- C:\Windows\System\NtMGQtd.exe
  C:\Windows\System\NtMGQtd.exe
  2⤵
  PID:9876
- C:\Windows\System\AgoJTnI.exe
  C:\Windows\System\AgoJTnI.exe
  2⤵
  PID:13340
- C:\Windows\System\mQrRhAL.exe
  C:\Windows\System\mQrRhAL.exe
  2⤵
  PID:13368
- C:\Windows\System\KhYEvAd.exe
  C:\Windows\System\KhYEvAd.exe
  2⤵
  PID:13396
- C:\Windows\System\zUSRAoU.exe
  C:\Windows\System\zUSRAoU.exe
  2⤵
  PID:13424
- C:\Windows\System\MfdVPci.exe
  C:\Windows\System\MfdVPci.exe
  2⤵
  PID:13452
- C:\Windows\System\diFZest.exe
  C:\Windows\System\diFZest.exe
  2⤵
  PID:13480
- C:\Windows\System\kKgjGVD.exe
  C:\Windows\System\kKgjGVD.exe
  2⤵
  PID:13508
- C:\Windows\System\algLWLQ.exe
  C:\Windows\System\algLWLQ.exe
  2⤵
  PID:13536
- C:\Windows\System\ZhjxDpt.exe
  C:\Windows\System\ZhjxDpt.exe
  2⤵
  PID:13568
- C:\Windows\System\vTHTNjy.exe
  C:\Windows\System\vTHTNjy.exe
  2⤵
  PID:13596
- C:\Windows\System\Gsvwywx.exe
  C:\Windows\System\Gsvwywx.exe
  2⤵
  PID:13624
- C:\Windows\System\TXlJttP.exe
  C:\Windows\System\TXlJttP.exe
  2⤵
  PID:13656
- C:\Windows\System\JXuTevY.exe
  C:\Windows\System\JXuTevY.exe
  2⤵
  PID:13680
- C:\Windows\System\ALekzKe.exe
  C:\Windows\System\ALekzKe.exe
  2⤵
  PID:13712
- C:\Windows\System\gqiupgK.exe
  C:\Windows\System\gqiupgK.exe
  2⤵
  PID:13740
- C:\Windows\System\FfAJQzK.exe
  C:\Windows\System\FfAJQzK.exe
  2⤵
  PID:13768
- C:\Windows\System\BbKkYUW.exe
  C:\Windows\System\BbKkYUW.exe
  2⤵
  PID:13796
- C:\Windows\System\GsMSOzX.exe
  C:\Windows\System\GsMSOzX.exe
  2⤵
  PID:13824
- C:\Windows\System\IWjLJJc.exe
  C:\Windows\System\IWjLJJc.exe
  2⤵
  PID:13852
- C:\Windows\System\xzNpmaw.exe
  C:\Windows\System\xzNpmaw.exe
  2⤵
  PID:13940
- C:\Windows\System\IbSoCxV.exe
  C:\Windows\System\IbSoCxV.exe
  2⤵
  PID:13968
- C:\Windows\System\HreMcxw.exe
  C:\Windows\System\HreMcxw.exe
  2⤵
  PID:13996
- C:\Windows\System\EjvEMnF.exe
  C:\Windows\System\EjvEMnF.exe
  2⤵
  PID:14024
- C:\Windows\System\BtbcdOb.exe
  C:\Windows\System\BtbcdOb.exe
  2⤵
  PID:14052
- C:\Windows\System\HMwJTav.exe
  C:\Windows\System\HMwJTav.exe
  2⤵
  PID:14080
- C:\Windows\System\FolChkL.exe
  C:\Windows\System\FolChkL.exe
  2⤵
  PID:14100
- C:\Windows\System\uUjlxav.exe
  C:\Windows\System\uUjlxav.exe
  2⤵
  PID:14120
- C:\Windows\System\NENfGsm.exe
  C:\Windows\System\NENfGsm.exe
  2⤵
  PID:14164
- C:\Windows\System\XYWqbQA.exe
  C:\Windows\System\XYWqbQA.exe
  2⤵
  PID:14196
- C:\Windows\System\JFZYzSd.exe
  C:\Windows\System\JFZYzSd.exe
  2⤵
  PID:14224
- C:\Windows\System\RBEfDPe.exe
  C:\Windows\System\RBEfDPe.exe
  2⤵
  PID:14252
- C:\Windows\System\zRPMUkV.exe
  C:\Windows\System\zRPMUkV.exe
  2⤵
  PID:14280
- C:\Windows\System\mCLsQLW.exe
  C:\Windows\System\mCLsQLW.exe
  2⤵
  PID:14308
- C:\Windows\System\VvkLqMH.exe
  C:\Windows\System\VvkLqMH.exe
  2⤵
  PID:13320
- C:\Windows\System\eKUSZUS.exe
  C:\Windows\System\eKUSZUS.exe
  2⤵
  PID:13384
- C:\Windows\System\lFesvTj.exe
  C:\Windows\System\lFesvTj.exe
  2⤵
  PID:13448
- C:\Windows\System\xgCmFgW.exe
  C:\Windows\System\xgCmFgW.exe
  2⤵
  PID:13504
- C:\Windows\System\oEoBFLM.exe
  C:\Windows\System\oEoBFLM.exe
  2⤵
  PID:13564
- C:\Windows\System\uXaoKGw.exe
  C:\Windows\System\uXaoKGw.exe
  2⤵
  PID:3556
- C:\Windows\System\ZGqMLcg.exe
  C:\Windows\System\ZGqMLcg.exe
  2⤵
  PID:13620
- C:\Windows\System\wxBFMez.exe
  C:\Windows\System\wxBFMez.exe
  2⤵
  PID:4580
- C:\Windows\System\cfKZetU.exe
  C:\Windows\System\cfKZetU.exe
  2⤵
  PID:13708
- C:\Windows\System\alVsENk.exe
  C:\Windows\System\alVsENk.exe
  2⤵
  PID:768
- C:\Windows\System\jirhkzU.exe
  C:\Windows\System\jirhkzU.exe
  2⤵
  PID:13776
- C:\Windows\System\PURcMdA.exe
  C:\Windows\System\PURcMdA.exe
  2⤵
  PID:13832
- C:\Windows\System\RhqgUrw.exe
  C:\Windows\System\RhqgUrw.exe
  2⤵
  PID:13912
- C:\Windows\System\ZeWQDAw.exe
  C:\Windows\System\ZeWQDAw.exe
  2⤵
  PID:13876
- C:\Windows\System\lifgWcR.exe
  C:\Windows\System\lifgWcR.exe
  2⤵
  PID:13920
- C:\Windows\System\YiWQglw.exe
  C:\Windows\System\YiWQglw.exe
  2⤵
  PID:13992
- C:\Windows\System\ZcFiDim.exe
  C:\Windows\System\ZcFiDim.exe
  2⤵
  PID:14048
- C:\Windows\System\RauKVED.exe
  C:\Windows\System\RauKVED.exe
  2⤵
  PID:14092
- C:\Windows\System\aMkNqvC.exe
  C:\Windows\System\aMkNqvC.exe
  2⤵
  PID:14184
- C:\Windows\System\NuVJlcy.exe
  C:\Windows\System\NuVJlcy.exe
  2⤵
  PID:14248
- C:\Windows\System\EtqKHLn.exe
  C:\Windows\System\EtqKHLn.exe
  2⤵
  PID:14316
- C:\Windows\System\vwzvboD.exe
  C:\Windows\System\vwzvboD.exe
  2⤵
  PID:13356
- C:\Windows\System\jXuTWwz.exe
  C:\Windows\System\jXuTWwz.exe
  2⤵
  PID:13440
- C:\Windows\System\LvJnrfW.exe
  C:\Windows\System\LvJnrfW.exe
  2⤵
  PID:13604
- C:\Windows\System\FznDHxy.exe
  C:\Windows\System\FznDHxy.exe
  2⤵
  PID:4516
- C:\Windows\System\tOTbAtU.exe
  C:\Windows\System\tOTbAtU.exe
  2⤵
  PID:13144
- C:\Windows\System\eJFgJNo.exe
  C:\Windows\System\eJFgJNo.exe
  2⤵
  PID:13904
- C:\Windows\System\wLmAKsY.exe
  C:\Windows\System\wLmAKsY.exe
  2⤵
  PID:13948
- C:\Windows\System\SOANyag.exe
  C:\Windows\System\SOANyag.exe
  2⤵
  PID:14088
- C:\Windows\System\dIOUuPb.exe
  C:\Windows\System\dIOUuPb.exe
  2⤵
  PID:14268
- C:\Windows\System\FofUmZk.exe
  C:\Windows\System\FofUmZk.exe
  2⤵
  PID:13524
- C:\Windows\System\njVmHHh.exe
  C:\Windows\System\njVmHHh.exe
  2⤵
  PID:1528
- C:\Windows\System\OwfjPvw.exe
  C:\Windows\System\OwfjPvw.exe
  2⤵
  PID:6588
- C:\Windows\System\CUxKGyV.exe
  C:\Windows\System\CUxKGyV.exe
  2⤵
  PID:13476
- C:\Windows\System\eZyDdeI.exe
  C:\Windows\System\eZyDdeI.exe
  2⤵
  PID:4640
- C:\Windows\System\ZzxabGH.exe
  C:\Windows\System\ZzxabGH.exe
  2⤵
  PID:14220
- C:\Windows\System\zVsHDEC.exe
  C:\Windows\System\zVsHDEC.exe
  2⤵
  PID:13612
- C:\Windows\System\myFlPhx.exe
  C:\Windows\System\myFlPhx.exe
  2⤵
  PID:14176
- C:\Windows\System\xquXVCp.exe
  C:\Windows\System\xquXVCp.exe
  2⤵
  PID:13984
- C:\Windows\System\jUkYIIz.exe
  C:\Windows\System\jUkYIIz.exe
  2⤵
  PID:14364
- C:\Windows\System\yDvpdnE.exe
  C:\Windows\System\yDvpdnE.exe
  2⤵
  PID:14344
- C:\Windows\System\pabfwQz.exe
  C:\Windows\System\pabfwQz.exe
  2⤵
  PID:14488
- C:\Windows\System\oBzzoxE.exe
  C:\Windows\System\oBzzoxE.exe
  2⤵
  PID:14524
- C:\Windows\System\VzKsiKG.exe
  C:\Windows\System\VzKsiKG.exe
  2⤵
  PID:14688
- C:\Windows\System\WnVfJtg.exe
  C:\Windows\System\WnVfJtg.exe
  2⤵
  PID:14736
- C:\Windows\System\uEIuOhx.exe
  C:\Windows\System\uEIuOhx.exe
  2⤵
  PID:14776
- C:\Windows\System\MYXDLUT.exe
  C:\Windows\System\MYXDLUT.exe
  2⤵
  PID:14832
- C:\Windows\System\BfVbbOc.exe
  C:\Windows\System\BfVbbOc.exe
  2⤵
  PID:15204
- C:\Windows\System\lstuAMf.exe
  C:\Windows\System\lstuAMf.exe
  2⤵
  PID:14588
- C:\Windows\System\Dyxndpp.exe
  C:\Windows\System\Dyxndpp.exe
  2⤵
  PID:8004
- C:\Windows\System\KHaQsot.exe
  C:\Windows\System\KHaQsot.exe
  2⤵
  PID:9808
- C:\Windows\System\acNUucN.exe
  C:\Windows\System\acNUucN.exe
  2⤵
  PID:15120
- C:\Windows\System\TGbzeui.exe
  C:\Windows\System\TGbzeui.exe
  2⤵
  PID:9804
- C:\Windows\System\YhxRJFW.exe
  C:\Windows\System\YhxRJFW.exe
  2⤵
  PID:14472
- C:\Windows\System\mRDkbbk.exe
  C:\Windows\System\mRDkbbk.exe
  2⤵
  PID:8508
- C:\Windows\System\GQSMhIO.exe
  C:\Windows\System\GQSMhIO.exe
  2⤵
  PID:14624
- C:\Windows\System\kRZRhlB.exe
  C:\Windows\System\kRZRhlB.exe
  2⤵
  PID:10744
- C:\Windows\System\DLQimuG.exe
  C:\Windows\System\DLQimuG.exe
  2⤵
  PID:3360
- C:\Windows\System\ikxqlVa.exe
  C:\Windows\System\ikxqlVa.exe
  2⤵
  PID:13420
- C:\Windows\System\LycEUmM.exe
  C:\Windows\System\LycEUmM.exe
  2⤵
  PID:14972
- C:\Windows\System\CYzdlAt.exe
  C:\Windows\System\CYzdlAt.exe
  2⤵
  PID:15032
- C:\Windows\System\FJoiVdO.exe
  C:\Windows\System\FJoiVdO.exe
  2⤵
  PID:15076
- C:\Windows\System\dsFLNCm.exe
  C:\Windows\System\dsFLNCm.exe
  2⤵
  PID:7428
- C:\Windows\System\CsvPxCA.exe
  C:\Windows\System\CsvPxCA.exe
  2⤵
  PID:14580
- C:\Windows\System\lOvbGXs.exe
  C:\Windows\System\lOvbGXs.exe
  2⤵
  PID:14628
- C:\Windows\System\CcifovA.exe
  C:\Windows\System\CcifovA.exe
  2⤵
  PID:14644
- C:\Windows\System\LgLWNEo.exe
  C:\Windows\System\LgLWNEo.exe
  2⤵
  PID:14664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p12bjpgk.2hu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CDravVd.exe

Filesize
18B

MD5
245dee33bd0829fb0a14fffbb01cddca

SHA1
3098465efbb0ab58d084dea73fb53b7464aa2124

SHA256
42ab9954ae85f062ea70b5a38d7cb35251b9594624f80f499a57a579cabb5d86

SHA512
4a249b410305275b4e8f1049bfb6debe0c906ca24cdd1c084f91263bd1208ad51b8937135ff9506b71885993cc7bafe2c69d5ba8bf11fa3ad12e247f4d803429

Download Submit
C:\Windows\System\ChhcWAJ.exe

Filesize
1.8MB

MD5
368a53afe14dc1e0ba9f8d4ebaa697b5

SHA1
596b2b13494713225ba26ed2c794d4c30f73582a

SHA256
79d364836b473732e3c8f2e39286905933cc728cd1f9af0991a59b8d71e2b32e

SHA512
abfec23264ab674567e0df292240981ac91dfc34f8d1611155839786b47bcfb415af8bf529557843c28d1272fcef5bdad22177c6b6db70ab7791c05d1a2f59da

Download Submit
C:\Windows\System\CpkZrgC.exe

Filesize
1.8MB

MD5
c4207ac53295b9f3c80740444b2c458a

SHA1
e6f989d141103ea2566d82d9ffd728ccb72e53dd

SHA256
26dc797477e4c311ce2234adb551cf5ac39fc29b814d45b9dceb060fa207377c

SHA512
0f08fbc89503c32af84121572b2743c6a570f7cfcde08a9ac865c00364830bb63ffc894eaeb1aa81c451d490e22e0a025258c9e377f8dbcb23838a7507db72d2

Download Submit
C:\Windows\System\EYhMPHv.exe

Filesize
1.8MB

MD5
f51085224a45795649edcd5b9b3a7790

SHA1
bb6161328fef16159c1645eecd99d7ce05bacafc

SHA256
cb5f5416a803583d122e6195ab0d62292a40f603b8d5cce943f8d8a71f67166f

SHA512
dcb462ef2ac8293d0e73cd5709e47e45daced29afa80e73211e5cbfddf1bd7af6f683b6f48b44d1b560b9bb0476c653e1a94b9af425ee33d9bded8aced25a01c

Download Submit
C:\Windows\System\EfJqDSE.exe

Filesize
1.8MB

MD5
07f6ca20db857a94f0363759851490d2

SHA1
acad44ada8ffb74ff59d6f36414cdfa34ed3c7e1

SHA256
cb4945be03284da37988ee2c94f6012b102101a8623caf05566756c37f1fb372

SHA512
fe9066004311d68f19a1767b6ee13f35d21d172f287ab8ceeffbf7c26217e3810029d0b2591ed4c738d9cd952586d627e25823a07dc645f163336fa5dfb60585

Download Submit
C:\Windows\System\FkXnGFm.exe

Filesize
1.8MB

MD5
f7d653db8d8b0bf0821095faede070c7

SHA1
f516993ea828854de1c723d10ff98f68ee8bdccf

SHA256
53c30b6c72bead72bd9131c040aeedbcb6b548b98f1f57a961b326c2ee05d6f8

SHA512
819988e4e439f6dc765ddcd61b5436fca9864240070f9e5356e964208d20d91cef68d2101daa51f3cf7b3819fe6a74224b677c62f250db626acbd86d000ff75f

Download Submit
C:\Windows\System\FkgQFuO.exe

Filesize
1.8MB

MD5
cff7d23aa79d9222509892a278905c84

SHA1
82ba3781c9bd411a2af93b3d55060b1710c076c9

SHA256
a8cceb50db4ed92266075a55f2e2fc3d65d6edbe34c449f7c60b73c773e5baa3

SHA512
9cd4a9833d38efb6fea72b3bc40cf93f189f8ff6347b0dcfdc0982694ba9f4eb2f8b23a601ed242226511d787f168ece8f3edebf6f5d52744e8fdc05131b7880

Download Submit
C:\Windows\System\HzMUbUT.exe

Filesize
1.8MB

MD5
b6959054a71f8aaccb547cd1eae1a6f6

SHA1
4330530be0d3acd2a2017af2b457c5873d2afe89

SHA256
8ed77c26ccf90fb9b2eb05c4cc14d2a2346fa380ec4f2d88bc186e9e178a1b5f

SHA512
aa2d5715d5a98cd6a02d9d2fd284397133376c7819b57bde7fe905fffbf254f5b82fc1e2040e6c18bcef8b7caf2b4678f290dd071f5c7492f9b3b716915924fd

Download Submit
C:\Windows\System\JQuoVmq.exe

Filesize
1.8MB

MD5
26aae8d01d4c93d67c7b89bc633b54bb

SHA1
cf5cc109dcc40551406480332a9d42718e884532

SHA256
f7a4631599d083137fc4ce09abfdb4ae6790ada7179b1c287385ca89671a30a6

SHA512
4a36e24b88646747beccca6bd9084d7ca5785e956114c7a1304dc8f6626d87a18c0dfa348f9d34465f6293f940dcfe931ea57130ff958aa5d5aa5e5853e81cff

Download Submit
C:\Windows\System\LivKGKV.exe

Filesize
1.8MB

MD5
ba78af7d85f4b6a1d970020bd931185a

SHA1
b9a419b16f14d90a18e629603caf0a52421efbb8

SHA256
26282ca395974e2dff2c5cd57f82510a079376e9ee7d49d8bd708153dc4a435c

SHA512
08b22ea6330786a5fa4d3ce0cde079b384990e4a993c7255a7159574af4d121e68b9aa2e504fbeffb0771659507125d24502d9cdc79394f268ad4c296594ff91

Download Submit
C:\Windows\System\LvaUNyS.exe

Filesize
1.8MB

MD5
2d384ed7ed03af02414e369837cb312c

SHA1
fea7ecb1a4cb83987dfea3a766fcad354c578882

SHA256
513b6d39d0fb17b4c240da39233b972495a1955207a04d6f1c8ee359689a75ad

SHA512
22c1dfdc2e395553f542be982e74e91b2a4cde230197bfccfca5ce81417808071a01ad96ff515affd6b094c8f1e6c7709683e9c97f6a01621875eaf225e8f72b

Download Submit
C:\Windows\System\MCQNuVt.exe

Filesize
1.8MB

MD5
046b90145868ea906f8bb181aeb09dff

SHA1
5513adb1266f4d320154681b523232ebcf612924

SHA256
b6c0323d434b266c079d84ea5ad0b3fb09218d00c0d0d2f02012de43fc710375

SHA512
edf6a9f6393476c9fedbce28f1073552244cbb41725079f16c0aa6a5083de8e7c71c29c5ce96c032d163665deb61dedec8ee37a606f5f1f5587f4552dc38d75a

Download Submit
C:\Windows\System\PXzwiyx.exe

Filesize
1.8MB

MD5
97f12e8c8eb9ea50a6bae9b191f793ea

SHA1
71e77e5cc032a0ce4fbc180d7390f92b6a720176

SHA256
619b017c02f2e8d7b9237339555219ac3e3410cdb9ff43709441694369a0add2

SHA512
981f2dfd7c8cca98c86768ef188c1a85a19713f1123a30a6cd844a217f9365052bb11eaf96098efada40885a2c2aaa0cd23415a729d9f0c96885cb6757d1792d

Download Submit
C:\Windows\System\QNOQUod.exe

Filesize
1.8MB

MD5
251a0446ce1cec07f3524213d43b31dc

SHA1
e96989f164a5c58341a9c9e086b7d8a363033253

SHA256
f2bd59edc705011b008b812f0540297a5db4e08d183d33de987d3cfe4d76173f

SHA512
02d1b5a13b4dff20b0150a5e8c50a167808330ec6ebd02f5d42cedb966826e2847170048203f3a5dd36710c3141826aa19ccc5a9c5aa27e429d20bd5c77425a4

Download Submit
C:\Windows\System\TIkgpBS.exe

Filesize
1.8MB

MD5
577544c850181d25ccd00732a4cc7233

SHA1
9d44d2f50a0ce926cf0df941870007958fcb901d

SHA256
32cc01aca9cca9498f2b15c1716ed4c0f402bde41f6909ac245528ab57d7035e

SHA512
0ede049750f4ad98e3d271fee771feccbcad960f6a3515ed1b936b7b5a9856872027a25ebdb1dc0e55edd719a49020d2ae9220e85226f913aee0455877823f08

Download Submit
C:\Windows\System\VfkSDGn.exe

Filesize
1.8MB

MD5
d3fb8b66e00121bfdb0fffe01c62c719

SHA1
65a858619ae020b8e37449fac76a468479d1f8bb

SHA256
66a9198a04cedec402e368d017d3fef13b0c17d4d35534e3d9405f25629c4ac6

SHA512
e0da7035e104c24bfcb7d9bc230a939cd829e10bf67851e7c9e2ccfaf7dca537e32f4ed01b08dc5cbb1c38c958a8fb766414ad160f15d6bee7c1098c1c41b3c5

Download Submit
C:\Windows\System\WKPsrsx.exe

Filesize
1.8MB

MD5
7f9a8d23430d59e4a597beb40cfbd38c

SHA1
e59113ff6f95e882d5d3af6d04293fc74af5c4ce

SHA256
a750bfc98a75aa58c2392bbbb5473bf782dd9c0f04e899d315dd76765390734f

SHA512
17d83f287f6bba8c4350a71ada4c23f0d84738b4f351a0398d09d925043acf947bda81bf99749252c50a256a0d83b7340f2a32b7b8dc87f56e2d68c4d2943049

Download Submit
C:\Windows\System\XAwLhjV.exe

Filesize
1.8MB

MD5
ef4543c562d12cdf708e004339e4a88a

SHA1
d694bad9744c07b1f326a864f01d5eed74996d5b

SHA256
b8328545606d28b235f6d2869838594ee5dba617bfe71f76f7e9d658e4e5dc39

SHA512
7e5248e49c8a6cc070ee178cfc833e2c372885a4071fdd84a16e60fc117316c948abecc760115ea7fee9ebcfcbdb41f2c7d8db478a7ea5924f5c2da6db4abaa6

Download Submit
C:\Windows\System\YLhNVUA.exe

Filesize
1.8MB

MD5
df1631f37a5fc47c8f9efdc92fff12ed

SHA1
b606cf79cb18f540aef8663efac612f763eabb4c

SHA256
cf79605ef861e90c17c0b65a5af4b6b33c75c9f3b15145726bda59945f9083f9

SHA512
568a2bc4fc12b251de962c378ff8f6f88db2d3a0f09a2b4626faa42072d5a59b77dca2a70262b2831d14e2badf1263c4f300c4c0a02b32c097da5ef6e2ae3253

Download Submit
C:\Windows\System\YStfCuF.exe

Filesize
1.8MB

MD5
a9b64e49b5cd4e0f06edea3b8df4276f

SHA1
42edf4d9842da19276bd1c02f0701ee35502d364

SHA256
40d12e7858fdb433d97319b747e0c5cf380eb78ef19f1c7cf6a8ac3ff23c8a56

SHA512
32042bc3f5c0f74a85f0dc400ade266199daedb8209076c874a7542aef8134bd63c5d90c3f6bfb1beb66bbe36ef7545fd8ad2f8afe256948bf44f192d0b6c2ab

Download Submit
C:\Windows\System\ZacXWed.exe

Filesize
1.8MB

MD5
5b4fd6685281fa8d6ed66fed76621104

SHA1
991b27dd7dcb09335423c4e4e6beb1b9afb97bba

SHA256
2eacc46bd593c9cb12803f79e5d4fc302322172bdd881056e51ec5b39213a7f2

SHA512
731e97018361e53bde8b30087a95b88b4303f9d8fd39c831d2a297d333f4d7991e48c94ebafee16a72dfb4971d3fc4e96a85f52a6492b1d9d69e0f5ae4e2cf6f

Download Submit
C:\Windows\System\ZgdQETz.exe

Filesize
1.8MB

MD5
f3996adc3bd28e90bc40fd624a695927

SHA1
0b0a8f8ebbdc8fd05694196e2b34b9ea0014c031

SHA256
146148ae8e101192ebac918cd5799692df3cbe82fa10a501340d37014913e9f6

SHA512
5c19326edb15d11be1286a58107be6b4bd16f610a56f1d6b4017ebdfa7c7a5ac4622b83b4e44c8f6b3acae31a153cebfe6be91fabcacf3487335c40d473cb2bb

Download Submit
C:\Windows\System\bRnFCem.exe

Filesize
1.8MB

MD5
21ffe53e0317cc97e033ef6ae93900d9

SHA1
d17ef01e365125f1c6c9b9df839bbc8968b7a5d3

SHA256
786e7e502b6315e43717e2427c8fba1944ddee56007517df7bc20b989ae297ff

SHA512
d76ffe91d5c94dfb83f3dcb2d6d99aca6bf248ca2f243ce66a65d0a86f589e50a280930038e1b6e3e71e7d534e407c5412fc6ba3c343682dd35f7accc92d1747

Download Submit
C:\Windows\System\cxtKlyS.exe

Filesize
8B

MD5
3277aa72bb7d7f1eb1043502fbd1c406

SHA1
8712dca2f3fbc82bf0cbbeecdc5d6a26c87f443c

SHA256
e94b62f30c9ce8b0b5cea14d4367a52fe08005d1bd56ca932a1fd7fc15c61bc9

SHA512
9fb0369549dba8937fb796cbc4ade6bacf540f10f98e02675f1b04c615cbb49e396cdbd25cd29de56c7bfb889c8464199939a84fa31434a75c020caeb4f9f503

Download Submit
C:\Windows\System\eOXkBCi.exe

Filesize
1.8MB

MD5
0d03b0d6319eb347dce24bf93511b67d

SHA1
d10717855ca960d13d0d35e6d699ad35359d11a9

SHA256
82d97a9502cf9bab4dcd17cebefe4ded1f2318c3ab13ecf40c2633113706503f

SHA512
a6dae7e8b0a2609abeec7cbcd12b5355c27e52b5d0400afa1c2e5ebc17833971884999faf3db554bce69da8221c735d7108132266ea9e86f225419beedc4f9e2

Download Submit
C:\Windows\System\eptYKtw.exe

Filesize
1.8MB

MD5
8feaa8444d436deb154e167624cafc99

SHA1
0923527c43e997b0448f764df0d9688e54dc6f0a

SHA256
b1ea1b5fe1a850d65ea64d19c60123aabb587f3dc4e1f1f754340ee6f2d34346

SHA512
b30275b79777bcc9fae21256e235ab4fc62e875ba94248d9ada046eb26075896e2c28edf5678a266f653acc88bb65792f8a81ccc6cfc0c69060086a5f1341d4d

Download Submit
C:\Windows\System\mBkNJXS.exe

Filesize
1.8MB

MD5
9d8ad25364e4d6f98e2cb300ec0eaafe

SHA1
83f3a274f62b9e2071546508c85a1f7d4fae0cad

SHA256
73c0dbb0ab4af40a89e35aa296a3a622253862b933e6bf217e3d7844d6d8ee42

SHA512
02b3b506252e1f45d4c251d2b5a0623f112993563d588c0a43709a98e28bd96c5aa24b3c75be1253a7b0f07720744b185c6678130152ae0e1db8a3a150917436

Download Submit
C:\Windows\System\ntpAAsS.exe

Filesize
1.8MB

MD5
45d649c35374510441a9871b4f693c44

SHA1
006b71d13689d267acda3b130bae6ad8328f5295

SHA256
9f4ac9312e97a12ff57b3ecd891b14c85bb15d1b12f35d830b00b35f7f7cccc4

SHA512
8b168c0b57531e196d9c0651d1c0facaff14909ba1bd5ed010fc2156f3fa5f8009b45b7dc1a93021a85e7adbb68513f36d743e16ba534ada81289452c1fa2893

Download Submit
C:\Windows\System\rJSDSdn.exe

Filesize
1.8MB

MD5
9149844d1d191af8adb4d047e15e06fe

SHA1
ce94b3e21256bd2c9e9135b9e33c0c7b38d5fd52

SHA256
3194a59407a0e790ff8c077f2ff450345469422716797463060f831e62484f26

SHA512
fc5ec1c51ccc9e75ea91d0172d97b44ebf0f1457db351c83b84a62dd05fa81fd4803d9f2c4ce289739a128f877c5e828c1084dcf4ce0ad19c7326aa7665b6398

Download Submit
C:\Windows\System\riFpPos.exe

Filesize
1.8MB

MD5
b976938ac1360fd49f0158916799e2d9

SHA1
f6e01492df5715cb4fb2b93e3d4a4689c79ddf0f

SHA256
a1aa42f8a027cd855ef690e3f544d2bb19e2f3f4cb70be39b4a28cd33ad383b0

SHA512
c148e2415a619f4e52a523db9e846e0dc39948a1c344337be5b7613619bec5978b5f627fe943424c5db2edf675ad1288843923d8d43d16555dd2b48de24a2811

Download Submit
C:\Windows\System\ueZXvZg.exe

Filesize
1.8MB

MD5
7a4f4155eec8813a21bce335b8e5dd2c

SHA1
23523863ac51bb4d28a699abd56c00a322b20b74

SHA256
64942c688c77932cd029ea5db282099911de2bb1c1fe8ff4531f71110c25410a

SHA512
0eee50b805f3056c1b15668c2622606d3f7c9da4477fb6ecc7f99ecc5e4ebf2b5dc5feedc9c2ac8a6df70f1bdb7c93e9e1389b0680af60eef65ab4790b0bf7d0

Download Submit
C:\Windows\System\vdCjNNa.exe

Filesize
1.8MB

MD5
9e09d9dcb6ba9262c5843879e0e4e26b

SHA1
0985ecec1f8e03b3dea0a6696b6fdfbe1ca19993

SHA256
72ed983f22cbcc33ca0e313b754e2be4f05e1f5d08f830721a1fb697563628bf

SHA512
fc212f64b4a5c8c13658a9cafe6da4e987a9febbf607739009d82ebf65adcea44874685c22107e33561be3fa4e508206bcb2547c71d61529fb9a9dbe4e126b60

Download Submit
C:\Windows\System\vrvHidS.exe

Filesize
1.8MB

MD5
e0463e6eb7d48777bdcc9a2062f2f2da

SHA1
b0678f01d5d882ca454945165ae8571b1227a66c

SHA256
aae78d34ed501fe3094f0c66fa8e393bdcf77d5c4d855430375fac8b7b202b5a

SHA512
6ebb273ff3934cd23ca13b825bd86c570bcbe1d3f5854ecb5c580e6e69b6cecc80516950f3f47b4f04500f415e8e3b27d0be3928b07517b9252699d7fad8befa

Download Submit
C:\Windows\System\xSPKOfT.exe

Filesize
1.8MB

MD5
4667b8995b2bfdf55b65f2d9c404a8e7

SHA1
9682dedfd8e21f44dd14c79913506e990eaf849e

SHA256
64a2f31e696ed3141cb44db3814f3f10cfdc25f70f48d4f55c4876926c429e30

SHA512
4169e0a5c89745ecf50833b85ebb7e982bf6fe4fd7e3b339b195a5a499a4bffaec8a892782a2019d29fbeac39f3e05285efcc7b9d48faa07c60d11c4dc123056

Download Submit
C:\Windows\System\zcLFkhF.exe

Filesize
1.8MB

MD5
2522a72ae7e5316fdfe86cbc39d9d12f

SHA1
a54aee2599267b9adddc3807a076b9434db98f2b

SHA256
3494cfa72d65004115e68ca92a02bbda1be80f4e756814c9e4be364d79b33206

SHA512
61d813ba1f9b541d7887eac2a1fddb77c6f0b41896c15cf884519835f649c0ab9bf05fb18bb141974d369d0d9a3e7e4e1956bfd248ace47553b5e5d2b82b26cb

Download Submit
memory/888-32-0x00007FF7EAF60000-0x00007FF7EB352000-memory.dmp

Filesize
3.9MB

Download
memory/1044-471-0x00007FF729CE0000-0x00007FF72A0D2000-memory.dmp

Filesize
3.9MB

Download
memory/1344-474-0x00007FF607190000-0x00007FF607582000-memory.dmp

Filesize
3.9MB

Download
memory/1356-30-0x00000291411D0000-0x00000291411E0000-memory.dmp

Filesize
64KB

Download
memory/1356-29-0x00007FFD8C5B0000-0x00007FFD8D071000-memory.dmp

Filesize
10.8MB

Download
memory/1356-41-0x00000291411A0000-0x00000291411C2000-memory.dmp

Filesize
136KB

Download
memory/1356-31-0x00000291411D0000-0x00000291411E0000-memory.dmp

Filesize
64KB

Download
memory/1476-532-0x00007FF73B260000-0x00007FF73B652000-memory.dmp

Filesize
3.9MB

Download
memory/1488-473-0x00007FF703080000-0x00007FF703472000-memory.dmp

Filesize
3.9MB

Download
memory/2036-472-0x00007FF7B03E0000-0x00007FF7B07D2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-6504-0x00007FF7B03E0000-0x00007FF7B07D2000-memory.dmp

Filesize
3.9MB

Download
memory/2300-486-0x00007FF6C4960000-0x00007FF6C4D52000-memory.dmp

Filesize
3.9MB

Download
memory/2392-476-0x00007FF79A320000-0x00007FF79A712000-memory.dmp

Filesize
3.9MB

Download
memory/2392-6606-0x00007FF79A320000-0x00007FF79A712000-memory.dmp

Filesize
3.9MB

Download
memory/2400-516-0x00007FF754540000-0x00007FF754932000-memory.dmp

Filesize
3.9MB

Download
memory/2400-6668-0x00007FF754540000-0x00007FF754932000-memory.dmp

Filesize
3.9MB

Download
memory/2640-526-0x00007FF605E30000-0x00007FF606222000-memory.dmp

Filesize
3.9MB

Download
memory/3004-34-0x00007FF7D5440000-0x00007FF7D5832000-memory.dmp

Filesize
3.9MB

Download
memory/3272-470-0x00007FF677F70000-0x00007FF678362000-memory.dmp

Filesize
3.9MB

Download
memory/3584-483-0x00007FF7FED70000-0x00007FF7FF162000-memory.dmp

Filesize
3.9MB

Download
memory/3824-497-0x00007FF76F100000-0x00007FF76F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/3824-6620-0x00007FF76F100000-0x00007FF76F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/4252-475-0x00007FF6417E0000-0x00007FF641BD2000-memory.dmp

Filesize
3.9MB

Download
memory/4400-37-0x00007FF645170000-0x00007FF645562000-memory.dmp

Filesize
3.9MB

Download
memory/4504-6654-0x00007FF6014B0000-0x00007FF6018A2000-memory.dmp

Filesize
3.9MB

Download
memory/4504-510-0x00007FF6014B0000-0x00007FF6018A2000-memory.dmp

Filesize
3.9MB

Download
memory/4728-502-0x00007FF6A4290000-0x00007FF6A4682000-memory.dmp

Filesize
3.9MB

Download
memory/4728-6641-0x00007FF6A4290000-0x00007FF6A4682000-memory.dmp

Filesize
3.9MB

Download
memory/4776-1-0x0000016F63F40000-0x0000016F63F50000-memory.dmp

Filesize
64KB

Download
memory/4776-0-0x00007FF713CF0000-0x00007FF7140E2000-memory.dmp

Filesize
3.9MB

Download
memory/4848-42-0x00007FF749AF0000-0x00007FF749EE2000-memory.dmp

Filesize
3.9MB

Download
memory/4860-47-0x00007FF6CAA30000-0x00007FF6CAE22000-memory.dmp

Filesize
3.9MB

Download
memory/4860-4631-0x00007FF6CAA30000-0x00007FF6CAE22000-memory.dmp

Filesize
3.9MB

Download
memory/4904-492-0x00007FF7FB9E0000-0x00007FF7FBDD2000-memory.dmp

Filesize
3.9MB

Download