xmrig | 419d0fb33b9bab52d3195e0f9af3f2f8fbd1a44db4545689018f00fc3afbb6bd

Analysis

max time kernel
31s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
Size

2.2MB
MD5

01a9fb2d13e5515c00d93ba93902d1d4
SHA1

c9a161a80280e6add147df6448a42b56aa764a53
SHA256

419d0fb33b9bab52d3195e0f9af3f2f8fbd1a44db4545689018f00fc3afbb6bd
SHA512

288fb102321ff273d00680db4871e02444303257f3ceefb96da0a615acf4fd19c474a6fdd9ff34581f2cdaf471a65ebeef88ee292cb96b18d1cc8611533aec56
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cRb2M:NABB

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/3792-55-0x00007FF7F9770000-0x00007FF7F9B62000-memory.dmp	xmrig
behavioral2/memory/3944-57-0x00007FF6F90B0000-0x00007FF6F94A2000-memory.dmp	xmrig
behavioral2/memory/824-58-0x00007FF63D710000-0x00007FF63DB02000-memory.dmp	xmrig
behavioral2/memory/1772-62-0x00007FF7DE520000-0x00007FF7DE912000-memory.dmp	xmrig
behavioral2/memory/696-68-0x00007FF7EA020000-0x00007FF7EA412000-memory.dmp	xmrig
behavioral2/memory/3648-380-0x00007FF785A40000-0x00007FF785E32000-memory.dmp	xmrig
behavioral2/memory/1400-386-0x00007FF6CAC90000-0x00007FF6CB082000-memory.dmp	xmrig
behavioral2/memory/4900-439-0x00007FF68A540000-0x00007FF68A932000-memory.dmp	xmrig
behavioral2/memory/3348-449-0x00007FF75D110000-0x00007FF75D502000-memory.dmp	xmrig
behavioral2/memory/3704-477-0x00007FF7293F0000-0x00007FF7297E2000-memory.dmp	xmrig
behavioral2/memory/4808-498-0x00007FF779DE0000-0x00007FF77A1D2000-memory.dmp	xmrig
behavioral2/memory/3768-458-0x00007FF7C7F30000-0x00007FF7C8322000-memory.dmp	xmrig
behavioral2/memory/2312-425-0x00007FF61CCA0000-0x00007FF61D092000-memory.dmp	xmrig
behavioral2/memory/3588-413-0x00007FF74F300000-0x00007FF74F6F2000-memory.dmp	xmrig
behavioral2/memory/1448-405-0x00007FF76E000000-0x00007FF76E3F2000-memory.dmp	xmrig
behavioral2/memory/1196-398-0x00007FF7728C0000-0x00007FF772CB2000-memory.dmp	xmrig
behavioral2/memory/3864-368-0x00007FF7D8C30000-0x00007FF7D9022000-memory.dmp	xmrig
behavioral2/memory/3656-69-0x00007FF769CE0000-0x00007FF76A0D2000-memory.dmp	xmrig
behavioral2/memory/4712-67-0x00007FF6EB5D0000-0x00007FF6EB9C2000-memory.dmp	xmrig
behavioral2/memory/1124-56-0x00007FF69ABF0000-0x00007FF69AFE2000-memory.dmp	xmrig
behavioral2/memory/3244-52-0x00007FF6ED580000-0x00007FF6ED972000-memory.dmp	xmrig
behavioral2/memory/1124-2086-0x00007FF69ABF0000-0x00007FF69AFE2000-memory.dmp	xmrig
behavioral2/memory/3792-2097-0x00007FF7F9770000-0x00007FF7F9B62000-memory.dmp	xmrig
behavioral2/memory/3944-2109-0x00007FF6F90B0000-0x00007FF6F94A2000-memory.dmp	xmrig
behavioral2/memory/3244-2060-0x00007FF6ED580000-0x00007FF6ED972000-memory.dmp	xmrig
behavioral2/memory/3864-2150-0x00007FF7D8C30000-0x00007FF7D9022000-memory.dmp	xmrig
behavioral2/memory/824-2156-0x00007FF63D710000-0x00007FF63DB02000-memory.dmp	xmrig
behavioral2/memory/3656-2148-0x00007FF769CE0000-0x00007FF76A0D2000-memory.dmp	xmrig
behavioral2/memory/3588-2184-0x00007FF74F300000-0x00007FF74F6F2000-memory.dmp	xmrig
behavioral2/memory/3648-2202-0x00007FF785A40000-0x00007FF785E32000-memory.dmp	xmrig
behavioral2/memory/3704-2199-0x00007FF7293F0000-0x00007FF7297E2000-memory.dmp	xmrig
behavioral2/memory/4900-2194-0x00007FF68A540000-0x00007FF68A932000-memory.dmp	xmrig
behavioral2/memory/1196-2186-0x00007FF7728C0000-0x00007FF772CB2000-memory.dmp	xmrig
behavioral2/memory/1448-2183-0x00007FF76E000000-0x00007FF76E3F2000-memory.dmp	xmrig
behavioral2/memory/1400-2182-0x00007FF6CAC90000-0x00007FF6CB082000-memory.dmp	xmrig
behavioral2/memory/4808-2201-0x00007FF779DE0000-0x00007FF77A1D2000-memory.dmp	xmrig
behavioral2/memory/2312-2197-0x00007FF61CCA0000-0x00007FF61D092000-memory.dmp	xmrig
behavioral2/memory/3348-2211-0x00007FF75D110000-0x00007FF75D502000-memory.dmp	xmrig
behavioral2/memory/3768-2210-0x00007FF7C7F30000-0x00007FF7C8322000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	2240	powershell.exe
10	2240	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1772	MwKrvtj.exe
3244	PzxTlRO.exe
3792	bTWicDG.exe
1124	mTmfHKU.exe
3944	vryqKsY.exe
824	qXYsGLG.exe
4712	rKKvcdA.exe
696	IvKeYQS.exe
3656	AZyUxgt.exe
3864	OrRogUl.exe
3648	FzAOgYv.exe
1400	zxXBKQe.exe
1196	cuqcjfy.exe
1448	mUBCfgV.exe
3588	BqCodcp.exe
2312	tAYKilm.exe
4900	EbtudDe.exe
3348	gvhCyRg.exe
3768	RxqpaWD.exe
3704	WUUfPXm.exe
4808	AnzatgS.exe
2720	rUWDPRb.exe
2868	WHRjIPt.exe
5028	jJoyzNn.exe
4824	rLeKbEB.exe
892	TyWXeVb.exe
4832	UNKosEk.exe
1696	ZqOBQMI.exe
4464	deuOudv.exe
3336	ytqxsAB.exe
3980	xmeQHcL.exe
4432	yVSQxcA.exe
3460	WPPOtFP.exe
4812	LwAhbOD.exe
2200	zfUUaea.exe
2128	eaWLwTh.exe
3328	XyeudUF.exe
756	WKRVJrU.exe
1824	cnKpnYf.exe
5000	KosMPVY.exe
3476	aBkoQCF.exe
3112	OCmtSZq.exe
5008	rgOskli.exe
844	JssDSpN.exe
3084	rYlKYRC.exe
376	fRpwJmf.exe
1776	ErNpzXA.exe
1132	AnuErnk.exe
608	FOdEghu.exe
2416	FJPiEBF.exe
4356	DkNCgFP.exe
2752	apoiHaP.exe
4124	CfUHlyQ.exe
5144	uMfagoQ.exe
5172	NFPgrcR.exe
5196	WYhhJyp.exe
5232	QuPjfyZ.exe
5260	wAUwcEs.exe
5292	IiLabPX.exe
5308	HMjfWpg.exe
5336	MVlizCX.exe
5352	MSnphQh.exe
5396	uiskdQV.exe
5420	ehNobXz.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2252-0-0x00007FF75A020000-0x00007FF75A412000-memory.dmp	upx
behavioral2/files/0x000e000000023157-4.dat	upx
behavioral2/files/0x000800000002325e-11.dat	upx
behavioral2/files/0x000700000002325f-9.dat	upx
behavioral2/files/0x0008000000023261-30.dat	upx
behavioral2/files/0x000800000002325c-36.dat	upx
behavioral2/files/0x0008000000023260-40.dat	upx
behavioral2/files/0x0007000000023262-47.dat	upx
behavioral2/files/0x0007000000023263-54.dat	upx
behavioral2/memory/3792-55-0x00007FF7F9770000-0x00007FF7F9B62000-memory.dmp	upx
behavioral2/memory/3944-57-0x00007FF6F90B0000-0x00007FF6F94A2000-memory.dmp	upx
behavioral2/memory/824-58-0x00007FF63D710000-0x00007FF63DB02000-memory.dmp	upx
behavioral2/files/0x0007000000023264-65.dat	upx
behavioral2/memory/1772-62-0x00007FF7DE520000-0x00007FF7DE912000-memory.dmp	upx
behavioral2/memory/696-68-0x00007FF7EA020000-0x00007FF7EA412000-memory.dmp	upx
behavioral2/files/0x0007000000023266-78.dat	upx
behavioral2/files/0x0007000000023268-88.dat	upx
behavioral2/files/0x0007000000023269-93.dat	upx
behavioral2/files/0x000700000002326a-98.dat	upx
behavioral2/files/0x000700000002326c-107.dat	upx
behavioral2/files/0x000700000002326e-120.dat	upx
behavioral2/files/0x0007000000023271-132.dat	upx
behavioral2/files/0x0007000000023273-143.dat	upx
behavioral2/files/0x0007000000023274-147.dat	upx
behavioral2/files/0x0007000000023276-157.dat	upx
behavioral2/files/0x0007000000023279-176.dat	upx
behavioral2/files/0x000700000002327c-185.dat	upx
behavioral2/files/0x000700000002327a-181.dat	upx
behavioral2/files/0x000700000002327b-180.dat	upx
behavioral2/memory/3648-380-0x00007FF785A40000-0x00007FF785E32000-memory.dmp	upx
behavioral2/memory/1400-386-0x00007FF6CAC90000-0x00007FF6CB082000-memory.dmp	upx
behavioral2/memory/4900-439-0x00007FF68A540000-0x00007FF68A932000-memory.dmp	upx
behavioral2/memory/3348-449-0x00007FF75D110000-0x00007FF75D502000-memory.dmp	upx
behavioral2/memory/3704-477-0x00007FF7293F0000-0x00007FF7297E2000-memory.dmp	upx
behavioral2/memory/4808-498-0x00007FF779DE0000-0x00007FF77A1D2000-memory.dmp	upx
behavioral2/memory/3768-458-0x00007FF7C7F30000-0x00007FF7C8322000-memory.dmp	upx
behavioral2/memory/2312-425-0x00007FF61CCA0000-0x00007FF61D092000-memory.dmp	upx
behavioral2/memory/3588-413-0x00007FF74F300000-0x00007FF74F6F2000-memory.dmp	upx
behavioral2/memory/1448-405-0x00007FF76E000000-0x00007FF76E3F2000-memory.dmp	upx
behavioral2/memory/1196-398-0x00007FF7728C0000-0x00007FF772CB2000-memory.dmp	upx
behavioral2/memory/3864-368-0x00007FF7D8C30000-0x00007FF7D9022000-memory.dmp	upx
behavioral2/files/0x0007000000023278-168.dat	upx
behavioral2/files/0x0007000000023277-163.dat	upx
behavioral2/files/0x0007000000023275-155.dat	upx
behavioral2/files/0x0007000000023272-140.dat	upx
behavioral2/files/0x0007000000023270-130.dat	upx
behavioral2/files/0x000700000002326f-126.dat	upx
behavioral2/files/0x000700000002326d-115.dat	upx
behavioral2/files/0x000700000002326b-105.dat	upx
behavioral2/files/0x0007000000023267-83.dat	upx
behavioral2/files/0x0007000000023265-73.dat	upx
behavioral2/memory/3656-69-0x00007FF769CE0000-0x00007FF76A0D2000-memory.dmp	upx
behavioral2/memory/4712-67-0x00007FF6EB5D0000-0x00007FF6EB9C2000-memory.dmp	upx
behavioral2/memory/1124-56-0x00007FF69ABF0000-0x00007FF69AFE2000-memory.dmp	upx
behavioral2/memory/3244-52-0x00007FF6ED580000-0x00007FF6ED972000-memory.dmp	upx
behavioral2/memory/1124-2086-0x00007FF69ABF0000-0x00007FF69AFE2000-memory.dmp	upx
behavioral2/memory/3792-2097-0x00007FF7F9770000-0x00007FF7F9B62000-memory.dmp	upx
behavioral2/memory/3944-2109-0x00007FF6F90B0000-0x00007FF6F94A2000-memory.dmp	upx
behavioral2/memory/3244-2060-0x00007FF6ED580000-0x00007FF6ED972000-memory.dmp	upx
behavioral2/memory/3864-2150-0x00007FF7D8C30000-0x00007FF7D9022000-memory.dmp	upx
behavioral2/memory/824-2156-0x00007FF63D710000-0x00007FF63DB02000-memory.dmp	upx
behavioral2/memory/3656-2148-0x00007FF769CE0000-0x00007FF76A0D2000-memory.dmp	upx
behavioral2/memory/3588-2184-0x00007FF74F300000-0x00007FF74F6F2000-memory.dmp	upx
behavioral2/memory/3648-2202-0x00007FF785A40000-0x00007FF785E32000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
6	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\iQAcHXV.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\jrnUBZF.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\loYJiqt.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\KbMctIo.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\nRdxwNJ.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\XSRlKFj.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\NvmkmIK.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\gXtLRlz.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\jyIGXNh.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\IhlcyFr.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\IwSAvUS.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\nJFUgvC.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\ZVAWYsS.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\AtAJble.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\KqWWeUO.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\dUXDklf.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\BvywzFa.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\JqEhOuB.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\ClDscFn.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\CsqkZIf.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\WxcEJdF.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\CRRaOtl.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\zAnEmzZ.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\IWfMgfb.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\sjabbyz.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\WAwfrlQ.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\sVHkyVl.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\nJiBXyH.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\cxSVGVA.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\eqFLudl.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\oVxyZsl.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\yORYVvB.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\zarRYNN.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\dlEzUOV.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\yfInaNX.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\vrbXQZj.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\zxXBKQe.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\rgOskli.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\IiLabPX.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\xNdMUwF.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\dGWZKeY.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\TeINBGo.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\veVcSAA.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\arctwTP.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\ehNobXz.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\yhGJDrT.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\IKIGcuL.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\cCEvIVb.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\MQcvgDx.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\FQMKVws.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\WhEIMfD.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\PbvnrAq.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\DgbBxcd.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\mOeSZEO.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\hgmjdyJ.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\mDEqZvg.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\QvfyrqG.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\hIDaTnc.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\PzxTlRO.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\HMjfWpg.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\BkSxwCJ.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\cUcNkpy.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\cxqdnOg.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
File created	C:\Windows\System\CKSZmbw.exe	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2240	powershell.exe
2240	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeLockMemoryPrivilege	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2240	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	92
PID 2252 wrote to memory of 2240	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	92
PID 2252 wrote to memory of 1772	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	93
PID 2252 wrote to memory of 1772	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	93
PID 2252 wrote to memory of 3244	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	94
PID 2252 wrote to memory of 3244	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	94
PID 2252 wrote to memory of 3792	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	95
PID 2252 wrote to memory of 3792	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	95
PID 2252 wrote to memory of 1124	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	96
PID 2252 wrote to memory of 1124	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	96
PID 2252 wrote to memory of 3944	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	97
PID 2252 wrote to memory of 3944	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	97
PID 2252 wrote to memory of 824	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	98
PID 2252 wrote to memory of 824	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	98
PID 2252 wrote to memory of 4712	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	99
PID 2252 wrote to memory of 4712	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	99
PID 2252 wrote to memory of 696	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	100
PID 2252 wrote to memory of 696	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	100
PID 2252 wrote to memory of 3656	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	101
PID 2252 wrote to memory of 3656	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	101
PID 2252 wrote to memory of 3864	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	102
PID 2252 wrote to memory of 3864	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	102
PID 2252 wrote to memory of 3648	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	103
PID 2252 wrote to memory of 3648	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	103
PID 2252 wrote to memory of 1400	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	104
PID 2252 wrote to memory of 1400	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	104
PID 2252 wrote to memory of 1196	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	105
PID 2252 wrote to memory of 1196	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	105
PID 2252 wrote to memory of 1448	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	106
PID 2252 wrote to memory of 1448	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	106
PID 2252 wrote to memory of 3588	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	107
PID 2252 wrote to memory of 3588	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	107
PID 2252 wrote to memory of 2312	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	108
PID 2252 wrote to memory of 2312	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	108
PID 2252 wrote to memory of 4900	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	109
PID 2252 wrote to memory of 4900	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	109
PID 2252 wrote to memory of 3348	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	110
PID 2252 wrote to memory of 3348	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	110
PID 2252 wrote to memory of 3768	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	111
PID 2252 wrote to memory of 3768	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	111
PID 2252 wrote to memory of 3704	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	112
PID 2252 wrote to memory of 3704	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	112
PID 2252 wrote to memory of 4808	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	113
PID 2252 wrote to memory of 4808	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	113
PID 2252 wrote to memory of 2720	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	114
PID 2252 wrote to memory of 2720	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	114
PID 2252 wrote to memory of 2868	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	115
PID 2252 wrote to memory of 2868	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	115
PID 2252 wrote to memory of 5028	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	116
PID 2252 wrote to memory of 5028	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	116
PID 2252 wrote to memory of 4824	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	117
PID 2252 wrote to memory of 4824	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	117
PID 2252 wrote to memory of 892	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	118
PID 2252 wrote to memory of 892	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	118
PID 2252 wrote to memory of 4832	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	119
PID 2252 wrote to memory of 4832	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	119
PID 2252 wrote to memory of 1696	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	120
PID 2252 wrote to memory of 1696	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	120
PID 2252 wrote to memory of 4464	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	121
PID 2252 wrote to memory of 4464	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	121
PID 2252 wrote to memory of 3336	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	122
PID 2252 wrote to memory of 3336	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	122
PID 2252 wrote to memory of 3980	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	123
PID 2252 wrote to memory of 3980	2252	01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe	123

C:\Users\Admin\AppData\Local\Temp\01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01a9fb2d13e5515c00d93ba93902d1d4_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2240
- C:\Windows\System\MwKrvtj.exe
  C:\Windows\System\MwKrvtj.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\PzxTlRO.exe
  C:\Windows\System\PzxTlRO.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\bTWicDG.exe
  C:\Windows\System\bTWicDG.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\mTmfHKU.exe
  C:\Windows\System\mTmfHKU.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\vryqKsY.exe
  C:\Windows\System\vryqKsY.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\qXYsGLG.exe
  C:\Windows\System\qXYsGLG.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\rKKvcdA.exe
  C:\Windows\System\rKKvcdA.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\IvKeYQS.exe
  C:\Windows\System\IvKeYQS.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\AZyUxgt.exe
  C:\Windows\System\AZyUxgt.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\OrRogUl.exe
  C:\Windows\System\OrRogUl.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\FzAOgYv.exe
  C:\Windows\System\FzAOgYv.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\zxXBKQe.exe
  C:\Windows\System\zxXBKQe.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\cuqcjfy.exe
  C:\Windows\System\cuqcjfy.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\mUBCfgV.exe
  C:\Windows\System\mUBCfgV.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\BqCodcp.exe
  C:\Windows\System\BqCodcp.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\tAYKilm.exe
  C:\Windows\System\tAYKilm.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\EbtudDe.exe
  C:\Windows\System\EbtudDe.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\gvhCyRg.exe
  C:\Windows\System\gvhCyRg.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\RxqpaWD.exe
  C:\Windows\System\RxqpaWD.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\WUUfPXm.exe
  C:\Windows\System\WUUfPXm.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\AnzatgS.exe
  C:\Windows\System\AnzatgS.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\rUWDPRb.exe
  C:\Windows\System\rUWDPRb.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\WHRjIPt.exe
  C:\Windows\System\WHRjIPt.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\jJoyzNn.exe
  C:\Windows\System\jJoyzNn.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\rLeKbEB.exe
  C:\Windows\System\rLeKbEB.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\TyWXeVb.exe
  C:\Windows\System\TyWXeVb.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\UNKosEk.exe
  C:\Windows\System\UNKosEk.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\ZqOBQMI.exe
  C:\Windows\System\ZqOBQMI.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\deuOudv.exe
  C:\Windows\System\deuOudv.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\ytqxsAB.exe
  C:\Windows\System\ytqxsAB.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\xmeQHcL.exe
  C:\Windows\System\xmeQHcL.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\yVSQxcA.exe
  C:\Windows\System\yVSQxcA.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\WPPOtFP.exe
  C:\Windows\System\WPPOtFP.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\LwAhbOD.exe
  C:\Windows\System\LwAhbOD.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\zfUUaea.exe
  C:\Windows\System\zfUUaea.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\eaWLwTh.exe
  C:\Windows\System\eaWLwTh.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\XyeudUF.exe
  C:\Windows\System\XyeudUF.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\WKRVJrU.exe
  C:\Windows\System\WKRVJrU.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\cnKpnYf.exe
  C:\Windows\System\cnKpnYf.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\KosMPVY.exe
  C:\Windows\System\KosMPVY.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\aBkoQCF.exe
  C:\Windows\System\aBkoQCF.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\OCmtSZq.exe
  C:\Windows\System\OCmtSZq.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\rgOskli.exe
  C:\Windows\System\rgOskli.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\JssDSpN.exe
  C:\Windows\System\JssDSpN.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\rYlKYRC.exe
  C:\Windows\System\rYlKYRC.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\fRpwJmf.exe
  C:\Windows\System\fRpwJmf.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\ErNpzXA.exe
  C:\Windows\System\ErNpzXA.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\AnuErnk.exe
  C:\Windows\System\AnuErnk.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\FOdEghu.exe
  C:\Windows\System\FOdEghu.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\FJPiEBF.exe
  C:\Windows\System\FJPiEBF.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\DkNCgFP.exe
  C:\Windows\System\DkNCgFP.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\apoiHaP.exe
  C:\Windows\System\apoiHaP.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\CfUHlyQ.exe
  C:\Windows\System\CfUHlyQ.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\uMfagoQ.exe
  C:\Windows\System\uMfagoQ.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\NFPgrcR.exe
  C:\Windows\System\NFPgrcR.exe
  2⤵
  - Executes dropped EXE
  PID:5172
- C:\Windows\System\WYhhJyp.exe
  C:\Windows\System\WYhhJyp.exe
  2⤵
  - Executes dropped EXE
  PID:5196
- C:\Windows\System\QuPjfyZ.exe
  C:\Windows\System\QuPjfyZ.exe
  2⤵
  - Executes dropped EXE
  PID:5232
- C:\Windows\System\wAUwcEs.exe
  C:\Windows\System\wAUwcEs.exe
  2⤵
  - Executes dropped EXE
  PID:5260
- C:\Windows\System\IiLabPX.exe
  C:\Windows\System\IiLabPX.exe
  2⤵
  - Executes dropped EXE
  PID:5292
- C:\Windows\System\HMjfWpg.exe
  C:\Windows\System\HMjfWpg.exe
  2⤵
  - Executes dropped EXE
  PID:5308
- C:\Windows\System\MVlizCX.exe
  C:\Windows\System\MVlizCX.exe
  2⤵
  - Executes dropped EXE
  PID:5336
- C:\Windows\System\MSnphQh.exe
  C:\Windows\System\MSnphQh.exe
  2⤵
  - Executes dropped EXE
  PID:5352
- C:\Windows\System\uiskdQV.exe
  C:\Windows\System\uiskdQV.exe
  2⤵
  - Executes dropped EXE
  PID:5396
- C:\Windows\System\ehNobXz.exe
  C:\Windows\System\ehNobXz.exe
  2⤵
  - Executes dropped EXE
  PID:5420
- C:\Windows\System\DALHJmM.exe
  C:\Windows\System\DALHJmM.exe
  2⤵
  PID:5452
- C:\Windows\System\BkSxwCJ.exe
  C:\Windows\System\BkSxwCJ.exe
  2⤵
  PID:5476
- C:\Windows\System\aHnvfPn.exe
  C:\Windows\System\aHnvfPn.exe
  2⤵
  PID:5492
- C:\Windows\System\tQKtNgd.exe
  C:\Windows\System\tQKtNgd.exe
  2⤵
  PID:5508
- C:\Windows\System\wFJqrSh.exe
  C:\Windows\System\wFJqrSh.exe
  2⤵
  PID:5548
- C:\Windows\System\IwSAvUS.exe
  C:\Windows\System\IwSAvUS.exe
  2⤵
  PID:5584
- C:\Windows\System\LxIQgyI.exe
  C:\Windows\System\LxIQgyI.exe
  2⤵
  PID:5636
- C:\Windows\System\SsEMXvk.exe
  C:\Windows\System\SsEMXvk.exe
  2⤵
  PID:5652
- C:\Windows\System\LfqrWZt.exe
  C:\Windows\System\LfqrWZt.exe
  2⤵
  PID:5668
- C:\Windows\System\LptQEaQ.exe
  C:\Windows\System\LptQEaQ.exe
  2⤵
  PID:5684
- C:\Windows\System\oAyxyUN.exe
  C:\Windows\System\oAyxyUN.exe
  2⤵
  PID:5708
- C:\Windows\System\MAnJsxY.exe
  C:\Windows\System\MAnJsxY.exe
  2⤵
  PID:5736
- C:\Windows\System\dSRoVZL.exe
  C:\Windows\System\dSRoVZL.exe
  2⤵
  PID:5764
- C:\Windows\System\LvZouZb.exe
  C:\Windows\System\LvZouZb.exe
  2⤵
  PID:5804
- C:\Windows\System\rOSqBsC.exe
  C:\Windows\System\rOSqBsC.exe
  2⤵
  PID:5832
- C:\Windows\System\KbMctIo.exe
  C:\Windows\System\KbMctIo.exe
  2⤵
  PID:5852
- C:\Windows\System\CteFkpU.exe
  C:\Windows\System\CteFkpU.exe
  2⤵
  PID:5916
- C:\Windows\System\maXJudE.exe
  C:\Windows\System\maXJudE.exe
  2⤵
  PID:5968
- C:\Windows\System\yhGJDrT.exe
  C:\Windows\System\yhGJDrT.exe
  2⤵
  PID:6020
- C:\Windows\System\SpBJHHB.exe
  C:\Windows\System\SpBJHHB.exe
  2⤵
  PID:6036
- C:\Windows\System\TIGJNAb.exe
  C:\Windows\System\TIGJNAb.exe
  2⤵
  PID:6052
- C:\Windows\System\YcNVtcg.exe
  C:\Windows\System\YcNVtcg.exe
  2⤵
  PID:6068
- C:\Windows\System\WFlsJai.exe
  C:\Windows\System\WFlsJai.exe
  2⤵
  PID:6084
- C:\Windows\System\AnzRmED.exe
  C:\Windows\System\AnzRmED.exe
  2⤵
  PID:6100
- C:\Windows\System\SRSxZzb.exe
  C:\Windows\System\SRSxZzb.exe
  2⤵
  PID:3592
- C:\Windows\System\YmkNEAw.exe
  C:\Windows\System\YmkNEAw.exe
  2⤵
  PID:5128
- C:\Windows\System\XQpeSBo.exe
  C:\Windows\System\XQpeSBo.exe
  2⤵
  PID:5168
- C:\Windows\System\LhDYHDE.exe
  C:\Windows\System\LhDYHDE.exe
  2⤵
  PID:5244
- C:\Windows\System\gjSrMHp.exe
  C:\Windows\System\gjSrMHp.exe
  2⤵
  PID:5300
- C:\Windows\System\MQcvgDx.exe
  C:\Windows\System\MQcvgDx.exe
  2⤵
  PID:5328
- C:\Windows\System\OYmJHUY.exe
  C:\Windows\System\OYmJHUY.exe
  2⤵
  PID:5368
- C:\Windows\System\xMDffpy.exe
  C:\Windows\System\xMDffpy.exe
  2⤵
  PID:5436
- C:\Windows\System\iyKmFmc.exe
  C:\Windows\System\iyKmFmc.exe
  2⤵
  PID:5600
- C:\Windows\System\yZQchcz.exe
  C:\Windows\System\yZQchcz.exe
  2⤵
  PID:1644
- C:\Windows\System\rvNavuo.exe
  C:\Windows\System\rvNavuo.exe
  2⤵
  PID:5648
- C:\Windows\System\ieBgrMp.exe
  C:\Windows\System\ieBgrMp.exe
  2⤵
  PID:3356
- C:\Windows\System\Tyzcuxs.exe
  C:\Windows\System\Tyzcuxs.exe
  2⤵
  PID:5700
- C:\Windows\System\wDXkkNk.exe
  C:\Windows\System\wDXkkNk.exe
  2⤵
  PID:5752
- C:\Windows\System\KHJfGzo.exe
  C:\Windows\System\KHJfGzo.exe
  2⤵
  PID:692
- C:\Windows\System\uuVmoeT.exe
  C:\Windows\System\uuVmoeT.exe
  2⤵
  PID:764
- C:\Windows\System\cUcNkpy.exe
  C:\Windows\System\cUcNkpy.exe
  2⤵
  PID:2888
- C:\Windows\System\eSIQSbf.exe
  C:\Windows\System\eSIQSbf.exe
  2⤵
  PID:2688
- C:\Windows\System\ZWWiyIz.exe
  C:\Windows\System\ZWWiyIz.exe
  2⤵
  PID:2484
- C:\Windows\System\xNdMUwF.exe
  C:\Windows\System\xNdMUwF.exe
  2⤵
  PID:5940
- C:\Windows\System\FQMKVws.exe
  C:\Windows\System\FQMKVws.exe
  2⤵
  PID:5964
- C:\Windows\System\jhizjln.exe
  C:\Windows\System\jhizjln.exe
  2⤵
  PID:5996
- C:\Windows\System\Clcihul.exe
  C:\Windows\System\Clcihul.exe
  2⤵
  PID:6032
- C:\Windows\System\nQMtewU.exe
  C:\Windows\System\nQMtewU.exe
  2⤵
  PID:6096
- C:\Windows\System\QzYacHr.exe
  C:\Windows\System\QzYacHr.exe
  2⤵
  PID:6140
- C:\Windows\System\EooCGue.exe
  C:\Windows\System\EooCGue.exe
  2⤵
  PID:3140
- C:\Windows\System\pDlfAaR.exe
  C:\Windows\System\pDlfAaR.exe
  2⤵
  PID:5284
- C:\Windows\System\nJFUgvC.exe
  C:\Windows\System\nJFUgvC.exe
  2⤵
  PID:5412
- C:\Windows\System\VjxVuic.exe
  C:\Windows\System\VjxVuic.exe
  2⤵
  PID:5500
- C:\Windows\System\DLYQjbN.exe
  C:\Windows\System\DLYQjbN.exe
  2⤵
  PID:5676
- C:\Windows\System\WAwfrlQ.exe
  C:\Windows\System\WAwfrlQ.exe
  2⤵
  PID:1636
- C:\Windows\System\JqEhOuB.exe
  C:\Windows\System\JqEhOuB.exe
  2⤵
  PID:5596
- C:\Windows\System\mdMIkDU.exe
  C:\Windows\System\mdMIkDU.exe
  2⤵
  PID:5800
- C:\Windows\System\FqbiqmX.exe
  C:\Windows\System\FqbiqmX.exe
  2⤵
  PID:5844
- C:\Windows\System\HuJeuSK.exe
  C:\Windows\System\HuJeuSK.exe
  2⤵
  PID:5960
- C:\Windows\System\jkZUojx.exe
  C:\Windows\System\jkZUojx.exe
  2⤵
  PID:3332
- C:\Windows\System\RKwAfcC.exe
  C:\Windows\System\RKwAfcC.exe
  2⤵
  PID:3760
- C:\Windows\System\YuqFxhP.exe
  C:\Windows\System\YuqFxhP.exe
  2⤵
  PID:800
- C:\Windows\System\rTjATkX.exe
  C:\Windows\System\rTjATkX.exe
  2⤵
  PID:6028
- C:\Windows\System\pXLxBQY.exe
  C:\Windows\System\pXLxBQY.exe
  2⤵
  PID:5792
- C:\Windows\System\TJwqPCs.exe
  C:\Windows\System\TJwqPCs.exe
  2⤵
  PID:5348
- C:\Windows\System\CiCkAVB.exe
  C:\Windows\System\CiCkAVB.exe
  2⤵
  PID:3268
- C:\Windows\System\PETpaAq.exe
  C:\Windows\System\PETpaAq.exe
  2⤵
  PID:5724
- C:\Windows\System\CaTFpZS.exe
  C:\Windows\System\CaTFpZS.exe
  2⤵
  PID:6160
- C:\Windows\System\IKIGcuL.exe
  C:\Windows\System\IKIGcuL.exe
  2⤵
  PID:6192
- C:\Windows\System\rjmfsWy.exe
  C:\Windows\System\rjmfsWy.exe
  2⤵
  PID:6208
- C:\Windows\System\KJwUCfb.exe
  C:\Windows\System\KJwUCfb.exe
  2⤵
  PID:6260
- C:\Windows\System\eqFLudl.exe
  C:\Windows\System\eqFLudl.exe
  2⤵
  PID:6284
- C:\Windows\System\DgCBmyQ.exe
  C:\Windows\System\DgCBmyQ.exe
  2⤵
  PID:6304
- C:\Windows\System\STsKBTo.exe
  C:\Windows\System\STsKBTo.exe
  2⤵
  PID:6328
- C:\Windows\System\dokKcGc.exe
  C:\Windows\System\dokKcGc.exe
  2⤵
  PID:6348
- C:\Windows\System\WqVodOJ.exe
  C:\Windows\System\WqVodOJ.exe
  2⤵
  PID:6400
- C:\Windows\System\zarRYNN.exe
  C:\Windows\System\zarRYNN.exe
  2⤵
  PID:6428
- C:\Windows\System\FlvZkKF.exe
  C:\Windows\System\FlvZkKF.exe
  2⤵
  PID:6452
- C:\Windows\System\BMnPYDa.exe
  C:\Windows\System\BMnPYDa.exe
  2⤵
  PID:6484
- C:\Windows\System\cCEvIVb.exe
  C:\Windows\System\cCEvIVb.exe
  2⤵
  PID:6504
- C:\Windows\System\dlEzUOV.exe
  C:\Windows\System\dlEzUOV.exe
  2⤵
  PID:6540
- C:\Windows\System\mcIduUm.exe
  C:\Windows\System\mcIduUm.exe
  2⤵
  PID:6568
- C:\Windows\System\hgmjdyJ.exe
  C:\Windows\System\hgmjdyJ.exe
  2⤵
  PID:6592
- C:\Windows\System\oVxyZsl.exe
  C:\Windows\System\oVxyZsl.exe
  2⤵
  PID:6660
- C:\Windows\System\mKUyODy.exe
  C:\Windows\System\mKUyODy.exe
  2⤵
  PID:6696
- C:\Windows\System\qRhfJfw.exe
  C:\Windows\System\qRhfJfw.exe
  2⤵
  PID:6728
- C:\Windows\System\ClDscFn.exe
  C:\Windows\System\ClDscFn.exe
  2⤵
  PID:6748
- C:\Windows\System\ppheNSY.exe
  C:\Windows\System\ppheNSY.exe
  2⤵
  PID:6768
- C:\Windows\System\GJInlix.exe
  C:\Windows\System\GJInlix.exe
  2⤵
  PID:6792
- C:\Windows\System\oyVFqNa.exe
  C:\Windows\System\oyVFqNa.exe
  2⤵
  PID:6808
- C:\Windows\System\ySBohAC.exe
  C:\Windows\System\ySBohAC.exe
  2⤵
  PID:6844
- C:\Windows\System\tSiLwjf.exe
  C:\Windows\System\tSiLwjf.exe
  2⤵
  PID:6868
- C:\Windows\System\fkVOTmd.exe
  C:\Windows\System\fkVOTmd.exe
  2⤵
  PID:6892
- C:\Windows\System\WgbUPuU.exe
  C:\Windows\System\WgbUPuU.exe
  2⤵
  PID:6908
- C:\Windows\System\DgbBxcd.exe
  C:\Windows\System\DgbBxcd.exe
  2⤵
  PID:6944
- C:\Windows\System\eYXSqol.exe
  C:\Windows\System\eYXSqol.exe
  2⤵
  PID:6980
- C:\Windows\System\KCWoPXc.exe
  C:\Windows\System\KCWoPXc.exe
  2⤵
  PID:7004
- C:\Windows\System\gnQEzoY.exe
  C:\Windows\System\gnQEzoY.exe
  2⤵
  PID:7028
- C:\Windows\System\CsqkZIf.exe
  C:\Windows\System\CsqkZIf.exe
  2⤵
  PID:7048
- C:\Windows\System\XQoUFSi.exe
  C:\Windows\System\XQoUFSi.exe
  2⤵
  PID:7068
- C:\Windows\System\WZPzkYR.exe
  C:\Windows\System\WZPzkYR.exe
  2⤵
  PID:7088
- C:\Windows\System\zFaTSPo.exe
  C:\Windows\System\zFaTSPo.exe
  2⤵
  PID:7108
- C:\Windows\System\otWBIOJ.exe
  C:\Windows\System\otWBIOJ.exe
  2⤵
  PID:7128
- C:\Windows\System\IfXmJRM.exe
  C:\Windows\System\IfXmJRM.exe
  2⤵
  PID:7148
- C:\Windows\System\iaJBvkP.exe
  C:\Windows\System\iaJBvkP.exe
  2⤵
  PID:2488
- C:\Windows\System\RONwseG.exe
  C:\Windows\System\RONwseG.exe
  2⤵
  PID:1612
- C:\Windows\System\SVBJwuh.exe
  C:\Windows\System\SVBJwuh.exe
  2⤵
  PID:4564
- C:\Windows\System\hzHJYcY.exe
  C:\Windows\System\hzHJYcY.exe
  2⤵
  PID:6180
- C:\Windows\System\ZcWYihL.exe
  C:\Windows\System\ZcWYihL.exe
  2⤵
  PID:6232
- C:\Windows\System\XztOBkj.exe
  C:\Windows\System\XztOBkj.exe
  2⤵
  PID:6280
- C:\Windows\System\cGsLFqh.exe
  C:\Windows\System\cGsLFqh.exe
  2⤵
  PID:6312
- C:\Windows\System\JZezyYi.exe
  C:\Windows\System\JZezyYi.exe
  2⤵
  PID:6344
- C:\Windows\System\veVcSAA.exe
  C:\Windows\System\veVcSAA.exe
  2⤵
  PID:6436
- C:\Windows\System\JfBLQip.exe
  C:\Windows\System\JfBLQip.exe
  2⤵
  PID:6472
- C:\Windows\System\JPpFQmT.exe
  C:\Windows\System\JPpFQmT.exe
  2⤵
  PID:6532
- C:\Windows\System\JwPwnzO.exe
  C:\Windows\System\JwPwnzO.exe
  2⤵
  PID:6588
- C:\Windows\System\HORgDEW.exe
  C:\Windows\System\HORgDEW.exe
  2⤵
  PID:6648
- C:\Windows\System\uzYiwiJ.exe
  C:\Windows\System\uzYiwiJ.exe
  2⤵
  PID:6684
- C:\Windows\System\dtuQNPz.exe
  C:\Windows\System\dtuQNPz.exe
  2⤵
  PID:6740
- C:\Windows\System\fBajPkM.exe
  C:\Windows\System\fBajPkM.exe
  2⤵
  PID:6788
- C:\Windows\System\AifHgUM.exe
  C:\Windows\System\AifHgUM.exe
  2⤵
  PID:6824
- C:\Windows\System\AoyMkKI.exe
  C:\Windows\System\AoyMkKI.exe
  2⤵
  PID:6876
- C:\Windows\System\UzmbVQv.exe
  C:\Windows\System\UzmbVQv.exe
  2⤵
  PID:6924
- C:\Windows\System\fKEcFkC.exe
  C:\Windows\System\fKEcFkC.exe
  2⤵
  PID:7056
- C:\Windows\System\JozfkNT.exe
  C:\Windows\System\JozfkNT.exe
  2⤵
  PID:6992
- C:\Windows\System\xTObDCI.exe
  C:\Windows\System\xTObDCI.exe
  2⤵
  PID:7080
- C:\Windows\System\FnTHHlk.exe
  C:\Windows\System\FnTHHlk.exe
  2⤵
  PID:7100
- C:\Windows\System\VgJfhCy.exe
  C:\Windows\System\VgJfhCy.exe
  2⤵
  PID:6204
- C:\Windows\System\jhcMDrE.exe
  C:\Windows\System\jhcMDrE.exe
  2⤵
  PID:7140
- C:\Windows\System\FgSkFyr.exe
  C:\Windows\System\FgSkFyr.exe
  2⤵
  PID:6340
- C:\Windows\System\bgQUjLC.exe
  C:\Windows\System\bgQUjLC.exe
  2⤵
  PID:6380
- C:\Windows\System\unyYsPa.exe
  C:\Windows\System\unyYsPa.exe
  2⤵
  PID:6248
- C:\Windows\System\OHaHSIz.exe
  C:\Windows\System\OHaHSIz.exe
  2⤵
  PID:6988
- C:\Windows\System\GIUtfAZ.exe
  C:\Windows\System\GIUtfAZ.exe
  2⤵
  PID:6060
- C:\Windows\System\jEiDLce.exe
  C:\Windows\System\jEiDLce.exe
  2⤵
  PID:7184
- C:\Windows\System\ybigmpK.exe
  C:\Windows\System\ybigmpK.exe
  2⤵
  PID:7204
- C:\Windows\System\AnZPgvv.exe
  C:\Windows\System\AnZPgvv.exe
  2⤵
  PID:7228
- C:\Windows\System\sVHkyVl.exe
  C:\Windows\System\sVHkyVl.exe
  2⤵
  PID:7252
- C:\Windows\System\VgRXWbd.exe
  C:\Windows\System\VgRXWbd.exe
  2⤵
  PID:7272
- C:\Windows\System\ZVAWYsS.exe
  C:\Windows\System\ZVAWYsS.exe
  2⤵
  PID:7296
- C:\Windows\System\ZuRwfER.exe
  C:\Windows\System\ZuRwfER.exe
  2⤵
  PID:7320
- C:\Windows\System\IULaJHW.exe
  C:\Windows\System\IULaJHW.exe
  2⤵
  PID:7344
- C:\Windows\System\AAGHura.exe
  C:\Windows\System\AAGHura.exe
  2⤵
  PID:7364
- C:\Windows\System\WhEIMfD.exe
  C:\Windows\System\WhEIMfD.exe
  2⤵
  PID:7384
- C:\Windows\System\FfssEYB.exe
  C:\Windows\System\FfssEYB.exe
  2⤵
  PID:7404
- C:\Windows\System\lbwbzdh.exe
  C:\Windows\System\lbwbzdh.exe
  2⤵
  PID:7436
- C:\Windows\System\KQVCkPM.exe
  C:\Windows\System\KQVCkPM.exe
  2⤵
  PID:7456
- C:\Windows\System\GGaGWdI.exe
  C:\Windows\System\GGaGWdI.exe
  2⤵
  PID:7476
- C:\Windows\System\PbvnrAq.exe
  C:\Windows\System\PbvnrAq.exe
  2⤵
  PID:7492
- C:\Windows\System\ZhkYYik.exe
  C:\Windows\System\ZhkYYik.exe
  2⤵
  PID:7516
- C:\Windows\System\LAGLytg.exe
  C:\Windows\System\LAGLytg.exe
  2⤵
  PID:7536
- C:\Windows\System\kwrkpRv.exe
  C:\Windows\System\kwrkpRv.exe
  2⤵
  PID:7556
- C:\Windows\System\jYIUYlJ.exe
  C:\Windows\System\jYIUYlJ.exe
  2⤵
  PID:7576
- C:\Windows\System\mOeSZEO.exe
  C:\Windows\System\mOeSZEO.exe
  2⤵
  PID:7656
- C:\Windows\System\WxcEJdF.exe
  C:\Windows\System\WxcEJdF.exe
  2⤵
  PID:7676
- C:\Windows\System\YpLJgCC.exe
  C:\Windows\System\YpLJgCC.exe
  2⤵
  PID:7700
- C:\Windows\System\YFgiLYi.exe
  C:\Windows\System\YFgiLYi.exe
  2⤵
  PID:7720
- C:\Windows\System\NHssgGM.exe
  C:\Windows\System\NHssgGM.exe
  2⤵
  PID:7744
- C:\Windows\System\BvywzFa.exe
  C:\Windows\System\BvywzFa.exe
  2⤵
  PID:7772
- C:\Windows\System\OzuXBSC.exe
  C:\Windows\System\OzuXBSC.exe
  2⤵
  PID:7796
- C:\Windows\System\epBWVcY.exe
  C:\Windows\System\epBWVcY.exe
  2⤵
  PID:7820
- C:\Windows\System\JlvEuKL.exe
  C:\Windows\System\JlvEuKL.exe
  2⤵
  PID:7844
- C:\Windows\System\zxqUIVk.exe
  C:\Windows\System\zxqUIVk.exe
  2⤵
  PID:7864
- C:\Windows\System\EIOnege.exe
  C:\Windows\System\EIOnege.exe
  2⤵
  PID:7888
- C:\Windows\System\QQbTehY.exe
  C:\Windows\System\QQbTehY.exe
  2⤵
  PID:7908
- C:\Windows\System\nJiBXyH.exe
  C:\Windows\System\nJiBXyH.exe
  2⤵
  PID:7928
- C:\Windows\System\nRdxwNJ.exe
  C:\Windows\System\nRdxwNJ.exe
  2⤵
  PID:7944
- C:\Windows\System\cBfsIyP.exe
  C:\Windows\System\cBfsIyP.exe
  2⤵
  PID:7964
- C:\Windows\System\FKkcdPQ.exe
  C:\Windows\System\FKkcdPQ.exe
  2⤵
  PID:7988
- C:\Windows\System\KqWWeUO.exe
  C:\Windows\System\KqWWeUO.exe
  2⤵
  PID:8004
- C:\Windows\System\RnYkHFl.exe
  C:\Windows\System\RnYkHFl.exe
  2⤵
  PID:8028
- C:\Windows\System\eYzYCHH.exe
  C:\Windows\System\eYzYCHH.exe
  2⤵
  PID:8052
- C:\Windows\System\TcwTUkv.exe
  C:\Windows\System\TcwTUkv.exe
  2⤵
  PID:8068
- C:\Windows\System\kHCgloW.exe
  C:\Windows\System\kHCgloW.exe
  2⤵
  PID:8084
- C:\Windows\System\cJZPsVU.exe
  C:\Windows\System\cJZPsVU.exe
  2⤵
  PID:8104
- C:\Windows\System\eODuvqC.exe
  C:\Windows\System\eODuvqC.exe
  2⤵
  PID:8136
- C:\Windows\System\rrsULSd.exe
  C:\Windows\System\rrsULSd.exe
  2⤵
  PID:7160
- C:\Windows\System\eipxUUp.exe
  C:\Windows\System\eipxUUp.exe
  2⤵
  PID:7040
- C:\Windows\System\szsoFUo.exe
  C:\Windows\System\szsoFUo.exe
  2⤵
  PID:6200
- C:\Windows\System\LQfkKkx.exe
  C:\Windows\System\LQfkKkx.exe
  2⤵
  PID:5276
- C:\Windows\System\HRBIwXd.exe
  C:\Windows\System\HRBIwXd.exe
  2⤵
  PID:3204
- C:\Windows\System\hyxOEFt.exe
  C:\Windows\System\hyxOEFt.exe
  2⤵
  PID:7020
- C:\Windows\System\kpqACct.exe
  C:\Windows\System\kpqACct.exe
  2⤵
  PID:7304
- C:\Windows\System\HLQVShE.exe
  C:\Windows\System\HLQVShE.exe
  2⤵
  PID:7176
- C:\Windows\System\XaYWuie.exe
  C:\Windows\System\XaYWuie.exe
  2⤵
  PID:7280
- C:\Windows\System\GrFnHQn.exe
  C:\Windows\System\GrFnHQn.exe
  2⤵
  PID:7464
- C:\Windows\System\IXXlxUR.exe
  C:\Windows\System\IXXlxUR.exe
  2⤵
  PID:7668
- C:\Windows\System\ASOAQmv.exe
  C:\Windows\System\ASOAQmv.exe
  2⤵
  PID:7716
- C:\Windows\System\EdeXmYN.exe
  C:\Windows\System\EdeXmYN.exe
  2⤵
  PID:7736
- C:\Windows\System\SfwBzsK.exe
  C:\Windows\System\SfwBzsK.exe
  2⤵
  PID:7424
- C:\Windows\System\vIlqtRY.exe
  C:\Windows\System\vIlqtRY.exe
  2⤵
  PID:7472
- C:\Windows\System\tJeesLm.exe
  C:\Windows\System\tJeesLm.exe
  2⤵
  PID:7568
- C:\Windows\System\sHlqpQj.exe
  C:\Windows\System\sHlqpQj.exe
  2⤵
  PID:1376
- C:\Windows\System\XSRlKFj.exe
  C:\Windows\System\XSRlKFj.exe
  2⤵
  PID:8080
- C:\Windows\System\SlwtIxj.exe
  C:\Windows\System\SlwtIxj.exe
  2⤵
  PID:7872
- C:\Windows\System\geKPydm.exe
  C:\Windows\System\geKPydm.exe
  2⤵
  PID:8020
- C:\Windows\System\rRoCpkt.exe
  C:\Windows\System\rRoCpkt.exe
  2⤵
  PID:8152
- C:\Windows\System\mDEqZvg.exe
  C:\Windows\System\mDEqZvg.exe
  2⤵
  PID:7804
- C:\Windows\System\cxqdnOg.exe
  C:\Windows\System\cxqdnOg.exe
  2⤵
  PID:8196
- C:\Windows\System\wZDVGju.exe
  C:\Windows\System\wZDVGju.exe
  2⤵
  PID:8232
- C:\Windows\System\ZsxDKlm.exe
  C:\Windows\System\ZsxDKlm.exe
  2⤵
  PID:8260
- C:\Windows\System\UUqExWs.exe
  C:\Windows\System\UUqExWs.exe
  2⤵
  PID:8276
- C:\Windows\System\cxSVGVA.exe
  C:\Windows\System\cxSVGVA.exe
  2⤵
  PID:8300
- C:\Windows\System\oHVnCdP.exe
  C:\Windows\System\oHVnCdP.exe
  2⤵
  PID:8324
- C:\Windows\System\RePPjoe.exe
  C:\Windows\System\RePPjoe.exe
  2⤵
  PID:8348
- C:\Windows\System\YhthUpT.exe
  C:\Windows\System\YhthUpT.exe
  2⤵
  PID:8368
- C:\Windows\System\nqGPuiZ.exe
  C:\Windows\System\nqGPuiZ.exe
  2⤵
  PID:8920
- C:\Windows\System\apDRZFy.exe
  C:\Windows\System\apDRZFy.exe
  2⤵
  PID:8936
- C:\Windows\System\ZLJsqKC.exe
  C:\Windows\System\ZLJsqKC.exe
  2⤵
  PID:8956
- C:\Windows\System\nSdWlXH.exe
  C:\Windows\System\nSdWlXH.exe
  2⤵
  PID:8980
- C:\Windows\System\mIIdXWN.exe
  C:\Windows\System\mIIdXWN.exe
  2⤵
  PID:9000
- C:\Windows\System\AiRiiKz.exe
  C:\Windows\System\AiRiiKz.exe
  2⤵
  PID:9016
- C:\Windows\System\HlAWNvk.exe
  C:\Windows\System\HlAWNvk.exe
  2⤵
  PID:9040
- C:\Windows\System\Qbrstms.exe
  C:\Windows\System\Qbrstms.exe
  2⤵
  PID:9072
- C:\Windows\System\AwbZKoc.exe
  C:\Windows\System\AwbZKoc.exe
  2⤵
  PID:9112
- C:\Windows\System\FzcvyLY.exe
  C:\Windows\System\FzcvyLY.exe
  2⤵
  PID:9136
- C:\Windows\System\dwKwWNW.exe
  C:\Windows\System\dwKwWNW.exe
  2⤵
  PID:9168
- C:\Windows\System\bWfwgGg.exe
  C:\Windows\System\bWfwgGg.exe
  2⤵
  PID:9196
- C:\Windows\System\NvmkmIK.exe
  C:\Windows\System\NvmkmIK.exe
  2⤵
  PID:8092
- C:\Windows\System\omVePqw.exe
  C:\Windows\System\omVePqw.exe
  2⤵
  PID:7136
- C:\Windows\System\QqyqLMR.exe
  C:\Windows\System\QqyqLMR.exe
  2⤵
  PID:7904
- C:\Windows\System\dUXDklf.exe
  C:\Windows\System\dUXDklf.exe
  2⤵
  PID:7684
- C:\Windows\System\QvfyrqG.exe
  C:\Windows\System\QvfyrqG.exe
  2⤵
  PID:5212
- C:\Windows\System\VWyhdJB.exe
  C:\Windows\System\VWyhdJB.exe
  2⤵
  PID:7224
- C:\Windows\System\jiIrEdr.exe
  C:\Windows\System\jiIrEdr.exe
  2⤵
  PID:464
- C:\Windows\System\gbbyazb.exe
  C:\Windows\System\gbbyazb.exe
  2⤵
  PID:2692
- C:\Windows\System\DayifEH.exe
  C:\Windows\System\DayifEH.exe
  2⤵
  PID:7292
- C:\Windows\System\muVpZmK.exe
  C:\Windows\System\muVpZmK.exe
  2⤵
  PID:7524
- C:\Windows\System\MwrsuBI.exe
  C:\Windows\System\MwrsuBI.exe
  2⤵
  PID:7308
- C:\Windows\System\HzJleoB.exe
  C:\Windows\System\HzJleoB.exe
  2⤵
  PID:8012
- C:\Windows\System\CzlxPFJ.exe
  C:\Windows\System\CzlxPFJ.exe
  2⤵
  PID:7936
- C:\Windows\System\IfEGapf.exe
  C:\Windows\System\IfEGapf.exe
  2⤵
  PID:8096
- C:\Windows\System\AodOuLh.exe
  C:\Windows\System\AodOuLh.exe
  2⤵
  PID:8344
- C:\Windows\System\KeikQEE.exe
  C:\Windows\System\KeikQEE.exe
  2⤵
  PID:8472
- C:\Windows\System\TmmpHna.exe
  C:\Windows\System\TmmpHna.exe
  2⤵
  PID:8540
- C:\Windows\System\MOVfYXx.exe
  C:\Windows\System\MOVfYXx.exe
  2⤵
  PID:8612
- C:\Windows\System\BUSnOCC.exe
  C:\Windows\System\BUSnOCC.exe
  2⤵
  PID:2904
- C:\Windows\System\eCwpUTN.exe
  C:\Windows\System\eCwpUTN.exe
  2⤵
  PID:7548
- C:\Windows\System\jqUKpJY.exe
  C:\Windows\System\jqUKpJY.exe
  2⤵
  PID:7552
- C:\Windows\System\RUoywqv.exe
  C:\Windows\System\RUoywqv.exe
  2⤵
  PID:8248
- C:\Windows\System\fzYQCQl.exe
  C:\Windows\System\fzYQCQl.exe
  2⤵
  PID:8376
- C:\Windows\System\MFCcrgr.exe
  C:\Windows\System\MFCcrgr.exe
  2⤵
  PID:8760
- C:\Windows\System\xbSdSlN.exe
  C:\Windows\System\xbSdSlN.exe
  2⤵
  PID:8732
- C:\Windows\System\yfInaNX.exe
  C:\Windows\System\yfInaNX.exe
  2⤵
  PID:8780
- C:\Windows\System\CRRaOtl.exe
  C:\Windows\System\CRRaOtl.exe
  2⤵
  PID:8844
- C:\Windows\System\MfnOnIN.exe
  C:\Windows\System\MfnOnIN.exe
  2⤵
  PID:8876
- C:\Windows\System\jKgsiBD.exe
  C:\Windows\System\jKgsiBD.exe
  2⤵
  PID:8928
- C:\Windows\System\yORYVvB.exe
  C:\Windows\System\yORYVvB.exe
  2⤵
  PID:8976
- C:\Windows\System\zPOwDfh.exe
  C:\Windows\System\zPOwDfh.exe
  2⤵
  PID:9036
- C:\Windows\System\utjcnxf.exe
  C:\Windows\System\utjcnxf.exe
  2⤵
  PID:9032
- C:\Windows\System\zAnEmzZ.exe
  C:\Windows\System\zAnEmzZ.exe
  2⤵
  PID:9152
- C:\Windows\System\WMZiafn.exe
  C:\Windows\System\WMZiafn.exe
  2⤵
  PID:9176
- C:\Windows\System\JaJMBtI.exe
  C:\Windows\System\JaJMBtI.exe
  2⤵
  PID:7856
- C:\Windows\System\AtAJble.exe
  C:\Windows\System\AtAJble.exe
  2⤵
  PID:8076
- C:\Windows\System\ywJobyI.exe
  C:\Windows\System\ywJobyI.exe
  2⤵
  PID:8044
- C:\Windows\System\vrbXQZj.exe
  C:\Windows\System\vrbXQZj.exe
  2⤵
  PID:8252
- C:\Windows\System\lLLeGRO.exe
  C:\Windows\System\lLLeGRO.exe
  2⤵
  PID:7996
- C:\Windows\System\rUsoQHU.exe
  C:\Windows\System\rUsoQHU.exe
  2⤵
  PID:4460
- C:\Windows\System\DebmRpD.exe
  C:\Windows\System\DebmRpD.exe
  2⤵
  PID:7788
- C:\Windows\System\iQAcHXV.exe
  C:\Windows\System\iQAcHXV.exe
  2⤵
  PID:5728
- C:\Windows\System\vGRCgTM.exe
  C:\Windows\System\vGRCgTM.exe
  2⤵
  PID:7828
- C:\Windows\System\zpNnlNW.exe
  C:\Windows\System\zpNnlNW.exe
  2⤵
  PID:8204
- C:\Windows\System\CljGtvy.exe
  C:\Windows\System\CljGtvy.exe
  2⤵
  PID:7448
- C:\Windows\System\IWfMgfb.exe
  C:\Windows\System\IWfMgfb.exe
  2⤵
  PID:8636
- C:\Windows\System\fzaTZuw.exe
  C:\Windows\System\fzaTZuw.exe
  2⤵
  PID:8948
- C:\Windows\System\rCUNQZJ.exe
  C:\Windows\System\rCUNQZJ.exe
  2⤵
  PID:7740
- C:\Windows\System\dGWZKeY.exe
  C:\Windows\System\dGWZKeY.exe
  2⤵
  PID:9104
- C:\Windows\System\smrvvbb.exe
  C:\Windows\System\smrvvbb.exe
  2⤵
  PID:9232
- C:\Windows\System\UjYkEiR.exe
  C:\Windows\System\UjYkEiR.exe
  2⤵
  PID:9260
- C:\Windows\System\gtQzaOw.exe
  C:\Windows\System\gtQzaOw.exe
  2⤵
  PID:9280
- C:\Windows\System\TeINBGo.exe
  C:\Windows\System\TeINBGo.exe
  2⤵
  PID:9304
- C:\Windows\System\sUCAjAl.exe
  C:\Windows\System\sUCAjAl.exe
  2⤵
  PID:9324
- C:\Windows\System\xiBzXFW.exe
  C:\Windows\System\xiBzXFW.exe
  2⤵
  PID:9344
- C:\Windows\System\nmkJXoN.exe
  C:\Windows\System\nmkJXoN.exe
  2⤵
  PID:9360
- C:\Windows\System\hIDaTnc.exe
  C:\Windows\System\hIDaTnc.exe
  2⤵
  PID:9380
- C:\Windows\System\cwVcQDh.exe
  C:\Windows\System\cwVcQDh.exe
  2⤵
  PID:9396
- C:\Windows\System\NGWuUkc.exe
  C:\Windows\System\NGWuUkc.exe
  2⤵
  PID:9420
- C:\Windows\System\gXtLRlz.exe
  C:\Windows\System\gXtLRlz.exe
  2⤵
  PID:9444
- C:\Windows\System\CfJGhwk.exe
  C:\Windows\System\CfJGhwk.exe
  2⤵
  PID:9464
- C:\Windows\System\qxRLnXr.exe
  C:\Windows\System\qxRLnXr.exe
  2⤵
  PID:9484
- C:\Windows\System\vPZsOMi.exe
  C:\Windows\System\vPZsOMi.exe
  2⤵
  PID:9508
- C:\Windows\System\fzHrEtb.exe
  C:\Windows\System\fzHrEtb.exe
  2⤵
  PID:9536
- C:\Windows\System\jyIGXNh.exe
  C:\Windows\System\jyIGXNh.exe
  2⤵
  PID:9556
- C:\Windows\System\MlRCQqL.exe
  C:\Windows\System\MlRCQqL.exe
  2⤵
  PID:9576
- C:\Windows\System\mIFcEyq.exe
  C:\Windows\System\mIFcEyq.exe
  2⤵
  PID:9600
- C:\Windows\System\VfTdrFR.exe
  C:\Windows\System\VfTdrFR.exe
  2⤵
  PID:9616
- C:\Windows\System\XqyjtyO.exe
  C:\Windows\System\XqyjtyO.exe
  2⤵
  PID:9640
- C:\Windows\System\GOwQyrJ.exe
  C:\Windows\System\GOwQyrJ.exe
  2⤵
  PID:9660
- C:\Windows\System\pViPTym.exe
  C:\Windows\System\pViPTym.exe
  2⤵
  PID:9680
- C:\Windows\System\xadRSFZ.exe
  C:\Windows\System\xadRSFZ.exe
  2⤵
  PID:9700
- C:\Windows\System\KrlgXgf.exe
  C:\Windows\System\KrlgXgf.exe
  2⤵
  PID:9720
- C:\Windows\System\ISaOfYh.exe
  C:\Windows\System\ISaOfYh.exe
  2⤵
  PID:9736
- C:\Windows\System\joXOFyO.exe
  C:\Windows\System\joXOFyO.exe
  2⤵
  PID:9752
- C:\Windows\System\cQstfqr.exe
  C:\Windows\System\cQstfqr.exe
  2⤵
  PID:9772
- C:\Windows\System\jrnUBZF.exe
  C:\Windows\System\jrnUBZF.exe
  2⤵
  PID:9792
- C:\Windows\System\loYJiqt.exe
  C:\Windows\System\loYJiqt.exe
  2⤵
  PID:9808
- C:\Windows\System\dgoLdiV.exe
  C:\Windows\System\dgoLdiV.exe
  2⤵
  PID:9844
- C:\Windows\System\sjabbyz.exe
  C:\Windows\System\sjabbyz.exe
  2⤵
  PID:9868
- C:\Windows\System\UtwMfrp.exe
  C:\Windows\System\UtwMfrp.exe
  2⤵
  PID:9884
- C:\Windows\System\arctwTP.exe
  C:\Windows\System\arctwTP.exe
  2⤵
  PID:9904
- C:\Windows\System\VJXkdVG.exe
  C:\Windows\System\VJXkdVG.exe
  2⤵
  PID:9924
- C:\Windows\System\cSkNVvv.exe
  C:\Windows\System\cSkNVvv.exe
  2⤵
  PID:9948
- C:\Windows\System\IhlcyFr.exe
  C:\Windows\System\IhlcyFr.exe
  2⤵
  PID:9972
- C:\Windows\System\LRxTmhd.exe
  C:\Windows\System\LRxTmhd.exe
  2⤵
  PID:9128
- C:\Windows\System\MYuDYHd.exe
  C:\Windows\System\MYuDYHd.exe
  2⤵
  PID:9356
- C:\Windows\System\ucBVwKi.exe
  C:\Windows\System\ucBVwKi.exe
  2⤵
  PID:8064
- C:\Windows\System\aXleYnJ.exe
  C:\Windows\System\aXleYnJ.exe
  2⤵
  PID:9436
- C:\Windows\System\hortOOm.exe
  C:\Windows\System\hortOOm.exe
  2⤵
  PID:8184
- C:\Windows\System\bNIsdFA.exe
  C:\Windows\System\bNIsdFA.exe
  2⤵
  PID:8912
- C:\Windows\System\kaIQIsE.exe
  C:\Windows\System\kaIQIsE.exe
  2⤵
  PID:9084
- C:\Windows\System\IynzAjp.exe
  C:\Windows\System\IynzAjp.exe
  2⤵
  PID:9764
- C:\Windows\System\IZuNYgs.exe
  C:\Windows\System\IZuNYgs.exe
  2⤵
  PID:9252
- C:\Windows\System\zDuNfoX.exe
  C:\Windows\System\zDuNfoX.exe
  2⤵
  PID:9336
- C:\Windows\System\RXpeHrR.exe
  C:\Windows\System\RXpeHrR.exe
  2⤵
  PID:7920
- C:\Windows\System\ExnpXnq.exe
  C:\Windows\System\ExnpXnq.exe
  2⤵
  PID:9516
- C:\Windows\System\AsVYalT.exe
  C:\Windows\System\AsVYalT.exe
  2⤵
  PID:10032
- C:\Windows\System\UoLHgQW.exe
  C:\Windows\System\UoLHgQW.exe
  2⤵
  PID:9748
- C:\Windows\System\nBFBRvz.exe
  C:\Windows\System\nBFBRvz.exe
  2⤵
  PID:9276
- C:\Windows\System\CKSZmbw.exe
  C:\Windows\System\CKSZmbw.exe
  2⤵
  PID:9388
- C:\Windows\System\jEckZGi.exe
  C:\Windows\System\jEckZGi.exe
  2⤵
  PID:10244
- C:\Windows\System\DZkaWbV.exe
  C:\Windows\System\DZkaWbV.exe
  2⤵
  PID:10352
- C:\Windows\System\CXzLXan.exe
  C:\Windows\System\CXzLXan.exe
  2⤵
  PID:10368
- C:\Windows\System\jvnFIjU.exe
  C:\Windows\System\jvnFIjU.exe
  2⤵
  PID:10384
- C:\Windows\System\FXDxaJZ.exe
  C:\Windows\System\FXDxaJZ.exe
  2⤵
  PID:10408
- C:\Windows\System\ZEbqAbo.exe
  C:\Windows\System\ZEbqAbo.exe
  2⤵
  PID:10424
- C:\Windows\System\oZTOQoQ.exe
  C:\Windows\System\oZTOQoQ.exe
  2⤵
  PID:10448
- C:\Windows\System\wOxvudX.exe
  C:\Windows\System\wOxvudX.exe
  2⤵
  PID:10468
- C:\Windows\System\DkDwNal.exe
  C:\Windows\System\DkDwNal.exe
  2⤵
  PID:10492
- C:\Windows\System\lsGacTS.exe
  C:\Windows\System\lsGacTS.exe
  2⤵
  PID:10512
- C:\Windows\System\lhiTnev.exe
  C:\Windows\System\lhiTnev.exe
  2⤵
  PID:10528
- C:\Windows\System\NzCxypK.exe
  C:\Windows\System\NzCxypK.exe
  2⤵
  PID:10548
- C:\Windows\System\lEnbeJP.exe
  C:\Windows\System\lEnbeJP.exe
  2⤵
  PID:10568
- C:\Windows\System\VvxtVHu.exe
  C:\Windows\System\VvxtVHu.exe
  2⤵
  PID:10600
- C:\Windows\System\kKsRXsw.exe
  C:\Windows\System\kKsRXsw.exe
  2⤵
  PID:10616
- C:\Windows\System\Agovvib.exe
  C:\Windows\System\Agovvib.exe
  2⤵
  PID:10632
- C:\Windows\System\GwhMZBz.exe
  C:\Windows\System\GwhMZBz.exe
  2⤵
  PID:10648
- C:\Windows\System\zeFWWbt.exe
  C:\Windows\System\zeFWWbt.exe
  2⤵
  PID:10668
- C:\Windows\System\RRIyWbC.exe
  C:\Windows\System\RRIyWbC.exe
  2⤵
  PID:10692
- C:\Windows\System\rEhorjo.exe
  C:\Windows\System\rEhorjo.exe
  2⤵
  PID:10716
- C:\Windows\System\UHzqdoU.exe
  C:\Windows\System\UHzqdoU.exe
  2⤵
  PID:10744
- C:\Windows\System\SAPrzXl.exe
  C:\Windows\System\SAPrzXl.exe
  2⤵
  PID:10760
- C:\Windows\System\oVwBkwu.exe
  C:\Windows\System\oVwBkwu.exe
  2⤵
  PID:10780
- C:\Windows\System\EYNWvvv.exe
  C:\Windows\System\EYNWvvv.exe
  2⤵
  PID:10796
- C:\Windows\System\gAykdki.exe
  C:\Windows\System\gAykdki.exe
  2⤵
  PID:10816
- C:\Windows\System\RzJmhwq.exe
  C:\Windows\System\RzJmhwq.exe
  2⤵
  PID:10852
- C:\Windows\System\pXGgFDv.exe
  C:\Windows\System\pXGgFDv.exe
  2⤵
  PID:10876
- C:\Windows\System\EleJEwh.exe
  C:\Windows\System\EleJEwh.exe
  2⤵
  PID:10896
- C:\Windows\System\EaWZciQ.exe
  C:\Windows\System\EaWZciQ.exe
  2⤵
  PID:10912
- C:\Windows\System\PlebtWo.exe
  C:\Windows\System\PlebtWo.exe
  2⤵
  PID:10932
- C:\Windows\System\iwNmEsP.exe
  C:\Windows\System\iwNmEsP.exe
  2⤵
  PID:10948
- C:\Windows\System\XHOwGja.exe
  C:\Windows\System\XHOwGja.exe
  2⤵
  PID:10968
- C:\Windows\System\eOXozjT.exe
  C:\Windows\System\eOXozjT.exe
  2⤵
  PID:10988
- C:\Windows\System\kSRaEjY.exe
  C:\Windows\System\kSRaEjY.exe
  2⤵
  PID:11004
- C:\Windows\System\mkYKnSl.exe
  C:\Windows\System\mkYKnSl.exe
  2⤵
  PID:11040
- C:\Windows\System\nAoHDXd.exe
  C:\Windows\System\nAoHDXd.exe
  2⤵
  PID:11060
- C:\Windows\System\fZMWfKA.exe
  C:\Windows\System\fZMWfKA.exe
  2⤵
  PID:11084
- C:\Windows\System\ZAWytKi.exe
  C:\Windows\System\ZAWytKi.exe
  2⤵
  PID:11104
- C:\Windows\System\CPyIANh.exe
  C:\Windows\System\CPyIANh.exe
  2⤵
  PID:11124
- C:\Windows\System\jNymxQA.exe
  C:\Windows\System\jNymxQA.exe
  2⤵
  PID:11148
- C:\Windows\System\yusqKCE.exe
  C:\Windows\System\yusqKCE.exe
  2⤵
  PID:11172
- C:\Windows\System\JusLOyB.exe
  C:\Windows\System\JusLOyB.exe
  2⤵
  PID:11196
- C:\Windows\System\lQigjqA.exe
  C:\Windows\System\lQigjqA.exe
  2⤵
  PID:10504
- C:\Windows\System\rIKHYRW.exe
  C:\Windows\System\rIKHYRW.exe
  2⤵
  PID:10580
- C:\Windows\System\ZOZWyvh.exe
  C:\Windows\System\ZOZWyvh.exe
  2⤵
  PID:9316
- C:\Windows\System\UZfDVnr.exe
  C:\Windows\System\UZfDVnr.exe
  2⤵
  PID:9552
- C:\Windows\System\PJhcNfB.exe
  C:\Windows\System\PJhcNfB.exe
  2⤵
  PID:9716
- C:\Windows\System\hTDNddp.exe
  C:\Windows\System\hTDNddp.exe
  2⤵
  PID:9832
- C:\Windows\System\UjOSwFK.exe
  C:\Windows\System\UjOSwFK.exe
  2⤵
  PID:9944
- C:\Windows\System\tUukJhE.exe
  C:\Windows\System\tUukJhE.exe
  2⤵
  PID:9876
- C:\Windows\System\KEtOBWj.exe
  C:\Windows\System\KEtOBWj.exe
  2⤵
  PID:10416
- C:\Windows\System\ofDVrTy.exe
  C:\Windows\System\ofDVrTy.exe
  2⤵
  PID:10436
- C:\Windows\System\qDUykrD.exe
  C:\Windows\System\qDUykrD.exe
  2⤵
  PID:10488
- C:\Windows\System\IlvEZMw.exe
  C:\Windows\System\IlvEZMw.exe
  2⤵
  PID:9340
- C:\Windows\System\xEqyoDz.exe
  C:\Windows\System\xEqyoDz.exe
  2⤵
  PID:10364
- C:\Windows\System\oIkRpxq.exe
  C:\Windows\System\oIkRpxq.exe
  2⤵
  PID:10976
- C:\Windows\System\oUWDQrZ.exe
  C:\Windows\System\oUWDQrZ.exe
  2⤵
  PID:10684
- C:\Windows\System\IsLlpaM.exe
  C:\Windows\System\IsLlpaM.exe
  2⤵
  PID:11096
- C:\Windows\System\fmvFYwZ.exe
  C:\Windows\System\fmvFYwZ.exe
  2⤵
  PID:10520
- C:\Windows\System\kCnSJtC.exe
  C:\Windows\System\kCnSJtC.exe
  2⤵
  PID:9624
- C:\Windows\System\vPQBSvf.exe
  C:\Windows\System\vPQBSvf.exe
  2⤵
  PID:10544
- C:\Windows\System\bpgCQhw.exe
  C:\Windows\System\bpgCQhw.exe
  2⤵
  PID:11056
- C:\Windows\System\ePIwldH.exe
  C:\Windows\System\ePIwldH.exe
  2⤵
  PID:11204
- C:\Windows\System\amNJBAs.exe
  C:\Windows\System\amNJBAs.exe
  2⤵
  PID:10536
- C:\Windows\System\nKAXnhj.exe
  C:\Windows\System\nKAXnhj.exe
  2⤵
  PID:11036
- C:\Windows\System\aRqRokz.exe
  C:\Windows\System\aRqRokz.exe
  2⤵
  PID:11268
- C:\Windows\System\sRVkGkH.exe
  C:\Windows\System\sRVkGkH.exe
  2⤵
  PID:11304
- C:\Windows\System\ZtuNSyi.exe
  C:\Windows\System\ZtuNSyi.exe
  2⤵
  PID:11324
- C:\Windows\System\AIFZsXf.exe
  C:\Windows\System\AIFZsXf.exe
  2⤵
  PID:11352
- C:\Windows\System\OOYQZOj.exe
  C:\Windows\System\OOYQZOj.exe
  2⤵
  PID:11372
- C:\Windows\System\OOwRaSC.exe
  C:\Windows\System\OOwRaSC.exe
  2⤵
  PID:11392
- C:\Windows\System\PZiLCzM.exe
  C:\Windows\System\PZiLCzM.exe
  2⤵
  PID:11408
- C:\Windows\System\FWapUOl.exe
  C:\Windows\System\FWapUOl.exe
  2⤵
  PID:11424
- C:\Windows\System\sLWPZtM.exe
  C:\Windows\System\sLWPZtM.exe
  2⤵
  PID:11444
- C:\Windows\System\dTryTVT.exe
  C:\Windows\System\dTryTVT.exe
  2⤵
  PID:11464
- C:\Windows\System\TkdzfOh.exe
  C:\Windows\System\TkdzfOh.exe
  2⤵
  PID:11484
- C:\Windows\System\GoBNYve.exe
  C:\Windows\System\GoBNYve.exe
  2⤵
  PID:11508
- C:\Windows\System\tUewHug.exe
  C:\Windows\System\tUewHug.exe
  2⤵
  PID:11532
- C:\Windows\System\dyiKmeE.exe
  C:\Windows\System\dyiKmeE.exe
  2⤵
  PID:11548
- C:\Windows\System\GJBcfOt.exe
  C:\Windows\System\GJBcfOt.exe
  2⤵
  PID:11564
- C:\Windows\System\ykXNfBC.exe
  C:\Windows\System\ykXNfBC.exe
  2⤵
  PID:11688
- C:\Windows\System\lpgjwxR.exe
  C:\Windows\System\lpgjwxR.exe
  2⤵
  PID:11704
- C:\Windows\System\zQzYBBD.exe
  C:\Windows\System\zQzYBBD.exe
  2⤵
  PID:11740
- C:\Windows\System\TQacMIy.exe
  C:\Windows\System\TQacMIy.exe
  2⤵
  PID:11768
- C:\Windows\System\MxzGYBV.exe
  C:\Windows\System\MxzGYBV.exe
  2⤵
  PID:11792
- C:\Windows\System\JmEejoE.exe
  C:\Windows\System\JmEejoE.exe
  2⤵
  PID:11812
- C:\Windows\System\GZZbdcB.exe
  C:\Windows\System\GZZbdcB.exe
  2⤵
  PID:11836
- C:\Windows\System\gTLKTDS.exe
  C:\Windows\System\gTLKTDS.exe
  2⤵
  PID:11852
- C:\Windows\System\GbvurIQ.exe
  C:\Windows\System\GbvurIQ.exe
  2⤵
  PID:11872
- C:\Windows\System\gWgEHrS.exe
  C:\Windows\System\gWgEHrS.exe
  2⤵
  PID:11900
- C:\Windows\System\OIWJKaS.exe
  C:\Windows\System\OIWJKaS.exe
  2⤵
  PID:11920
- C:\Windows\System\LEkFbWv.exe
  C:\Windows\System\LEkFbWv.exe
  2⤵
  PID:11944
- C:\Windows\System\uSVbHmq.exe
  C:\Windows\System\uSVbHmq.exe
  2⤵
  PID:11964
- C:\Windows\System\TjkDDMc.exe
  C:\Windows\System\TjkDDMc.exe
  2⤵
  PID:11984
- C:\Windows\System\DLtnQQB.exe
  C:\Windows\System\DLtnQQB.exe
  2⤵
  PID:12004
- C:\Windows\System\TynPiJZ.exe
  C:\Windows\System\TynPiJZ.exe
  2⤵
  PID:12024
- C:\Windows\System\llNVxxX.exe
  C:\Windows\System\llNVxxX.exe
  2⤵
  PID:12048
- C:\Windows\System\PFmZQJu.exe
  C:\Windows\System\PFmZQJu.exe
  2⤵
  PID:12068
- C:\Windows\System\ZSSLxoq.exe
  C:\Windows\System\ZSSLxoq.exe
  2⤵
  PID:12084
- C:\Windows\System\aFPPxEk.exe
  C:\Windows\System\aFPPxEk.exe
  2⤵
  PID:12100
- C:\Windows\System\PhseTcL.exe
  C:\Windows\System\PhseTcL.exe
  2⤵
  PID:12116
- C:\Windows\System\JfQyigX.exe
  C:\Windows\System\JfQyigX.exe
  2⤵
  PID:12132
- C:\Windows\System\kXlDHvb.exe
  C:\Windows\System\kXlDHvb.exe
  2⤵
  PID:12156
- C:\Windows\System\pCDQcMj.exe
  C:\Windows\System\pCDQcMj.exe
  2⤵
  PID:12176
- C:\Windows\System\FMfPHXd.exe
  C:\Windows\System\FMfPHXd.exe
  2⤵
  PID:12200
- C:\Windows\System\ryOXiBU.exe
  C:\Windows\System\ryOXiBU.exe
  2⤵
  PID:12216
- C:\Windows\System\IIRKvsP.exe
  C:\Windows\System\IIRKvsP.exe
  2⤵
  PID:12232
- C:\Windows\System\RDALNVI.exe
  C:\Windows\System\RDALNVI.exe
  2⤵
  PID:11032
- C:\Windows\System\AzzOzbO.exe
  C:\Windows\System\AzzOzbO.exe
  2⤵
  PID:11236
- C:\Windows\System\JWsexTi.exe
  C:\Windows\System\JWsexTi.exe
  2⤵
  PID:4452
- C:\Windows\System\PWECrCL.exe
  C:\Windows\System\PWECrCL.exe
  2⤵
  PID:11164
- C:\Windows\System\GaQCyBL.exe
  C:\Windows\System\GaQCyBL.exe
  2⤵
  PID:11208
- C:\Windows\System\bhelTwk.exe
  C:\Windows\System\bhelTwk.exe
  2⤵
  PID:10756
- C:\Windows\System\IuHukgH.exe
  C:\Windows\System\IuHukgH.exe
  2⤵
  PID:11388
- C:\Windows\System\kvMpDgC.exe
  C:\Windows\System\kvMpDgC.exe
  2⤵
  PID:11028
- C:\Windows\System\aXIpqeh.exe
  C:\Windows\System\aXIpqeh.exe
  2⤵
  PID:11332
- C:\Windows\System\fAfixNt.exe
  C:\Windows\System\fAfixNt.exe
  2⤵
  PID:11516
- C:\Windows\System\KdOVFkR.exe
  C:\Windows\System\KdOVFkR.exe
  2⤵
  PID:11576
- C:\Windows\System\aDhrjPN.exe
  C:\Windows\System\aDhrjPN.exe
  2⤵
  PID:11596
- C:\Windows\System\CUeqEbL.exe
  C:\Windows\System\CUeqEbL.exe
  2⤵
  PID:11460
- C:\Windows\System\brnGVQg.exe
  C:\Windows\System\brnGVQg.exe
  2⤵
  PID:11504
- C:\Windows\System\iMCgeQm.exe
  C:\Windows\System\iMCgeQm.exe
  2⤵
  PID:4804
- C:\Windows\System\btEdKHu.exe
  C:\Windows\System\btEdKHu.exe
  2⤵
  PID:11976
- C:\Windows\System\mDilQqW.exe
  C:\Windows\System\mDilQqW.exe
  2⤵
  PID:12124
- C:\Windows\System\nTgpHFy.exe
  C:\Windows\System\nTgpHFy.exe
  2⤵
  PID:12244
- C:\Windows\System\EvyzcMF.exe
  C:\Windows\System\EvyzcMF.exe
  2⤵
  PID:12080
- C:\Windows\System\lsgKUra.exe
  C:\Windows\System\lsgKUra.exe
  2⤵
  PID:11880
- C:\Windows\System\HgRUCFn.exe
  C:\Windows\System\HgRUCFn.exe
  2⤵
  PID:10232
- C:\Windows\System\skMLBOt.exe
  C:\Windows\System\skMLBOt.exe
  2⤵
  PID:10752
- C:\Windows\System\WLRqJSh.exe
  C:\Windows\System\WLRqJSh.exe
  2⤵
  PID:12044
- C:\Windows\System\ksvaCMJ.exe
  C:\Windows\System\ksvaCMJ.exe
  2⤵
  PID:12192
- C:\Windows\System\CmUCudr.exe
  C:\Windows\System\CmUCudr.exe
  2⤵
  PID:12284
- C:\Windows\System\EUjkEKi.exe
  C:\Windows\System\EUjkEKi.exe
  2⤵
  PID:9932
- C:\Windows\System\KowEGzb.exe
  C:\Windows\System\KowEGzb.exe
  2⤵
  PID:11320
- C:\Windows\System\VWKOyZr.exe
  C:\Windows\System\VWKOyZr.exe
  2⤵
  PID:11492
- C:\Windows\System\XvoZIRB.exe
  C:\Windows\System\XvoZIRB.exe
  2⤵
  PID:10396
- C:\Windows\System\OEZbjBD.exe
  C:\Windows\System\OEZbjBD.exe
  2⤵
  PID:12308
- C:\Windows\System\sYJggjl.exe
  C:\Windows\System\sYJggjl.exe
  2⤵
  PID:12328
- C:\Windows\System\wecycPR.exe
  C:\Windows\System\wecycPR.exe
  2⤵
  PID:12352
- C:\Windows\System\EtZiVlv.exe
  C:\Windows\System\EtZiVlv.exe
  2⤵
  PID:12376
- C:\Windows\System\caQfkld.exe
  C:\Windows\System\caQfkld.exe
  2⤵
  PID:12396
- C:\Windows\System\ncKISnw.exe
  C:\Windows\System\ncKISnw.exe
  2⤵
  PID:12412
- C:\Windows\System\HUmOAYn.exe
  C:\Windows\System\HUmOAYn.exe
  2⤵
  PID:12428
- C:\Windows\System\cfIXeSb.exe
  C:\Windows\System\cfIXeSb.exe
  2⤵
  PID:12444
- C:\Windows\System\grlTjqz.exe
  C:\Windows\System\grlTjqz.exe
  2⤵
  PID:12460
- C:\Windows\System\DqwoJYw.exe
  C:\Windows\System\DqwoJYw.exe
  2⤵
  PID:12476
- C:\Windows\System\XQyfJAL.exe
  C:\Windows\System\XQyfJAL.exe
  2⤵
  PID:12500
- C:\Windows\System\tMMQqcS.exe
  C:\Windows\System\tMMQqcS.exe
  2⤵
  PID:12516
- C:\Windows\System\NlcKqWn.exe
  C:\Windows\System\NlcKqWn.exe
  2⤵
  PID:12532
- C:\Windows\System\TEkhHXY.exe
  C:\Windows\System\TEkhHXY.exe
  2⤵
  PID:12548
- C:\Windows\System\rQrLpYr.exe
  C:\Windows\System\rQrLpYr.exe
  2⤵
  PID:12564
- C:\Windows\System\LkSwCXd.exe
  C:\Windows\System\LkSwCXd.exe
  2⤵
  PID:12584
- C:\Windows\System\CSTeuab.exe
  C:\Windows\System\CSTeuab.exe
  2⤵
  PID:12604
- C:\Windows\System\AvcJrDF.exe
  C:\Windows\System\AvcJrDF.exe
  2⤵
  PID:12624
- C:\Windows\System\mdRjIku.exe
  C:\Windows\System\mdRjIku.exe
  2⤵
  PID:12640
- C:\Windows\System\ZzpqKWj.exe
  C:\Windows\System\ZzpqKWj.exe
  2⤵
  PID:12664
- C:\Windows\System\YbiZkSv.exe
  C:\Windows\System\YbiZkSv.exe
  2⤵
  PID:12688
- C:\Windows\System\lJxtStV.exe
  C:\Windows\System\lJxtStV.exe
  2⤵
  PID:12708
- C:\Windows\System\JlinXku.exe
  C:\Windows\System\JlinXku.exe
  2⤵
  PID:12728
- C:\Windows\System\MXbGZOQ.exe
  C:\Windows\System\MXbGZOQ.exe
  2⤵
  PID:12748
- C:\Windows\System\OpnLTtY.exe
  C:\Windows\System\OpnLTtY.exe
  2⤵
  PID:12768
- C:\Windows\System\zbYeqCE.exe
  C:\Windows\System\zbYeqCE.exe
  2⤵
  PID:12784
- C:\Windows\System\mBQBfZp.exe
  C:\Windows\System\mBQBfZp.exe
  2⤵
  PID:12800
- C:\Windows\System\FjZNyLJ.exe
  C:\Windows\System\FjZNyLJ.exe
  2⤵
  PID:12824
- C:\Windows\System\DoqYsfN.exe
  C:\Windows\System\DoqYsfN.exe
  2⤵
  PID:12844
- C:\Windows\System\MwzgAge.exe
  C:\Windows\System\MwzgAge.exe
  2⤵
  PID:12864
- C:\Windows\System\zuasQeE.exe
  C:\Windows\System\zuasQeE.exe
  2⤵
  PID:12884
- C:\Windows\System\XImABgK.exe
  C:\Windows\System\XImABgK.exe
  2⤵
  PID:12900
- C:\Windows\System\nrOGsnE.exe
  C:\Windows\System\nrOGsnE.exe
  2⤵
  PID:12916
- C:\Windows\System\BVJlBlb.exe
  C:\Windows\System\BVJlBlb.exe
  2⤵
  PID:12932
- C:\Windows\System\nNMAdgk.exe
  C:\Windows\System\nNMAdgk.exe
  2⤵
  PID:12952
- C:\Windows\System\RaJdvPc.exe
  C:\Windows\System\RaJdvPc.exe
  2⤵
  PID:12968
- C:\Windows\System\wivdfvX.exe
  C:\Windows\System\wivdfvX.exe
  2⤵
  PID:12984
- C:\Windows\System\FPIzytD.exe
  C:\Windows\System\FPIzytD.exe
  2⤵
  PID:13004
- C:\Windows\System\nxlEYzw.exe
  C:\Windows\System\nxlEYzw.exe
  2⤵
  PID:13032
- C:\Windows\System\BUtNyhx.exe
  C:\Windows\System\BUtNyhx.exe
  2⤵
  PID:13052
- C:\Windows\System\VXZOvgP.exe
  C:\Windows\System\VXZOvgP.exe
  2⤵
  PID:13072
- C:\Windows\System\PCeSCea.exe
  C:\Windows\System\PCeSCea.exe
  2⤵
  PID:13092
- C:\Windows\System\yvKQVAq.exe
  C:\Windows\System\yvKQVAq.exe
  2⤵
  PID:13112
- C:\Windows\System\SgJJaza.exe
  C:\Windows\System\SgJJaza.exe
  2⤵
  PID:13132
- C:\Windows\System\QjzeIOS.exe
  C:\Windows\System\QjzeIOS.exe
  2⤵
  PID:13156
- C:\Windows\System\cZSQYKG.exe
  C:\Windows\System\cZSQYKG.exe
  2⤵
  PID:12928
- C:\Windows\System\SUayKsU.exe
  C:\Windows\System\SUayKsU.exe
  2⤵
  PID:13024
- C:\Windows\System\MwknKBb.exe
  C:\Windows\System\MwknKBb.exe
  2⤵
  PID:12792
- C:\Windows\System\OHUoCxL.exe
  C:\Windows\System\OHUoCxL.exe
  2⤵
  PID:12892
- C:\Windows\System\TyXdgwm.exe
  C:\Windows\System\TyXdgwm.exe
  2⤵
  PID:11556
- C:\Windows\System\XzsjVdD.exe
  C:\Windows\System\XzsjVdD.exe
  2⤵
  PID:12296
- C:\Windows\System\PlbyxPY.exe
  C:\Windows\System\PlbyxPY.exe
  2⤵
  PID:11440
- C:\Windows\System\HvZZQsH.exe
  C:\Windows\System\HvZZQsH.exe
  2⤵
  PID:12512
- C:\Windows\System\RRnvuyl.exe
  C:\Windows\System\RRnvuyl.exe
  2⤵
  PID:12492
- C:\Windows\System\EGYngEs.exe
  C:\Windows\System\EGYngEs.exe
  2⤵
  PID:2964
- C:\Windows\System\eAApJOF.exe
  C:\Windows\System\eAApJOF.exe
  2⤵
  PID:2532
- C:\Windows\System\oMuilpS.exe
  C:\Windows\System\oMuilpS.exe
  2⤵
  PID:12420
- C:\Windows\System\WGQnfli.exe
  C:\Windows\System\WGQnfli.exe
  2⤵
  PID:13108
- C:\Windows\System\QcNnOiI.exe
  C:\Windows\System\QcNnOiI.exe
  2⤵
  PID:13000
- C:\Windows\System\mDzVnui.exe
  C:\Windows\System\mDzVnui.exe
  2⤵
  PID:13232
- C:\Windows\System\nYgwgUP.exe
  C:\Windows\System\nYgwgUP.exe
  2⤵
  PID:11420
- C:\Windows\System\mILHFyU.exe
  C:\Windows\System\mILHFyU.exe
  2⤵
  PID:9048
- C:\Windows\System\Opoqvni.exe
  C:\Windows\System\Opoqvni.exe
  2⤵
  PID:13164
- C:\Windows\System\swFTFUH.exe
  C:\Windows\System\swFTFUH.exe
  2⤵
  PID:13204
- C:\Windows\System\CEIoeim.exe
  C:\Windows\System\CEIoeim.exe
  2⤵
  PID:9272
- C:\Windows\System\LmknjwK.exe
  C:\Windows\System\LmknjwK.exe
  2⤵
  PID:13220
- C:\Windows\System\MnoASiF.exe
  C:\Windows\System\MnoASiF.exe
  2⤵
  PID:5060
- C:\Windows\System\CjCdyqY.exe
  C:\Windows\System\CjCdyqY.exe
  2⤵
  PID:4748
- C:\Windows\System\UFtauNe.exe
  C:\Windows\System\UFtauNe.exe
  2⤵
  PID:1508
- C:\Windows\System\FxnRSlm.exe
  C:\Windows\System\FxnRSlm.exe
  2⤵
  PID:12716
- C:\Windows\System\RqMgcSd.exe
  C:\Windows\System\RqMgcSd.exe
  2⤵
  PID:13208
- C:\Windows\System\dbTAAcB.exe
  C:\Windows\System\dbTAAcB.exe
  2⤵
  PID:12384
- C:\Windows\System\dDeZnCx.exe
  C:\Windows\System\dDeZnCx.exe
  2⤵
  PID:2140
- C:\Windows\System\LEJQQZo.exe
  C:\Windows\System\LEJQQZo.exe
  2⤵
  PID:1732
- C:\Windows\System\vGIyQwG.exe
  C:\Windows\System\vGIyQwG.exe
  2⤵
  PID:12488
- C:\Windows\System\BNYwTCw.exe
  C:\Windows\System\BNYwTCw.exe
  2⤵
  PID:452
- C:\Windows\System\fRaYfCD.exe
  C:\Windows\System\fRaYfCD.exe
  2⤵
  PID:12744
- C:\Windows\System\RiNocFk.exe
  C:\Windows\System\RiNocFk.exe
  2⤵
  PID:13284
- C:\Windows\System\ekNaMAX.exe
  C:\Windows\System\ekNaMAX.exe
  2⤵
  PID:6416
- C:\Windows\System\BDQPfLZ.exe
  C:\Windows\System\BDQPfLZ.exe
  2⤵
  PID:3560
- C:\Windows\System\ukOJFnA.exe
  C:\Windows\System\ukOJFnA.exe
  2⤵
  PID:12764
- C:\Windows\System\BzuumXq.exe
  C:\Windows\System\BzuumXq.exe
  2⤵
  PID:6692
- C:\Windows\System\tnIDcVD.exe
  C:\Windows\System\tnIDcVD.exe
  2⤵
  PID:12860
- C:\Windows\System\cgUadXy.exe
  C:\Windows\System\cgUadXy.exe
  2⤵
  PID:6156
- C:\Windows\System\lezfTMd.exe
  C:\Windows\System\lezfTMd.exe
  2⤵
  PID:5024
- C:\Windows\System\qyGJQmV.exe
  C:\Windows\System\qyGJQmV.exe
  2⤵
  PID:4716
- C:\Windows\System\KKWRiEO.exe
  C:\Windows\System\KKWRiEO.exe
  2⤵
  PID:1112
- C:\Windows\System\osWsRdE.exe
  C:\Windows\System\osWsRdE.exe
  2⤵
  PID:228
- C:\Windows\System\hxHTLbe.exe
  C:\Windows\System\hxHTLbe.exe
  2⤵
  PID:3060
- C:\Windows\System\itkylxy.exe
  C:\Windows\System\itkylxy.exe
  2⤵
  PID:12184
- C:\Windows\System\xAwTsQQ.exe
  C:\Windows\System\xAwTsQQ.exe
  2⤵
  PID:4548
- C:\Windows\System\YLUcXzs.exe
  C:\Windows\System\YLUcXzs.exe
  2⤵
  PID:1504
- C:\Windows\System\zscmNVS.exe
  C:\Windows\System\zscmNVS.exe
  2⤵
  PID:1796
- C:\Windows\System\WHRySVL.exe
  C:\Windows\System\WHRySVL.exe
  2⤵
  PID:4816
- C:\Windows\System\zxLguhJ.exe
  C:\Windows\System\zxLguhJ.exe
  2⤵
  PID:1156
- C:\Windows\System\wAEdyYc.exe
  C:\Windows\System\wAEdyYc.exe
  2⤵
  PID:528
- C:\Windows\System\JzFkONg.exe
  C:\Windows\System\JzFkONg.exe
  2⤵
  PID:4472
- C:\Windows\System\QjKwEzy.exe
  C:\Windows\System\QjKwEzy.exe
  2⤵
  PID:12832
- C:\Windows\System\OfIAxlE.exe
  C:\Windows\System\OfIAxlE.exe
  2⤵
  PID:2080
- C:\Windows\System\MRwNJDA.exe
  C:\Windows\System\MRwNJDA.exe
  2⤵
  PID:4720
- C:\Windows\System\AyxahkY.exe
  C:\Windows\System\AyxahkY.exe
  2⤵
  PID:1692
- C:\Windows\System\aRbtUaS.exe
  C:\Windows\System\aRbtUaS.exe
  2⤵
  PID:1656
- C:\Windows\System\ZLDPjlx.exe
  C:\Windows\System\ZLDPjlx.exe
  2⤵
  PID:12960
- C:\Windows\System\UqVTDHu.exe
  C:\Windows\System\UqVTDHu.exe
  2⤵
  PID:12508
- C:\Windows\System\oIEHVRg.exe
  C:\Windows\System\oIEHVRg.exe
  2⤵
  PID:1496
- C:\Windows\System\mzKLyfx.exe
  C:\Windows\System\mzKLyfx.exe
  2⤵
  PID:5016
- C:\Windows\System\zflQNJn.exe
  C:\Windows\System\zflQNJn.exe
  2⤵
  PID:4936
- C:\Windows\System\LLawSVf.exe
  C:\Windows\System\LLawSVf.exe
  2⤵
  PID:6372
- C:\Windows\System\xdKshNm.exe
  C:\Windows\System\xdKshNm.exe
  2⤵
  PID:5864
- C:\Windows\System\CAzYnMe.exe
  C:\Windows\System\CAzYnMe.exe
  2⤵
  PID:5164
- C:\Windows\System\ncCBCmL.exe
  C:\Windows\System\ncCBCmL.exe
  2⤵
  PID:6820
- C:\Windows\System\HBGULQM.exe
  C:\Windows\System\HBGULQM.exe
  2⤵
  PID:11864
- C:\Windows\System\febLspB.exe
  C:\Windows\System\febLspB.exe
  2⤵
  PID:4184
- C:\Windows\System\utDcypD.exe
  C:\Windows\System\utDcypD.exe
  2⤵
  PID:2152
- C:\Windows\System\dIGBweh.exe
  C:\Windows\System\dIGBweh.exe
  2⤵
  PID:3524
- C:\Windows\System\KPXTZSt.exe
  C:\Windows\System\KPXTZSt.exe
  2⤵
  PID:3308
- C:\Windows\System\KFWeVke.exe
  C:\Windows\System\KFWeVke.exe
  2⤵
  PID:13320
- C:\Windows\System\WppXJqb.exe
  C:\Windows\System\WppXJqb.exe
  2⤵
  PID:13412
- C:\Windows\System\kovPHVX.exe
  C:\Windows\System\kovPHVX.exe
  2⤵
  PID:13484
- C:\Windows\System\hBfTwPX.exe
  C:\Windows\System\hBfTwPX.exe
  2⤵
  PID:13516
- C:\Windows\System\DSzLdBq.exe
  C:\Windows\System\DSzLdBq.exe
  2⤵
  PID:13540
- C:\Windows\System\icBxBGw.exe
  C:\Windows\System\icBxBGw.exe
  2⤵
  PID:13568
- C:\Windows\System\oLDFCZG.exe
  C:\Windows\System\oLDFCZG.exe
  2⤵
  PID:13592
- C:\Windows\System\JHLDRIY.exe
  C:\Windows\System\JHLDRIY.exe
  2⤵
  PID:13612
- C:\Windows\System\kmfoMjh.exe
  C:\Windows\System\kmfoMjh.exe
  2⤵
  PID:13628
- C:\Windows\System\lANpUAV.exe
  C:\Windows\System\lANpUAV.exe
  2⤵
  PID:13644
- C:\Windows\System\idaUwfl.exe
  C:\Windows\System\idaUwfl.exe
  2⤵
  PID:13672
- C:\Windows\System\pmQsyGY.exe
  C:\Windows\System\pmQsyGY.exe
  2⤵
  PID:13692
- C:\Windows\System\JFQuVon.exe
  C:\Windows\System\JFQuVon.exe
  2⤵
  PID:13712
- C:\Windows\System\EugRACS.exe
  C:\Windows\System\EugRACS.exe
  2⤵
  PID:13732
- C:\Windows\System\wcgirmj.exe
  C:\Windows\System\wcgirmj.exe
  2⤵
  PID:13752
- C:\Windows\System\fmAskJM.exe
  C:\Windows\System\fmAskJM.exe
  2⤵
  PID:13772
- C:\Windows\System\sMxeYrO.exe
  C:\Windows\System\sMxeYrO.exe
  2⤵
  PID:13792
- C:\Windows\System\DQaWnHI.exe
  C:\Windows\System\DQaWnHI.exe
  2⤵
  PID:13820
- C:\Windows\System\VhUTLzV.exe
  C:\Windows\System\VhUTLzV.exe
  2⤵
  PID:13844
- C:\Windows\System\eDJAgac.exe
  C:\Windows\System\eDJAgac.exe
  2⤵
  PID:13872
- C:\Windows\System\mZwKMrg.exe
  C:\Windows\System\mZwKMrg.exe
  2⤵
  PID:13892
- C:\Windows\System\puMkmUe.exe
  C:\Windows\System\puMkmUe.exe
  2⤵
  PID:13912
- C:\Windows\System\staQxzC.exe
  C:\Windows\System\staQxzC.exe
  2⤵
  PID:13932
- C:\Windows\System\VSLmTtH.exe
  C:\Windows\System\VSLmTtH.exe
  2⤵
  PID:13952
- C:\Windows\System\NlaxPrp.exe
  C:\Windows\System\NlaxPrp.exe
  2⤵
  PID:13976
- C:\Windows\System\XqqDtsi.exe
  C:\Windows\System\XqqDtsi.exe
  2⤵
  PID:14000
- C:\Windows\System\ZBScxMg.exe
  C:\Windows\System\ZBScxMg.exe
  2⤵
  PID:14024
- C:\Windows\System\rvaIjiA.exe
  C:\Windows\System\rvaIjiA.exe
  2⤵
  PID:14040
- C:\Windows\System\txgZRYd.exe
  C:\Windows\System\txgZRYd.exe
  2⤵
  PID:14056
- C:\Windows\System\YvDsymH.exe
  C:\Windows\System\YvDsymH.exe
  2⤵
  PID:14076
- C:\Windows\System\xVBDKMN.exe
  C:\Windows\System\xVBDKMN.exe
  2⤵
  PID:14096
- C:\Windows\System\igNLeSN.exe
  C:\Windows\System\igNLeSN.exe
  2⤵
  PID:14120
- C:\Windows\System\waaunCw.exe
  C:\Windows\System\waaunCw.exe
  2⤵
  PID:14212
- C:\Windows\System\YRaBiUJ.exe
  C:\Windows\System\YRaBiUJ.exe
  2⤵
  PID:14228
- C:\Windows\System\OuBmaIH.exe
  C:\Windows\System\OuBmaIH.exe
  2⤵
  PID:14248
- C:\Windows\System\fdKFTJz.exe
  C:\Windows\System\fdKFTJz.exe
  2⤵
  PID:14268
- C:\Windows\System\ICLZkxM.exe
  C:\Windows\System\ICLZkxM.exe
  2⤵
  PID:14288
- C:\Windows\System\hwRgqXr.exe
  C:\Windows\System\hwRgqXr.exe
  2⤵
  PID:14308
- C:\Windows\System\cMEDHuH.exe
  C:\Windows\System\cMEDHuH.exe
  2⤵
  PID:14324
- C:\Windows\System\lglEEEw.exe
  C:\Windows\System\lglEEEw.exe
  2⤵
  PID:6476
- C:\Windows\System\VeyztGz.exe
  C:\Windows\System\VeyztGz.exe
  2⤵
  PID:2164
- C:\Windows\System\xUvZjKJ.exe
  C:\Windows\System\xUvZjKJ.exe
  2⤵
  PID:2136
- C:\Windows\System\ljwWWoc.exe
  C:\Windows\System\ljwWWoc.exe
  2⤵
  PID:2560
- C:\Windows\System\AbIQCHX.exe
  C:\Windows\System\AbIQCHX.exe
  2⤵
  PID:5380
- C:\Windows\System\jKGmAJK.exe
  C:\Windows\System\jKGmAJK.exe
  2⤵
  PID:1164
- C:\Windows\System\inGrNqt.exe
  C:\Windows\System\inGrNqt.exe
  2⤵
  PID:11664
- C:\Windows\System\LOfVeui.exe
  C:\Windows\System\LOfVeui.exe
  2⤵
  PID:1764
- C:\Windows\System\cTOfzUA.exe
  C:\Windows\System\cTOfzUA.exe
  2⤵
  PID:13424
- C:\Windows\System\jPkNnjJ.exe
  C:\Windows\System\jPkNnjJ.exe
  2⤵
  PID:5576
- C:\Windows\System\nuVpzkD.exe
  C:\Windows\System\nuVpzkD.exe
  2⤵
  PID:4212
- C:\Windows\System\aayijMi.exe
  C:\Windows\System\aayijMi.exe
  2⤵
  PID:13480
- C:\Windows\System\cNFagLs.exe
  C:\Windows\System\cNFagLs.exe
  2⤵
  PID:13368
- C:\Windows\System\NDmOTaL.exe
  C:\Windows\System\NDmOTaL.exe
  2⤵
  PID:13728
- C:\Windows\System\dgHupUI.exe
  C:\Windows\System\dgHupUI.exe
  2⤵
  PID:13908
- C:\Windows\System\sNCKEhK.exe
  C:\Windows\System\sNCKEhK.exe
  2⤵
  PID:5536
- C:\Windows\System\UhMMOOa.exe
  C:\Windows\System\UhMMOOa.exe
  2⤵
  PID:13744
- C:\Windows\System\qhDtmel.exe
  C:\Windows\System\qhDtmel.exe
  2⤵
  PID:5748
- C:\Windows\System\EExRRYG.exe
  C:\Windows\System\EExRRYG.exe
  2⤵
  PID:5716
- C:\Windows\System\nqBWeoq.exe
  C:\Windows\System\nqBWeoq.exe
  2⤵
  PID:13948
- C:\Windows\System\vHxNGTa.exe
  C:\Windows\System\vHxNGTa.exe
  2⤵
  PID:5788
- C:\Windows\System\MmgMlsx.exe
  C:\Windows\System\MmgMlsx.exe
  2⤵
  PID:5332
- C:\Windows\System\htzyIXr.exe
  C:\Windows\System\htzyIXr.exe
  2⤵
  PID:8840
- C:\Windows\System\bEFsyiX.exe
  C:\Windows\System\bEFsyiX.exe
  2⤵
  PID:5812
- C:\Windows\System\RPzHJCN.exe
  C:\Windows\System\RPzHJCN.exe
  2⤵
  PID:5188
- C:\Windows\System\gZUbOLE.exe
  C:\Windows\System\gZUbOLE.exe
  2⤵
  PID:13704
- C:\Windows\System\mUKaTFk.exe
  C:\Windows\System\mUKaTFk.exe
  2⤵
  PID:9120
- C:\Windows\System\dwQZMaF.exe
  C:\Windows\System\dwQZMaF.exe
  2⤵
  PID:5936
- C:\Windows\System\qwJKiwO.exe
  C:\Windows\System\qwJKiwO.exe
  2⤵
  PID:5448
- C:\Windows\System\jddfQtT.exe
  C:\Windows\System\jddfQtT.exe
  2⤵
  PID:9180
- C:\Windows\System\vjLzUfq.exe
  C:\Windows\System\vjLzUfq.exe
  2⤵
  PID:5744
- C:\Windows\System\ibtNEfi.exe
  C:\Windows\System\ibtNEfi.exe
  2⤵
  PID:13168
- C:\Windows\System\ALoKdff.exe
  C:\Windows\System\ALoKdff.exe
  2⤵
  PID:5460
- C:\Windows\System\VQbUXbY.exe
  C:\Windows\System\VQbUXbY.exe
  2⤵
  PID:5416
- C:\Windows\System\MCkABHF.exe
  C:\Windows\System\MCkABHF.exe
  2⤵
  PID:2364
- C:\Windows\System\wErwbor.exe
  C:\Windows\System\wErwbor.exe
  2⤵
  PID:13452
- C:\Windows\System\dckLbLs.exe
  C:\Windows\System\dckLbLs.exe
  2⤵
  PID:4852
- C:\Windows\System\tVOlxye.exe
  C:\Windows\System\tVOlxye.exe
  2⤵
  PID:8664
- C:\Windows\System\oNubiuS.exe
  C:\Windows\System\oNubiuS.exe
  2⤵
  PID:5432
- C:\Windows\System\KLnXual.exe
  C:\Windows\System\KLnXual.exe
  2⤵
  PID:3176
- C:\Windows\System\YTjDacK.exe
  C:\Windows\System\YTjDacK.exe
  2⤵
  PID:1460
- C:\Windows\System\AEJIcnB.exe
  C:\Windows\System\AEJIcnB.exe
  2⤵
  PID:5924
- C:\Windows\System\NscalpE.exe
  C:\Windows\System\NscalpE.exe
  2⤵
  PID:5828
- C:\Windows\System\mnEjkkU.exe
  C:\Windows\System\mnEjkkU.exe
  2⤵
  PID:13664
- C:\Windows\System\gwlVrHG.exe
  C:\Windows\System\gwlVrHG.exe
  2⤵
  PID:8756
- C:\Windows\System\woNvieZ.exe
  C:\Windows\System\woNvieZ.exe
  2⤵
  PID:5872
- C:\Windows\System\XnXSfHS.exe
  C:\Windows\System\XnXSfHS.exe
  2⤵
  PID:5540
- C:\Windows\System\OCGYWuI.exe
  C:\Windows\System\OCGYWuI.exe
  2⤵
  PID:1484
- C:\Windows\System\WAaRfUe.exe
  C:\Windows\System\WAaRfUe.exe
  2⤵
  PID:1652
- C:\Windows\System\rDgpBIJ.exe
  C:\Windows\System\rDgpBIJ.exe
  2⤵
  PID:6220
- C:\Windows\System\UdnGqLi.exe
  C:\Windows\System\UdnGqLi.exe
  2⤵
  PID:8908
- C:\Windows\System\RgiXWbD.exe
  C:\Windows\System\RgiXWbD.exe
  2⤵
  PID:13448
- C:\Windows\System\gBKuqbF.exe
  C:\Windows\System\gBKuqbF.exe
  2⤵
  PID:232
- C:\Windows\System\GieeLTw.exe
  C:\Windows\System\GieeLTw.exe
  2⤵
  PID:4012
- C:\Windows\System\FaDuncR.exe
  C:\Windows\System\FaDuncR.exe
  2⤵
  PID:8900
- C:\Windows\System\LGjTLRP.exe
  C:\Windows\System\LGjTLRP.exe
  2⤵
  PID:5956
- C:\Windows\System\nQxEOZp.exe
  C:\Windows\System\nQxEOZp.exe
  2⤵
  PID:13988
- C:\Windows\System\xWpmMpK.exe
  C:\Windows\System\xWpmMpK.exe
  2⤵
  PID:4920
- C:\Windows\System\DWDBQKi.exe
  C:\Windows\System\DWDBQKi.exe
  2⤵
  PID:5112
- C:\Windows\System\GeYgHVR.exe
  C:\Windows\System\GeYgHVR.exe
  2⤵
  PID:14240
- C:\Windows\System\TWQlVuY.exe
  C:\Windows\System\TWQlVuY.exe
  2⤵
  PID:6128
- C:\Windows\System\vPNdWjS.exe
  C:\Windows\System\vPNdWjS.exe
  2⤵
  PID:8608
- C:\Windows\System\ZkLtOJr.exe
  C:\Windows\System\ZkLtOJr.exe
  2⤵
  PID:5504
- C:\Windows\System\CSlWXHr.exe
  C:\Windows\System\CSlWXHr.exe
  2⤵
  PID:6520
- C:\Windows\System\GVJDNgX.exe
  C:\Windows\System\GVJDNgX.exe
  2⤵
  PID:6608
- C:\Windows\System\PTehrmT.exe
  C:\Windows\System\PTehrmT.exe
  2⤵
  PID:9936
- C:\Windows\System\KHUsnXI.exe
  C:\Windows\System\KHUsnXI.exe
  2⤵
  PID:13356
- C:\Windows\System\jjMfeIn.exe
  C:\Windows\System\jjMfeIn.exe
  2⤵
  PID:10040
- C:\Windows\System\iWBXVCw.exe
  C:\Windows\System\iWBXVCw.exe
  2⤵
  PID:5076
- C:\Windows\System\ANOeLXX.exe
  C:\Windows\System\ANOeLXX.exe
  2⤵
  PID:13944
- C:\Windows\System\ydlUDTz.exe
  C:\Windows\System\ydlUDTz.exe
  2⤵
  PID:5524
- C:\Windows\System\SDLbhFj.exe
  C:\Windows\System\SDLbhFj.exe
  2⤵
  PID:8972
- C:\Windows\System\POjbzaH.exe
  C:\Windows\System\POjbzaH.exe
  2⤵
  PID:13656
- C:\Windows\System\LoEbUvc.exe
  C:\Windows\System\LoEbUvc.exe
  2⤵
  PID:14092
- C:\Windows\System\GtMqvOW.exe
  C:\Windows\System\GtMqvOW.exe
  2⤵
  PID:9088
- C:\Windows\System\PgFSDyt.exe
  C:\Windows\System\PgFSDyt.exe
  2⤵
  PID:13904
- C:\Windows\System\dRHMIZz.exe
  C:\Windows\System\dRHMIZz.exe
  2⤵
  PID:5404
- C:\Windows\System\BhnrPdK.exe
  C:\Windows\System\BhnrPdK.exe
  2⤵
  PID:6108
- C:\Windows\System\xAJZXEC.exe
  C:\Windows\System\xAJZXEC.exe
  2⤵
  PID:13512
- C:\Windows\System\ogbBuez.exe
  C:\Windows\System\ogbBuez.exe
  2⤵
  PID:13780
- C:\Windows\System\BFITqZb.exe
  C:\Windows\System\BFITqZb.exe
  2⤵
  PID:13784
- C:\Windows\System\rNmmtHI.exe
  C:\Windows\System\rNmmtHI.exe
  2⤵
  PID:1052
- C:\Windows\System\wKWzxbs.exe
  C:\Windows\System\wKWzxbs.exe
  2⤵
  PID:2468
- C:\Windows\System\KJGdWCl.exe
  C:\Windows\System\KJGdWCl.exe
  2⤵
  PID:8804
- C:\Windows\System\nGUEkme.exe
  C:\Windows\System\nGUEkme.exe
  2⤵
  PID:6080
- C:\Windows\System\XYBGFQp.exe
  C:\Windows\System\XYBGFQp.exe
  2⤵
  PID:3424
- C:\Windows\System\UhZfLsh.exe
  C:\Windows\System\UhZfLsh.exe
  2⤵
  PID:8808
- C:\Windows\System\qGpAnru.exe
  C:\Windows\System\qGpAnru.exe
  2⤵
  PID:14340
- C:\Windows\System\xiWWeUv.exe
  C:\Windows\System\xiWWeUv.exe
  2⤵
  PID:14364
- C:\Windows\System\cknFSeM.exe
  C:\Windows\System\cknFSeM.exe
  2⤵
  PID:14392
- C:\Windows\System\ksobdQh.exe
  C:\Windows\System\ksobdQh.exe
  2⤵
  PID:14644
- C:\Windows\System\nNpXHNu.exe
  C:\Windows\System\nNpXHNu.exe
  2⤵
  PID:14684
- C:\Windows\System\YOUGQnT.exe
  C:\Windows\System\YOUGQnT.exe
  2⤵
  PID:14704
- C:\Windows\System\cdSaUfT.exe
  C:\Windows\System\cdSaUfT.exe
  2⤵
  PID:14728
- C:\Windows\System\QeBNFgT.exe
  C:\Windows\System\QeBNFgT.exe
  2⤵
  PID:14752
- C:\Windows\System\VjOVrrq.exe
  C:\Windows\System\VjOVrrq.exe
  2⤵
  PID:14848
- C:\Windows\System\BqzMyzV.exe
  C:\Windows\System\BqzMyzV.exe
  2⤵
  PID:14872
- C:\Windows\System\KWZvvrP.exe
  C:\Windows\System\KWZvvrP.exe
  2⤵
  PID:14888
- C:\Windows\System\wAGMbSu.exe
  C:\Windows\System\wAGMbSu.exe
  2⤵
  PID:14904
- C:\Windows\System\xZqfARf.exe
  C:\Windows\System\xZqfARf.exe
  2⤵
  PID:14928
- C:\Windows\System\urmbqgB.exe
  C:\Windows\System\urmbqgB.exe
  2⤵
  PID:14952
- C:\Windows\System\FyELCzk.exe
  C:\Windows\System\FyELCzk.exe
  2⤵
  PID:14968
- C:\Windows\System\rDuiqEj.exe
  C:\Windows\System\rDuiqEj.exe
  2⤵
  PID:14988
- C:\Windows\System\GDdZxTS.exe
  C:\Windows\System\GDdZxTS.exe
  2⤵
  PID:15016
- C:\Windows\System\oaPRUsu.exe
  C:\Windows\System\oaPRUsu.exe
  2⤵
  PID:15036
- C:\Windows\System\bLCrMCm.exe
  C:\Windows\System\bLCrMCm.exe
  2⤵
  PID:15056
- C:\Windows\System\Izjjvyz.exe
  C:\Windows\System\Izjjvyz.exe
  2⤵
  PID:15268
- C:\Windows\System\PaBEbsB.exe
  C:\Windows\System\PaBEbsB.exe
  2⤵
  PID:15284
- C:\Windows\System\EuvtsRP.exe
  C:\Windows\System\EuvtsRP.exe
  2⤵
  PID:6368
- C:\Windows\System\tQYoTPQ.exe
  C:\Windows\System\tQYoTPQ.exe
  2⤵
  PID:6928
- C:\Windows\System\udkPCqb.exe
  C:\Windows\System\udkPCqb.exe
  2⤵
  PID:6244
- C:\Windows\System\EmvqBhN.exe
  C:\Windows\System\EmvqBhN.exe
  2⤵
  PID:6668
- C:\Windows\System\julXQNV.exe
  C:\Windows\System\julXQNV.exe
  2⤵
  PID:6184
- C:\Windows\System\Unfrzcz.exe
  C:\Windows\System\Unfrzcz.exe
  2⤵
  PID:7156
- C:\Windows\System\yggSicS.exe
  C:\Windows\System\yggSicS.exe
  2⤵
  PID:6604
- C:\Windows\System\cWsoSsK.exe
  C:\Windows\System\cWsoSsK.exe
  2⤵
  PID:14380
- C:\Windows\System\XsIYDSJ.exe
  C:\Windows\System\XsIYDSJ.exe
  2⤵
  PID:7316
- C:\Windows\System\oFEBDBn.exe
  C:\Windows\System\oFEBDBn.exe
  2⤵
  PID:10700
- C:\Windows\System\qIndzIe.exe
  C:\Windows\System\qIndzIe.exe
  2⤵
  PID:6492
- C:\Windows\System\mmFKhmF.exe
  C:\Windows\System\mmFKhmF.exe
  2⤵
  PID:6864
- C:\Windows\System\NdNpDiQ.exe
  C:\Windows\System\NdNpDiQ.exe
  2⤵
  PID:7192
- C:\Windows\System\SpJMTif.exe
  C:\Windows\System\SpJMTif.exe
  2⤵
  PID:14476
- C:\Windows\System\kLKwtrB.exe
  C:\Windows\System\kLKwtrB.exe
  2⤵
  PID:12572
- C:\Windows\System\MuvizIt.exe
  C:\Windows\System\MuvizIt.exe
  2⤵
  PID:1648
- C:\Windows\System\UDlcjsb.exe
  C:\Windows\System\UDlcjsb.exe
  2⤵
  PID:5388
- C:\Windows\System\EOsAHNS.exe
  C:\Windows\System\EOsAHNS.exe
  2⤵
  PID:14508
- C:\Windows\System\ACRXVHC.exe
  C:\Windows\System\ACRXVHC.exe
  2⤵
  PID:5632
- C:\Windows\System\qtJGQUX.exe
  C:\Windows\System\qtJGQUX.exe
  2⤵
  PID:7620
- C:\Windows\System\MszpkUY.exe
  C:\Windows\System\MszpkUY.exe
  2⤵
  PID:14008
- C:\Windows\System\QKJjntw.exe
  C:\Windows\System\QKJjntw.exe
  2⤵
  PID:2300
- C:\Windows\System\OBmcqGy.exe
  C:\Windows\System\OBmcqGy.exe
  2⤵
  PID:7332
- C:\Windows\System\OyAfvXs.exe
  C:\Windows\System\OyAfvXs.exe
  2⤵
  PID:13760
- C:\Windows\System\MdQPSVG.exe
  C:\Windows\System\MdQPSVG.exe
  2⤵
  PID:6552
- C:\Windows\System\KEpZzyk.exe
  C:\Windows\System\KEpZzyk.exe
  2⤵
  PID:7012
- C:\Windows\System\RdnWQbK.exe
  C:\Windows\System\RdnWQbK.exe
  2⤵
  PID:10132
- C:\Windows\System\JVLpkhb.exe
  C:\Windows\System\JVLpkhb.exe
  2⤵
  PID:14672
- C:\Windows\System\ZCgjVwF.exe
  C:\Windows\System\ZCgjVwF.exe
  2⤵
  PID:14996
- C:\Windows\System\kAtruHb.exe
  C:\Windows\System\kAtruHb.exe
  2⤵
  PID:14592
- C:\Windows\System\DGgcMJr.exe
  C:\Windows\System\DGgcMJr.exe
  2⤵
  PID:8224
- C:\Windows\System\QGlbLSu.exe
  C:\Windows\System\QGlbLSu.exe
  2⤵
  PID:10340
- C:\Windows\System\dKTfxaK.exe
  C:\Windows\System\dKTfxaK.exe
  2⤵
  PID:14784
- C:\Windows\System\nUIDmel.exe
  C:\Windows\System\nUIDmel.exe
  2⤵
  PID:8160
- C:\Windows\System\WKuiQTI.exe
  C:\Windows\System\WKuiQTI.exe
  2⤵
  PID:14632
- C:\Windows\System\QwMrsic.exe
  C:\Windows\System\QwMrsic.exe
  2⤵
  PID:7956
- C:\Windows\System\mOOcECK.exe
  C:\Windows\System\mOOcECK.exe
  2⤵
  PID:14916
- C:\Windows\System\YnTuOPg.exe
  C:\Windows\System\YnTuOPg.exe
  2⤵
  PID:8128
- C:\Windows\System\qIaThBs.exe
  C:\Windows\System\qIaThBs.exe
  2⤵
  PID:14984
- C:\Windows\System\rxBrxJX.exe
  C:\Windows\System\rxBrxJX.exe
  2⤵
  PID:14760
- C:\Windows\System\nMRjvyX.exe
  C:\Windows\System\nMRjvyX.exe
  2⤵
  PID:15084
- C:\Windows\System\HQLHUjJ.exe
  C:\Windows\System\HQLHUjJ.exe
  2⤵
  PID:15308
- C:\Windows\System\ZNbpfnE.exe
  C:\Windows\System\ZNbpfnE.exe
  2⤵
  PID:15120
- C:\Windows\System\UEEOUKL.exe
  C:\Windows\System\UEEOUKL.exe
  2⤵
  PID:8116
- C:\Windows\System\yACIqDk.exe
  C:\Windows\System\yACIqDk.exe
  2⤵
  PID:14896
- C:\Windows\System\uaecjQW.exe
  C:\Windows\System\uaecjQW.exe
  2⤵
  PID:6300
- C:\Windows\System\zRcDVTp.exe
  C:\Windows\System\zRcDVTp.exe
  2⤵
  PID:15188
- C:\Windows\System\BnjZxpr.exe
  C:\Windows\System\BnjZxpr.exe
  2⤵
  PID:6500
- C:\Windows\System\AIGbWYB.exe
  C:\Windows\System\AIGbWYB.exe
  2⤵
  PID:5992
- C:\Windows\System\lejdCiL.exe
  C:\Windows\System\lejdCiL.exe
  2⤵
  PID:15228
- C:\Windows\System\VVyguDv.exe
  C:\Windows\System\VVyguDv.exe
  2⤵
  PID:8536
- C:\Windows\System\DyWuSpz.exe
  C:\Windows\System\DyWuSpz.exe
  2⤵
  PID:11620
- C:\Windows\System\TcQuarq.exe
  C:\Windows\System\TcQuarq.exe
  2⤵
  PID:5032
- C:\Windows\System\pkSQYhn.exe
  C:\Windows\System\pkSQYhn.exe
  2⤵
  PID:11656
- C:\Windows\System\tVujXcH.exe
  C:\Windows\System\tVujXcH.exe
  2⤵
  PID:7832
- C:\Windows\System\DlfSwzG.exe
  C:\Windows\System\DlfSwzG.exe
  2⤵
  PID:7900
- C:\Windows\System\yXdrqUf.exe
  C:\Windows\System\yXdrqUf.exe
  2⤵
  PID:6904
- C:\Windows\System\BqMISUu.exe
  C:\Windows\System\BqMISUu.exe
  2⤵
  PID:7732
- C:\Windows\System\NpWuvgA.exe
  C:\Windows\System\NpWuvgA.exe
  2⤵
  PID:15032
- C:\Windows\System\QsOhPbN.exe
  C:\Windows\System\QsOhPbN.exe
  2⤵
  PID:15144
- C:\Windows\System\xsNvtpJ.exe
  C:\Windows\System\xsNvtpJ.exe
  2⤵
  PID:8176
- C:\Windows\System\pGGkmXW.exe
  C:\Windows\System\pGGkmXW.exe
  2⤵
  PID:6780
- C:\Windows\System\fdUXkTp.exe
  C:\Windows\System\fdUXkTp.exe
  2⤵
  PID:14468
- C:\Windows\System\AzcUZBn.exe
  C:\Windows\System\AzcUZBn.exe
  2⤵
  PID:6932
- C:\Windows\System\bIBLhkN.exe
  C:\Windows\System\bIBLhkN.exe
  2⤵
  PID:8040
- C:\Windows\System\zqQTvJO.exe
  C:\Windows\System\zqQTvJO.exe
  2⤵
  PID:10984
- C:\Windows\System\MHgpSHp.exe
  C:\Windows\System\MHgpSHp.exe
  2⤵
  PID:7688
- C:\Windows\System\ijggtKQ.exe
  C:\Windows\System\ijggtKQ.exe
  2⤵
  PID:15248
- C:\Windows\System\szmbnin.exe
  C:\Windows\System\szmbnin.exe
  2⤵
  PID:7952
- C:\Windows\System\RnOhpTl.exe
  C:\Windows\System\RnOhpTl.exe
  2⤵
  PID:7000
- C:\Windows\System\MZjigum.exe
  C:\Windows\System\MZjigum.exe
  2⤵
  PID:15004
- C:\Windows\System\kjwElZJ.exe
  C:\Windows\System\kjwElZJ.exe
  2⤵
  PID:14612
- C:\Windows\System\AvxMNzX.exe
  C:\Windows\System\AvxMNzX.exe
  2⤵
  PID:14528
- C:\Windows\System\WyDIZyx.exe
  C:\Windows\System\WyDIZyx.exe
  2⤵
  PID:9100
- C:\Windows\System\HODhLew.exe
  C:\Windows\System\HODhLew.exe
  2⤵
  PID:11748
- C:\Windows\System\QCCuroQ.exe
  C:\Windows\System\QCCuroQ.exe
  2⤵
  PID:15180
- C:\Windows\System\EkGkDDo.exe
  C:\Windows\System\EkGkDDo.exe
  2⤵
  PID:6152
- C:\Windows\System\Fvgcuoi.exe
  C:\Windows\System\Fvgcuoi.exe
  2⤵
  PID:8188
- C:\Windows\System\KKyitUv.exe
  C:\Windows\System\KKyitUv.exe
  2⤵
  PID:10848
- C:\Windows\System\eYYfSTu.exe
  C:\Windows\System\eYYfSTu.exe
  2⤵
  PID:8580
- C:\Windows\System\YbhUVsI.exe
  C:\Windows\System\YbhUVsI.exe
  2⤵
  PID:8652
- C:\Windows\System\FGRKusC.exe
  C:\Windows\System\FGRKusC.exe
  2⤵
  PID:6564
- C:\Windows\System\uBWbhsG.exe
  C:\Windows\System\uBWbhsG.exe
  2⤵
  PID:8220
- C:\Windows\System\hRwYWOh.exe
  C:\Windows\System\hRwYWOh.exe
  2⤵
  PID:8456
- C:\Windows\System\yIaDFQO.exe
  C:\Windows\System\yIaDFQO.exe
  2⤵
  PID:7592
- C:\Windows\System\emIWRyT.exe
  C:\Windows\System\emIWRyT.exe
  2⤵
  PID:8968
- C:\Windows\System\EAUvMpb.exe
  C:\Windows\System\EAUvMpb.exe
  2⤵
  PID:8392
- C:\Windows\System\iWSvSjV.exe
  C:\Windows\System\iWSvSjV.exe
  2⤵
  PID:8404
- C:\Windows\System\apiUhRN.exe
  C:\Windows\System\apiUhRN.exe
  2⤵
  PID:14524
- C:\Windows\System\hIyQaek.exe
  C:\Windows\System\hIyQaek.exe
  2⤵
  PID:8556
- C:\Windows\System\KxIddmW.exe
  C:\Windows\System\KxIddmW.exe
  2⤵
  PID:14384
- C:\Windows\System\zPavTYN.exe
  C:\Windows\System\zPavTYN.exe
  2⤵
  PID:8100
- C:\Windows\System\AEvShDW.exe
  C:\Windows\System\AEvShDW.exe
  2⤵
  PID:9108
- C:\Windows\System\zPIUuZH.exe
  C:\Windows\System\zPIUuZH.exe
  2⤵
  PID:7648
- C:\Windows\System\EMqmVMz.exe
  C:\Windows\System\EMqmVMz.exe
  2⤵
  PID:14960
- C:\Windows\System\KaTnVTT.exe
  C:\Windows\System\KaTnVTT.exe
  2⤵
  PID:14504
- C:\Windows\System\zaneHQQ.exe
  C:\Windows\System\zaneHQQ.exe
  2⤵
  PID:8432
- C:\Windows\System\eVTSzrw.exe
  C:\Windows\System\eVTSzrw.exe
  2⤵
  PID:9992
- C:\Windows\System\dwCRCNr.exe
  C:\Windows\System\dwCRCNr.exe
  2⤵
  PID:6688
- C:\Windows\System\Sdstmxj.exe
  C:\Windows\System\Sdstmxj.exe
  2⤵
  PID:8740
- C:\Windows\System\sZeYprs.exe
  C:\Windows\System\sZeYprs.exe
  2⤵
  PID:9648
- C:\Windows\System\fJUgZQC.exe
  C:\Windows\System\fJUgZQC.exe
  2⤵
  PID:10092
- C:\Windows\System\AIrbQDs.exe
  C:\Windows\System\AIrbQDs.exe
  2⤵
  PID:14824
- C:\Windows\System\qamdeAf.exe
  C:\Windows\System\qamdeAf.exe
  2⤵
  PID:10812
- C:\Windows\System\eHWgkod.exe
  C:\Windows\System\eHWgkod.exe
  2⤵
  PID:10016
- C:\Windows\System\EODYKTZ.exe
  C:\Windows\System\EODYKTZ.exe
  2⤵
  PID:8216
- C:\Windows\System\dxUsMta.exe
  C:\Windows\System\dxUsMta.exe
  2⤵
  PID:8364
- C:\Windows\System\lfQtLXZ.exe
  C:\Windows\System\lfQtLXZ.exe
  2⤵
  PID:9712
- C:\Windows\System\TgJdheG.exe
  C:\Windows\System\TgJdheG.exe
  2⤵
  PID:8156
- C:\Windows\System\nFVERXe.exe
  C:\Windows\System\nFVERXe.exe
  2⤵
  PID:3856
- C:\Windows\System\zmxnQCZ.exe
  C:\Windows\System\zmxnQCZ.exe
  2⤵
  PID:9428
- C:\Windows\System\HYzeBkb.exe
  C:\Windows\System\HYzeBkb.exe
  2⤵
  PID:6268
- C:\Windows\System\jnwtZXI.exe
  C:\Windows\System\jnwtZXI.exe
  2⤵
  PID:10316
- C:\Windows\System\uqnnjkj.exe
  C:\Windows\System\uqnnjkj.exe
  2⤵
  PID:15340
- C:\Windows\System\IzwkENw.exe
  C:\Windows\System\IzwkENw.exe
  2⤵
  PID:9760
- C:\Windows\System\TWlMmZF.exe
  C:\Windows\System\TWlMmZF.exe
  2⤵
  PID:8512
- C:\Windows\System\WsGXQbD.exe
  C:\Windows\System\WsGXQbD.exe
  2⤵
  PID:10184
- C:\Windows\System\veXhRyV.exe
  C:\Windows\System\veXhRyV.exe
  2⤵
  PID:9668
- C:\Windows\System\PfoCqHg.exe
  C:\Windows\System\PfoCqHg.exe
  2⤵
  PID:6016
- C:\Windows\System\FCVfTAR.exe
  C:\Windows\System\FCVfTAR.exe
  2⤵
  PID:10196
- C:\Windows\System\kvDZSKD.exe
  C:\Windows\System\kvDZSKD.exe
  2⤵
  PID:10264
- C:\Windows\System\aTmIcGY.exe
  C:\Windows\System\aTmIcGY.exe
  2⤵
  PID:10228
- C:\Windows\System\NfpDdak.exe
  C:\Windows\System\NfpDdak.exe
  2⤵
  PID:8688
- C:\Windows\System\CwLiPhC.exe
  C:\Windows\System\CwLiPhC.exe
  2⤵
  PID:11496
- C:\Windows\System\mnlYZeE.exe
  C:\Windows\System\mnlYZeE.exe
  2⤵
  PID:9164
- C:\Windows\System\pippTzL.exe
  C:\Windows\System\pippTzL.exe
  2⤵
  PID:10312
- C:\Windows\System\DEvmPAz.exe
  C:\Windows\System\DEvmPAz.exe
  2⤵
  PID:10172
- C:\Windows\System\qXgYZdc.exe
  C:\Windows\System\qXgYZdc.exe
  2⤵
  PID:8772
- C:\Windows\System\lbHVLSa.exe
  C:\Windows\System\lbHVLSa.exe
  2⤵
  PID:8460
- C:\Windows\System\GWuupeF.exe
  C:\Windows\System\GWuupeF.exe
  2⤵
  PID:10336
- C:\Windows\System\UkAAWKm.exe
  C:\Windows\System\UkAAWKm.exe
  2⤵
  PID:7756
- C:\Windows\System\uTQDNWY.exe
  C:\Windows\System\uTQDNWY.exe
  2⤵
  PID:10832
- C:\Windows\System\mpVrJDt.exe
  C:\Windows\System\mpVrJDt.exe
  2⤵
  PID:9476
- C:\Windows\System\vWRxjUe.exe
  C:\Windows\System\vWRxjUe.exe
  2⤵
  PID:10292
- C:\Windows\System\PcfFgYS.exe
  C:\Windows\System\PcfFgYS.exe
  2⤵
  PID:9212
- C:\Windows\System\gGiTaCs.exe
  C:\Windows\System\gGiTaCs.exe
  2⤵
  PID:10736
- C:\Windows\System\gSmFgGi.exe
  C:\Windows\System\gSmFgGi.exe
  2⤵
  PID:8680
- C:\Windows\System\NBQWucG.exe
  C:\Windows\System\NBQWucG.exe
  2⤵
  PID:10956
- C:\Windows\System\yMirIXY.exe
  C:\Windows\System\yMirIXY.exe
  2⤵
  PID:14132
- C:\Windows\System\MrMTtcR.exe
  C:\Windows\System\MrMTtcR.exe
  2⤵
  PID:10168
- C:\Windows\System\rxZWZIe.exe
  C:\Windows\System\rxZWZIe.exe
  2⤵
  PID:11024
- C:\Windows\System\DqqVOBa.exe
  C:\Windows\System\DqqVOBa.exe
  2⤵
  PID:15264
- C:\Windows\System\UrcjvBV.exe
  C:\Windows\System\UrcjvBV.exe
  2⤵
  PID:11076
- C:\Windows\System\JsLwwHW.exe
  C:\Windows\System\JsLwwHW.exe
  2⤵
  PID:9124
- C:\Windows\System\iEUIIeW.exe
  C:\Windows\System\iEUIIeW.exe
  2⤵
  PID:10584
- C:\Windows\System\DNDcIuZ.exe
  C:\Windows\System\DNDcIuZ.exe
  2⤵
  PID:10180
- C:\Windows\System\Ssjflms.exe
  C:\Windows\System\Ssjflms.exe
  2⤵
  PID:9300
- C:\Windows\System\TRIOAXA.exe
  C:\Windows\System\TRIOAXA.exe
  2⤵
  PID:9092
- C:\Windows\System\dTrbtMj.exe
  C:\Windows\System\dTrbtMj.exe
  2⤵
  PID:9960
- C:\Windows\System\cKvOaRc.exe
  C:\Windows\System\cKvOaRc.exe
  2⤵
  PID:11224
- C:\Windows\System\KCNIgon.exe
  C:\Windows\System\KCNIgon.exe
  2⤵
  PID:15388
- C:\Windows\System\PIByjqF.exe
  C:\Windows\System\PIByjqF.exe
  2⤵
  PID:15404
- C:\Windows\System\ahgufQK.exe
  C:\Windows\System\ahgufQK.exe
  2⤵
  PID:15520
- C:\Windows\System\UvEZwtP.exe
  C:\Windows\System\UvEZwtP.exe
  2⤵
  PID:15540
- C:\Windows\System\qtZQbLZ.exe
  C:\Windows\System\qtZQbLZ.exe
  2⤵
  PID:15560
- C:\Windows\System\UOxTvhM.exe
  C:\Windows\System\UOxTvhM.exe
  2⤵
  PID:15584
- C:\Windows\System\QMHMUiP.exe
  C:\Windows\System\QMHMUiP.exe
  2⤵
  PID:15624
- C:\Windows\System\cTwaWdx.exe
  C:\Windows\System\cTwaWdx.exe
  2⤵
  PID:15648
- C:\Windows\System\rlmfPPG.exe
  C:\Windows\System\rlmfPPG.exe
  2⤵
  PID:15672
- C:\Windows\System\EtqyDrw.exe
  C:\Windows\System\EtqyDrw.exe
  2⤵
  PID:15700
- C:\Windows\System\ITmAdBD.exe
  C:\Windows\System\ITmAdBD.exe
  2⤵
  PID:15724
- C:\Windows\System\RMQwiJG.exe
  C:\Windows\System\RMQwiJG.exe
  2⤵
  PID:15744
- C:\Windows\System\LZmMVql.exe
  C:\Windows\System\LZmMVql.exe
  2⤵
  PID:15772
- C:\Windows\System\gGwVIVc.exe
  C:\Windows\System\gGwVIVc.exe
  2⤵
  PID:15792
- C:\Windows\System\OiPwUQK.exe
  C:\Windows\System\OiPwUQK.exe
  2⤵
  PID:15820
- C:\Windows\System\VrNmQkt.exe
  C:\Windows\System\VrNmQkt.exe
  2⤵
  PID:15840
- C:\Windows\System\sOulSpE.exe
  C:\Windows\System\sOulSpE.exe
  2⤵
  PID:15880
- C:\Windows\System\EWtmLIs.exe
  C:\Windows\System\EWtmLIs.exe
  2⤵
  PID:15904
- C:\Windows\System\XqzJNhy.exe
  C:\Windows\System\XqzJNhy.exe
  2⤵
  PID:15928
- C:\Windows\System\ROpTKCk.exe
  C:\Windows\System\ROpTKCk.exe
  2⤵
  PID:15948
- C:\Windows\System\TdVgdgM.exe
  C:\Windows\System\TdVgdgM.exe
  2⤵
  PID:15964
- C:\Windows\System\ElidCfl.exe
  C:\Windows\System\ElidCfl.exe
  2⤵
  PID:15980
- C:\Windows\System\JKRVfZW.exe
  C:\Windows\System\JKRVfZW.exe
  2⤵
  PID:16000
- C:\Windows\System\mfvaPpD.exe
  C:\Windows\System\mfvaPpD.exe
  2⤵
  PID:16020
- C:\Windows\System\AwoCFZN.exe
  C:\Windows\System\AwoCFZN.exe
  2⤵
  PID:16040
- C:\Windows\System\inkNckC.exe
  C:\Windows\System\inkNckC.exe
  2⤵
  PID:16060
- C:\Windows\System\MKRVolC.exe
  C:\Windows\System\MKRVolC.exe
  2⤵
  PID:16180
- C:\Windows\System\gAoMGam.exe
  C:\Windows\System\gAoMGam.exe
  2⤵
  PID:14776
- C:\Windows\System\dGhJXwW.exe
  C:\Windows\System\dGhJXwW.exe
  2⤵
  PID:10432
- C:\Windows\System\OWYTvzK.exe
  C:\Windows\System\OWYTvzK.exe
  2⤵
  PID:9496
- C:\Windows\System\tqmjKjE.exe
  C:\Windows\System\tqmjKjE.exe
  2⤵
  PID:10680
- C:\Windows\System\oUkQHwN.exe
  C:\Windows\System\oUkQHwN.exe
  2⤵
  PID:11260
- C:\Windows\System\xoLvjSE.exe
  C:\Windows\System\xoLvjSE.exe
  2⤵
  PID:10884
- C:\Windows\System\sBJAgVr.exe
  C:\Windows\System\sBJAgVr.exe
  2⤵
  PID:5268
- C:\Windows\System\OnEQAmZ.exe
  C:\Windows\System\OnEQAmZ.exe
  2⤵
  PID:10392
- C:\Windows\System\kbZHRYp.exe
  C:\Windows\System\kbZHRYp.exe
  2⤵
  PID:15380
- C:\Windows\System\EhwNUKh.exe
  C:\Windows\System\EhwNUKh.exe
  2⤵
  PID:10056
- C:\Windows\System\mtwUvtc.exe
  C:\Windows\System\mtwUvtc.exe
  2⤵
  PID:15420
- C:\Windows\System\sUKLLTq.exe
  C:\Windows\System\sUKLLTq.exe
  2⤵
  PID:15580
- C:\Windows\System\MCRkigV.exe
  C:\Windows\System\MCRkigV.exe
  2⤵
  PID:10776
- C:\Windows\System\HiPpBxx.exe
  C:\Windows\System\HiPpBxx.exe
  2⤵
  PID:9708
- C:\Windows\System\UYWOTys.exe
  C:\Windows\System\UYWOTys.exe
  2⤵
  PID:10576
- C:\Windows\System\ZiEVRaD.exe
  C:\Windows\System\ZiEVRaD.exe
  2⤵
  PID:15960
- C:\Windows\System\dUGYusb.exe
  C:\Windows\System\dUGYusb.exe
  2⤵
  PID:10844
- C:\Windows\System\IqMgLnY.exe
  C:\Windows\System\IqMgLnY.exe
  2⤵
  PID:15660
- C:\Windows\System\MkIIGXF.exe
  C:\Windows\System\MkIIGXF.exe
  2⤵
  PID:15716
- C:\Windows\System\shJKyUL.exe
  C:\Windows\System\shJKyUL.exe
  2⤵
  PID:10036
- C:\Windows\System\tKYDGCQ.exe
  C:\Windows\System\tKYDGCQ.exe
  2⤵
  PID:16036
- C:\Windows\System\iexnTSN.exe
  C:\Windows\System\iexnTSN.exe
  2⤵
  PID:15740
- C:\Windows\System\ibipFkm.exe
  C:\Windows\System\ibipFkm.exe
  2⤵
  PID:12140
- C:\Windows\System\fJSnLYM.exe
  C:\Windows\System\fJSnLYM.exe
  2⤵
  PID:15868
- C:\Windows\System\FSarqGP.exe
  C:\Windows\System\FSarqGP.exe
  2⤵
  PID:15940
- C:\Windows\System\oKdGKWm.exe
  C:\Windows\System\oKdGKWm.exe
  2⤵
  PID:16188
- C:\Windows\System\yHwFtro.exe
  C:\Windows\System\yHwFtro.exe
  2⤵
  PID:16304
- C:\Windows\System\MHyMmZZ.exe
  C:\Windows\System\MHyMmZZ.exe
  2⤵
  PID:16236
- C:\Windows\System\XhwzjEo.exe
  C:\Windows\System\XhwzjEo.exe
  2⤵
  PID:7972
- C:\Windows\System\DHknTeO.exe
  C:\Windows\System\DHknTeO.exe
  2⤵
  PID:10200
- C:\Windows\System\wOLrQvp.exe
  C:\Windows\System\wOLrQvp.exe
  2⤵
  PID:15216
- C:\Windows\System\Phvmcnv.exe
  C:\Windows\System\Phvmcnv.exe
  2⤵
  PID:12036
- C:\Windows\System\OqHwBJw.exe
  C:\Windows\System\OqHwBJw.exe
  2⤵
  PID:12172
- C:\Windows\System\tLQIGPX.exe
  C:\Windows\System\tLQIGPX.exe
  2⤵
  PID:12260
- C:\Windows\System\jpOezbp.exe
  C:\Windows\System\jpOezbp.exe
  2⤵
  PID:10612
- C:\Windows\System\BwyXjMw.exe
  C:\Windows\System\BwyXjMw.exe
  2⤵
  PID:10608
- C:\Windows\System\MOdcViP.exe
  C:\Windows\System\MOdcViP.exe
  2⤵
  PID:12340
- C:\Windows\System\wObtLDX.exe
  C:\Windows\System\wObtLDX.exe
  2⤵
  PID:12672
- C:\Windows\System\MZWcQVi.exe
  C:\Windows\System\MZWcQVi.exe
  2⤵
  PID:10640
- C:\Windows\System\YZldrFx.exe
  C:\Windows\System\YZldrFx.exe
  2⤵
  PID:11724
- C:\Windows\System\sQQyENC.exe
  C:\Windows\System\sQQyENC.exe
  2⤵
  PID:11728
- C:\Windows\System\UpCRebd.exe
  C:\Windows\System\UpCRebd.exe
  2⤵
  PID:10728
- C:\Windows\System\XsIrLUi.exe
  C:\Windows\System\XsIrLUi.exe
  2⤵
  PID:9480
- C:\Windows\System\kzpdqdf.exe
  C:\Windows\System\kzpdqdf.exe
  2⤵
  PID:10112
- C:\Windows\System\snrlrXI.exe
  C:\Windows\System\snrlrXI.exe
  2⤵
  PID:12684
- C:\Windows\System\iMPbRPu.exe
  C:\Windows\System\iMPbRPu.exe
  2⤵
  PID:11720
- C:\Windows\System\SRyMGIU.exe
  C:\Windows\System\SRyMGIU.exe
  2⤵
  PID:8288
- C:\Windows\System\gAVCEcr.exe
  C:\Windows\System\gAVCEcr.exe
  2⤵
  PID:11760
- C:\Windows\System\oaWlBSI.exe
  C:\Windows\System\oaWlBSI.exe
  2⤵
  PID:11676
- C:\Windows\System\LryBgMv.exe
  C:\Windows\System\LryBgMv.exe
  2⤵
  PID:12012
- C:\Windows\System\fjECocP.exe
  C:\Windows\System\fjECocP.exe
  2⤵
  PID:11732
- C:\Windows\System\cqCKiJo.exe
  C:\Windows\System\cqCKiJo.exe
  2⤵
  PID:11140
- C:\Windows\System\qBBazum.exe
  C:\Windows\System\qBBazum.exe
  2⤵
  PID:12304
- C:\Windows\System\jHXPvvn.exe
  C:\Windows\System\jHXPvvn.exe
  2⤵
  PID:8048
- C:\Windows\System\goJpWHw.exe
  C:\Windows\System\goJpWHw.exe
  2⤵
  PID:12000
- C:\Windows\System\IVHQDHE.exe
  C:\Windows\System\IVHQDHE.exe
  2⤵
  PID:9784
- C:\Windows\System\QRIuFSr.exe
  C:\Windows\System\QRIuFSr.exe
  2⤵
  PID:9008
- C:\Windows\System\kFeJDaY.exe
  C:\Windows\System\kFeJDaY.exe
  2⤵
  PID:15912
- C:\Windows\System\qcBStxq.exe
  C:\Windows\System\qcBStxq.exe
  2⤵
  PID:13228
- C:\Windows\System\HumQTsK.exe
  C:\Windows\System\HumQTsK.exe
  2⤵
  PID:15444
- C:\Windows\System\AuNIeVe.exe
  C:\Windows\System\AuNIeVe.exe
  2⤵
  PID:15956
- C:\Windows\System\xsBHdpE.exe
  C:\Windows\System\xsBHdpE.exe
  2⤵
  PID:11280
- C:\Windows\System\CMsANku.exe
  C:\Windows\System\CMsANku.exe
  2⤵
  PID:8408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sgi0v2xb.4im.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AZyUxgt.exe

Filesize
2.2MB

MD5
57ced4439f00337205e6fd89cb6e5752

SHA1
425bdc1f77a607811142b460b368551d07a5b5a2

SHA256
a9d745e977dce347f6f2a51804cf6914809af6badad41098c185103c776d44ae

SHA512
72564e368891ba16e517ddacd212bf591c2cb34eb06822a348431263652bc12fac146e2f7a84f209063bb32f689995f022ffaec81d1fbbbdf428a8ba75fe10c1

Download Submit
C:\Windows\System\AnzatgS.exe

Filesize
2.2MB

MD5
75bd9b0f3ec7440bbb8c1d08c57d4fe8

SHA1
9797bf5cb5777f791db1b032f0cd086f0a777326

SHA256
be4e196aeb2919710aa04fd22bd587fb72f0064f1907f56e78f4863184ceb9e0

SHA512
c98b38a2fd3d20c5c257b504b611764d5dd66efe7cd7875631bd3a9a1099118c6f47c4bf3ed56b79e185cc84d4ad9766694195f9ef1bd9eaf2c9b909a5606fed

Download Submit
C:\Windows\System\BqCodcp.exe

Filesize
2.2MB

MD5
289dfd293e17316d84d4bdb44c1159b7

SHA1
b6fb546d0689e5169771e1b1008472d2cf9fcb4f

SHA256
9829bc1e06abdaa0c9502fba8c52978904665137241dacfa0185ea13cdc27153

SHA512
f8dfb32bf770417d50cb506595735577c9c7feda5319ac4ffbf37ac406b37f3cb530fe80009f5f002a741c0a841192c06752ef7b5a2d6d8387404ec371c2d386

Download Submit
C:\Windows\System\EbtudDe.exe

Filesize
2.2MB

MD5
f9c1466710ab6e891cf6fefb9346377c

SHA1
8177e4dab2b9fba49957ea059245916e4d0a36df

SHA256
3130267c1d3ce1f1378733bfaca5cb2ac6c95c343a8c56686e7a3cc7251b53ff

SHA512
92c12f3b155c899a6753072ce3d25f4ac5ca2e57a75d91ac2f5fbe9b2eb43b7f1779be351e62f6103b19b08f62004234c156cc2fe69ed9e4ef4b64c350899668

Download Submit
C:\Windows\System\FzAOgYv.exe

Filesize
2.2MB

MD5
579b702fadc702ead9fd3f266cd7897d

SHA1
e195af1c5fc2e8502e3adac765a719627f886022

SHA256
caa83c6bdc90b5c068a73f1f4c19551ddf5a0a877c3137e9b0aab6ae3209cbbd

SHA512
7c9b0c46a1e15d0172cca52eb2347ef55e9801e3a232e65917328b113868e1934069496088e51e62726232af4a457d137c3a4ca57676cc21d89623c88e27f0d8

Download Submit
C:\Windows\System\IvKeYQS.exe

Filesize
2.2MB

MD5
21bfb5df3e20aa8dc441c203d71d3cce

SHA1
62df43ca0a18480b7a4b095a21d565f248619521

SHA256
38c648d758974b0e8f4e040f3ea42daee85b87f3e4e39fee943505eb6d0afc6d

SHA512
cad4d109858c2ca645e76e90e0d79c1cfee0b6fd92a6d74a2a78825338269f0c29cd4e835e0eff4ac43819f011251ae45219ac7f6d43a7740914c9a6a566b6fb

Download Submit
C:\Windows\System\MwKrvtj.exe

Filesize
2.2MB

MD5
8aad383b484b859438190c116a675a5a

SHA1
a5a2b30539acac3590577928c20f3db7aa88a5b5

SHA256
0a8d1dec5776d6a291ce9956fd5fecbca34a12ac7fea5f22121a1b226b18bb88

SHA512
8ea635e70d9b8a73b73398be1d8dfbe3453218c2c216dc6bd1bb5d0eb685ab06c9c2c8c979cc637dddbff25b83aff7721eaae478383d15dcbcce67950b01ea76

Download Submit
C:\Windows\System\OrRogUl.exe

Filesize
2.2MB

MD5
a31394b5fb19324a850a27591c7ca613

SHA1
2073e0f4c0a2c9b528db8d76e11f79bef74ce830

SHA256
5481133c43670796ba0375cb2e01c1a15da07ebd77c435483bd2f8c9806bb902

SHA512
0b39b3cd65374d7961b00b655919f11cda79bcc2397d68410b90bb7d213fae16e291bcdccfcdfcbe4a15a51206533ddfbc57a89d03e3af792290b340f2e5fd15

Download Submit
C:\Windows\System\PzxTlRO.exe

Filesize
2.2MB

MD5
24d41373a08361d87583d5982785a82e

SHA1
42710baf7cec8bada16901bf423dca0638f0d688

SHA256
c4977b37e05d5c00a89ec0edf05b644c068ebf8cfd42de49f24da91aefd4c2d5

SHA512
7812cecb8c2eac802603fd4bd9758a15b06e163aa62ce7c2ec9dc94a592b843cba5d9c4d609c0c7d8e61147e8ab586029f22bb33ab6394829c45e03b53c0bc68

Download Submit
C:\Windows\System\RxqpaWD.exe

Filesize
2.2MB

MD5
f5f4de21f4f8a24003907132b877c008

SHA1
4eaba081292522a473e2b8f10ca7c34aaab0e039

SHA256
aed3fae0474235c1afece9306f9f9ecb76fe6246a281445257564b062bd0496e

SHA512
54f5791f2b1445529b43f2948bfbfa8023b7c0fd1fc752044d57be43cf776e16fa08657c622283d60091ef448a8880924b36a22ac222d7547212bb00c3a003de

Download Submit
C:\Windows\System\TyWXeVb.exe

Filesize
2.2MB

MD5
78e2c5ed4b42f7c90e31720d4d9e691e

SHA1
90719d9b321160be615fad4ce8b2951fadbe51ba

SHA256
d4124c23ee57279404d38a6762248d100fc978d808f2c7c2f7695fe7c5390599

SHA512
dd2b36990839be490dfd0e514309df8dff72328e65fc5673e3cda045a2e7e3c7c0570d438142b0ae8588d9be158703cc001809bff01091a3ee8f48252fdf5546

Download Submit
C:\Windows\System\UNKosEk.exe

Filesize
2.2MB

MD5
fd36ab8a0c93a4f017a2213b19ae0a89

SHA1
1ceb1c8bfede409adb3aa230a352dcd0a3c600b4

SHA256
f8afece9757a41fbf9b3494f93c8cace8640fdf9d12de8d515d355694d75be0a

SHA512
701dec3232091d0de73cbaf42c2f0fecaa9554dae34c816847da9e4f64bb0675c58f9665d837dfa8b362b0c68509826c008f3362311607a61094b8deb5d33891

Download Submit
C:\Windows\System\WHRjIPt.exe

Filesize
2.2MB

MD5
35184a649ad0f73f469362d72d417333

SHA1
e346cdd0406f1a0cbd9dae27a206528aec630df7

SHA256
cd55a37f3a074fdc37144717e401428e37bab350b9fbb991b56464f383f3a87f

SHA512
91e32ef39364f95c6bfdf5073c9eb6fd63bb22d64de78dfc174960afa68b0c3be020ce81919b2c2c451e9a8bfa652d15c6dee26aeb0a72f9ec8d78d554847746

Download Submit
C:\Windows\System\WPPOtFP.exe

Filesize
2.2MB

MD5
022e371ed2affe6b4334570f7f655a4d

SHA1
55576ac9c7b1069c3d4b3eb5ee030af668574aa2

SHA256
dc0018494a883292d246b8d4e5cad88b8e6aae813773f4e3830f2e106edf9766

SHA512
32c85cfcf69cec5b558ccb157a36a8040678eec1a33328fd5b66029644b0763cf0487d3a4f7a9625811300a7dbe9863aaca6512db45bf477b956ec3f775edb10

Download Submit
C:\Windows\System\WUUfPXm.exe

Filesize
2.2MB

MD5
75887bf718dceb7811878d790dc7cb8b

SHA1
c68eed2407109e4bc636fb2e6d998c172b3dd6b4

SHA256
565453a9057dcb99bd41fc24a0aa92a3026072900574af589c8adf12ac4ce13d

SHA512
ae17f1a0d5a4f36f5a48fca114fb4b3e7f4d421599d6e67e981437711261c69426a175a8c997e1891d63b2cd0f62b72c279ef87a60513fc0ae895dd229a15563

Download Submit
C:\Windows\System\ZqOBQMI.exe

Filesize
2.2MB

MD5
a8d38a6f2bf0ff76fad4a9feee9768ed

SHA1
298607b09a13c63a34472d9a731766ed4e006327

SHA256
a2677bfe7126d88f6c704b7f054722be67fc48a1f23ffb37a95a87447a391a32

SHA512
43bce9b44e991ae02045643c1dd3f416f40c3af808a6500d2c4371e4c11c4023eb141c446b7e7a346f078d7097c2a20d027723f6248e08070147a850587e3ce1

Download Submit
C:\Windows\System\bTWicDG.exe

Filesize
2.2MB

MD5
ed595ff7737128e57be03a07f95b47a1

SHA1
69435733348a8e849e0fb2187b10230461eab795

SHA256
9131ec114e7f5c147ad97bc425aee807c0d6b735e3625535e5dfcfb301bc3d3b

SHA512
ac4c345c04b4b8ae0bdb9203487d807fc1213fbcc9dc879c4cd28b24f9831d2cacaa4ed6c533a3841f6b23068a6c130b9e5bbcabdf12041c24643275368f936e

Download Submit
C:\Windows\System\cuqcjfy.exe

Filesize
2.2MB

MD5
1358e382a2b0ad4147d0760b8b1286f5

SHA1
c7856ee28b722713297e4757cbc23033fbec5030

SHA256
258c481f1972779ad03af08ed32b532c2c4fecbbf919ecf450b16afb6ff9a51c

SHA512
a6ca86931efcf3a32ed159d6956a5b4d8fa284c17d911d322e737a0aebf2209b84812a9c844b9b4fbd028012e888115dd4230a70cb28183bdc656581e45b9038

Download Submit
C:\Windows\System\deuOudv.exe

Filesize
2.2MB

MD5
76e93e4de6ab79217e635c64dfe70e8e

SHA1
e47d0221f63ce7f877bf118f27d89349b61b9745

SHA256
45bbf8ddc6df22caea4e408ac3219dc46656e927bc08712698f5c97f8c5f8945

SHA512
63dc164cab9971db557d78b28d8675f7f0eab3cdda65816ffcb21ddc1848f759a8b031b4e19b6b80a61d6fe5f7ac73032b228dfd82a119fae6ee948fede6f701

Download Submit
C:\Windows\System\gvhCyRg.exe

Filesize
2.2MB

MD5
34693099cc88466dfa05f1b513803185

SHA1
566ab9cc2ee803ee7d8c62fb546642e274553135

SHA256
180967c9dd6c807e8a8022528fcdc2b2aa91de08d9d97710278f0d06f7c3f1a5

SHA512
f9e5330ca6178e783b0f99380c6010a9c2004524e7b23c370eaab482071f1650bf5fdd417e9f83c28a63387122f70470b57de97e590efccdce983c9a6ee47325

Download Submit
C:\Windows\System\jJoyzNn.exe

Filesize
2.2MB

MD5
aabfa188f0c1cd028e654b81252798ae

SHA1
dec8d722e3fea73d948138cbbbc2822144f30965

SHA256
cccb3b49e2a5999a7494bcd54bc06ec4b259875a44f64ced95624d65a7ac7215

SHA512
8e646b8784cdcdaf1a095c2ef1e1bcdd391e8f61f609771bbca5b18d8183bed5d4369b8888b2c85811eb826920b136b3fe3445b4b51739f4a6ca26f7767f97f1

Download Submit
C:\Windows\System\mTmfHKU.exe

Filesize
2.2MB

MD5
82981312d4912f7a8d48fbd312e78aa2

SHA1
40199692b273b87e9c438471231d51f8455fbff1

SHA256
554e5364ecd48d04a738a094d63d721750f5b3ce216045b5ef3cce16953be83f

SHA512
0993aa3852e89d30a32e4b2b44f57776972192a2135309f5155ef56b39a9e7d7e7ede65593b51e8aa22ebb3b912915b017680e93c305df7d910bdf22939588a1

Download Submit
C:\Windows\System\mUBCfgV.exe

Filesize
2.2MB

MD5
3e089d8da1596698e16866025d532dca

SHA1
3a4defdc1df28a0d065f7a27a77ccbe4670c0767

SHA256
4412028bb6fad12905e67ef828e56bdde2a9ac0d71cc7acfa3a00a701c4d0b48

SHA512
f408aa1d5226e3df151598f0c14499efb013aa7e28d66df63a72d8a1f54496b82d467f9ee8b35001db4e5f087e0d26f331c961d1941f7ef78dd9603202c18ed9

Download Submit
C:\Windows\System\qXYsGLG.exe

Filesize
2.2MB

MD5
10bb2a3331c03486a244eeb5adf7ee24

SHA1
fd0419b3689ee0bf903c0b4a3995a8fed65fef2e

SHA256
a1f7aba2d8ccdbe22ebc9906052ea91b9c0b4658e265b3020e490f813def7db4

SHA512
5f1e4e2db66cddc1eb3486f473419df4259854542a961582ae881b41375d7d785fc47a35264186e1ea22dd9aa29c65ec03fb8c6fabb6f6fbdbc649bbb64096eb

Download Submit
C:\Windows\System\rKKvcdA.exe

Filesize
2.2MB

MD5
d1efce3b3f4a99aafb33dade1f392c43

SHA1
138ba33481def9e86459c910fbf603318c852ffa

SHA256
4a3262d9b1897c51bbc02673002e2ffbbf95be04be374b5414fd02acb48c2989

SHA512
2ed9a9aafe3ecb9c6794dfcf1b8b9f0d3bdd31340ed76989ea564a4900c571cbe5114ed02e658ffcc8f452526de7db81db6837de7efa302babfb7d250dc3d0c1

Download Submit
C:\Windows\System\rLeKbEB.exe

Filesize
2.2MB

MD5
064fa0e9158600c305f00419c252e50b

SHA1
b9e46126a371c3d50eb496d48539eba228da3672

SHA256
666ad76e42fe24cd0e9fb22655792d3be2e1884ec2a0f05cbfaea67726d7c31c

SHA512
248b03323619f80d41c29a132f55ffbf3472c93263c94f5451e3f53ca9727b1ec6203cb27366977d5493fd5bddc964420d7b9d89b41b92a6a19cc66086b93f40

Download Submit
C:\Windows\System\rUWDPRb.exe

Filesize
2.2MB

MD5
9ffc6ae512c2a05c3145dea1dce0285e

SHA1
f98736e03dd7a82585b63d90e97a505a16c65b31

SHA256
d2769108b7c0f498faa785ceb3913d05c7ea44f4352ca9359bbacfd6a02a06eb

SHA512
7a8d0c178f1ae88d17c965dd3acbcb3321d52ca87fb72a1762b13a9139979209c7ad5db6c9238c71aca3ff5b5aef53a1bc11c0cd27b271ec36ffcceda9f128e4

Download Submit
C:\Windows\System\tAYKilm.exe

Filesize
2.2MB

MD5
741b4ac1ee972f6b8e6afe08ac00372e

SHA1
f3209d4fe534b9f7a37b13bf6e9cccd63f120f80

SHA256
0cce3aaa1b5c499d7156836eea99b68b2c316858a7f8c9c7d39cf5919af7c0c8

SHA512
4a604a5b7c21cee83ada8023afa4ca1c7dd1ec131b25a30ea46af3b9d90c8795df3c30870daeeb903798a79c77016098c4a72f1271d8321b51efc22b8760e792

Download Submit
C:\Windows\System\vryqKsY.exe

Filesize
2.2MB

MD5
ed256b7908621e4bd4c52afcfe66d4f1

SHA1
d0304bd5dc69dd9d745f0d5fa45db5d7529bb033

SHA256
5e53e0810593ae0468d409bc05b04c53de3b6ff21dd89761ccf09f8764e83d0e

SHA512
f8b33d8fcb13c093da896d9c5b63d095e9227132ba18f38ce2f632d23aa0d927f48486c465f7a8c18b9b8f9c8b4fdb85fed44989c498c71ed9710c0cf58853ba

Download Submit
C:\Windows\System\xmeQHcL.exe

Filesize
2.2MB

MD5
5ed1eb5b0783307e3202f7fe8706013c

SHA1
77f0cb94e89ebafd4fc00282b5e4eee5f34c57d3

SHA256
eee61d1ece06847aaa475b12c3189c5fc33c667eef34f057a1e364f1fd3f2158

SHA512
c7f0d08339cea53e44a51648ca303fb21bb30e4827afb5d9b40d3954ea4ccb1a78477690fe8ec4f25dc9ab482dde50c3b40c4f07e90a42bbb4b10492f14d76f8

Download Submit
C:\Windows\System\yVSQxcA.exe

Filesize
2.2MB

MD5
cef9b14452ee3ef8afe7af35b8643c83

SHA1
3d6f3c6cff8e2a04c37b2b222269b8168a87e201

SHA256
157ed83cc10857d5af49c1de925a80dba504c5904aea83704dc649713fa1622d

SHA512
39f0582c57ca5b2bdb32039aaed90910e2d2089d55be86a478e883d15ff443401ef5aa9c4adac12f8d87a57814be826ec4e50601e3c98cf26eb5b7972bfc3b3e

Download Submit
C:\Windows\System\ytqxsAB.exe

Filesize
2.2MB

MD5
fec1d2e8fb44126ca350bf4952cd7f9c

SHA1
299cdc9ef80832c74c7716c436267296b7238b00

SHA256
f01716c661ed80fbee5237f5eeeb76c25e6c0d3cd815378300f12d95a74569d5

SHA512
6607137defccefe24af028ebaabe777fed4f6759d8ec427a95476097a649febc384e402996c69d8f2e0c3354780d410077f17310e9fe3699c079ee878e3f5e4d

Download Submit
C:\Windows\System\zxXBKQe.exe

Filesize
2.2MB

MD5
487bdb3e119696319bf36b666d3e9204

SHA1
f22c36869d8b108705cfdc011536b6779d7e1ec4

SHA256
7a602da784e0e29b788526007becc73383509e6406d308bc505d19b211964f93

SHA512
c754da4e7a54d6ad3bc046278259455a29783e9e9ddc1db124bf1f8e8294ce7d2ca8df4d64c7e24c16f323dab4904ea7c542e545887e8caac8a8f860c2ed191a

Download Submit
memory/696-68-0x00007FF7EA020000-0x00007FF7EA412000-memory.dmp

Filesize
3.9MB

Download
memory/824-2156-0x00007FF63D710000-0x00007FF63DB02000-memory.dmp

Filesize
3.9MB

Download
memory/824-58-0x00007FF63D710000-0x00007FF63DB02000-memory.dmp

Filesize
3.9MB

Download
memory/1124-2086-0x00007FF69ABF0000-0x00007FF69AFE2000-memory.dmp

Filesize
3.9MB

Download
memory/1124-56-0x00007FF69ABF0000-0x00007FF69AFE2000-memory.dmp

Filesize
3.9MB

Download
memory/1196-2186-0x00007FF7728C0000-0x00007FF772CB2000-memory.dmp

Filesize
3.9MB

Download
memory/1196-398-0x00007FF7728C0000-0x00007FF772CB2000-memory.dmp

Filesize
3.9MB

Download
memory/1400-386-0x00007FF6CAC90000-0x00007FF6CB082000-memory.dmp

Filesize
3.9MB

Download
memory/1400-2182-0x00007FF6CAC90000-0x00007FF6CB082000-memory.dmp

Filesize
3.9MB

Download
memory/1448-405-0x00007FF76E000000-0x00007FF76E3F2000-memory.dmp

Filesize
3.9MB

Download
memory/1448-2183-0x00007FF76E000000-0x00007FF76E3F2000-memory.dmp

Filesize
3.9MB

Download
memory/1772-62-0x00007FF7DE520000-0x00007FF7DE912000-memory.dmp

Filesize
3.9MB

Download
memory/2240-44-0x000001FB85510000-0x000001FB85520000-memory.dmp

Filesize
64KB

Download
memory/2240-22-0x000001FB9FD20000-0x000001FB9FD42000-memory.dmp

Filesize
136KB

Download
memory/2240-259-0x000001FBA1230000-0x000001FBA19D6000-memory.dmp

Filesize
7.6MB

Download
memory/2240-43-0x00007FFD3FDC0000-0x00007FFD40881000-memory.dmp

Filesize
10.8MB

Download
memory/2240-45-0x000001FB85510000-0x000001FB85520000-memory.dmp

Filesize
64KB

Download
memory/2252-0-0x00007FF75A020000-0x00007FF75A412000-memory.dmp

Filesize
3.9MB

Download
memory/2252-1-0x0000022C98BA0000-0x0000022C98BB0000-memory.dmp

Filesize
64KB

Download
memory/2312-2197-0x00007FF61CCA0000-0x00007FF61D092000-memory.dmp

Filesize
3.9MB

Download
memory/2312-425-0x00007FF61CCA0000-0x00007FF61D092000-memory.dmp

Filesize
3.9MB

Download
memory/3244-52-0x00007FF6ED580000-0x00007FF6ED972000-memory.dmp

Filesize
3.9MB

Download
memory/3244-2060-0x00007FF6ED580000-0x00007FF6ED972000-memory.dmp

Filesize
3.9MB

Download
memory/3348-449-0x00007FF75D110000-0x00007FF75D502000-memory.dmp

Filesize
3.9MB

Download
memory/3348-2211-0x00007FF75D110000-0x00007FF75D502000-memory.dmp

Filesize
3.9MB

Download
memory/3588-413-0x00007FF74F300000-0x00007FF74F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/3588-2184-0x00007FF74F300000-0x00007FF74F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/3648-2202-0x00007FF785A40000-0x00007FF785E32000-memory.dmp

Filesize
3.9MB

Download
memory/3648-380-0x00007FF785A40000-0x00007FF785E32000-memory.dmp

Filesize
3.9MB

Download
memory/3656-69-0x00007FF769CE0000-0x00007FF76A0D2000-memory.dmp

Filesize
3.9MB

Download
memory/3656-2148-0x00007FF769CE0000-0x00007FF76A0D2000-memory.dmp

Filesize
3.9MB

Download
memory/3704-2199-0x00007FF7293F0000-0x00007FF7297E2000-memory.dmp

Filesize
3.9MB

Download
memory/3704-477-0x00007FF7293F0000-0x00007FF7297E2000-memory.dmp

Filesize
3.9MB

Download
memory/3768-2210-0x00007FF7C7F30000-0x00007FF7C8322000-memory.dmp

Filesize
3.9MB

Download
memory/3768-458-0x00007FF7C7F30000-0x00007FF7C8322000-memory.dmp

Filesize
3.9MB

Download
memory/3792-2097-0x00007FF7F9770000-0x00007FF7F9B62000-memory.dmp

Filesize
3.9MB

Download
memory/3792-55-0x00007FF7F9770000-0x00007FF7F9B62000-memory.dmp

Filesize
3.9MB

Download
memory/3864-368-0x00007FF7D8C30000-0x00007FF7D9022000-memory.dmp

Filesize
3.9MB

Download
memory/3864-2150-0x00007FF7D8C30000-0x00007FF7D9022000-memory.dmp

Filesize
3.9MB

Download
memory/3944-2109-0x00007FF6F90B0000-0x00007FF6F94A2000-memory.dmp

Filesize
3.9MB

Download
memory/3944-57-0x00007FF6F90B0000-0x00007FF6F94A2000-memory.dmp

Filesize
3.9MB

Download
memory/4712-67-0x00007FF6EB5D0000-0x00007FF6EB9C2000-memory.dmp

Filesize
3.9MB

Download
memory/4808-2201-0x00007FF779DE0000-0x00007FF77A1D2000-memory.dmp

Filesize
3.9MB

Download
memory/4808-498-0x00007FF779DE0000-0x00007FF77A1D2000-memory.dmp

Filesize
3.9MB

Download
memory/4900-2194-0x00007FF68A540000-0x00007FF68A932000-memory.dmp

Filesize
3.9MB

Download
memory/4900-439-0x00007FF68A540000-0x00007FF68A932000-memory.dmp

Filesize
3.9MB

Download