xmrig | b50fc9232f79b65c4f2e99aeeacee0c3da537238c2ce30114a2edfa65c2266b5

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 22:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
Size

1.9MB
MD5

03bb83bc83bd9c2a5ead13140a266392
SHA1

be5df65873ca1c2f1b8318edf6498ed4de8d9e3d
SHA256

b50fc9232f79b65c4f2e99aeeacee0c3da537238c2ce30114a2edfa65c2266b5
SHA512

7b148a11ef6add1eb703740a232acb5cc4a75d4e86b6404640151dd90c2dc69d1bd677282357403d2e696fd3e6f17b3ee86f22e0a4250d7776e703a2e0307190
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1Z:NABw

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/memory/3212-56-0x00007FF613710000-0x00007FF613B02000-memory.dmp	xmrig
behavioral2/memory/4076-60-0x00007FF6CB930000-0x00007FF6CBD22000-memory.dmp	xmrig
behavioral2/memory/5036-152-0x00007FF6309A0000-0x00007FF630D92000-memory.dmp	xmrig
behavioral2/memory/4556-215-0x00007FF6B6AB0000-0x00007FF6B6EA2000-memory.dmp	xmrig
behavioral2/memory/1732-220-0x00007FF6F23F0000-0x00007FF6F27E2000-memory.dmp	xmrig
behavioral2/memory/2564-221-0x00007FF65D520000-0x00007FF65D912000-memory.dmp	xmrig
behavioral2/memory/3644-219-0x00007FF654040000-0x00007FF654432000-memory.dmp	xmrig
behavioral2/memory/5024-218-0x00007FF6C3BD0000-0x00007FF6C3FC2000-memory.dmp	xmrig
behavioral2/memory/4636-217-0x00007FF774FA0000-0x00007FF775392000-memory.dmp	xmrig
behavioral2/memory/4356-216-0x00007FF6F4000000-0x00007FF6F43F2000-memory.dmp	xmrig
behavioral2/memory/372-214-0x00007FF69CAE0000-0x00007FF69CED2000-memory.dmp	xmrig
behavioral2/memory/4804-202-0x00007FF7D7FC0000-0x00007FF7D83B2000-memory.dmp	xmrig
behavioral2/memory/1060-127-0x00007FF7CE050000-0x00007FF7CE442000-memory.dmp	xmrig
behavioral2/memory/3264-126-0x00007FF7CC030000-0x00007FF7CC422000-memory.dmp	xmrig
behavioral2/memory/3328-115-0x00007FF694980000-0x00007FF694D72000-memory.dmp	xmrig
behavioral2/memory/2944-110-0x00007FF7C0800000-0x00007FF7C0BF2000-memory.dmp	xmrig
behavioral2/memory/4940-96-0x00007FF6D6650000-0x00007FF6D6A42000-memory.dmp	xmrig
behavioral2/memory/3440-70-0x00007FF641920000-0x00007FF641D12000-memory.dmp	xmrig
behavioral2/memory/4544-61-0x00007FF7DD580000-0x00007FF7DD972000-memory.dmp	xmrig
behavioral2/memory/3764-54-0x00007FF7C5220000-0x00007FF7C5612000-memory.dmp	xmrig
behavioral2/memory/3136-32-0x00007FF62C670000-0x00007FF62CA62000-memory.dmp	xmrig
behavioral2/memory/3132-5701-0x00007FF674940000-0x00007FF674D32000-memory.dmp	xmrig
behavioral2/memory/3136-6555-0x00007FF62C670000-0x00007FF62CA62000-memory.dmp	xmrig
behavioral2/memory/3132-6581-0x00007FF674940000-0x00007FF674D32000-memory.dmp	xmrig
behavioral2/memory/3440-6637-0x00007FF641920000-0x00007FF641D12000-memory.dmp	xmrig
behavioral2/memory/4544-6666-0x00007FF7DD580000-0x00007FF7DD972000-memory.dmp	xmrig
behavioral2/memory/3212-6647-0x00007FF613710000-0x00007FF613B02000-memory.dmp	xmrig
behavioral2/memory/4940-6706-0x00007FF6D6650000-0x00007FF6D6A42000-memory.dmp	xmrig
behavioral2/memory/5024-6718-0x00007FF6C3BD0000-0x00007FF6C3FC2000-memory.dmp	xmrig
behavioral2/memory/3644-6733-0x00007FF654040000-0x00007FF654432000-memory.dmp	xmrig
behavioral2/memory/1060-6762-0x00007FF7CE050000-0x00007FF7CE442000-memory.dmp	xmrig
behavioral2/memory/3328-6746-0x00007FF694980000-0x00007FF694D72000-memory.dmp	xmrig
behavioral2/memory/1732-6810-0x00007FF6F23F0000-0x00007FF6F27E2000-memory.dmp	xmrig
behavioral2/memory/4556-6822-0x00007FF6B6AB0000-0x00007FF6B6EA2000-memory.dmp	xmrig
behavioral2/memory/5036-6825-0x00007FF6309A0000-0x00007FF630D92000-memory.dmp	xmrig
behavioral2/memory/372-6820-0x00007FF69CAE0000-0x00007FF69CED2000-memory.dmp	xmrig
behavioral2/memory/4804-6829-0x00007FF7D7FC0000-0x00007FF7D83B2000-memory.dmp	xmrig
behavioral2/memory/2564-6818-0x00007FF65D520000-0x00007FF65D912000-memory.dmp	xmrig
behavioral2/memory/4636-6837-0x00007FF774FA0000-0x00007FF775392000-memory.dmp	xmrig
behavioral2/memory/4356-6836-0x00007FF6F4000000-0x00007FF6F43F2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
572	mxzakEK.exe
3764	rpAQOlL.exe
3132	qJLgDdD.exe
3720	RXUTiWW.exe
3136	PDvKPXm.exe
3440	zVwPltC.exe
3212	jJSdQtb.exe
4076	mGZGZXk.exe
4544	BJCwsfa.exe
4940	xzvQiYP.exe
5024	jRcqzfB.exe
3644	nDYHXim.exe
2944	wHpFGgw.exe
3328	qVNCIMF.exe
3264	JHGKtuc.exe
1060	cLijPyT.exe
1732	tXQmWnz.exe
5036	CBdsByp.exe
4804	XmHeMCL.exe
2564	MNPngMn.exe
372	xYbExor.exe
4556	vorVnOl.exe
4356	EWTucOV.exe
4636	htIpPvR.exe
232	CssDEap.exe
412	YMBdIwV.exe
2192	bWAWkal.exe
2084	kKnGrVS.exe
3000	kipNyRs.exe
2560	VelCSzX.exe
3200	RDzHQJC.exe
4832	ftHgkvg.exe
4916	qhdfteL.exe
2416	nuchmsF.exe
4972	SrITaYa.exe
1072	vrPhKxz.exe
4904	WqyXUyL.exe
1948	MbGniof.exe
2448	XAoVPCc.exe
4092	bLHscol.exe
1044	ckeLCOm.exe
1148	FdWJRFi.exe
4220	WpXEGGV.exe
3640	oeibqmz.exe
2548	upuqVQB.exe
3708	mxFSKiY.exe
3340	fVELHQb.exe
2876	oPoeatR.exe
428	nKHPCwL.exe
2788	meGuwaT.exe
4668	eXeClyW.exe
5076	wHjPjhD.exe
2784	vXHPHcS.exe
1476	WReYssf.exe
740	uXwLNNa.exe
4152	FEVFOaF.exe
4560	wTQcNRh.exe
3316	oXKvTyy.exe
1584	RrnXqOn.exe
4672	yuqvMOV.exe
5020	OsCcHkz.exe
3724	kLPcwyO.exe
544	HIodJcD.exe
3120	HwwGeQO.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4256-0-0x00007FF6508C0000-0x00007FF650CB2000-memory.dmp	upx
behavioral2/files/0x0008000000023408-5.dat	upx
behavioral2/files/0x000700000002340d-16.dat	upx
behavioral2/files/0x000800000002340b-21.dat	upx
behavioral2/memory/3132-24-0x00007FF674940000-0x00007FF674D32000-memory.dmp	upx
behavioral2/files/0x000700000002340e-29.dat	upx
behavioral2/files/0x000700000002340f-34.dat	upx
behavioral2/files/0x0007000000023411-48.dat	upx
behavioral2/files/0x0007000000023412-50.dat	upx
behavioral2/memory/3212-56-0x00007FF613710000-0x00007FF613B02000-memory.dmp	upx
behavioral2/memory/4076-60-0x00007FF6CB930000-0x00007FF6CBD22000-memory.dmp	upx
behavioral2/files/0x0007000000023414-63.dat	upx
behavioral2/files/0x0007000000023417-84.dat	upx
behavioral2/files/0x000700000002341b-100.dat	upx
behavioral2/files/0x0008000000023409-120.dat	upx
behavioral2/files/0x000700000002341d-131.dat	upx
behavioral2/memory/5036-152-0x00007FF6309A0000-0x00007FF630D92000-memory.dmp	upx
behavioral2/memory/4556-215-0x00007FF6B6AB0000-0x00007FF6B6EA2000-memory.dmp	upx
behavioral2/memory/1732-220-0x00007FF6F23F0000-0x00007FF6F27E2000-memory.dmp	upx
behavioral2/memory/2564-221-0x00007FF65D520000-0x00007FF65D912000-memory.dmp	upx
behavioral2/memory/3644-219-0x00007FF654040000-0x00007FF654432000-memory.dmp	upx
behavioral2/memory/5024-218-0x00007FF6C3BD0000-0x00007FF6C3FC2000-memory.dmp	upx
behavioral2/memory/4636-217-0x00007FF774FA0000-0x00007FF775392000-memory.dmp	upx
behavioral2/memory/4356-216-0x00007FF6F4000000-0x00007FF6F43F2000-memory.dmp	upx
behavioral2/memory/372-214-0x00007FF69CAE0000-0x00007FF69CED2000-memory.dmp	upx
behavioral2/files/0x0007000000023422-213.dat	upx
behavioral2/files/0x000700000002342a-207.dat	upx
behavioral2/memory/4804-202-0x00007FF7D7FC0000-0x00007FF7D83B2000-memory.dmp	upx
behavioral2/files/0x0007000000023428-198.dat	upx
behavioral2/files/0x0007000000023429-195.dat	upx
behavioral2/files/0x0007000000023427-191.dat	upx
behavioral2/files/0x0007000000023426-189.dat	upx
behavioral2/files/0x0007000000023421-187.dat	upx
behavioral2/files/0x0007000000023425-186.dat	upx
behavioral2/files/0x0007000000023424-184.dat	upx
behavioral2/files/0x0007000000023423-178.dat	upx
behavioral2/files/0x0007000000023420-174.dat	upx
behavioral2/files/0x000700000002341c-140.dat	upx
behavioral2/files/0x000700000002341f-137.dat	upx
behavioral2/files/0x000700000002341e-133.dat	upx
behavioral2/memory/1060-127-0x00007FF7CE050000-0x00007FF7CE442000-memory.dmp	upx
behavioral2/memory/3264-126-0x00007FF7CC030000-0x00007FF7CC422000-memory.dmp	upx
behavioral2/files/0x000700000002341a-116.dat	upx
behavioral2/memory/3328-115-0x00007FF694980000-0x00007FF694D72000-memory.dmp	upx
behavioral2/memory/2944-110-0x00007FF7C0800000-0x00007FF7C0BF2000-memory.dmp	upx
behavioral2/memory/4940-96-0x00007FF6D6650000-0x00007FF6D6A42000-memory.dmp	upx
behavioral2/files/0x0007000000023419-90.dat	upx
behavioral2/files/0x0007000000023415-88.dat	upx
behavioral2/files/0x0007000000023418-86.dat	upx
behavioral2/files/0x0007000000023416-82.dat	upx
behavioral2/files/0x0007000000023439-222.dat	upx
behavioral2/files/0x000700000002342b-223.dat	upx
behavioral2/memory/3440-70-0x00007FF641920000-0x00007FF641D12000-memory.dmp	upx
behavioral2/memory/4544-61-0x00007FF7DD580000-0x00007FF7DD972000-memory.dmp	upx
behavioral2/files/0x0007000000023413-55.dat	upx
behavioral2/memory/3764-54-0x00007FF7C5220000-0x00007FF7C5612000-memory.dmp	upx
behavioral2/files/0x0007000000023410-46.dat	upx
behavioral2/memory/3136-32-0x00007FF62C670000-0x00007FF62CA62000-memory.dmp	upx
behavioral2/memory/3720-28-0x00007FF600620000-0x00007FF600A12000-memory.dmp	upx
behavioral2/files/0x000700000002340c-23.dat	upx
behavioral2/memory/572-20-0x00007FF735340000-0x00007FF735732000-memory.dmp	upx
behavioral2/memory/3132-5701-0x00007FF674940000-0x00007FF674D32000-memory.dmp	upx
behavioral2/memory/3136-6555-0x00007FF62C670000-0x00007FF62CA62000-memory.dmp	upx
behavioral2/memory/3132-6581-0x00007FF674940000-0x00007FF674D32000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\iwmrywo.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\wtvaStK.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\kNfhEoi.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\vupostl.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\LEbKiIj.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\JFhXYBg.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\jwraXIj.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\oFZUNWP.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\EstAcZh.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\TqqFleb.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\zIkMSNX.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\kSGMsSZ.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\exdVzbl.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\ygffbsW.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\cthstjP.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\DBjkili.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\kIgEFmR.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\XaMGIbz.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\eYTzmFR.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\FZfORrr.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\HcqjWqw.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\QSGAXxZ.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\Ilpxdde.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\nlcKQBR.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\fUBGzaN.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\SGeJhKh.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\MfZYTZP.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\HHrnJnS.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\UBVZBLq.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\tkuBazJ.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\keUqZAl.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\DRiEiit.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\BJouRPQ.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\sliARCN.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\uCfOOkx.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\ExFKpOr.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\wnHxiAM.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\CuVHrhl.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\QwofsNK.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\SuMzLqu.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\HoIcNel.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\jgZnwHa.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\sSbdxGJ.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\KtxpVjU.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\bcxdEug.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\htMsiUg.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\NwRMmFX.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\XFEZJJV.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\MenjlMw.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\SxsVVvJ.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\rTEajrN.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\opdByWp.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\IIQoVxS.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\MJxhxRt.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\lpkVUjm.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\pYyysWH.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\CWUKrJl.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\GlumYwD.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\oWTJWzF.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\rarWTdd.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\KCBMoWa.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\xOhAOqO.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\PDQfpcc.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
File created	C:\Windows\System\RIlLHhJ.exe	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5040	powershell.exe
5040	powershell.exe
5040	powershell.exe
5040	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
Token: SeDebugPrivilege	5040	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 5040	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	85
PID 4256 wrote to memory of 5040	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	85
PID 4256 wrote to memory of 572	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	86
PID 4256 wrote to memory of 572	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	86
PID 4256 wrote to memory of 3136	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	87
PID 4256 wrote to memory of 3136	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	87
PID 4256 wrote to memory of 3764	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	88
PID 4256 wrote to memory of 3764	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	88
PID 4256 wrote to memory of 3132	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	89
PID 4256 wrote to memory of 3132	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	89
PID 4256 wrote to memory of 3720	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	90
PID 4256 wrote to memory of 3720	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	90
PID 4256 wrote to memory of 3440	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	91
PID 4256 wrote to memory of 3440	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	91
PID 4256 wrote to memory of 3212	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	92
PID 4256 wrote to memory of 3212	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	92
PID 4256 wrote to memory of 4076	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	93
PID 4256 wrote to memory of 4076	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	93
PID 4256 wrote to memory of 4544	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	94
PID 4256 wrote to memory of 4544	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	94
PID 4256 wrote to memory of 4940	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	95
PID 4256 wrote to memory of 4940	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	95
PID 4256 wrote to memory of 5024	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	96
PID 4256 wrote to memory of 5024	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	96
PID 4256 wrote to memory of 3264	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	97
PID 4256 wrote to memory of 3264	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	97
PID 4256 wrote to memory of 3644	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	98
PID 4256 wrote to memory of 3644	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	98
PID 4256 wrote to memory of 2944	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	99
PID 4256 wrote to memory of 2944	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	99
PID 4256 wrote to memory of 3328	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	100
PID 4256 wrote to memory of 3328	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	100
PID 4256 wrote to memory of 1060	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	101
PID 4256 wrote to memory of 1060	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	101
PID 4256 wrote to memory of 1732	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	102
PID 4256 wrote to memory of 1732	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	102
PID 4256 wrote to memory of 5036	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	103
PID 4256 wrote to memory of 5036	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	103
PID 4256 wrote to memory of 4804	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	104
PID 4256 wrote to memory of 4804	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	104
PID 4256 wrote to memory of 2564	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	105
PID 4256 wrote to memory of 2564	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	105
PID 4256 wrote to memory of 372	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	106
PID 4256 wrote to memory of 372	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	106
PID 4256 wrote to memory of 4556	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	107
PID 4256 wrote to memory of 4556	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	107
PID 4256 wrote to memory of 4356	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	108
PID 4256 wrote to memory of 4356	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	108
PID 4256 wrote to memory of 4636	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	109
PID 4256 wrote to memory of 4636	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	109
PID 4256 wrote to memory of 232	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	110
PID 4256 wrote to memory of 232	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	110
PID 4256 wrote to memory of 412	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	111
PID 4256 wrote to memory of 412	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	111
PID 4256 wrote to memory of 2192	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	112
PID 4256 wrote to memory of 2192	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	112
PID 4256 wrote to memory of 2084	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	113
PID 4256 wrote to memory of 2084	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	113
PID 4256 wrote to memory of 3000	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	114
PID 4256 wrote to memory of 3000	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	114
PID 4256 wrote to memory of 2560	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	115
PID 4256 wrote to memory of 2560	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	115
PID 4256 wrote to memory of 3200	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	116
PID 4256 wrote to memory of 3200	4256	03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03bb83bc83bd9c2a5ead13140a266392_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5040
- C:\Windows\System\mxzakEK.exe
  C:\Windows\System\mxzakEK.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\PDvKPXm.exe
  C:\Windows\System\PDvKPXm.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\rpAQOlL.exe
  C:\Windows\System\rpAQOlL.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\qJLgDdD.exe
  C:\Windows\System\qJLgDdD.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\RXUTiWW.exe
  C:\Windows\System\RXUTiWW.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\zVwPltC.exe
  C:\Windows\System\zVwPltC.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\jJSdQtb.exe
  C:\Windows\System\jJSdQtb.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\mGZGZXk.exe
  C:\Windows\System\mGZGZXk.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\BJCwsfa.exe
  C:\Windows\System\BJCwsfa.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\xzvQiYP.exe
  C:\Windows\System\xzvQiYP.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\jRcqzfB.exe
  C:\Windows\System\jRcqzfB.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\JHGKtuc.exe
  C:\Windows\System\JHGKtuc.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\nDYHXim.exe
  C:\Windows\System\nDYHXim.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\wHpFGgw.exe
  C:\Windows\System\wHpFGgw.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\qVNCIMF.exe
  C:\Windows\System\qVNCIMF.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\cLijPyT.exe
  C:\Windows\System\cLijPyT.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\tXQmWnz.exe
  C:\Windows\System\tXQmWnz.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\CBdsByp.exe
  C:\Windows\System\CBdsByp.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\XmHeMCL.exe
  C:\Windows\System\XmHeMCL.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\MNPngMn.exe
  C:\Windows\System\MNPngMn.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\xYbExor.exe
  C:\Windows\System\xYbExor.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\vorVnOl.exe
  C:\Windows\System\vorVnOl.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\EWTucOV.exe
  C:\Windows\System\EWTucOV.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\htIpPvR.exe
  C:\Windows\System\htIpPvR.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\CssDEap.exe
  C:\Windows\System\CssDEap.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\YMBdIwV.exe
  C:\Windows\System\YMBdIwV.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\bWAWkal.exe
  C:\Windows\System\bWAWkal.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\kKnGrVS.exe
  C:\Windows\System\kKnGrVS.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\kipNyRs.exe
  C:\Windows\System\kipNyRs.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\VelCSzX.exe
  C:\Windows\System\VelCSzX.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\RDzHQJC.exe
  C:\Windows\System\RDzHQJC.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\ftHgkvg.exe
  C:\Windows\System\ftHgkvg.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\qhdfteL.exe
  C:\Windows\System\qhdfteL.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\nuchmsF.exe
  C:\Windows\System\nuchmsF.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\vrPhKxz.exe
  C:\Windows\System\vrPhKxz.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\ckeLCOm.exe
  C:\Windows\System\ckeLCOm.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\FdWJRFi.exe
  C:\Windows\System\FdWJRFi.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\oPoeatR.exe
  C:\Windows\System\oPoeatR.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\WpXEGGV.exe
  C:\Windows\System\WpXEGGV.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\bLHscol.exe
  C:\Windows\System\bLHscol.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\XAoVPCc.exe
  C:\Windows\System\XAoVPCc.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\oeibqmz.exe
  C:\Windows\System\oeibqmz.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\MbGniof.exe
  C:\Windows\System\MbGniof.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\upuqVQB.exe
  C:\Windows\System\upuqVQB.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\WqyXUyL.exe
  C:\Windows\System\WqyXUyL.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\mxFSKiY.exe
  C:\Windows\System\mxFSKiY.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\SrITaYa.exe
  C:\Windows\System\SrITaYa.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\fVELHQb.exe
  C:\Windows\System\fVELHQb.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\nKHPCwL.exe
  C:\Windows\System\nKHPCwL.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\meGuwaT.exe
  C:\Windows\System\meGuwaT.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\eXeClyW.exe
  C:\Windows\System\eXeClyW.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\wHjPjhD.exe
  C:\Windows\System\wHjPjhD.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\vXHPHcS.exe
  C:\Windows\System\vXHPHcS.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\WReYssf.exe
  C:\Windows\System\WReYssf.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\uXwLNNa.exe
  C:\Windows\System\uXwLNNa.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\FEVFOaF.exe
  C:\Windows\System\FEVFOaF.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\wTQcNRh.exe
  C:\Windows\System\wTQcNRh.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\oXKvTyy.exe
  C:\Windows\System\oXKvTyy.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\RrnXqOn.exe
  C:\Windows\System\RrnXqOn.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\yuqvMOV.exe
  C:\Windows\System\yuqvMOV.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\OsCcHkz.exe
  C:\Windows\System\OsCcHkz.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\ilRuyOO.exe
  C:\Windows\System\ilRuyOO.exe
  2⤵
  PID:1248
- C:\Windows\System\OXikSYb.exe
  C:\Windows\System\OXikSYb.exe
  2⤵
  PID:5056
- C:\Windows\System\kLPcwyO.exe
  C:\Windows\System\kLPcwyO.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\HIodJcD.exe
  C:\Windows\System\HIodJcD.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\HwwGeQO.exe
  C:\Windows\System\HwwGeQO.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\trabUYE.exe
  C:\Windows\System\trabUYE.exe
  2⤵
  PID:4000
- C:\Windows\System\BdeWsrd.exe
  C:\Windows\System\BdeWsrd.exe
  2⤵
  PID:4508
- C:\Windows\System\PFRVziU.exe
  C:\Windows\System\PFRVziU.exe
  2⤵
  PID:4788
- C:\Windows\System\evYzvLs.exe
  C:\Windows\System\evYzvLs.exe
  2⤵
  PID:216
- C:\Windows\System\lvoWeaF.exe
  C:\Windows\System\lvoWeaF.exe
  2⤵
  PID:1908
- C:\Windows\System\ksjbTuy.exe
  C:\Windows\System\ksjbTuy.exe
  2⤵
  PID:3776
- C:\Windows\System\CngwKtu.exe
  C:\Windows\System\CngwKtu.exe
  2⤵
  PID:3876
- C:\Windows\System\rmJEIMy.exe
  C:\Windows\System\rmJEIMy.exe
  2⤵
  PID:3600
- C:\Windows\System\iThajat.exe
  C:\Windows\System\iThajat.exe
  2⤵
  PID:1828
- C:\Windows\System\IfWvPIJ.exe
  C:\Windows\System\IfWvPIJ.exe
  2⤵
  PID:3348
- C:\Windows\System\xJAyxdJ.exe
  C:\Windows\System\xJAyxdJ.exe
  2⤵
  PID:4572
- C:\Windows\System\avxmxIc.exe
  C:\Windows\System\avxmxIc.exe
  2⤵
  PID:3292
- C:\Windows\System\YUirRBd.exe
  C:\Windows\System\YUirRBd.exe
  2⤵
  PID:208
- C:\Windows\System\CvVvSHG.exe
  C:\Windows\System\CvVvSHG.exe
  2⤵
  PID:3604
- C:\Windows\System\nmwrzPU.exe
  C:\Windows\System\nmwrzPU.exe
  2⤵
  PID:3336
- C:\Windows\System\HVwrvwk.exe
  C:\Windows\System\HVwrvwk.exe
  2⤵
  PID:3436
- C:\Windows\System\Ttiqerh.exe
  C:\Windows\System\Ttiqerh.exe
  2⤵
  PID:2136
- C:\Windows\System\DefWfYI.exe
  C:\Windows\System\DefWfYI.exe
  2⤵
  PID:452
- C:\Windows\System\ymYJMDP.exe
  C:\Windows\System\ymYJMDP.exe
  2⤵
  PID:3240
- C:\Windows\System\TeBYiTW.exe
  C:\Windows\System\TeBYiTW.exe
  2⤵
  PID:5068
- C:\Windows\System\ZQIaPQw.exe
  C:\Windows\System\ZQIaPQw.exe
  2⤵
  PID:3960
- C:\Windows\System\biusfaP.exe
  C:\Windows\System\biusfaP.exe
  2⤵
  PID:2368
- C:\Windows\System\KnNvICb.exe
  C:\Windows\System\KnNvICb.exe
  2⤵
  PID:5016
- C:\Windows\System\XMwGeCk.exe
  C:\Windows\System\XMwGeCk.exe
  2⤵
  PID:3232
- C:\Windows\System\nYmejCk.exe
  C:\Windows\System\nYmejCk.exe
  2⤵
  PID:2308
- C:\Windows\System\SeinKEx.exe
  C:\Windows\System\SeinKEx.exe
  2⤵
  PID:5064
- C:\Windows\System\VUloLId.exe
  C:\Windows\System\VUloLId.exe
  2⤵
  PID:4332
- C:\Windows\System\OGszrMQ.exe
  C:\Windows\System\OGszrMQ.exe
  2⤵
  PID:1848
- C:\Windows\System\olljuWy.exe
  C:\Windows\System\olljuWy.exe
  2⤵
  PID:4860
- C:\Windows\System\kkpWVLJ.exe
  C:\Windows\System\kkpWVLJ.exe
  2⤵
  PID:404
- C:\Windows\System\oiAhoMy.exe
  C:\Windows\System\oiAhoMy.exe
  2⤵
  PID:4388
- C:\Windows\System\WhUBkUJ.exe
  C:\Windows\System\WhUBkUJ.exe
  2⤵
  PID:3516
- C:\Windows\System\PNTDTWH.exe
  C:\Windows\System\PNTDTWH.exe
  2⤵
  PID:4676
- C:\Windows\System\gIDIRKr.exe
  C:\Windows\System\gIDIRKr.exe
  2⤵
  PID:4576
- C:\Windows\System\TkwSDhV.exe
  C:\Windows\System\TkwSDhV.exe
  2⤵
  PID:3320
- C:\Windows\System\sOaOXxl.exe
  C:\Windows\System\sOaOXxl.exe
  2⤵
  PID:3716
- C:\Windows\System\UmFuIrs.exe
  C:\Windows\System\UmFuIrs.exe
  2⤵
  PID:3648
- C:\Windows\System\nyrBpaQ.exe
  C:\Windows\System\nyrBpaQ.exe
  2⤵
  PID:1944
- C:\Windows\System\DZSrygd.exe
  C:\Windows\System\DZSrygd.exe
  2⤵
  PID:4272
- C:\Windows\System\DdYdgPk.exe
  C:\Windows\System\DdYdgPk.exe
  2⤵
  PID:1708
- C:\Windows\System\HYrqjjg.exe
  C:\Windows\System\HYrqjjg.exe
  2⤵
  PID:5144
- C:\Windows\System\JLRhECA.exe
  C:\Windows\System\JLRhECA.exe
  2⤵
  PID:5168
- C:\Windows\System\CqtzBYl.exe
  C:\Windows\System\CqtzBYl.exe
  2⤵
  PID:5184
- C:\Windows\System\zoQlNuB.exe
  C:\Windows\System\zoQlNuB.exe
  2⤵
  PID:5208
- C:\Windows\System\guKfqjd.exe
  C:\Windows\System\guKfqjd.exe
  2⤵
  PID:5224
- C:\Windows\System\BlrSjOg.exe
  C:\Windows\System\BlrSjOg.exe
  2⤵
  PID:5252
- C:\Windows\System\vivjpGS.exe
  C:\Windows\System\vivjpGS.exe
  2⤵
  PID:5276
- C:\Windows\System\MxWhlrh.exe
  C:\Windows\System\MxWhlrh.exe
  2⤵
  PID:5296
- C:\Windows\System\Eosuuaf.exe
  C:\Windows\System\Eosuuaf.exe
  2⤵
  PID:5320
- C:\Windows\System\shlRxfO.exe
  C:\Windows\System\shlRxfO.exe
  2⤵
  PID:5348
- C:\Windows\System\MsYqzXO.exe
  C:\Windows\System\MsYqzXO.exe
  2⤵
  PID:5372
- C:\Windows\System\zAGHNcf.exe
  C:\Windows\System\zAGHNcf.exe
  2⤵
  PID:5392
- C:\Windows\System\iRZwsri.exe
  C:\Windows\System\iRZwsri.exe
  2⤵
  PID:5412
- C:\Windows\System\hEeRmFi.exe
  C:\Windows\System\hEeRmFi.exe
  2⤵
  PID:5432
- C:\Windows\System\jgFSdgo.exe
  C:\Windows\System\jgFSdgo.exe
  2⤵
  PID:5456
- C:\Windows\System\LvNalwv.exe
  C:\Windows\System\LvNalwv.exe
  2⤵
  PID:5476
- C:\Windows\System\lpmhLLE.exe
  C:\Windows\System\lpmhLLE.exe
  2⤵
  PID:5496
- C:\Windows\System\fBUOIBZ.exe
  C:\Windows\System\fBUOIBZ.exe
  2⤵
  PID:5516
- C:\Windows\System\KcNbHCs.exe
  C:\Windows\System\KcNbHCs.exe
  2⤵
  PID:5548
- C:\Windows\System\NwXZiLB.exe
  C:\Windows\System\NwXZiLB.exe
  2⤵
  PID:5564
- C:\Windows\System\yWWTCfm.exe
  C:\Windows\System\yWWTCfm.exe
  2⤵
  PID:5588
- C:\Windows\System\ZyedqHh.exe
  C:\Windows\System\ZyedqHh.exe
  2⤵
  PID:5608
- C:\Windows\System\uKVaybp.exe
  C:\Windows\System\uKVaybp.exe
  2⤵
  PID:5632
- C:\Windows\System\fUHHPHK.exe
  C:\Windows\System\fUHHPHK.exe
  2⤵
  PID:5652
- C:\Windows\System\LbgWbIY.exe
  C:\Windows\System\LbgWbIY.exe
  2⤵
  PID:5680
- C:\Windows\System\byFLBcl.exe
  C:\Windows\System\byFLBcl.exe
  2⤵
  PID:5700
- C:\Windows\System\cfQMCrM.exe
  C:\Windows\System\cfQMCrM.exe
  2⤵
  PID:5724
- C:\Windows\System\yfYyuhK.exe
  C:\Windows\System\yfYyuhK.exe
  2⤵
  PID:5744
- C:\Windows\System\GPdKsSB.exe
  C:\Windows\System\GPdKsSB.exe
  2⤵
  PID:5768
- C:\Windows\System\jmNIDzM.exe
  C:\Windows\System\jmNIDzM.exe
  2⤵
  PID:5788
- C:\Windows\System\inFwdPI.exe
  C:\Windows\System\inFwdPI.exe
  2⤵
  PID:5812
- C:\Windows\System\WVYCEyx.exe
  C:\Windows\System\WVYCEyx.exe
  2⤵
  PID:5828
- C:\Windows\System\xvTzVPk.exe
  C:\Windows\System\xvTzVPk.exe
  2⤵
  PID:5856
- C:\Windows\System\tRdAueg.exe
  C:\Windows\System\tRdAueg.exe
  2⤵
  PID:5880
- C:\Windows\System\jKRKyWT.exe
  C:\Windows\System\jKRKyWT.exe
  2⤵
  PID:5900
- C:\Windows\System\qIhutfa.exe
  C:\Windows\System\qIhutfa.exe
  2⤵
  PID:5920
- C:\Windows\System\zYBCviS.exe
  C:\Windows\System\zYBCviS.exe
  2⤵
  PID:5940
- C:\Windows\System\sDyEeat.exe
  C:\Windows\System\sDyEeat.exe
  2⤵
  PID:5968
- C:\Windows\System\YTizwGO.exe
  C:\Windows\System\YTizwGO.exe
  2⤵
  PID:5984
- C:\Windows\System\PBXLmLq.exe
  C:\Windows\System\PBXLmLq.exe
  2⤵
  PID:6008
- C:\Windows\System\bUHmCue.exe
  C:\Windows\System\bUHmCue.exe
  2⤵
  PID:6036
- C:\Windows\System\ERBEPPi.exe
  C:\Windows\System\ERBEPPi.exe
  2⤵
  PID:6068
- C:\Windows\System\WWxuUIZ.exe
  C:\Windows\System\WWxuUIZ.exe
  2⤵
  PID:6088
- C:\Windows\System\ppSREpJ.exe
  C:\Windows\System\ppSREpJ.exe
  2⤵
  PID:6112
- C:\Windows\System\JJXtyxB.exe
  C:\Windows\System\JJXtyxB.exe
  2⤵
  PID:6132
- C:\Windows\System\KQFAybL.exe
  C:\Windows\System\KQFAybL.exe
  2⤵
  PID:564
- C:\Windows\System\MvhGkJu.exe
  C:\Windows\System\MvhGkJu.exe
  2⤵
  PID:4060
- C:\Windows\System\acEjVpf.exe
  C:\Windows\System\acEjVpf.exe
  2⤵
  PID:1964
- C:\Windows\System\DymHRYH.exe
  C:\Windows\System\DymHRYH.exe
  2⤵
  PID:4032
- C:\Windows\System\eAoDeWZ.exe
  C:\Windows\System\eAoDeWZ.exe
  2⤵
  PID:1844
- C:\Windows\System\vVCLeJW.exe
  C:\Windows\System\vVCLeJW.exe
  2⤵
  PID:4160
- C:\Windows\System\IoSXXIv.exe
  C:\Windows\System\IoSXXIv.exe
  2⤵
  PID:4968
- C:\Windows\System\JhHdojM.exe
  C:\Windows\System\JhHdojM.exe
  2⤵
  PID:5140
- C:\Windows\System\NPFxrWd.exe
  C:\Windows\System\NPFxrWd.exe
  2⤵
  PID:5176
- C:\Windows\System\hQCRXxD.exe
  C:\Windows\System\hQCRXxD.exe
  2⤵
  PID:5264
- C:\Windows\System\UPGaoJM.exe
  C:\Windows\System\UPGaoJM.exe
  2⤵
  PID:4864
- C:\Windows\System\PwUPldX.exe
  C:\Windows\System\PwUPldX.exe
  2⤵
  PID:4432
- C:\Windows\System\ujQAdtB.exe
  C:\Windows\System\ujQAdtB.exe
  2⤵
  PID:3544
- C:\Windows\System\UxvITvk.exe
  C:\Windows\System\UxvITvk.exe
  2⤵
  PID:4992
- C:\Windows\System\JzbgvAH.exe
  C:\Windows\System\JzbgvAH.exe
  2⤵
  PID:4364
- C:\Windows\System\URRqyLc.exe
  C:\Windows\System\URRqyLc.exe
  2⤵
  PID:4080
- C:\Windows\System\YWVzRNp.exe
  C:\Windows\System\YWVzRNp.exe
  2⤵
  PID:5604
- C:\Windows\System\msPzdiL.exe
  C:\Windows\System\msPzdiL.exe
  2⤵
  PID:5644
- C:\Windows\System\FAURBOk.exe
  C:\Windows\System\FAURBOk.exe
  2⤵
  PID:5288
- C:\Windows\System\aBZxuhM.exe
  C:\Windows\System\aBZxuhM.exe
  2⤵
  PID:5848
- C:\Windows\System\NIcPPIr.exe
  C:\Windows\System\NIcPPIr.exe
  2⤵
  PID:5948
- C:\Windows\System\mtcLtYz.exe
  C:\Windows\System\mtcLtYz.exe
  2⤵
  PID:6152
- C:\Windows\System\OgLaAFf.exe
  C:\Windows\System\OgLaAFf.exe
  2⤵
  PID:6176
- C:\Windows\System\pPnGWuM.exe
  C:\Windows\System\pPnGWuM.exe
  2⤵
  PID:6200
- C:\Windows\System\PpMRVKs.exe
  C:\Windows\System\PpMRVKs.exe
  2⤵
  PID:6224
- C:\Windows\System\EkDTkLb.exe
  C:\Windows\System\EkDTkLb.exe
  2⤵
  PID:6244
- C:\Windows\System\XvASnBr.exe
  C:\Windows\System\XvASnBr.exe
  2⤵
  PID:6268
- C:\Windows\System\GVvaFjg.exe
  C:\Windows\System\GVvaFjg.exe
  2⤵
  PID:6284
- C:\Windows\System\ORhOGwb.exe
  C:\Windows\System\ORhOGwb.exe
  2⤵
  PID:6300
- C:\Windows\System\YtrxopK.exe
  C:\Windows\System\YtrxopK.exe
  2⤵
  PID:6324
- C:\Windows\System\qkBERzl.exe
  C:\Windows\System\qkBERzl.exe
  2⤵
  PID:6340
- C:\Windows\System\RwwdvwX.exe
  C:\Windows\System\RwwdvwX.exe
  2⤵
  PID:6364
- C:\Windows\System\SHHSMIa.exe
  C:\Windows\System\SHHSMIa.exe
  2⤵
  PID:6392
- C:\Windows\System\MrAmJPz.exe
  C:\Windows\System\MrAmJPz.exe
  2⤵
  PID:6408
- C:\Windows\System\XHWqikn.exe
  C:\Windows\System\XHWqikn.exe
  2⤵
  PID:6436
- C:\Windows\System\ZKudlCo.exe
  C:\Windows\System\ZKudlCo.exe
  2⤵
  PID:6456
- C:\Windows\System\CiJDMfO.exe
  C:\Windows\System\CiJDMfO.exe
  2⤵
  PID:6476
- C:\Windows\System\SrhnpGN.exe
  C:\Windows\System\SrhnpGN.exe
  2⤵
  PID:6496
- C:\Windows\System\HBNeenQ.exe
  C:\Windows\System\HBNeenQ.exe
  2⤵
  PID:6516
- C:\Windows\System\AyhZReR.exe
  C:\Windows\System\AyhZReR.exe
  2⤵
  PID:6540
- C:\Windows\System\GhKzBjP.exe
  C:\Windows\System\GhKzBjP.exe
  2⤵
  PID:6568
- C:\Windows\System\ztlaPSI.exe
  C:\Windows\System\ztlaPSI.exe
  2⤵
  PID:6584
- C:\Windows\System\UcnEqDg.exe
  C:\Windows\System\UcnEqDg.exe
  2⤵
  PID:6608
- C:\Windows\System\NfEKdmE.exe
  C:\Windows\System\NfEKdmE.exe
  2⤵
  PID:6628
- C:\Windows\System\uNfWzdV.exe
  C:\Windows\System\uNfWzdV.exe
  2⤵
  PID:6652
- C:\Windows\System\OxIkomA.exe
  C:\Windows\System\OxIkomA.exe
  2⤵
  PID:6668
- C:\Windows\System\xZDQcyK.exe
  C:\Windows\System\xZDQcyK.exe
  2⤵
  PID:6692
- C:\Windows\System\pBJIWCp.exe
  C:\Windows\System\pBJIWCp.exe
  2⤵
  PID:6716
- C:\Windows\System\ejBBCtt.exe
  C:\Windows\System\ejBBCtt.exe
  2⤵
  PID:6732
- C:\Windows\System\UwuFgNb.exe
  C:\Windows\System\UwuFgNb.exe
  2⤵
  PID:6760
- C:\Windows\System\UTozSln.exe
  C:\Windows\System\UTozSln.exe
  2⤵
  PID:6784
- C:\Windows\System\lsqMRhu.exe
  C:\Windows\System\lsqMRhu.exe
  2⤵
  PID:6800
- C:\Windows\System\lMHfBnY.exe
  C:\Windows\System\lMHfBnY.exe
  2⤵
  PID:6824
- C:\Windows\System\EjTGhVR.exe
  C:\Windows\System\EjTGhVR.exe
  2⤵
  PID:6852
- C:\Windows\System\EvLtEeg.exe
  C:\Windows\System\EvLtEeg.exe
  2⤵
  PID:6868
- C:\Windows\System\RaIhJjA.exe
  C:\Windows\System\RaIhJjA.exe
  2⤵
  PID:6896
- C:\Windows\System\auPdtDm.exe
  C:\Windows\System\auPdtDm.exe
  2⤵
  PID:6912
- C:\Windows\System\Xtjathq.exe
  C:\Windows\System\Xtjathq.exe
  2⤵
  PID:6932
- C:\Windows\System\AdnsUAr.exe
  C:\Windows\System\AdnsUAr.exe
  2⤵
  PID:6952
- C:\Windows\System\fStvkCK.exe
  C:\Windows\System\fStvkCK.exe
  2⤵
  PID:6976
- C:\Windows\System\PhbcaOR.exe
  C:\Windows\System\PhbcaOR.exe
  2⤵
  PID:6992
- C:\Windows\System\fjMoXOn.exe
  C:\Windows\System\fjMoXOn.exe
  2⤵
  PID:7020
- C:\Windows\System\NTbuzaZ.exe
  C:\Windows\System\NTbuzaZ.exe
  2⤵
  PID:7040
- C:\Windows\System\ivObBay.exe
  C:\Windows\System\ivObBay.exe
  2⤵
  PID:7060
- C:\Windows\System\RhdRrdT.exe
  C:\Windows\System\RhdRrdT.exe
  2⤵
  PID:7080
- C:\Windows\System\kJDDYXn.exe
  C:\Windows\System\kJDDYXn.exe
  2⤵
  PID:7104
- C:\Windows\System\twqtjtI.exe
  C:\Windows\System\twqtjtI.exe
  2⤵
  PID:7124
- C:\Windows\System\zTaBAMU.exe
  C:\Windows\System\zTaBAMU.exe
  2⤵
  PID:7152
- C:\Windows\System\gfxeyUu.exe
  C:\Windows\System\gfxeyUu.exe
  2⤵
  PID:4492
- C:\Windows\System\xKsfLkr.exe
  C:\Windows\System\xKsfLkr.exe
  2⤵
  PID:6052
- C:\Windows\System\FvzFYYX.exe
  C:\Windows\System\FvzFYYX.exe
  2⤵
  PID:6084
- C:\Windows\System\QuDGygG.exe
  C:\Windows\System\QuDGygG.exe
  2⤵
  PID:5340
- C:\Windows\System\mpplYqp.exe
  C:\Windows\System\mpplYqp.exe
  2⤵
  PID:5932
- C:\Windows\System\vgXEmiE.exe
  C:\Windows\System\vgXEmiE.exe
  2⤵
  PID:5992
- C:\Windows\System\PccYagW.exe
  C:\Windows\System\PccYagW.exe
  2⤵
  PID:5312
- C:\Windows\System\jOCHqSy.exe
  C:\Windows\System\jOCHqSy.exe
  2⤵
  PID:6148
- C:\Windows\System\bvEvcow.exe
  C:\Windows\System\bvEvcow.exe
  2⤵
  PID:6260
- C:\Windows\System\yPjuZrt.exe
  C:\Windows\System\yPjuZrt.exe
  2⤵
  PID:6292
- C:\Windows\System\FZLRQfx.exe
  C:\Windows\System\FZLRQfx.exe
  2⤵
  PID:6128
- C:\Windows\System\yFhmUHx.exe
  C:\Windows\System\yFhmUHx.exe
  2⤵
  PID:3820
- C:\Windows\System\dhHFiOa.exe
  C:\Windows\System\dhHFiOa.exe
  2⤵
  PID:3384
- C:\Windows\System\nwWGQor.exe
  C:\Windows\System\nwWGQor.exe
  2⤵
  PID:5136
- C:\Windows\System\DSMVRuH.exe
  C:\Windows\System\DSMVRuH.exe
  2⤵
  PID:5708
- C:\Windows\System\hxtFkgo.exe
  C:\Windows\System\hxtFkgo.exe
  2⤵
  PID:6768
- C:\Windows\System\QWiLRFw.exe
  C:\Windows\System\QWiLRFw.exe
  2⤵
  PID:5232
- C:\Windows\System\iApQqZA.exe
  C:\Windows\System\iApQqZA.exe
  2⤵
  PID:5764
- C:\Windows\System\niBOUAy.exe
  C:\Windows\System\niBOUAy.exe
  2⤵
  PID:6972
- C:\Windows\System\fiAnOhN.exe
  C:\Windows\System\fiAnOhN.exe
  2⤵
  PID:5472
- C:\Windows\System\BECJtcf.exe
  C:\Windows\System\BECJtcf.exe
  2⤵
  PID:7144
- C:\Windows\System\QbaIzEJ.exe
  C:\Windows\System\QbaIzEJ.exe
  2⤵
  PID:5964
- C:\Windows\System\ugTjUog.exe
  C:\Windows\System\ugTjUog.exe
  2⤵
  PID:6044
- C:\Windows\System\ABsfuKr.exe
  C:\Windows\System\ABsfuKr.exe
  2⤵
  PID:6644
- C:\Windows\System\GKIhsgI.exe
  C:\Windows\System\GKIhsgI.exe
  2⤵
  PID:6484
- C:\Windows\System\ZpmCEEx.exe
  C:\Windows\System\ZpmCEEx.exe
  2⤵
  PID:6416
- C:\Windows\System\LOnPaSD.exe
  C:\Windows\System\LOnPaSD.exe
  2⤵
  PID:2004
- C:\Windows\System\BpegXQF.exe
  C:\Windows\System\BpegXQF.exe
  2⤵
  PID:7180
- C:\Windows\System\XWmvYqq.exe
  C:\Windows\System\XWmvYqq.exe
  2⤵
  PID:7200
- C:\Windows\System\oYzxlOs.exe
  C:\Windows\System\oYzxlOs.exe
  2⤵
  PID:7224
- C:\Windows\System\aGcScda.exe
  C:\Windows\System\aGcScda.exe
  2⤵
  PID:7240
- C:\Windows\System\iwWtiiz.exe
  C:\Windows\System\iwWtiiz.exe
  2⤵
  PID:7268
- C:\Windows\System\PMKXIZD.exe
  C:\Windows\System\PMKXIZD.exe
  2⤵
  PID:7288
- C:\Windows\System\CBxDdIc.exe
  C:\Windows\System\CBxDdIc.exe
  2⤵
  PID:7308
- C:\Windows\System\KbpNHjA.exe
  C:\Windows\System\KbpNHjA.exe
  2⤵
  PID:7328
- C:\Windows\System\IhLZtVr.exe
  C:\Windows\System\IhLZtVr.exe
  2⤵
  PID:7348
- C:\Windows\System\PvjZLXE.exe
  C:\Windows\System\PvjZLXE.exe
  2⤵
  PID:7368
- C:\Windows\System\TdjQRtw.exe
  C:\Windows\System\TdjQRtw.exe
  2⤵
  PID:7400
- C:\Windows\System\ZLYKzlV.exe
  C:\Windows\System\ZLYKzlV.exe
  2⤵
  PID:7424
- C:\Windows\System\zbQaglG.exe
  C:\Windows\System\zbQaglG.exe
  2⤵
  PID:7452
- C:\Windows\System\kyZoAxz.exe
  C:\Windows\System\kyZoAxz.exe
  2⤵
  PID:7472
- C:\Windows\System\IewsLOf.exe
  C:\Windows\System\IewsLOf.exe
  2⤵
  PID:7496
- C:\Windows\System\iEAIvfb.exe
  C:\Windows\System\iEAIvfb.exe
  2⤵
  PID:7520
- C:\Windows\System\mEUlBay.exe
  C:\Windows\System\mEUlBay.exe
  2⤵
  PID:7540
- C:\Windows\System\RUqEuQi.exe
  C:\Windows\System\RUqEuQi.exe
  2⤵
  PID:7560
- C:\Windows\System\kPJarnD.exe
  C:\Windows\System\kPJarnD.exe
  2⤵
  PID:7576
- C:\Windows\System\exhKaCz.exe
  C:\Windows\System\exhKaCz.exe
  2⤵
  PID:7600
- C:\Windows\System\kICGnlq.exe
  C:\Windows\System\kICGnlq.exe
  2⤵
  PID:7628
- C:\Windows\System\OxQYUkt.exe
  C:\Windows\System\OxQYUkt.exe
  2⤵
  PID:7648
- C:\Windows\System\KfOMahZ.exe
  C:\Windows\System\KfOMahZ.exe
  2⤵
  PID:7672
- C:\Windows\System\wYMmwBw.exe
  C:\Windows\System\wYMmwBw.exe
  2⤵
  PID:7696
- C:\Windows\System\gCOKbHk.exe
  C:\Windows\System\gCOKbHk.exe
  2⤵
  PID:7720
- C:\Windows\System\cFhHvxL.exe
  C:\Windows\System\cFhHvxL.exe
  2⤵
  PID:7736
- C:\Windows\System\glcHrYO.exe
  C:\Windows\System\glcHrYO.exe
  2⤵
  PID:7760
- C:\Windows\System\hosdPKk.exe
  C:\Windows\System\hosdPKk.exe
  2⤵
  PID:7784
- C:\Windows\System\XwUcUEt.exe
  C:\Windows\System\XwUcUEt.exe
  2⤵
  PID:7808
- C:\Windows\System\QkkOSQN.exe
  C:\Windows\System\QkkOSQN.exe
  2⤵
  PID:7824
- C:\Windows\System\MjseYOH.exe
  C:\Windows\System\MjseYOH.exe
  2⤵
  PID:7844
- C:\Windows\System\DlKsuji.exe
  C:\Windows\System\DlKsuji.exe
  2⤵
  PID:7892
- C:\Windows\System\umMLwLt.exe
  C:\Windows\System\umMLwLt.exe
  2⤵
  PID:7916
- C:\Windows\System\IiOXqqK.exe
  C:\Windows\System\IiOXqqK.exe
  2⤵
  PID:7944
- C:\Windows\System\nYSAQCc.exe
  C:\Windows\System\nYSAQCc.exe
  2⤵
  PID:7968
- C:\Windows\System\xfEIqwA.exe
  C:\Windows\System\xfEIqwA.exe
  2⤵
  PID:7984
- C:\Windows\System\AcPHWFN.exe
  C:\Windows\System\AcPHWFN.exe
  2⤵
  PID:8012
- C:\Windows\System\ggZDCWl.exe
  C:\Windows\System\ggZDCWl.exe
  2⤵
  PID:8032
- C:\Windows\System\rSgzrQC.exe
  C:\Windows\System\rSgzrQC.exe
  2⤵
  PID:8052
- C:\Windows\System\gVrWwTA.exe
  C:\Windows\System\gVrWwTA.exe
  2⤵
  PID:8080
- C:\Windows\System\xZzFkUO.exe
  C:\Windows\System\xZzFkUO.exe
  2⤵
  PID:8100
- C:\Windows\System\fHnJWfv.exe
  C:\Windows\System\fHnJWfv.exe
  2⤵
  PID:8120
- C:\Windows\System\vRAmyrz.exe
  C:\Windows\System\vRAmyrz.exe
  2⤵
  PID:8148
- C:\Windows\System\SmYPmlz.exe
  C:\Windows\System\SmYPmlz.exe
  2⤵
  PID:8172
- C:\Windows\System\TwKnMsw.exe
  C:\Windows\System\TwKnMsw.exe
  2⤵
  PID:8188
- C:\Windows\System\NEqIEeJ.exe
  C:\Windows\System\NEqIEeJ.exe
  2⤵
  PID:6988
- C:\Windows\System\sUoMJgV.exe
  C:\Windows\System\sUoMJgV.exe
  2⤵
  PID:7072
- C:\Windows\System\XVWllOA.exe
  C:\Windows\System\XVWllOA.exe
  2⤵
  PID:6188
- C:\Windows\System\uvUsHXH.exe
  C:\Windows\System\uvUsHXH.exe
  2⤵
  PID:520
- C:\Windows\System\qXHXaUR.exe
  C:\Windows\System\qXHXaUR.exe
  2⤵
  PID:6968
- C:\Windows\System\KSlULpU.exe
  C:\Windows\System\KSlULpU.exe
  2⤵
  PID:6884
- C:\Windows\System\yYGOyPW.exe
  C:\Windows\System\yYGOyPW.exe
  2⤵
  PID:5572
- C:\Windows\System\RVmBvVu.exe
  C:\Windows\System\RVmBvVu.exe
  2⤵
  PID:5200
- C:\Windows\System\ENXaEVR.exe
  C:\Windows\System\ENXaEVR.exe
  2⤵
  PID:2680
- C:\Windows\System\iKqOqEs.exe
  C:\Windows\System\iKqOqEs.exe
  2⤵
  PID:6468
- C:\Windows\System\jtmZcGa.exe
  C:\Windows\System\jtmZcGa.exe
  2⤵
  PID:6488
- C:\Windows\System\YWLziHn.exe
  C:\Windows\System\YWLziHn.exe
  2⤵
  PID:5756
- C:\Windows\System\TTpdLnK.exe
  C:\Windows\System\TTpdLnK.exe
  2⤵
  PID:6004
- C:\Windows\System\mQAhzEQ.exe
  C:\Windows\System\mQAhzEQ.exe
  2⤵
  PID:7096
- C:\Windows\System\IBHYvdY.exe
  C:\Windows\System\IBHYvdY.exe
  2⤵
  PID:3396
- C:\Windows\System\HMpVNLy.exe
  C:\Windows\System\HMpVNLy.exe
  2⤵
  PID:6820
- C:\Windows\System\AxjjhVy.exe
  C:\Windows\System\AxjjhVy.exe
  2⤵
  PID:7220
- C:\Windows\System\GNCOGBk.exe
  C:\Windows\System\GNCOGBk.exe
  2⤵
  PID:7340
- C:\Windows\System\iVMBbRz.exe
  C:\Windows\System\iVMBbRz.exe
  2⤵
  PID:7536
- C:\Windows\System\grMyehF.exe
  C:\Windows\System\grMyehF.exe
  2⤵
  PID:7584
- C:\Windows\System\QweRaJI.exe
  C:\Windows\System\QweRaJI.exe
  2⤵
  PID:7640
- C:\Windows\System\tSgTVAO.exe
  C:\Windows\System\tSgTVAO.exe
  2⤵
  PID:8204
- C:\Windows\System\WpWTxQM.exe
  C:\Windows\System\WpWTxQM.exe
  2⤵
  PID:8224
- C:\Windows\System\KQQVFIN.exe
  C:\Windows\System\KQQVFIN.exe
  2⤵
  PID:8244
- C:\Windows\System\yMOmAjm.exe
  C:\Windows\System\yMOmAjm.exe
  2⤵
  PID:8280
- C:\Windows\System\Cvnjczr.exe
  C:\Windows\System\Cvnjczr.exe
  2⤵
  PID:8308
- C:\Windows\System\gHRLoWC.exe
  C:\Windows\System\gHRLoWC.exe
  2⤵
  PID:8324
- C:\Windows\System\moAXinx.exe
  C:\Windows\System\moAXinx.exe
  2⤵
  PID:8348
- C:\Windows\System\FpJXSuQ.exe
  C:\Windows\System\FpJXSuQ.exe
  2⤵
  PID:8364
- C:\Windows\System\cMtlyHl.exe
  C:\Windows\System\cMtlyHl.exe
  2⤵
  PID:8388
- C:\Windows\System\JTPtipi.exe
  C:\Windows\System\JTPtipi.exe
  2⤵
  PID:8412
- C:\Windows\System\ebabKeL.exe
  C:\Windows\System\ebabKeL.exe
  2⤵
  PID:8428
- C:\Windows\System\TBVZKKK.exe
  C:\Windows\System\TBVZKKK.exe
  2⤵
  PID:8452
- C:\Windows\System\uzitItd.exe
  C:\Windows\System\uzitItd.exe
  2⤵
  PID:8476
- C:\Windows\System\QNVHawB.exe
  C:\Windows\System\QNVHawB.exe
  2⤵
  PID:8500
- C:\Windows\System\akfIrBt.exe
  C:\Windows\System\akfIrBt.exe
  2⤵
  PID:8520
- C:\Windows\System\ccpvFqp.exe
  C:\Windows\System\ccpvFqp.exe
  2⤵
  PID:8540
- C:\Windows\System\NcbFuYs.exe
  C:\Windows\System\NcbFuYs.exe
  2⤵
  PID:8564
- C:\Windows\System\ZvzJMlj.exe
  C:\Windows\System\ZvzJMlj.exe
  2⤵
  PID:8580
- C:\Windows\System\ccDRnvj.exe
  C:\Windows\System\ccDRnvj.exe
  2⤵
  PID:8608
- C:\Windows\System\yPlcDYr.exe
  C:\Windows\System\yPlcDYr.exe
  2⤵
  PID:8624
- C:\Windows\System\tXieVSV.exe
  C:\Windows\System\tXieVSV.exe
  2⤵
  PID:8652
- C:\Windows\System\LidiTDB.exe
  C:\Windows\System\LidiTDB.exe
  2⤵
  PID:8672
- C:\Windows\System\OXLRtfU.exe
  C:\Windows\System\OXLRtfU.exe
  2⤵
  PID:8692
- C:\Windows\System\KcBiiVH.exe
  C:\Windows\System\KcBiiVH.exe
  2⤵
  PID:8716
- C:\Windows\System\HLDyUek.exe
  C:\Windows\System\HLDyUek.exe
  2⤵
  PID:8736
- C:\Windows\System\dLXLxir.exe
  C:\Windows\System\dLXLxir.exe
  2⤵
  PID:8760
- C:\Windows\System\bRYCGzj.exe
  C:\Windows\System\bRYCGzj.exe
  2⤵
  PID:8780
- C:\Windows\System\rbkviua.exe
  C:\Windows\System\rbkviua.exe
  2⤵
  PID:8812
- C:\Windows\System\EXdaHAb.exe
  C:\Windows\System\EXdaHAb.exe
  2⤵
  PID:8836
- C:\Windows\System\EhdihrR.exe
  C:\Windows\System\EhdihrR.exe
  2⤵
  PID:8860
- C:\Windows\System\IvFSoDh.exe
  C:\Windows\System\IvFSoDh.exe
  2⤵
  PID:8884
- C:\Windows\System\fqtBDXY.exe
  C:\Windows\System\fqtBDXY.exe
  2⤵
  PID:9160
- C:\Windows\System\XNLmsUz.exe
  C:\Windows\System\XNLmsUz.exe
  2⤵
  PID:9188
- C:\Windows\System\stzzoII.exe
  C:\Windows\System\stzzoII.exe
  2⤵
  PID:9212
- C:\Windows\System\NpeqWMB.exe
  C:\Windows\System\NpeqWMB.exe
  2⤵
  PID:5836
- C:\Windows\System\izojavk.exe
  C:\Windows\System\izojavk.exe
  2⤵
  PID:6776
- C:\Windows\System\BiUgwyY.exe
  C:\Windows\System\BiUgwyY.exe
  2⤵
  PID:6724
- C:\Windows\System\hfnaleO.exe
  C:\Windows\System\hfnaleO.exe
  2⤵
  PID:6576
- C:\Windows\System\gSqDmUX.exe
  C:\Windows\System\gSqDmUX.exe
  2⤵
  PID:5628
- C:\Windows\System\AMmKDLp.exe
  C:\Windows\System\AMmKDLp.exe
  2⤵
  PID:6752
- C:\Windows\System\mEXepXL.exe
  C:\Windows\System\mEXepXL.exe
  2⤵
  PID:5752
- C:\Windows\System\MCJKokb.exe
  C:\Windows\System\MCJKokb.exe
  2⤵
  PID:8096
- C:\Windows\System\DdGkZwZ.exe
  C:\Windows\System\DdGkZwZ.exe
  2⤵
  PID:7116
- C:\Windows\System\OrAkkkC.exe
  C:\Windows\System\OrAkkkC.exe
  2⤵
  PID:6508
- C:\Windows\System\pFaIMrV.exe
  C:\Windows\System\pFaIMrV.exe
  2⤵
  PID:6216
- C:\Windows\System\XTZzGUJ.exe
  C:\Windows\System\XTZzGUJ.exe
  2⤵
  PID:3152
- C:\Windows\System\RHiVxSa.exe
  C:\Windows\System\RHiVxSa.exe
  2⤵
  PID:6308
- C:\Windows\System\zmMKnhI.exe
  C:\Windows\System\zmMKnhI.exe
  2⤵
  PID:7388
- C:\Windows\System\nVjNCOl.exe
  C:\Windows\System\nVjNCOl.exe
  2⤵
  PID:7460
- C:\Windows\System\MigTJnH.exe
  C:\Windows\System\MigTJnH.exe
  2⤵
  PID:7516
- C:\Windows\System\ZBXKUbk.exe
  C:\Windows\System\ZBXKUbk.exe
  2⤵
  PID:7656
- C:\Windows\System\XOvDbJI.exe
  C:\Windows\System\XOvDbJI.exe
  2⤵
  PID:7816
- C:\Windows\System\mExAQUb.exe
  C:\Windows\System\mExAQUb.exe
  2⤵
  PID:7884
- C:\Windows\System\gXayjsM.exe
  C:\Windows\System\gXayjsM.exe
  2⤵
  PID:8588
- C:\Windows\System\vwaSyZS.exe
  C:\Windows\System\vwaSyZS.exe
  2⤵
  PID:8048
- C:\Windows\System\pthGHnT.exe
  C:\Windows\System\pthGHnT.exe
  2⤵
  PID:2932
- C:\Windows\System\CCJUmtw.exe
  C:\Windows\System\CCJUmtw.exe
  2⤵
  PID:7172
- C:\Windows\System\vGQmUgb.exe
  C:\Windows\System\vGQmUgb.exe
  2⤵
  PID:7320
- C:\Windows\System\tXYHTpY.exe
  C:\Windows\System\tXYHTpY.exe
  2⤵
  PID:5524
- C:\Windows\System\cScbbZC.exe
  C:\Windows\System\cScbbZC.exe
  2⤵
  PID:7420
- C:\Windows\System\LBAwOvF.exe
  C:\Windows\System\LBAwOvF.exe
  2⤵
  PID:7552
- C:\Windows\System\UasOUvE.exe
  C:\Windows\System\UasOUvE.exe
  2⤵
  PID:8200
- C:\Windows\System\tHpiNhd.exe
  C:\Windows\System\tHpiNhd.exe
  2⤵
  PID:7688
- C:\Windows\System\BfbruFq.exe
  C:\Windows\System\BfbruFq.exe
  2⤵
  PID:7744
- C:\Windows\System\NOlzFCB.exe
  C:\Windows\System\NOlzFCB.exe
  2⤵
  PID:7868
- C:\Windows\System\JsmUAxt.exe
  C:\Windows\System\JsmUAxt.exe
  2⤵
  PID:8064
- C:\Windows\System\LFkmGQb.exe
  C:\Windows\System\LFkmGQb.exe
  2⤵
  PID:8724
- C:\Windows\System\omEjsce.exe
  C:\Windows\System\omEjsce.exe
  2⤵
  PID:8136
- C:\Windows\System\SlaxIgh.exe
  C:\Windows\System\SlaxIgh.exe
  2⤵
  PID:8788
- C:\Windows\System\wFsMJJt.exe
  C:\Windows\System\wFsMJJt.exe
  2⤵
  PID:8832
- C:\Windows\System\PysBSIo.exe
  C:\Windows\System\PysBSIo.exe
  2⤵
  PID:9236
- C:\Windows\System\CWpaoKL.exe
  C:\Windows\System\CWpaoKL.exe
  2⤵
  PID:9252
- C:\Windows\System\YrqNDZA.exe
  C:\Windows\System\YrqNDZA.exe
  2⤵
  PID:9272
- C:\Windows\System\WpyAgma.exe
  C:\Windows\System\WpyAgma.exe
  2⤵
  PID:9296
- C:\Windows\System\YuBgKdc.exe
  C:\Windows\System\YuBgKdc.exe
  2⤵
  PID:9320
- C:\Windows\System\BdgssWK.exe
  C:\Windows\System\BdgssWK.exe
  2⤵
  PID:9340
- C:\Windows\System\XMxfMYi.exe
  C:\Windows\System\XMxfMYi.exe
  2⤵
  PID:9364
- C:\Windows\System\BThwNIs.exe
  C:\Windows\System\BThwNIs.exe
  2⤵
  PID:9384
- C:\Windows\System\jfIuScp.exe
  C:\Windows\System\jfIuScp.exe
  2⤵
  PID:9416
- C:\Windows\System\zQYaitf.exe
  C:\Windows\System\zQYaitf.exe
  2⤵
  PID:9440
- C:\Windows\System\WmBjpZj.exe
  C:\Windows\System\WmBjpZj.exe
  2⤵
  PID:9456
- C:\Windows\System\kVyJtFS.exe
  C:\Windows\System\kVyJtFS.exe
  2⤵
  PID:9484
- C:\Windows\System\fzOUeuO.exe
  C:\Windows\System\fzOUeuO.exe
  2⤵
  PID:9512
- C:\Windows\System\EbYLusT.exe
  C:\Windows\System\EbYLusT.exe
  2⤵
  PID:9532
- C:\Windows\System\vzbECZM.exe
  C:\Windows\System\vzbECZM.exe
  2⤵
  PID:9552
- C:\Windows\System\figdbJz.exe
  C:\Windows\System\figdbJz.exe
  2⤵
  PID:9576
- C:\Windows\System\SyrDkzK.exe
  C:\Windows\System\SyrDkzK.exe
  2⤵
  PID:9600
- C:\Windows\System\kqKyjKy.exe
  C:\Windows\System\kqKyjKy.exe
  2⤵
  PID:9628
- C:\Windows\System\YuidFMS.exe
  C:\Windows\System\YuidFMS.exe
  2⤵
  PID:9644
- C:\Windows\System\iCzalIy.exe
  C:\Windows\System\iCzalIy.exe
  2⤵
  PID:9664
- C:\Windows\System\QOVhTww.exe
  C:\Windows\System\QOVhTww.exe
  2⤵
  PID:9688
- C:\Windows\System\QpHjSks.exe
  C:\Windows\System\QpHjSks.exe
  2⤵
  PID:9712
- C:\Windows\System\qyXJUDi.exe
  C:\Windows\System\qyXJUDi.exe
  2⤵
  PID:9736
- C:\Windows\System\afLmkzw.exe
  C:\Windows\System\afLmkzw.exe
  2⤵
  PID:9760
- C:\Windows\System\IKGMfPG.exe
  C:\Windows\System\IKGMfPG.exe
  2⤵
  PID:9776
- C:\Windows\System\CmsgDfa.exe
  C:\Windows\System\CmsgDfa.exe
  2⤵
  PID:9800
- C:\Windows\System\OMXQolC.exe
  C:\Windows\System\OMXQolC.exe
  2⤵
  PID:9824
- C:\Windows\System\wAIjwtr.exe
  C:\Windows\System\wAIjwtr.exe
  2⤵
  PID:9848
- C:\Windows\System\ppBqYNM.exe
  C:\Windows\System\ppBqYNM.exe
  2⤵
  PID:9868
- C:\Windows\System\ncqhmEx.exe
  C:\Windows\System\ncqhmEx.exe
  2⤵
  PID:9888
- C:\Windows\System\siuKUCy.exe
  C:\Windows\System\siuKUCy.exe
  2⤵
  PID:9912
- C:\Windows\System\IwdgqRN.exe
  C:\Windows\System\IwdgqRN.exe
  2⤵
  PID:9936
- C:\Windows\System\uYYwUYt.exe
  C:\Windows\System\uYYwUYt.exe
  2⤵
  PID:9952
- C:\Windows\System\WpOAaIC.exe
  C:\Windows\System\WpOAaIC.exe
  2⤵
  PID:9992
- C:\Windows\System\ityFFXE.exe
  C:\Windows\System\ityFFXE.exe
  2⤵
  PID:10008
- C:\Windows\System\zrDNdUb.exe
  C:\Windows\System\zrDNdUb.exe
  2⤵
  PID:10024
- C:\Windows\System\QyIiohR.exe
  C:\Windows\System\QyIiohR.exe
  2⤵
  PID:10044
- C:\Windows\System\BspeIWA.exe
  C:\Windows\System\BspeIWA.exe
  2⤵
  PID:10064
- C:\Windows\System\YlGMUgr.exe
  C:\Windows\System\YlGMUgr.exe
  2⤵
  PID:10084
- C:\Windows\System\dqGQLuK.exe
  C:\Windows\System\dqGQLuK.exe
  2⤵
  PID:10104
- C:\Windows\System\pQPQscm.exe
  C:\Windows\System\pQPQscm.exe
  2⤵
  PID:10128
- C:\Windows\System\cwSmzGe.exe
  C:\Windows\System\cwSmzGe.exe
  2⤵
  PID:10152
- C:\Windows\System\ayEQhjs.exe
  C:\Windows\System\ayEQhjs.exe
  2⤵
  PID:10176
- C:\Windows\System\rXgtDEg.exe
  C:\Windows\System\rXgtDEg.exe
  2⤵
  PID:10196
- C:\Windows\System\oQWEofZ.exe
  C:\Windows\System\oQWEofZ.exe
  2⤵
  PID:10216
- C:\Windows\System\IJKfDdI.exe
  C:\Windows\System\IJKfDdI.exe
  2⤵
  PID:10244
- C:\Windows\System\PlVGEei.exe
  C:\Windows\System\PlVGEei.exe
  2⤵
  PID:10268
- C:\Windows\System\otpuLey.exe
  C:\Windows\System\otpuLey.exe
  2⤵
  PID:10288
- C:\Windows\System\UgoAOmi.exe
  C:\Windows\System\UgoAOmi.exe
  2⤵
  PID:10308
- C:\Windows\System\YPOsuGI.exe
  C:\Windows\System\YPOsuGI.exe
  2⤵
  PID:10332
- C:\Windows\System\UyJBOMC.exe
  C:\Windows\System\UyJBOMC.exe
  2⤵
  PID:10356
- C:\Windows\System\KzWlDNJ.exe
  C:\Windows\System\KzWlDNJ.exe
  2⤵
  PID:10380
- C:\Windows\System\MyYuqxJ.exe
  C:\Windows\System\MyYuqxJ.exe
  2⤵
  PID:10400
- C:\Windows\System\DcJLBAz.exe
  C:\Windows\System\DcJLBAz.exe
  2⤵
  PID:10424
- C:\Windows\System\AoXGgTJ.exe
  C:\Windows\System\AoXGgTJ.exe
  2⤵
  PID:10448
- C:\Windows\System\XNQqZhW.exe
  C:\Windows\System\XNQqZhW.exe
  2⤵
  PID:10468
- C:\Windows\System\MYpdFRP.exe
  C:\Windows\System\MYpdFRP.exe
  2⤵
  PID:10492
- C:\Windows\System\iIxidUj.exe
  C:\Windows\System\iIxidUj.exe
  2⤵
  PID:10512
- C:\Windows\System\SzlVBXB.exe
  C:\Windows\System\SzlVBXB.exe
  2⤵
  PID:10536
- C:\Windows\System\NmwaRoF.exe
  C:\Windows\System\NmwaRoF.exe
  2⤵
  PID:10564
- C:\Windows\System\YRwUNBL.exe
  C:\Windows\System\YRwUNBL.exe
  2⤵
  PID:10584
- C:\Windows\System\jhSjYlP.exe
  C:\Windows\System\jhSjYlP.exe
  2⤵
  PID:10612
- C:\Windows\System\GHnjviO.exe
  C:\Windows\System\GHnjviO.exe
  2⤵
  PID:10636
- C:\Windows\System\ugSsmbs.exe
  C:\Windows\System\ugSsmbs.exe
  2⤵
  PID:10652
- C:\Windows\System\lVwpmak.exe
  C:\Windows\System\lVwpmak.exe
  2⤵
  PID:10676
- C:\Windows\System\EXhiQcy.exe
  C:\Windows\System\EXhiQcy.exe
  2⤵
  PID:10696
- C:\Windows\System\JFunNDU.exe
  C:\Windows\System\JFunNDU.exe
  2⤵
  PID:10712
- C:\Windows\System\XkiAfFx.exe
  C:\Windows\System\XkiAfFx.exe
  2⤵
  PID:10728
- C:\Windows\System\vdhiAxA.exe
  C:\Windows\System\vdhiAxA.exe
  2⤵
  PID:10748
- C:\Windows\System\xOTCWdX.exe
  C:\Windows\System\xOTCWdX.exe
  2⤵
  PID:10768
- C:\Windows\System\yAZNSGW.exe
  C:\Windows\System\yAZNSGW.exe
  2⤵
  PID:10788
- C:\Windows\System\hscIhco.exe
  C:\Windows\System\hscIhco.exe
  2⤵
  PID:10808
- C:\Windows\System\vzNnUDx.exe
  C:\Windows\System\vzNnUDx.exe
  2⤵
  PID:10824
- C:\Windows\System\yYAOtCJ.exe
  C:\Windows\System\yYAOtCJ.exe
  2⤵
  PID:10840
- C:\Windows\System\MuerxNO.exe
  C:\Windows\System\MuerxNO.exe
  2⤵
  PID:10860
- C:\Windows\System\GCGVrjo.exe
  C:\Windows\System\GCGVrjo.exe
  2⤵
  PID:10880
- C:\Windows\System\fedkCCk.exe
  C:\Windows\System\fedkCCk.exe
  2⤵
  PID:10904
- C:\Windows\System\cUnYRAX.exe
  C:\Windows\System\cUnYRAX.exe
  2⤵
  PID:10920
- C:\Windows\System\tGSDpmR.exe
  C:\Windows\System\tGSDpmR.exe
  2⤵
  PID:10964
- C:\Windows\System\eADGzaC.exe
  C:\Windows\System\eADGzaC.exe
  2⤵
  PID:10988
- C:\Windows\System\AyfQaKk.exe
  C:\Windows\System\AyfQaKk.exe
  2⤵
  PID:11024
- C:\Windows\System\HcraTJo.exe
  C:\Windows\System\HcraTJo.exe
  2⤵
  PID:11052
- C:\Windows\System\nbcmPCq.exe
  C:\Windows\System\nbcmPCq.exe
  2⤵
  PID:11076
- C:\Windows\System\LwnprTI.exe
  C:\Windows\System\LwnprTI.exe
  2⤵
  PID:11096
- C:\Windows\System\AbEMJnR.exe
  C:\Windows\System\AbEMJnR.exe
  2⤵
  PID:11124
- C:\Windows\System\AQCqypv.exe
  C:\Windows\System\AQCqypv.exe
  2⤵
  PID:11152
- C:\Windows\System\rtPeXwU.exe
  C:\Windows\System\rtPeXwU.exe
  2⤵
  PID:11172
- C:\Windows\System\zDnZUbI.exe
  C:\Windows\System\zDnZUbI.exe
  2⤵
  PID:11200
- C:\Windows\System\GahUnWQ.exe
  C:\Windows\System\GahUnWQ.exe
  2⤵
  PID:11228
- C:\Windows\System\VytjgUC.exe
  C:\Windows\System\VytjgUC.exe
  2⤵
  PID:11252
- C:\Windows\System\qwLYNjX.exe
  C:\Windows\System\qwLYNjX.exe
  2⤵
  PID:6792
- C:\Windows\System\YqVLiIp.exe
  C:\Windows\System\YqVLiIp.exe
  2⤵
  PID:6960
- C:\Windows\System\udCeYzy.exe
  C:\Windows\System\udCeYzy.exe
  2⤵
  PID:7008
- C:\Windows\System\pyASOFS.exe
  C:\Windows\System\pyASOFS.exe
  2⤵
  PID:1612
- C:\Windows\System\GBJcVDW.exe
  C:\Windows\System\GBJcVDW.exe
  2⤵
  PID:8356
- C:\Windows\System\tWflrAe.exe
  C:\Windows\System\tWflrAe.exe
  2⤵
  PID:8408
- C:\Windows\System\JAZvLzU.exe
  C:\Windows\System\JAZvLzU.exe
  2⤵
  PID:8484
- C:\Windows\System\bSrafmS.exe
  C:\Windows\System\bSrafmS.exe
  2⤵
  PID:8532
- C:\Windows\System\RfHLUeC.exe
  C:\Windows\System\RfHLUeC.exe
  2⤵
  PID:8576
- C:\Windows\System\njSerlB.exe
  C:\Windows\System\njSerlB.exe
  2⤵
  PID:9040
- C:\Windows\System\VjiRaUc.exe
  C:\Windows\System\VjiRaUc.exe
  2⤵
  PID:8020
- C:\Windows\System\CjZbUnM.exe
  C:\Windows\System\CjZbUnM.exe
  2⤵
  PID:6888
- C:\Windows\System\GtXQPGh.exe
  C:\Windows\System\GtXQPGh.exe
  2⤵
  PID:6372
- C:\Windows\System\ZDHfxAl.exe
  C:\Windows\System\ZDHfxAl.exe
  2⤵
  PID:6624
- C:\Windows\System\EbnGbXj.exe
  C:\Windows\System\EbnGbXj.exe
  2⤵
  PID:7376
- C:\Windows\System\pxBXFGH.exe
  C:\Windows\System\pxBXFGH.exe
  2⤵
  PID:7568
- C:\Windows\System\rpRphXY.exe
  C:\Windows\System\rpRphXY.exe
  2⤵
  PID:9128
- C:\Windows\System\qkhoWCL.exe
  C:\Windows\System\qkhoWCL.exe
  2⤵
  PID:8872
- C:\Windows\System\ovOOFsU.exe
  C:\Windows\System\ovOOFsU.exe
  2⤵
  PID:7660
- C:\Windows\System\nhQOidV.exe
  C:\Windows\System\nhQOidV.exe
  2⤵
  PID:6212
- C:\Windows\System\HKKaPmv.exe
  C:\Windows\System\HKKaPmv.exe
  2⤵
  PID:9316
- C:\Windows\System\aKjgzbS.exe
  C:\Windows\System\aKjgzbS.exe
  2⤵
  PID:9392
- C:\Windows\System\vZAYLzE.exe
  C:\Windows\System\vZAYLzE.exe
  2⤵
  PID:9636
- C:\Windows\System\SRdeGRY.exe
  C:\Windows\System\SRdeGRY.exe
  2⤵
  PID:9796
- C:\Windows\System\schaZwY.exe
  C:\Windows\System\schaZwY.exe
  2⤵
  PID:9864
- C:\Windows\System\VzWxYTS.exe
  C:\Windows\System\VzWxYTS.exe
  2⤵
  PID:9976
- C:\Windows\System\aJdusWh.exe
  C:\Windows\System\aJdusWh.exe
  2⤵
  PID:10168
- C:\Windows\System\zUZYHAl.exe
  C:\Windows\System\zUZYHAl.exe
  2⤵
  PID:10264
- C:\Windows\System\BvHdNJR.exe
  C:\Windows\System\BvHdNJR.exe
  2⤵
  PID:10316
- C:\Windows\System\tlmYnCd.exe
  C:\Windows\System\tlmYnCd.exe
  2⤵
  PID:11272
- C:\Windows\System\dgnHFIh.exe
  C:\Windows\System\dgnHFIh.exe
  2⤵
  PID:11292
- C:\Windows\System\ACkGlnb.exe
  C:\Windows\System\ACkGlnb.exe
  2⤵
  PID:11308
- C:\Windows\System\eTMHusv.exe
  C:\Windows\System\eTMHusv.exe
  2⤵
  PID:11332
- C:\Windows\System\dAapUgR.exe
  C:\Windows\System\dAapUgR.exe
  2⤵
  PID:11352
- C:\Windows\System\ZlxXaYv.exe
  C:\Windows\System\ZlxXaYv.exe
  2⤵
  PID:11372
- C:\Windows\System\VGXNERu.exe
  C:\Windows\System\VGXNERu.exe
  2⤵
  PID:11392
- C:\Windows\System\bkgFUuO.exe
  C:\Windows\System\bkgFUuO.exe
  2⤵
  PID:11416
- C:\Windows\System\zNPiDSl.exe
  C:\Windows\System\zNPiDSl.exe
  2⤵
  PID:11440
- C:\Windows\System\KBzwrje.exe
  C:\Windows\System\KBzwrje.exe
  2⤵
  PID:11464
- C:\Windows\System\NwTPGTf.exe
  C:\Windows\System\NwTPGTf.exe
  2⤵
  PID:11488
- C:\Windows\System\ZwZMLws.exe
  C:\Windows\System\ZwZMLws.exe
  2⤵
  PID:11512
- C:\Windows\System\ZuUhtJD.exe
  C:\Windows\System\ZuUhtJD.exe
  2⤵
  PID:11532
- C:\Windows\System\xbjBAri.exe
  C:\Windows\System\xbjBAri.exe
  2⤵
  PID:11552
- C:\Windows\System\DGcqEMp.exe
  C:\Windows\System\DGcqEMp.exe
  2⤵
  PID:11576
- C:\Windows\System\MImQpVB.exe
  C:\Windows\System\MImQpVB.exe
  2⤵
  PID:11600
- C:\Windows\System\GJPTIrt.exe
  C:\Windows\System\GJPTIrt.exe
  2⤵
  PID:11620
- C:\Windows\System\MMRiLJP.exe
  C:\Windows\System\MMRiLJP.exe
  2⤵
  PID:11644
- C:\Windows\System\ynibmQi.exe
  C:\Windows\System\ynibmQi.exe
  2⤵
  PID:11668
- C:\Windows\System\AINOQZX.exe
  C:\Windows\System\AINOQZX.exe
  2⤵
  PID:11692
- C:\Windows\System\ZikqwqF.exe
  C:\Windows\System\ZikqwqF.exe
  2⤵
  PID:11716
- C:\Windows\System\jJGhJxW.exe
  C:\Windows\System\jJGhJxW.exe
  2⤵
  PID:11740
- C:\Windows\System\aoNIFPh.exe
  C:\Windows\System\aoNIFPh.exe
  2⤵
  PID:11756
- C:\Windows\System\QlhnuNm.exe
  C:\Windows\System\QlhnuNm.exe
  2⤵
  PID:11780
- C:\Windows\System\XLNGoUu.exe
  C:\Windows\System\XLNGoUu.exe
  2⤵
  PID:11804
- C:\Windows\System\wUNfcRo.exe
  C:\Windows\System\wUNfcRo.exe
  2⤵
  PID:11828
- C:\Windows\System\eqmmMCS.exe
  C:\Windows\System\eqmmMCS.exe
  2⤵
  PID:11852
- C:\Windows\System\INNhhXn.exe
  C:\Windows\System\INNhhXn.exe
  2⤵
  PID:11872
- C:\Windows\System\leRhQgA.exe
  C:\Windows\System\leRhQgA.exe
  2⤵
  PID:11900
- C:\Windows\System\BwLoiXo.exe
  C:\Windows\System\BwLoiXo.exe
  2⤵
  PID:11924
- C:\Windows\System\RRTHyiY.exe
  C:\Windows\System\RRTHyiY.exe
  2⤵
  PID:11944
- C:\Windows\System\gMHzEyB.exe
  C:\Windows\System\gMHzEyB.exe
  2⤵
  PID:11964
- C:\Windows\System\KIwuDqO.exe
  C:\Windows\System\KIwuDqO.exe
  2⤵
  PID:11984
- C:\Windows\System\KYsjfVb.exe
  C:\Windows\System\KYsjfVb.exe
  2⤵
  PID:12004
- C:\Windows\System\RlHDwSp.exe
  C:\Windows\System\RlHDwSp.exe
  2⤵
  PID:12024
- C:\Windows\System\xSNqxcd.exe
  C:\Windows\System\xSNqxcd.exe
  2⤵
  PID:12052
- C:\Windows\System\sLQoGtu.exe
  C:\Windows\System\sLQoGtu.exe
  2⤵
  PID:12072
- C:\Windows\System\DQwPSvb.exe
  C:\Windows\System\DQwPSvb.exe
  2⤵
  PID:12096
- C:\Windows\System\SJkaLpd.exe
  C:\Windows\System\SJkaLpd.exe
  2⤵
  PID:12116
- C:\Windows\System\topfVKm.exe
  C:\Windows\System\topfVKm.exe
  2⤵
  PID:12140
- C:\Windows\System\sZfgMSj.exe
  C:\Windows\System\sZfgMSj.exe
  2⤵
  PID:12160
- C:\Windows\System\jNlhqKA.exe
  C:\Windows\System\jNlhqKA.exe
  2⤵
  PID:12176
- C:\Windows\System\hThlKeB.exe
  C:\Windows\System\hThlKeB.exe
  2⤵
  PID:12200
- C:\Windows\System\mDIXUlN.exe
  C:\Windows\System\mDIXUlN.exe
  2⤵
  PID:12220
- C:\Windows\System\OvaCIVH.exe
  C:\Windows\System\OvaCIVH.exe
  2⤵
  PID:12240
- C:\Windows\System\pzmwhhO.exe
  C:\Windows\System\pzmwhhO.exe
  2⤵
  PID:12264
- C:\Windows\System\pvxLsMl.exe
  C:\Windows\System\pvxLsMl.exe
  2⤵
  PID:12284
- C:\Windows\System\MgkZEOi.exe
  C:\Windows\System\MgkZEOi.exe
  2⤵
  PID:9172
- C:\Windows\System\nOvtmZx.exe
  C:\Windows\System\nOvtmZx.exe
  2⤵
  PID:9204
- C:\Windows\System\oHKyBpG.exe
  C:\Windows\System\oHKyBpG.exe
  2⤵
  PID:876
- C:\Windows\System\LmtIubY.exe
  C:\Windows\System\LmtIubY.exe
  2⤵
  PID:6020
- C:\Windows\System\TJsOcrp.exe
  C:\Windows\System\TJsOcrp.exe
  2⤵
  PID:7344
- C:\Windows\System\JxzLYbC.exe
  C:\Windows\System\JxzLYbC.exe
  2⤵
  PID:7492
- C:\Windows\System\wBsxRvL.exe
  C:\Windows\System\wBsxRvL.exe
  2⤵
  PID:4740
- C:\Windows\System\cHVDVwT.exe
  C:\Windows\System\cHVDVwT.exe
  2⤵
  PID:8396
- C:\Windows\System\kTMKTno.exe
  C:\Windows\System\kTMKTno.exe
  2⤵
  PID:10796
- C:\Windows\System\dgNCsYX.exe
  C:\Windows\System\dgNCsYX.exe
  2⤵
  PID:10820
- C:\Windows\System\kUoWHsW.exe
  C:\Windows\System\kUoWHsW.exe
  2⤵
  PID:7572
- C:\Windows\System\JWcxxfH.exe
  C:\Windows\System\JWcxxfH.exe
  2⤵
  PID:10972
- C:\Windows\System\XnbRxbw.exe
  C:\Windows\System\XnbRxbw.exe
  2⤵
  PID:6184
- C:\Windows\System\VuepfyC.exe
  C:\Windows\System\VuepfyC.exe
  2⤵
  PID:9268
- C:\Windows\System\BLPmsOg.exe
  C:\Windows\System\BLPmsOg.exe
  2⤵
  PID:9428
- C:\Windows\System\KikNpaU.exe
  C:\Windows\System\KikNpaU.exe
  2⤵
  PID:8912
- C:\Windows\System\jtoQDAM.exe
  C:\Windows\System\jtoQDAM.exe
  2⤵
  PID:6528
- C:\Windows\System\ZHgkQbJ.exe
  C:\Windows\System\ZHgkQbJ.exe
  2⤵
  PID:9560
- C:\Windows\System\oQCLRXB.exe
  C:\Windows\System\oQCLRXB.exe
  2⤵
  PID:9608
- C:\Windows\System\xvNuQZy.exe
  C:\Windows\System\xvNuQZy.exe
  2⤵
  PID:9680
- C:\Windows\System\EPeTWpx.exe
  C:\Windows\System\EPeTWpx.exe
  2⤵
  PID:9768
- C:\Windows\System\JpdJlpX.exe
  C:\Windows\System\JpdJlpX.exe
  2⤵
  PID:9908
- C:\Windows\System\ykEeJta.exe
  C:\Windows\System\ykEeJta.exe
  2⤵
  PID:7196
- C:\Windows\System\oknOlpl.exe
  C:\Windows\System\oknOlpl.exe
  2⤵
  PID:10036
- C:\Windows\System\bAatekq.exe
  C:\Windows\System\bAatekq.exe
  2⤵
  PID:10120
- C:\Windows\System\lfnnInX.exe
  C:\Windows\System\lfnnInX.exe
  2⤵
  PID:10252
- C:\Windows\System\dwMJXTl.exe
  C:\Windows\System\dwMJXTl.exe
  2⤵
  PID:12292
- C:\Windows\System\TUyAmAI.exe
  C:\Windows\System\TUyAmAI.exe
  2⤵
  PID:12312
- C:\Windows\System\XRkQVte.exe
  C:\Windows\System\XRkQVte.exe
  2⤵
  PID:12332
- C:\Windows\System\aTDqxDY.exe
  C:\Windows\System\aTDqxDY.exe
  2⤵
  PID:12352
- C:\Windows\System\glZxTSU.exe
  C:\Windows\System\glZxTSU.exe
  2⤵
  PID:12372
- C:\Windows\System\LSVOWnc.exe
  C:\Windows\System\LSVOWnc.exe
  2⤵
  PID:12400
- C:\Windows\System\CjFYvWk.exe
  C:\Windows\System\CjFYvWk.exe
  2⤵
  PID:12420
- C:\Windows\System\FJYkvGc.exe
  C:\Windows\System\FJYkvGc.exe
  2⤵
  PID:12448
- C:\Windows\System\EPrYefj.exe
  C:\Windows\System\EPrYefj.exe
  2⤵
  PID:12464
- C:\Windows\System\FmVdFAp.exe
  C:\Windows\System\FmVdFAp.exe
  2⤵
  PID:12488
- C:\Windows\System\iHkUAcQ.exe
  C:\Windows\System\iHkUAcQ.exe
  2⤵
  PID:12508
- C:\Windows\System\ZnrXjTK.exe
  C:\Windows\System\ZnrXjTK.exe
  2⤵
  PID:12532
- C:\Windows\System\rjgOWZW.exe
  C:\Windows\System\rjgOWZW.exe
  2⤵
  PID:12556
- C:\Windows\System\uJqLYSn.exe
  C:\Windows\System\uJqLYSn.exe
  2⤵
  PID:12576
- C:\Windows\System\WQmTmBL.exe
  C:\Windows\System\WQmTmBL.exe
  2⤵
  PID:12596
- C:\Windows\System\eAWEMYc.exe
  C:\Windows\System\eAWEMYc.exe
  2⤵
  PID:12620
- C:\Windows\System\CIKVzsx.exe
  C:\Windows\System\CIKVzsx.exe
  2⤵
  PID:12640
- C:\Windows\System\gPGEMMO.exe
  C:\Windows\System\gPGEMMO.exe
  2⤵
  PID:12660
- C:\Windows\System\cylDrcB.exe
  C:\Windows\System\cylDrcB.exe
  2⤵
  PID:12684
- C:\Windows\System\SUYNOWU.exe
  C:\Windows\System\SUYNOWU.exe
  2⤵
  PID:12708
- C:\Windows\System\KvQQRNv.exe
  C:\Windows\System\KvQQRNv.exe
  2⤵
  PID:12732
- C:\Windows\System\NnIHuPp.exe
  C:\Windows\System\NnIHuPp.exe
  2⤵
  PID:12752
- C:\Windows\System\JGtNUeN.exe
  C:\Windows\System\JGtNUeN.exe
  2⤵
  PID:12776
- C:\Windows\System\bvvCqdd.exe
  C:\Windows\System\bvvCqdd.exe
  2⤵
  PID:12800
- C:\Windows\System\ckJRLYT.exe
  C:\Windows\System\ckJRLYT.exe
  2⤵
  PID:12824
- C:\Windows\System\cIqfiXU.exe
  C:\Windows\System\cIqfiXU.exe
  2⤵
  PID:12848
- C:\Windows\System\eyfwesE.exe
  C:\Windows\System\eyfwesE.exe
  2⤵
  PID:12868
- C:\Windows\System\zkxzWXs.exe
  C:\Windows\System\zkxzWXs.exe
  2⤵
  PID:10460
- C:\Windows\System\ruvgwuG.exe
  C:\Windows\System\ruvgwuG.exe
  2⤵
  PID:10524
- C:\Windows\System\JmNDmgs.exe
  C:\Windows\System\JmNDmgs.exe
  2⤵
  PID:8856
- C:\Windows\System\KJfrpwS.exe
  C:\Windows\System\KJfrpwS.exe
  2⤵
  PID:10016
- C:\Windows\System\XLkopVf.exe
  C:\Windows\System\XLkopVf.exe
  2⤵
  PID:9884
- C:\Windows\System\cRbplVn.exe
  C:\Windows\System\cRbplVn.exe
  2⤵
  PID:11072
- C:\Windows\System\wqngHKC.exe
  C:\Windows\System\wqngHKC.exe
  2⤵
  PID:11164
- C:\Windows\System\cBRnfGp.exe
  C:\Windows\System\cBRnfGp.exe
  2⤵
  PID:13292
- C:\Windows\System\WRLDUCH.exe
  C:\Windows\System\WRLDUCH.exe
  2⤵
  PID:12276
- C:\Windows\System\WhIKPwc.exe
  C:\Windows\System\WhIKPwc.exe
  2⤵
  PID:6684
- C:\Windows\System\OMYiFei.exe
  C:\Windows\System\OMYiFei.exe
  2⤵
  PID:12976
- C:\Windows\System\PxlXwdN.exe
  C:\Windows\System\PxlXwdN.exe
  2⤵
  PID:11244
- C:\Windows\System\MHfJxEW.exe
  C:\Windows\System\MHfJxEW.exe
  2⤵
  PID:8552
- C:\Windows\System\cLYuDMt.exe
  C:\Windows\System\cLYuDMt.exe
  2⤵
  PID:3472
- C:\Windows\System\dVtCeIu.exe
  C:\Windows\System\dVtCeIu.exe
  2⤵
  PID:8772
- C:\Windows\System\CDDbLqT.exe
  C:\Windows\System\CDDbLqT.exe
  2⤵
  PID:9704
- C:\Windows\System\DziUgOq.exe
  C:\Windows\System\DziUgOq.exe
  2⤵
  PID:9304
- C:\Windows\System\lFNJVnX.exe
  C:\Windows\System\lFNJVnX.exe
  2⤵
  PID:10876
- C:\Windows\System\kiRVEyf.exe
  C:\Windows\System\kiRVEyf.exe
  2⤵
  PID:11956
- C:\Windows\System\ROiPcNU.exe
  C:\Windows\System\ROiPcNU.exe
  2⤵
  PID:11752
- C:\Windows\System\YzyIdvK.exe
  C:\Windows\System\YzyIdvK.exe
  2⤵
  PID:10456
- C:\Windows\System\dWmXKic.exe
  C:\Windows\System\dWmXKic.exe
  2⤵
  PID:11908
- C:\Windows\System\mfUfeVs.exe
  C:\Windows\System\mfUfeVs.exe
  2⤵
  PID:12248
- C:\Windows\System\zQCQibc.exe
  C:\Windows\System\zQCQibc.exe
  2⤵
  PID:8460
- C:\Windows\System\uxQUpIj.exe
  C:\Windows\System\uxQUpIj.exe
  2⤵
  PID:2284
- C:\Windows\System\sPjJVLd.exe
  C:\Windows\System\sPjJVLd.exe
  2⤵
  PID:11564
- C:\Windows\System\dYgGUXP.exe
  C:\Windows\System\dYgGUXP.exe
  2⤵
  PID:13068
- C:\Windows\System\DdnnDnN.exe
  C:\Windows\System\DdnnDnN.exe
  2⤵
  PID:13276
- C:\Windows\System\kXqhysx.exe
  C:\Windows\System\kXqhysx.exe
  2⤵
  PID:6388
- C:\Windows\System\NNeXLgi.exe
  C:\Windows\System\NNeXLgi.exe
  2⤵
  PID:9896
- C:\Windows\System\NMaIAkB.exe
  C:\Windows\System\NMaIAkB.exe
  2⤵
  PID:11484
- C:\Windows\System\QlNhEyT.exe
  C:\Windows\System\QlNhEyT.exe
  2⤵
  PID:11912
- C:\Windows\System\oKyeilz.exe
  C:\Windows\System\oKyeilz.exe
  2⤵
  PID:12068
- C:\Windows\System\IeaKIWL.exe
  C:\Windows\System\IeaKIWL.exe
  2⤵
  PID:11844
- C:\Windows\System\YrRwxeh.exe
  C:\Windows\System\YrRwxeh.exe
  2⤵
  PID:12280
- C:\Windows\System\DpYNrIf.exe
  C:\Windows\System\DpYNrIf.exe
  2⤵
  PID:7408
- C:\Windows\System\SYCLKbz.exe
  C:\Windows\System\SYCLKbz.exe
  2⤵
  PID:9120
- C:\Windows\System\YSvJWUc.exe
  C:\Windows\System\YSvJWUc.exe
  2⤵
  PID:7512
- C:\Windows\System\UlJDibo.exe
  C:\Windows\System\UlJDibo.exe
  2⤵
  PID:10940
- C:\Windows\System\pqclTiz.exe
  C:\Windows\System\pqclTiz.exe
  2⤵
  PID:9640
- C:\Windows\System\MWnTOfD.exe
  C:\Windows\System\MWnTOfD.exe
  2⤵
  PID:7280
- C:\Windows\System\WREjOob.exe
  C:\Windows\System\WREjOob.exe
  2⤵
  PID:10144
- C:\Windows\System\MZrTjbk.exe
  C:\Windows\System\MZrTjbk.exe
  2⤵
  PID:11044
- C:\Windows\System\ZGTiFZl.exe
  C:\Windows\System\ZGTiFZl.exe
  2⤵
  PID:11448
- C:\Windows\System\ggWQbOx.exe
  C:\Windows\System\ggWQbOx.exe
  2⤵
  PID:11548
- C:\Windows\System\YMzkaTD.exe
  C:\Windows\System\YMzkaTD.exe
  2⤵
  PID:10740
- C:\Windows\System\RsKPqQO.exe
  C:\Windows\System\RsKPqQO.exe
  2⤵
  PID:10416
- C:\Windows\System\ESJnKXG.exe
  C:\Windows\System\ESJnKXG.exe
  2⤵
  PID:9756
- C:\Windows\System\ihmWjcT.exe
  C:\Windows\System\ihmWjcT.exe
  2⤵
  PID:11980
- C:\Windows\System\zVCvwIm.exe
  C:\Windows\System\zVCvwIm.exe
  2⤵
  PID:10212
- C:\Windows\System\lYPpEKg.exe
  C:\Windows\System\lYPpEKg.exe
  2⤵
  PID:13148
- C:\Windows\System\oayviNj.exe
  C:\Windows\System\oayviNj.exe
  2⤵
  PID:11104
- C:\Windows\System\eEBABUM.exe
  C:\Windows\System\eEBABUM.exe
  2⤵
  PID:11820
- C:\Windows\System\bazEQyj.exe
  C:\Windows\System\bazEQyj.exe
  2⤵
  PID:10544
- C:\Windows\System\EhOWFWC.exe
  C:\Windows\System\EhOWFWC.exe
  2⤵
  PID:11708
- C:\Windows\System\fPariRo.exe
  C:\Windows\System\fPariRo.exe
  2⤵
  PID:11048
- C:\Windows\System\fTAvPYQ.exe
  C:\Windows\System\fTAvPYQ.exe
  2⤵
  PID:9472
- C:\Windows\System\HgSwtjP.exe
  C:\Windows\System\HgSwtjP.exe
  2⤵
  PID:9548
- C:\Windows\System\TCVHszf.exe
  C:\Windows\System\TCVHszf.exe
  2⤵
  PID:11776
- C:\Windows\System\hctwPhU.exe
  C:\Windows\System\hctwPhU.exe
  2⤵
  PID:11736
- C:\Windows\System\cJUptKt.exe
  C:\Windows\System\cJUptKt.exe
  2⤵
  PID:5108
- C:\Windows\System\NYkEceW.exe
  C:\Windows\System\NYkEceW.exe
  2⤵
  PID:2940
- C:\Windows\System\YpkYUpr.exe
  C:\Windows\System\YpkYUpr.exe
  2⤵
  PID:11120
- C:\Windows\System\dsMkXDY.exe
  C:\Windows\System\dsMkXDY.exe
  2⤵
  PID:6704
- C:\Windows\System\GsQWrxJ.exe
  C:\Windows\System\GsQWrxJ.exe
  2⤵
  PID:11368
- C:\Windows\System\IbLomcf.exe
  C:\Windows\System\IbLomcf.exe
  2⤵
  PID:11836
- C:\Windows\System\sKfyHQm.exe
  C:\Windows\System\sKfyHQm.exe
  2⤵
  PID:9748
- C:\Windows\System\KyigbPA.exe
  C:\Windows\System\KyigbPA.exe
  2⤵
  PID:8044
- C:\Windows\System\sKFhToI.exe
  C:\Windows\System\sKFhToI.exe
  2⤵
  PID:11068
- C:\Windows\System\WedNJFR.exe
  C:\Windows\System\WedNJFR.exe
  2⤵
  PID:13184
- C:\Windows\System\HyHQaIB.exe
  C:\Windows\System\HyHQaIB.exe
  2⤵
  PID:9352
- C:\Windows\System\bJTXVBI.exe
  C:\Windows\System\bJTXVBI.exe
  2⤵
  PID:10692
- C:\Windows\System\htrRelW.exe
  C:\Windows\System\htrRelW.exe
  2⤵
  PID:12232
- C:\Windows\System\LjYKZEV.exe
  C:\Windows\System\LjYKZEV.exe
  2⤵
  PID:12928
- C:\Windows\System\tRocUJP.exe
  C:\Windows\System\tRocUJP.exe
  2⤵
  PID:4040
- C:\Windows\System\EQFGpxk.exe
  C:\Windows\System\EQFGpxk.exe
  2⤵
  PID:2596
- C:\Windows\System\PZHQyRp.exe
  C:\Windows\System\PZHQyRp.exe
  2⤵
  PID:10704
- C:\Windows\System\ooasPMB.exe
  C:\Windows\System\ooasPMB.exe
  2⤵
  PID:12216
- C:\Windows\System\OTKNlws.exe
  C:\Windows\System\OTKNlws.exe
  2⤵
  PID:12344
- C:\Windows\System\FHYipuc.exe
  C:\Windows\System\FHYipuc.exe
  2⤵
  PID:11892
- C:\Windows\System\AGbyEAS.exe
  C:\Windows\System\AGbyEAS.exe
  2⤵
  PID:11796
- C:\Windows\System\YPbRtsb.exe
  C:\Windows\System\YPbRtsb.exe
  2⤵
  PID:10504
- C:\Windows\System\suuulbk.exe
  C:\Windows\System\suuulbk.exe
  2⤵
  PID:10756
- C:\Windows\System\yXeuZSy.exe
  C:\Windows\System\yXeuZSy.exe
  2⤵
  PID:9660
- C:\Windows\System\BZzEunT.exe
  C:\Windows\System\BZzEunT.exe
  2⤵
  PID:2444
- C:\Windows\System\HTyeWQJ.exe
  C:\Windows\System\HTyeWQJ.exe
  2⤵
  PID:4248
- C:\Windows\System\pHRbxGZ.exe
  C:\Windows\System\pHRbxGZ.exe
  2⤵
  PID:2920
- C:\Windows\System\HSbgPJw.exe
  C:\Windows\System\HSbgPJw.exe
  2⤵
  PID:12388
- C:\Windows\System\ahzJQXt.exe
  C:\Windows\System\ahzJQXt.exe
  2⤵
  PID:3500
- C:\Windows\System\vXhTyFc.exe
  C:\Windows\System\vXhTyFc.exe
  2⤵
  PID:2872
- C:\Windows\System\lLcNlhC.exe
  C:\Windows\System\lLcNlhC.exe
  2⤵
  PID:3956
- C:\Windows\System\pdtbwbB.exe
  C:\Windows\System\pdtbwbB.exe
  2⤵
  PID:3416
- C:\Windows\System\bCqwNcy.exe
  C:\Windows\System\bCqwNcy.exe
  2⤵
  PID:2320
- C:\Windows\System\nKEauSt.exe
  C:\Windows\System\nKEauSt.exe
  2⤵
  PID:3372
- C:\Windows\System\ADdnrcW.exe
  C:\Windows\System\ADdnrcW.exe
  2⤵
  PID:4212
- C:\Windows\System\tpJsuLa.exe
  C:\Windows\System\tpJsuLa.exe
  2⤵
  PID:13452
- C:\Windows\System\pwHCIaa.exe
  C:\Windows\System\pwHCIaa.exe
  2⤵
  PID:13660
- C:\Windows\System\PTYWMqp.exe
  C:\Windows\System\PTYWMqp.exe
  2⤵
  PID:13784
- C:\Windows\System\dnDyXBx.exe
  C:\Windows\System\dnDyXBx.exe
  2⤵
  PID:13812
- C:\Windows\System\yvuXnhk.exe
  C:\Windows\System\yvuXnhk.exe
  2⤵
  PID:13876
- C:\Windows\System\OWruIoE.exe
  C:\Windows\System\OWruIoE.exe
  2⤵
  PID:13900
- C:\Windows\System\SvdaBBu.exe
  C:\Windows\System\SvdaBBu.exe
  2⤵
  PID:13988
- C:\Windows\System\pZeSCno.exe
  C:\Windows\System\pZeSCno.exe
  2⤵
  PID:14112
- C:\Windows\System\SejcXoM.exe
  C:\Windows\System\SejcXoM.exe
  2⤵
  PID:14208
- C:\Windows\System\OhUXpQy.exe
  C:\Windows\System\OhUXpQy.exe
  2⤵
  PID:14232
- C:\Windows\System\bHfdPNi.exe
  C:\Windows\System\bHfdPNi.exe
  2⤵
  PID:14300
- C:\Windows\System\yNaaguk.exe
  C:\Windows\System\yNaaguk.exe
  2⤵
  PID:9904
- C:\Windows\System\MngxcOm.exe
  C:\Windows\System\MngxcOm.exe
  2⤵
  PID:3124
- C:\Windows\System\cXIfhrU.exe
  C:\Windows\System\cXIfhrU.exe
  2⤵
  PID:2624
- C:\Windows\System\dVjLShW.exe
  C:\Windows\System\dVjLShW.exe
  2⤵
  PID:13348
- C:\Windows\System\POWBbKx.exe
  C:\Windows\System\POWBbKx.exe
  2⤵
  PID:2188
- C:\Windows\System\FThYeKz.exe
  C:\Windows\System\FThYeKz.exe
  2⤵
  PID:4260
- C:\Windows\System\oWnwXwN.exe
  C:\Windows\System\oWnwXwN.exe
  2⤵
  PID:13364
- C:\Windows\System\qLBCftS.exe
  C:\Windows\System\qLBCftS.exe
  2⤵
  PID:13400
- C:\Windows\System\ZaxFKgQ.exe
  C:\Windows\System\ZaxFKgQ.exe
  2⤵
  PID:13428
- C:\Windows\System\CEcZtOR.exe
  C:\Windows\System\CEcZtOR.exe
  2⤵
  PID:13500
- C:\Windows\System\QMmJYCa.exe
  C:\Windows\System\QMmJYCa.exe
  2⤵
  PID:13576
- C:\Windows\System\DSzItUt.exe
  C:\Windows\System\DSzItUt.exe
  2⤵
  PID:13524
- C:\Windows\System\VJnqmyu.exe
  C:\Windows\System\VJnqmyu.exe
  2⤵
  PID:13552
- C:\Windows\System\BrYSwMZ.exe
  C:\Windows\System\BrYSwMZ.exe
  2⤵
  PID:2016
- C:\Windows\System\DeSELgw.exe
  C:\Windows\System\DeSELgw.exe
  2⤵
  PID:13616
- C:\Windows\System\YiEAFVV.exe
  C:\Windows\System\YiEAFVV.exe
  2⤵
  PID:13952
- C:\Windows\System\EmvTVfi.exe
  C:\Windows\System\EmvTVfi.exe
  2⤵
  PID:1852
- C:\Windows\System\KseNoCm.exe
  C:\Windows\System\KseNoCm.exe
  2⤵
  PID:14272
- C:\Windows\System\yFxENsa.exe
  C:\Windows\System\yFxENsa.exe
  2⤵
  PID:13604
- C:\Windows\System\BgDyuyG.exe
  C:\Windows\System\BgDyuyG.exe
  2⤵
  PID:13648
- C:\Windows\System\aNRgahF.exe
  C:\Windows\System\aNRgahF.exe
  2⤵
  PID:13852
- C:\Windows\System\MgLidYN.exe
  C:\Windows\System\MgLidYN.exe
  2⤵
  PID:13856
- C:\Windows\System\HRUyJJV.exe
  C:\Windows\System\HRUyJJV.exe
  2⤵
  PID:3784
- C:\Windows\System\HMNxnvr.exe
  C:\Windows\System\HMNxnvr.exe
  2⤵
  PID:13932
- C:\Windows\System\sTORzxL.exe
  C:\Windows\System\sTORzxL.exe
  2⤵
  PID:14128
- C:\Windows\System\JYrtMGk.exe
  C:\Windows\System\JYrtMGk.exe
  2⤵
  PID:14152
- C:\Windows\System\Ysnjfhr.exe
  C:\Windows\System\Ysnjfhr.exe
  2⤵
  PID:13808
- C:\Windows\System\MElqsVT.exe
  C:\Windows\System\MElqsVT.exe
  2⤵
  PID:4284
- C:\Windows\System\MZsallg.exe
  C:\Windows\System\MZsallg.exe
  2⤵
  PID:14284
- C:\Windows\System\fEynafe.exe
  C:\Windows\System\fEynafe.exe
  2⤵
  PID:13328
- C:\Windows\System\hZiWJhW.exe
  C:\Windows\System\hZiWJhW.exe
  2⤵
  PID:13476
- C:\Windows\System\FgCBtqN.exe
  C:\Windows\System\FgCBtqN.exe
  2⤵
  PID:13496
- C:\Windows\System\itlMWuh.exe
  C:\Windows\System\itlMWuh.exe
  2⤵
  PID:13684
- C:\Windows\System\kRPQgUu.exe
  C:\Windows\System\kRPQgUu.exe
  2⤵
  PID:13768
- C:\Windows\System\UPhzuXj.exe
  C:\Windows\System\UPhzuXj.exe
  2⤵
  PID:13724
- C:\Windows\System\nmnkOIG.exe
  C:\Windows\System\nmnkOIG.exe
  2⤵
  PID:1160
- C:\Windows\System\UpMDiBD.exe
  C:\Windows\System\UpMDiBD.exe
  2⤵
  PID:13736
- C:\Windows\System\oStWNiR.exe
  C:\Windows\System\oStWNiR.exe
  2⤵
  PID:13860
- C:\Windows\System\kpFKomr.exe
  C:\Windows\System\kpFKomr.exe
  2⤵
  PID:13884
- C:\Windows\System\jwncvBe.exe
  C:\Windows\System\jwncvBe.exe
  2⤵
  PID:13960
- C:\Windows\System\QJkGMtl.exe
  C:\Windows\System\QJkGMtl.exe
  2⤵
  PID:4660
- C:\Windows\System\KDaGhaD.exe
  C:\Windows\System\KDaGhaD.exe
  2⤵
  PID:13436
- C:\Windows\System\iqHSSDG.exe
  C:\Windows\System\iqHSSDG.exe
  2⤵
  PID:13620
- C:\Windows\System\PvJHRTe.exe
  C:\Windows\System\PvJHRTe.exe
  2⤵
  PID:1096
- C:\Windows\System\PGXaLXo.exe
  C:\Windows\System\PGXaLXo.exe
  2⤵
  PID:4764
- C:\Windows\System\MMATorM.exe
  C:\Windows\System\MMATorM.exe
  2⤵
  PID:1760
- C:\Windows\System\QWhpfaO.exe
  C:\Windows\System\QWhpfaO.exe
  2⤵
  PID:1588
- C:\Windows\System\nneypRR.exe
  C:\Windows\System\nneypRR.exe
  2⤵
  PID:4824
- C:\Windows\System\DPNtfLM.exe
  C:\Windows\System\DPNtfLM.exe
  2⤵
  PID:5132
- C:\Windows\System\iKesoOt.exe
  C:\Windows\System\iKesoOt.exe
  2⤵
  PID:13700
- C:\Windows\System\QjayVvM.exe
  C:\Windows\System\QjayVvM.exe
  2⤵
  PID:13752
- C:\Windows\System\yRCLSaX.exe
  C:\Windows\System\yRCLSaX.exe
  2⤵
  PID:13764
- C:\Windows\System\rOClAax.exe
  C:\Windows\System\rOClAax.exe
  2⤵
  PID:12816
- C:\Windows\System\ckwavTj.exe
  C:\Windows\System\ckwavTj.exe
  2⤵
  PID:2092
- C:\Windows\System\MYItStM.exe
  C:\Windows\System\MYItStM.exe
  2⤵
  PID:5852
- C:\Windows\System\kxwxUiG.exe
  C:\Windows\System\kxwxUiG.exe
  2⤵
  PID:13628
- C:\Windows\System\hNKMLQE.exe
  C:\Windows\System\hNKMLQE.exe
  2⤵
  PID:14076
- C:\Windows\System\crikTYF.exe
  C:\Windows\System\crikTYF.exe
  2⤵
  PID:14148
- C:\Windows\System\OYqmZsb.exe
  C:\Windows\System\OYqmZsb.exe
  2⤵
  PID:3052
- C:\Windows\System\aYgOVzP.exe
  C:\Windows\System\aYgOVzP.exe
  2⤵
  PID:6060
- C:\Windows\System\WjeOPga.exe
  C:\Windows\System\WjeOPga.exe
  2⤵
  PID:4068
- C:\Windows\System\hdjvaWE.exe
  C:\Windows\System\hdjvaWE.exe
  2⤵
  PID:14248
- C:\Windows\System\qVAGEHv.exe
  C:\Windows\System\qVAGEHv.exe
  2⤵
  PID:5468
- C:\Windows\System\jxxqmNt.exe
  C:\Windows\System\jxxqmNt.exe
  2⤵
  PID:14328
- C:\Windows\System\kWGjqeu.exe
  C:\Windows\System\kWGjqeu.exe
  2⤵
  PID:2832
- C:\Windows\System\guBoAdB.exe
  C:\Windows\System\guBoAdB.exe
  2⤵
  PID:1892
- C:\Windows\System\CeGFKxv.exe
  C:\Windows\System\CeGFKxv.exe
  2⤵
  PID:5508
- C:\Windows\System\qyslLxa.exe
  C:\Windows\System\qyslLxa.exe
  2⤵
  PID:2264
- C:\Windows\System\DzwVohw.exe
  C:\Windows\System\DzwVohw.exe
  2⤵
  PID:4036
- C:\Windows\System\mIHICDK.exe
  C:\Windows\System\mIHICDK.exe
  2⤵
  PID:5244
- C:\Windows\System\ohZSWWh.exe
  C:\Windows\System\ohZSWWh.exe
  2⤵
  PID:3244
- C:\Windows\System\lGuofBV.exe
  C:\Windows\System\lGuofBV.exe
  2⤵
  PID:7448
- C:\Windows\System\sDzOOAR.exe
  C:\Windows\System\sDzOOAR.exe
  2⤵
  PID:7876
- C:\Windows\System\reulslA.exe
  C:\Windows\System\reulslA.exe
  2⤵
  PID:5332
- C:\Windows\System\qMBnkke.exe
  C:\Windows\System\qMBnkke.exe
  2⤵
  PID:2616
- C:\Windows\System\NollzYz.exe
  C:\Windows\System\NollzYz.exe
  2⤵
  PID:7956
- C:\Windows\System\RPCIrVb.exe
  C:\Windows\System\RPCIrVb.exe
  2⤵
  PID:8076
- C:\Windows\System\UgdzMlZ.exe
  C:\Windows\System\UgdzMlZ.exe
  2⤵
  PID:6908
- C:\Windows\System\rKrLeXE.exe
  C:\Windows\System\rKrLeXE.exe
  2⤵
  PID:6100
- C:\Windows\System\uUfeujC.exe
  C:\Windows\System\uUfeujC.exe
  2⤵
  PID:5260
- C:\Windows\System\bsFGSvI.exe
  C:\Windows\System\bsFGSvI.exe
  2⤵
  PID:7380
- C:\Windows\System\zGBaqZs.exe
  C:\Windows\System\zGBaqZs.exe
  2⤵
  PID:6056
- C:\Windows\System\LHgvEmV.exe
  C:\Windows\System\LHgvEmV.exe
  2⤵
  PID:12808
- C:\Windows\System\mXXlTCy.exe
  C:\Windows\System\mXXlTCy.exe
  2⤵
  PID:5688
- C:\Windows\System\MTKxiNQ.exe
  C:\Windows\System\MTKxiNQ.exe
  2⤵
  PID:3508
- C:\Windows\System\uRtZlgK.exe
  C:\Windows\System\uRtZlgK.exe
  2⤵
  PID:8604
- C:\Windows\System\QMySptI.exe
  C:\Windows\System\QMySptI.exe
  2⤵
  PID:8088
- C:\Windows\System\dBKgJoP.exe
  C:\Windows\System\dBKgJoP.exe
  2⤵
  PID:5928
- C:\Windows\System\HSUsEWu.exe
  C:\Windows\System\HSUsEWu.exe
  2⤵
  PID:6208
- C:\Windows\System\BrboFUS.exe
  C:\Windows\System\BrboFUS.exe
  2⤵
  PID:3732
- C:\Windows\System\fYYllzL.exe
  C:\Windows\System\fYYllzL.exe
  2⤵
  PID:14096
- C:\Windows\System\JFoLeoa.exe
  C:\Windows\System\JFoLeoa.exe
  2⤵
  PID:14084
- C:\Windows\System\VDjHlaa.exe
  C:\Windows\System\VDjHlaa.exe
  2⤵
  PID:8960
- C:\Windows\System\sdNIGnx.exe
  C:\Windows\System\sdNIGnx.exe
  2⤵
  PID:8376
- C:\Windows\System\joqACQk.exe
  C:\Windows\System\joqACQk.exe
  2⤵
  PID:4856
- C:\Windows\System\LUrFMOm.exe
  C:\Windows\System\LUrFMOm.exe
  2⤵
  PID:228
- C:\Windows\System\XdUndfZ.exe
  C:\Windows\System\XdUndfZ.exe
  2⤵
  PID:8660
- C:\Windows\System\ZhSVoMx.exe
  C:\Windows\System\ZhSVoMx.exe
  2⤵
  PID:5164
- C:\Windows\System\smNaSkE.exe
  C:\Windows\System\smNaSkE.exe
  2⤵
  PID:8900
- C:\Windows\System\jiIGenr.exe
  C:\Windows\System\jiIGenr.exe
  2⤵
  PID:8260
- C:\Windows\System\ABwEXwO.exe
  C:\Windows\System\ABwEXwO.exe
  2⤵
  PID:9024
- C:\Windows\System\CaMpzoM.exe
  C:\Windows\System\CaMpzoM.exe
  2⤵
  PID:9104
- C:\Windows\System\fMFHnpw.exe
  C:\Windows\System\fMFHnpw.exe
  2⤵
  PID:9140
- C:\Windows\System\AJmdKdv.exe
  C:\Windows\System\AJmdKdv.exe
  2⤵
  PID:5360
- C:\Windows\System\QgmrDBn.exe
  C:\Windows\System\QgmrDBn.exe
  2⤵
  PID:10628
- C:\Windows\System\acBmNLC.exe
  C:\Windows\System\acBmNLC.exe
  2⤵
  PID:6640
- C:\Windows\System\DBXjBFZ.exe
  C:\Windows\System\DBXjBFZ.exe
  2⤵
  PID:6928
- C:\Windows\System\UhgSJIY.exe
  C:\Windows\System\UhgSJIY.exe
  2⤵
  PID:7692
- C:\Windows\System\KbNZFUg.exe
  C:\Windows\System\KbNZFUg.exe
  2⤵
  PID:1460
- C:\Windows\System\PlRXpvf.exe
  C:\Windows\System\PlRXpvf.exe
  2⤵
  PID:9092
- C:\Windows\System\arZYaGP.exe
  C:\Windows\System\arZYaGP.exe
  2⤵
  PID:13492
- C:\Windows\System\tcpCkOd.exe
  C:\Windows\System\tcpCkOd.exe
  2⤵
  PID:2960
- C:\Windows\System\xVcexrc.exe
  C:\Windows\System\xVcexrc.exe
  2⤵
  PID:13424
- C:\Windows\System\jRZPiNq.exe
  C:\Windows\System\jRZPiNq.exe
  2⤵
  PID:6812
- C:\Windows\System\gaeYcBk.exe
  C:\Windows\System\gaeYcBk.exe
  2⤵
  PID:13520
- C:\Windows\System\aAYcPBY.exe
  C:\Windows\System\aAYcPBY.exe
  2⤵
  PID:9620
- C:\Windows\System\CybhEJC.exe
  C:\Windows\System\CybhEJC.exe
  2⤵
  PID:5892
- C:\Windows\System\IkGZWLT.exe
  C:\Windows\System\IkGZWLT.exe
  2⤵
  PID:9540
- C:\Windows\System\xfeLZMz.exe
  C:\Windows\System\xfeLZMz.exe
  2⤵
  PID:9700
- C:\Windows\System\pZbpela.exe
  C:\Windows\System\pZbpela.exe
  2⤵
  PID:2852
- C:\Windows\System\jjVcqpa.exe
  C:\Windows\System\jjVcqpa.exe
  2⤵
  PID:1728
- C:\Windows\System\gMpHCuP.exe
  C:\Windows\System\gMpHCuP.exe
  2⤵
  PID:13540
- C:\Windows\System\iaNYNtY.exe
  C:\Windows\System\iaNYNtY.exe
  2⤵
  PID:7908
- C:\Windows\System\QvkccEc.exe
  C:\Windows\System\QvkccEc.exe
  2⤵
  PID:7776
- C:\Windows\System\qFGlwmW.exe
  C:\Windows\System\qFGlwmW.exe
  2⤵
  PID:5448
- C:\Windows\System\AckXtEZ.exe
  C:\Windows\System\AckXtEZ.exe
  2⤵
  PID:9876
- C:\Windows\System\WJKAnPg.exe
  C:\Windows\System\WJKAnPg.exe
  2⤵
  PID:13688
- C:\Windows\System\VpsoWJo.exe
  C:\Windows\System\VpsoWJo.exe
  2⤵
  PID:13772
- C:\Windows\System\wxsAVjW.exe
  C:\Windows\System\wxsAVjW.exe
  2⤵
  PID:5160
- C:\Windows\System\BSBfxte.exe
  C:\Windows\System\BSBfxte.exe
  2⤵
  PID:5672
- C:\Windows\System\cLFQmtL.exe
  C:\Windows\System\cLFQmtL.exe
  2⤵
  PID:8616
- C:\Windows\System\ayWrqrN.exe
  C:\Windows\System\ayWrqrN.exe
  2⤵
  PID:5896
- C:\Windows\System\AxbOcHa.exe
  C:\Windows\System\AxbOcHa.exe
  2⤵
  PID:5800
- C:\Windows\System\PPesEuq.exe
  C:\Windows\System\PPesEuq.exe
  2⤵
  PID:13936
- C:\Windows\System\FzRFJFD.exe
  C:\Windows\System\FzRFJFD.exe
  2⤵
  PID:6532
- C:\Windows\System\XonqFrJ.exe
  C:\Windows\System\XonqFrJ.exe
  2⤵
  PID:5952
- C:\Windows\System\xaOXPqZ.exe
  C:\Windows\System\xaOXPqZ.exe
  2⤵
  PID:6016
- C:\Windows\System\dWblLlm.exe
  C:\Windows\System\dWblLlm.exe
  2⤵
  PID:11500
- C:\Windows\System\rfResKv.exe
  C:\Windows\System\rfResKv.exe
  2⤵
  PID:8920
- C:\Windows\System\lMwanVZ.exe
  C:\Windows\System\lMwanVZ.exe
  2⤵
  PID:13084
- C:\Windows\System\QvFiiiU.exe
  C:\Windows\System\QvFiiiU.exe
  2⤵
  PID:12124
- C:\Windows\System\ESnSbPn.exe
  C:\Windows\System\ESnSbPn.exe
  2⤵
  PID:8464
- C:\Windows\System\iTpRINf.exe
  C:\Windows\System\iTpRINf.exe
  2⤵
  PID:8996
- C:\Windows\System\dBnlGBM.exe
  C:\Windows\System\dBnlGBM.exe
  2⤵
  PID:2964
- C:\Windows\System\MJwgonk.exe
  C:\Windows\System\MJwgonk.exe
  2⤵
  PID:9288
- C:\Windows\System\fNMUBlL.exe
  C:\Windows\System\fNMUBlL.exe
  2⤵
  PID:13164
- C:\Windows\System\poXWOrE.exe
  C:\Windows\System\poXWOrE.exe
  2⤵
  PID:10160
- C:\Windows\System\MfnFSvd.exe
  C:\Windows\System\MfnFSvd.exe
  2⤵
  PID:7148
- C:\Windows\System\qdZOhzV.exe
  C:\Windows\System\qdZOhzV.exe
  2⤵
  PID:12472
- C:\Windows\System\WEjNdwf.exe
  C:\Windows\System\WEjNdwf.exe
  2⤵
  PID:12544
- C:\Windows\System\MGlhVID.exe
  C:\Windows\System\MGlhVID.exe
  2⤵
  PID:7668
- C:\Windows\System\rnTZeSy.exe
  C:\Windows\System\rnTZeSy.exe
  2⤵
  PID:3800
- C:\Windows\System\uMFwdJb.exe
  C:\Windows\System\uMFwdJb.exe
  2⤵
  PID:12820
- C:\Windows\System\HuNLaVT.exe
  C:\Windows\System\HuNLaVT.exe
  2⤵
  PID:12900
- C:\Windows\System\PmECyhK.exe
  C:\Windows\System\PmECyhK.exe
  2⤵
  PID:1736
- C:\Windows\System\ennuZBY.exe
  C:\Windows\System\ennuZBY.exe
  2⤵
  PID:8288
- C:\Windows\System\tZjpoAr.exe
  C:\Windows\System\tZjpoAr.exe
  2⤵
  PID:8024
- C:\Windows\System\gFngnjB.exe
  C:\Windows\System\gFngnjB.exe
  2⤵
  PID:5080
- C:\Windows\System\UgqFcVn.exe
  C:\Windows\System\UgqFcVn.exe
  2⤵
  PID:9072
- C:\Windows\System\VcmFtfK.exe
  C:\Windows\System\VcmFtfK.exe
  2⤵
  PID:9084
- C:\Windows\System\KmdNspS.exe
  C:\Windows\System\KmdNspS.exe
  2⤵
  PID:9096
- C:\Windows\System\zNyenVc.exe
  C:\Windows\System\zNyenVc.exe
  2⤵
  PID:9820
- C:\Windows\System\YhiZBLj.exe
  C:\Windows\System\YhiZBLj.exe
  2⤵
  PID:13280
- C:\Windows\System\UjEnjbV.exe
  C:\Windows\System\UjEnjbV.exe
  2⤵
  PID:5284
- C:\Windows\System\EoqWCZg.exe
  C:\Windows\System\EoqWCZg.exe
  2⤵
  PID:6840
- C:\Windows\System\VbTqhLo.exe
  C:\Windows\System\VbTqhLo.exe
  2⤵
  PID:11008
- C:\Windows\System\zohYNHr.exe
  C:\Windows\System\zohYNHr.exe
  2⤵
  PID:9728
- C:\Windows\System\wZGLMOH.exe
  C:\Windows\System\wZGLMOH.exe
  2⤵
  PID:11148
- C:\Windows\System\PYyEOmn.exe
  C:\Windows\System\PYyEOmn.exe
  2⤵
  PID:12916
- C:\Windows\System\CqpSryw.exe
  C:\Windows\System\CqpSryw.exe
  2⤵
  PID:7256
- C:\Windows\System\QgjcGYj.exe
  C:\Windows\System\QgjcGYj.exe
  2⤵
  PID:9348
- C:\Windows\System\wAmdZeb.exe
  C:\Windows\System\wAmdZeb.exe
  2⤵
  PID:7900
- C:\Windows\System\qXdpieT.exe
  C:\Windows\System\qXdpieT.exe
  2⤵
  PID:11216
- C:\Windows\System\MLsxJzA.exe
  C:\Windows\System\MLsxJzA.exe
  2⤵
  PID:9244
- C:\Windows\System\eAQtqZQ.exe
  C:\Windows\System\eAQtqZQ.exe
  2⤵
  PID:13556
- C:\Windows\System\khFHNwd.exe
  C:\Windows\System\khFHNwd.exe
  2⤵
  PID:9788
- C:\Windows\System\kMKqDfI.exe
  C:\Windows\System\kMKqDfI.exe
  2⤵
  PID:8516
- C:\Windows\System\QIAzOSX.exe
  C:\Windows\System\QIAzOSX.exe
  2⤵
  PID:12552
- C:\Windows\System\UhjqhAW.exe
  C:\Windows\System\UhjqhAW.exe
  2⤵
  PID:12392
- C:\Windows\System\BJaowoe.exe
  C:\Windows\System\BJaowoe.exe
  2⤵
  PID:6688
- C:\Windows\System\ipdaBPP.exe
  C:\Windows\System\ipdaBPP.exe
  2⤵
  PID:10140
- C:\Windows\System\POHWtmx.exe
  C:\Windows\System\POHWtmx.exe
  2⤵
  PID:12300
- C:\Windows\System\cERHxDj.exe
  C:\Windows\System\cERHxDj.exe
  2⤵
  PID:10228
- C:\Windows\System\lJveinR.exe
  C:\Windows\System\lJveinR.exe
  2⤵
  PID:12864
- C:\Windows\System\zmUPpBW.exe
  C:\Windows\System\zmUPpBW.exe
  2⤵
  PID:12856
- C:\Windows\System\YxSPeeg.exe
  C:\Windows\System\YxSPeeg.exe
  2⤵
  PID:13108
- C:\Windows\System\PQFMcIE.exe
  C:\Windows\System\PQFMcIE.exe
  2⤵
  PID:10000
- C:\Windows\System\QlzYjcH.exe
  C:\Windows\System\QlzYjcH.exe
  2⤵
  PID:316
- C:\Windows\System\KaGSEpF.exe
  C:\Windows\System\KaGSEpF.exe
  2⤵
  PID:13256
- C:\Windows\System\QUvCzxI.exe
  C:\Windows\System\QUvCzxI.exe
  2⤵
  PID:13052
- C:\Windows\System\bSigzjB.exe
  C:\Windows\System\bSigzjB.exe
  2⤵
  PID:10056
- C:\Windows\System\zVjzRHl.exe
  C:\Windows\System\zVjzRHl.exe
  2⤵
  PID:11036
- C:\Windows\System\DcSzsoQ.exe
  C:\Windows\System\DcSzsoQ.exe
  2⤵
  PID:13780
- C:\Windows\System\zGxfpEe.exe
  C:\Windows\System\zGxfpEe.exe
  2⤵
  PID:11764
- C:\Windows\System\qblvveD.exe
  C:\Windows\System\qblvveD.exe
  2⤵
  PID:11680
- C:\Windows\System\FgorJYS.exe
  C:\Windows\System\FgorJYS.exe
  2⤵
  PID:13692
- C:\Windows\System\mODQKvf.exe
  C:\Windows\System\mODQKvf.exe
  2⤵
  PID:12604
- C:\Windows\System\WXlreQC.exe
  C:\Windows\System\WXlreQC.exe
  2⤵
  PID:12716
- C:\Windows\System\tisfsGW.exe
  C:\Windows\System\tisfsGW.exe
  2⤵
  PID:10484
- C:\Windows\System\GCaAirJ.exe
  C:\Windows\System\GCaAirJ.exe
  2⤵
  PID:13032
- C:\Windows\System\wzMrlgj.exe
  C:\Windows\System\wzMrlgj.exe
  2⤵
  PID:10932
- C:\Windows\System\XgGCIvc.exe
  C:\Windows\System\XgGCIvc.exe
  2⤵
  PID:12768
- C:\Windows\System\lFCBWvT.exe
  C:\Windows\System\lFCBWvT.exe
  2⤵
  PID:10300
- C:\Windows\System\ciGereF.exe
  C:\Windows\System\ciGereF.exe
  2⤵
  PID:10960
- C:\Windows\System\PfxcQZE.exe
  C:\Windows\System\PfxcQZE.exe
  2⤵
  PID:10736
- C:\Windows\System\SpAEBEy.exe
  C:\Windows\System\SpAEBEy.exe
  2⤵
  PID:12548
- C:\Windows\System\wGZydzn.exe
  C:\Windows\System\wGZydzn.exe
  2⤵
  PID:10948
- C:\Windows\System\sGoQQsN.exe
  C:\Windows\System\sGoQQsN.exe
  2⤵
  PID:12000
- C:\Windows\System\zzeFqPt.exe
  C:\Windows\System\zzeFqPt.exe
  2⤵
  PID:6948
- C:\Windows\System\ULkeCLN.exe
  C:\Windows\System\ULkeCLN.exe
  2⤵
  PID:7588
- C:\Windows\System\jUfAqVy.exe
  C:\Windows\System\jUfAqVy.exe
  2⤵
  PID:11236
- C:\Windows\System\EYXcEgi.exe
  C:\Windows\System\EYXcEgi.exe
  2⤵
  PID:12136
- C:\Windows\System\fymHmTN.exe
  C:\Windows\System\fymHmTN.exe
  2⤵
  PID:7772
- C:\Windows\System\TlzAIHZ.exe
  C:\Windows\System\TlzAIHZ.exe
  2⤵
  PID:8296
- C:\Windows\System\CBaHtub.exe
  C:\Windows\System\CBaHtub.exe
  2⤵
  PID:9524
- C:\Windows\System\yVOWRHF.exe
  C:\Windows\System\yVOWRHF.exe
  2⤵
  PID:8712
- C:\Windows\System\actmTzK.exe
  C:\Windows\System\actmTzK.exe
  2⤵
  PID:13948
- C:\Windows\System\uBcjuLQ.exe
  C:\Windows\System\uBcjuLQ.exe
  2⤵
  PID:12208
- C:\Windows\System\UcMXWZg.exe
  C:\Windows\System\UcMXWZg.exe
  2⤵
  PID:6320
- C:\Windows\System\ZESzcNc.exe
  C:\Windows\System\ZESzcNc.exe
  2⤵
  PID:11888
- C:\Windows\System\FaMrlwb.exe
  C:\Windows\System\FaMrlwb.exe
  2⤵
  PID:6400
- C:\Windows\System\tpoWbnW.exe
  C:\Windows\System\tpoWbnW.exe
  2⤵
  PID:8944
- C:\Windows\System\DiMhxrb.exe
  C:\Windows\System\DiMhxrb.exe
  2⤵
  PID:4400
- C:\Windows\System\HsKPViN.exe
  C:\Windows\System\HsKPViN.exe
  2⤵
  PID:11860
- C:\Windows\System\nwOJLBE.exe
  C:\Windows\System\nwOJLBE.exe
  2⤵
  PID:11768
- C:\Windows\System\JFjwsJV.exe
  C:\Windows\System\JFjwsJV.exe
  2⤵
  PID:7620
- C:\Windows\System\YnYpRLW.exe
  C:\Windows\System\YnYpRLW.exe
  2⤵
  PID:636
- C:\Windows\System\kSHLcxY.exe
  C:\Windows\System\kSHLcxY.exe
  2⤵
  PID:8848
- C:\Windows\System\roIVYYs.exe
  C:\Windows\System\roIVYYs.exe
  2⤵
  PID:9584
- C:\Windows\System\UqUTEBp.exe
  C:\Windows\System\UqUTEBp.exe
  2⤵
  PID:8984
- C:\Windows\System\imLvwQX.exe
  C:\Windows\System\imLvwQX.exe
  2⤵
  PID:12252
- C:\Windows\System\NsTGHpH.exe
  C:\Windows\System\NsTGHpH.exe
  2⤵
  PID:6604
- C:\Windows\System\XhebGOf.exe
  C:\Windows\System\XhebGOf.exe
  2⤵
  PID:4084
- C:\Windows\System\XWvjfHe.exe
  C:\Windows\System\XWvjfHe.exe
  2⤵
  PID:6048
- C:\Windows\System\ZGFiVFl.exe
  C:\Windows\System\ZGFiVFl.exe
  2⤵
  PID:2396
- C:\Windows\System\akoaefU.exe
  C:\Windows\System\akoaefU.exe
  2⤵
  PID:9032
- C:\Windows\System\BjRWAVN.exe
  C:\Windows\System\BjRWAVN.exe
  2⤵
  PID:10816
- C:\Windows\System\XzTOSnd.exe
  C:\Windows\System\XzTOSnd.exe
  2⤵
  PID:13232
- C:\Windows\System\QMeGqRu.exe
  C:\Windows\System\QMeGqRu.exe
  2⤵
  PID:4288
- C:\Windows\System\bWDAgZA.exe
  C:\Windows\System\bWDAgZA.exe
  2⤵
  PID:8436
- C:\Windows\System\OlgQFTB.exe
  C:\Windows\System\OlgQFTB.exe
  2⤵
  PID:12876
- C:\Windows\System\BHUEUNe.exe
  C:\Windows\System\BHUEUNe.exe
  2⤵
  PID:8000
- C:\Windows\System\ErOVotU.exe
  C:\Windows\System\ErOVotU.exe
  2⤵
  PID:9960
- C:\Windows\System\bHLaAnt.exe
  C:\Windows\System\bHLaAnt.exe
  2⤵
  PID:5580
- C:\Windows\System\KkgEVuz.exe
  C:\Windows\System\KkgEVuz.exe
  2⤵
  PID:10112
- C:\Windows\System\LKwupdL.exe
  C:\Windows\System\LKwupdL.exe
  2⤵
  PID:7012
- C:\Windows\System\VCCqBGc.exe
  C:\Windows\System\VCCqBGc.exe
  2⤵
  PID:6432
- C:\Windows\System\eMcoAWH.exe
  C:\Windows\System\eMcoAWH.exe
  2⤵
  PID:9116
- C:\Windows\System\VfBJBxD.exe
  C:\Windows\System\VfBJBxD.exe
  2⤵
  PID:7136
- C:\Windows\System\gxEblPo.exe
  C:\Windows\System\gxEblPo.exe
  2⤵
  PID:7392
- C:\Windows\System\npdocsj.exe
  C:\Windows\System\npdocsj.exe
  2⤵
  PID:11436
- C:\Windows\System\qoFriYz.exe
  C:\Windows\System\qoFriYz.exe
  2⤵
  PID:11240
- C:\Windows\System\TPAiemK.exe
  C:\Windows\System\TPAiemK.exe
  2⤵
  PID:8708
- C:\Windows\System\vRyDOvP.exe
  C:\Windows\System\vRyDOvP.exe
  2⤵
  PID:1896
- C:\Windows\System\XluXrOc.exe
  C:\Windows\System\XluXrOc.exe
  2⤵
  PID:13384
- C:\Windows\System\BlYTlTW.exe
  C:\Windows\System\BlYTlTW.exe
  2⤵
  PID:11480
- C:\Windows\System\nqipQtH.exe
  C:\Windows\System\nqipQtH.exe
  2⤵
  PID:10032
- C:\Windows\System\xxTTbsS.exe
  C:\Windows\System\xxTTbsS.exe
  2⤵
  PID:13532
- C:\Windows\System\wnNDzCp.exe
  C:\Windows\System\wnNDzCp.exe
  2⤵
  PID:13636
- C:\Windows\System\dMhGQsD.exe
  C:\Windows\System\dMhGQsD.exe
  2⤵
  PID:12704
- C:\Windows\System\AcxTnIs.exe
  C:\Windows\System\AcxTnIs.exe
  2⤵
  PID:9312
- C:\Windows\System\TJOhdyI.exe
  C:\Windows\System\TJOhdyI.exe
  2⤵
  PID:12480
- C:\Windows\System\rzuQLYK.exe
  C:\Windows\System\rzuQLYK.exe
  2⤵
  PID:11268
- C:\Windows\System\JXZLkcM.exe
  C:\Windows\System\JXZLkcM.exe
  2⤵
  PID:6064
- C:\Windows\System\iGhluCb.exe
  C:\Windows\System\iGhluCb.exe
  2⤵
  PID:10052
- C:\Windows\System\Zfijvbl.exe
  C:\Windows\System\Zfijvbl.exe
  2⤵
  PID:5380
- C:\Windows\System\WHsRWZe.exe
  C:\Windows\System\WHsRWZe.exe
  2⤵
  PID:736
- C:\Windows\System\RunNwDC.exe
  C:\Windows\System\RunNwDC.exe
  2⤵
  PID:10832
- C:\Windows\System\zvGrfZg.exe
  C:\Windows\System\zvGrfZg.exe
  2⤵
  PID:12528
- C:\Windows\System\uWFgcWC.exe
  C:\Windows\System\uWFgcWC.exe
  2⤵
  PID:11040
- C:\Windows\System\TCxNvos.exe
  C:\Windows\System\TCxNvos.exe
  2⤵
  PID:10848
- C:\Windows\System\baasAtu.exe
  C:\Windows\System\baasAtu.exe
  2⤵
  PID:7100
- C:\Windows\System\cjbtUXL.exe
  C:\Windows\System\cjbtUXL.exe
  2⤵
  PID:11936
- C:\Windows\System\lShEBvS.exe
  C:\Windows\System\lShEBvS.exe
  2⤵
  PID:10896
- C:\Windows\System\tMMkUhz.exe
  C:\Windows\System\tMMkUhz.exe
  2⤵
  PID:8684
- C:\Windows\System\CnJGvRU.exe
  C:\Windows\System\CnJGvRU.exe
  2⤵
  PID:12148
- C:\Windows\System\lbPdodA.exe
  C:\Windows\System\lbPdodA.exe
  2⤵
  PID:8248
- C:\Windows\System\HgcpMWb.exe
  C:\Windows\System\HgcpMWb.exe
  2⤵
  PID:9464
- C:\Windows\System\SGrjxVh.exe
  C:\Windows\System\SGrjxVh.exe
  2⤵
  PID:8756
- C:\Windows\System\VmWIeNW.exe
  C:\Windows\System\VmWIeNW.exe
  2⤵
  PID:10708
- C:\Windows\System\pywHIxN.exe
  C:\Windows\System\pywHIxN.exe
  2⤵
  PID:11608
- C:\Windows\System\oXVQsfs.exe
  C:\Windows\System\oXVQsfs.exe
  2⤵
  PID:13028
- C:\Windows\System\oFBdbGY.exe
  C:\Windows\System\oFBdbGY.exe
  2⤵
  PID:12192
- C:\Windows\System\umcPbxM.exe
  C:\Windows\System\umcPbxM.exe
  2⤵
  PID:8340
- C:\Windows\System\SODHwaS.exe
  C:\Windows\System\SODHwaS.exe
  2⤵
  PID:2328
- C:\Windows\System\FQQTEyc.exe
  C:\Windows\System\FQQTEyc.exe
  2⤵
  PID:13896
- C:\Windows\System\oKVHfsQ.exe
  C:\Windows\System\oKVHfsQ.exe
  2⤵
  PID:8196
- C:\Windows\System\xIMJjaj.exe
  C:\Windows\System\xIMJjaj.exe
  2⤵
  PID:11868
- C:\Windows\System\adGwueE.exe
  C:\Windows\System\adGwueE.exe
  2⤵
  PID:4964
- C:\Windows\System\IoZPfWy.exe
  C:\Windows\System\IoZPfWy.exe
  2⤵
  PID:12840
- C:\Windows\System\RMoSsKs.exe
  C:\Windows\System\RMoSsKs.exe
  2⤵
  PID:13336
- C:\Windows\System\SuehJEk.exe
  C:\Windows\System\SuehJEk.exe
  2⤵
  PID:6744
- C:\Windows\System\nKQUPUg.exe
  C:\Windows\System\nKQUPUg.exe
  2⤵
  PID:9076
- C:\Windows\System\MblGKrL.exe
  C:\Windows\System\MblGKrL.exe
  2⤵
  PID:10764
- C:\Windows\System\fKRZPFL.exe
  C:\Windows\System\fKRZPFL.exe
  2⤵
  PID:13448
- C:\Windows\System\iThhVNV.exe
  C:\Windows\System\iThhVNV.exe
  2⤵
  PID:9224
- C:\Windows\System\dApoixh.exe
  C:\Windows\System\dApoixh.exe
  2⤵
  PID:7880
- C:\Windows\System\TnNRdpG.exe
  C:\Windows\System\TnNRdpG.exe
  2⤵
  PID:3148
- C:\Windows\System\rwToOoF.exe
  C:\Windows\System\rwToOoF.exe
  2⤵
  PID:12152
- C:\Windows\System\lfkeKEx.exe
  C:\Windows\System\lfkeKEx.exe
  2⤵
  PID:12944
- C:\Windows\System\BvnrkuC.exe
  C:\Windows\System\BvnrkuC.exe
  2⤵
  PID:8232
- C:\Windows\System\EdJyzOA.exe
  C:\Windows\System\EdJyzOA.exe
  2⤵
  PID:9264
- C:\Windows\System\FhjNqwO.exe
  C:\Windows\System\FhjNqwO.exe
  2⤵
  PID:11116
- C:\Windows\System\GiZfmWu.exe
  C:\Windows\System\GiZfmWu.exe
  2⤵
  PID:5052
- C:\Windows\System\mMoEoGA.exe
  C:\Windows\System\mMoEoGA.exe
  2⤵
  PID:13864
- C:\Windows\System\iNKxtFl.exe
  C:\Windows\System\iNKxtFl.exe
  2⤵
  PID:12504
- C:\Windows\System\dwltdUg.exe
  C:\Windows\System\dwltdUg.exe
  2⤵
  PID:11880
- C:\Windows\System\qSYXClS.exe
  C:\Windows\System\qSYXClS.exe
  2⤵
  PID:14312
- C:\Windows\System\Gfsermx.exe
  C:\Windows\System\Gfsermx.exe
  2⤵
  PID:4732
- C:\Windows\System\eXfFZwu.exe
  C:\Windows\System\eXfFZwu.exe
  2⤵
  PID:13340
- C:\Windows\System\VWenZMK.exe
  C:\Windows\System\VWenZMK.exe
  2⤵
  PID:12572
- C:\Windows\System\nHeDxjk.exe
  C:\Windows\System\nHeDxjk.exe
  2⤵
  PID:8820
- C:\Windows\System\gBCxthB.exe
  C:\Windows\System\gBCxthB.exe
  2⤵
  PID:3808
- C:\Windows\System\puTAiFX.exe
  C:\Windows\System\puTAiFX.exe
  2⤵
  PID:13420
- C:\Windows\System\MzsVWMj.exe
  C:\Windows\System\MzsVWMj.exe
  2⤵
  PID:4412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uw0w42jk.hlu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AIjekUE.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\BJCwsfa.exe

Filesize
1.9MB

MD5
fd26dfb9ef363320c324a18493a666cc

SHA1
e4c08c8656fe63186fca1d2f804a58f30f950b2f

SHA256
5e721d31a9fd05c907fc5189a8a0a37ce6f0b3a31544c9f59a080c4a6efe333f

SHA512
7bf07c79d5731949df0a0fa4abb45b9764d68638129f2a8444bf45a3c5343615430b6cccc4649eaae55e5304df3efd64ecc312b49531c72b0d2482d85fde1784

Download Submit
C:\Windows\System\CBdsByp.exe

Filesize
1.9MB

MD5
38ef49531ce911536ce4199b2a6b39a5

SHA1
8d36d087046a3a8c1600ca263f273d3d43e3ef62

SHA256
8c6f4fa7b8d34757227a326fea5a23e31ad3e547839bd56f1e1cf032be0534d6

SHA512
7c0c095396289a40626f16b3f33409e6565bec9393cb5e0195c80b02ea6ef50756ea75e73d36cafa1e50bc328c449aa6ac3e3f2a7506d45d1ed20461477537c4

Download Submit
C:\Windows\System\CssDEap.exe

Filesize
1.9MB

MD5
40e208669b2331458a6f91ab4e857ed2

SHA1
17f8e242557e2f4a47bf269fb8849efcc65f5d68

SHA256
24ba5199963e806d46f550ae3bfe6105e8e3fa585ea01965bae7f1acee210609

SHA512
a5b1d6302c8367740bba3ccabee3670caf72334b29f1159b54f2c84e59fb632e33c4042ce22532c72d9e1514c047bd371e59224cd054a401dfcd976f479163e4

Download Submit
C:\Windows\System\EWTucOV.exe

Filesize
1.9MB

MD5
3d32579a9df36835a5bf9af67795d0ef

SHA1
791431105d192823d8894871e4ef392c80c541b2

SHA256
70ee5ef784042bf0532bd872d4fcce4a6e506c6927904aefa1f81cd5b61bac44

SHA512
680e9849454191e88e1ec061382f4d39c57540b41fe7267b462e27a512b1fd00758354f3f7f79136a32f18333b25b4e163575237b14537b7cde492210e4a5911

Download Submit
C:\Windows\System\JHGKtuc.exe

Filesize
1.9MB

MD5
d98a94ddb98af1a336846861877c213b

SHA1
a578fcff75ee89e47a845a0c9e4c77c17ba9068f

SHA256
76bf39b5067e48f20a009e06a211f5ee0de0bcc83c28c3e925d6487688f29b4e

SHA512
f5dfb66a320e15d7eb1059504359c45d9d1d142513183c369955e2043d334e102bf7f0a921492edf68ae34e7364e56d90e5a372911b3ea0af5c51503bdcfdf8e

Download Submit
C:\Windows\System\MNPngMn.exe

Filesize
1.9MB

MD5
57bae3ef636d99f1d89fbafd63cde7af

SHA1
405e118ffa9cf640d5473b09b703ca3623bf3d88

SHA256
63b9f651353ba5539ec95361cc37bd7fdd3b9c268738369d3e0245c683d140c1

SHA512
bb399950fce3831a5ff864ba9eb8b701e5959efe991768ea562da3f019d4ed7a50fbe42299f4c4cd95cd0b1ee05e870d165c2c599f2fe3b752bb9780f01dd0ba

Download Submit
C:\Windows\System\PDvKPXm.exe

Filesize
1.9MB

MD5
b5d27ef26527373b1c01b94b4cb0fde1

SHA1
717f989fe4c16b6a80c7030869c0f2da2ba144af

SHA256
878adaae4403e49bd6adeeb83bfba5ee93119f7d4a2e80ddd6072f80071cddfd

SHA512
cb14598033e90f2fc51bed7f9547142265e19edb9324a99930247038c15c9ab1bf73e5da127e4f5f04fe43b65743dd35710acc5e0d2a1bdda5ef19ea07563ed6

Download Submit
C:\Windows\System\RDzHQJC.exe

Filesize
1.9MB

MD5
17999e53442075241fda665e912ab5cc

SHA1
772625b23d22798b12e2a2d7112a1260868ff3d0

SHA256
5fabb13ea0b72cbb0f80e6175599b341fafbb2d769bab9c9015e721d44090901

SHA512
0ecdd0e1505f42f12a66cac328119b66759d1e6f4eb51fac1d6e46efa8c176b3daad4302e3ad3d984ffb1d19c0f87318255374572174e7e3fbdc9693399865b1

Download Submit
C:\Windows\System\RXUTiWW.exe

Filesize
1.9MB

MD5
2828c95db08800b03b7df7a1432dc155

SHA1
f4cb335e021315b466c8c7372f3e9923a38742d7

SHA256
d829d6cc92dd9ccfa099af2e2a523d98eaa2fa6c7eec09aa53e11fee17788393

SHA512
236a4d554aee646b7e70512137c0226b9bbe6a3fcebdac1cecf89b1e680da601ae84c91bd5f9822cdfe99446b1031ceb6f4c3389c7d6f367975f8db4d0dac9a9

Download Submit
C:\Windows\System\SrITaYa.exe

Filesize
1.9MB

MD5
9c1c467c0ec7cdf29bb46bf10f6df2ea

SHA1
5c92a5c42e595606f7c3f4d86503d3eb9d757587

SHA256
57b67c02d87b20d1db4c273795da84ff76058e47e66ca3f184432c8cf8830b98

SHA512
12506e196eed0c550e2091986f81a43985693f6e948bfa61c735093460ff31520587aadb309cbf596f86a8f4b8632304a1af16ee9c9878483308bcead9b7084a

Download Submit
C:\Windows\System\VelCSzX.exe

Filesize
1.9MB

MD5
3ee45e33b43adc0feecda4409905efff

SHA1
d87b9d5f4343a4c05445bedffee3f36a64c76591

SHA256
4809b121199e0c44e4a9b25c74bc52253848cecb86664af746a333ae0886cded

SHA512
b78e857b7fff88fefa547f3b15b92c338aafa3d0970ebe758f2abc01513940e4724458facef956e75db2fc994cb1e1c3c30eefcc7029f3d63e0ed1635f342985

Download Submit
C:\Windows\System\XmHeMCL.exe

Filesize
1.9MB

MD5
c50149baadee95370ff8691768e73ae1

SHA1
4c14559f27af8cac6a2f45e1a1fbccb6e25267e0

SHA256
9fdc97e95a9c91132df3d83a0e280d5d5872f7f74371618ea50a0ea2b3dcc55b

SHA512
eadeae86e6658069cdd37a9796cd6acd111d3c8036f4936e9ef9ff637753f7eb77a2719e2e5b018258279e8d92a0383a7db3ae390e5dc0cea0a2e91264209050

Download Submit
C:\Windows\System\YMBdIwV.exe

Filesize
1.9MB

MD5
6ca5f8ab3a0cf2bb7caeec0ea16f87f3

SHA1
4be4f1b436c5b7bd8c616193b5deb8efb4b987c9

SHA256
e90521487d74517a00280234c355014aa09067603cf0638b2709d8273b04ae02

SHA512
577c7143600fa03fcdba70e4a1a54d36f3c838c298bc92750d71c8d1a23e47c74eb60c06ac2ec1797394c8f69a15c4d0d570b47c8dddd8e178eac2045a7f1f5b

Download Submit
C:\Windows\System\bWAWkal.exe

Filesize
1.9MB

MD5
990a3b274139e6c312c1573450b34a7b

SHA1
004f5ad402ee68f706684dfd25dad873a324e5d8

SHA256
0d561d0e612f37dbad16bd0c1184f3260682b50bfaffda711c5fb6b8a6d08da3

SHA512
b36f2c3d06d94990cb07877fea90e12c03e2b5bed57edad021665fce0ce8dacf447da79464710eee18031d821ea36204c318ee07491f8abe0b7cab5370bd1727

Download Submit
C:\Windows\System\cLijPyT.exe

Filesize
1.9MB

MD5
0b540c96d3d78f049515b4c997473edb

SHA1
58203f647a224f661bb4c7f1cba9648818686d1f

SHA256
1290dfc8fe1c92a2d018cb7f36e91828eccfaa658f5be5cf183a44e036f50283

SHA512
1e71d73cd2f3b54cb658e112078557ce0c5b6fc50594409d41b3f27ae8e700d456ad18b7f861561011255fbd94cc7595ed0ab119b1ba54a3b6f238d6fa96addc

Download Submit
C:\Windows\System\ftHgkvg.exe

Filesize
1.9MB

MD5
f746fd58d67a6bf9bbb6393ce8e8c947

SHA1
3834e658bd43cb981ee5f24a91009f9d87b603be

SHA256
1842947c3875b3fc8ad2b96d8551de0a293ec0c24b34d583c0b4717c409039d7

SHA512
2b371e984e43dd5c55acd30f12f3209045238e4d8be1459012cfd694e6b60e29793fcbf5132b6a41f9779fc7207357d825c2a752ab676dba8c9c18b0a165fc58

Download Submit
C:\Windows\System\htIpPvR.exe

Filesize
1.9MB

MD5
89d665e634b341528696494f85ca3d7f

SHA1
692382fcf10b52022bf21bd33eac2710359c2f82

SHA256
6bb5371d4ebc15bbac54bbd21c6c4aaf79d81a66c7aeeb6735fb660ede6638f7

SHA512
c554393aa0805f1018db86432f607260f7d1371aa82d99a1b5c973037ca494fece0aa7ddee9b421763e24dc4e7bd2a14c534428a22ef2cf56721752e15b70976

Download Submit
C:\Windows\System\jJSdQtb.exe

Filesize
1.9MB

MD5
62a88d9a7e80fef6d1ccd244807db5df

SHA1
47e684ce927e67e160114674e19c5ae72e271a7f

SHA256
6c78d854a5c517fd7da33aeb54ad6124b9f69dcaf21c4c2738638c974927525b

SHA512
2416d195f8cc41680a8e645a845cafdeca48163f99ca719f4ea0d7aa9fbbfee8d21020ba599079009685f5606e70d3503d7da0ba290a3e574ffb8e7dc773d4d4

Download Submit
C:\Windows\System\jRcqzfB.exe

Filesize
1.9MB

MD5
0aa08c227c905514d46793afe1860398

SHA1
d0ba40d9342cbcd96b3d332c65525c8b8a8123b4

SHA256
ed13e66d7f4b077ac1e4cceb8ca524b5f52e223b674f0ed2130a5ca8fe110e43

SHA512
03eb54cbfbad1da3e6c7c6dcebbe8401915f7b5abd119b2aeaa33ad067e731755b4fdf4d8cffc7d1086cfdd7a147d1ab8fa2e52a09fa09dd7a7abed308c02359

Download Submit
C:\Windows\System\kKnGrVS.exe

Filesize
1.9MB

MD5
4e9b31a26a049e44d5c5569683faca91

SHA1
7275696a795a02096c091740cbc24a59c8e1ce74

SHA256
e72e6137ea7b93e25797487f162e07b2567c90af1dfce285f6fe30a977fe0c8b

SHA512
6cadd22698e07d45f87c177485a3a04af674dfe9f2edde51e0a1fd655d0f14cba7ad9b231e6e7869ae3b71e89092bfb6a6758a63334f5cd903f409e759440b67

Download Submit
C:\Windows\System\kipNyRs.exe

Filesize
1.9MB

MD5
fe0e60f6e989b2298a3a6f9ed676ab3f

SHA1
41cf5a064273f3eae7b97641bd0bd7ab6ef0853d

SHA256
d2c9361db15cdc51be1114d12f63add18d7b00173915c8a1a1dca02945a0541c

SHA512
e2f79017582a968339598bdac860342577ddb6f37a3a507d976ccf7feee2a412e615598925643f86902c52bad52fd1e4900a669d600b720c7b2eb21bfa5748e7

Download Submit
C:\Windows\System\mGZGZXk.exe

Filesize
1.9MB

MD5
afea11cc8c1d5c2814cb7be27e0d2e46

SHA1
6464175ce4a95d9ae18b5ddd344d2b01c4cee1cf

SHA256
4a351fc00c11bb799b3e76651f6f5e22147f2fd4a8ac3b78379ed33d7d97c1b9

SHA512
0ceacd49beb77da314c6fb943090e95bbd84dbe5ab412239f3a01bfb4d496dbf625d152ac9a6cbf20edac45f403c9d4bc55c46162a47f4372e4b03bf36c46513

Download Submit
C:\Windows\System\mxzakEK.exe

Filesize
1.9MB

MD5
2f479cf631b287476898d59f1e2c63aa

SHA1
f091d9943acdc943b7ad301ca0abde7b9200bc83

SHA256
3ec3e26039cb856a5cc50a95999b8392fab28b71bc4be76669f0d5c7348fc3e7

SHA512
c17759f925fe14a28b85c8a893f3fb763d08c835af366890f6ffee4c1ba4781ab6ef42613a7772adc5838d8642eef0ec4a415d235235177875eb572c69044f29

Download Submit
C:\Windows\System\nDYHXim.exe

Filesize
1.9MB

MD5
667911c62adb0c51dfce09ba1dab493a

SHA1
e5f437a481bb4a3972faeb5a163480b31a569e2c

SHA256
7824668f75d6369aec087daec20253528ec8fc6221e8821d405c37b224654648

SHA512
f224a3896fb1a385430fd9b94687ae8e0ffd6d92edaf4545ee27b38e6d7ba4f317d6556ac9695b4d5920421f9b88c5ca2bfa8780b9ad00ed261293d9d3af0d86

Download Submit
C:\Windows\System\nuchmsF.exe

Filesize
1.9MB

MD5
77b828b9cc52057e21ff554f0829c409

SHA1
b8d84c27cd89a1a914e55d485998cbdc559ba958

SHA256
0f1e5319fc145e33bb828b68ea8e26e5545e0a224825a4667274081d765c17fe

SHA512
33ff858a5cf8005d55e907c33152fd7245a73f2f4d27f047408b2355ddf13ca0d2806cb242b0676a8f3609a3699ae526858fbd008ffc6af1add7374a4408f619

Download Submit
C:\Windows\System\qJLgDdD.exe

Filesize
1.9MB

MD5
440959f5618fa15de265955162b90d10

SHA1
d6658c6b41d63563c67bd18f508b03a8c0ae590a

SHA256
7c71b252523f605048dff253260b8f8a762c5e51ee9896340b3d93f0214aa18c

SHA512
3406700fcd3027d8de4e51950b6047194c1f780ff23068360f679544455620af1dc0bde311e47c4b6e2876172c57877df7cf31e5eccf7c8d79058ab45b8e8821

Download Submit
C:\Windows\System\qVNCIMF.exe

Filesize
1.9MB

MD5
8b8ab4e61e847e6c10364a93be1605f2

SHA1
03eb179af4b9ecaba24ea065e0d7ee06b6442aa7

SHA256
d09ec4bac0d1ecee835dade6a8c42cfdd0b8d96c139a11b85b7e0d2a1885fd36

SHA512
7fda1b50a59d04dcbec5c0134e7cc0bfa037bc384208eb2f6942a668bc1a2a0f75ce76f9b707a1da83b5357301098264d7c7f0cf3e6542b8cc41945f74984c65

Download Submit
C:\Windows\System\qhdfteL.exe

Filesize
1.9MB

MD5
922205cd217a2162d40aa6d34e6ef2f8

SHA1
1ec73a250f3d940f90e658d942d05f06a35b481f

SHA256
470ee9ba3f3510947561530df9a753ab1f6e2a0fd661f7b776ad7b770d367a51

SHA512
f094eefe0551d7d4bc0ce2071ac1e8b69f6b5c3057a1eb841f3707543c8ef0c2b1cf113f6751a03705b70a42bec1056c655369c1debac31e6caf1eddb1d1738e

Download Submit
C:\Windows\System\rpAQOlL.exe

Filesize
1.9MB

MD5
f06a9137812f69b1c85666b70db0cbf7

SHA1
e89dea42e0d3a3f259f83bf5cddeab5e0dc30c91

SHA256
174d1b7bd5e1befde07e6e5a8e301ef87c29660245e999a158b4ed2340e396b3

SHA512
c8aa32c1eac2d69cf4ac8df7f83d4c941b802132077000b0bb524a3075b36181208129824fe6b5b1435906d82b98d2265d1a856e64f33db9a9c13fe6ac97c86f

Download Submit
C:\Windows\System\tXQmWnz.exe

Filesize
1.9MB

MD5
28d87f139848719bbaa2b8ef427cb24d

SHA1
2f11c3de388af55378803d236015699fc5d4a4e6

SHA256
ae6369636b076d824a57841520f9107ce8061b18072b8c7017fcef9ba2204cb4

SHA512
dc57251f8a4897b5445be00267c6d2312e224efe5531a54c84b70472dfe207f29f9a79f0d6e1fb47427aaf92821ec8acaa6f59ad561fa85f94f3899f52dd6580

Download Submit
C:\Windows\System\tfrGvhE.exe

Filesize
18B

MD5
b5af15b91ef901dbbad280bf2ec97d3f

SHA1
b8fc44effcf94c604b3a330099fdd05d70ca2290

SHA256
4b241b0358bbe69bc40fb7c8558ef0dacf7a7dd595b9974e7ee1287f6f6a57a6

SHA512
77e9e1cd7604d29efe33ea37dfc85035465c8eb4a6b1edf396f009c9427a6171460e7b24fac454a276653572360ea48634eb43a059b68dd9d91460bd58c1ddf1

Download Submit
C:\Windows\System\vorVnOl.exe

Filesize
1.9MB

MD5
1113241827a856ae4837666fcf4ba376

SHA1
05c49f1ce44ca9accfe049e8d10e5b18de67c991

SHA256
cea8de3c04687c874bc9fc824ce470cdd4f7c60a033ab9a2b7ae908813a85dc4

SHA512
1f91b68fb438b513ad1d15977b01bff07dde28238aaa62f43ab7f8554d363181bca2281c5595dc9e4f772aa9240dda6b3ab1539ce9c2c67435476e00b3322dca

Download Submit
C:\Windows\System\vrPhKxz.exe

Filesize
1.9MB

MD5
77e28497dcd1a22f5354ff2b92bdf2ba

SHA1
97144641afcf5b5cbf58dc02df1cb03e05d918e6

SHA256
2bab306ce4a6981c82f214e34eeeba169d16b6018754a52166d2c277b5877009

SHA512
ce0b7f58dce6ccf0538f0830b602addfce319506a3c6b740816989b1d2138b373b74444755bcd3c2b0dc1f680a0b8b01f1affc16e5b30f18f1e59b5d7a37e5f7

Download Submit
C:\Windows\System\wHpFGgw.exe

Filesize
1.9MB

MD5
446707dc12ad627bb6be2709838e9b0d

SHA1
e9891915669c9f57b8ae1dbb49dd5a0cd3d3a8f8

SHA256
4172bf1630a353f9278fd88abf9aac368e6e398038328af87a3a8f063cea1029

SHA512
ff931132171deb73462ffafd4c6dafa078585772bd6ec0a9d9df6d114c682b509d880847397103a4c442ba8eba8c34d4f3d0fceb612215cc2af4d3ad91d857ed

Download Submit
C:\Windows\System\xYbExor.exe

Filesize
1.9MB

MD5
19ec7adb56ab4d9ca4c9fd92c961de24

SHA1
5716e7a8ff44fc567c4a656d4a8005db015fe746

SHA256
5b5a5692a15ec6f036e78a62c00ce0ec0be8690e4cd7577e88cbabcd7c79061d

SHA512
65a29a9e5fc9a53187ecb4b1454f996e0602117c75b7bb2032eca0edbebddf82f0ab9e4185d0f971211f643b76d598bb7e4a5afe2c0cae4d555e6305c3e4660e

Download Submit
C:\Windows\System\xzvQiYP.exe

Filesize
1.9MB

MD5
01bc4b3575b08890ad4e034a1eff22b6

SHA1
84cf270da055442cc5dccf0cc8eb4fffeb5c198d

SHA256
f3e1a368c4aa387026acbe0ffb595681849258cb6c4233d6b5848bf1c89215eb

SHA512
998272a9ac8d4bcf13555c23f299f7e87d57d793dc515924ff2a50a69ee14071c6dfe397d8956818d2484669fba57b19379a287f0a679cea83d841738218bd74

Download Submit
C:\Windows\System\zVwPltC.exe

Filesize
1.9MB

MD5
efec3db1b475cd12bfc3c2ee1653a368

SHA1
cf068a762d643692627d9e4512fff4e08d6979cc

SHA256
f0442c30624dda9fd0bbca3d6b9a55aa784cc6163418e02002d0a1d8b37a8a33

SHA512
b97b1f3368fe6be4fcf629517e417f464e923e2e4042c827b52e3d885b9818b8d4ef0adb4f1e48fdfd0f24e46732740a891b0d2909a74954b7e84acb18d7a4eb

Download Submit
memory/372-214-0x00007FF69CAE0000-0x00007FF69CED2000-memory.dmp

Filesize
3.9MB

Download
memory/372-6820-0x00007FF69CAE0000-0x00007FF69CED2000-memory.dmp

Filesize
3.9MB

Download
memory/572-20-0x00007FF735340000-0x00007FF735732000-memory.dmp

Filesize
3.9MB

Download
memory/1060-6762-0x00007FF7CE050000-0x00007FF7CE442000-memory.dmp

Filesize
3.9MB

Download
memory/1060-127-0x00007FF7CE050000-0x00007FF7CE442000-memory.dmp

Filesize
3.9MB

Download
memory/1732-220-0x00007FF6F23F0000-0x00007FF6F27E2000-memory.dmp

Filesize
3.9MB

Download
memory/1732-6810-0x00007FF6F23F0000-0x00007FF6F27E2000-memory.dmp

Filesize
3.9MB

Download
memory/2564-221-0x00007FF65D520000-0x00007FF65D912000-memory.dmp

Filesize
3.9MB

Download
memory/2564-6818-0x00007FF65D520000-0x00007FF65D912000-memory.dmp

Filesize
3.9MB

Download
memory/2944-110-0x00007FF7C0800000-0x00007FF7C0BF2000-memory.dmp

Filesize
3.9MB

Download
memory/3132-5701-0x00007FF674940000-0x00007FF674D32000-memory.dmp

Filesize
3.9MB

Download
memory/3132-24-0x00007FF674940000-0x00007FF674D32000-memory.dmp

Filesize
3.9MB

Download
memory/3132-6581-0x00007FF674940000-0x00007FF674D32000-memory.dmp

Filesize
3.9MB

Download
memory/3136-6555-0x00007FF62C670000-0x00007FF62CA62000-memory.dmp

Filesize
3.9MB

Download
memory/3136-32-0x00007FF62C670000-0x00007FF62CA62000-memory.dmp

Filesize
3.9MB

Download
memory/3212-56-0x00007FF613710000-0x00007FF613B02000-memory.dmp

Filesize
3.9MB

Download
memory/3212-6647-0x00007FF613710000-0x00007FF613B02000-memory.dmp

Filesize
3.9MB

Download
memory/3264-126-0x00007FF7CC030000-0x00007FF7CC422000-memory.dmp

Filesize
3.9MB

Download
memory/3328-6746-0x00007FF694980000-0x00007FF694D72000-memory.dmp

Filesize
3.9MB

Download
memory/3328-115-0x00007FF694980000-0x00007FF694D72000-memory.dmp

Filesize
3.9MB

Download
memory/3440-70-0x00007FF641920000-0x00007FF641D12000-memory.dmp

Filesize
3.9MB

Download
memory/3440-6637-0x00007FF641920000-0x00007FF641D12000-memory.dmp

Filesize
3.9MB

Download
memory/3644-219-0x00007FF654040000-0x00007FF654432000-memory.dmp

Filesize
3.9MB

Download
memory/3644-6733-0x00007FF654040000-0x00007FF654432000-memory.dmp

Filesize
3.9MB

Download
memory/3720-28-0x00007FF600620000-0x00007FF600A12000-memory.dmp

Filesize
3.9MB

Download
memory/3764-54-0x00007FF7C5220000-0x00007FF7C5612000-memory.dmp

Filesize
3.9MB

Download
memory/4076-60-0x00007FF6CB930000-0x00007FF6CBD22000-memory.dmp

Filesize
3.9MB

Download
memory/4256-1-0x0000024158EB0000-0x0000024158EC0000-memory.dmp

Filesize
64KB

Download
memory/4256-0-0x00007FF6508C0000-0x00007FF650CB2000-memory.dmp

Filesize
3.9MB

Download
memory/4356-216-0x00007FF6F4000000-0x00007FF6F43F2000-memory.dmp

Filesize
3.9MB

Download
memory/4356-6836-0x00007FF6F4000000-0x00007FF6F43F2000-memory.dmp

Filesize
3.9MB

Download
memory/4544-6666-0x00007FF7DD580000-0x00007FF7DD972000-memory.dmp

Filesize
3.9MB

Download
memory/4544-61-0x00007FF7DD580000-0x00007FF7DD972000-memory.dmp

Filesize
3.9MB

Download
memory/4556-215-0x00007FF6B6AB0000-0x00007FF6B6EA2000-memory.dmp

Filesize
3.9MB

Download
memory/4556-6822-0x00007FF6B6AB0000-0x00007FF6B6EA2000-memory.dmp

Filesize
3.9MB

Download
memory/4636-217-0x00007FF774FA0000-0x00007FF775392000-memory.dmp

Filesize
3.9MB

Download
memory/4636-6837-0x00007FF774FA0000-0x00007FF775392000-memory.dmp

Filesize
3.9MB

Download
memory/4804-6829-0x00007FF7D7FC0000-0x00007FF7D83B2000-memory.dmp

Filesize
3.9MB

Download
memory/4804-202-0x00007FF7D7FC0000-0x00007FF7D83B2000-memory.dmp

Filesize
3.9MB

Download
memory/4940-6706-0x00007FF6D6650000-0x00007FF6D6A42000-memory.dmp

Filesize
3.9MB

Download
memory/4940-96-0x00007FF6D6650000-0x00007FF6D6A42000-memory.dmp

Filesize
3.9MB

Download
memory/5024-6718-0x00007FF6C3BD0000-0x00007FF6C3FC2000-memory.dmp

Filesize
3.9MB

Download
memory/5024-218-0x00007FF6C3BD0000-0x00007FF6C3FC2000-memory.dmp

Filesize
3.9MB

Download
memory/5036-6825-0x00007FF6309A0000-0x00007FF630D92000-memory.dmp

Filesize
3.9MB

Download
memory/5036-152-0x00007FF6309A0000-0x00007FF630D92000-memory.dmp

Filesize
3.9MB

Download
memory/5040-163-0x0000022553970000-0x0000022553992000-memory.dmp

Filesize
136KB

Download