xmrig | bc85d990ca32a682850cd61546557909e9526d9c9540a8d111c4bc26052e7dc6

Analysis

max time kernel
123s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
Size

1.8MB
MD5

03c1245a42360ca436deb670aeac912e
SHA1

e88767d9b18b17a1cadf18408b223142bdf989dc
SHA256

bc85d990ca32a682850cd61546557909e9526d9c9540a8d111c4bc26052e7dc6
SHA512

55517ef2a1ec0f555b7476325181c66a5c3bcdde7a33e38733141e618e099ab2e3916265fae1075db65c8b9f2fc16e277b38edccaffaae55788766f33c71bd70
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl5S9:NABx

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/memory/2748-253-0x00007FF76EE30000-0x00007FF76F222000-memory.dmp	xmrig
behavioral2/memory/3208-307-0x00007FF79A940000-0x00007FF79AD32000-memory.dmp	xmrig
behavioral2/memory/456-337-0x00007FF701410000-0x00007FF701802000-memory.dmp	xmrig
behavioral2/memory/1808-342-0x00007FF7F3130000-0x00007FF7F3522000-memory.dmp	xmrig
behavioral2/memory/2220-341-0x00007FF781C90000-0x00007FF782082000-memory.dmp	xmrig
behavioral2/memory/2924-340-0x00007FF6B2770000-0x00007FF6B2B62000-memory.dmp	xmrig
behavioral2/memory/1320-339-0x00007FF7F5870000-0x00007FF7F5C62000-memory.dmp	xmrig
behavioral2/memory/4600-338-0x00007FF6B27A0000-0x00007FF6B2B92000-memory.dmp	xmrig
behavioral2/memory/1760-336-0x00007FF6FC740000-0x00007FF6FCB32000-memory.dmp	xmrig
behavioral2/memory/5112-335-0x00007FF673020000-0x00007FF673412000-memory.dmp	xmrig
behavioral2/memory/4760-334-0x00007FF7FD6E0000-0x00007FF7FDAD2000-memory.dmp	xmrig
behavioral2/memory/4176-333-0x00007FF7178C0000-0x00007FF717CB2000-memory.dmp	xmrig
behavioral2/memory/4656-250-0x00007FF77D5A0000-0x00007FF77D992000-memory.dmp	xmrig
behavioral2/memory/4464-218-0x00007FF643220000-0x00007FF643612000-memory.dmp	xmrig
behavioral2/memory/4956-168-0x00007FF668DC0000-0x00007FF6691B2000-memory.dmp	xmrig
behavioral2/memory/1108-160-0x00007FF7D13F0000-0x00007FF7D17E2000-memory.dmp	xmrig
behavioral2/memory/1708-83-0x00007FF7E36C0000-0x00007FF7E3AB2000-memory.dmp	xmrig
behavioral2/memory/1900-6628-0x00007FF617030000-0x00007FF617422000-memory.dmp	xmrig
behavioral2/memory/464-7465-0x00007FF7D6280000-0x00007FF7D6672000-memory.dmp	xmrig
behavioral2/memory/4464-7781-0x00007FF643220000-0x00007FF643612000-memory.dmp	xmrig
behavioral2/memory/4956-7784-0x00007FF668DC0000-0x00007FF6691B2000-memory.dmp	xmrig
behavioral2/memory/4176-7786-0x00007FF7178C0000-0x00007FF717CB2000-memory.dmp	xmrig
behavioral2/memory/456-7820-0x00007FF701410000-0x00007FF701802000-memory.dmp	xmrig
behavioral2/memory/2924-7816-0x00007FF6B2770000-0x00007FF6B2B62000-memory.dmp	xmrig
behavioral2/memory/1320-7814-0x00007FF7F5870000-0x00007FF7F5C62000-memory.dmp	xmrig
behavioral2/memory/4600-7812-0x00007FF6B27A0000-0x00007FF6B2B92000-memory.dmp	xmrig
behavioral2/memory/4656-7810-0x00007FF77D5A0000-0x00007FF77D992000-memory.dmp	xmrig
behavioral2/memory/5112-7806-0x00007FF673020000-0x00007FF673412000-memory.dmp	xmrig
behavioral2/memory/1808-7804-0x00007FF7F3130000-0x00007FF7F3522000-memory.dmp	xmrig
behavioral2/memory/2748-7802-0x00007FF76EE30000-0x00007FF76F222000-memory.dmp	xmrig
behavioral2/memory/2220-7835-0x00007FF781C90000-0x00007FF782082000-memory.dmp	xmrig
behavioral2/memory/4760-7824-0x00007FF7FD6E0000-0x00007FF7FDAD2000-memory.dmp	xmrig
behavioral2/memory/1900-7808-0x00007FF617030000-0x00007FF617422000-memory.dmp	xmrig
behavioral2/memory/3208-7798-0x00007FF79A940000-0x00007FF79AD32000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1388	LYKSCAl.exe
464	FuoTRkH.exe
4844	CaTaBql.exe
1708	JKBWjRS.exe
1900	LGXcyZy.exe
1108	MwWLwaf.exe
4956	uxUJOAD.exe
4464	buLcUwn.exe
4656	ZvlueIe.exe
2748	tFBEDMl.exe
3208	tXYkBJk.exe
2220	EMkMbJY.exe
4176	pFfJdBI.exe
4760	LCPLPcQ.exe
5112	MtxXLPs.exe
1760	AwxwCjj.exe
1808	MIeFFeH.exe
456	abkDIKW.exe
4600	QkBLpOG.exe
1320	GdriXyO.exe
2924	VeDMJqK.exe
4868	KydqaPU.exe
4000	Rojteyz.exe
4608	kVDXaZZ.exe
2296	fvhOoqx.exe
3960	yeHTbOn.exe
2960	UDCVrup.exe
4396	hWxXsSh.exe
2684	yzwRbMt.exe
3984	zEVwoMj.exe
1624	QlYTUOd.exe
2876	LXzoqkG.exe
944	lPALdHW.exe
2524	tvuPLBx.exe
540	DuQEDrZ.exe
3712	LONThPo.exe
1120	eDurCIL.exe
3184	ozhEEEd.exe
2680	NilTiYb.exe
1264	OQruCly.exe
4100	mblhItf.exe
4676	JhxoEqm.exe
2636	zeSErRN.exe
1208	JFnCTcj.exe
1924	DEGUvGN.exe
4392	fpywbso.exe
3864	XmvkOKc.exe
1744	xxExzWb.exe
4632	kMCDxgu.exe
2328	eLaddDW.exe
4624	CHpglud.exe
4536	fBfjdSN.exe
3668	TyazXLy.exe
348	XiCcKAE.exe
4668	PePnltg.exe
4564	XvpQDdf.exe
2644	JWDrquM.exe
2816	xHQxHgc.exe
4856	YNIOutp.exe
2028	AWSUypW.exe
864	seQSQUH.exe
4264	MxurNul.exe
644	RHSKEMt.exe
872	LSPTelF.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1280-0-0x00007FF6FB100000-0x00007FF6FB4F2000-memory.dmp	upx
behavioral2/files/0x000b00000002340a-7.dat	upx
behavioral2/files/0x0007000000023417-6.dat	upx
behavioral2/files/0x0008000000023416-10.dat	upx
behavioral2/memory/4844-17-0x00007FF681080000-0x00007FF681472000-memory.dmp	upx
behavioral2/memory/464-13-0x00007FF7D6280000-0x00007FF7D6672000-memory.dmp	upx
behavioral2/memory/1388-11-0x00007FF77D1A0000-0x00007FF77D592000-memory.dmp	upx
behavioral2/files/0x0007000000023418-24.dat	upx
behavioral2/files/0x000700000002341f-53.dat	upx
behavioral2/files/0x000700000002342e-138.dat	upx
behavioral2/files/0x000700000002342d-171.dat	upx
behavioral2/memory/2748-253-0x00007FF76EE30000-0x00007FF76F222000-memory.dmp	upx
behavioral2/memory/3208-307-0x00007FF79A940000-0x00007FF79AD32000-memory.dmp	upx
behavioral2/memory/456-337-0x00007FF701410000-0x00007FF701802000-memory.dmp	upx
behavioral2/memory/1808-342-0x00007FF7F3130000-0x00007FF7F3522000-memory.dmp	upx
behavioral2/memory/2220-341-0x00007FF781C90000-0x00007FF782082000-memory.dmp	upx
behavioral2/memory/2924-340-0x00007FF6B2770000-0x00007FF6B2B62000-memory.dmp	upx
behavioral2/memory/1320-339-0x00007FF7F5870000-0x00007FF7F5C62000-memory.dmp	upx
behavioral2/memory/4600-338-0x00007FF6B27A0000-0x00007FF6B2B92000-memory.dmp	upx
behavioral2/memory/1760-336-0x00007FF6FC740000-0x00007FF6FCB32000-memory.dmp	upx
behavioral2/memory/5112-335-0x00007FF673020000-0x00007FF673412000-memory.dmp	upx
behavioral2/memory/4760-334-0x00007FF7FD6E0000-0x00007FF7FDAD2000-memory.dmp	upx
behavioral2/memory/4176-333-0x00007FF7178C0000-0x00007FF717CB2000-memory.dmp	upx
behavioral2/memory/4656-250-0x00007FF77D5A0000-0x00007FF77D992000-memory.dmp	upx
behavioral2/memory/4464-218-0x00007FF643220000-0x00007FF643612000-memory.dmp	upx
behavioral2/files/0x000700000002342c-212.dat	upx
behavioral2/files/0x0007000000023438-210.dat	upx
behavioral2/files/0x000700000002343e-207.dat	upx
behavioral2/files/0x0007000000023424-195.dat	upx
behavioral2/files/0x0007000000023428-192.dat	upx
behavioral2/files/0x000700000002343c-191.dat	upx
behavioral2/files/0x000700000002343b-184.dat	upx
behavioral2/files/0x0008000000023414-176.dat	upx
behavioral2/files/0x0007000000023422-175.dat	upx
behavioral2/memory/4956-168-0x00007FF668DC0000-0x00007FF6691B2000-memory.dmp	upx
behavioral2/files/0x0007000000023439-167.dat	upx
behavioral2/files/0x0007000000023420-161.dat	upx
behavioral2/files/0x0007000000023437-159.dat	upx
behavioral2/files/0x0007000000023436-158.dat	upx
behavioral2/files/0x0007000000023435-157.dat	upx
behavioral2/files/0x0007000000023434-156.dat	upx
behavioral2/files/0x000700000002342a-155.dat	upx
behavioral2/files/0x0007000000023431-154.dat	upx
behavioral2/files/0x0007000000023430-149.dat	upx
behavioral2/files/0x0007000000023427-144.dat	upx
behavioral2/files/0x000700000002343a-173.dat	upx
behavioral2/files/0x0007000000023426-164.dat	upx
behavioral2/files/0x0007000000023425-131.dat	upx
behavioral2/memory/1108-160-0x00007FF7D13F0000-0x00007FF7D17E2000-memory.dmp	upx
behavioral2/files/0x000700000002342b-124.dat	upx
behavioral2/memory/1900-121-0x00007FF617030000-0x00007FF617422000-memory.dmp	upx
behavioral2/files/0x0007000000023429-153.dat	upx
behavioral2/files/0x0007000000023423-103.dat	upx
behavioral2/files/0x000700000002342f-142.dat	upx
behavioral2/files/0x0007000000023421-140.dat	upx
behavioral2/files/0x000700000002341e-86.dat	upx
behavioral2/memory/1708-83-0x00007FF7E36C0000-0x00007FF7E3AB2000-memory.dmp	upx
behavioral2/files/0x0007000000023419-72.dat	upx
behavioral2/files/0x000700000002341d-65.dat	upx
behavioral2/files/0x000700000002341a-46.dat	upx
behavioral2/files/0x000700000002341b-42.dat	upx
behavioral2/files/0x000700000002341c-47.dat	upx
behavioral2/memory/1900-6628-0x00007FF617030000-0x00007FF617422000-memory.dmp	upx
behavioral2/memory/464-7465-0x00007FF7D6280000-0x00007FF7D6672000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KosTpQy.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\MXhCJFd.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\wLFzEJh.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\jebiIgQ.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\jGVimgS.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\UJcnrcy.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\SEynHEY.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\icwqKww.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\YoctnFM.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\qfeOZpr.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\yeyESJa.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\LqxmbUC.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\rFVcxQN.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\mnQrOGD.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\WmeoiXw.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\iiFGYIc.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\oiwoaTb.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\aTLwjLK.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\jMjFXkW.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\EknvXnh.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\KkzfaMt.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\bpHnhKB.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\QAwaKnh.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\NfBWqCF.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\MIoNQzG.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\uBAEmup.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\LGDCreH.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\hxASRre.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\DknLobV.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\zSBVyFJ.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\VKmhWVu.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\ZAFmZaM.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\vtSHlZt.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\nRZnPXB.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\vfuXaKn.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\ljWeCQg.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\LHnbIyt.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\iplpZXU.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\dHvriNz.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\uBoSFha.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\XQpjQsD.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\qGXxYHx.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\iOmrUfB.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\IyQYMhm.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\orXwhZV.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\iDvqwBF.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\AyORzOr.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\elPhjuE.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\jZNcqdh.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\nfLgfjC.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\jVIUHbl.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\CREHMSs.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\tlJwwFC.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\DKpynRA.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\zOJkVFO.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\PhMDERQ.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\CCNXarG.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\vBGxTDK.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\DKgoZpL.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\DfYkYRg.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\VwlirBI.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\aFKeEEL.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\fDRqUVi.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
File created	C:\Windows\System\rkaUwkI.exe	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5084	powershell.exe
5084	powershell.exe
5084	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
Token: SeDebugPrivilege	5084	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 5084	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	83
PID 1280 wrote to memory of 5084	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	83
PID 1280 wrote to memory of 1388	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	84
PID 1280 wrote to memory of 1388	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	84
PID 1280 wrote to memory of 464	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	85
PID 1280 wrote to memory of 464	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	85
PID 1280 wrote to memory of 4844	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	86
PID 1280 wrote to memory of 4844	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	86
PID 1280 wrote to memory of 1708	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	87
PID 1280 wrote to memory of 1708	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	87
PID 1280 wrote to memory of 1900	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	88
PID 1280 wrote to memory of 1900	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	88
PID 1280 wrote to memory of 1108	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	89
PID 1280 wrote to memory of 1108	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	89
PID 1280 wrote to memory of 4956	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	90
PID 1280 wrote to memory of 4956	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	90
PID 1280 wrote to memory of 4464	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	91
PID 1280 wrote to memory of 4464	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	91
PID 1280 wrote to memory of 4656	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	92
PID 1280 wrote to memory of 4656	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	92
PID 1280 wrote to memory of 2748	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	93
PID 1280 wrote to memory of 2748	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	93
PID 1280 wrote to memory of 3208	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	94
PID 1280 wrote to memory of 3208	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	94
PID 1280 wrote to memory of 2220	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	95
PID 1280 wrote to memory of 2220	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	95
PID 1280 wrote to memory of 4176	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	96
PID 1280 wrote to memory of 4176	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	96
PID 1280 wrote to memory of 4760	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	97
PID 1280 wrote to memory of 4760	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	97
PID 1280 wrote to memory of 5112	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	98
PID 1280 wrote to memory of 5112	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	98
PID 1280 wrote to memory of 1760	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	99
PID 1280 wrote to memory of 1760	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	99
PID 1280 wrote to memory of 1808	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	100
PID 1280 wrote to memory of 1808	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	100
PID 1280 wrote to memory of 456	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	101
PID 1280 wrote to memory of 456	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	101
PID 1280 wrote to memory of 4600	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	102
PID 1280 wrote to memory of 4600	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	102
PID 1280 wrote to memory of 1320	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	103
PID 1280 wrote to memory of 1320	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	103
PID 1280 wrote to memory of 2924	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	104
PID 1280 wrote to memory of 2924	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	104
PID 1280 wrote to memory of 2960	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	105
PID 1280 wrote to memory of 2960	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	105
PID 1280 wrote to memory of 2684	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	106
PID 1280 wrote to memory of 2684	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	106
PID 1280 wrote to memory of 4868	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	107
PID 1280 wrote to memory of 4868	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	107
PID 1280 wrote to memory of 4000	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	108
PID 1280 wrote to memory of 4000	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	108
PID 1280 wrote to memory of 540	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	109
PID 1280 wrote to memory of 540	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	109
PID 1280 wrote to memory of 4608	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	110
PID 1280 wrote to memory of 4608	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	110
PID 1280 wrote to memory of 2296	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	111
PID 1280 wrote to memory of 2296	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	111
PID 1280 wrote to memory of 3960	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	112
PID 1280 wrote to memory of 3960	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	112
PID 1280 wrote to memory of 4396	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	113
PID 1280 wrote to memory of 4396	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	113
PID 1280 wrote to memory of 3984	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	114
PID 1280 wrote to memory of 3984	1280	03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe	114

C:\Users\Admin\AppData\Local\Temp\03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03c1245a42360ca436deb670aeac912e_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5084
- C:\Windows\System\LYKSCAl.exe
  C:\Windows\System\LYKSCAl.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\FuoTRkH.exe
  C:\Windows\System\FuoTRkH.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\CaTaBql.exe
  C:\Windows\System\CaTaBql.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\JKBWjRS.exe
  C:\Windows\System\JKBWjRS.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\LGXcyZy.exe
  C:\Windows\System\LGXcyZy.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\MwWLwaf.exe
  C:\Windows\System\MwWLwaf.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\uxUJOAD.exe
  C:\Windows\System\uxUJOAD.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\buLcUwn.exe
  C:\Windows\System\buLcUwn.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\ZvlueIe.exe
  C:\Windows\System\ZvlueIe.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\tFBEDMl.exe
  C:\Windows\System\tFBEDMl.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\tXYkBJk.exe
  C:\Windows\System\tXYkBJk.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\EMkMbJY.exe
  C:\Windows\System\EMkMbJY.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\pFfJdBI.exe
  C:\Windows\System\pFfJdBI.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\LCPLPcQ.exe
  C:\Windows\System\LCPLPcQ.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\MtxXLPs.exe
  C:\Windows\System\MtxXLPs.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\AwxwCjj.exe
  C:\Windows\System\AwxwCjj.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\MIeFFeH.exe
  C:\Windows\System\MIeFFeH.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\abkDIKW.exe
  C:\Windows\System\abkDIKW.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\QkBLpOG.exe
  C:\Windows\System\QkBLpOG.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\GdriXyO.exe
  C:\Windows\System\GdriXyO.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\VeDMJqK.exe
  C:\Windows\System\VeDMJqK.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\UDCVrup.exe
  C:\Windows\System\UDCVrup.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\yzwRbMt.exe
  C:\Windows\System\yzwRbMt.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\KydqaPU.exe
  C:\Windows\System\KydqaPU.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\Rojteyz.exe
  C:\Windows\System\Rojteyz.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\DuQEDrZ.exe
  C:\Windows\System\DuQEDrZ.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\kVDXaZZ.exe
  C:\Windows\System\kVDXaZZ.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\fvhOoqx.exe
  C:\Windows\System\fvhOoqx.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\yeHTbOn.exe
  C:\Windows\System\yeHTbOn.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\hWxXsSh.exe
  C:\Windows\System\hWxXsSh.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\zEVwoMj.exe
  C:\Windows\System\zEVwoMj.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\QlYTUOd.exe
  C:\Windows\System\QlYTUOd.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\LXzoqkG.exe
  C:\Windows\System\LXzoqkG.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\lPALdHW.exe
  C:\Windows\System\lPALdHW.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\OQruCly.exe
  C:\Windows\System\OQruCly.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\tvuPLBx.exe
  C:\Windows\System\tvuPLBx.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\LONThPo.exe
  C:\Windows\System\LONThPo.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\eDurCIL.exe
  C:\Windows\System\eDurCIL.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\ozhEEEd.exe
  C:\Windows\System\ozhEEEd.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\eLaddDW.exe
  C:\Windows\System\eLaddDW.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\NilTiYb.exe
  C:\Windows\System\NilTiYb.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\mblhItf.exe
  C:\Windows\System\mblhItf.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\JhxoEqm.exe
  C:\Windows\System\JhxoEqm.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\zeSErRN.exe
  C:\Windows\System\zeSErRN.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\JFnCTcj.exe
  C:\Windows\System\JFnCTcj.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\DEGUvGN.exe
  C:\Windows\System\DEGUvGN.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\fpywbso.exe
  C:\Windows\System\fpywbso.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\XmvkOKc.exe
  C:\Windows\System\XmvkOKc.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\xxExzWb.exe
  C:\Windows\System\xxExzWb.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\kMCDxgu.exe
  C:\Windows\System\kMCDxgu.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\CHpglud.exe
  C:\Windows\System\CHpglud.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\fBfjdSN.exe
  C:\Windows\System\fBfjdSN.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\TyazXLy.exe
  C:\Windows\System\TyazXLy.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\XiCcKAE.exe
  C:\Windows\System\XiCcKAE.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\PePnltg.exe
  C:\Windows\System\PePnltg.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\yzLyJit.exe
  C:\Windows\System\yzLyJit.exe
  2⤵
  PID:4576
- C:\Windows\System\XvpQDdf.exe
  C:\Windows\System\XvpQDdf.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\JWDrquM.exe
  C:\Windows\System\JWDrquM.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\xHQxHgc.exe
  C:\Windows\System\xHQxHgc.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\YNIOutp.exe
  C:\Windows\System\YNIOutp.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\AWSUypW.exe
  C:\Windows\System\AWSUypW.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\seQSQUH.exe
  C:\Windows\System\seQSQUH.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\MxurNul.exe
  C:\Windows\System\MxurNul.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\RHSKEMt.exe
  C:\Windows\System\RHSKEMt.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\LSPTelF.exe
  C:\Windows\System\LSPTelF.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\BaKnAyI.exe
  C:\Windows\System\BaKnAyI.exe
  2⤵
  PID:3596
- C:\Windows\System\qsVjTIP.exe
  C:\Windows\System\qsVjTIP.exe
  2⤵
  PID:4852
- C:\Windows\System\Tridnin.exe
  C:\Windows\System\Tridnin.exe
  2⤵
  PID:1580
- C:\Windows\System\iTVxYQL.exe
  C:\Windows\System\iTVxYQL.exe
  2⤵
  PID:3060
- C:\Windows\System\EAcGswJ.exe
  C:\Windows\System\EAcGswJ.exe
  2⤵
  PID:4036
- C:\Windows\System\DbWrYRA.exe
  C:\Windows\System\DbWrYRA.exe
  2⤵
  PID:2240
- C:\Windows\System\WPaHtUD.exe
  C:\Windows\System\WPaHtUD.exe
  2⤵
  PID:2708
- C:\Windows\System\NOMzLGP.exe
  C:\Windows\System\NOMzLGP.exe
  2⤵
  PID:4336
- C:\Windows\System\KOwPLmZ.exe
  C:\Windows\System\KOwPLmZ.exe
  2⤵
  PID:4360
- C:\Windows\System\TRMjKLu.exe
  C:\Windows\System\TRMjKLu.exe
  2⤵
  PID:3168
- C:\Windows\System\oGVAVSD.exe
  C:\Windows\System\oGVAVSD.exe
  2⤵
  PID:1804
- C:\Windows\System\RKuPxTt.exe
  C:\Windows\System\RKuPxTt.exe
  2⤵
  PID:3968
- C:\Windows\System\WvlXEDR.exe
  C:\Windows\System\WvlXEDR.exe
  2⤵
  PID:1188
- C:\Windows\System\QmwtVms.exe
  C:\Windows\System\QmwtVms.exe
  2⤵
  PID:1236
- C:\Windows\System\GMIuguO.exe
  C:\Windows\System\GMIuguO.exe
  2⤵
  PID:3292
- C:\Windows\System\PuqcuGT.exe
  C:\Windows\System\PuqcuGT.exe
  2⤵
  PID:5144
- C:\Windows\System\nRGldlT.exe
  C:\Windows\System\nRGldlT.exe
  2⤵
  PID:5160
- C:\Windows\System\CCNXarG.exe
  C:\Windows\System\CCNXarG.exe
  2⤵
  PID:5188
- C:\Windows\System\OZeOlbo.exe
  C:\Windows\System\OZeOlbo.exe
  2⤵
  PID:5208
- C:\Windows\System\KhAujli.exe
  C:\Windows\System\KhAujli.exe
  2⤵
  PID:5232
- C:\Windows\System\kPnfHvr.exe
  C:\Windows\System\kPnfHvr.exe
  2⤵
  PID:5256
- C:\Windows\System\kaGLXEf.exe
  C:\Windows\System\kaGLXEf.exe
  2⤵
  PID:5280
- C:\Windows\System\lSHqAYh.exe
  C:\Windows\System\lSHqAYh.exe
  2⤵
  PID:5296
- C:\Windows\System\atnjkcU.exe
  C:\Windows\System\atnjkcU.exe
  2⤵
  PID:5320
- C:\Windows\System\BbTZVfd.exe
  C:\Windows\System\BbTZVfd.exe
  2⤵
  PID:5340
- C:\Windows\System\PXEIxZg.exe
  C:\Windows\System\PXEIxZg.exe
  2⤵
  PID:5368
- C:\Windows\System\InLdYLl.exe
  C:\Windows\System\InLdYLl.exe
  2⤵
  PID:5396
- C:\Windows\System\CSCPzuX.exe
  C:\Windows\System\CSCPzuX.exe
  2⤵
  PID:5420
- C:\Windows\System\VUYtWsz.exe
  C:\Windows\System\VUYtWsz.exe
  2⤵
  PID:5444
- C:\Windows\System\DOGkmqX.exe
  C:\Windows\System\DOGkmqX.exe
  2⤵
  PID:5476
- C:\Windows\System\SuSJmVf.exe
  C:\Windows\System\SuSJmVf.exe
  2⤵
  PID:5496
- C:\Windows\System\lXNYFoz.exe
  C:\Windows\System\lXNYFoz.exe
  2⤵
  PID:5516
- C:\Windows\System\QafIcVJ.exe
  C:\Windows\System\QafIcVJ.exe
  2⤵
  PID:5536
- C:\Windows\System\hBeUYXS.exe
  C:\Windows\System\hBeUYXS.exe
  2⤵
  PID:5680
- C:\Windows\System\MzcpSQL.exe
  C:\Windows\System\MzcpSQL.exe
  2⤵
  PID:5696
- C:\Windows\System\OtHHddR.exe
  C:\Windows\System\OtHHddR.exe
  2⤵
  PID:5712
- C:\Windows\System\IZgJNaq.exe
  C:\Windows\System\IZgJNaq.exe
  2⤵
  PID:5728
- C:\Windows\System\gNZDTeN.exe
  C:\Windows\System\gNZDTeN.exe
  2⤵
  PID:5744
- C:\Windows\System\XXqXGUl.exe
  C:\Windows\System\XXqXGUl.exe
  2⤵
  PID:5760
- C:\Windows\System\JfzugHS.exe
  C:\Windows\System\JfzugHS.exe
  2⤵
  PID:5776
- C:\Windows\System\DpfGblP.exe
  C:\Windows\System\DpfGblP.exe
  2⤵
  PID:5792
- C:\Windows\System\MtVhDCM.exe
  C:\Windows\System\MtVhDCM.exe
  2⤵
  PID:5808
- C:\Windows\System\nFudSff.exe
  C:\Windows\System\nFudSff.exe
  2⤵
  PID:5824
- C:\Windows\System\QlQtePS.exe
  C:\Windows\System\QlQtePS.exe
  2⤵
  PID:5840
- C:\Windows\System\GWUAkOC.exe
  C:\Windows\System\GWUAkOC.exe
  2⤵
  PID:5856
- C:\Windows\System\JRZhQvF.exe
  C:\Windows\System\JRZhQvF.exe
  2⤵
  PID:5872
- C:\Windows\System\uDhFCfj.exe
  C:\Windows\System\uDhFCfj.exe
  2⤵
  PID:5916
- C:\Windows\System\OxhzidA.exe
  C:\Windows\System\OxhzidA.exe
  2⤵
  PID:6020
- C:\Windows\System\PWllRjh.exe
  C:\Windows\System\PWllRjh.exe
  2⤵
  PID:6044
- C:\Windows\System\PxWcSnr.exe
  C:\Windows\System\PxWcSnr.exe
  2⤵
  PID:6068
- C:\Windows\System\dzhByzp.exe
  C:\Windows\System\dzhByzp.exe
  2⤵
  PID:6088
- C:\Windows\System\qPqmPla.exe
  C:\Windows\System\qPqmPla.exe
  2⤵
  PID:6116
- C:\Windows\System\dRHpapn.exe
  C:\Windows\System\dRHpapn.exe
  2⤵
  PID:1856
- C:\Windows\System\tCnyKne.exe
  C:\Windows\System\tCnyKne.exe
  2⤵
  PID:1780
- C:\Windows\System\PuDifsw.exe
  C:\Windows\System\PuDifsw.exe
  2⤵
  PID:3940
- C:\Windows\System\UlXuqMf.exe
  C:\Windows\System\UlXuqMf.exe
  2⤵
  PID:5016
- C:\Windows\System\wtFinwN.exe
  C:\Windows\System\wtFinwN.exe
  2⤵
  PID:3200
- C:\Windows\System\yGQYkDc.exe
  C:\Windows\System\yGQYkDc.exe
  2⤵
  PID:4544
- C:\Windows\System\dRMLaHE.exe
  C:\Windows\System\dRMLaHE.exe
  2⤵
  PID:3780
- C:\Windows\System\XWycudR.exe
  C:\Windows\System\XWycudR.exe
  2⤵
  PID:528
- C:\Windows\System\VhhpvMh.exe
  C:\Windows\System\VhhpvMh.exe
  2⤵
  PID:3644
- C:\Windows\System\tFcWqQf.exe
  C:\Windows\System\tFcWqQf.exe
  2⤵
  PID:1332
- C:\Windows\System\MGPDXpv.exe
  C:\Windows\System\MGPDXpv.exe
  2⤵
  PID:3944
- C:\Windows\System\igxGrBH.exe
  C:\Windows\System\igxGrBH.exe
  2⤵
  PID:1000
- C:\Windows\System\ypHIfhl.exe
  C:\Windows\System\ypHIfhl.exe
  2⤵
  PID:2800
- C:\Windows\System\rcKIlvp.exe
  C:\Windows\System\rcKIlvp.exe
  2⤵
  PID:4236
- C:\Windows\System\ptgroVq.exe
  C:\Windows\System\ptgroVq.exe
  2⤵
  PID:1424
- C:\Windows\System\SsaDdNh.exe
  C:\Windows\System\SsaDdNh.exe
  2⤵
  PID:5216
- C:\Windows\System\bmyLOWG.exe
  C:\Windows\System\bmyLOWG.exe
  2⤵
  PID:5364
- C:\Windows\System\walEtwU.exe
  C:\Windows\System\walEtwU.exe
  2⤵
  PID:5508
- C:\Windows\System\FHHuRWM.exe
  C:\Windows\System\FHHuRWM.exe
  2⤵
  PID:3156
- C:\Windows\System\pDVThDS.exe
  C:\Windows\System\pDVThDS.exe
  2⤵
  PID:2272
- C:\Windows\System\hahijxh.exe
  C:\Windows\System\hahijxh.exe
  2⤵
  PID:5156
- C:\Windows\System\LaDrXVN.exe
  C:\Windows\System\LaDrXVN.exe
  2⤵
  PID:5200
- C:\Windows\System\QynqVqt.exe
  C:\Windows\System\QynqVqt.exe
  2⤵
  PID:4192
- C:\Windows\System\yiIyQGC.exe
  C:\Windows\System\yiIyQGC.exe
  2⤵
  PID:6164
- C:\Windows\System\KtlUSBW.exe
  C:\Windows\System\KtlUSBW.exe
  2⤵
  PID:6216
- C:\Windows\System\nhLFQtv.exe
  C:\Windows\System\nhLFQtv.exe
  2⤵
  PID:6244
- C:\Windows\System\DemplZt.exe
  C:\Windows\System\DemplZt.exe
  2⤵
  PID:6292
- C:\Windows\System\qJTKTxV.exe
  C:\Windows\System\qJTKTxV.exe
  2⤵
  PID:6308
- C:\Windows\System\FfCXgJc.exe
  C:\Windows\System\FfCXgJc.exe
  2⤵
  PID:6324
- C:\Windows\System\WLQMXlC.exe
  C:\Windows\System\WLQMXlC.exe
  2⤵
  PID:6344
- C:\Windows\System\hyBwFHt.exe
  C:\Windows\System\hyBwFHt.exe
  2⤵
  PID:6368
- C:\Windows\System\GXcMYCH.exe
  C:\Windows\System\GXcMYCH.exe
  2⤵
  PID:6396
- C:\Windows\System\bRceKbI.exe
  C:\Windows\System\bRceKbI.exe
  2⤵
  PID:6452
- C:\Windows\System\ZKkzxMk.exe
  C:\Windows\System\ZKkzxMk.exe
  2⤵
  PID:6468
- C:\Windows\System\JAQuSPO.exe
  C:\Windows\System\JAQuSPO.exe
  2⤵
  PID:6484
- C:\Windows\System\zHrqgVY.exe
  C:\Windows\System\zHrqgVY.exe
  2⤵
  PID:6500
- C:\Windows\System\VXxaTtv.exe
  C:\Windows\System\VXxaTtv.exe
  2⤵
  PID:6516
- C:\Windows\System\wsgFbeU.exe
  C:\Windows\System\wsgFbeU.exe
  2⤵
  PID:6532
- C:\Windows\System\lMhbBPv.exe
  C:\Windows\System\lMhbBPv.exe
  2⤵
  PID:6552
- C:\Windows\System\EBrabmI.exe
  C:\Windows\System\EBrabmI.exe
  2⤵
  PID:6568
- C:\Windows\System\yQLaWZB.exe
  C:\Windows\System\yQLaWZB.exe
  2⤵
  PID:6584
- C:\Windows\System\qosqGvR.exe
  C:\Windows\System\qosqGvR.exe
  2⤵
  PID:6608
- C:\Windows\System\tqSEDkR.exe
  C:\Windows\System\tqSEDkR.exe
  2⤵
  PID:6624
- C:\Windows\System\GRHyZUL.exe
  C:\Windows\System\GRHyZUL.exe
  2⤵
  PID:6648
- C:\Windows\System\cZJhnUl.exe
  C:\Windows\System\cZJhnUl.exe
  2⤵
  PID:6672
- C:\Windows\System\JdxlyeP.exe
  C:\Windows\System\JdxlyeP.exe
  2⤵
  PID:6692
- C:\Windows\System\UEimOPU.exe
  C:\Windows\System\UEimOPU.exe
  2⤵
  PID:6716
- C:\Windows\System\ffLiYAP.exe
  C:\Windows\System\ffLiYAP.exe
  2⤵
  PID:6732
- C:\Windows\System\JpCSyXE.exe
  C:\Windows\System\JpCSyXE.exe
  2⤵
  PID:6756
- C:\Windows\System\xIqBhfZ.exe
  C:\Windows\System\xIqBhfZ.exe
  2⤵
  PID:6780
- C:\Windows\System\RjhqzmM.exe
  C:\Windows\System\RjhqzmM.exe
  2⤵
  PID:6796
- C:\Windows\System\twpbHet.exe
  C:\Windows\System\twpbHet.exe
  2⤵
  PID:6824
- C:\Windows\System\bLAvpDI.exe
  C:\Windows\System\bLAvpDI.exe
  2⤵
  PID:6844
- C:\Windows\System\EYbbyjX.exe
  C:\Windows\System\EYbbyjX.exe
  2⤵
  PID:6868
- C:\Windows\System\DeeMjVU.exe
  C:\Windows\System\DeeMjVU.exe
  2⤵
  PID:6888
- C:\Windows\System\UFvLxuV.exe
  C:\Windows\System\UFvLxuV.exe
  2⤵
  PID:6908
- C:\Windows\System\xElejiW.exe
  C:\Windows\System\xElejiW.exe
  2⤵
  PID:6928
- C:\Windows\System\SegoSWB.exe
  C:\Windows\System\SegoSWB.exe
  2⤵
  PID:6948
- C:\Windows\System\zkKSBEL.exe
  C:\Windows\System\zkKSBEL.exe
  2⤵
  PID:6964
- C:\Windows\System\zLSUCwX.exe
  C:\Windows\System\zLSUCwX.exe
  2⤵
  PID:6988
- C:\Windows\System\IvzfdUN.exe
  C:\Windows\System\IvzfdUN.exe
  2⤵
  PID:7012
- C:\Windows\System\WtqJCSK.exe
  C:\Windows\System\WtqJCSK.exe
  2⤵
  PID:7028
- C:\Windows\System\uOVSZWj.exe
  C:\Windows\System\uOVSZWj.exe
  2⤵
  PID:7052
- C:\Windows\System\CLNqKUX.exe
  C:\Windows\System\CLNqKUX.exe
  2⤵
  PID:7076
- C:\Windows\System\CpVkzJR.exe
  C:\Windows\System\CpVkzJR.exe
  2⤵
  PID:7092
- C:\Windows\System\qCtnoru.exe
  C:\Windows\System\qCtnoru.exe
  2⤵
  PID:7116
- C:\Windows\System\SshCUPX.exe
  C:\Windows\System\SshCUPX.exe
  2⤵
  PID:7136
- C:\Windows\System\wrRrPve.exe
  C:\Windows\System\wrRrPve.exe
  2⤵
  PID:7160
- C:\Windows\System\hyrNrUr.exe
  C:\Windows\System\hyrNrUr.exe
  2⤵
  PID:3904
- C:\Windows\System\IZTvAqU.exe
  C:\Windows\System\IZTvAqU.exe
  2⤵
  PID:5196
- C:\Windows\System\NvthYFt.exe
  C:\Windows\System\NvthYFt.exe
  2⤵
  PID:6380
- C:\Windows\System\bENfOSt.exe
  C:\Windows\System\bENfOSt.exe
  2⤵
  PID:6236
- C:\Windows\System\otfHnbq.exe
  C:\Windows\System\otfHnbq.exe
  2⤵
  PID:5180
- C:\Windows\System\yDuDxZm.exe
  C:\Windows\System\yDuDxZm.exe
  2⤵
  PID:7176
- C:\Windows\System\JAyYKnK.exe
  C:\Windows\System\JAyYKnK.exe
  2⤵
  PID:7200
- C:\Windows\System\dEnfSYx.exe
  C:\Windows\System\dEnfSYx.exe
  2⤵
  PID:7224
- C:\Windows\System\tjChawD.exe
  C:\Windows\System\tjChawD.exe
  2⤵
  PID:7244
- C:\Windows\System\qYyOeaU.exe
  C:\Windows\System\qYyOeaU.exe
  2⤵
  PID:7264
- C:\Windows\System\mNTijnc.exe
  C:\Windows\System\mNTijnc.exe
  2⤵
  PID:7288
- C:\Windows\System\LgupamL.exe
  C:\Windows\System\LgupamL.exe
  2⤵
  PID:7312
- C:\Windows\System\WcZSWfx.exe
  C:\Windows\System\WcZSWfx.exe
  2⤵
  PID:7332
- C:\Windows\System\EBozXbf.exe
  C:\Windows\System\EBozXbf.exe
  2⤵
  PID:7352
- C:\Windows\System\nuohCsC.exe
  C:\Windows\System\nuohCsC.exe
  2⤵
  PID:7376
- C:\Windows\System\cplGmYn.exe
  C:\Windows\System\cplGmYn.exe
  2⤵
  PID:7400
- C:\Windows\System\RaFhjKe.exe
  C:\Windows\System\RaFhjKe.exe
  2⤵
  PID:7424
- C:\Windows\System\cCFmLNg.exe
  C:\Windows\System\cCFmLNg.exe
  2⤵
  PID:7440
- C:\Windows\System\vvOePdp.exe
  C:\Windows\System\vvOePdp.exe
  2⤵
  PID:7464
- C:\Windows\System\CdhhzDX.exe
  C:\Windows\System\CdhhzDX.exe
  2⤵
  PID:7492
- C:\Windows\System\cAJvRhJ.exe
  C:\Windows\System\cAJvRhJ.exe
  2⤵
  PID:7512
- C:\Windows\System\GIuvZac.exe
  C:\Windows\System\GIuvZac.exe
  2⤵
  PID:7528
- C:\Windows\System\hQSQOFl.exe
  C:\Windows\System\hQSQOFl.exe
  2⤵
  PID:7576
- C:\Windows\System\NStVHam.exe
  C:\Windows\System\NStVHam.exe
  2⤵
  PID:7592
- C:\Windows\System\gzFRICD.exe
  C:\Windows\System\gzFRICD.exe
  2⤵
  PID:7608
- C:\Windows\System\TUZwnML.exe
  C:\Windows\System\TUZwnML.exe
  2⤵
  PID:7624
- C:\Windows\System\AgFEWqV.exe
  C:\Windows\System\AgFEWqV.exe
  2⤵
  PID:7644
- C:\Windows\System\rdSuFUs.exe
  C:\Windows\System\rdSuFUs.exe
  2⤵
  PID:7672
- C:\Windows\System\STqoSbP.exe
  C:\Windows\System\STqoSbP.exe
  2⤵
  PID:7704
- C:\Windows\System\ePAlwab.exe
  C:\Windows\System\ePAlwab.exe
  2⤵
  PID:7724
- C:\Windows\System\vqgGXjE.exe
  C:\Windows\System\vqgGXjE.exe
  2⤵
  PID:7748
- C:\Windows\System\bCcgVha.exe
  C:\Windows\System\bCcgVha.exe
  2⤵
  PID:7772
- C:\Windows\System\jKevRzN.exe
  C:\Windows\System\jKevRzN.exe
  2⤵
  PID:7804
- C:\Windows\System\bsOTRIY.exe
  C:\Windows\System\bsOTRIY.exe
  2⤵
  PID:7824
- C:\Windows\System\GejSUFE.exe
  C:\Windows\System\GejSUFE.exe
  2⤵
  PID:7848
- C:\Windows\System\kLkuHAy.exe
  C:\Windows\System\kLkuHAy.exe
  2⤵
  PID:7868
- C:\Windows\System\NYEtvOg.exe
  C:\Windows\System\NYEtvOg.exe
  2⤵
  PID:7892
- C:\Windows\System\xkreHUu.exe
  C:\Windows\System\xkreHUu.exe
  2⤵
  PID:7908
- C:\Windows\System\DWtPYhM.exe
  C:\Windows\System\DWtPYhM.exe
  2⤵
  PID:7940
- C:\Windows\System\WHuqDHN.exe
  C:\Windows\System\WHuqDHN.exe
  2⤵
  PID:7956
- C:\Windows\System\CSGytVF.exe
  C:\Windows\System\CSGytVF.exe
  2⤵
  PID:7988
- C:\Windows\System\zICHTjp.exe
  C:\Windows\System\zICHTjp.exe
  2⤵
  PID:8016
- C:\Windows\System\jaJEgBj.exe
  C:\Windows\System\jaJEgBj.exe
  2⤵
  PID:8048
- C:\Windows\System\Gdiyjkm.exe
  C:\Windows\System\Gdiyjkm.exe
  2⤵
  PID:8076
- C:\Windows\System\aehUAAt.exe
  C:\Windows\System\aehUAAt.exe
  2⤵
  PID:8104
- C:\Windows\System\xNfxbrH.exe
  C:\Windows\System\xNfxbrH.exe
  2⤵
  PID:8124
- C:\Windows\System\SyTSbZY.exe
  C:\Windows\System\SyTSbZY.exe
  2⤵
  PID:8148
- C:\Windows\System\kOoOkUS.exe
  C:\Windows\System\kOoOkUS.exe
  2⤵
  PID:8164
- C:\Windows\System\UDrQuuZ.exe
  C:\Windows\System\UDrQuuZ.exe
  2⤵
  PID:8188
- C:\Windows\System\SmAsomz.exe
  C:\Windows\System\SmAsomz.exe
  2⤵
  PID:5768
- C:\Windows\System\yvLZper.exe
  C:\Windows\System\yvLZper.exe
  2⤵
  PID:5800
- C:\Windows\System\ygNCorZ.exe
  C:\Windows\System\ygNCorZ.exe
  2⤵
  PID:5976
- C:\Windows\System\sUMefQM.exe
  C:\Windows\System\sUMefQM.exe
  2⤵
  PID:6000
- C:\Windows\System\TIcZOrk.exe
  C:\Windows\System\TIcZOrk.exe
  2⤵
  PID:6084
- C:\Windows\System\unODUEf.exe
  C:\Windows\System\unODUEf.exe
  2⤵
  PID:6140
- C:\Windows\System\YKUCVBF.exe
  C:\Windows\System\YKUCVBF.exe
  2⤵
  PID:3432
- C:\Windows\System\KUEtQqZ.exe
  C:\Windows\System\KUEtQqZ.exe
  2⤵
  PID:3760
- C:\Windows\System\OJBWXBG.exe
  C:\Windows\System\OJBWXBG.exe
  2⤵
  PID:4532
- C:\Windows\System\rzxhhZs.exe
  C:\Windows\System\rzxhhZs.exe
  2⤵
  PID:876
- C:\Windows\System\wiuCxlx.exe
  C:\Windows\System\wiuCxlx.exe
  2⤵
  PID:4144
- C:\Windows\System\vOfsiIp.exe
  C:\Windows\System\vOfsiIp.exe
  2⤵
  PID:1104
- C:\Windows\System\vwuOwXR.exe
  C:\Windows\System\vwuOwXR.exe
  2⤵
  PID:2608
- C:\Windows\System\TiGKZYv.exe
  C:\Windows\System\TiGKZYv.exe
  2⤵
  PID:6788
- C:\Windows\System\dbsmhYk.exe
  C:\Windows\System\dbsmhYk.exe
  2⤵
  PID:6960
- C:\Windows\System\jKvNiRh.exe
  C:\Windows\System\jKvNiRh.exe
  2⤵
  PID:7088
- C:\Windows\System\LCRLMPF.exe
  C:\Windows\System\LCRLMPF.exe
  2⤵
  PID:7132
- C:\Windows\System\qyuuIhB.exe
  C:\Windows\System\qyuuIhB.exe
  2⤵
  PID:5512
- C:\Windows\System\iaHHOkp.exe
  C:\Windows\System\iaHHOkp.exe
  2⤵
  PID:6208
- C:\Windows\System\MqBTdWp.exe
  C:\Windows\System\MqBTdWp.exe
  2⤵
  PID:6320
- C:\Windows\System\LBlfhts.exe
  C:\Windows\System\LBlfhts.exe
  2⤵
  PID:6376
- C:\Windows\System\fxZlhux.exe
  C:\Windows\System\fxZlhux.exe
  2⤵
  PID:6416
- C:\Windows\System\jGqunXI.exe
  C:\Windows\System\jGqunXI.exe
  2⤵
  PID:6996
- C:\Windows\System\usxOQpm.exe
  C:\Windows\System\usxOQpm.exe
  2⤵
  PID:7832
- C:\Windows\System\DTookPE.exe
  C:\Windows\System\DTookPE.exe
  2⤵
  PID:7860
- C:\Windows\System\bGyQIVN.exe
  C:\Windows\System\bGyQIVN.exe
  2⤵
  PID:6444
- C:\Windows\System\aicvzZi.exe
  C:\Windows\System\aicvzZi.exe
  2⤵
  PID:6476
- C:\Windows\System\RLoYDaQ.exe
  C:\Windows\System\RLoYDaQ.exe
  2⤵
  PID:6524
- C:\Windows\System\IeMYaog.exe
  C:\Windows\System\IeMYaog.exe
  2⤵
  PID:8196
- C:\Windows\System\KhqYGIQ.exe
  C:\Windows\System\KhqYGIQ.exe
  2⤵
  PID:8212
- C:\Windows\System\osDqbDc.exe
  C:\Windows\System\osDqbDc.exe
  2⤵
  PID:8236
- C:\Windows\System\TIklaHE.exe
  C:\Windows\System\TIklaHE.exe
  2⤵
  PID:8260
- C:\Windows\System\PmtCDyM.exe
  C:\Windows\System\PmtCDyM.exe
  2⤵
  PID:8276
- C:\Windows\System\SFxsGDw.exe
  C:\Windows\System\SFxsGDw.exe
  2⤵
  PID:8300
- C:\Windows\System\WYwndIW.exe
  C:\Windows\System\WYwndIW.exe
  2⤵
  PID:8324
- C:\Windows\System\PsqMihz.exe
  C:\Windows\System\PsqMihz.exe
  2⤵
  PID:8344
- C:\Windows\System\RpqXQTM.exe
  C:\Windows\System\RpqXQTM.exe
  2⤵
  PID:8368
- C:\Windows\System\AFtrzXK.exe
  C:\Windows\System\AFtrzXK.exe
  2⤵
  PID:8392
- C:\Windows\System\XzfTkQp.exe
  C:\Windows\System\XzfTkQp.exe
  2⤵
  PID:8408
- C:\Windows\System\hvXXfIh.exe
  C:\Windows\System\hvXXfIh.exe
  2⤵
  PID:8432
- C:\Windows\System\OfpFEMN.exe
  C:\Windows\System\OfpFEMN.exe
  2⤵
  PID:8456
- C:\Windows\System\njReFcz.exe
  C:\Windows\System\njReFcz.exe
  2⤵
  PID:8472
- C:\Windows\System\JFbwqbe.exe
  C:\Windows\System\JFbwqbe.exe
  2⤵
  PID:8496
- C:\Windows\System\RTEITpc.exe
  C:\Windows\System\RTEITpc.exe
  2⤵
  PID:8520
- C:\Windows\System\rZEulrt.exe
  C:\Windows\System\rZEulrt.exe
  2⤵
  PID:8536
- C:\Windows\System\CHzWkgS.exe
  C:\Windows\System\CHzWkgS.exe
  2⤵
  PID:8560
- C:\Windows\System\sCysYYX.exe
  C:\Windows\System\sCysYYX.exe
  2⤵
  PID:8584
- C:\Windows\System\icpNmLs.exe
  C:\Windows\System\icpNmLs.exe
  2⤵
  PID:8600
- C:\Windows\System\oDDYnPq.exe
  C:\Windows\System\oDDYnPq.exe
  2⤵
  PID:8624
- C:\Windows\System\GmXAIIv.exe
  C:\Windows\System\GmXAIIv.exe
  2⤵
  PID:8648
- C:\Windows\System\ZgjeyuY.exe
  C:\Windows\System\ZgjeyuY.exe
  2⤵
  PID:8668
- C:\Windows\System\RSAmVCK.exe
  C:\Windows\System\RSAmVCK.exe
  2⤵
  PID:8688
- C:\Windows\System\sNCVSwy.exe
  C:\Windows\System\sNCVSwy.exe
  2⤵
  PID:8712
- C:\Windows\System\qMaapnQ.exe
  C:\Windows\System\qMaapnQ.exe
  2⤵
  PID:8732
- C:\Windows\System\jjNgPYu.exe
  C:\Windows\System\jjNgPYu.exe
  2⤵
  PID:8832
- C:\Windows\System\KrSfryC.exe
  C:\Windows\System\KrSfryC.exe
  2⤵
  PID:8856
- C:\Windows\System\efBhsAr.exe
  C:\Windows\System\efBhsAr.exe
  2⤵
  PID:8876
- C:\Windows\System\OVBhDPR.exe
  C:\Windows\System\OVBhDPR.exe
  2⤵
  PID:8900
- C:\Windows\System\Sxrmxhx.exe
  C:\Windows\System\Sxrmxhx.exe
  2⤵
  PID:8924
- C:\Windows\System\rgZNNHd.exe
  C:\Windows\System\rgZNNHd.exe
  2⤵
  PID:8940
- C:\Windows\System\JuqDUeE.exe
  C:\Windows\System\JuqDUeE.exe
  2⤵
  PID:8964
- C:\Windows\System\sjLNmhF.exe
  C:\Windows\System\sjLNmhF.exe
  2⤵
  PID:9000
- C:\Windows\System\LiIwHJx.exe
  C:\Windows\System\LiIwHJx.exe
  2⤵
  PID:9024
- C:\Windows\System\aLJeMVH.exe
  C:\Windows\System\aLJeMVH.exe
  2⤵
  PID:9048
- C:\Windows\System\eKcmWNz.exe
  C:\Windows\System\eKcmWNz.exe
  2⤵
  PID:9072
- C:\Windows\System\pusopmR.exe
  C:\Windows\System\pusopmR.exe
  2⤵
  PID:9184
- C:\Windows\System\CWeRGhV.exe
  C:\Windows\System\CWeRGhV.exe
  2⤵
  PID:9212
- C:\Windows\System\CxvtFNN.exe
  C:\Windows\System\CxvtFNN.exe
  2⤵
  PID:6596
- C:\Windows\System\HsxwDTt.exe
  C:\Windows\System\HsxwDTt.exe
  2⤵
  PID:6656
- C:\Windows\System\fJEsuUU.exe
  C:\Windows\System\fJEsuUU.exe
  2⤵
  PID:6708
- C:\Windows\System\AajrpWq.exe
  C:\Windows\System\AajrpWq.exe
  2⤵
  PID:6748
- C:\Windows\System\yfLHTEH.exe
  C:\Windows\System\yfLHTEH.exe
  2⤵
  PID:6792
- C:\Windows\System\wNGDOGK.exe
  C:\Windows\System\wNGDOGK.exe
  2⤵
  PID:6832
- C:\Windows\System\ckGzrLA.exe
  C:\Windows\System\ckGzrLA.exe
  2⤵
  PID:6904
- C:\Windows\System\XYrOzaD.exe
  C:\Windows\System\XYrOzaD.exe
  2⤵
  PID:7024
- C:\Windows\System\nJyPSKw.exe
  C:\Windows\System\nJyPSKw.exe
  2⤵
  PID:7048
- C:\Windows\System\PflYGSu.exe
  C:\Windows\System\PflYGSu.exe
  2⤵
  PID:7152
- C:\Windows\System\tiSeedQ.exe
  C:\Windows\System\tiSeedQ.exe
  2⤵
  PID:4240
- C:\Windows\System\oAgGlBQ.exe
  C:\Windows\System\oAgGlBQ.exe
  2⤵
  PID:7184
- C:\Windows\System\DyBQNjs.exe
  C:\Windows\System\DyBQNjs.exe
  2⤵
  PID:7240
- C:\Windows\System\ILhSooO.exe
  C:\Windows\System\ILhSooO.exe
  2⤵
  PID:7280
- C:\Windows\System\pafsFVU.exe
  C:\Windows\System\pafsFVU.exe
  2⤵
  PID:7360
- C:\Windows\System\xjPXZTd.exe
  C:\Windows\System\xjPXZTd.exe
  2⤵
  PID:7304
- C:\Windows\System\TIlRMDq.exe
  C:\Windows\System\TIlRMDq.exe
  2⤵
  PID:3852
- C:\Windows\System\zVdNasd.exe
  C:\Windows\System\zVdNasd.exe
  2⤵
  PID:5704
- C:\Windows\System\fJdWTDp.exe
  C:\Windows\System\fJdWTDp.exe
  2⤵
  PID:7436
- C:\Windows\System\ZQKsZYj.exe
  C:\Windows\System\ZQKsZYj.exe
  2⤵
  PID:7500
- C:\Windows\System\xkFgGbp.exe
  C:\Windows\System\xkFgGbp.exe
  2⤵
  PID:7536
- C:\Windows\System\hcdeEJs.exe
  C:\Windows\System\hcdeEJs.exe
  2⤵
  PID:6924
- C:\Windows\System\wgiLuKk.exe
  C:\Windows\System\wgiLuKk.exe
  2⤵
  PID:2848
- C:\Windows\System\vMNBbYS.exe
  C:\Windows\System\vMNBbYS.exe
  2⤵
  PID:7812
- C:\Windows\System\DsQrGts.exe
  C:\Windows\System\DsQrGts.exe
  2⤵
  PID:8336
- C:\Windows\System\PMQToRk.exe
  C:\Windows\System\PMQToRk.exe
  2⤵
  PID:7600
- C:\Windows\System\TqcvVBf.exe
  C:\Windows\System\TqcvVBf.exe
  2⤵
  PID:7696
- C:\Windows\System\SgdcbKX.exe
  C:\Windows\System\SgdcbKX.exe
  2⤵
  PID:7732
- C:\Windows\System\WhRwptC.exe
  C:\Windows\System\WhRwptC.exe
  2⤵
  PID:8468
- C:\Windows\System\gkwFXoJ.exe
  C:\Windows\System\gkwFXoJ.exe
  2⤵
  PID:5868
- C:\Windows\System\hFVcXZp.exe
  C:\Windows\System\hFVcXZp.exe
  2⤵
  PID:8608
- C:\Windows\System\xNeiHTY.exe
  C:\Windows\System\xNeiHTY.exe
  2⤵
  PID:3324
- C:\Windows\System\RGDUxsz.exe
  C:\Windows\System\RGDUxsz.exe
  2⤵
  PID:7876
- C:\Windows\System\PfvNAXL.exe
  C:\Windows\System\PfvNAXL.exe
  2⤵
  PID:8708
- C:\Windows\System\hVCmTOX.exe
  C:\Windows\System\hVCmTOX.exe
  2⤵
  PID:7964
- C:\Windows\System\heaPLoz.exe
  C:\Windows\System\heaPLoz.exe
  2⤵
  PID:8000
- C:\Windows\System\UqvhuXp.exe
  C:\Windows\System\UqvhuXp.exe
  2⤵
  PID:4636
- C:\Windows\System\XiEKvGY.exe
  C:\Windows\System\XiEKvGY.exe
  2⤵
  PID:8800
- C:\Windows\System\GfefCmE.exe
  C:\Windows\System\GfefCmE.exe
  2⤵
  PID:9240
- C:\Windows\System\SRaqumB.exe
  C:\Windows\System\SRaqumB.exe
  2⤵
  PID:9260
- C:\Windows\System\XgHmDTJ.exe
  C:\Windows\System\XgHmDTJ.exe
  2⤵
  PID:9444
- C:\Windows\System\QoEZgsi.exe
  C:\Windows\System\QoEZgsi.exe
  2⤵
  PID:9484
- C:\Windows\System\LbAWwmx.exe
  C:\Windows\System\LbAWwmx.exe
  2⤵
  PID:9504
- C:\Windows\System\PIQaFrT.exe
  C:\Windows\System\PIQaFrT.exe
  2⤵
  PID:9520
- C:\Windows\System\yhPmrzP.exe
  C:\Windows\System\yhPmrzP.exe
  2⤵
  PID:9544
- C:\Windows\System\WaHOlzD.exe
  C:\Windows\System\WaHOlzD.exe
  2⤵
  PID:9568
- C:\Windows\System\RWfcCRl.exe
  C:\Windows\System\RWfcCRl.exe
  2⤵
  PID:9592
- C:\Windows\System\AVsGpWj.exe
  C:\Windows\System\AVsGpWj.exe
  2⤵
  PID:9608
- C:\Windows\System\bAeVtVL.exe
  C:\Windows\System\bAeVtVL.exe
  2⤵
  PID:9628
- C:\Windows\System\KImKyyw.exe
  C:\Windows\System\KImKyyw.exe
  2⤵
  PID:9648
- C:\Windows\System\CKmFdCg.exe
  C:\Windows\System\CKmFdCg.exe
  2⤵
  PID:9676
- C:\Windows\System\mAppAdK.exe
  C:\Windows\System\mAppAdK.exe
  2⤵
  PID:9696
- C:\Windows\System\PzEAJBQ.exe
  C:\Windows\System\PzEAJBQ.exe
  2⤵
  PID:9712
- C:\Windows\System\vsnbpDV.exe
  C:\Windows\System\vsnbpDV.exe
  2⤵
  PID:9728
- C:\Windows\System\YNdocrS.exe
  C:\Windows\System\YNdocrS.exe
  2⤵
  PID:9744
- C:\Windows\System\PUcjUXp.exe
  C:\Windows\System\PUcjUXp.exe
  2⤵
  PID:9760
- C:\Windows\System\jXVvaqr.exe
  C:\Windows\System\jXVvaqr.exe
  2⤵
  PID:9776
- C:\Windows\System\IVEPuRf.exe
  C:\Windows\System\IVEPuRf.exe
  2⤵
  PID:9792
- C:\Windows\System\jgBgyHu.exe
  C:\Windows\System\jgBgyHu.exe
  2⤵
  PID:9812
- C:\Windows\System\ujZrbFg.exe
  C:\Windows\System\ujZrbFg.exe
  2⤵
  PID:9836
- C:\Windows\System\COGXUmp.exe
  C:\Windows\System\COGXUmp.exe
  2⤵
  PID:9860
- C:\Windows\System\EbqcvCw.exe
  C:\Windows\System\EbqcvCw.exe
  2⤵
  PID:9880
- C:\Windows\System\LeaBecW.exe
  C:\Windows\System\LeaBecW.exe
  2⤵
  PID:9900
- C:\Windows\System\fvRcEIf.exe
  C:\Windows\System\fvRcEIf.exe
  2⤵
  PID:9924
- C:\Windows\System\kjqSFiQ.exe
  C:\Windows\System\kjqSFiQ.exe
  2⤵
  PID:9948
- C:\Windows\System\nsyRKHd.exe
  C:\Windows\System\nsyRKHd.exe
  2⤵
  PID:9968
- C:\Windows\System\JrNBYFq.exe
  C:\Windows\System\JrNBYFq.exe
  2⤵
  PID:9988
- C:\Windows\System\gHWKaJB.exe
  C:\Windows\System\gHWKaJB.exe
  2⤵
  PID:10008
- C:\Windows\System\wCZByUw.exe
  C:\Windows\System\wCZByUw.exe
  2⤵
  PID:10024
- C:\Windows\System\TLCQugW.exe
  C:\Windows\System\TLCQugW.exe
  2⤵
  PID:10052
- C:\Windows\System\ADnKKMG.exe
  C:\Windows\System\ADnKKMG.exe
  2⤵
  PID:10072
- C:\Windows\System\MxButEW.exe
  C:\Windows\System\MxButEW.exe
  2⤵
  PID:10092
- C:\Windows\System\HoZdwwW.exe
  C:\Windows\System\HoZdwwW.exe
  2⤵
  PID:10120
- C:\Windows\System\YPvwiZS.exe
  C:\Windows\System\YPvwiZS.exe
  2⤵
  PID:10144
- C:\Windows\System\tuMPiwC.exe
  C:\Windows\System\tuMPiwC.exe
  2⤵
  PID:10160
- C:\Windows\System\USpBPZr.exe
  C:\Windows\System\USpBPZr.exe
  2⤵
  PID:10188
- C:\Windows\System\ABXIEXA.exe
  C:\Windows\System\ABXIEXA.exe
  2⤵
  PID:10204
- C:\Windows\System\DfIufPx.exe
  C:\Windows\System\DfIufPx.exe
  2⤵
  PID:10232
- C:\Windows\System\VTpVYrW.exe
  C:\Windows\System\VTpVYrW.exe
  2⤵
  PID:4708
- C:\Windows\System\fSeDbov.exe
  C:\Windows\System\fSeDbov.exe
  2⤵
  PID:9032
- C:\Windows\System\qDYhBLe.exe
  C:\Windows\System\qDYhBLe.exe
  2⤵
  PID:6776
- C:\Windows\System\jClgWqV.exe
  C:\Windows\System\jClgWqV.exe
  2⤵
  PID:8848
- C:\Windows\System\UsFvhIW.exe
  C:\Windows\System\UsFvhIW.exe
  2⤵
  PID:9016
- C:\Windows\System\jXmTxZv.exe
  C:\Windows\System\jXmTxZv.exe
  2⤵
  PID:6632
- C:\Windows\System\lrdpDqZ.exe
  C:\Windows\System\lrdpDqZ.exe
  2⤵
  PID:7004
- C:\Windows\System\ltUMZNN.exe
  C:\Windows\System\ltUMZNN.exe
  2⤵
  PID:8448
- C:\Windows\System\sDyRaqi.exe
  C:\Windows\System\sDyRaqi.exe
  2⤵
  PID:8532
- C:\Windows\System\eBovnFW.exe
  C:\Windows\System\eBovnFW.exe
  2⤵
  PID:548
- C:\Windows\System\BxYRSTw.exe
  C:\Windows\System\BxYRSTw.exe
  2⤵
  PID:7476
- C:\Windows\System\qDRMKhj.exe
  C:\Windows\System\qDRMKhj.exe
  2⤵
  PID:7524
- C:\Windows\System\JKIvcvT.exe
  C:\Windows\System\JKIvcvT.exe
  2⤵
  PID:860
- C:\Windows\System\xuHJkPU.exe
  C:\Windows\System\xuHJkPU.exe
  2⤵
  PID:7616
- C:\Windows\System\PqxkklF.exe
  C:\Windows\System\PqxkklF.exe
  2⤵
  PID:8544
- C:\Windows\System\OiqRWjq.exe
  C:\Windows\System\OiqRWjq.exe
  2⤵
  PID:5996
- C:\Windows\System\QlVDphd.exe
  C:\Windows\System\QlVDphd.exe
  2⤵
  PID:6080
- C:\Windows\System\FaPZNCc.exe
  C:\Windows\System\FaPZNCc.exe
  2⤵
  PID:8780
- C:\Windows\System\GEZayfW.exe
  C:\Windows\System\GEZayfW.exe
  2⤵
  PID:9220
- C:\Windows\System\Fyldiqw.exe
  C:\Windows\System\Fyldiqw.exe
  2⤵
  PID:388
- C:\Windows\System\YQCNniZ.exe
  C:\Windows\System\YQCNniZ.exe
  2⤵
  PID:8896
- C:\Windows\System\XFGBzvc.exe
  C:\Windows\System\XFGBzvc.exe
  2⤵
  PID:5464
- C:\Windows\System\tBywccV.exe
  C:\Windows\System\tBywccV.exe
  2⤵
  PID:7128
- C:\Windows\System\dkZTvQH.exe
  C:\Windows\System\dkZTvQH.exe
  2⤵
  PID:9356
- C:\Windows\System\ksIZESE.exe
  C:\Windows\System\ksIZESE.exe
  2⤵
  PID:6408
- C:\Windows\System\EUAIasU.exe
  C:\Windows\System\EUAIasU.exe
  2⤵
  PID:10256
- C:\Windows\System\BpjeAoQ.exe
  C:\Windows\System\BpjeAoQ.exe
  2⤵
  PID:10292
- C:\Windows\System\UZqdEwZ.exe
  C:\Windows\System\UZqdEwZ.exe
  2⤵
  PID:10308
- C:\Windows\System\ivTDIux.exe
  C:\Windows\System\ivTDIux.exe
  2⤵
  PID:10324
- C:\Windows\System\baPSjQF.exe
  C:\Windows\System\baPSjQF.exe
  2⤵
  PID:10340
- C:\Windows\System\RtQkgtT.exe
  C:\Windows\System\RtQkgtT.exe
  2⤵
  PID:10360
- C:\Windows\System\tbRgOwC.exe
  C:\Windows\System\tbRgOwC.exe
  2⤵
  PID:10376
- C:\Windows\System\ZYzVOxy.exe
  C:\Windows\System\ZYzVOxy.exe
  2⤵
  PID:10400
- C:\Windows\System\gMESkbz.exe
  C:\Windows\System\gMESkbz.exe
  2⤵
  PID:10436
- C:\Windows\System\ecombXL.exe
  C:\Windows\System\ecombXL.exe
  2⤵
  PID:10460
- C:\Windows\System\DTnUFAZ.exe
  C:\Windows\System\DTnUFAZ.exe
  2⤵
  PID:10484
- C:\Windows\System\YbxIVup.exe
  C:\Windows\System\YbxIVup.exe
  2⤵
  PID:10512
- C:\Windows\System\GeiXnlk.exe
  C:\Windows\System\GeiXnlk.exe
  2⤵
  PID:10528
- C:\Windows\System\mqUeqAO.exe
  C:\Windows\System\mqUeqAO.exe
  2⤵
  PID:10548
- C:\Windows\System\SRwFRDE.exe
  C:\Windows\System\SRwFRDE.exe
  2⤵
  PID:10584
- C:\Windows\System\SDqVbOB.exe
  C:\Windows\System\SDqVbOB.exe
  2⤵
  PID:10600
- C:\Windows\System\HzCPJiJ.exe
  C:\Windows\System\HzCPJiJ.exe
  2⤵
  PID:10616
- C:\Windows\System\PnKwZDn.exe
  C:\Windows\System\PnKwZDn.exe
  2⤵
  PID:10632
- C:\Windows\System\jEMhliN.exe
  C:\Windows\System\jEMhliN.exe
  2⤵
  PID:10652
- C:\Windows\System\AIjsxpY.exe
  C:\Windows\System\AIjsxpY.exe
  2⤵
  PID:10668
- C:\Windows\System\stWhhgc.exe
  C:\Windows\System\stWhhgc.exe
  2⤵
  PID:10692
- C:\Windows\System\MANhZdJ.exe
  C:\Windows\System\MANhZdJ.exe
  2⤵
  PID:10724
- C:\Windows\System\DyvFknq.exe
  C:\Windows\System\DyvFknq.exe
  2⤵
  PID:10744
- C:\Windows\System\SXtNCTd.exe
  C:\Windows\System\SXtNCTd.exe
  2⤵
  PID:10764
- C:\Windows\System\mnrrRxg.exe
  C:\Windows\System\mnrrRxg.exe
  2⤵
  PID:10780
- C:\Windows\System\BGjguiv.exe
  C:\Windows\System\BGjguiv.exe
  2⤵
  PID:10796
- C:\Windows\System\zCjQbNT.exe
  C:\Windows\System\zCjQbNT.exe
  2⤵
  PID:10816
- C:\Windows\System\UYoeaEQ.exe
  C:\Windows\System\UYoeaEQ.exe
  2⤵
  PID:10844
- C:\Windows\System\jVCbyUD.exe
  C:\Windows\System\jVCbyUD.exe
  2⤵
  PID:10864
- C:\Windows\System\nTpwMZL.exe
  C:\Windows\System\nTpwMZL.exe
  2⤵
  PID:10884
- C:\Windows\System\UwUBJnQ.exe
  C:\Windows\System\UwUBJnQ.exe
  2⤵
  PID:10904
- C:\Windows\System\QrZDnAb.exe
  C:\Windows\System\QrZDnAb.exe
  2⤵
  PID:10928
- C:\Windows\System\vxDWjsu.exe
  C:\Windows\System\vxDWjsu.exe
  2⤵
  PID:10952
- C:\Windows\System\TwdMocm.exe
  C:\Windows\System\TwdMocm.exe
  2⤵
  PID:10968
- C:\Windows\System\TTXajaV.exe
  C:\Windows\System\TTXajaV.exe
  2⤵
  PID:10992
- C:\Windows\System\bBdfuYA.exe
  C:\Windows\System\bBdfuYA.exe
  2⤵
  PID:11016
- C:\Windows\System\rperGYx.exe
  C:\Windows\System\rperGYx.exe
  2⤵
  PID:11040
- C:\Windows\System\Ubbvizw.exe
  C:\Windows\System\Ubbvizw.exe
  2⤵
  PID:11060
- C:\Windows\System\EKteaTL.exe
  C:\Windows\System\EKteaTL.exe
  2⤵
  PID:11080
- C:\Windows\System\AxkIVVu.exe
  C:\Windows\System\AxkIVVu.exe
  2⤵
  PID:11100
- C:\Windows\System\iVXbiJd.exe
  C:\Windows\System\iVXbiJd.exe
  2⤵
  PID:11124
- C:\Windows\System\IrhvAzB.exe
  C:\Windows\System\IrhvAzB.exe
  2⤵
  PID:11144
- C:\Windows\System\rMumjgj.exe
  C:\Windows\System\rMumjgj.exe
  2⤵
  PID:11164
- C:\Windows\System\jnHIrXb.exe
  C:\Windows\System\jnHIrXb.exe
  2⤵
  PID:11184
- C:\Windows\System\YYnJLsb.exe
  C:\Windows\System\YYnJLsb.exe
  2⤵
  PID:11208
- C:\Windows\System\yOHqNXm.exe
  C:\Windows\System\yOHqNXm.exe
  2⤵
  PID:11228
- C:\Windows\System\SOveZhP.exe
  C:\Windows\System\SOveZhP.exe
  2⤵
  PID:11244
- C:\Windows\System\PPwZHpr.exe
  C:\Windows\System\PPwZHpr.exe
  2⤵
  PID:8160
- C:\Windows\System\ypyBHbn.exe
  C:\Windows\System\ypyBHbn.exe
  2⤵
  PID:6512
- C:\Windows\System\fceJMZl.exe
  C:\Windows\System\fceJMZl.exe
  2⤵
  PID:8208
- C:\Windows\System\BgLjLoo.exe
  C:\Windows\System\BgLjLoo.exe
  2⤵
  PID:8256
- C:\Windows\System\tiqiXuv.exe
  C:\Windows\System\tiqiXuv.exe
  2⤵
  PID:9164
- C:\Windows\System\nAnnOcw.exe
  C:\Windows\System\nAnnOcw.exe
  2⤵
  PID:6620
- C:\Windows\System\qlQjyqs.exe
  C:\Windows\System\qlQjyqs.exe
  2⤵
  PID:6740
- C:\Windows\System\GTuBJbE.exe
  C:\Windows\System\GTuBJbE.exe
  2⤵
  PID:7792
- C:\Windows\System\qjCzxlc.exe
  C:\Windows\System\qjCzxlc.exe
  2⤵
  PID:7344
- C:\Windows\System\uiaUezM.exe
  C:\Windows\System\uiaUezM.exe
  2⤵
  PID:9824
- C:\Windows\System\IMviAgP.exe
  C:\Windows\System\IMviAgP.exe
  2⤵
  PID:9984
- C:\Windows\System\KuzTZwQ.exe
  C:\Windows\System\KuzTZwQ.exe
  2⤵
  PID:8704
- C:\Windows\System\BGdomDD.exe
  C:\Windows\System\BGdomDD.exe
  2⤵
  PID:5788
- C:\Windows\System\kuqpNtH.exe
  C:\Windows\System\kuqpNtH.exe
  2⤵
  PID:9344
- C:\Windows\System\reAeiNq.exe
  C:\Windows\System\reAeiNq.exe
  2⤵
  PID:8696
- C:\Windows\System\ZEUsGsW.exe
  C:\Windows\System\ZEUsGsW.exe
  2⤵
  PID:9432
- C:\Windows\System\CLadEiS.exe
  C:\Windows\System\CLadEiS.exe
  2⤵
  PID:9536
- C:\Windows\System\XCVeVig.exe
  C:\Windows\System\XCVeVig.exe
  2⤵
  PID:9624
- C:\Windows\System\WdQByot.exe
  C:\Windows\System\WdQByot.exe
  2⤵
  PID:9800
- C:\Windows\System\zKMwyfz.exe
  C:\Windows\System\zKMwyfz.exe
  2⤵
  PID:10032
- C:\Windows\System\npSXsSh.exe
  C:\Windows\System\npSXsSh.exe
  2⤵
  PID:10112
- C:\Windows\System\RySwntS.exe
  C:\Windows\System\RySwntS.exe
  2⤵
  PID:10184
- C:\Windows\System\lZvGsEk.exe
  C:\Windows\System\lZvGsEk.exe
  2⤵
  PID:8868
- C:\Windows\System\vvaWCTh.exe
  C:\Windows\System\vvaWCTh.exe
  2⤵
  PID:9196
- C:\Windows\System\fPomQYl.exe
  C:\Windows\System\fPomQYl.exe
  2⤵
  PID:5328
- C:\Windows\System\Krviulr.exe
  C:\Windows\System\Krviulr.exe
  2⤵
  PID:1872
- C:\Windows\System\shjhPER.exe
  C:\Windows\System\shjhPER.exe
  2⤵
  PID:8768
- C:\Windows\System\lTkdoVc.exe
  C:\Windows\System\lTkdoVc.exe
  2⤵
  PID:6128
- C:\Windows\System\EjSwoHz.exe
  C:\Windows\System\EjSwoHz.exe
  2⤵
  PID:8820
- C:\Windows\System\hJHszpN.exe
  C:\Windows\System\hJHszpN.exe
  2⤵
  PID:8960
- C:\Windows\System\SYErjRl.exe
  C:\Windows\System\SYErjRl.exe
  2⤵
  PID:7112
- C:\Windows\System\KgcnlnU.exe
  C:\Windows\System\KgcnlnU.exe
  2⤵
  PID:672
- C:\Windows\System\sivgHxr.exe
  C:\Windows\System\sivgHxr.exe
  2⤵
  PID:10252
- C:\Windows\System\QBozjDC.exe
  C:\Windows\System\QBozjDC.exe
  2⤵
  PID:10304
- C:\Windows\System\SckvmQm.exe
  C:\Windows\System\SckvmQm.exe
  2⤵
  PID:10352
- C:\Windows\System\FBgiXHJ.exe
  C:\Windows\System\FBgiXHJ.exe
  2⤵
  PID:10396
- C:\Windows\System\PgDjndb.exe
  C:\Windows\System\PgDjndb.exe
  2⤵
  PID:10452
- C:\Windows\System\KkPlIvQ.exe
  C:\Windows\System\KkPlIvQ.exe
  2⤵
  PID:10508
- C:\Windows\System\wxbPpko.exe
  C:\Windows\System\wxbPpko.exe
  2⤵
  PID:10544
- C:\Windows\System\sMafYGY.exe
  C:\Windows\System\sMafYGY.exe
  2⤵
  PID:10580
- C:\Windows\System\nFUaasL.exe
  C:\Windows\System\nFUaasL.exe
  2⤵
  PID:10624
- C:\Windows\System\KKzCCib.exe
  C:\Windows\System\KKzCCib.exe
  2⤵
  PID:10676
- C:\Windows\System\eGTdxZb.exe
  C:\Windows\System\eGTdxZb.exe
  2⤵
  PID:10708
- C:\Windows\System\WEymJnl.exe
  C:\Windows\System\WEymJnl.exe
  2⤵
  PID:10772
- C:\Windows\System\FXmszvf.exe
  C:\Windows\System\FXmszvf.exe
  2⤵
  PID:10824
- C:\Windows\System\qRSGKOH.exe
  C:\Windows\System\qRSGKOH.exe
  2⤵
  PID:10860
- C:\Windows\System\gkwamHe.exe
  C:\Windows\System\gkwamHe.exe
  2⤵
  PID:10900
- C:\Windows\System\TRFKsPq.exe
  C:\Windows\System\TRFKsPq.exe
  2⤵
  PID:10960
- C:\Windows\System\wIEPeAy.exe
  C:\Windows\System\wIEPeAy.exe
  2⤵
  PID:11000
- C:\Windows\System\shjPsFy.exe
  C:\Windows\System\shjPsFy.exe
  2⤵
  PID:11048
- C:\Windows\System\qmuhdfV.exe
  C:\Windows\System\qmuhdfV.exe
  2⤵
  PID:11092
- C:\Windows\System\LCvlRGS.exe
  C:\Windows\System\LCvlRGS.exe
  2⤵
  PID:11140
- C:\Windows\System\WfBIBZK.exe
  C:\Windows\System\WfBIBZK.exe
  2⤵
  PID:11176
- C:\Windows\System\qNMinmp.exe
  C:\Windows\System\qNMinmp.exe
  2⤵
  PID:11216
- C:\Windows\System\EYRLYNB.exe
  C:\Windows\System\EYRLYNB.exe
  2⤵
  PID:11236
- C:\Windows\System\ycSuIYr.exe
  C:\Windows\System\ycSuIYr.exe
  2⤵
  PID:8232
- C:\Windows\System\boUxrWA.exe
  C:\Windows\System\boUxrWA.exe
  2⤵
  PID:9516
- C:\Windows\System\LQLLkkz.exe
  C:\Windows\System\LQLLkkz.exe
  2⤵
  PID:9564
- C:\Windows\System\edmkolj.exe
  C:\Windows\System\edmkolj.exe
  2⤵
  PID:8440
- C:\Windows\System\KXEyFkg.exe
  C:\Windows\System\KXEyFkg.exe
  2⤵
  PID:9784
- C:\Windows\System\okgSwjV.exe
  C:\Windows\System\okgSwjV.exe
  2⤵
  PID:4476
- C:\Windows\System\JZdlmbV.exe
  C:\Windows\System\JZdlmbV.exe
  2⤵
  PID:4736
- C:\Windows\System\GTjoRIX.exe
  C:\Windows\System\GTjoRIX.exe
  2⤵
  PID:3632
- C:\Windows\System\NZbYZeJ.exe
  C:\Windows\System\NZbYZeJ.exe
  2⤵
  PID:3348
- C:\Windows\System\bQxXabu.exe
  C:\Windows\System\bQxXabu.exe
  2⤵
  PID:4504
- C:\Windows\System\kFnUmSc.exe
  C:\Windows\System\kFnUmSc.exe
  2⤵
  PID:1340
- C:\Windows\System\AwAjUhW.exe
  C:\Windows\System\AwAjUhW.exe
  2⤵
  PID:9416
- C:\Windows\System\nJyBRGM.exe
  C:\Windows\System\nJyBRGM.exe
  2⤵
  PID:9620
- C:\Windows\System\PNUGSeg.exe
  C:\Windows\System\PNUGSeg.exe
  2⤵
  PID:4340
- C:\Windows\System\IXnACwn.exe
  C:\Windows\System\IXnACwn.exe
  2⤵
  PID:10200
- C:\Windows\System\WktDsvw.exe
  C:\Windows\System\WktDsvw.exe
  2⤵
  PID:8992
- C:\Windows\System\YyVJnMm.exe
  C:\Windows\System\YyVJnMm.exe
  2⤵
  PID:8576
- C:\Windows\System\nZAemLR.exe
  C:\Windows\System\nZAemLR.exe
  2⤵
  PID:4824
- C:\Windows\System\hxMLPVF.exe
  C:\Windows\System\hxMLPVF.exe
  2⤵
  PID:6304
- C:\Windows\System\lgDXTkT.exe
  C:\Windows\System\lgDXTkT.exe
  2⤵
  PID:11272
- C:\Windows\System\TcxcGaS.exe
  C:\Windows\System\TcxcGaS.exe
  2⤵
  PID:11292
- C:\Windows\System\bgbENdG.exe
  C:\Windows\System\bgbENdG.exe
  2⤵
  PID:11312
- C:\Windows\System\poCzhjN.exe
  C:\Windows\System\poCzhjN.exe
  2⤵
  PID:11340
- C:\Windows\System\GWAlgkP.exe
  C:\Windows\System\GWAlgkP.exe
  2⤵
  PID:11360
- C:\Windows\System\WYbeAxT.exe
  C:\Windows\System\WYbeAxT.exe
  2⤵
  PID:11380
- C:\Windows\System\jylgiBv.exe
  C:\Windows\System\jylgiBv.exe
  2⤵
  PID:11404
- C:\Windows\System\kPIFspd.exe
  C:\Windows\System\kPIFspd.exe
  2⤵
  PID:11420
- C:\Windows\System\jpVBGru.exe
  C:\Windows\System\jpVBGru.exe
  2⤵
  PID:11444
- C:\Windows\System\LRqVdBg.exe
  C:\Windows\System\LRqVdBg.exe
  2⤵
  PID:11464
- C:\Windows\System\ZjLMDbu.exe
  C:\Windows\System\ZjLMDbu.exe
  2⤵
  PID:11480
- C:\Windows\System\Ybishod.exe
  C:\Windows\System\Ybishod.exe
  2⤵
  PID:11500
- C:\Windows\System\jfZEkMl.exe
  C:\Windows\System\jfZEkMl.exe
  2⤵
  PID:11520
- C:\Windows\System\WjZYPWE.exe
  C:\Windows\System\WjZYPWE.exe
  2⤵
  PID:11540
- C:\Windows\System\STmgHvD.exe
  C:\Windows\System\STmgHvD.exe
  2⤵
  PID:11560
- C:\Windows\System\BkMeUwk.exe
  C:\Windows\System\BkMeUwk.exe
  2⤵
  PID:11584
- C:\Windows\System\ufyXoIa.exe
  C:\Windows\System\ufyXoIa.exe
  2⤵
  PID:11608
- C:\Windows\System\SpWoidq.exe
  C:\Windows\System\SpWoidq.exe
  2⤵
  PID:11636
- C:\Windows\System\uuGPnmV.exe
  C:\Windows\System\uuGPnmV.exe
  2⤵
  PID:11660
- C:\Windows\System\UFljlvQ.exe
  C:\Windows\System\UFljlvQ.exe
  2⤵
  PID:11680
- C:\Windows\System\UlmZbTd.exe
  C:\Windows\System\UlmZbTd.exe
  2⤵
  PID:11696
- C:\Windows\System\ALqVoZt.exe
  C:\Windows\System\ALqVoZt.exe
  2⤵
  PID:11712
- C:\Windows\System\plSlJOz.exe
  C:\Windows\System\plSlJOz.exe
  2⤵
  PID:11732
- C:\Windows\System\KVoAcko.exe
  C:\Windows\System\KVoAcko.exe
  2⤵
  PID:11756
- C:\Windows\System\hPiIhMk.exe
  C:\Windows\System\hPiIhMk.exe
  2⤵
  PID:11776
- C:\Windows\System\MHkwmHp.exe
  C:\Windows\System\MHkwmHp.exe
  2⤵
  PID:11800
- C:\Windows\System\fSpDyyW.exe
  C:\Windows\System\fSpDyyW.exe
  2⤵
  PID:11824
- C:\Windows\System\rcdKhou.exe
  C:\Windows\System\rcdKhou.exe
  2⤵
  PID:11840
- C:\Windows\System\ZaTVVoB.exe
  C:\Windows\System\ZaTVVoB.exe
  2⤵
  PID:11860
- C:\Windows\System\Sydadmf.exe
  C:\Windows\System\Sydadmf.exe
  2⤵
  PID:11880
- C:\Windows\System\JAsKxcI.exe
  C:\Windows\System\JAsKxcI.exe
  2⤵
  PID:11900
- C:\Windows\System\UpmJTMy.exe
  C:\Windows\System\UpmJTMy.exe
  2⤵
  PID:11920
- C:\Windows\System\fbZUeDL.exe
  C:\Windows\System\fbZUeDL.exe
  2⤵
  PID:11940
- C:\Windows\System\lgBFtEs.exe
  C:\Windows\System\lgBFtEs.exe
  2⤵
  PID:11968
- C:\Windows\System\sODhgQC.exe
  C:\Windows\System\sODhgQC.exe
  2⤵
  PID:11988
- C:\Windows\System\ttjUtfb.exe
  C:\Windows\System\ttjUtfb.exe
  2⤵
  PID:12008
- C:\Windows\System\eYahHTC.exe
  C:\Windows\System\eYahHTC.exe
  2⤵
  PID:12032
- C:\Windows\System\vIRPaEo.exe
  C:\Windows\System\vIRPaEo.exe
  2⤵
  PID:12056
- C:\Windows\System\jSfBOaV.exe
  C:\Windows\System\jSfBOaV.exe
  2⤵
  PID:12076
- C:\Windows\System\dTKrNvX.exe
  C:\Windows\System\dTKrNvX.exe
  2⤵
  PID:12100
- C:\Windows\System\ZFTRkGf.exe
  C:\Windows\System\ZFTRkGf.exe
  2⤵
  PID:12120
- C:\Windows\System\qNMMaim.exe
  C:\Windows\System\qNMMaim.exe
  2⤵
  PID:12144
- C:\Windows\System\jsrFJXB.exe
  C:\Windows\System\jsrFJXB.exe
  2⤵
  PID:12164
- C:\Windows\System\cLOPdnr.exe
  C:\Windows\System\cLOPdnr.exe
  2⤵
  PID:12180
- C:\Windows\System\bYyrmbj.exe
  C:\Windows\System\bYyrmbj.exe
  2⤵
  PID:12200
- C:\Windows\System\eVMKamu.exe
  C:\Windows\System\eVMKamu.exe
  2⤵
  PID:12220
- C:\Windows\System\NVApbKB.exe
  C:\Windows\System\NVApbKB.exe
  2⤵
  PID:12236
- C:\Windows\System\ZdWrRgC.exe
  C:\Windows\System\ZdWrRgC.exe
  2⤵
  PID:12252
- C:\Windows\System\cYMKWXH.exe
  C:\Windows\System\cYMKWXH.exe
  2⤵
  PID:12268
- C:\Windows\System\BfKEWcb.exe
  C:\Windows\System\BfKEWcb.exe
  2⤵
  PID:6700
- C:\Windows\System\iRTXxwU.exe
  C:\Windows\System\iRTXxwU.exe
  2⤵
  PID:10524
- C:\Windows\System\qAvbvFW.exe
  C:\Windows\System\qAvbvFW.exe
  2⤵
  PID:10080
- C:\Windows\System\nEneWTN.exe
  C:\Windows\System\nEneWTN.exe
  2⤵
  PID:10760
- C:\Windows\System\KDDrwJQ.exe
  C:\Windows\System\KDDrwJQ.exe
  2⤵
  PID:12360
- C:\Windows\System\OqsMTUI.exe
  C:\Windows\System\OqsMTUI.exe
  2⤵
  PID:12384
- C:\Windows\System\HTCewmW.exe
  C:\Windows\System\HTCewmW.exe
  2⤵
  PID:12404
- C:\Windows\System\ZdWrxoF.exe
  C:\Windows\System\ZdWrxoF.exe
  2⤵
  PID:12424
- C:\Windows\System\lEYoFcH.exe
  C:\Windows\System\lEYoFcH.exe
  2⤵
  PID:12448
- C:\Windows\System\eTouwgV.exe
  C:\Windows\System\eTouwgV.exe
  2⤵
  PID:12468
- C:\Windows\System\aQzrkfs.exe
  C:\Windows\System\aQzrkfs.exe
  2⤵
  PID:12488
- C:\Windows\System\cuNXOqZ.exe
  C:\Windows\System\cuNXOqZ.exe
  2⤵
  PID:12508
- C:\Windows\System\MebTtgB.exe
  C:\Windows\System\MebTtgB.exe
  2⤵
  PID:12568
- C:\Windows\System\NQUbiag.exe
  C:\Windows\System\NQUbiag.exe
  2⤵
  PID:12600
- C:\Windows\System\KrbyEKp.exe
  C:\Windows\System\KrbyEKp.exe
  2⤵
  PID:4800
- C:\Windows\System\BCbsNfg.exe
  C:\Windows\System\BCbsNfg.exe
  2⤵
  PID:8884
- C:\Windows\System\tnRCAOC.exe
  C:\Windows\System\tnRCAOC.exe
  2⤵
  PID:1392
- C:\Windows\System\mHvPbLt.exe
  C:\Windows\System\mHvPbLt.exe
  2⤵
  PID:12072
- C:\Windows\System\HRgsvng.exe
  C:\Windows\System\HRgsvng.exe
  2⤵
  PID:11076
- C:\Windows\System\HzINcnG.exe
  C:\Windows\System\HzINcnG.exe
  2⤵
  PID:6560
- C:\Windows\System\jwnAiGf.exe
  C:\Windows\System\jwnAiGf.exe
  2⤵
  PID:6600
- C:\Windows\System\TrpIJYR.exe
  C:\Windows\System\TrpIJYR.exe
  2⤵
  PID:11708
- C:\Windows\System\ECUsQOe.exe
  C:\Windows\System\ECUsQOe.exe
  2⤵
  PID:12992
- C:\Windows\System\crAChoz.exe
  C:\Windows\System\crAChoz.exe
  2⤵
  PID:13260
- C:\Windows\System\BaHicwK.exe
  C:\Windows\System\BaHicwK.exe
  2⤵
  PID:13184
- C:\Windows\System\UnPZIdy.exe
  C:\Windows\System\UnPZIdy.exe
  2⤵
  PID:11240
- C:\Windows\System\iyWHvft.exe
  C:\Windows\System\iyWHvft.exe
  2⤵
  PID:12948
- C:\Windows\System\nkVnAfy.exe
  C:\Windows\System\nkVnAfy.exe
  2⤵
  PID:11288
- C:\Windows\System\jEYaFOa.exe
  C:\Windows\System\jEYaFOa.exe
  2⤵
  PID:12292
- C:\Windows\System\WuIfmzv.exe
  C:\Windows\System\WuIfmzv.exe
  2⤵
  PID:10936
- C:\Windows\System\iwEIsjP.exe
  C:\Windows\System\iwEIsjP.exe
  2⤵
  PID:12480
- C:\Windows\System\qUpDHyh.exe
  C:\Windows\System\qUpDHyh.exe
  2⤵
  PID:13028
- C:\Windows\System\TXePzzL.exe
  C:\Windows\System\TXePzzL.exe
  2⤵
  PID:9672
- C:\Windows\System\jnppMJi.exe
  C:\Windows\System\jnppMJi.exe
  2⤵
  PID:11452
- C:\Windows\System\GckQwdQ.exe
  C:\Windows\System\GckQwdQ.exe
  2⤵
  PID:10268
- C:\Windows\System\osfPYBK.exe
  C:\Windows\System\osfPYBK.exe
  2⤵
  PID:11552
- C:\Windows\System\XnrMMiX.exe
  C:\Windows\System\XnrMMiX.exe
  2⤵
  PID:5316
- C:\Windows\System\FFEMDXQ.exe
  C:\Windows\System\FFEMDXQ.exe
  2⤵
  PID:12892
- C:\Windows\System\MvjXawI.exe
  C:\Windows\System\MvjXawI.exe
  2⤵
  PID:13168
- C:\Windows\System\icfWeSU.exe
  C:\Windows\System\icfWeSU.exe
  2⤵
  PID:13060
- C:\Windows\System\POnRKUu.exe
  C:\Windows\System\POnRKUu.exe
  2⤵
  PID:13296
- C:\Windows\System\JNUGUnn.exe
  C:\Windows\System\JNUGUnn.exe
  2⤵
  PID:11936
- C:\Windows\System\ujoXwyH.exe
  C:\Windows\System\ujoXwyH.exe
  2⤵
  PID:12640
- C:\Windows\System\pWtyJyC.exe
  C:\Windows\System\pWtyJyC.exe
  2⤵
  PID:12764
- C:\Windows\System\yFBLKnS.exe
  C:\Windows\System\yFBLKnS.exe
  2⤵
  PID:13268
- C:\Windows\System\MoRpCaT.exe
  C:\Windows\System\MoRpCaT.exe
  2⤵
  PID:9656
- C:\Windows\System\qqdAXNM.exe
  C:\Windows\System\qqdAXNM.exe
  2⤵
  PID:4540
- C:\Windows\System\IZhFQNm.exe
  C:\Windows\System\IZhFQNm.exe
  2⤵
  PID:13116
- C:\Windows\System\szusZdp.exe
  C:\Windows\System\szusZdp.exe
  2⤵
  PID:13012
- C:\Windows\System\NiPFuWQ.exe
  C:\Windows\System\NiPFuWQ.exe
  2⤵
  PID:13068
- C:\Windows\System\KUyMDQS.exe
  C:\Windows\System\KUyMDQS.exe
  2⤵
  PID:4628
- C:\Windows\System\IthDycF.exe
  C:\Windows\System\IthDycF.exe
  2⤵
  PID:12776
- C:\Windows\System\lDecdgW.exe
  C:\Windows\System\lDecdgW.exe
  2⤵
  PID:2036
- C:\Windows\System\bjMQaqG.exe
  C:\Windows\System\bjMQaqG.exe
  2⤵
  PID:12844
- C:\Windows\System\iLYMsCr.exe
  C:\Windows\System\iLYMsCr.exe
  2⤵
  PID:12744
- C:\Windows\System\yXiYXmf.exe
  C:\Windows\System\yXiYXmf.exe
  2⤵
  PID:13040
- C:\Windows\System\sCArwjE.exe
  C:\Windows\System\sCArwjE.exe
  2⤵
  PID:12936
- C:\Windows\System\fJOhCpY.exe
  C:\Windows\System\fJOhCpY.exe
  2⤵
  PID:11348
- C:\Windows\System\OfVUoKj.exe
  C:\Windows\System\OfVUoKj.exe
  2⤵
  PID:10988
- C:\Windows\System\rxhGqGV.exe
  C:\Windows\System\rxhGqGV.exe
  2⤵
  PID:11744
- C:\Windows\System\nPfJnoo.exe
  C:\Windows\System\nPfJnoo.exe
  2⤵
  PID:4692
- C:\Windows\System\LEtlpZt.exe
  C:\Windows\System\LEtlpZt.exe
  2⤵
  PID:8428
- C:\Windows\System\nfLgfjC.exe
  C:\Windows\System\nfLgfjC.exe
  2⤵
  PID:12276
- C:\Windows\System\gKfxtsb.exe
  C:\Windows\System\gKfxtsb.exe
  2⤵
  PID:8852
- C:\Windows\System\RKNNWqo.exe
  C:\Windows\System\RKNNWqo.exe
  2⤵
  PID:11300
- C:\Windows\System\jAtxmYQ.exe
  C:\Windows\System\jAtxmYQ.exe
  2⤵
  PID:12440
- C:\Windows\System\jneaAMB.exe
  C:\Windows\System\jneaAMB.exe
  2⤵
  PID:13284
- C:\Windows\System\QLYEpWR.exe
  C:\Windows\System\QLYEpWR.exe
  2⤵
  PID:13088
- C:\Windows\System\CvqeQLC.exe
  C:\Windows\System\CvqeQLC.exe
  2⤵
  PID:12624
- C:\Windows\System\cVnrxCp.exe
  C:\Windows\System\cVnrxCp.exe
  2⤵
  PID:3112
- C:\Windows\System\bYHgDqz.exe
  C:\Windows\System\bYHgDqz.exe
  2⤵
  PID:13052
- C:\Windows\System\fEsIZRk.exe
  C:\Windows\System\fEsIZRk.exe
  2⤵
  PID:11568
- C:\Windows\System\UGdJpkg.exe
  C:\Windows\System\UGdJpkg.exe
  2⤵
  PID:12944
- C:\Windows\System\YgoThnb.exe
  C:\Windows\System\YgoThnb.exe
  2⤵
  PID:12824
- C:\Windows\System\pZOIDdA.exe
  C:\Windows\System\pZOIDdA.exe
  2⤵
  PID:11204
- C:\Windows\System\RSRZiZf.exe
  C:\Windows\System\RSRZiZf.exe
  2⤵
  PID:11472
- C:\Windows\System\VLjkDNl.exe
  C:\Windows\System\VLjkDNl.exe
  2⤵
  PID:5268
- C:\Windows\System\DrQOwoU.exe
  C:\Windows\System\DrQOwoU.exe
  2⤵
  PID:1476
- C:\Windows\System\UsGgrOj.exe
  C:\Windows\System\UsGgrOj.exe
  2⤵
  PID:12520
- C:\Windows\System\oTZHCYR.exe
  C:\Windows\System\oTZHCYR.exe
  2⤵
  PID:13016
- C:\Windows\System\NnrFHCF.exe
  C:\Windows\System\NnrFHCF.exe
  2⤵
  PID:12132
- C:\Windows\System\GzqnwoK.exe
  C:\Windows\System\GzqnwoK.exe
  2⤵
  PID:10480
- C:\Windows\System\UqEVzot.exe
  C:\Windows\System\UqEVzot.exe
  2⤵
  PID:11460
- C:\Windows\System\XjfOeNh.exe
  C:\Windows\System\XjfOeNh.exe
  2⤵
  PID:12608
- C:\Windows\System\VYJOVyQ.exe
  C:\Windows\System\VYJOVyQ.exe
  2⤵
  PID:12548
- C:\Windows\System\NbWgtMP.exe
  C:\Windows\System\NbWgtMP.exe
  2⤵
  PID:13272
- C:\Windows\System\WbhQAEu.exe
  C:\Windows\System\WbhQAEu.exe
  2⤵
  PID:13128
- C:\Windows\System\hWiDUZb.exe
  C:\Windows\System\hWiDUZb.exe
  2⤵
  PID:1140
- C:\Windows\System\eeIKZxx.exe
  C:\Windows\System\eeIKZxx.exe
  2⤵
  PID:10920
- C:\Windows\System\rjHiMwd.exe
  C:\Windows\System\rjHiMwd.exe
  2⤵
  PID:5612
- C:\Windows\System\EeNyBlQ.exe
  C:\Windows\System\EeNyBlQ.exe
  2⤵
  PID:5636
- C:\Windows\System\GJZyQoU.exe
  C:\Windows\System\GJZyQoU.exe
  2⤵
  PID:5632
- C:\Windows\System\rdDvXDa.exe
  C:\Windows\System\rdDvXDa.exe
  2⤵
  PID:5524
- C:\Windows\System\FMFeieV.exe
  C:\Windows\System\FMFeieV.exe
  2⤵
  PID:12160
- C:\Windows\System\FmtUgkY.exe
  C:\Windows\System\FmtUgkY.exe
  2⤵
  PID:11496
- C:\Windows\System\vuHSyEq.exe
  C:\Windows\System\vuHSyEq.exe
  2⤵
  PID:12556
- C:\Windows\System\bxrzsSv.exe
  C:\Windows\System\bxrzsSv.exe
  2⤵
  PID:12924
- C:\Windows\System\EtCGvVQ.exe
  C:\Windows\System\EtCGvVQ.exe
  2⤵
  PID:12396
- C:\Windows\System\eEqxtcf.exe
  C:\Windows\System\eEqxtcf.exe
  2⤵
  PID:9452
- C:\Windows\System\uyeZmaW.exe
  C:\Windows\System\uyeZmaW.exe
  2⤵
  PID:4720
- C:\Windows\System\PYnjPQa.exe
  C:\Windows\System\PYnjPQa.exe
  2⤵
  PID:5040
- C:\Windows\System\GVTYeGs.exe
  C:\Windows\System\GVTYeGs.exe
  2⤵
  PID:11492
- C:\Windows\System\zjfPybm.exe
  C:\Windows\System\zjfPybm.exe
  2⤵
  PID:12972
- C:\Windows\System\ieEEBoe.exe
  C:\Windows\System\ieEEBoe.exe
  2⤵
  PID:3404
- C:\Windows\System\wFVRedv.exe
  C:\Windows\System\wFVRedv.exe
  2⤵
  PID:2112
- C:\Windows\System\XebrcbD.exe
  C:\Windows\System\XebrcbD.exe
  2⤵
  PID:13020
- C:\Windows\System\YDHDccZ.exe
  C:\Windows\System\YDHDccZ.exe
  2⤵
  PID:11948
- C:\Windows\System\JcrQjWH.exe
  C:\Windows\System\JcrQjWH.exe
  2⤵
  PID:4872
- C:\Windows\System\VJCTbbK.exe
  C:\Windows\System\VJCTbbK.exe
  2⤵
  PID:6412
- C:\Windows\System\mxNaxyS.exe
  C:\Windows\System\mxNaxyS.exe
  2⤵
  PID:13320
- C:\Windows\System\YvrbFOZ.exe
  C:\Windows\System\YvrbFOZ.exe
  2⤵
  PID:13336
- C:\Windows\System\TQrBQSS.exe
  C:\Windows\System\TQrBQSS.exe
  2⤵
  PID:13360
- C:\Windows\System\IwVSApZ.exe
  C:\Windows\System\IwVSApZ.exe
  2⤵
  PID:13392
- C:\Windows\System\HUxXiog.exe
  C:\Windows\System\HUxXiog.exe
  2⤵
  PID:13448
- C:\Windows\System\chrTfgz.exe
  C:\Windows\System\chrTfgz.exe
  2⤵
  PID:13472
- C:\Windows\System\nDNeFGb.exe
  C:\Windows\System\nDNeFGb.exe
  2⤵
  PID:13496
- C:\Windows\System\GDxzpfF.exe
  C:\Windows\System\GDxzpfF.exe
  2⤵
  PID:13708
- C:\Windows\System\JYItepD.exe
  C:\Windows\System\JYItepD.exe
  2⤵
  PID:13736
- C:\Windows\System\vBeRzDR.exe
  C:\Windows\System\vBeRzDR.exe
  2⤵
  PID:3140
- C:\Windows\System\biWRpUP.exe
  C:\Windows\System\biWRpUP.exe
  2⤵
  PID:14024
- C:\Windows\System\eoGiciO.exe
  C:\Windows\System\eoGiciO.exe
  2⤵
  PID:13856
- C:\Windows\System\BKKKwaT.exe
  C:\Windows\System\BKKKwaT.exe
  2⤵
  PID:14052
- C:\Windows\System\biWbLbJ.exe
  C:\Windows\System\biWbLbJ.exe
  2⤵
  PID:4280
- C:\Windows\System\AVQBweR.exe
  C:\Windows\System\AVQBweR.exe
  2⤵
  PID:13984
- C:\Windows\System\iRiFvaJ.exe
  C:\Windows\System\iRiFvaJ.exe
  2⤵
  PID:13952
- C:\Windows\System\fdKGJjU.exe
  C:\Windows\System\fdKGJjU.exe
  2⤵
  PID:1852
- C:\Windows\System\FjpDTDt.exe
  C:\Windows\System\FjpDTDt.exe
  2⤵
  PID:3220
- C:\Windows\System\kFZXXRL.exe
  C:\Windows\System\kFZXXRL.exe
  2⤵
  PID:14072
- C:\Windows\System\jZUvyMv.exe
  C:\Windows\System\jZUvyMv.exe
  2⤵
  PID:2208
- C:\Windows\System\jgwxQUq.exe
  C:\Windows\System\jgwxQUq.exe
  2⤵
  PID:4500
- C:\Windows\System\OmwdETp.exe
  C:\Windows\System\OmwdETp.exe
  2⤵
  PID:14128
- C:\Windows\System\WUhfJoi.exe
  C:\Windows\System\WUhfJoi.exe
  2⤵
  PID:14148
- C:\Windows\System\gdXeoSK.exe
  C:\Windows\System\gdXeoSK.exe
  2⤵
  PID:14124
- C:\Windows\System\rYkXyHP.exe
  C:\Windows\System\rYkXyHP.exe
  2⤵
  PID:14176
- C:\Windows\System\oUmugvb.exe
  C:\Windows\System\oUmugvb.exe
  2⤵
  PID:14220
- C:\Windows\System\jGusenB.exe
  C:\Windows\System\jGusenB.exe
  2⤵
  PID:14264
- C:\Windows\System\copBJnd.exe
  C:\Windows\System\copBJnd.exe
  2⤵
  PID:14324
- C:\Windows\System\FqmwMPD.exe
  C:\Windows\System\FqmwMPD.exe
  2⤵
  PID:692
- C:\Windows\System\POswJqC.exe
  C:\Windows\System\POswJqC.exe
  2⤵
  PID:13384
- C:\Windows\System\EcncAhy.exe
  C:\Windows\System\EcncAhy.exe
  2⤵
  PID:12672
- C:\Windows\System\sSzIGoF.exe
  C:\Windows\System\sSzIGoF.exe
  2⤵
  PID:13484
- C:\Windows\System\wQIFKnN.exe
  C:\Windows\System\wQIFKnN.exe
  2⤵
  PID:13508
- C:\Windows\System\uxgQwAF.exe
  C:\Windows\System\uxgQwAF.exe
  2⤵
  PID:14116
- C:\Windows\System\hZwuzgc.exe
  C:\Windows\System\hZwuzgc.exe
  2⤵
  PID:13588
- C:\Windows\System\IMzENlm.exe
  C:\Windows\System\IMzENlm.exe
  2⤵
  PID:13676
- C:\Windows\System\YTPNWZj.exe
  C:\Windows\System\YTPNWZj.exe
  2⤵
  PID:13696
- C:\Windows\System\DwqOlQE.exe
  C:\Windows\System\DwqOlQE.exe
  2⤵
  PID:13656
- C:\Windows\System\IRsWlCN.exe
  C:\Windows\System\IRsWlCN.exe
  2⤵
  PID:13648
- C:\Windows\System\TbejArX.exe
  C:\Windows\System\TbejArX.exe
  2⤵
  PID:3116
- C:\Windows\System\SinABbO.exe
  C:\Windows\System\SinABbO.exe
  2⤵
  PID:13796
- C:\Windows\System\xikYPqI.exe
  C:\Windows\System\xikYPqI.exe
  2⤵
  PID:13832
- C:\Windows\System\GpwTrTi.exe
  C:\Windows\System\GpwTrTi.exe
  2⤵
  PID:13824
- C:\Windows\System\piNRgrP.exe
  C:\Windows\System\piNRgrP.exe
  2⤵
  PID:5548
- C:\Windows\System\ioFSemi.exe
  C:\Windows\System\ioFSemi.exe
  2⤵
  PID:13864
- C:\Windows\System\juLVFQZ.exe
  C:\Windows\System\juLVFQZ.exe
  2⤵
  PID:13872
- C:\Windows\System\PwCfYQr.exe
  C:\Windows\System\PwCfYQr.exe
  2⤵
  PID:372
- C:\Windows\System\YGWukOS.exe
  C:\Windows\System\YGWukOS.exe
  2⤵
  PID:5572
- C:\Windows\System\CWfZkIO.exe
  C:\Windows\System\CWfZkIO.exe
  2⤵
  PID:2624
- C:\Windows\System\HxxgZxW.exe
  C:\Windows\System\HxxgZxW.exe
  2⤵
  PID:2520
- C:\Windows\System\VfqAoEo.exe
  C:\Windows\System\VfqAoEo.exe
  2⤵
  PID:4012
- C:\Windows\System\tieBUNe.exe
  C:\Windows\System\tieBUNe.exe
  2⤵
  PID:4480
- C:\Windows\System\PGJIBll.exe
  C:\Windows\System\PGJIBll.exe
  2⤵
  PID:2952
- C:\Windows\System\CIpQSPi.exe
  C:\Windows\System\CIpQSPi.exe
  2⤵
  PID:2884
- C:\Windows\System\LNsSqlY.exe
  C:\Windows\System\LNsSqlY.exe
  2⤵
  PID:13944
- C:\Windows\System\HuygjeY.exe
  C:\Windows\System\HuygjeY.exe
  2⤵
  PID:14012
- C:\Windows\System\NSGOROe.exe
  C:\Windows\System\NSGOROe.exe
  2⤵
  PID:5584
- C:\Windows\System\VuqQDFL.exe
  C:\Windows\System\VuqQDFL.exe
  2⤵
  PID:14056
- C:\Windows\System\OmlXCfS.exe
  C:\Windows\System\OmlXCfS.exe
  2⤵
  PID:2324
- C:\Windows\System\aPkunvB.exe
  C:\Windows\System\aPkunvB.exe
  2⤵
  PID:3232
- C:\Windows\System\stMFEbd.exe
  C:\Windows\System\stMFEbd.exe
  2⤵
  PID:14140
- C:\Windows\System\KJRGahd.exe
  C:\Windows\System\KJRGahd.exe
  2⤵
  PID:14108
- C:\Windows\System\hkICgUS.exe
  C:\Windows\System\hkICgUS.exe
  2⤵
  PID:5360
- C:\Windows\System\pEUXrZe.exe
  C:\Windows\System\pEUXrZe.exe
  2⤵
  PID:5880
- C:\Windows\System\RaKFbNT.exe
  C:\Windows\System\RaKFbNT.exe
  2⤵
  PID:14312
- C:\Windows\System\QsxaIPC.exe
  C:\Windows\System\QsxaIPC.exe
  2⤵
  PID:3676
- C:\Windows\System\vQbqFwe.exe
  C:\Windows\System\vQbqFwe.exe
  2⤵
  PID:6180
- C:\Windows\System\gRDjvQi.exe
  C:\Windows\System\gRDjvQi.exe
  2⤵
  PID:6184
- C:\Windows\System\GYhDPwN.exe
  C:\Windows\System\GYhDPwN.exe
  2⤵
  PID:12380
- C:\Windows\System\BmKHidD.exe
  C:\Windows\System\BmKHidD.exe
  2⤵
  PID:13412
- C:\Windows\System\DQpGdRp.exe
  C:\Windows\System\DQpGdRp.exe
  2⤵
  PID:1684
- C:\Windows\System\gsKnOWJ.exe
  C:\Windows\System\gsKnOWJ.exe
  2⤵
  PID:13604
- C:\Windows\System\gSprSro.exe
  C:\Windows\System\gSprSro.exe
  2⤵
  PID:13380
- C:\Windows\System\ctTKixq.exe
  C:\Windows\System\ctTKixq.exe
  2⤵
  PID:5416
- C:\Windows\System\fWmIhvt.exe
  C:\Windows\System\fWmIhvt.exe
  2⤵
  PID:3948
- C:\Windows\System\KQUJWuB.exe
  C:\Windows\System\KQUJWuB.exe
  2⤵
  PID:5484
- C:\Windows\System\uQjepnn.exe
  C:\Windows\System\uQjepnn.exe
  2⤵
  PID:6260
- C:\Windows\System\LvDrkGa.exe
  C:\Windows\System\LvDrkGa.exe
  2⤵
  PID:5532
- C:\Windows\System\BbIAXyb.exe
  C:\Windows\System\BbIAXyb.exe
  2⤵
  PID:6064
- C:\Windows\System\BimIvZy.exe
  C:\Windows\System\BimIvZy.exe
  2⤵
  PID:6100
- C:\Windows\System\dDgDclR.exe
  C:\Windows\System\dDgDclR.exe
  2⤵
  PID:14064
- C:\Windows\System\mMrBiZK.exe
  C:\Windows\System\mMrBiZK.exe
  2⤵
  PID:6232
- C:\Windows\System\VKmhWVu.exe
  C:\Windows\System\VKmhWVu.exe
  2⤵
  PID:936
- C:\Windows\System\UpZZnFa.exe
  C:\Windows\System\UpZZnFa.exe
  2⤵
  PID:7552
- C:\Windows\System\DVoLtMA.exe
  C:\Windows\System\DVoLtMA.exe
  2⤵
  PID:7556
- C:\Windows\System\oRjaZUI.exe
  C:\Windows\System\oRjaZUI.exe
  2⤵
  PID:6860
- C:\Windows\System\GKXzQpR.exe
  C:\Windows\System\GKXzQpR.exe
  2⤵
  PID:6744
- C:\Windows\System\LFPnKLq.exe
  C:\Windows\System\LFPnKLq.exe
  2⤵
  PID:6976
- C:\Windows\System\LsRvXsU.exe
  C:\Windows\System\LsRvXsU.exe
  2⤵
  PID:13704
- C:\Windows\System\xEuxkER.exe
  C:\Windows\System\xEuxkER.exe
  2⤵
  PID:1668
- C:\Windows\System\DimlmzS.exe
  C:\Windows\System\DimlmzS.exe
  2⤵
  PID:13744
- C:\Windows\System\YJjmizX.exe
  C:\Windows\System\YJjmizX.exe
  2⤵
  PID:3240
- C:\Windows\System\LzoFcPH.exe
  C:\Windows\System\LzoFcPH.exe
  2⤵
  PID:7148
- C:\Windows\System\trvSCwk.exe
  C:\Windows\System\trvSCwk.exe
  2⤵
  PID:7156
- C:\Windows\System\UFAxdpS.exe
  C:\Windows\System\UFAxdpS.exe
  2⤵
  PID:8012
- C:\Windows\System\ZDoNJvN.exe
  C:\Windows\System\ZDoNJvN.exe
  2⤵
  PID:14132
- C:\Windows\System\nGqJHtF.exe
  C:\Windows\System\nGqJHtF.exe
  2⤵
  PID:4728
- C:\Windows\System\OiCZJSE.exe
  C:\Windows\System\OiCZJSE.exe
  2⤵
  PID:5456
- C:\Windows\System\QyLASkv.exe
  C:\Windows\System\QyLASkv.exe
  2⤵
  PID:5288
- C:\Windows\System\cijpQjS.exe
  C:\Windows\System\cijpQjS.exe
  2⤵
  PID:5952
- C:\Windows\System\iMlBIdl.exe
  C:\Windows\System\iMlBIdl.exe
  2⤵
  PID:5964
- C:\Windows\System\mVGdBTN.exe
  C:\Windows\System\mVGdBTN.exe
  2⤵
  PID:4756
- C:\Windows\System\atYnRZA.exe
  C:\Windows\System\atYnRZA.exe
  2⤵
  PID:7736
- C:\Windows\System\FLiEWil.exe
  C:\Windows\System\FLiEWil.exe
  2⤵
  PID:13372
- C:\Windows\System\vQCgmBX.exe
  C:\Windows\System\vQCgmBX.exe
  2⤵
  PID:7800
- C:\Windows\System\ZtfdtWk.exe
  C:\Windows\System\ZtfdtWk.exe
  2⤵
  PID:6224
- C:\Windows\System\XfQSBZC.exe
  C:\Windows\System\XfQSBZC.exe
  2⤵
  PID:5740
- C:\Windows\System\VmfFPvQ.exe
  C:\Windows\System\VmfFPvQ.exe
  2⤵
  PID:13544
- C:\Windows\System\KJFWPTf.exe
  C:\Windows\System\KJFWPTf.exe
  2⤵
  PID:13592
- C:\Windows\System\JYuYtwY.exe
  C:\Windows\System\JYuYtwY.exe
  2⤵
  PID:13892
- C:\Windows\System\ECzQkNr.exe
  C:\Windows\System\ECzQkNr.exe
  2⤵
  PID:5132
- C:\Windows\System\sAHkWyB.exe
  C:\Windows\System\sAHkWyB.exe
  2⤵
  PID:9056
- C:\Windows\System\DmUWBVL.exe
  C:\Windows\System\DmUWBVL.exe
  2⤵
  PID:5412
- C:\Windows\System\JsRmTRZ.exe
  C:\Windows\System\JsRmTRZ.exe
  2⤵
  PID:2492
- C:\Windows\System\sBRatWB.exe
  C:\Windows\System\sBRatWB.exe
  2⤵
  PID:13692
- C:\Windows\System\yqMmfYy.exe
  C:\Windows\System\yqMmfYy.exe
  2⤵
  PID:5452
- C:\Windows\System\EAfFVbO.exe
  C:\Windows\System\EAfFVbO.exe
  2⤵
  PID:9152
- C:\Windows\System\MqHDfkF.exe
  C:\Windows\System\MqHDfkF.exe
  2⤵
  PID:8252
- C:\Windows\System\tJRaMMy.exe
  C:\Windows\System\tJRaMMy.exe
  2⤵
  PID:8288
- C:\Windows\System\VAyStop.exe
  C:\Windows\System\VAyStop.exe
  2⤵
  PID:5560
- C:\Windows\System\lXgZsDY.exe
  C:\Windows\System\lXgZsDY.exe
  2⤵
  PID:8444
- C:\Windows\System\uaipQHW.exe
  C:\Windows\System\uaipQHW.exe
  2⤵
  PID:2396
- C:\Windows\System\ulZqeST.exe
  C:\Windows\System\ulZqeST.exe
  2⤵
  PID:4436
- C:\Windows\System\wWQwXGu.exe
  C:\Windows\System\wWQwXGu.exe
  2⤵
  PID:7320
- C:\Windows\System\YQNrRjV.exe
  C:\Windows\System\YQNrRjV.exe
  2⤵
  PID:13752
- C:\Windows\System\JLBEByB.exe
  C:\Windows\System\JLBEByB.exe
  2⤵
  PID:7652
- C:\Windows\System\pJxFCFv.exe
  C:\Windows\System\pJxFCFv.exe
  2⤵
  PID:8748
- C:\Windows\System\LivUhVF.exe
  C:\Windows\System\LivUhVF.exe
  2⤵
  PID:7764
- C:\Windows\System\uqPBXyn.exe
  C:\Windows\System\uqPBXyn.exe
  2⤵
  PID:8792
- C:\Windows\System\DTqjYso.exe
  C:\Windows\System\DTqjYso.exe
  2⤵
  PID:8952
- C:\Windows\System\nFDfmSv.exe
  C:\Windows\System\nFDfmSv.exe
  2⤵
  PID:8028
- C:\Windows\System\osUGXes.exe
  C:\Windows\System\osUGXes.exe
  2⤵
  PID:7040
- C:\Windows\System\VZovWKq.exe
  C:\Windows\System\VZovWKq.exe
  2⤵
  PID:8980
- C:\Windows\System\PCuDhUR.exe
  C:\Windows\System\PCuDhUR.exe
  2⤵
  PID:5468
- C:\Windows\System\DacUkCY.exe
  C:\Windows\System\DacUkCY.exe
  2⤵
  PID:9140
- C:\Windows\System\doVFFIX.exe
  C:\Windows\System\doVFFIX.exe
  2⤵
  PID:9404
- C:\Windows\System\tPVfIyq.exe
  C:\Windows\System\tPVfIyq.exe
  2⤵
  PID:8084
- C:\Windows\System\kHatFWv.exe
  C:\Windows\System\kHatFWv.exe
  2⤵
  PID:6640
- C:\Windows\System\HjzFjly.exe
  C:\Windows\System\HjzFjly.exe
  2⤵
  PID:7020
- C:\Windows\System\kKQlsJa.exe
  C:\Windows\System\kKQlsJa.exe
  2⤵
  PID:1848
- C:\Windows\System\NobUPko.exe
  C:\Windows\System\NobUPko.exe
  2⤵
  PID:9576
- C:\Windows\System\qCTliAo.exe
  C:\Windows\System\qCTliAo.exe
  2⤵
  PID:6008
- C:\Windows\System\HFGQYIB.exe
  C:\Windows\System\HFGQYIB.exe
  2⤵
  PID:6016
- C:\Windows\System\XRFOrLr.exe
  C:\Windows\System\XRFOrLr.exe
  2⤵
  PID:10100
- C:\Windows\System\kwPEAki.exe
  C:\Windows\System\kwPEAki.exe
  2⤵
  PID:10048
- C:\Windows\System\eERYccp.exe
  C:\Windows\System\eERYccp.exe
  2⤵
  PID:5992
- C:\Windows\System\tYCHhpu.exe
  C:\Windows\System\tYCHhpu.exe
  2⤵
  PID:8040
- C:\Windows\System\pwscTlX.exe
  C:\Windows\System\pwscTlX.exe
  2⤵
  PID:10216
- C:\Windows\System\mkjoDEo.exe
  C:\Windows\System\mkjoDEo.exe
  2⤵
  PID:7996
- C:\Windows\System\xGJWlYb.exe
  C:\Windows\System\xGJWlYb.exe
  2⤵
  PID:836
- C:\Windows\System\WvqUdzq.exe
  C:\Windows\System\WvqUdzq.exe
  2⤵
  PID:13532
- C:\Windows\System\xnLvDwA.exe
  C:\Windows\System\xnLvDwA.exe
  2⤵
  PID:9340
- C:\Windows\System\TdQFbro.exe
  C:\Windows\System\TdQFbro.exe
  2⤵
  PID:5940
- C:\Windows\System\CQzcLay.exe
  C:\Windows\System\CQzcLay.exe
  2⤵
  PID:4344
- C:\Windows\System\WTtFZSR.exe
  C:\Windows\System\WTtFZSR.exe
  2⤵
  PID:8824
- C:\Windows\System\LBlLlgU.exe
  C:\Windows\System\LBlLlgU.exe
  2⤵
  PID:9112
- C:\Windows\System\rtQYlbD.exe
  C:\Windows\System\rtQYlbD.exe
  2⤵
  PID:9200
- C:\Windows\System\BRtXUyW.exe
  C:\Windows\System\BRtXUyW.exe
  2⤵
  PID:13816
- C:\Windows\System\tSpPDzx.exe
  C:\Windows\System\tSpPDzx.exe
  2⤵
  PID:736
- C:\Windows\System\zplFaVT.exe
  C:\Windows\System\zplFaVT.exe
  2⤵
  PID:2920
- C:\Windows\System\eTdpatR.exe
  C:\Windows\System\eTdpatR.exe
  2⤵
  PID:8292
- C:\Windows\System\zKdvBum.exe
  C:\Windows\System\zKdvBum.exe
  2⤵
  PID:14144
- C:\Windows\System\SjhoWEH.exe
  C:\Windows\System\SjhoWEH.exe
  2⤵
  PID:5628
- C:\Windows\System\odFGNup.exe
  C:\Windows\System\odFGNup.exe
  2⤵
  PID:8640
- C:\Windows\System\SeCEypZ.exe
  C:\Windows\System\SeCEypZ.exe
  2⤵
  PID:7572
- C:\Windows\System\HIdCUnI.exe
  C:\Windows\System\HIdCUnI.exe
  2⤵
  PID:8464
- C:\Windows\System\EoNFWBf.exe
  C:\Windows\System\EoNFWBf.exe
  2⤵
  PID:13888
- C:\Windows\System\VRgndkT.exe
  C:\Windows\System\VRgndkT.exe
  2⤵
  PID:8764
- C:\Windows\System\FVCaSdW.exe
  C:\Windows\System\FVCaSdW.exe
  2⤵
  PID:13416
- C:\Windows\System\NQUXZIj.exe
  C:\Windows\System\NQUXZIj.exe
  2⤵
  PID:13756
- C:\Windows\System\uTYobDM.exe
  C:\Windows\System\uTYobDM.exe
  2⤵
  PID:9804
- C:\Windows\System\UHOmpsU.exe
  C:\Windows\System\UHOmpsU.exe
  2⤵
  PID:9856
- C:\Windows\System\UMhWBHA.exe
  C:\Windows\System\UMhWBHA.exe
  2⤵
  PID:7000
- C:\Windows\System\tgTCgQF.exe
  C:\Windows\System\tgTCgQF.exe
  2⤵
  PID:7432
- C:\Windows\System\hYiOOka.exe
  C:\Windows\System\hYiOOka.exe
  2⤵
  PID:9348
- C:\Windows\System\iIspkit.exe
  C:\Windows\System\iIspkit.exe
  2⤵
  PID:10356
- C:\Windows\System\sFVrFPL.exe
  C:\Windows\System\sFVrFPL.exe
  2⤵
  PID:9464
- C:\Windows\System\AKzhbfw.exe
  C:\Windows\System\AKzhbfw.exe
  2⤵
  PID:10428
- C:\Windows\System\EAivXgk.exe
  C:\Windows\System\EAivXgk.exe
  2⤵
  PID:9500
- C:\Windows\System\HNrDDRl.exe
  C:\Windows\System\HNrDDRl.exe
  2⤵
  PID:6880
- C:\Windows\System\QfLxZdt.exe
  C:\Windows\System\QfLxZdt.exe
  2⤵
  PID:8312
- C:\Windows\System\fNZYQIN.exe
  C:\Windows\System\fNZYQIN.exe
  2⤵
  PID:7564
- C:\Windows\System\boyHoZT.exe
  C:\Windows\System\boyHoZT.exe
  2⤵
  PID:9980
- C:\Windows\System\SVJHicT.exe
  C:\Windows\System\SVJHicT.exe
  2⤵
  PID:13404
- C:\Windows\System\aXIkVzu.exe
  C:\Windows\System\aXIkVzu.exe
  2⤵
  PID:10892
- C:\Windows\System\nZkucuA.exe
  C:\Windows\System\nZkucuA.exe
  2⤵
  PID:10116
- C:\Windows\System\bZwnBlm.exe
  C:\Windows\System\bZwnBlm.exe
  2⤵
  PID:13520
- C:\Windows\System\BMaKNKL.exe
  C:\Windows\System\BMaKNKL.exe
  2⤵
  PID:11008
- C:\Windows\System\HNdklWG.exe
  C:\Windows\System\HNdklWG.exe
  2⤵
  PID:9300
- C:\Windows\System\aiZMdSi.exe
  C:\Windows\System\aiZMdSi.exe
  2⤵
  PID:9580
- C:\Windows\System\ydvlKfk.exe
  C:\Windows\System\ydvlKfk.exe
  2⤵
  PID:6436
- C:\Windows\System\uhKPnFu.exe
  C:\Windows\System\uhKPnFu.exe
  2⤵
  PID:9224
- C:\Windows\System\ntYdhhS.exe
  C:\Windows\System\ntYdhhS.exe
  2⤵
  PID:5912
- C:\Windows\System\iJrhvKW.exe
  C:\Windows\System\iJrhvKW.exe
  2⤵
  PID:8948
- C:\Windows\System\tsPaoYm.exe
  C:\Windows\System\tsPaoYm.exe
  2⤵
  PID:8996
- C:\Windows\System\gSPBlyx.exe
  C:\Windows\System\gSPBlyx.exe
  2⤵
  PID:7636
- C:\Windows\System\ZcqFCsN.exe
  C:\Windows\System\ZcqFCsN.exe
  2⤵
  PID:6112
- C:\Windows\System\DscKFPI.exe
  C:\Windows\System\DscKFPI.exe
  2⤵
  PID:13432
- C:\Windows\System\DLDiRhu.exe
  C:\Windows\System\DLDiRhu.exe
  2⤵
  PID:9148
- C:\Windows\System\wUvtYdy.exe
  C:\Windows\System\wUvtYdy.exe
  2⤵
  PID:7196
- C:\Windows\System\TEiuEbP.exe
  C:\Windows\System\TEiuEbP.exe
  2⤵
  PID:8484
- C:\Windows\System\IqrhWlf.exe
  C:\Windows\System\IqrhWlf.exe
  2⤵
  PID:7664
- C:\Windows\System\hpSsCnQ.exe
  C:\Windows\System\hpSsCnQ.exe
  2⤵
  PID:7192
- C:\Windows\System\pVuzBtF.exe
  C:\Windows\System\pVuzBtF.exe
  2⤵
  PID:9236
- C:\Windows\System\SBmEZsL.exe
  C:\Windows\System\SBmEZsL.exe
  2⤵
  PID:8684
- C:\Windows\System\SaeGHer.exe
  C:\Windows\System\SaeGHer.exe
  2⤵
  PID:7220
- C:\Windows\System\YKCgzQt.exe
  C:\Windows\System\YKCgzQt.exe
  2⤵
  PID:9808
- C:\Windows\System\uiDWcJy.exe
  C:\Windows\System\uiDWcJy.exe
  2⤵
  PID:8864
- C:\Windows\System\vOzhLyK.exe
  C:\Windows\System\vOzhLyK.exe
  2⤵
  PID:13968
- C:\Windows\System\zJtXPAj.exe
  C:\Windows\System\zJtXPAj.exe
  2⤵
  PID:10812
- C:\Windows\System\jwFHNAv.exe
  C:\Windows\System\jwFHNAv.exe
  2⤵
  PID:10948
- C:\Windows\System\rPcIdGQ.exe
  C:\Windows\System\rPcIdGQ.exe
  2⤵
  PID:9036
- C:\Windows\System\KhprFEA.exe
  C:\Windows\System\KhprFEA.exe
  2⤵
  PID:6492
- C:\Windows\System\rorBGYf.exe
  C:\Windows\System\rorBGYf.exe
  2⤵
  PID:7452
- C:\Windows\System\agaBdSn.exe
  C:\Windows\System\agaBdSn.exe
  2⤵
  PID:5820
- C:\Windows\System\oaiZtVq.exe
  C:\Windows\System\oaiZtVq.exe
  2⤵
  PID:13468
- C:\Windows\System\IFUfFnz.exe
  C:\Windows\System\IFUfFnz.exe
  2⤵
  PID:13512
- C:\Windows\System\XnlAEqG.exe
  C:\Windows\System\XnlAEqG.exe
  2⤵
  PID:8776
- C:\Windows\System\TCMghAQ.exe
  C:\Windows\System\TCMghAQ.exe
  2⤵
  PID:13536
- C:\Windows\System\CJxCTHE.exe
  C:\Windows\System\CJxCTHE.exe
  2⤵
  PID:11200
- C:\Windows\System\tRcDuCJ.exe
  C:\Windows\System\tRcDuCJ.exe
  2⤵
  PID:12344
- C:\Windows\System\rdWzZYF.exe
  C:\Windows\System\rdWzZYF.exe
  2⤵
  PID:2032
- C:\Windows\System\tLblYOP.exe
  C:\Windows\System\tLblYOP.exe
  2⤵
  PID:7928
- C:\Windows\System\QBlICHW.exe
  C:\Windows\System\QBlICHW.exe
  2⤵
  PID:5848
- C:\Windows\System\MgNOoLr.exe
  C:\Windows\System\MgNOoLr.exe
  2⤵
  PID:5816
- C:\Windows\System\oSxZLLr.exe
  C:\Windows\System\oSxZLLr.exe
  2⤵
  PID:1528
- C:\Windows\System\pbaLJLp.exe
  C:\Windows\System\pbaLJLp.exe
  2⤵
  PID:11368
- C:\Windows\System\gTcYMqU.exe
  C:\Windows\System\gTcYMqU.exe
  2⤵
  PID:9424
- C:\Windows\System\ouSSAoC.exe
  C:\Windows\System\ouSSAoC.exe
  2⤵
  PID:11196
- C:\Windows\System\WtDrEak.exe
  C:\Windows\System\WtDrEak.exe
  2⤵
  PID:2808
- C:\Windows\System\CPPzuDc.exe
  C:\Windows\System\CPPzuDc.exe
  2⤵
  PID:10752
- C:\Windows\System\PlytsRv.exe
  C:\Windows\System\PlytsRv.exe
  2⤵
  PID:9896
- C:\Windows\System\iODsLjJ.exe
  C:\Windows\System\iODsLjJ.exe
  2⤵
  PID:7472
- C:\Windows\System\hipxEAc.exe
  C:\Windows\System\hipxEAc.exe
  2⤵
  PID:11788
- C:\Windows\System\sJcYWwD.exe
  C:\Windows\System\sJcYWwD.exe
  2⤵
  PID:12092
- C:\Windows\System\bfTINnb.exe
  C:\Windows\System\bfTINnb.exe
  2⤵
  PID:7084
- C:\Windows\System\YInMnfr.exe
  C:\Windows\System\YInMnfr.exe
  2⤵
  PID:9828
- C:\Windows\System\mZoCIgW.exe
  C:\Windows\System\mZoCIgW.exe
  2⤵
  PID:7920
- C:\Windows\System\zBOIrQM.exe
  C:\Windows\System\zBOIrQM.exe
  2⤵
  PID:9104
- C:\Windows\System\KqHomii.exe
  C:\Windows\System\KqHomii.exe
  2⤵
  PID:9428
- C:\Windows\System\JAsNXvn.exe
  C:\Windows\System\JAsNXvn.exe
  2⤵
  PID:11136
- C:\Windows\System\bIVRiri.exe
  C:\Windows\System\bIVRiri.exe
  2⤵
  PID:12828
- C:\Windows\System\bBbuAdD.exe
  C:\Windows\System\bBbuAdD.exe
  2⤵
  PID:7232
- C:\Windows\System\YcrxqHA.exe
  C:\Windows\System\YcrxqHA.exe
  2⤵
  PID:12900
- C:\Windows\System\xZbHJSg.exe
  C:\Windows\System\xZbHJSg.exe
  2⤵
  PID:10492
- C:\Windows\System\ZPOUNMy.exe
  C:\Windows\System\ZPOUNMy.exe
  2⤵
  PID:12864
- C:\Windows\System\VLRFnHc.exe
  C:\Windows\System\VLRFnHc.exe
  2⤵
  PID:12296
- C:\Windows\System\ZDsiABq.exe
  C:\Windows\System\ZDsiABq.exe
  2⤵
  PID:5152
- C:\Windows\System\aKoMDML.exe
  C:\Windows\System\aKoMDML.exe
  2⤵
  PID:11632
- C:\Windows\System\YJTxqbS.exe
  C:\Windows\System\YJTxqbS.exe
  2⤵
  PID:10224
- C:\Windows\System\nbtrRQO.exe
  C:\Windows\System\nbtrRQO.exe
  2⤵
  PID:9600
- C:\Windows\System\HaAsCnD.exe
  C:\Windows\System\HaAsCnD.exe
  2⤵
  PID:12496
- C:\Windows\System\IgdAKBY.exe
  C:\Windows\System\IgdAKBY.exe
  2⤵
  PID:7904
- C:\Windows\System\BOTLVFs.exe
  C:\Windows\System\BOTLVFs.exe
  2⤵
  PID:13528
- C:\Windows\System\iOqKfbA.exe
  C:\Windows\System\iOqKfbA.exe
  2⤵
  PID:11456
- C:\Windows\System\oGHFlVH.exe
  C:\Windows\System\oGHFlVH.exe
  2⤵
  PID:3888
- C:\Windows\System\vgHqpKU.exe
  C:\Windows\System\vgHqpKU.exe
  2⤵
  PID:5044
- C:\Windows\System\ADarQeT.exe
  C:\Windows\System\ADarQeT.exe
  2⤵
  PID:9724
- C:\Windows\System\xYJktlC.exe
  C:\Windows\System\xYJktlC.exe
  2⤵
  PID:11596
- C:\Windows\System\hvWRaPl.exe
  C:\Windows\System\hvWRaPl.exe
  2⤵
  PID:12788
- C:\Windows\System\kFsPGFA.exe
  C:\Windows\System\kFsPGFA.exe
  2⤵
  PID:7104
- C:\Windows\System\JgKwlaF.exe
  C:\Windows\System\JgKwlaF.exe
  2⤵
  PID:9396
- C:\Windows\System\PEItYaX.exe
  C:\Windows\System\PEItYaX.exe
  2⤵
  PID:12020
- C:\Windows\System\mfMwjjC.exe
  C:\Windows\System\mfMwjjC.exe
  2⤵
  PID:7300
- C:\Windows\System\EBfTqlk.exe
  C:\Windows\System\EBfTqlk.exe
  2⤵
  PID:3788
- C:\Windows\System\MQdRlBK.exe
  C:\Windows\System\MQdRlBK.exe
  2⤵
  PID:10064
- C:\Windows\System\CCplUQD.exe
  C:\Windows\System\CCplUQD.exe
  2⤵
  PID:11432
- C:\Windows\System\fKhZcvw.exe
  C:\Windows\System\fKhZcvw.exe
  2⤵
  PID:3836
- C:\Windows\System\yoggXEG.exe
  C:\Windows\System\yoggXEG.exe
  2⤵
  PID:10172
- C:\Windows\System\hQpCZDH.exe
  C:\Windows\System\hQpCZDH.exe
  2⤵
  PID:10272
- C:\Windows\System\BsigcJp.exe
  C:\Windows\System\BsigcJp.exe
  2⤵
  PID:12896
- C:\Windows\System\HYcxoaq.exe
  C:\Windows\System\HYcxoaq.exe
  2⤵
  PID:12544
- C:\Windows\System\WuUDogt.exe
  C:\Windows\System\WuUDogt.exe
  2⤵
  PID:2724
- C:\Windows\System\kISLkHx.exe
  C:\Windows\System\kISLkHx.exe
  2⤵
  PID:11268
- C:\Windows\System\TGYiIPB.exe
  C:\Windows\System\TGYiIPB.exe
  2⤵
  PID:11428
- C:\Windows\System\UGUwERc.exe
  C:\Windows\System\UGUwERc.exe
  2⤵
  PID:8812
- C:\Windows\System\EnKxXby.exe
  C:\Windows\System\EnKxXby.exe
  2⤵
  PID:12340
- C:\Windows\System\IsbGTYV.exe
  C:\Windows\System\IsbGTYV.exe
  2⤵
  PID:13152
- C:\Windows\System\qlTLCoq.exe
  C:\Windows\System\qlTLCoq.exe
  2⤵
  PID:9496
- C:\Windows\System\SjEeztC.exe
  C:\Windows\System\SjEeztC.exe
  2⤵
  PID:7744
- C:\Windows\System\dQNVNph.exe
  C:\Windows\System\dQNVNph.exe
  2⤵
  PID:13072
- C:\Windows\System\sihZqkJ.exe
  C:\Windows\System\sihZqkJ.exe
  2⤵
  PID:12264
- C:\Windows\System\yHJBdbR.exe
  C:\Windows\System\yHJBdbR.exe
  2⤵
  PID:9720
- C:\Windows\System\SpnpejA.exe
  C:\Windows\System\SpnpejA.exe
  2⤵
  PID:12536
- C:\Windows\System\BSnnfxD.exe
  C:\Windows\System\BSnnfxD.exe
  2⤵
  PID:11764
- C:\Windows\System\gOedDhS.exe
  C:\Windows\System\gOedDhS.exe
  2⤵
  PID:12832
- C:\Windows\System\NvvELyt.exe
  C:\Windows\System\NvvELyt.exe
  2⤵
  PID:9420
- C:\Windows\System\bPAiuQm.exe
  C:\Windows\System\bPAiuQm.exe
  2⤵
  PID:10680
- C:\Windows\System\fJyDjOJ.exe
  C:\Windows\System\fJyDjOJ.exe
  2⤵
  PID:5756
- C:\Windows\System\YGiYbdU.exe
  C:\Windows\System\YGiYbdU.exe
  2⤵
  PID:8620
- C:\Windows\System\qsSYImn.exe
  C:\Windows\System\qsSYImn.exe
  2⤵
  PID:12872
- C:\Windows\System\NIEehVS.exe
  C:\Windows\System\NIEehVS.exe
  2⤵
  PID:11160
- C:\Windows\System\cIlzejo.exe
  C:\Windows\System\cIlzejo.exe
  2⤵
  PID:9832
- C:\Windows\System\QEImMEc.exe
  C:\Windows\System\QEImMEc.exe
  2⤵
  PID:12768
- C:\Windows\System\tqrzsXp.exe
  C:\Windows\System\tqrzsXp.exe
  2⤵
  PID:12116
- C:\Windows\System\keqhTCw.exe
  C:\Windows\System\keqhTCw.exe
  2⤵
  PID:12648
- C:\Windows\System\sKpXSGH.exe
  C:\Windows\System\sKpXSGH.exe
  2⤵
  PID:13080
- C:\Windows\System\RcAXcdl.exe
  C:\Windows\System\RcAXcdl.exe
  2⤵
  PID:12560
- C:\Windows\System\vgSPJKr.exe
  C:\Windows\System\vgSPJKr.exe
  2⤵
  PID:7640
- C:\Windows\System\rjcyHUB.exe
  C:\Windows\System\rjcyHUB.exe
  2⤵
  PID:2784
- C:\Windows\System\XuBEBPX.exe
  C:\Windows\System\XuBEBPX.exe
  2⤵
  PID:7236
- C:\Windows\System\CUgVQHt.exe
  C:\Windows\System\CUgVQHt.exe
  2⤵
  PID:12464
- C:\Windows\System\EWGLFGR.exe
  C:\Windows\System\EWGLFGR.exe
  2⤵
  PID:3256
- C:\Windows\System\lVaqliF.exe
  C:\Windows\System\lVaqliF.exe
  2⤵
  PID:10156
- C:\Windows\System\ezTEvNZ.exe
  C:\Windows\System\ezTEvNZ.exe
  2⤵
  PID:12260
- C:\Windows\System\KyFxuAb.exe
  C:\Windows\System\KyFxuAb.exe
  2⤵
  PID:11088
- C:\Windows\System\kkPABSQ.exe
  C:\Windows\System\kkPABSQ.exe
  2⤵
  PID:6564
- C:\Windows\System\eCYMTGl.exe
  C:\Windows\System\eCYMTGl.exe
  2⤵
  PID:13308
- C:\Windows\System\UgOEprQ.exe
  C:\Windows\System\UgOEprQ.exe
  2⤵
  PID:9892
- C:\Windows\System\BJiGerc.exe
  C:\Windows\System\BJiGerc.exe
  2⤵
  PID:12140
- C:\Windows\System\nGlHvrj.exe
  C:\Windows\System\nGlHvrj.exe
  2⤵
  PID:3472
- C:\Windows\System\ijJwnhK.exe
  C:\Windows\System\ijJwnhK.exe
  2⤵
  PID:1696
- C:\Windows\System\zuWNwSm.exe
  C:\Windows\System\zuWNwSm.exe
  2⤵
  PID:11320
- C:\Windows\System\pvjEqyj.exe
  C:\Windows\System\pvjEqyj.exe
  2⤵
  PID:10408
- C:\Windows\System\RqiCpWU.exe
  C:\Windows\System\RqiCpWU.exe
  2⤵
  PID:9684
- C:\Windows\System\UDUYgOW.exe
  C:\Windows\System\UDUYgOW.exe
  2⤵
  PID:12324
- C:\Windows\System\LAfyLcD.exe
  C:\Windows\System\LAfyLcD.exe
  2⤵
  PID:880
- C:\Windows\System\zdBlYEz.exe
  C:\Windows\System\zdBlYEz.exe
  2⤵
  PID:3636
- C:\Windows\System\XhSfPEf.exe
  C:\Windows\System\XhSfPEf.exe
  2⤵
  PID:8376
- C:\Windows\System\kdkuAwy.exe
  C:\Windows\System\kdkuAwy.exe
  2⤵
  PID:10644
- C:\Windows\System\EnbYEYS.exe
  C:\Windows\System\EnbYEYS.exe
  2⤵
  PID:9312
- C:\Windows\System\zwyGbMK.exe
  C:\Windows\System\zwyGbMK.exe
  2⤵
  PID:10608
- C:\Windows\System\ginhrGP.exe
  C:\Windows\System\ginhrGP.exe
  2⤵
  PID:232
- C:\Windows\System\FhHiMml.exe
  C:\Windows\System\FhHiMml.exe
  2⤵
  PID:4288
- C:\Windows\System\xPMqLuV.exe
  C:\Windows\System\xPMqLuV.exe
  2⤵
  PID:12612
- C:\Windows\System\mxOclgi.exe
  C:\Windows\System\mxOclgi.exe
  2⤵
  PID:12576
- C:\Windows\System\HlqcFhz.exe
  C:\Windows\System\HlqcFhz.exe
  2⤵
  PID:12400
- C:\Windows\System\xzgWmkA.exe
  C:\Windows\System\xzgWmkA.exe
  2⤵
  PID:11056
- C:\Windows\System\ShugDdH.exe
  C:\Windows\System\ShugDdH.exe
  2⤵
  PID:12884
- C:\Windows\System\AWpSDbh.exe
  C:\Windows\System\AWpSDbh.exe
  2⤵
  PID:3600
- C:\Windows\System\QjKOblw.exe
  C:\Windows\System\QjKOblw.exe
  2⤵
  PID:13140
- C:\Windows\System\gElvdSW.exe
  C:\Windows\System\gElvdSW.exe
  2⤵
  PID:11724
- C:\Windows\System\DlhpBwC.exe
  C:\Windows\System\DlhpBwC.exe
  2⤵
  PID:7124
- C:\Windows\System\SYyMDcA.exe
  C:\Windows\System\SYyMDcA.exe
  2⤵
  PID:11388
- C:\Windows\System\rsryAsc.exe
  C:\Windows\System\rsryAsc.exe
  2⤵
  PID:13108
- C:\Windows\System\nBdmwQL.exe
  C:\Windows\System\nBdmwQL.exe
  2⤵
  PID:12724
- C:\Windows\System\FDuiDlH.exe
  C:\Windows\System\FDuiDlH.exe
  2⤵
  PID:5032
- C:\Windows\System\FcUbArR.exe
  C:\Windows\System\FcUbArR.exe
  2⤵
  PID:376
- C:\Windows\System\FqJTciQ.exe
  C:\Windows\System\FqJTciQ.exe
  2⤵
  PID:4372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_obbbyi0x.qaj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AwxwCjj.exe

Filesize
1.9MB

MD5
526764904b7d5355f55a462cdde6e8ae

SHA1
c4c0c0adb86c9592706367c9a249e9d0706d55a0

SHA256
449d7e95874127267cbc0655ec661aa643a64a1b125477632a4fc934ec6f3b94

SHA512
be8a4db154add3766b6fba417cdb50a550aae04f57ae7d5c1b64f266ca8a9ecdf96fba9028b64588a998711612bd0886073d8b98981ef590f7ce3697f5a0debb

Download Submit
C:\Windows\System\CaTaBql.exe

Filesize
1.8MB

MD5
0bc8037cea28b0d1792d6cfc0d26514f

SHA1
05c9eee310216a914f78211d79ca7a188b75c91b

SHA256
8cfc2288f992d8d9c470b486d18b4801aa85de3b322967cf3380c7504bb5bd2d

SHA512
50964be0c14714be7d21ca9f52dc9b5807888524115b5fd08be77b1e4f22fca71a46f0a6d651495d3d6545a11787275367e46fad0db8bd5720f920d02b02ef20

Download Submit
C:\Windows\System\DuQEDrZ.exe

Filesize
1.9MB

MD5
13a71bbb4bb55e149b19afd29d935a6d

SHA1
6e77f7651a86d2efab4cdc57c8791fac92c36ea9

SHA256
54622b4a6bfc860f6c0edfaaf1b9c60a1c83f0b7e5ef41c3374e5a2b1409096a

SHA512
a3c9b02049f7ef140eaf0e4a12992e3e5fcd947823a3faf317c2af87ec48352292159c714ec915503206c1336eece94127673d82e64394974965b827c7b51c2a

Download Submit
C:\Windows\System\EMkMbJY.exe

Filesize
1.9MB

MD5
c9d006115ab793e2daa9dcbdb60c58c9

SHA1
619826bcd4b1a5facabf3250e07a20d4e8630483

SHA256
3058e620db73bee5af177bf7b38f91408d47283102009b66c6afbbdd29822570

SHA512
1ae0e795edd3d934ad37734063592c730f4ae62c56268e68a390f76e10561653eab89efb6d703f2973226748b2dc9f6e97880874aef07dae16a1cf2be63b4ad3

Download Submit
C:\Windows\System\FuoTRkH.exe

Filesize
1.8MB

MD5
e8ee71d4481eb05a0fffd26cf0777174

SHA1
2dd20504147fb01d228c4df98a815e81c2dc96ac

SHA256
6b9776db372eb4612f3481eac12be54591760c2e206059e0a7f362fe69be8670

SHA512
08ec32aa3a7cdefcd3fb4fcab6ab591329db6d8d4cf399819640a2c72499bced36087aed64b30762154a6e384fd5501d1592a220582e07441e3caa6347a0f600

Download Submit
C:\Windows\System\GdriXyO.exe

Filesize
1.9MB

MD5
39f810c14bbcb9a016269449b6c05b12

SHA1
02f010728a8766bcf2f142f1bb17055703bd97f3

SHA256
b767e761e573516ba2888e299668fdf04b9f2f608db5162465f3b831c9d50a46

SHA512
aafb64a95e86254d6f0d4d46e8644dc401a538d0a8a4d2d34c63a16cead8b4415e00395db126b096bfd4de76b6d804115d3ef5d71126b6310a7866c62345ab46

Download Submit
C:\Windows\System\JKBWjRS.exe

Filesize
1.8MB

MD5
470684d093bdce91de2f14dd52b30de5

SHA1
0ccb5937d1ee9459bce23e37f1b5045a416b004a

SHA256
c9f33375ae6d1d98b79cffccf742e4fbd225f301216b891f726084e907387e85

SHA512
a3e30c3f97bad77ccc4d48dc9481084445f3756ce76e36956b25bdd9dc8073770c6ced66eb0eb69a77c79f561b081a872c412d548b04a1315af5a2ed3fcf2807

Download Submit
C:\Windows\System\KydqaPU.exe

Filesize
1.9MB

MD5
6c4b32300f26500250c7e236e05d00a8

SHA1
814afbf452c9b1fe585d754e9718e4d3e8e37ca5

SHA256
5471e7c411da6b0f933f84053faf70d8d8800c881a729a00221a08876502842e

SHA512
c9b74f5b99c1f7e1b99eff80a0af851a91b4e098737b18ab4e18893bbe5cd5ae9a0fcdbd6fa3e10d0b5f438dd6ec56ef9eb7da1820b8c4e578fd9ec03057f6ad

Download Submit
C:\Windows\System\LCPLPcQ.exe

Filesize
1.9MB

MD5
a9ecd2b9743352d367216435306bcc8e

SHA1
469fd46a06f55faebdcae1ea46f969565d98ea26

SHA256
101a96da865fe20248d72ddb7494e32e1f03c1253de268484bd69046f0cafe95

SHA512
6bee473ba64107153b8e53c4ec6969f81b4b141336b1b041214f8a20a7c596dad4bd8ea22db2896c8242b9bd2a3c232f754e137673b2a8ce9b7e6e70a9ca9339

Download Submit
C:\Windows\System\LGXcyZy.exe

Filesize
1.8MB

MD5
020bc0981529bc111022560a20174ce8

SHA1
1121b5f11f3625d7a46930501c8cff3f386b797b

SHA256
7be939c66206763d8dce3ddc39300f0ee75950e16e1eb2b771c5def1899954ed

SHA512
7b32f3b31e24752208fa71dfe7db74e716d55507afc66e18f7db183f2bbdf2cb4e335591bb6e582f4a2a9084ef06cc822efba27bc365001e8a2cc04791809403

Download Submit
C:\Windows\System\LONThPo.exe

Filesize
1.9MB

MD5
d128f17494bd9af05713e55d97e596ae

SHA1
3eb6aa5f66e759121e0adaec1d54d4626a593d27

SHA256
c999c19680f9bb38be9615b569299b3a25b62e5a523b88194e8fc4d1e800ed46

SHA512
a90fbf44fe1ba5e5ea5fabb95244d88e55ca0c453ab291d0c43373890e1b1d9ad4a2e03ab408138afc15941dbd99c17f5fa83509f40966711c90576244c30489

Download Submit
C:\Windows\System\LXzoqkG.exe

Filesize
1.9MB

MD5
bcebb7ce2a80a1b16c5fd9c546c98072

SHA1
87fdc94535306831828fb3fbed5adebd5c562438

SHA256
61fc9521d9a2c87eca8681024d5906a3dcf1353971d43e53a0876f3e6f2b5786

SHA512
323e5ff8a36cbe68ddb66ce24e83f3685d586f8974269ac1446929d80263cd1e10acc977449dddcd46efe79a60274ffe85bc3f7beb016279b54fa8c46f3ec397

Download Submit
C:\Windows\System\LYKSCAl.exe

Filesize
1.8MB

MD5
fa137b3582e2941ec7933f9d5f85c74f

SHA1
5682228e190f8bdc5baef124e9b5567dc7bc65e2

SHA256
794bfd1148d362edef9464a5cfa10f916db44c682084bb28d799749346f9b8d3

SHA512
4a7ecf5da0d85ca58421b96105b60b1d5aadb6fe2decd19824ec5b9c9da0e4f941e04f12bab9c2881eba1858f430777fbb665afefd151fd4fb5f02191d3db083

Download Submit
C:\Windows\System\MIeFFeH.exe

Filesize
1.9MB

MD5
6e7a9581f05eec6691e0fbbd7b7ccfd9

SHA1
1b812c4d3077213a5ee7899ade6ea77f1a552301

SHA256
3844fd14287e2de86b2040f0a35c6f0ccc04ab0800a1c1b14cb7267272be99cb

SHA512
2c9f61884fc1e5208d7699174c7e5f41c37c0fea6804dcd6765e7121348f743a5a5c5686bea354a34ca830c8cf6fcf33aecc6142310900dbc04d22389dfd3e10

Download Submit
C:\Windows\System\MtxXLPs.exe

Filesize
1.9MB

MD5
d64ca4183a13e5857b49e3344da27690

SHA1
0d95a7e7a29f7f2de8bd9b5d15e4bd7f01033447

SHA256
9fe4c2d0913f9a55372e0757ab08f3361018cb797713f77fe08e963fa789000e

SHA512
5c0f280bfa63aa96aee456952c59bd3431d7b1d4a2cce18dad78831d10198f36619cf9975feb5657b287296ec489cdd21022e710dac50687e07c45113f4d3020

Download Submit
C:\Windows\System\MwWLwaf.exe

Filesize
1.9MB

MD5
61e431d2ef6d948dfe59439d823d3000

SHA1
aae051a00c7ae2c9f2b30ffc3bed97e1be61d48c

SHA256
ca7633ce621ee1cd0a4cdb3daa1f7ce3c752903c0c2e28de7a160cfabd75a14b

SHA512
aaeb0e4c087bcc684b88ce3d1f1823824da51f7a26d8d90c5b1d6378f48d720a6300552fc3aefa8787435904f15d86143c337b17de05924be20ac3d0c093a17c

Download Submit
C:\Windows\System\NilTiYb.exe

Filesize
1.9MB

MD5
af05e319bef436edc2c2bbe11d28cd04

SHA1
2ad655ea6c6237572d675df7f835315ef5bd7ec3

SHA256
6c6c57298d34f9d4d90acb9e3bad0bb6b19908f4f69833d465477497dded2978

SHA512
ff2f7cc9bfa75f18d06048f4b2da69e17b96ac83510b84475c3edcb310c50bb0f4ac0f5910c08c2becffdbc201943057e46e71b299e9522d521284bcab07e4f9

Download Submit
C:\Windows\System\OQruCly.exe

Filesize
1.9MB

MD5
6e53ad0b2533cba709f851385e979ed6

SHA1
8af0580ec65d1b649805c837b863c08943d1c6ea

SHA256
da710394a5904f370e01bed0f8469720963e263d996f4962b68cb42a4b2acabc

SHA512
e31fed7ccfbb37995f0e002251359be66e14e01c5755e9399236806e06d47002d0c4f8ce3fcc3603f76799e113b4252a36e1fbe19a57ec2e9bb603b8ab628438

Download Submit
C:\Windows\System\QkBLpOG.exe

Filesize
1.9MB

MD5
04d4d0b3f444595b4eb9702503d7e5e4

SHA1
88cb49b445aff66883c4a5d8823638349ef0fcfa

SHA256
3b611ae220cffa05b60a2ab01b6cad26e45702696896ba505fca56df792cbc94

SHA512
c783e8067cef11771d0a8274ee444b81d9502d6c2d74afe226df4048dd2a35006b265c796c84dc08a9270f1482ff3f32083743b7b92f1e2bb2d5dbca21bbafe2

Download Submit
C:\Windows\System\QlYTUOd.exe

Filesize
1.9MB

MD5
e313358f7b2ef904d74832a010664505

SHA1
d3c784825908f756f6aefde5428f3326b12977d5

SHA256
b3c19726fae3a7ec9c8566e25704f78325366517c1245209de1d6900c5e59506

SHA512
57b763c2c10e54e2c1ffe2844de3c127741e253e9beaf2e37b9294ba0ab005ad0450decbb522b94db8bdba051c57c188c70591da6497653f923c6b3432b6755c

Download Submit
C:\Windows\System\Rojteyz.exe

Filesize
1.9MB

MD5
55c5ee991bb6cbc3cfbda06f951d76ff

SHA1
d14fb1d4ad9abfb7a5641c882a58cfc031dd33c2

SHA256
a1780a3995f038a3f136449010a219d8f5eb3679590ebbbdf3209dee384e4c84

SHA512
7aabbbe9d71379f8847bd41b06dd25bc213d7732425c5a2a06cd69cbe22d9985ab2441cdf7210480bc75316aa483926fcf101adb8fa57c3a11288ce8e36bab45

Download Submit
C:\Windows\System\UDCVrup.exe

Filesize
1.9MB

MD5
4e3bf1f411d61b8461e567990064e2b0

SHA1
49cb8fad6f5091b3fdbb572598ae85859b2d4038

SHA256
da894807f1ea504c67d3d0aecc590af2193ef7834db2197671b2e090920813ae

SHA512
885f74a6595a6e9b5c8ee34b45701fbe02886ed827d9bab6f957a48e01071757e52a37b805364870e40d8d0515bd8ddaa8a403f316023af1c490f358acdd7ff3

Download Submit
C:\Windows\System\VeDMJqK.exe

Filesize
1.9MB

MD5
74e48d76d6fbaa4f1d3dbd4706f3676a

SHA1
7f1bc4c22bbb396344d98b61ed62a0426264e6dc

SHA256
77767f6fbee39f00288f3a53f37881078d4515af32745f2f0068209bdb6fc283

SHA512
97d85490e20848910d2fac0837170d2f76b91db611f4f082a82ef8a0984c7dc287546a972c5c373cf9c6203abaad3aab7b7dd3f8b8aabd4d2db0d6559d8aa319

Download Submit
C:\Windows\System\ZvlueIe.exe

Filesize
1.9MB

MD5
740f49b6e20f94059ab1288f80f6dca8

SHA1
661062aa7c8f6d5661f7e7334ba9969ff60c37e0

SHA256
28082a2a6a0761e414844c718a5f77ded2c2c25d262f85c1fccb68905c80cf44

SHA512
2f7285cc124eb83829a619dbc1a54bfe3f13da39c08664afd3391bf1c4b4246d17badd5ac16fed0d00446c7c7667bf46f966d355d2ca2d552fa0135e08d362a7

Download Submit
C:\Windows\System\abkDIKW.exe

Filesize
1.9MB

MD5
77f9af536f2303d803f588ae9b8ccad7

SHA1
260830481e5e6140ebdf870b67735550295c15f9

SHA256
4668d0cafc163071056257cc93c13501d1fcc38fdf063dec3d1b0e0484895d9f

SHA512
3940cd6f786e38f5af39e40fb747911f1d71a5f934239376bd124d5b251f23e8e4d444b5db25f550cd67a153e78a1d3c6476453afc2cdb1b6b01628fb06591ca

Download Submit
C:\Windows\System\bJkfpJr.exe

Filesize
8B

MD5
0a4d9fd0cc8fe1472d155d5d981ff235

SHA1
137003f778b74f1b96494293112b43e4307e765e

SHA256
4707e767d70e4899759ce8aba6535007a27f8c132e3f3e05b8b8ae03c23dd080

SHA512
ad9c5b802b25d2a28cbec3d4cc246b638fad901bd44704bb559f8a0cf5c0d25f339a2e2fe9f4b8bbba249477fc11b0b14c51d97cfa76d081fb255f90811dd5c7

Download Submit
C:\Windows\System\buLcUwn.exe

Filesize
1.9MB

MD5
b3c865db8b91abea7b4738e7fc04a568

SHA1
f71a632fa94eb1617a3eaa2915164b7879fce83b

SHA256
b5989daa8c3a4511037907ac0e1c38092b1b5d89778280133b6546abeef60e3c

SHA512
dcc6daef2488184718f9fb0f074872b5b6b013a249bb9fdd535915fa80b2efadaab43e6ecde47e387c1dcc2d56f98af8732f0ddcb8cba44a6ee294d2ee685673

Download Submit
C:\Windows\System\eDurCIL.exe

Filesize
1.9MB

MD5
e26ad923a481ed0bb9c37fed673cbd3f

SHA1
1140c7e3e152fb57ffb1a9e7f8475b3b398f21bf

SHA256
a2f840e65186430fd454411c6d63b20a6aa515f34df1840c4e766d4642f9e959

SHA512
b2dcef18b7bfd70e30a302f5f111bae40ddfb31aa8ca0cf21cd88ef54b02f0c5fb94d6413d6c9deaeb97599419909061e526ace3a63c18977fe1d111b0db782b

Download Submit
C:\Windows\System\fvhOoqx.exe

Filesize
1.9MB

MD5
51b68c05c7b841b6acc0e46646c7d2d0

SHA1
bd3918e0227d185912111f4f89e92e74cc47a3e3

SHA256
e2d2f01c1572f7dbe672bd8766f05942b35b4dc19d173bfb203acd07f16062c1

SHA512
c6452443740dc039766a44250ea7cc9e2dee72dd8525fff10dd4c4ce66cfd1dd0ac84fc58dffbb2af25497191297dc26fd2f25c0eb3ebd973f8346292844557e

Download Submit
C:\Windows\System\hWxXsSh.exe

Filesize
1.9MB

MD5
380ee5cbe542057408c872dc23b04d58

SHA1
d5685356c40811a523644deb55288e2449ddb760

SHA256
1ebc5434b9d0432d79239fb100b3762d16ced27dc722c27e677f2a8e16bde084

SHA512
5e0a6fb4f63a8a578bbe98cd6e01ccbf168923040016e41a166290d3c7e8dba534a97d69f3a9ff8a1df01095ae1f584f823c225f4d6e17e1a9f7f5915b2296f1

Download Submit
C:\Windows\System\kVDXaZZ.exe

Filesize
1.9MB

MD5
f99bfe788fa9e7fecd180bb0137c3600

SHA1
91199238766207aa35e0482dbe916daebec06970

SHA256
3b5d31a139179e9eabab1b99cd89f14f90c436d09fc16218cd74fd0a9d2dfff3

SHA512
b84bcde29051fc54cd2d123ce3c96020ba5e957673738c9be505124304cf77d9110b5367ea52f330798ab8dc6e250844a51c2735285f649251a2018decb663b8

Download Submit
C:\Windows\System\lPALdHW.exe

Filesize
1.9MB

MD5
82259e449feaa6291a30853a19bd2b29

SHA1
e043f0cda8bfedb06099cec615731b0bf7253fc1

SHA256
a1a2a9952b7fba235ef5d6f5e702b7e4644c4c4fd04782e463330a22f1d3ccbf

SHA512
857a3e139c31dba8fdebf6d69f6b9c6d2a3d518cc0d613b298873d372903e9f97f2dd9ae15b3c1e3e36f7ea00449bf19b26da1dd9cbbc6d03613591587042591

Download Submit
C:\Windows\System\ozhEEEd.exe

Filesize
1.9MB

MD5
186138d1fb2b9edddb5e3c4c7d9ef133

SHA1
a66ea5ae9b4bf0ab95c3f3f2bca9f417b2bc731b

SHA256
c4b0dd3d79661e1d7bbdbb82184d69dd551c5b26918b5ff181c9019f86db7e1e

SHA512
188bbdde6557947377c918ecf64bfd24bc2a5d9f9b2ef59b24306c2f4fd4c7df19064095b0c8636dfb3bc26248b92760a34f72a5f4d4b7edeacb898659951e5e

Download Submit
C:\Windows\System\pFfJdBI.exe

Filesize
1.9MB

MD5
3dcb008983dff2542579bf7fce650d59

SHA1
d68e9631ab930616456df44fe67eae1562c13865

SHA256
8c1e19d61679771f223724222bbde54c1f70b1acbe1cbac20a4062fa02ef4f92

SHA512
6fcfa6f503081d4805cfe5563ea7140f467ea15449bc152078a5d265b05d335754bab4111d2e8d4bd9b5967b8f9877bbfa75cf6cb8d6fd91f49d8cf78270bea4

Download Submit
C:\Windows\System\tFBEDMl.exe

Filesize
1.9MB

MD5
8eea0af5d4d65ae2287545e9e35b0aee

SHA1
72129540e603fd9e1ac4c11a0d7ccb040248d8c6

SHA256
aba30c0a5108ad7ff5e2d771b9cf40335a7d5a790dd49218d26b02fe4f0d7746

SHA512
a5dd246603a9cf4d7fae2322b479d04f42dba19846706396d6375749acbbb22fbbea31631d2c33a65a06511235462746e31c4fe8b4041d965f89a97a78893c20

Download Submit
C:\Windows\System\tXYkBJk.exe

Filesize
1.9MB

MD5
05373d1a3c5bb36456d45f3d568d9a60

SHA1
84c4f3cd18b89e59284a9476dc25abefbaf49fb1

SHA256
f6e920f5ce4bfb8952723251e40fa6852a888908903483cd2f75f5ed95af7ff4

SHA512
4fd9ff7620fcb27d8bd980962b3b9670251b7d1c1347451deaec166c91c65a40ed58bc7d40b00e20d1988f169d9c0316b728235e4f37fd191af310972a5fe106

Download Submit
C:\Windows\System\tvuPLBx.exe

Filesize
1.9MB

MD5
90216c620fc62d1a7eb4ab2d0aae187f

SHA1
14c9ef90e21ccb05615db5529686db92ab6554f2

SHA256
6c0d60c1e6c543cf7e2db0c80a9ad094daa941d561e9659c33f8164d6714132b

SHA512
00a10cc42f21f649a86e844bcb1cde763286b67bc24447bf7e8e3208978ed48f31e3d9dfeff50b9022cffb0f3e5ff3290fff614d231aa561c67b1fa928d2246a

Download Submit
C:\Windows\System\uxUJOAD.exe

Filesize
1.9MB

MD5
e12d225cca5226c6086c48c53fd9c784

SHA1
2e743cbefcc8778f242968014152e5bbf2e1c417

SHA256
f36fe35443b373d82d276df95f96cfc751b8ca9c55994d8a37c13ad72074c64d

SHA512
66853dd485a71524d6c44c813262bc946aca77661b42d20821a6122214bd157a46d1494fb951926700ac98c9eb8a7df7336525c52fd0b42e1947d2feb00d1600

Download Submit
C:\Windows\System\yLgkemf.exe

Filesize
18B

MD5
0ccf85372d6f08655cc5b8a1bfb286c6

SHA1
19c0d15afa3a1724e4aad3aeb560d62824d96ee6

SHA256
e346037445c26dd1dcaee6ec19c9921976440e12a46b5265512a2ebbe020b707

SHA512
46b3e86ab66175e5bdeaa19cae91f567d8c433aabd58be58bf936f08366e274c54b36c7ca0cfdeb255aae1ffab900a8353ef7f99aee465b682ac697979899e2c

Download Submit
C:\Windows\System\yeHTbOn.exe

Filesize
1.9MB

MD5
2f34f66030f5d7143d7139d81c2dfa14

SHA1
372d75885fb3acb95cd4b206e9d55c39e8d33850

SHA256
05afd301a056a5d984c303f1eb3ca11d7f129a0b26fa7345de2b63553fa72147

SHA512
a914627b9c42c4706468146f28b6019e0bbd6806414621df1376d8b7d5a90f2225d52cf32c4b61aea0440e0b331a2d0f6bf64f851ee13f0e6c815276010fa534

Download Submit
C:\Windows\System\yzwRbMt.exe

Filesize
1.9MB

MD5
53fa508ad869dc3bdcc11593b08a05bb

SHA1
76a7ede92659b3e77d9fa5b68f2aaf000275f96a

SHA256
9c6140afdcf5eb18febef1e6eeaf396cce173172a49fa8b03fb53e9ba2372885

SHA512
746e60b2c0a1b4cdf5d2864ee4266e5c7050fcbefa03e0a0c34b417637ca994d01d364e833df4900cd41803efce82e29f78e0675228b96a9d35b49ca563d3281

Download Submit
C:\Windows\System\zEVwoMj.exe

Filesize
1.9MB

MD5
9a3a245b1c6f14b1b5b1a7a3a2954b64

SHA1
12b1aa6fb2b9a371916c2c42c592a4f59098daa6

SHA256
1aa8457ec98dbb3bc2ad8350cfcacdcb6647f9862c223f318d3c4da3ac5deab5

SHA512
bd53882dccd239c3b08a6016ee9324fa5b7a7d173b0bb75f135b78633a606743f7ac08cc4134fbde69ff0b40555e9e472dfe0e8aa01d861e286bef22e260e8bd

Download Submit
memory/456-7820-0x00007FF701410000-0x00007FF701802000-memory.dmp

Filesize
3.9MB

Download
memory/456-337-0x00007FF701410000-0x00007FF701802000-memory.dmp

Filesize
3.9MB

Download
memory/464-7465-0x00007FF7D6280000-0x00007FF7D6672000-memory.dmp

Filesize
3.9MB

Download
memory/464-13-0x00007FF7D6280000-0x00007FF7D6672000-memory.dmp

Filesize
3.9MB

Download
memory/1108-160-0x00007FF7D13F0000-0x00007FF7D17E2000-memory.dmp

Filesize
3.9MB

Download
memory/1280-1-0x000001EE5FEB0000-0x000001EE5FEC0000-memory.dmp

Filesize
64KB

Download
memory/1280-0-0x00007FF6FB100000-0x00007FF6FB4F2000-memory.dmp

Filesize
3.9MB

Download
memory/1320-7814-0x00007FF7F5870000-0x00007FF7F5C62000-memory.dmp

Filesize
3.9MB

Download
memory/1320-339-0x00007FF7F5870000-0x00007FF7F5C62000-memory.dmp

Filesize
3.9MB

Download
memory/1388-11-0x00007FF77D1A0000-0x00007FF77D592000-memory.dmp

Filesize
3.9MB

Download
memory/1708-83-0x00007FF7E36C0000-0x00007FF7E3AB2000-memory.dmp

Filesize
3.9MB

Download
memory/1760-336-0x00007FF6FC740000-0x00007FF6FCB32000-memory.dmp

Filesize
3.9MB

Download
memory/1808-342-0x00007FF7F3130000-0x00007FF7F3522000-memory.dmp

Filesize
3.9MB

Download
memory/1808-7804-0x00007FF7F3130000-0x00007FF7F3522000-memory.dmp

Filesize
3.9MB

Download
memory/1900-6628-0x00007FF617030000-0x00007FF617422000-memory.dmp

Filesize
3.9MB

Download
memory/1900-121-0x00007FF617030000-0x00007FF617422000-memory.dmp

Filesize
3.9MB

Download
memory/1900-7808-0x00007FF617030000-0x00007FF617422000-memory.dmp

Filesize
3.9MB

Download
memory/2220-341-0x00007FF781C90000-0x00007FF782082000-memory.dmp

Filesize
3.9MB

Download
memory/2220-7835-0x00007FF781C90000-0x00007FF782082000-memory.dmp

Filesize
3.9MB

Download
memory/2748-253-0x00007FF76EE30000-0x00007FF76F222000-memory.dmp

Filesize
3.9MB

Download
memory/2748-7802-0x00007FF76EE30000-0x00007FF76F222000-memory.dmp

Filesize
3.9MB

Download
memory/2924-340-0x00007FF6B2770000-0x00007FF6B2B62000-memory.dmp

Filesize
3.9MB

Download
memory/2924-7816-0x00007FF6B2770000-0x00007FF6B2B62000-memory.dmp

Filesize
3.9MB

Download
memory/3208-7798-0x00007FF79A940000-0x00007FF79AD32000-memory.dmp

Filesize
3.9MB

Download
memory/3208-307-0x00007FF79A940000-0x00007FF79AD32000-memory.dmp

Filesize
3.9MB

Download
memory/4176-7786-0x00007FF7178C0000-0x00007FF717CB2000-memory.dmp

Filesize
3.9MB

Download
memory/4176-333-0x00007FF7178C0000-0x00007FF717CB2000-memory.dmp

Filesize
3.9MB

Download
memory/4464-218-0x00007FF643220000-0x00007FF643612000-memory.dmp

Filesize
3.9MB

Download
memory/4464-7781-0x00007FF643220000-0x00007FF643612000-memory.dmp

Filesize
3.9MB

Download
memory/4600-338-0x00007FF6B27A0000-0x00007FF6B2B92000-memory.dmp

Filesize
3.9MB

Download
memory/4600-7812-0x00007FF6B27A0000-0x00007FF6B2B92000-memory.dmp

Filesize
3.9MB

Download
memory/4656-7810-0x00007FF77D5A0000-0x00007FF77D992000-memory.dmp

Filesize
3.9MB

Download
memory/4656-250-0x00007FF77D5A0000-0x00007FF77D992000-memory.dmp

Filesize
3.9MB

Download
memory/4760-334-0x00007FF7FD6E0000-0x00007FF7FDAD2000-memory.dmp

Filesize
3.9MB

Download
memory/4760-7824-0x00007FF7FD6E0000-0x00007FF7FDAD2000-memory.dmp

Filesize
3.9MB

Download
memory/4844-17-0x00007FF681080000-0x00007FF681472000-memory.dmp

Filesize
3.9MB

Download
memory/4956-168-0x00007FF668DC0000-0x00007FF6691B2000-memory.dmp

Filesize
3.9MB

Download
memory/4956-7784-0x00007FF668DC0000-0x00007FF6691B2000-memory.dmp

Filesize
3.9MB

Download
memory/5084-60-0x0000018D2AD40000-0x0000018D2AD50000-memory.dmp

Filesize
64KB

Download
memory/5084-115-0x0000018D2ACC0000-0x0000018D2ACE2000-memory.dmp

Filesize
136KB

Download
memory/5084-56-0x00007FFFD8E40000-0x00007FFFD9901000-memory.dmp

Filesize
10.8MB

Download
memory/5112-7806-0x00007FF673020000-0x00007FF673412000-memory.dmp

Filesize
3.9MB

Download
memory/5112-335-0x00007FF673020000-0x00007FF673412000-memory.dmp

Filesize
3.9MB

Download