xmrig | 1c0cb2ed8d6b87d6a4eef8d423969d9c41f3f4d0401637cbdd75ed62a12be13e

Analysis

max time kernel
125s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
Size

2.1MB
MD5

03d07d05cd58a72933395a3073b9fe40
SHA1

af86ecf3a1b2d868977348a5fa5841a553005832
SHA256

1c0cb2ed8d6b87d6a4eef8d423969d9c41f3f4d0401637cbdd75ed62a12be13e
SHA512

bf52bb31f3571a4d3ec85ba0318eb7d412093703dd2db348e69dfc0a3e6d9604534398907aba5954923c2fe845bbbff77284eee0408d71d2f0e3f06c964d15fb
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafws1PO:NABL

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 26 IoCs

miner

resource	yara_rule
behavioral2/memory/872-83-0x00007FF740D30000-0x00007FF741122000-memory.dmp	xmrig
behavioral2/memory/3544-90-0x00007FF77C870000-0x00007FF77CC62000-memory.dmp	xmrig
behavioral2/memory/3960-125-0x00007FF7DE490000-0x00007FF7DE882000-memory.dmp	xmrig
behavioral2/memory/4488-119-0x00007FF6ABD80000-0x00007FF6AC172000-memory.dmp	xmrig
behavioral2/memory/2784-113-0x00007FF7D5AD0000-0x00007FF7D5EC2000-memory.dmp	xmrig
behavioral2/memory/4276-107-0x00007FF6C82B0000-0x00007FF6C86A2000-memory.dmp	xmrig
behavioral2/memory/2132-106-0x00007FF6C4400000-0x00007FF6C47F2000-memory.dmp	xmrig
behavioral2/memory/4836-100-0x00007FF64BE90000-0x00007FF64C282000-memory.dmp	xmrig
behavioral2/memory/2928-84-0x00007FF76F500000-0x00007FF76F8F2000-memory.dmp	xmrig
behavioral2/memory/2212-76-0x00007FF79DBA0000-0x00007FF79DF92000-memory.dmp	xmrig
behavioral2/memory/2900-70-0x00007FF72A580000-0x00007FF72A972000-memory.dmp	xmrig
behavioral2/memory/1012-47-0x00007FF796580000-0x00007FF796972000-memory.dmp	xmrig
behavioral2/memory/864-42-0x00007FF697DA0000-0x00007FF698192000-memory.dmp	xmrig
behavioral2/memory/3436-37-0x00007FF7C8320000-0x00007FF7C8712000-memory.dmp	xmrig
behavioral2/memory/1980-2623-0x00007FF71B4F0000-0x00007FF71B8E2000-memory.dmp	xmrig
behavioral2/memory/5092-2626-0x00007FF7885F0000-0x00007FF7889E2000-memory.dmp	xmrig
behavioral2/memory/1260-3816-0x00007FF6C87B0000-0x00007FF6C8BA2000-memory.dmp	xmrig
behavioral2/memory/3988-3817-0x00007FF6B9380000-0x00007FF6B9772000-memory.dmp	xmrig
behavioral2/memory/3408-4773-0x00007FF7E4CA0000-0x00007FF7E5092000-memory.dmp	xmrig
behavioral2/memory/3436-5222-0x00007FF7C8320000-0x00007FF7C8712000-memory.dmp	xmrig
behavioral2/memory/872-5291-0x00007FF740D30000-0x00007FF741122000-memory.dmp	xmrig
behavioral2/memory/1980-5294-0x00007FF71B4F0000-0x00007FF71B8E2000-memory.dmp	xmrig
behavioral2/memory/3544-5307-0x00007FF77C870000-0x00007FF77CC62000-memory.dmp	xmrig
behavioral2/memory/5092-5304-0x00007FF7885F0000-0x00007FF7889E2000-memory.dmp	xmrig
behavioral2/memory/3408-5377-0x00007FF7E4CA0000-0x00007FF7E5092000-memory.dmp	xmrig
behavioral2/memory/4512-5371-0x00007FF6802E0000-0x00007FF6806D2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4472	GlTmSgI.exe
2212	nEdNsof.exe
3436	wIDOopA.exe
864	GqZOHHE.exe
1012	xLuVLyX.exe
872	AqCAyrw.exe
1980	LciugeS.exe
2928	JnhYvdM.exe
2900	gvkyHlw.exe
3544	PKxbEUV.exe
4836	qVacuGE.exe
2132	fgqIIOF.exe
5092	vjpUrMm.exe
4276	cbUXTpS.exe
2784	HajukVS.exe
4488	zSlLDpu.exe
3960	GJHNfwo.exe
1260	qznvCej.exe
3988	pmYuzmr.exe
4512	HLLhhke.exe
3408	ZAMJrdd.exe
1764	EABDUAg.exe
1716	koNItUt.exe
1124	pvPAtNL.exe
3756	LDvpEwe.exe
1948	FtcFaVv.exe
852	vtSMZFR.exe
3068	TjjJiiX.exe
3128	feoePDL.exe
5064	Ckjzqfo.exe
1300	yKFekDi.exe
4344	wBPeoeD.exe
2112	FHATjiE.exe
3244	nJwXaIp.exe
4164	yxLFzgv.exe
2144	nlwyQbr.exe
4872	FMnfEBa.exe
4912	CgTVRrO.exe
3164	DiESHEb.exe
1724	UJinriN.exe
116	peppzuq.exe
1252	CqGDTrB.exe
4632	SdwnNcF.exe
4292	ZwGNKVW.exe
3040	vETWbbe.exe
2060	UrNtcNC.exe
1732	AmTPwtu.exe
3200	VxybDKi.exe
3692	PHRvJJw.exe
5000	isihRWZ.exe
4240	kIEpMOS.exe
4532	AXALHxu.exe
1604	QDALwiI.exe
4084	pljOfID.exe
2196	cUIgNNO.exe
4332	QpxrOCn.exe
4572	snTCCKy.exe
2972	GCneVpR.exe
3084	yubPsTs.exe
2568	STKsbSL.exe
3248	zvBUkZn.exe
2904	xeKdgyJ.exe
532	OuKBQSv.exe
5080	FBkwRtu.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3696-0-0x00007FF7417E0000-0x00007FF741BD2000-memory.dmp	upx
behavioral2/files/0x000d000000023bb9-5.dat	upx
behavioral2/files/0x000a000000023bc2-17.dat	upx
behavioral2/files/0x000a000000023bc3-20.dat	upx
behavioral2/files/0x000a000000023bc1-15.dat	upx
behavioral2/memory/4472-9-0x00007FF749F80000-0x00007FF74A372000-memory.dmp	upx
behavioral2/files/0x000a000000023bc4-26.dat	upx
behavioral2/files/0x000a000000023bc7-45.dat	upx
behavioral2/files/0x000a000000023bc6-48.dat	upx
behavioral2/files/0x000a000000023bc8-55.dat	upx
behavioral2/files/0x000a000000023bca-73.dat	upx
behavioral2/memory/872-83-0x00007FF740D30000-0x00007FF741122000-memory.dmp	upx
behavioral2/memory/3544-90-0x00007FF77C870000-0x00007FF77CC62000-memory.dmp	upx
behavioral2/memory/5092-96-0x00007FF7885F0000-0x00007FF7889E2000-memory.dmp	upx
behavioral2/files/0x000a000000023bce-101.dat	upx
behavioral2/files/0x000b000000023bcb-110.dat	upx
behavioral2/files/0x000a000000023bd0-126.dat	upx
behavioral2/files/0x000a000000023bd3-144.dat	upx
behavioral2/files/0x000a000000023bd7-157.dat	upx
behavioral2/files/0x000a000000023bda-172.dat	upx
behavioral2/files/0x000a000000023bdf-197.dat	upx
behavioral2/files/0x000a000000023bdd-195.dat	upx
behavioral2/files/0x000a000000023bde-192.dat	upx
behavioral2/files/0x000a000000023bdc-190.dat	upx
behavioral2/files/0x000a000000023bdb-185.dat	upx
behavioral2/files/0x000a000000023bd9-175.dat	upx
behavioral2/files/0x000a000000023bd8-170.dat	upx
behavioral2/files/0x000a000000023bd6-160.dat	upx
behavioral2/files/0x000a000000023bd5-155.dat	upx
behavioral2/files/0x000a000000023bd4-150.dat	upx
behavioral2/memory/3408-149-0x00007FF7E4CA0000-0x00007FF7E5092000-memory.dmp	upx
behavioral2/memory/4512-143-0x00007FF6802E0000-0x00007FF6806D2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd2-138.dat	upx
behavioral2/memory/3988-137-0x00007FF6B9380000-0x00007FF6B9772000-memory.dmp	upx
behavioral2/files/0x000a000000023bd1-132.dat	upx
behavioral2/memory/1260-131-0x00007FF6C87B0000-0x00007FF6C8BA2000-memory.dmp	upx
behavioral2/memory/3960-125-0x00007FF7DE490000-0x00007FF7DE882000-memory.dmp	upx
behavioral2/memory/4488-119-0x00007FF6ABD80000-0x00007FF6AC172000-memory.dmp	upx
behavioral2/files/0x000b000000023bbe-114.dat	upx
behavioral2/memory/2784-113-0x00007FF7D5AD0000-0x00007FF7D5EC2000-memory.dmp	upx
behavioral2/files/0x000a000000023bcf-108.dat	upx
behavioral2/memory/4276-107-0x00007FF6C82B0000-0x00007FF6C86A2000-memory.dmp	upx
behavioral2/memory/2132-106-0x00007FF6C4400000-0x00007FF6C47F2000-memory.dmp	upx
behavioral2/memory/4836-100-0x00007FF64BE90000-0x00007FF64C282000-memory.dmp	upx
behavioral2/files/0x000b000000023bcc-92.dat	upx
behavioral2/files/0x000a000000023bcd-85.dat	upx
behavioral2/memory/2928-84-0x00007FF76F500000-0x00007FF76F8F2000-memory.dmp	upx
behavioral2/memory/2212-76-0x00007FF79DBA0000-0x00007FF79DF92000-memory.dmp	upx
behavioral2/files/0x000a000000023bc9-71.dat	upx
behavioral2/memory/2900-70-0x00007FF72A580000-0x00007FF72A972000-memory.dmp	upx
behavioral2/memory/1980-51-0x00007FF71B4F0000-0x00007FF71B8E2000-memory.dmp	upx
behavioral2/memory/1012-47-0x00007FF796580000-0x00007FF796972000-memory.dmp	upx
behavioral2/memory/864-42-0x00007FF697DA0000-0x00007FF698192000-memory.dmp	upx
behavioral2/files/0x000a000000023bc5-43.dat	upx
behavioral2/memory/3436-37-0x00007FF7C8320000-0x00007FF7C8712000-memory.dmp	upx
behavioral2/memory/1980-2623-0x00007FF71B4F0000-0x00007FF71B8E2000-memory.dmp	upx
behavioral2/memory/5092-2626-0x00007FF7885F0000-0x00007FF7889E2000-memory.dmp	upx
behavioral2/memory/1260-3816-0x00007FF6C87B0000-0x00007FF6C8BA2000-memory.dmp	upx
behavioral2/memory/3988-3817-0x00007FF6B9380000-0x00007FF6B9772000-memory.dmp	upx
behavioral2/memory/3408-4773-0x00007FF7E4CA0000-0x00007FF7E5092000-memory.dmp	upx
behavioral2/memory/3436-5222-0x00007FF7C8320000-0x00007FF7C8712000-memory.dmp	upx
behavioral2/memory/872-5291-0x00007FF740D30000-0x00007FF741122000-memory.dmp	upx
behavioral2/memory/1980-5294-0x00007FF71B4F0000-0x00007FF71B8E2000-memory.dmp	upx
behavioral2/memory/3544-5307-0x00007FF77C870000-0x00007FF77CC62000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZNzyMXS.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\GjZDDcW.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\RpesXwL.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\vFFVKEu.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\yEkUChu.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\fsQHXHa.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\mrTvvSF.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\wONkSfN.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\apuYmpC.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\dfNQIeZ.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\fcvsiNx.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\qvopaEv.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\ruweVPi.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\yKFBfbf.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\zdrZUjz.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\OkgZFDy.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\txeBTfJ.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\LqETqcQ.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\QPnioxu.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\lgQdjgv.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\ZRPPPtc.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\ZJTWEqY.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\mryZUjE.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\gUgLmIL.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\FDKvMzY.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\gOLxnjY.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\ZUSUHta.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\gzNyciE.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\uCKvCXg.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\VOwFAuG.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\nhqdoWb.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\uvadlBV.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\DDJmQKf.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\pWBVdnH.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\HXowmDq.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\bSUYHvA.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\snTCCKy.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\qqhXWwR.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\wpUUNzW.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\yVhZEml.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\jUevbEj.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\hDxVxjc.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\OqsOLpB.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\SDdrhMy.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\oiAtpal.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\HXRrdMu.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\xWefXxw.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\ZKuHXwm.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\nBXuWPS.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\sWPeLxg.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\bAmkazS.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\FbGkisz.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\VoHBvvn.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\gSnSogt.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\orPlQZy.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\RPnguez.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\pEjxpKz.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\wkcqbBN.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\SkMhIVP.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\WwAWahA.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\BzWCoAf.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\obNkMPZ.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\ioCXoUG.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\qywlwBH.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1472	powershell.exe
1472	powershell.exe
1472	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
Token: SeDebugPrivilege	1472	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 1472	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	84
PID 3696 wrote to memory of 1472	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	84
PID 3696 wrote to memory of 4472	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	85
PID 3696 wrote to memory of 4472	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	85
PID 3696 wrote to memory of 2212	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	86
PID 3696 wrote to memory of 2212	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	86
PID 3696 wrote to memory of 3436	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	87
PID 3696 wrote to memory of 3436	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	87
PID 3696 wrote to memory of 864	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	88
PID 3696 wrote to memory of 864	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	88
PID 3696 wrote to memory of 1012	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	89
PID 3696 wrote to memory of 1012	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	89
PID 3696 wrote to memory of 872	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	90
PID 3696 wrote to memory of 872	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	90
PID 3696 wrote to memory of 1980	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	91
PID 3696 wrote to memory of 1980	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	91
PID 3696 wrote to memory of 2928	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	92
PID 3696 wrote to memory of 2928	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	92
PID 3696 wrote to memory of 2900	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	93
PID 3696 wrote to memory of 2900	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	93
PID 3696 wrote to memory of 3544	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	94
PID 3696 wrote to memory of 3544	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	94
PID 3696 wrote to memory of 4836	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	95
PID 3696 wrote to memory of 4836	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	95
PID 3696 wrote to memory of 2132	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	96
PID 3696 wrote to memory of 2132	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	96
PID 3696 wrote to memory of 5092	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	97
PID 3696 wrote to memory of 5092	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	97
PID 3696 wrote to memory of 4276	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	98
PID 3696 wrote to memory of 4276	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	98
PID 3696 wrote to memory of 2784	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	99
PID 3696 wrote to memory of 2784	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	99
PID 3696 wrote to memory of 4488	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	100
PID 3696 wrote to memory of 4488	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	100
PID 3696 wrote to memory of 3960	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	101
PID 3696 wrote to memory of 3960	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	101
PID 3696 wrote to memory of 1260	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	102
PID 3696 wrote to memory of 1260	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	102
PID 3696 wrote to memory of 3988	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	103
PID 3696 wrote to memory of 3988	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	103
PID 3696 wrote to memory of 4512	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	104
PID 3696 wrote to memory of 4512	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	104
PID 3696 wrote to memory of 3408	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	105
PID 3696 wrote to memory of 3408	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	105
PID 3696 wrote to memory of 1764	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	106
PID 3696 wrote to memory of 1764	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	106
PID 3696 wrote to memory of 1716	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	107
PID 3696 wrote to memory of 1716	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	107
PID 3696 wrote to memory of 1124	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	108
PID 3696 wrote to memory of 1124	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	108
PID 3696 wrote to memory of 3756	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	109
PID 3696 wrote to memory of 3756	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	109
PID 3696 wrote to memory of 1948	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	110
PID 3696 wrote to memory of 1948	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	110
PID 3696 wrote to memory of 852	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	111
PID 3696 wrote to memory of 852	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	111
PID 3696 wrote to memory of 3068	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	112
PID 3696 wrote to memory of 3068	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	112
PID 3696 wrote to memory of 3128	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	113
PID 3696 wrote to memory of 3128	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	113
PID 3696 wrote to memory of 5064	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	114
PID 3696 wrote to memory of 5064	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	114
PID 3696 wrote to memory of 1300	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	115
PID 3696 wrote to memory of 1300	3696	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1472
- C:\Windows\System\GlTmSgI.exe
  C:\Windows\System\GlTmSgI.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\nEdNsof.exe
  C:\Windows\System\nEdNsof.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\wIDOopA.exe
  C:\Windows\System\wIDOopA.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\GqZOHHE.exe
  C:\Windows\System\GqZOHHE.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\xLuVLyX.exe
  C:\Windows\System\xLuVLyX.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\AqCAyrw.exe
  C:\Windows\System\AqCAyrw.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\LciugeS.exe
  C:\Windows\System\LciugeS.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\JnhYvdM.exe
  C:\Windows\System\JnhYvdM.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\gvkyHlw.exe
  C:\Windows\System\gvkyHlw.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\PKxbEUV.exe
  C:\Windows\System\PKxbEUV.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\qVacuGE.exe
  C:\Windows\System\qVacuGE.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\fgqIIOF.exe
  C:\Windows\System\fgqIIOF.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\vjpUrMm.exe
  C:\Windows\System\vjpUrMm.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\cbUXTpS.exe
  C:\Windows\System\cbUXTpS.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\HajukVS.exe
  C:\Windows\System\HajukVS.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\zSlLDpu.exe
  C:\Windows\System\zSlLDpu.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\GJHNfwo.exe
  C:\Windows\System\GJHNfwo.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\qznvCej.exe
  C:\Windows\System\qznvCej.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\pmYuzmr.exe
  C:\Windows\System\pmYuzmr.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\HLLhhke.exe
  C:\Windows\System\HLLhhke.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\ZAMJrdd.exe
  C:\Windows\System\ZAMJrdd.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\EABDUAg.exe
  C:\Windows\System\EABDUAg.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\koNItUt.exe
  C:\Windows\System\koNItUt.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\pvPAtNL.exe
  C:\Windows\System\pvPAtNL.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\LDvpEwe.exe
  C:\Windows\System\LDvpEwe.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\FtcFaVv.exe
  C:\Windows\System\FtcFaVv.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\vtSMZFR.exe
  C:\Windows\System\vtSMZFR.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\TjjJiiX.exe
  C:\Windows\System\TjjJiiX.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\feoePDL.exe
  C:\Windows\System\feoePDL.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\Ckjzqfo.exe
  C:\Windows\System\Ckjzqfo.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\yKFekDi.exe
  C:\Windows\System\yKFekDi.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\wBPeoeD.exe
  C:\Windows\System\wBPeoeD.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\FHATjiE.exe
  C:\Windows\System\FHATjiE.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\nJwXaIp.exe
  C:\Windows\System\nJwXaIp.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\yxLFzgv.exe
  C:\Windows\System\yxLFzgv.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\nlwyQbr.exe
  C:\Windows\System\nlwyQbr.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\FMnfEBa.exe
  C:\Windows\System\FMnfEBa.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\CgTVRrO.exe
  C:\Windows\System\CgTVRrO.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\DiESHEb.exe
  C:\Windows\System\DiESHEb.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\UJinriN.exe
  C:\Windows\System\UJinriN.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\peppzuq.exe
  C:\Windows\System\peppzuq.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\CqGDTrB.exe
  C:\Windows\System\CqGDTrB.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\SdwnNcF.exe
  C:\Windows\System\SdwnNcF.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\ZwGNKVW.exe
  C:\Windows\System\ZwGNKVW.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\vETWbbe.exe
  C:\Windows\System\vETWbbe.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\UrNtcNC.exe
  C:\Windows\System\UrNtcNC.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\AmTPwtu.exe
  C:\Windows\System\AmTPwtu.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\VxybDKi.exe
  C:\Windows\System\VxybDKi.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\PHRvJJw.exe
  C:\Windows\System\PHRvJJw.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\isihRWZ.exe
  C:\Windows\System\isihRWZ.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\kIEpMOS.exe
  C:\Windows\System\kIEpMOS.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\AXALHxu.exe
  C:\Windows\System\AXALHxu.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\QDALwiI.exe
  C:\Windows\System\QDALwiI.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\pljOfID.exe
  C:\Windows\System\pljOfID.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\cUIgNNO.exe
  C:\Windows\System\cUIgNNO.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\QpxrOCn.exe
  C:\Windows\System\QpxrOCn.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\snTCCKy.exe
  C:\Windows\System\snTCCKy.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\GCneVpR.exe
  C:\Windows\System\GCneVpR.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\yubPsTs.exe
  C:\Windows\System\yubPsTs.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\STKsbSL.exe
  C:\Windows\System\STKsbSL.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\zvBUkZn.exe
  C:\Windows\System\zvBUkZn.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\xeKdgyJ.exe
  C:\Windows\System\xeKdgyJ.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\OuKBQSv.exe
  C:\Windows\System\OuKBQSv.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\FBkwRtu.exe
  C:\Windows\System\FBkwRtu.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\VWzfREV.exe
  C:\Windows\System\VWzfREV.exe
  2⤵
  PID:4284
- C:\Windows\System\QXURzlY.exe
  C:\Windows\System\QXURzlY.exe
  2⤵
  PID:4500
- C:\Windows\System\tTYshkF.exe
  C:\Windows\System\tTYshkF.exe
  2⤵
  PID:5004
- C:\Windows\System\vtWSeAu.exe
  C:\Windows\System\vtWSeAu.exe
  2⤵
  PID:1956
- C:\Windows\System\lVXMngp.exe
  C:\Windows\System\lVXMngp.exe
  2⤵
  PID:4716
- C:\Windows\System\XCAXlni.exe
  C:\Windows\System\XCAXlni.exe
  2⤵
  PID:5024
- C:\Windows\System\hPTReGI.exe
  C:\Windows\System\hPTReGI.exe
  2⤵
  PID:2984
- C:\Windows\System\mOrZnSb.exe
  C:\Windows\System\mOrZnSb.exe
  2⤵
  PID:2708
- C:\Windows\System\FbGRldC.exe
  C:\Windows\System\FbGRldC.exe
  2⤵
  PID:260
- C:\Windows\System\TJFAbdu.exe
  C:\Windows\System\TJFAbdu.exe
  2⤵
  PID:448
- C:\Windows\System\aBKBDfE.exe
  C:\Windows\System\aBKBDfE.exe
  2⤵
  PID:5132
- C:\Windows\System\RIXxldo.exe
  C:\Windows\System\RIXxldo.exe
  2⤵
  PID:5160
- C:\Windows\System\kKOcaDW.exe
  C:\Windows\System\kKOcaDW.exe
  2⤵
  PID:5188
- C:\Windows\System\gcXUgHU.exe
  C:\Windows\System\gcXUgHU.exe
  2⤵
  PID:5216
- C:\Windows\System\mWUmDLS.exe
  C:\Windows\System\mWUmDLS.exe
  2⤵
  PID:5236
- C:\Windows\System\NtSBQiP.exe
  C:\Windows\System\NtSBQiP.exe
  2⤵
  PID:5264
- C:\Windows\System\pbTKJRH.exe
  C:\Windows\System\pbTKJRH.exe
  2⤵
  PID:5292
- C:\Windows\System\VgQVhph.exe
  C:\Windows\System\VgQVhph.exe
  2⤵
  PID:5316
- C:\Windows\System\iBYjTKq.exe
  C:\Windows\System\iBYjTKq.exe
  2⤵
  PID:5348
- C:\Windows\System\GlxwImt.exe
  C:\Windows\System\GlxwImt.exe
  2⤵
  PID:5376
- C:\Windows\System\ywzfHpn.exe
  C:\Windows\System\ywzfHpn.exe
  2⤵
  PID:5404
- C:\Windows\System\jxTTNyp.exe
  C:\Windows\System\jxTTNyp.exe
  2⤵
  PID:5432
- C:\Windows\System\cxbZnfu.exe
  C:\Windows\System\cxbZnfu.exe
  2⤵
  PID:5460
- C:\Windows\System\MjsmeZj.exe
  C:\Windows\System\MjsmeZj.exe
  2⤵
  PID:5488
- C:\Windows\System\wWeOtvq.exe
  C:\Windows\System\wWeOtvq.exe
  2⤵
  PID:5516
- C:\Windows\System\QCfVCJm.exe
  C:\Windows\System\QCfVCJm.exe
  2⤵
  PID:5544
- C:\Windows\System\CgyrXIr.exe
  C:\Windows\System\CgyrXIr.exe
  2⤵
  PID:5568
- C:\Windows\System\tJJcOkZ.exe
  C:\Windows\System\tJJcOkZ.exe
  2⤵
  PID:5600
- C:\Windows\System\rWzAKcU.exe
  C:\Windows\System\rWzAKcU.exe
  2⤵
  PID:5624
- C:\Windows\System\qnCaihi.exe
  C:\Windows\System\qnCaihi.exe
  2⤵
  PID:5656
- C:\Windows\System\gjSLVqJ.exe
  C:\Windows\System\gjSLVqJ.exe
  2⤵
  PID:5680
- C:\Windows\System\WcSgJYX.exe
  C:\Windows\System\WcSgJYX.exe
  2⤵
  PID:5708
- C:\Windows\System\NBCiUzj.exe
  C:\Windows\System\NBCiUzj.exe
  2⤵
  PID:5740
- C:\Windows\System\ORijUYe.exe
  C:\Windows\System\ORijUYe.exe
  2⤵
  PID:5768
- C:\Windows\System\xaNMjRC.exe
  C:\Windows\System\xaNMjRC.exe
  2⤵
  PID:5796
- C:\Windows\System\NEyGZzY.exe
  C:\Windows\System\NEyGZzY.exe
  2⤵
  PID:5824
- C:\Windows\System\RKoApsa.exe
  C:\Windows\System\RKoApsa.exe
  2⤵
  PID:5852
- C:\Windows\System\jArjzxE.exe
  C:\Windows\System\jArjzxE.exe
  2⤵
  PID:5880
- C:\Windows\System\BTNTdDF.exe
  C:\Windows\System\BTNTdDF.exe
  2⤵
  PID:5908
- C:\Windows\System\LZEFWaI.exe
  C:\Windows\System\LZEFWaI.exe
  2⤵
  PID:5932
- C:\Windows\System\tWzWRWc.exe
  C:\Windows\System\tWzWRWc.exe
  2⤵
  PID:5960
- C:\Windows\System\GhyTfhc.exe
  C:\Windows\System\GhyTfhc.exe
  2⤵
  PID:5992
- C:\Windows\System\mRtzXNO.exe
  C:\Windows\System\mRtzXNO.exe
  2⤵
  PID:6020
- C:\Windows\System\GDDvvYK.exe
  C:\Windows\System\GDDvvYK.exe
  2⤵
  PID:6048
- C:\Windows\System\uwqDkEG.exe
  C:\Windows\System\uwqDkEG.exe
  2⤵
  PID:6076
- C:\Windows\System\HrIIJIt.exe
  C:\Windows\System\HrIIJIt.exe
  2⤵
  PID:6100
- C:\Windows\System\HXRrdMu.exe
  C:\Windows\System\HXRrdMu.exe
  2⤵
  PID:6132
- C:\Windows\System\OLkfuUR.exe
  C:\Windows\System\OLkfuUR.exe
  2⤵
  PID:1424
- C:\Windows\System\bKrTElh.exe
  C:\Windows\System\bKrTElh.exe
  2⤵
  PID:4368
- C:\Windows\System\TyWzXgD.exe
  C:\Windows\System\TyWzXgD.exe
  2⤵
  PID:2852
- C:\Windows\System\jNjHXQE.exe
  C:\Windows\System\jNjHXQE.exe
  2⤵
  PID:4948
- C:\Windows\System\EtYGgNL.exe
  C:\Windows\System\EtYGgNL.exe
  2⤵
  PID:5152
- C:\Windows\System\ZmHttab.exe
  C:\Windows\System\ZmHttab.exe
  2⤵
  PID:5212
- C:\Windows\System\djvpGIa.exe
  C:\Windows\System\djvpGIa.exe
  2⤵
  PID:5280
- C:\Windows\System\qEGCTnw.exe
  C:\Windows\System\qEGCTnw.exe
  2⤵
  PID:5340
- C:\Windows\System\VrsJlRH.exe
  C:\Windows\System\VrsJlRH.exe
  2⤵
  PID:5396
- C:\Windows\System\JxugEMb.exe
  C:\Windows\System\JxugEMb.exe
  2⤵
  PID:5472
- C:\Windows\System\xfvUGaN.exe
  C:\Windows\System\xfvUGaN.exe
  2⤵
  PID:5532
- C:\Windows\System\gATBPAL.exe
  C:\Windows\System\gATBPAL.exe
  2⤵
  PID:5584
- C:\Windows\System\YLAkfrN.exe
  C:\Windows\System\YLAkfrN.exe
  2⤵
  PID:5644
- C:\Windows\System\RBDqqRb.exe
  C:\Windows\System\RBDqqRb.exe
  2⤵
  PID:5696
- C:\Windows\System\tRhpIYA.exe
  C:\Windows\System\tRhpIYA.exe
  2⤵
  PID:5756
- C:\Windows\System\tFANXzd.exe
  C:\Windows\System\tFANXzd.exe
  2⤵
  PID:1428
- C:\Windows\System\XPTErIA.exe
  C:\Windows\System\XPTErIA.exe
  2⤵
  PID:5868
- C:\Windows\System\jZfWhYW.exe
  C:\Windows\System\jZfWhYW.exe
  2⤵
  PID:5948
- C:\Windows\System\xRxakHM.exe
  C:\Windows\System\xRxakHM.exe
  2⤵
  PID:5984
- C:\Windows\System\TSNHxMQ.exe
  C:\Windows\System\TSNHxMQ.exe
  2⤵
  PID:6060
- C:\Windows\System\qxBppKq.exe
  C:\Windows\System\qxBppKq.exe
  2⤵
  PID:6116
- C:\Windows\System\NPendAW.exe
  C:\Windows\System\NPendAW.exe
  2⤵
  PID:5100
- C:\Windows\System\RepEJjS.exe
  C:\Windows\System\RepEJjS.exe
  2⤵
  PID:1596
- C:\Windows\System\SfobEpn.exe
  C:\Windows\System\SfobEpn.exe
  2⤵
  PID:5184
- C:\Windows\System\rcrXStu.exe
  C:\Windows\System\rcrXStu.exe
  2⤵
  PID:5312
- C:\Windows\System\sOoHQEB.exe
  C:\Windows\System\sOoHQEB.exe
  2⤵
  PID:5444
- C:\Windows\System\nneigjS.exe
  C:\Windows\System\nneigjS.exe
  2⤵
  PID:5560
- C:\Windows\System\BNIzepD.exe
  C:\Windows\System\BNIzepD.exe
  2⤵
  PID:5724
- C:\Windows\System\BRAUejY.exe
  C:\Windows\System\BRAUejY.exe
  2⤵
  PID:2136
- C:\Windows\System\dcYVHHa.exe
  C:\Windows\System\dcYVHHa.exe
  2⤵
  PID:5920
- C:\Windows\System\OENkxyk.exe
  C:\Windows\System\OENkxyk.exe
  2⤵
  PID:6036
- C:\Windows\System\aDopCkc.exe
  C:\Windows\System\aDopCkc.exe
  2⤵
  PID:644
- C:\Windows\System\GWRLgcb.exe
  C:\Windows\System\GWRLgcb.exe
  2⤵
  PID:5124
- C:\Windows\System\VPLRLbf.exe
  C:\Windows\System\VPLRLbf.exe
  2⤵
  PID:5424
- C:\Windows\System\QszfruW.exe
  C:\Windows\System\QszfruW.exe
  2⤵
  PID:4564
- C:\Windows\System\fLmGlqM.exe
  C:\Windows\System\fLmGlqM.exe
  2⤵
  PID:5896
- C:\Windows\System\zEfJvrM.exe
  C:\Windows\System\zEfJvrM.exe
  2⤵
  PID:6168
- C:\Windows\System\TOyDUGI.exe
  C:\Windows\System\TOyDUGI.exe
  2⤵
  PID:6196
- C:\Windows\System\sHUJOcX.exe
  C:\Windows\System\sHUJOcX.exe
  2⤵
  PID:6224
- C:\Windows\System\lwctcJI.exe
  C:\Windows\System\lwctcJI.exe
  2⤵
  PID:6252
- C:\Windows\System\bUqRwqC.exe
  C:\Windows\System\bUqRwqC.exe
  2⤵
  PID:6280
- C:\Windows\System\vnsdCNF.exe
  C:\Windows\System\vnsdCNF.exe
  2⤵
  PID:6308
- C:\Windows\System\LjzJRfs.exe
  C:\Windows\System\LjzJRfs.exe
  2⤵
  PID:6336
- C:\Windows\System\BDvPTKr.exe
  C:\Windows\System\BDvPTKr.exe
  2⤵
  PID:6360
- C:\Windows\System\uYvFuRg.exe
  C:\Windows\System\uYvFuRg.exe
  2⤵
  PID:6392
- C:\Windows\System\CWvKEyx.exe
  C:\Windows\System\CWvKEyx.exe
  2⤵
  PID:6420
- C:\Windows\System\NhRzizR.exe
  C:\Windows\System\NhRzizR.exe
  2⤵
  PID:6448
- C:\Windows\System\QyBHKpB.exe
  C:\Windows\System\QyBHKpB.exe
  2⤵
  PID:6476
- C:\Windows\System\gLxPkYD.exe
  C:\Windows\System\gLxPkYD.exe
  2⤵
  PID:6504
- C:\Windows\System\bdHFmtf.exe
  C:\Windows\System\bdHFmtf.exe
  2⤵
  PID:6532
- C:\Windows\System\pOtAIFK.exe
  C:\Windows\System\pOtAIFK.exe
  2⤵
  PID:6560
- C:\Windows\System\VmRruMZ.exe
  C:\Windows\System\VmRruMZ.exe
  2⤵
  PID:6588
- C:\Windows\System\BZzAWyO.exe
  C:\Windows\System\BZzAWyO.exe
  2⤵
  PID:6616
- C:\Windows\System\JsnlMFM.exe
  C:\Windows\System\JsnlMFM.exe
  2⤵
  PID:6644
- C:\Windows\System\OxuwcWO.exe
  C:\Windows\System\OxuwcWO.exe
  2⤵
  PID:6668
- C:\Windows\System\xSEiUeN.exe
  C:\Windows\System\xSEiUeN.exe
  2⤵
  PID:6696
- C:\Windows\System\KqSDPom.exe
  C:\Windows\System\KqSDPom.exe
  2⤵
  PID:6728
- C:\Windows\System\yLstAFj.exe
  C:\Windows\System\yLstAFj.exe
  2⤵
  PID:6788
- C:\Windows\System\yvIjhEm.exe
  C:\Windows\System\yvIjhEm.exe
  2⤵
  PID:6824
- C:\Windows\System\pEjvLUX.exe
  C:\Windows\System\pEjvLUX.exe
  2⤵
  PID:6868
- C:\Windows\System\umnIkCS.exe
  C:\Windows\System\umnIkCS.exe
  2⤵
  PID:6888
- C:\Windows\System\eleQcvy.exe
  C:\Windows\System\eleQcvy.exe
  2⤵
  PID:6916
- C:\Windows\System\kFNIiut.exe
  C:\Windows\System\kFNIiut.exe
  2⤵
  PID:6960
- C:\Windows\System\RabOTmW.exe
  C:\Windows\System\RabOTmW.exe
  2⤵
  PID:6980
- C:\Windows\System\kMnsCzu.exe
  C:\Windows\System\kMnsCzu.exe
  2⤵
  PID:7000
- C:\Windows\System\wrcmsYY.exe
  C:\Windows\System\wrcmsYY.exe
  2⤵
  PID:7024
- C:\Windows\System\gxrpIPb.exe
  C:\Windows\System\gxrpIPb.exe
  2⤵
  PID:7076
- C:\Windows\System\HRLyQIK.exe
  C:\Windows\System\HRLyQIK.exe
  2⤵
  PID:7092
- C:\Windows\System\itDnFMV.exe
  C:\Windows\System\itDnFMV.exe
  2⤵
  PID:7120
- C:\Windows\System\bpsrEwF.exe
  C:\Windows\System\bpsrEwF.exe
  2⤵
  PID:7140
- C:\Windows\System\MOmOBvv.exe
  C:\Windows\System\MOmOBvv.exe
  2⤵
  PID:4188
- C:\Windows\System\HVeLwFS.exe
  C:\Windows\System\HVeLwFS.exe
  2⤵
  PID:5260
- C:\Windows\System\ahhQzRp.exe
  C:\Windows\System\ahhQzRp.exe
  2⤵
  PID:1880
- C:\Windows\System\vMghpim.exe
  C:\Windows\System\vMghpim.exe
  2⤵
  PID:6216
- C:\Windows\System\AYoyygN.exe
  C:\Windows\System\AYoyygN.exe
  2⤵
  PID:6244
- C:\Windows\System\TblnkuZ.exe
  C:\Windows\System\TblnkuZ.exe
  2⤵
  PID:4416
- C:\Windows\System\QaZuDZl.exe
  C:\Windows\System\QaZuDZl.exe
  2⤵
  PID:3744
- C:\Windows\System\yPNRvvL.exe
  C:\Windows\System\yPNRvvL.exe
  2⤵
  PID:6376
- C:\Windows\System\rFzkIdf.exe
  C:\Windows\System\rFzkIdf.exe
  2⤵
  PID:6460
- C:\Windows\System\ikxgSEP.exe
  C:\Windows\System\ikxgSEP.exe
  2⤵
  PID:6488
- C:\Windows\System\hSTJoVy.exe
  C:\Windows\System\hSTJoVy.exe
  2⤵
  PID:2692
- C:\Windows\System\GtaPBLR.exe
  C:\Windows\System\GtaPBLR.exe
  2⤵
  PID:6524
- C:\Windows\System\WTGDXgb.exe
  C:\Windows\System\WTGDXgb.exe
  2⤵
  PID:2796
- C:\Windows\System\swTbySK.exe
  C:\Windows\System\swTbySK.exe
  2⤵
  PID:2932
- C:\Windows\System\DKUXgbr.exe
  C:\Windows\System\DKUXgbr.exe
  2⤵
  PID:6628
- C:\Windows\System\ZVNjSGu.exe
  C:\Windows\System\ZVNjSGu.exe
  2⤵
  PID:6656
- C:\Windows\System\BVmQITD.exe
  C:\Windows\System\BVmQITD.exe
  2⤵
  PID:6720
- C:\Windows\System\FBjcXov.exe
  C:\Windows\System\FBjcXov.exe
  2⤵
  PID:2976
- C:\Windows\System\kaYpOin.exe
  C:\Windows\System\kaYpOin.exe
  2⤵
  PID:2220
- C:\Windows\System\tiMYKzZ.exe
  C:\Windows\System\tiMYKzZ.exe
  2⤵
  PID:3616
- C:\Windows\System\XVEJfXG.exe
  C:\Windows\System\XVEJfXG.exe
  2⤵
  PID:4080
- C:\Windows\System\VsTWXQZ.exe
  C:\Windows\System\VsTWXQZ.exe
  2⤵
  PID:6944
- C:\Windows\System\wXcGTBV.exe
  C:\Windows\System\wXcGTBV.exe
  2⤵
  PID:2056
- C:\Windows\System\jWSzdxN.exe
  C:\Windows\System\jWSzdxN.exe
  2⤵
  PID:7048
- C:\Windows\System\ecyCOQl.exe
  C:\Windows\System\ecyCOQl.exe
  2⤵
  PID:7072
- C:\Windows\System\YuWjusn.exe
  C:\Windows\System\YuWjusn.exe
  2⤵
  PID:7128
- C:\Windows\System\TwEuuMe.exe
  C:\Windows\System\TwEuuMe.exe
  2⤵
  PID:1212
- C:\Windows\System\AlGwkUE.exe
  C:\Windows\System\AlGwkUE.exe
  2⤵
  PID:5504
- C:\Windows\System\bUGNjsa.exe
  C:\Windows\System\bUGNjsa.exe
  2⤵
  PID:6208
- C:\Windows\System\FtwwJZh.exe
  C:\Windows\System\FtwwJZh.exe
  2⤵
  PID:6292
- C:\Windows\System\ZhXZakJ.exe
  C:\Windows\System\ZhXZakJ.exe
  2⤵
  PID:6468
- C:\Windows\System\sljTUZo.exe
  C:\Windows\System\sljTUZo.exe
  2⤵
  PID:6520
- C:\Windows\System\HLQqjFO.exe
  C:\Windows\System\HLQqjFO.exe
  2⤵
  PID:6684
- C:\Windows\System\wgEfSrL.exe
  C:\Windows\System\wgEfSrL.exe
  2⤵
  PID:6692
- C:\Windows\System\CMBolFx.exe
  C:\Windows\System\CMBolFx.exe
  2⤵
  PID:3680
- C:\Windows\System\khtgsHE.exe
  C:\Windows\System\khtgsHE.exe
  2⤵
  PID:4936
- C:\Windows\System\KQVuxOV.exe
  C:\Windows\System\KQVuxOV.exe
  2⤵
  PID:7136
- C:\Windows\System\DJRkKUL.exe
  C:\Windows\System\DJRkKUL.exe
  2⤵
  PID:7116
- C:\Windows\System\JZPBauA.exe
  C:\Windows\System\JZPBauA.exe
  2⤵
  PID:6212
- C:\Windows\System\CCsdPHI.exe
  C:\Windows\System\CCsdPHI.exe
  2⤵
  PID:1364
- C:\Windows\System\CQbjKwZ.exe
  C:\Windows\System\CQbjKwZ.exe
  2⤵
  PID:6572
- C:\Windows\System\SfYJzXS.exe
  C:\Windows\System\SfYJzXS.exe
  2⤵
  PID:2892
- C:\Windows\System\LxCTmqK.exe
  C:\Windows\System\LxCTmqK.exe
  2⤵
  PID:6236
- C:\Windows\System\zGMOgCN.exe
  C:\Windows\System\zGMOgCN.exe
  2⤵
  PID:6436
- C:\Windows\System\oKVKmYo.exe
  C:\Windows\System\oKVKmYo.exe
  2⤵
  PID:3140
- C:\Windows\System\kaGzShn.exe
  C:\Windows\System\kaGzShn.exe
  2⤵
  PID:7188
- C:\Windows\System\AEQJHNd.exe
  C:\Windows\System\AEQJHNd.exe
  2⤵
  PID:7216
- C:\Windows\System\SizkOfq.exe
  C:\Windows\System\SizkOfq.exe
  2⤵
  PID:7264
- C:\Windows\System\aowkJUG.exe
  C:\Windows\System\aowkJUG.exe
  2⤵
  PID:7284
- C:\Windows\System\bHPIeBR.exe
  C:\Windows\System\bHPIeBR.exe
  2⤵
  PID:7300
- C:\Windows\System\VKuqGrT.exe
  C:\Windows\System\VKuqGrT.exe
  2⤵
  PID:7324
- C:\Windows\System\CmArTHo.exe
  C:\Windows\System\CmArTHo.exe
  2⤵
  PID:7340
- C:\Windows\System\uQvIVpj.exe
  C:\Windows\System\uQvIVpj.exe
  2⤵
  PID:7368
- C:\Windows\System\dzmgZsa.exe
  C:\Windows\System\dzmgZsa.exe
  2⤵
  PID:7392
- C:\Windows\System\HwePKco.exe
  C:\Windows\System\HwePKco.exe
  2⤵
  PID:7420
- C:\Windows\System\pAEDikQ.exe
  C:\Windows\System\pAEDikQ.exe
  2⤵
  PID:7440
- C:\Windows\System\ENuIXYv.exe
  C:\Windows\System\ENuIXYv.exe
  2⤵
  PID:7460
- C:\Windows\System\oqvrQVb.exe
  C:\Windows\System\oqvrQVb.exe
  2⤵
  PID:7516
- C:\Windows\System\ZxDOpgn.exe
  C:\Windows\System\ZxDOpgn.exe
  2⤵
  PID:7540
- C:\Windows\System\QqcfMzA.exe
  C:\Windows\System\QqcfMzA.exe
  2⤵
  PID:7556
- C:\Windows\System\puVAHBD.exe
  C:\Windows\System\puVAHBD.exe
  2⤵
  PID:7580
- C:\Windows\System\OVABrJD.exe
  C:\Windows\System\OVABrJD.exe
  2⤵
  PID:7640
- C:\Windows\System\efROabF.exe
  C:\Windows\System\efROabF.exe
  2⤵
  PID:7668
- C:\Windows\System\InBlBkf.exe
  C:\Windows\System\InBlBkf.exe
  2⤵
  PID:7688
- C:\Windows\System\YmQawqF.exe
  C:\Windows\System\YmQawqF.exe
  2⤵
  PID:7712
- C:\Windows\System\pYyHmuC.exe
  C:\Windows\System\pYyHmuC.exe
  2⤵
  PID:7740
- C:\Windows\System\HDrEnzb.exe
  C:\Windows\System\HDrEnzb.exe
  2⤵
  PID:7764
- C:\Windows\System\TBtZzYC.exe
  C:\Windows\System\TBtZzYC.exe
  2⤵
  PID:7784
- C:\Windows\System\Hkuuvxs.exe
  C:\Windows\System\Hkuuvxs.exe
  2⤵
  PID:7844
- C:\Windows\System\OpTiUCG.exe
  C:\Windows\System\OpTiUCG.exe
  2⤵
  PID:7864
- C:\Windows\System\WBpYAVi.exe
  C:\Windows\System\WBpYAVi.exe
  2⤵
  PID:7884
- C:\Windows\System\UwBAlmf.exe
  C:\Windows\System\UwBAlmf.exe
  2⤵
  PID:7908
- C:\Windows\System\OnFdsaw.exe
  C:\Windows\System\OnFdsaw.exe
  2⤵
  PID:7956
- C:\Windows\System\hudOtMv.exe
  C:\Windows\System\hudOtMv.exe
  2⤵
  PID:7984
- C:\Windows\System\QYVfiXm.exe
  C:\Windows\System\QYVfiXm.exe
  2⤵
  PID:8008
- C:\Windows\System\Lzsvkma.exe
  C:\Windows\System\Lzsvkma.exe
  2⤵
  PID:8024
- C:\Windows\System\HlkRpBK.exe
  C:\Windows\System\HlkRpBK.exe
  2⤵
  PID:8060
- C:\Windows\System\iWyvqec.exe
  C:\Windows\System\iWyvqec.exe
  2⤵
  PID:8084
- C:\Windows\System\rKufzLU.exe
  C:\Windows\System\rKufzLU.exe
  2⤵
  PID:8128
- C:\Windows\System\KWGkMdx.exe
  C:\Windows\System\KWGkMdx.exe
  2⤵
  PID:8152
- C:\Windows\System\ftNfXuS.exe
  C:\Windows\System\ftNfXuS.exe
  2⤵
  PID:1676
- C:\Windows\System\SoxTiqU.exe
  C:\Windows\System\SoxTiqU.exe
  2⤵
  PID:4492
- C:\Windows\System\FwaEIsI.exe
  C:\Windows\System\FwaEIsI.exe
  2⤵
  PID:7236
- C:\Windows\System\cvgHBSu.exe
  C:\Windows\System\cvgHBSu.exe
  2⤵
  PID:7276
- C:\Windows\System\vmMFYpg.exe
  C:\Windows\System\vmMFYpg.exe
  2⤵
  PID:7312
- C:\Windows\System\ZLuRqlm.exe
  C:\Windows\System\ZLuRqlm.exe
  2⤵
  PID:7336
- C:\Windows\System\AEHvwjD.exe
  C:\Windows\System\AEHvwjD.exe
  2⤵
  PID:7412
- C:\Windows\System\kPmaSVT.exe
  C:\Windows\System\kPmaSVT.exe
  2⤵
  PID:7492
- C:\Windows\System\AfCvLOb.exe
  C:\Windows\System\AfCvLOb.exe
  2⤵
  PID:7568
- C:\Windows\System\tDFUZsz.exe
  C:\Windows\System\tDFUZsz.exe
  2⤵
  PID:7708
- C:\Windows\System\RZcaCiF.exe
  C:\Windows\System\RZcaCiF.exe
  2⤵
  PID:7772
- C:\Windows\System\dNMZCdL.exe
  C:\Windows\System\dNMZCdL.exe
  2⤵
  PID:7796
- C:\Windows\System\rkvAQgp.exe
  C:\Windows\System\rkvAQgp.exe
  2⤵
  PID:7880
- C:\Windows\System\XPIgLVe.exe
  C:\Windows\System\XPIgLVe.exe
  2⤵
  PID:7940
- C:\Windows\System\mUbEpcf.exe
  C:\Windows\System\mUbEpcf.exe
  2⤵
  PID:8000
- C:\Windows\System\yjxwOqT.exe
  C:\Windows\System\yjxwOqT.exe
  2⤵
  PID:8016
- C:\Windows\System\NskJVCP.exe
  C:\Windows\System\NskJVCP.exe
  2⤵
  PID:8100
- C:\Windows\System\OyHwYgn.exe
  C:\Windows\System\OyHwYgn.exe
  2⤵
  PID:8124
- C:\Windows\System\ZoeAUSe.exe
  C:\Windows\System\ZoeAUSe.exe
  2⤵
  PID:7248
- C:\Windows\System\MxyZWoI.exe
  C:\Windows\System\MxyZWoI.exe
  2⤵
  PID:7376
- C:\Windows\System\NEMksXl.exe
  C:\Windows\System\NEMksXl.exe
  2⤵
  PID:7648
- C:\Windows\System\mnEpHxa.exe
  C:\Windows\System\mnEpHxa.exe
  2⤵
  PID:7732
- C:\Windows\System\mjzfDfS.exe
  C:\Windows\System\mjzfDfS.exe
  2⤵
  PID:8076
- C:\Windows\System\xaCtBxP.exe
  C:\Windows\System\xaCtBxP.exe
  2⤵
  PID:7996
- C:\Windows\System\lFQxKIH.exe
  C:\Windows\System\lFQxKIH.exe
  2⤵
  PID:8180
- C:\Windows\System\OhqqdNh.exe
  C:\Windows\System\OhqqdNh.exe
  2⤵
  PID:7680
- C:\Windows\System\lPgzxJp.exe
  C:\Windows\System\lPgzxJp.exe
  2⤵
  PID:8120
- C:\Windows\System\KhTZCyT.exe
  C:\Windows\System\KhTZCyT.exe
  2⤵
  PID:8160
- C:\Windows\System\bliETcK.exe
  C:\Windows\System\bliETcK.exe
  2⤵
  PID:8200
- C:\Windows\System\cusgtoA.exe
  C:\Windows\System\cusgtoA.exe
  2⤵
  PID:8220
- C:\Windows\System\cwDAQTR.exe
  C:\Windows\System\cwDAQTR.exe
  2⤵
  PID:8244
- C:\Windows\System\abtndXb.exe
  C:\Windows\System\abtndXb.exe
  2⤵
  PID:8268
- C:\Windows\System\tRxuDVP.exe
  C:\Windows\System\tRxuDVP.exe
  2⤵
  PID:8292
- C:\Windows\System\bxBxtnr.exe
  C:\Windows\System\bxBxtnr.exe
  2⤵
  PID:8340
- C:\Windows\System\htqlYgn.exe
  C:\Windows\System\htqlYgn.exe
  2⤵
  PID:8360
- C:\Windows\System\QaTIBiR.exe
  C:\Windows\System\QaTIBiR.exe
  2⤵
  PID:8376
- C:\Windows\System\KCTOcTP.exe
  C:\Windows\System\KCTOcTP.exe
  2⤵
  PID:8420
- C:\Windows\System\ZGPtpyx.exe
  C:\Windows\System\ZGPtpyx.exe
  2⤵
  PID:8452
- C:\Windows\System\ivZdHmO.exe
  C:\Windows\System\ivZdHmO.exe
  2⤵
  PID:8480
- C:\Windows\System\VIeZqOB.exe
  C:\Windows\System\VIeZqOB.exe
  2⤵
  PID:8508
- C:\Windows\System\ReqydmO.exe
  C:\Windows\System\ReqydmO.exe
  2⤵
  PID:8532
- C:\Windows\System\evXypLS.exe
  C:\Windows\System\evXypLS.exe
  2⤵
  PID:8548
- C:\Windows\System\LCQgCrL.exe
  C:\Windows\System\LCQgCrL.exe
  2⤵
  PID:8592
- C:\Windows\System\imofoRt.exe
  C:\Windows\System\imofoRt.exe
  2⤵
  PID:8608
- C:\Windows\System\focTEvN.exe
  C:\Windows\System\focTEvN.exe
  2⤵
  PID:8628
- C:\Windows\System\OMLpgAe.exe
  C:\Windows\System\OMLpgAe.exe
  2⤵
  PID:8652
- C:\Windows\System\gvCQPxJ.exe
  C:\Windows\System\gvCQPxJ.exe
  2⤵
  PID:8672
- C:\Windows\System\BpjMIBH.exe
  C:\Windows\System\BpjMIBH.exe
  2⤵
  PID:8744
- C:\Windows\System\KYltENw.exe
  C:\Windows\System\KYltENw.exe
  2⤵
  PID:8760
- C:\Windows\System\qBMNnQb.exe
  C:\Windows\System\qBMNnQb.exe
  2⤵
  PID:8784
- C:\Windows\System\lpuxNqJ.exe
  C:\Windows\System\lpuxNqJ.exe
  2⤵
  PID:8804
- C:\Windows\System\ighbAlv.exe
  C:\Windows\System\ighbAlv.exe
  2⤵
  PID:8856
- C:\Windows\System\SkBZrXS.exe
  C:\Windows\System\SkBZrXS.exe
  2⤵
  PID:8888
- C:\Windows\System\hqDWivf.exe
  C:\Windows\System\hqDWivf.exe
  2⤵
  PID:8908
- C:\Windows\System\yLkHsOk.exe
  C:\Windows\System\yLkHsOk.exe
  2⤵
  PID:8932
- C:\Windows\System\CuGQmzR.exe
  C:\Windows\System\CuGQmzR.exe
  2⤵
  PID:8960
- C:\Windows\System\EPNhNvS.exe
  C:\Windows\System\EPNhNvS.exe
  2⤵
  PID:8980
- C:\Windows\System\CpNydgI.exe
  C:\Windows\System\CpNydgI.exe
  2⤵
  PID:9008
- C:\Windows\System\mGfFnra.exe
  C:\Windows\System\mGfFnra.exe
  2⤵
  PID:9036
- C:\Windows\System\nXhGIEr.exe
  C:\Windows\System\nXhGIEr.exe
  2⤵
  PID:9056
- C:\Windows\System\xqcgwxv.exe
  C:\Windows\System\xqcgwxv.exe
  2⤵
  PID:9088
- C:\Windows\System\jTvMMjY.exe
  C:\Windows\System\jTvMMjY.exe
  2⤵
  PID:9128
- C:\Windows\System\AqfKmwj.exe
  C:\Windows\System\AqfKmwj.exe
  2⤵
  PID:9156
- C:\Windows\System\GTQdpFH.exe
  C:\Windows\System\GTQdpFH.exe
  2⤵
  PID:9176
- C:\Windows\System\SuYAjsd.exe
  C:\Windows\System\SuYAjsd.exe
  2⤵
  PID:9204
- C:\Windows\System\ZFDFwoe.exe
  C:\Windows\System\ZFDFwoe.exe
  2⤵
  PID:8212
- C:\Windows\System\HZichwM.exe
  C:\Windows\System\HZichwM.exe
  2⤵
  PID:8264
- C:\Windows\System\NSTRwoU.exe
  C:\Windows\System\NSTRwoU.exe
  2⤵
  PID:8356
- C:\Windows\System\fDYRMEO.exe
  C:\Windows\System\fDYRMEO.exe
  2⤵
  PID:8428
- C:\Windows\System\BprcHQu.exe
  C:\Windows\System\BprcHQu.exe
  2⤵
  PID:8444
- C:\Windows\System\aNlieFS.exe
  C:\Windows\System\aNlieFS.exe
  2⤵
  PID:8572
- C:\Windows\System\aFYBReA.exe
  C:\Windows\System\aFYBReA.exe
  2⤵
  PID:8648
- C:\Windows\System\VjVqIfi.exe
  C:\Windows\System\VjVqIfi.exe
  2⤵
  PID:8664
- C:\Windows\System\YeWblUs.exe
  C:\Windows\System\YeWblUs.exe
  2⤵
  PID:8732
- C:\Windows\System\mBKXIJC.exe
  C:\Windows\System\mBKXIJC.exe
  2⤵
  PID:8768
- C:\Windows\System\gKVAMlG.exe
  C:\Windows\System\gKVAMlG.exe
  2⤵
  PID:8852
- C:\Windows\System\qPJgYmU.exe
  C:\Windows\System\qPJgYmU.exe
  2⤵
  PID:8884
- C:\Windows\System\kcJgPHJ.exe
  C:\Windows\System\kcJgPHJ.exe
  2⤵
  PID:8948
- C:\Windows\System\BcxGwsH.exe
  C:\Windows\System\BcxGwsH.exe
  2⤵
  PID:8988
- C:\Windows\System\bVESSQF.exe
  C:\Windows\System\bVESSQF.exe
  2⤵
  PID:9104
- C:\Windows\System\gTaPCXw.exe
  C:\Windows\System\gTaPCXw.exe
  2⤵
  PID:8400
- C:\Windows\System\KdWHNxd.exe
  C:\Windows\System\KdWHNxd.exe
  2⤵
  PID:8252
- C:\Windows\System\pPPpdQX.exe
  C:\Windows\System\pPPpdQX.exe
  2⤵
  PID:8368
- C:\Windows\System\BLOsjVd.exe
  C:\Windows\System\BLOsjVd.exe
  2⤵
  PID:8500
- C:\Windows\System\cUnCNet.exe
  C:\Windows\System\cUnCNet.exe
  2⤵
  PID:8668
- C:\Windows\System\ZQETlng.exe
  C:\Windows\System\ZQETlng.exe
  2⤵
  PID:8800
- C:\Windows\System\RMWoLDY.exe
  C:\Windows\System\RMWoLDY.exe
  2⤵
  PID:9108
- C:\Windows\System\xBJVYYZ.exe
  C:\Windows\System\xBJVYYZ.exe
  2⤵
  PID:9212
- C:\Windows\System\CjYeTtB.exe
  C:\Windows\System\CjYeTtB.exe
  2⤵
  PID:8412
- C:\Windows\System\IJPWejM.exe
  C:\Windows\System\IJPWejM.exe
  2⤵
  PID:8780
- C:\Windows\System\kwXrXWq.exe
  C:\Windows\System\kwXrXWq.exe
  2⤵
  PID:8620
- C:\Windows\System\feyPgLL.exe
  C:\Windows\System\feyPgLL.exe
  2⤵
  PID:8312
- C:\Windows\System\PYEzdWb.exe
  C:\Windows\System\PYEzdWb.exe
  2⤵
  PID:9244
- C:\Windows\System\otbhqYU.exe
  C:\Windows\System\otbhqYU.exe
  2⤵
  PID:9264
- C:\Windows\System\HpFKxBn.exe
  C:\Windows\System\HpFKxBn.exe
  2⤵
  PID:9328
- C:\Windows\System\TAbWzMX.exe
  C:\Windows\System\TAbWzMX.exe
  2⤵
  PID:9392
- C:\Windows\System\SoqKoVg.exe
  C:\Windows\System\SoqKoVg.exe
  2⤵
  PID:9408
- C:\Windows\System\NBmoAtu.exe
  C:\Windows\System\NBmoAtu.exe
  2⤵
  PID:9424
- C:\Windows\System\odwlrzH.exe
  C:\Windows\System\odwlrzH.exe
  2⤵
  PID:9440
- C:\Windows\System\FoWrwoQ.exe
  C:\Windows\System\FoWrwoQ.exe
  2⤵
  PID:9460
- C:\Windows\System\qmsQkzm.exe
  C:\Windows\System\qmsQkzm.exe
  2⤵
  PID:9516
- C:\Windows\System\BQonkCP.exe
  C:\Windows\System\BQonkCP.exe
  2⤵
  PID:9560
- C:\Windows\System\sbLKknW.exe
  C:\Windows\System\sbLKknW.exe
  2⤵
  PID:9576
- C:\Windows\System\FCapgWm.exe
  C:\Windows\System\FCapgWm.exe
  2⤵
  PID:9632
- C:\Windows\System\xlFjSjd.exe
  C:\Windows\System\xlFjSjd.exe
  2⤵
  PID:9648
- C:\Windows\System\CmthXIi.exe
  C:\Windows\System\CmthXIi.exe
  2⤵
  PID:9664
- C:\Windows\System\ECqTVza.exe
  C:\Windows\System\ECqTVza.exe
  2⤵
  PID:9680
- C:\Windows\System\nIeGwYT.exe
  C:\Windows\System\nIeGwYT.exe
  2⤵
  PID:9768
- C:\Windows\System\sddLXMv.exe
  C:\Windows\System\sddLXMv.exe
  2⤵
  PID:9784
- C:\Windows\System\yLmVflF.exe
  C:\Windows\System\yLmVflF.exe
  2⤵
  PID:9840
- C:\Windows\System\QcWxEPr.exe
  C:\Windows\System\QcWxEPr.exe
  2⤵
  PID:9868
- C:\Windows\System\nDvERYP.exe
  C:\Windows\System\nDvERYP.exe
  2⤵
  PID:9888
- C:\Windows\System\DEBicQQ.exe
  C:\Windows\System\DEBicQQ.exe
  2⤵
  PID:9936
- C:\Windows\System\xjWOxYB.exe
  C:\Windows\System\xjWOxYB.exe
  2⤵
  PID:9956
- C:\Windows\System\WyCKRTR.exe
  C:\Windows\System\WyCKRTR.exe
  2⤵
  PID:9976
- C:\Windows\System\nRMoaCY.exe
  C:\Windows\System\nRMoaCY.exe
  2⤵
  PID:10024
- C:\Windows\System\GUiuJeD.exe
  C:\Windows\System\GUiuJeD.exe
  2⤵
  PID:10060
- C:\Windows\System\gsTueuG.exe
  C:\Windows\System\gsTueuG.exe
  2⤵
  PID:10092
- C:\Windows\System\Iabmkqf.exe
  C:\Windows\System\Iabmkqf.exe
  2⤵
  PID:10112
- C:\Windows\System\ojowkFm.exe
  C:\Windows\System\ojowkFm.exe
  2⤵
  PID:10132
- C:\Windows\System\wcpDZrl.exe
  C:\Windows\System\wcpDZrl.exe
  2⤵
  PID:10148
- C:\Windows\System\pOXddrG.exe
  C:\Windows\System\pOXddrG.exe
  2⤵
  PID:10180
- C:\Windows\System\dTLIVkp.exe
  C:\Windows\System\dTLIVkp.exe
  2⤵
  PID:10200
- C:\Windows\System\JFmwZmF.exe
  C:\Windows\System\JFmwZmF.exe
  2⤵
  PID:10224
- C:\Windows\System\GLtvmaQ.exe
  C:\Windows\System\GLtvmaQ.exe
  2⤵
  PID:8336
- C:\Windows\System\BMFWnCs.exe
  C:\Windows\System\BMFWnCs.exe
  2⤵
  PID:9324
- C:\Windows\System\gdPHZnb.exe
  C:\Windows\System\gdPHZnb.exe
  2⤵
  PID:9380
- C:\Windows\System\fsyHcsN.exe
  C:\Windows\System\fsyHcsN.exe
  2⤵
  PID:9404
- C:\Windows\System\JVWcTDR.exe
  C:\Windows\System\JVWcTDR.exe
  2⤵
  PID:9496
- C:\Windows\System\WMfVvGB.exe
  C:\Windows\System\WMfVvGB.exe
  2⤵
  PID:9544
- C:\Windows\System\MuSoApj.exe
  C:\Windows\System\MuSoApj.exe
  2⤵
  PID:9300
- C:\Windows\System\wrxKTOf.exe
  C:\Windows\System\wrxKTOf.exe
  2⤵
  PID:9432
- C:\Windows\System\fASNRhj.exe
  C:\Windows\System\fASNRhj.exe
  2⤵
  PID:9476
- C:\Windows\System\pzBpbIO.exe
  C:\Windows\System\pzBpbIO.exe
  2⤵
  PID:9760
- C:\Windows\System\HRKErOv.exe
  C:\Windows\System\HRKErOv.exe
  2⤵
  PID:9716
- C:\Windows\System\olOdfQU.exe
  C:\Windows\System\olOdfQU.exe
  2⤵
  PID:9816
- C:\Windows\System\IFIoSFz.exe
  C:\Windows\System\IFIoSFz.exe
  2⤵
  PID:9832
- C:\Windows\System\EWWYEIy.exe
  C:\Windows\System\EWWYEIy.exe
  2⤵
  PID:9944
- C:\Windows\System\oapEsiv.exe
  C:\Windows\System\oapEsiv.exe
  2⤵
  PID:8740
- C:\Windows\System\ZhZyDNf.exe
  C:\Windows\System\ZhZyDNf.exe
  2⤵
  PID:10156
- C:\Windows\System\uaAduxN.exe
  C:\Windows\System\uaAduxN.exe
  2⤵
  PID:10188
- C:\Windows\System\GpaNpWf.exe
  C:\Windows\System\GpaNpWf.exe
  2⤵
  PID:10144
- C:\Windows\System\funWfYD.exe
  C:\Windows\System\funWfYD.exe
  2⤵
  PID:10208
- C:\Windows\System\pngQZzW.exe
  C:\Windows\System\pngQZzW.exe
  2⤵
  PID:9304
- C:\Windows\System\Wgcvsjz.exe
  C:\Windows\System\Wgcvsjz.exe
  2⤵
  PID:9372
- C:\Windows\System\bCTCrmE.exe
  C:\Windows\System\bCTCrmE.exe
  2⤵
  PID:9568
- C:\Windows\System\YGqrUwf.exe
  C:\Windows\System\YGqrUwf.exe
  2⤵
  PID:9672
- C:\Windows\System\VuoCxKk.exe
  C:\Windows\System\VuoCxKk.exe
  2⤵
  PID:9820
- C:\Windows\System\rEAxcef.exe
  C:\Windows\System\rEAxcef.exe
  2⤵
  PID:10004
- C:\Windows\System\gZpSOrt.exe
  C:\Windows\System\gZpSOrt.exe
  2⤵
  PID:2456
- C:\Windows\System\SCwYonw.exe
  C:\Windows\System\SCwYonw.exe
  2⤵
  PID:10140
- C:\Windows\System\RPKWKlR.exe
  C:\Windows\System\RPKWKlR.exe
  2⤵
  PID:2288
- C:\Windows\System\tooObVx.exe
  C:\Windows\System\tooObVx.exe
  2⤵
  PID:9556
- C:\Windows\System\ZyzIQsV.exe
  C:\Windows\System\ZyzIQsV.exe
  2⤵
  PID:9852
- C:\Windows\System\LuTtmAS.exe
  C:\Windows\System\LuTtmAS.exe
  2⤵
  PID:10068
- C:\Windows\System\loYoCyU.exe
  C:\Windows\System\loYoCyU.exe
  2⤵
  PID:9624
- C:\Windows\System\HvrvqqM.exe
  C:\Windows\System\HvrvqqM.exe
  2⤵
  PID:9796
- C:\Windows\System\AEHrtqz.exe
  C:\Windows\System\AEHrtqz.exe
  2⤵
  PID:9704
- C:\Windows\System\IdfbWjp.exe
  C:\Windows\System\IdfbWjp.exe
  2⤵
  PID:10260
- C:\Windows\System\XQCjDcG.exe
  C:\Windows\System\XQCjDcG.exe
  2⤵
  PID:10284
- C:\Windows\System\RoNFGdX.exe
  C:\Windows\System\RoNFGdX.exe
  2⤵
  PID:10320
- C:\Windows\System\VGieffV.exe
  C:\Windows\System\VGieffV.exe
  2⤵
  PID:10360
- C:\Windows\System\YLbFZDR.exe
  C:\Windows\System\YLbFZDR.exe
  2⤵
  PID:10388
- C:\Windows\System\XAfpbJU.exe
  C:\Windows\System\XAfpbJU.exe
  2⤵
  PID:10408
- C:\Windows\System\yXeHXdU.exe
  C:\Windows\System\yXeHXdU.exe
  2⤵
  PID:10456
- C:\Windows\System\VKveYvg.exe
  C:\Windows\System\VKveYvg.exe
  2⤵
  PID:10476
- C:\Windows\System\AmjlaAn.exe
  C:\Windows\System\AmjlaAn.exe
  2⤵
  PID:10504
- C:\Windows\System\VFjFNgG.exe
  C:\Windows\System\VFjFNgG.exe
  2⤵
  PID:10528
- C:\Windows\System\CZHqoce.exe
  C:\Windows\System\CZHqoce.exe
  2⤵
  PID:10548
- C:\Windows\System\AvfpViK.exe
  C:\Windows\System\AvfpViK.exe
  2⤵
  PID:10572
- C:\Windows\System\iOGSjEo.exe
  C:\Windows\System\iOGSjEo.exe
  2⤵
  PID:10620
- C:\Windows\System\NIYUMty.exe
  C:\Windows\System\NIYUMty.exe
  2⤵
  PID:10656
- C:\Windows\System\KlOIkGk.exe
  C:\Windows\System\KlOIkGk.exe
  2⤵
  PID:10684
- C:\Windows\System\yyKSJPH.exe
  C:\Windows\System\yyKSJPH.exe
  2⤵
  PID:10704
- C:\Windows\System\OzVUtYq.exe
  C:\Windows\System\OzVUtYq.exe
  2⤵
  PID:10728
- C:\Windows\System\hYUcsBu.exe
  C:\Windows\System\hYUcsBu.exe
  2⤵
  PID:10756
- C:\Windows\System\WSwOoCt.exe
  C:\Windows\System\WSwOoCt.exe
  2⤵
  PID:10776
- C:\Windows\System\ynzqLdk.exe
  C:\Windows\System\ynzqLdk.exe
  2⤵
  PID:10804
- C:\Windows\System\cLXcvGc.exe
  C:\Windows\System\cLXcvGc.exe
  2⤵
  PID:10844
- C:\Windows\System\VTSDkOw.exe
  C:\Windows\System\VTSDkOw.exe
  2⤵
  PID:10896
- C:\Windows\System\ZzPHtDL.exe
  C:\Windows\System\ZzPHtDL.exe
  2⤵
  PID:10916
- C:\Windows\System\rlRXEex.exe
  C:\Windows\System\rlRXEex.exe
  2⤵
  PID:10940
- C:\Windows\System\snUntmj.exe
  C:\Windows\System\snUntmj.exe
  2⤵
  PID:10980
- C:\Windows\System\uHPWxJT.exe
  C:\Windows\System\uHPWxJT.exe
  2⤵
  PID:10996
- C:\Windows\System\XDMoSnt.exe
  C:\Windows\System\XDMoSnt.exe
  2⤵
  PID:11016
- C:\Windows\System\fYRzAeh.exe
  C:\Windows\System\fYRzAeh.exe
  2⤵
  PID:11040
- C:\Windows\System\wQjYmsD.exe
  C:\Windows\System\wQjYmsD.exe
  2⤵
  PID:11060
- C:\Windows\System\xgxMxUF.exe
  C:\Windows\System\xgxMxUF.exe
  2⤵
  PID:11108
- C:\Windows\System\AcfLZMb.exe
  C:\Windows\System\AcfLZMb.exe
  2⤵
  PID:11136
- C:\Windows\System\bEHEdHP.exe
  C:\Windows\System\bEHEdHP.exe
  2⤵
  PID:11168
- C:\Windows\System\WFKzozw.exe
  C:\Windows\System\WFKzozw.exe
  2⤵
  PID:11196
- C:\Windows\System\EYyFQQR.exe
  C:\Windows\System\EYyFQQR.exe
  2⤵
  PID:11212
- C:\Windows\System\pKHXDpr.exe
  C:\Windows\System\pKHXDpr.exe
  2⤵
  PID:11236
- C:\Windows\System\qEjFejm.exe
  C:\Windows\System\qEjFejm.exe
  2⤵
  PID:11260
- C:\Windows\System\SfspUsZ.exe
  C:\Windows\System\SfspUsZ.exe
  2⤵
  PID:10104
- C:\Windows\System\NeyhuvT.exe
  C:\Windows\System\NeyhuvT.exe
  2⤵
  PID:10316
- C:\Windows\System\gEorBjP.exe
  C:\Windows\System\gEorBjP.exe
  2⤵
  PID:10396
- C:\Windows\System\BxIeAWs.exe
  C:\Windows\System\BxIeAWs.exe
  2⤵
  PID:10484
- C:\Windows\System\qyKJByI.exe
  C:\Windows\System\qyKJByI.exe
  2⤵
  PID:10496
- C:\Windows\System\muNhqZr.exe
  C:\Windows\System\muNhqZr.exe
  2⤵
  PID:10568
- C:\Windows\System\kkxRMJg.exe
  C:\Windows\System\kkxRMJg.exe
  2⤵
  PID:10632
- C:\Windows\System\PXBkMze.exe
  C:\Windows\System\PXBkMze.exe
  2⤵
  PID:10692
- C:\Windows\System\mxJueNT.exe
  C:\Windows\System\mxJueNT.exe
  2⤵
  PID:10784
- C:\Windows\System\xZYzhhZ.exe
  C:\Windows\System\xZYzhhZ.exe
  2⤵
  PID:10820
- C:\Windows\System\VUIWDqy.exe
  C:\Windows\System\VUIWDqy.exe
  2⤵
  PID:10924
- C:\Windows\System\cpuiyzF.exe
  C:\Windows\System\cpuiyzF.exe
  2⤵
  PID:11024
- C:\Windows\System\OegpGYs.exe
  C:\Windows\System\OegpGYs.exe
  2⤵
  PID:11052
- C:\Windows\System\PMVaxtv.exe
  C:\Windows\System\PMVaxtv.exe
  2⤵
  PID:11116
- C:\Windows\System\uGFnuTT.exe
  C:\Windows\System\uGFnuTT.exe
  2⤵
  PID:11228
- C:\Windows\System\TtgehKj.exe
  C:\Windows\System\TtgehKj.exe
  2⤵
  PID:11248
- C:\Windows\System\YAiZSWu.exe
  C:\Windows\System\YAiZSWu.exe
  2⤵
  PID:3236
- C:\Windows\System\nHSDbiY.exe
  C:\Windows\System\nHSDbiY.exe
  2⤵
  PID:1528
- C:\Windows\System\LDacJYF.exe
  C:\Windows\System\LDacJYF.exe
  2⤵
  PID:10500
- C:\Windows\System\EiMtxEZ.exe
  C:\Windows\System\EiMtxEZ.exe
  2⤵
  PID:10668
- C:\Windows\System\VlZSwvF.exe
  C:\Windows\System\VlZSwvF.exe
  2⤵
  PID:10720
- C:\Windows\System\paoIecB.exe
  C:\Windows\System\paoIecB.exe
  2⤵
  PID:10976
- C:\Windows\System\utOIIgO.exe
  C:\Windows\System\utOIIgO.exe
  2⤵
  PID:11156
- C:\Windows\System\fyeFahy.exe
  C:\Windows\System\fyeFahy.exe
  2⤵
  PID:10352
- C:\Windows\System\iekKgkq.exe
  C:\Windows\System\iekKgkq.exe
  2⤵
  PID:10428
- C:\Windows\System\uAhvxeq.exe
  C:\Windows\System\uAhvxeq.exe
  2⤵
  PID:10764
- C:\Windows\System\uhPbEfH.exe
  C:\Windows\System\uhPbEfH.exe
  2⤵
  PID:10964
- C:\Windows\System\sKhxKhe.exe
  C:\Windows\System\sKhxKhe.exe
  2⤵
  PID:932
- C:\Windows\System\muMPXQJ.exe
  C:\Windows\System\muMPXQJ.exe
  2⤵
  PID:11268
- C:\Windows\System\soPXBso.exe
  C:\Windows\System\soPXBso.exe
  2⤵
  PID:11284
- C:\Windows\System\fJnzwpj.exe
  C:\Windows\System\fJnzwpj.exe
  2⤵
  PID:11304
- C:\Windows\System\wZmiCki.exe
  C:\Windows\System\wZmiCki.exe
  2⤵
  PID:11324
- C:\Windows\System\PKLPZBz.exe
  C:\Windows\System\PKLPZBz.exe
  2⤵
  PID:11392
- C:\Windows\System\bJMxeiJ.exe
  C:\Windows\System\bJMxeiJ.exe
  2⤵
  PID:11408
- C:\Windows\System\TbJvvga.exe
  C:\Windows\System\TbJvvga.exe
  2⤵
  PID:11436
- C:\Windows\System\JgmxXCU.exe
  C:\Windows\System\JgmxXCU.exe
  2⤵
  PID:11476
- C:\Windows\System\KFbfTMp.exe
  C:\Windows\System\KFbfTMp.exe
  2⤵
  PID:11500
- C:\Windows\System\tHtaHDo.exe
  C:\Windows\System\tHtaHDo.exe
  2⤵
  PID:11524
- C:\Windows\System\mMYAxQI.exe
  C:\Windows\System\mMYAxQI.exe
  2⤵
  PID:11548
- C:\Windows\System\UaQNDKc.exe
  C:\Windows\System\UaQNDKc.exe
  2⤵
  PID:11600
- C:\Windows\System\kSSiWgq.exe
  C:\Windows\System\kSSiWgq.exe
  2⤵
  PID:11624
- C:\Windows\System\hJJctza.exe
  C:\Windows\System\hJJctza.exe
  2⤵
  PID:11640
- C:\Windows\System\UyxaDSk.exe
  C:\Windows\System\UyxaDSk.exe
  2⤵
  PID:11660
- C:\Windows\System\CsggkHh.exe
  C:\Windows\System\CsggkHh.exe
  2⤵
  PID:11688
- C:\Windows\System\CvYiXKO.exe
  C:\Windows\System\CvYiXKO.exe
  2⤵
  PID:11704
- C:\Windows\System\PFlpWHI.exe
  C:\Windows\System\PFlpWHI.exe
  2⤵
  PID:11752
- C:\Windows\System\aJWlPLI.exe
  C:\Windows\System\aJWlPLI.exe
  2⤵
  PID:11796
- C:\Windows\System\dsAweNl.exe
  C:\Windows\System\dsAweNl.exe
  2⤵
  PID:11816
- C:\Windows\System\xnKuULP.exe
  C:\Windows\System\xnKuULP.exe
  2⤵
  PID:11844
- C:\Windows\System\iSASCyc.exe
  C:\Windows\System\iSASCyc.exe
  2⤵
  PID:11884
- C:\Windows\System\UyCJASW.exe
  C:\Windows\System\UyCJASW.exe
  2⤵
  PID:11920
- C:\Windows\System\aRgwsFL.exe
  C:\Windows\System\aRgwsFL.exe
  2⤵
  PID:11940
- C:\Windows\System\ORheyFd.exe
  C:\Windows\System\ORheyFd.exe
  2⤵
  PID:11964
- C:\Windows\System\MnvEYPS.exe
  C:\Windows\System\MnvEYPS.exe
  2⤵
  PID:11984
- C:\Windows\System\vTafeOW.exe
  C:\Windows\System\vTafeOW.exe
  2⤵
  PID:12020
- C:\Windows\System\GoqXIRd.exe
  C:\Windows\System\GoqXIRd.exe
  2⤵
  PID:12044
- C:\Windows\System\zphghIM.exe
  C:\Windows\System\zphghIM.exe
  2⤵
  PID:12064
- C:\Windows\System\ugIGRFl.exe
  C:\Windows\System\ugIGRFl.exe
  2⤵
  PID:12084
- C:\Windows\System\asmErIG.exe
  C:\Windows\System\asmErIG.exe
  2⤵
  PID:12108
- C:\Windows\System\tFfzhBN.exe
  C:\Windows\System\tFfzhBN.exe
  2⤵
  PID:12132
- C:\Windows\System\ybomwSX.exe
  C:\Windows\System\ybomwSX.exe
  2⤵
  PID:12196
- C:\Windows\System\tggVLZd.exe
  C:\Windows\System\tggVLZd.exe
  2⤵
  PID:12216
- C:\Windows\System\ztPEDaN.exe
  C:\Windows\System\ztPEDaN.exe
  2⤵
  PID:12240
- C:\Windows\System\HOGaSQH.exe
  C:\Windows\System\HOGaSQH.exe
  2⤵
  PID:12268
- C:\Windows\System\gvOiHRC.exe
  C:\Windows\System\gvOiHRC.exe
  2⤵
  PID:10256
- C:\Windows\System\dCeDNgl.exe
  C:\Windows\System\dCeDNgl.exe
  2⤵
  PID:11344
- C:\Windows\System\IEEELca.exe
  C:\Windows\System\IEEELca.exe
  2⤵
  PID:11364
- C:\Windows\System\eftXgCm.exe
  C:\Windows\System\eftXgCm.exe
  2⤵
  PID:11360
- C:\Windows\System\vdKECHf.exe
  C:\Windows\System\vdKECHf.exe
  2⤵
  PID:11428
- C:\Windows\System\EWCKMTx.exe
  C:\Windows\System\EWCKMTx.exe
  2⤵
  PID:11536
- C:\Windows\System\DhyYpiL.exe
  C:\Windows\System\DhyYpiL.exe
  2⤵
  PID:11668
- C:\Windows\System\sTkXYFS.exe
  C:\Windows\System\sTkXYFS.exe
  2⤵
  PID:11732
- C:\Windows\System\gdycHdm.exe
  C:\Windows\System\gdycHdm.exe
  2⤵
  PID:11780
- C:\Windows\System\OnvGPsD.exe
  C:\Windows\System\OnvGPsD.exe
  2⤵
  PID:11840
- C:\Windows\System\lyREhpN.exe
  C:\Windows\System\lyREhpN.exe
  2⤵
  PID:11856
- C:\Windows\System\yNmAoGe.exe
  C:\Windows\System\yNmAoGe.exe
  2⤵
  PID:1060
- C:\Windows\System\zrUOOeb.exe
  C:\Windows\System\zrUOOeb.exe
  2⤵
  PID:11996
- C:\Windows\System\NYAWPUy.exe
  C:\Windows\System\NYAWPUy.exe
  2⤵
  PID:12032
- C:\Windows\System\EekNoXo.exe
  C:\Windows\System\EekNoXo.exe
  2⤵
  PID:10472
- C:\Windows\System\ZJTWEqY.exe
  C:\Windows\System\ZJTWEqY.exe
  2⤵
  PID:12160
- C:\Windows\System\kLXLVhM.exe
  C:\Windows\System\kLXLVhM.exe
  2⤵
  PID:12264
- C:\Windows\System\LRjzWuo.exe
  C:\Windows\System\LRjzWuo.exe
  2⤵
  PID:11312
- C:\Windows\System\uCtcJIe.exe
  C:\Windows\System\uCtcJIe.exe
  2⤵
  PID:11404
- C:\Windows\System\DyXdiDt.exe
  C:\Windows\System\DyXdiDt.exe
  2⤵
  PID:11544
- C:\Windows\System\nWVHReT.exe
  C:\Windows\System\nWVHReT.exe
  2⤵
  PID:11620
- C:\Windows\System\ZDaWkdt.exe
  C:\Windows\System\ZDaWkdt.exe
  2⤵
  PID:11952
- C:\Windows\System\tlbpdgj.exe
  C:\Windows\System\tlbpdgj.exe
  2⤵
  PID:12004
- C:\Windows\System\wuwVISF.exe
  C:\Windows\System\wuwVISF.exe
  2⤵
  PID:2880
- C:\Windows\System\xzGlIdx.exe
  C:\Windows\System\xzGlIdx.exe
  2⤵
  PID:12128
- C:\Windows\System\JBNtbtp.exe
  C:\Windows\System\JBNtbtp.exe
  2⤵
  PID:612
- C:\Windows\System\mbFsZLi.exe
  C:\Windows\System\mbFsZLi.exe
  2⤵
  PID:10444
- C:\Windows\System\ksnQFWH.exe
  C:\Windows\System\ksnQFWH.exe
  2⤵
  PID:11484
- C:\Windows\System\HUbdxhe.exe
  C:\Windows\System\HUbdxhe.exe
  2⤵
  PID:12028
- C:\Windows\System\prJZNjp.exe
  C:\Windows\System\prJZNjp.exe
  2⤵
  PID:12204
- C:\Windows\System\OdBAWxN.exe
  C:\Windows\System\OdBAWxN.exe
  2⤵
  PID:12296
- C:\Windows\System\UewxdFJ.exe
  C:\Windows\System\UewxdFJ.exe
  2⤵
  PID:12340
- C:\Windows\System\XMlQLxg.exe
  C:\Windows\System\XMlQLxg.exe
  2⤵
  PID:12380
- C:\Windows\System\OUgcFrv.exe
  C:\Windows\System\OUgcFrv.exe
  2⤵
  PID:12404
- C:\Windows\System\zjiXepD.exe
  C:\Windows\System\zjiXepD.exe
  2⤵
  PID:12424
- C:\Windows\System\KtDJjyf.exe
  C:\Windows\System\KtDJjyf.exe
  2⤵
  PID:12452
- C:\Windows\System\eTKAxxp.exe
  C:\Windows\System\eTKAxxp.exe
  2⤵
  PID:12488
- C:\Windows\System\dtMnQQG.exe
  C:\Windows\System\dtMnQQG.exe
  2⤵
  PID:12536
- C:\Windows\System\wnkoPNj.exe
  C:\Windows\System\wnkoPNj.exe
  2⤵
  PID:12556
- C:\Windows\System\qqIjZbT.exe
  C:\Windows\System\qqIjZbT.exe
  2⤵
  PID:12580
- C:\Windows\System\eJwnIJW.exe
  C:\Windows\System\eJwnIJW.exe
  2⤵
  PID:12604
- C:\Windows\System\QwRutUY.exe
  C:\Windows\System\QwRutUY.exe
  2⤵
  PID:12628
- C:\Windows\System\huJUovk.exe
  C:\Windows\System\huJUovk.exe
  2⤵
  PID:12652
- C:\Windows\System\eCbKaoB.exe
  C:\Windows\System\eCbKaoB.exe
  2⤵
  PID:12672
- C:\Windows\System\pdZnIqL.exe
  C:\Windows\System\pdZnIqL.exe
  2⤵
  PID:12716
- C:\Windows\System\dSYLlPp.exe
  C:\Windows\System\dSYLlPp.exe
  2⤵
  PID:12756
- C:\Windows\System\pBkuMhr.exe
  C:\Windows\System\pBkuMhr.exe
  2⤵
  PID:12784
- C:\Windows\System\GHboMVi.exe
  C:\Windows\System\GHboMVi.exe
  2⤵
  PID:12804
- C:\Windows\System\frFVisw.exe
  C:\Windows\System\frFVisw.exe
  2⤵
  PID:12832
- C:\Windows\System\FglSRmt.exe
  C:\Windows\System\FglSRmt.exe
  2⤵
  PID:12872
- C:\Windows\System\kVRvMiA.exe
  C:\Windows\System\kVRvMiA.exe
  2⤵
  PID:12900
- C:\Windows\System\uVIOCVY.exe
  C:\Windows\System\uVIOCVY.exe
  2⤵
  PID:12920
- C:\Windows\System\ztxczsL.exe
  C:\Windows\System\ztxczsL.exe
  2⤵
  PID:12956
- C:\Windows\System\SHZulyp.exe
  C:\Windows\System\SHZulyp.exe
  2⤵
  PID:12972
- C:\Windows\System\lJfKvdR.exe
  C:\Windows\System\lJfKvdR.exe
  2⤵
  PID:13008
- C:\Windows\System\IByWwgK.exe
  C:\Windows\System\IByWwgK.exe
  2⤵
  PID:13032
- C:\Windows\System\ehMNKvY.exe
  C:\Windows\System\ehMNKvY.exe
  2⤵
  PID:13064
- C:\Windows\System\rOekaaH.exe
  C:\Windows\System\rOekaaH.exe
  2⤵
  PID:13088
- C:\Windows\System\sgaRrSI.exe
  C:\Windows\System\sgaRrSI.exe
  2⤵
  PID:13104
- C:\Windows\System\WAjePgU.exe
  C:\Windows\System\WAjePgU.exe
  2⤵
  PID:12336
- C:\Windows\System\ORHRnKr.exe
  C:\Windows\System\ORHRnKr.exe
  2⤵
  PID:12552
- C:\Windows\System\koxmXXY.exe
  C:\Windows\System\koxmXXY.exe
  2⤵
  PID:12600
- C:\Windows\System\lTZfBmu.exe
  C:\Windows\System\lTZfBmu.exe
  2⤵
  PID:12688
- C:\Windows\System\sEUlWhs.exe
  C:\Windows\System\sEUlWhs.exe
  2⤵
  PID:12736
- C:\Windows\System\MTIwTCm.exe
  C:\Windows\System\MTIwTCm.exe
  2⤵
  PID:12820
- C:\Windows\System\YJSCuLC.exe
  C:\Windows\System\YJSCuLC.exe
  2⤵
  PID:12896
- C:\Windows\System\qGyxkqC.exe
  C:\Windows\System\qGyxkqC.exe
  2⤵
  PID:12948
- C:\Windows\System\KKdvekt.exe
  C:\Windows\System\KKdvekt.exe
  2⤵
  PID:13016
- C:\Windows\System\EFwVlBA.exe
  C:\Windows\System\EFwVlBA.exe
  2⤵
  PID:13052
- C:\Windows\System\jIVVWcA.exe
  C:\Windows\System\jIVVWcA.exe
  2⤵
  PID:13100
- C:\Windows\System\gljMlWC.exe
  C:\Windows\System\gljMlWC.exe
  2⤵
  PID:13144
- C:\Windows\System\XgoVeml.exe
  C:\Windows\System\XgoVeml.exe
  2⤵
  PID:13200
- C:\Windows\System\pcDQBPD.exe
  C:\Windows\System\pcDQBPD.exe
  2⤵
  PID:13228
- C:\Windows\System\XOAmMUK.exe
  C:\Windows\System\XOAmMUK.exe
  2⤵
  PID:12412
- C:\Windows\System\cyBjaQm.exe
  C:\Windows\System\cyBjaQm.exe
  2⤵
  PID:12448
- C:\Windows\System\YFDLnwe.exe
  C:\Windows\System\YFDLnwe.exe
  2⤵
  PID:12524
- C:\Windows\System\HrMSLAY.exe
  C:\Windows\System\HrMSLAY.exe
  2⤵
  PID:13284
- C:\Windows\System\IuurYKn.exe
  C:\Windows\System\IuurYKn.exe
  2⤵
  PID:12120
- C:\Windows\System\AtByRKu.exe
  C:\Windows\System\AtByRKu.exe
  2⤵
  PID:11700
- C:\Windows\System\GEHCgNu.exe
  C:\Windows\System\GEHCgNu.exe
  2⤵
  PID:12532
- C:\Windows\System\CPMaUTp.exe
  C:\Windows\System\CPMaUTp.exe
  2⤵
  PID:12480
- C:\Windows\System\KXLdhDy.exe
  C:\Windows\System\KXLdhDy.exe
  2⤵
  PID:12596
- C:\Windows\System\ZhliSbq.exe
  C:\Windows\System\ZhliSbq.exe
  2⤵
  PID:1748
- C:\Windows\System\mLiVkES.exe
  C:\Windows\System\mLiVkES.exe
  2⤵
  PID:4780
- C:\Windows\System\PcBvLPb.exe
  C:\Windows\System\PcBvLPb.exe
  2⤵
  PID:2332
- C:\Windows\System\AjZikSe.exe
  C:\Windows\System\AjZikSe.exe
  2⤵
  PID:624
- C:\Windows\System\XIKzhYV.exe
  C:\Windows\System\XIKzhYV.exe
  2⤵
  PID:12636
- C:\Windows\System\UvBpltL.exe
  C:\Windows\System\UvBpltL.exe
  2⤵
  PID:12800
- C:\Windows\System\seFdCrG.exe
  C:\Windows\System\seFdCrG.exe
  2⤵
  PID:3364
- C:\Windows\System\ItMyrmC.exe
  C:\Windows\System\ItMyrmC.exe
  2⤵
  PID:12668
- C:\Windows\System\RIjqalN.exe
  C:\Windows\System\RIjqalN.exe
  2⤵
  PID:12312
- C:\Windows\System\NuhqmVV.exe
  C:\Windows\System\NuhqmVV.exe
  2⤵
  PID:12928
- C:\Windows\System\FloQNKY.exe
  C:\Windows\System\FloQNKY.exe
  2⤵
  PID:556
- C:\Windows\System\ZmiEAel.exe
  C:\Windows\System\ZmiEAel.exe
  2⤵
  PID:4764
- C:\Windows\System\pnqrGdA.exe
  C:\Windows\System\pnqrGdA.exe
  2⤵
  PID:3484
- C:\Windows\System\dOqpHae.exe
  C:\Windows\System\dOqpHae.exe
  2⤵
  PID:5028
- C:\Windows\System\rtRttiX.exe
  C:\Windows\System\rtRttiX.exe
  2⤵
  PID:5552
- C:\Windows\System\UhGqRoE.exe
  C:\Windows\System\UhGqRoE.exe
  2⤵
  PID:6864
- C:\Windows\System\VMvGuwT.exe
  C:\Windows\System\VMvGuwT.exe
  2⤵
  PID:3816
- C:\Windows\System\ohJWdDN.exe
  C:\Windows\System\ohJWdDN.exe
  2⤵
  PID:6576
- C:\Windows\System\pamsmUk.exe
  C:\Windows\System\pamsmUk.exe
  2⤵
  PID:2184
- C:\Windows\System\ZHbhaHF.exe
  C:\Windows\System\ZHbhaHF.exe
  2⤵
  PID:6940
- C:\Windows\System\uNlEdHn.exe
  C:\Windows\System\uNlEdHn.exe
  2⤵
  PID:5980
- C:\Windows\System\jQJbYSg.exe
  C:\Windows\System\jQJbYSg.exe
  2⤵
  PID:7252
- C:\Windows\System\LYesCtZ.exe
  C:\Windows\System\LYesCtZ.exe
  2⤵
  PID:7652
- C:\Windows\System\bVjPHDp.exe
  C:\Windows\System\bVjPHDp.exe
  2⤵
  PID:4520
- C:\Windows\System\tYJdLfI.exe
  C:\Windows\System\tYJdLfI.exe
  2⤵
  PID:8004
- C:\Windows\System\eYzjIym.exe
  C:\Windows\System\eYzjIym.exe
  2⤵
  PID:13004
- C:\Windows\System\fOrtyFG.exe
  C:\Windows\System\fOrtyFG.exe
  2⤵
  PID:6988
- C:\Windows\System\ImXjBwZ.exe
  C:\Windows\System\ImXjBwZ.exe
  2⤵
  PID:5496
- C:\Windows\System\YiBVLAA.exe
  C:\Windows\System\YiBVLAA.exe
  2⤵
  PID:12968
- C:\Windows\System\iSAheIr.exe
  C:\Windows\System\iSAheIr.exe
  2⤵
  PID:7176
- C:\Windows\System\xKPIMST.exe
  C:\Windows\System\xKPIMST.exe
  2⤵
  PID:7180
- C:\Windows\System\qOvLBUl.exe
  C:\Windows\System\qOvLBUl.exe
  2⤵
  PID:4972
- C:\Windows\System\YtmQLSs.exe
  C:\Windows\System\YtmQLSs.exe
  2⤵
  PID:3008
- C:\Windows\System\uSOtYwE.exe
  C:\Windows\System\uSOtYwE.exe
  2⤵
  PID:7600
- C:\Windows\System\MpbDzHM.exe
  C:\Windows\System\MpbDzHM.exe
  2⤵
  PID:7856
- C:\Windows\System\qteWJCy.exe
  C:\Windows\System\qteWJCy.exe
  2⤵
  PID:3712
- C:\Windows\System\UNAoWYv.exe
  C:\Windows\System\UNAoWYv.exe
  2⤵
  PID:1556
- C:\Windows\System\UfEAqAF.exe
  C:\Windows\System\UfEAqAF.exe
  2⤵
  PID:7316
- C:\Windows\System\WFkWOPv.exe
  C:\Windows\System\WFkWOPv.exe
  2⤵
  PID:3532
- C:\Windows\System\KifJnOO.exe
  C:\Windows\System\KifJnOO.exe
  2⤵
  PID:8072
- C:\Windows\System\sWNGmcN.exe
  C:\Windows\System\sWNGmcN.exe
  2⤵
  PID:8320
- C:\Windows\System\aZKTWhF.exe
  C:\Windows\System\aZKTWhF.exe
  2⤵
  PID:8324
- C:\Windows\System\jlyFOlM.exe
  C:\Windows\System\jlyFOlM.exe
  2⤵
  PID:6952
- C:\Windows\System\gIYqEBK.exe
  C:\Windows\System\gIYqEBK.exe
  2⤵
  PID:7432
- C:\Windows\System\baYrbLg.exe
  C:\Windows\System\baYrbLg.exe
  2⤵
  PID:4484
- C:\Windows\System\vqAnrCH.exe
  C:\Windows\System\vqAnrCH.exe
  2⤵
  PID:7876
- C:\Windows\System\XgTmnkW.exe
  C:\Windows\System\XgTmnkW.exe
  2⤵
  PID:13268
- C:\Windows\System\qOtdAKF.exe
  C:\Windows\System\qOtdAKF.exe
  2⤵
  PID:2148
- C:\Windows\System\QcECiPe.exe
  C:\Windows\System\QcECiPe.exe
  2⤵
  PID:7900
- C:\Windows\System\KLKiSZY.exe
  C:\Windows\System\KLKiSZY.exe
  2⤵
  PID:3648
- C:\Windows\System\FtNybDD.exe
  C:\Windows\System\FtNybDD.exe
  2⤵
  PID:7224
- C:\Windows\System\TUwcipZ.exe
  C:\Windows\System\TUwcipZ.exe
  2⤵
  PID:6636
- C:\Windows\System\djKnSrd.exe
  C:\Windows\System\djKnSrd.exe
  2⤵
  PID:4196
- C:\Windows\System\nhxEpRI.exe
  C:\Windows\System\nhxEpRI.exe
  2⤵
  PID:8148
- C:\Windows\System\lUrNSeY.exe
  C:\Windows\System\lUrNSeY.exe
  2⤵
  PID:2260
- C:\Windows\System\QEgmsfj.exe
  C:\Windows\System\QEgmsfj.exe
  2⤵
  PID:5512
- C:\Windows\System\SjMrACU.exe
  C:\Windows\System\SjMrACU.exe
  2⤵
  PID:2792
- C:\Windows\System\GYelHPc.exe
  C:\Windows\System\GYelHPc.exe
  2⤵
  PID:2920
- C:\Windows\System\nGTncFH.exe
  C:\Windows\System\nGTncFH.exe
  2⤵
  PID:1020
- C:\Windows\System\pOqwMVz.exe
  C:\Windows\System\pOqwMVz.exe
  2⤵
  PID:8832
- C:\Windows\System\yfUgWxh.exe
  C:\Windows\System\yfUgWxh.exe
  2⤵
  PID:436
- C:\Windows\System\mPfFEhl.exe
  C:\Windows\System\mPfFEhl.exe
  2⤵
  PID:3108
- C:\Windows\System\JjbIkvQ.exe
  C:\Windows\System\JjbIkvQ.exe
  2⤵
  PID:2888
- C:\Windows\System\IynzaNp.exe
  C:\Windows\System\IynzaNp.exe
  2⤵
  PID:2712
- C:\Windows\System\BntWQyY.exe
  C:\Windows\System\BntWQyY.exe
  2⤵
  PID:816
- C:\Windows\System\dnzPFkY.exe
  C:\Windows\System\dnzPFkY.exe
  2⤵
  PID:3256
- C:\Windows\System\ykBzFOI.exe
  C:\Windows\System\ykBzFOI.exe
  2⤵
  PID:8616
- C:\Windows\System\WqxrAPt.exe
  C:\Windows\System\WqxrAPt.exe
  2⤵
  PID:1968
- C:\Windows\System\nBjiyFt.exe
  C:\Windows\System\nBjiyFt.exe
  2⤵
  PID:8956
- C:\Windows\System\edjhJhx.exe
  C:\Windows\System\edjhJhx.exe
  2⤵
  PID:7172
- C:\Windows\System\XsUavXI.exe
  C:\Windows\System\XsUavXI.exe
  2⤵
  PID:8692
- C:\Windows\System\ncKZPfg.exe
  C:\Windows\System\ncKZPfg.exe
  2⤵
  PID:4808
- C:\Windows\System\SJkRcQN.exe
  C:\Windows\System\SJkRcQN.exe
  2⤵
  PID:1572
- C:\Windows\System\HrvVJnF.exe
  C:\Windows\System\HrvVJnF.exe
  2⤵
  PID:4268
- C:\Windows\System\HAawOOx.exe
  C:\Windows\System\HAawOOx.exe
  2⤵
  PID:516
- C:\Windows\System\wBEvESm.exe
  C:\Windows\System\wBEvESm.exe
  2⤵
  PID:5200
- C:\Windows\System\paaGaOH.exe
  C:\Windows\System\paaGaOH.exe
  2⤵
  PID:3152
- C:\Windows\System\EYARwTK.exe
  C:\Windows\System\EYARwTK.exe
  2⤵
  PID:8300
- C:\Windows\System\BSLSIxc.exe
  C:\Windows\System\BSLSIxc.exe
  2⤵
  PID:708
- C:\Windows\System\heUqLAM.exe
  C:\Windows\System\heUqLAM.exe
  2⤵
  PID:12564
- C:\Windows\System\BdsWFlp.exe
  C:\Windows\System\BdsWFlp.exe
  2⤵
  PID:10056
- C:\Windows\System\JOoUUTd.exe
  C:\Windows\System\JOoUUTd.exe
  2⤵
  PID:9152
- C:\Windows\System\CKwtjWl.exe
  C:\Windows\System\CKwtjWl.exe
  2⤵
  PID:8916
- C:\Windows\System\jzTVtui.exe
  C:\Windows\System\jzTVtui.exe
  2⤵
  PID:9800
- C:\Windows\System\evbQRza.exe
  C:\Windows\System\evbQRza.exe
  2⤵
  PID:10084
- C:\Windows\System\RsmAgIy.exe
  C:\Windows\System\RsmAgIy.exe
  2⤵
  PID:9540
- C:\Windows\System\QhWmhOj.exe
  C:\Windows\System\QhWmhOj.exe
  2⤵
  PID:9492
- C:\Windows\System\TYesnvS.exe
  C:\Windows\System\TYesnvS.exe
  2⤵
  PID:860
- C:\Windows\System\xQiQHLY.exe
  C:\Windows\System\xQiQHLY.exe
  2⤵
  PID:3772
- C:\Windows\System\fzWnKsA.exe
  C:\Windows\System\fzWnKsA.exe
  2⤵
  PID:7756
- C:\Windows\System\VaHVkYQ.exe
  C:\Windows\System\VaHVkYQ.exe
  2⤵
  PID:5144
- C:\Windows\System\nxsHoKp.exe
  C:\Windows\System\nxsHoKp.exe
  2⤵
  PID:10608
- C:\Windows\System\pQZuZsO.exe
  C:\Windows\System\pQZuZsO.exe
  2⤵
  PID:5224
- C:\Windows\System\LUcOZDY.exe
  C:\Windows\System\LUcOZDY.exe
  2⤵
  PID:9812
- C:\Windows\System\fIAHFyn.exe
  C:\Windows\System\fIAHFyn.exe
  2⤵
  PID:1664
- C:\Windows\System\JrCCbWy.exe
  C:\Windows\System\JrCCbWy.exe
  2⤵
  PID:8040
- C:\Windows\System\ZCEQves.exe
  C:\Windows\System\ZCEQves.exe
  2⤵
  PID:7808
- C:\Windows\System\lxjpBcm.exe
  C:\Windows\System\lxjpBcm.exe
  2⤵
  PID:10904
- C:\Windows\System\xuBNAtb.exe
  C:\Windows\System\xuBNAtb.exe
  2⤵
  PID:5356
- C:\Windows\System\BjktuNW.exe
  C:\Windows\System\BjktuNW.exe
  2⤵
  PID:10972
- C:\Windows\System\ZfWSfCf.exe
  C:\Windows\System\ZfWSfCf.exe
  2⤵
  PID:4376
- C:\Windows\System\oaeZijJ.exe
  C:\Windows\System\oaeZijJ.exe
  2⤵
  PID:7196
- C:\Windows\System\TfIGFxt.exe
  C:\Windows\System\TfIGFxt.exe
  2⤵
  PID:5764
- C:\Windows\System\iILISQi.exe
  C:\Windows\System\iILISQi.exe
  2⤵
  PID:5820
- C:\Windows\System\XqagxDA.exe
  C:\Windows\System\XqagxDA.exe
  2⤵
  PID:9016
- C:\Windows\System\VesjpLH.exe
  C:\Windows\System\VesjpLH.exe
  2⤵
  PID:10716
- C:\Windows\System\eBwpuyf.exe
  C:\Windows\System\eBwpuyf.exe
  2⤵
  PID:5324
- C:\Windows\System\YllaWGa.exe
  C:\Windows\System\YllaWGa.exe
  2⤵
  PID:3224
- C:\Windows\System\hosIdWp.exe
  C:\Windows\System\hosIdWp.exe
  2⤵
  PID:9356
- C:\Windows\System\yOcPKLA.exe
  C:\Windows\System\yOcPKLA.exe
  2⤵
  PID:10768
- C:\Windows\System\RNEjNIy.exe
  C:\Windows\System\RNEjNIy.exe
  2⤵
  PID:10960
- C:\Windows\System\tAwyYRt.exe
  C:\Windows\System\tAwyYRt.exe
  2⤵
  PID:3252
- C:\Windows\System\snSeKGd.exe
  C:\Windows\System\snSeKGd.exe
  2⤵
  PID:4588
- C:\Windows\System\JMcInLK.exe
  C:\Windows\System\JMcInLK.exe
  2⤵
  PID:5848
- C:\Windows\System\byGjTlh.exe
  C:\Windows\System\byGjTlh.exe
  2⤵
  PID:5640
- C:\Windows\System\wqJnPYq.exe
  C:\Windows\System\wqJnPYq.exe
  2⤵
  PID:5704
- C:\Windows\System\vhKoPMS.exe
  C:\Windows\System\vhKoPMS.exe
  2⤵
  PID:10652
- C:\Windows\System\vBbCbpY.exe
  C:\Windows\System\vBbCbpY.exe
  2⤵
  PID:1440
- C:\Windows\System\vqLvbWV.exe
  C:\Windows\System\vqLvbWV.exe
  2⤵
  PID:5944
- C:\Windows\System\JvgSGce.exe
  C:\Windows\System\JvgSGce.exe
  2⤵
  PID:11164
- C:\Windows\System\yQBFLqK.exe
  C:\Windows\System\yQBFLqK.exe
  2⤵
  PID:9660
- C:\Windows\System\GyOfdoR.exe
  C:\Windows\System\GyOfdoR.exe
  2⤵
  PID:8164
- C:\Windows\System\llyFzZZ.exe
  C:\Windows\System\llyFzZZ.exe
  2⤵
  PID:7356
- C:\Windows\System\AaswatS.exe
  C:\Windows\System\AaswatS.exe
  2⤵
  PID:5344
- C:\Windows\System\qvopaEv.exe
  C:\Windows\System\qvopaEv.exe
  2⤵
  PID:11864
- C:\Windows\System\XAcWkia.exe
  C:\Windows\System\XAcWkia.exe
  2⤵
  PID:5372
- C:\Windows\System\nwFkMHd.exe
  C:\Windows\System\nwFkMHd.exe
  2⤵
  PID:10172
- C:\Windows\System\MxbIeyj.exe
  C:\Windows\System\MxbIeyj.exe
  2⤵
  PID:11568
- C:\Windows\System\RFKWkcG.exe
  C:\Windows\System\RFKWkcG.exe
  2⤵
  PID:12176
- C:\Windows\System\YCCNxIf.exe
  C:\Windows\System\YCCNxIf.exe
  2⤵
  PID:6040
- C:\Windows\System\UDsOGZT.exe
  C:\Windows\System\UDsOGZT.exe
  2⤵
  PID:6088
- C:\Windows\System\AhpoQdL.exe
  C:\Windows\System\AhpoQdL.exe
  2⤵
  PID:6056
- C:\Windows\System\kNFSbHu.exe
  C:\Windows\System\kNFSbHu.exe
  2⤵
  PID:8836
- C:\Windows\System\aIUtZZJ.exe
  C:\Windows\System\aIUtZZJ.exe
  2⤵
  PID:11636
- C:\Windows\System\LoFAMRF.exe
  C:\Windows\System\LoFAMRF.exe
  2⤵
  PID:5180
- C:\Windows\System\WRrTSkf.exe
  C:\Windows\System\WRrTSkf.exe
  2⤵
  PID:5244
- C:\Windows\System\BeAwdQW.exe
  C:\Windows\System\BeAwdQW.exe
  2⤵
  PID:5564
- C:\Windows\System\SfywkyU.exe
  C:\Windows\System\SfywkyU.exe
  2⤵
  PID:2700
- C:\Windows\System\PNjvPEr.exe
  C:\Windows\System\PNjvPEr.exe
  2⤵
  PID:11760
- C:\Windows\System\lkrkqnp.exe
  C:\Windows\System\lkrkqnp.exe
  2⤵
  PID:6204
- C:\Windows\System\ooJdPfj.exe
  C:\Windows\System\ooJdPfj.exe
  2⤵
  PID:11904
- C:\Windows\System\FckwGaE.exe
  C:\Windows\System\FckwGaE.exe
  2⤵
  PID:10196
- C:\Windows\System\GQruePj.exe
  C:\Windows\System\GQruePj.exe
  2⤵
  PID:6304
- C:\Windows\System\oeesrrh.exe
  C:\Windows\System\oeesrrh.exe
  2⤵
  PID:6584
- C:\Windows\System\ALsPqrL.exe
  C:\Windows\System\ALsPqrL.exe
  2⤵
  PID:6148
- C:\Windows\System\TTATZZE.exe
  C:\Windows\System\TTATZZE.exe
  2⤵
  PID:12104
- C:\Windows\System\uESgqdi.exe
  C:\Windows\System\uESgqdi.exe
  2⤵
  PID:6640
- C:\Windows\System\NesNBBE.exe
  C:\Windows\System\NesNBBE.exe
  2⤵
  PID:8348
- C:\Windows\System\hdSnbKh.exe
  C:\Windows\System\hdSnbKh.exe
  2⤵
  PID:12684
- C:\Windows\System\rMjeIii.exe
  C:\Windows\System\rMjeIii.exe
  2⤵
  PID:12696
- C:\Windows\System\FSbKrnM.exe
  C:\Windows\System\FSbKrnM.exe
  2⤵
  PID:12768
- C:\Windows\System\UpGGrns.exe
  C:\Windows\System\UpGGrns.exe
  2⤵
  PID:6708
- C:\Windows\System\uVKQNcU.exe
  C:\Windows\System\uVKQNcU.exe
  2⤵
  PID:10948
- C:\Windows\System\TilJBzt.exe
  C:\Windows\System\TilJBzt.exe
  2⤵
  PID:6332
- C:\Windows\System\qLiMKeU.exe
  C:\Windows\System\qLiMKeU.exe
  2⤵
  PID:5456
- C:\Windows\System\OFhtFtG.exe
  C:\Windows\System\OFhtFtG.exe
  2⤵
  PID:8696
- C:\Windows\System\mUPMBCC.exe
  C:\Windows\System\mUPMBCC.exe
  2⤵
  PID:6416
- C:\Windows\System\HCTrzLR.exe
  C:\Windows\System\HCTrzLR.exe
  2⤵
  PID:12392
- C:\Windows\System\cdrKlqN.exe
  C:\Windows\System\cdrKlqN.exe
  2⤵
  PID:8876
- C:\Windows\System\xjrImAa.exe
  C:\Windows\System\xjrImAa.exe
  2⤵
  PID:5392
- C:\Windows\System\GasiiFr.exe
  C:\Windows\System\GasiiFr.exe
  2⤵
  PID:12796
- C:\Windows\System\ZRLmvev.exe
  C:\Windows\System\ZRLmvev.exe
  2⤵
  PID:6900
- C:\Windows\System\efuShDK.exe
  C:\Windows\System\efuShDK.exe
  2⤵
  PID:4604
- C:\Windows\System\ZYDZcPc.exe
  C:\Windows\System\ZYDZcPc.exe
  2⤵
  PID:12940
- C:\Windows\System\SGEZZlb.exe
  C:\Windows\System\SGEZZlb.exe
  2⤵
  PID:6852
- C:\Windows\System\PfbpVrp.exe
  C:\Windows\System\PfbpVrp.exe
  2⤵
  PID:10884
- C:\Windows\System\HpiFxZT.exe
  C:\Windows\System\HpiFxZT.exe
  2⤵
  PID:10072
- C:\Windows\System\KUjpXuL.exe
  C:\Windows\System\KUjpXuL.exe
  2⤵
  PID:3188
- C:\Windows\System\SMSoyjt.exe
  C:\Windows\System\SMSoyjt.exe
  2⤵
  PID:10672
- C:\Windows\System\yEJluIH.exe
  C:\Windows\System\yEJluIH.exe
  2⤵
  PID:6248
- C:\Windows\System\emVnuCU.exe
  C:\Windows\System\emVnuCU.exe
  2⤵
  PID:6156
- C:\Windows\System\VvXccKy.exe
  C:\Windows\System\VvXccKy.exe
  2⤵
  PID:11400
- C:\Windows\System\xYcfSQG.exe
  C:\Windows\System\xYcfSQG.exe
  2⤵
  PID:5840
- C:\Windows\System\wcESHka.exe
  C:\Windows\System\wcESHka.exe
  2⤵
  PID:9452
- C:\Windows\System\bukFUbq.exe
  C:\Windows\System\bukFUbq.exe
  2⤵
  PID:12644
- C:\Windows\System\QuVXEDZ.exe
  C:\Windows\System\QuVXEDZ.exe
  2⤵
  PID:6068
- C:\Windows\System\uiEkxjh.exe
  C:\Windows\System\uiEkxjh.exe
  2⤵
  PID:6444
- C:\Windows\System\TnXxqzo.exe
  C:\Windows\System\TnXxqzo.exe
  2⤵
  PID:3216
- C:\Windows\System\BChAhwU.exe
  C:\Windows\System\BChAhwU.exe
  2⤵
  PID:12472
- C:\Windows\System\ESUWmFa.exe
  C:\Windows\System\ESUWmFa.exe
  2⤵
  PID:11444
- C:\Windows\System\QOpteFE.exe
  C:\Windows\System\QOpteFE.exe
  2⤵
  PID:12508
- C:\Windows\System\dzyloII.exe
  C:\Windows\System\dzyloII.exe
  2⤵
  PID:4200
- C:\Windows\System\msdjqCE.exe
  C:\Windows\System\msdjqCE.exe
  2⤵
  PID:2940
- C:\Windows\System\wNcVHjG.exe
  C:\Windows\System\wNcVHjG.exe
  2⤵
  PID:7012
- C:\Windows\System\GfFAPYE.exe
  C:\Windows\System\GfFAPYE.exe
  2⤵
  PID:2452
- C:\Windows\System\RJXocAO.exe
  C:\Windows\System\RJXocAO.exe
  2⤵
  PID:6844
- C:\Windows\System\SXVAcFI.exe
  C:\Windows\System\SXVAcFI.exe
  2⤵
  PID:7060
- C:\Windows\System\duRdOKW.exe
  C:\Windows\System\duRdOKW.exe
  2⤵
  PID:13248
- C:\Windows\System\vPoeGWS.exe
  C:\Windows\System\vPoeGWS.exe
  2⤵
  PID:808
- C:\Windows\System\YCJPcRs.exe
  C:\Windows\System\YCJPcRs.exe
  2⤵
  PID:5780
- C:\Windows\System\kdHvlsK.exe
  C:\Windows\System\kdHvlsK.exe
  2⤵
  PID:5672
- C:\Windows\System\cRafyKw.exe
  C:\Windows\System\cRafyKw.exe
  2⤵
  PID:5636
- C:\Windows\System\ZmRvlNy.exe
  C:\Windows\System\ZmRvlNy.exe
  2⤵
  PID:11356
- C:\Windows\System\nrqlRle.exe
  C:\Windows\System\nrqlRle.exe
  2⤵
  PID:5364
- C:\Windows\System\RpYqeKE.exe
  C:\Windows\System\RpYqeKE.exe
  2⤵
  PID:3508
- C:\Windows\System\UqyvqTb.exe
  C:\Windows\System\UqyvqTb.exe
  2⤵
  PID:6260
- C:\Windows\System\FSoOhgn.exe
  C:\Windows\System\FSoOhgn.exe
  2⤵
  PID:7156
- C:\Windows\System\FqRkUqe.exe
  C:\Windows\System\FqRkUqe.exe
  2⤵
  PID:6352
- C:\Windows\System\OtFHLbK.exe
  C:\Windows\System\OtFHLbK.exe
  2⤵
  PID:6388
- C:\Windows\System\LyiiZyS.exe
  C:\Windows\System\LyiiZyS.exe
  2⤵
  PID:6712
- C:\Windows\System\KuOrDFO.exe
  C:\Windows\System\KuOrDFO.exe
  2⤵
  PID:10640
- C:\Windows\System\lfFHpdJ.exe
  C:\Windows\System\lfFHpdJ.exe
  2⤵
  PID:7272
- C:\Windows\System\BwmPXVZ.exe
  C:\Windows\System\BwmPXVZ.exe
  2⤵
  PID:12516
- C:\Windows\System\HtzPMcX.exe
  C:\Windows\System\HtzPMcX.exe
  2⤵
  PID:7928
- C:\Windows\System\pEDZnMo.exe
  C:\Windows\System\pEDZnMo.exe
  2⤵
  PID:7524
- C:\Windows\System\YRPYCdS.exe
  C:\Windows\System\YRPYCdS.exe
  2⤵
  PID:7852
- C:\Windows\System\VxGeNtW.exe
  C:\Windows\System\VxGeNtW.exe
  2⤵
  PID:10016
- C:\Windows\System\dkrhGZc.exe
  C:\Windows\System\dkrhGZc.exe
  2⤵
  PID:6272
- C:\Windows\System\BOtvSca.exe
  C:\Windows\System\BOtvSca.exe
  2⤵
  PID:12496
- C:\Windows\System\ObFJpbi.exe
  C:\Windows\System\ObFJpbi.exe
  2⤵
  PID:12980
- C:\Windows\System\TiOjLet.exe
  C:\Windows\System\TiOjLet.exe
  2⤵
  PID:7832
- C:\Windows\System\uEkOSyx.exe
  C:\Windows\System\uEkOSyx.exe
  2⤵
  PID:7976
- C:\Windows\System\uJYepKu.exe
  C:\Windows\System\uJYepKu.exe
  2⤵
  PID:8588
- C:\Windows\System\XLKvlXG.exe
  C:\Windows\System\XLKvlXG.exe
  2⤵
  PID:6276
- C:\Windows\System\WbpizrN.exe
  C:\Windows\System\WbpizrN.exe
  2⤵
  PID:7536
- C:\Windows\System\YqdDpCl.exe
  C:\Windows\System\YqdDpCl.exe
  2⤵
  PID:7968
- C:\Windows\System\VtijpeM.exe
  C:\Windows\System\VtijpeM.exe
  2⤵
  PID:9072
- C:\Windows\System\hynXuLJ.exe
  C:\Windows\System\hynXuLJ.exe
  2⤵
  PID:9200
- C:\Windows\System\MiaBUhT.exe
  C:\Windows\System\MiaBUhT.exe
  2⤵
  PID:8332
- C:\Windows\System\jMdVMpG.exe
  C:\Windows\System\jMdVMpG.exe
  2⤵
  PID:8584
- C:\Windows\System\zoBmMrF.exe
  C:\Windows\System\zoBmMrF.exe
  2⤵
  PID:8492
- C:\Windows\System\tIPgZbH.exe
  C:\Windows\System\tIPgZbH.exe
  2⤵
  PID:10992
- C:\Windows\System\qhxjlGZ.exe
  C:\Windows\System\qhxjlGZ.exe
  2⤵
  PID:8952
- C:\Windows\System\GNTBtFs.exe
  C:\Windows\System\GNTBtFs.exe
  2⤵
  PID:6356
- C:\Windows\System\zpKWCas.exe
  C:\Windows\System\zpKWCas.exe
  2⤵
  PID:12332
- C:\Windows\System\BiAIGFF.exe
  C:\Windows\System\BiAIGFF.exe
  2⤵
  PID:1520
- C:\Windows\System\WNRLhzV.exe
  C:\Windows\System\WNRLhzV.exe
  2⤵
  PID:7212
- C:\Windows\System\bIgcdhG.exe
  C:\Windows\System\bIgcdhG.exe
  2⤵
  PID:13172
- C:\Windows\System\DQtKIrS.exe
  C:\Windows\System\DQtKIrS.exe
  2⤵
  PID:8636
- C:\Windows\System\HwdzIed.exe
  C:\Windows\System\HwdzIed.exe
  2⤵
  PID:12548
- C:\Windows\System\nVIzbkm.exe
  C:\Windows\System\nVIzbkm.exe
  2⤵
  PID:11192
- C:\Windows\System\hUxOhIb.exe
  C:\Windows\System\hUxOhIb.exe
  2⤵
  PID:9708
- C:\Windows\System\HkJwOEv.exe
  C:\Windows\System\HkJwOEv.exe
  2⤵
  PID:9608
- C:\Windows\System\QXfcTyF.exe
  C:\Windows\System\QXfcTyF.exe
  2⤵
  PID:9700
- C:\Windows\System\SSRtenw.exe
  C:\Windows\System\SSRtenw.exe
  2⤵
  PID:8052
- C:\Windows\System\vVWizDA.exe
  C:\Windows\System\vVWizDA.exe
  2⤵
  PID:7496
- C:\Windows\System\RiyNKFX.exe
  C:\Windows\System\RiyNKFX.exe
  2⤵
  PID:10864
- C:\Windows\System\BywZCVp.exe
  C:\Windows\System\BywZCVp.exe
  2⤵
  PID:9828
- C:\Windows\System\CGsYmMf.exe
  C:\Windows\System\CGsYmMf.exe
  2⤵
  PID:10032
- C:\Windows\System\LBcyokr.exe
  C:\Windows\System\LBcyokr.exe
  2⤵
  PID:8920
- C:\Windows\System\fxhymbi.exe
  C:\Windows\System\fxhymbi.exe
  2⤵
  PID:9048
- C:\Windows\System\AqAhrvq.exe
  C:\Windows\System\AqAhrvq.exe
  2⤵
  PID:10176
- C:\Windows\System\MEyelTG.exe
  C:\Windows\System\MEyelTG.exe
  2⤵
  PID:12988
- C:\Windows\System\LBgeEvX.exe
  C:\Windows\System\LBgeEvX.exe
  2⤵
  PID:9116
- C:\Windows\System\WEhRZiR.exe
  C:\Windows\System\WEhRZiR.exe
  2⤵
  PID:8276
- C:\Windows\System\sjxGxhi.exe
  C:\Windows\System\sjxGxhi.exe
  2⤵
  PID:8440
- C:\Windows\System\HRPeWGB.exe
  C:\Windows\System\HRPeWGB.exe
  2⤵
  PID:8928
- C:\Windows\System\kGHnYlR.exe
  C:\Windows\System\kGHnYlR.exe
  2⤵
  PID:9876
- C:\Windows\System\BbppJkv.exe
  C:\Windows\System\BbppJkv.exe
  2⤵
  PID:8384
- C:\Windows\System\aTbbqvG.exe
  C:\Windows\System\aTbbqvG.exe
  2⤵
  PID:7108
- C:\Windows\System\ysOzsmi.exe
  C:\Windows\System\ysOzsmi.exe
  2⤵
  PID:11088
- C:\Windows\System\VUGVDEa.exe
  C:\Windows\System\VUGVDEa.exe
  2⤵
  PID:9612
- C:\Windows\System\AXYvZxy.exe
  C:\Windows\System\AXYvZxy.exe
  2⤵
  PID:9352
- C:\Windows\System\FMilVZA.exe
  C:\Windows\System\FMilVZA.exe
  2⤵
  PID:9752
- C:\Windows\System\xiOkvdz.exe
  C:\Windows\System\xiOkvdz.exe
  2⤵
  PID:9920
- C:\Windows\System\DXZXrZT.exe
  C:\Windows\System\DXZXrZT.exe
  2⤵
  PID:9860
- C:\Windows\System\qjIeYsj.exe
  C:\Windows\System\qjIeYsj.exe
  2⤵
  PID:9656
- C:\Windows\System\NnzpyAU.exe
  C:\Windows\System\NnzpyAU.exe
  2⤵
  PID:10380
- C:\Windows\System\VBzhWyH.exe
  C:\Windows\System\VBzhWyH.exe
  2⤵
  PID:10416
- C:\Windows\System\fMiAJMA.exe
  C:\Windows\System\fMiAJMA.exe
  2⤵
  PID:10424
- C:\Windows\System\QqFzeRm.exe
  C:\Windows\System\QqFzeRm.exe
  2⤵
  PID:4736
- C:\Windows\System\OIeDajU.exe
  C:\Windows\System\OIeDajU.exe
  2⤵
  PID:10296
- C:\Windows\System\csOOdvF.exe
  C:\Windows\System\csOOdvF.exe
  2⤵
  PID:10332
- C:\Windows\System\xQLexvo.exe
  C:\Windows\System\xQLexvo.exe
  2⤵
  PID:10344
- C:\Windows\System\LxCXcIz.exe
  C:\Windows\System\LxCXcIz.exe
  2⤵
  PID:10036
- C:\Windows\System\subtNnM.exe
  C:\Windows\System\subtNnM.exe
  2⤵
  PID:9336
- C:\Windows\System\PJPFIhg.exe
  C:\Windows\System\PJPFIhg.exe
  2⤵
  PID:10680
- C:\Windows\System\KQhfcNL.exe
  C:\Windows\System\KQhfcNL.exe
  2⤵
  PID:8660
- C:\Windows\System\jisWQyt.exe
  C:\Windows\System\jisWQyt.exe
  2⤵
  PID:8528
- C:\Windows\System\deaXOmk.exe
  C:\Windows\System\deaXOmk.exe
  2⤵
  PID:12744
- C:\Windows\System\ccNRzcv.exe
  C:\Windows\System\ccNRzcv.exe
  2⤵
  PID:10752
- C:\Windows\System\XYvPJfs.exe
  C:\Windows\System\XYvPJfs.exe
  2⤵
  PID:11204
- C:\Windows\System\yeHmVWo.exe
  C:\Windows\System\yeHmVWo.exe
  2⤵
  PID:9744
- C:\Windows\System\CPvOraf.exe
  C:\Windows\System\CPvOraf.exe
  2⤵
  PID:11148
- C:\Windows\System\ewmZxhV.exe
  C:\Windows\System\ewmZxhV.exe
  2⤵
  PID:9532
- C:\Windows\System\PaCUBuj.exe
  C:\Windows\System\PaCUBuj.exe
  2⤵
  PID:9968
- C:\Windows\System\jYfoUUH.exe
  C:\Windows\System\jYfoUUH.exe
  2⤵
  PID:9456
- C:\Windows\System\GbgQKmK.exe
  C:\Windows\System\GbgQKmK.exe
  2⤵
  PID:10468
- C:\Windows\System\xFMShmE.exe
  C:\Windows\System\xFMShmE.exe
  2⤵
  PID:9580
- C:\Windows\System\hpnyAvK.exe
  C:\Windows\System\hpnyAvK.exe
  2⤵
  PID:10160
- C:\Windows\System\ffXjJKn.exe
  C:\Windows\System\ffXjJKn.exe
  2⤵
  PID:6384
- C:\Windows\System\kcVmYzY.exe
  C:\Windows\System\kcVmYzY.exe
  2⤵
  PID:9320
- C:\Windows\System\jZQfOEr.exe
  C:\Windows\System\jZQfOEr.exe
  2⤵
  PID:10536
- C:\Windows\System\ByUKwol.exe
  C:\Windows\System\ByUKwol.exe
  2⤵
  PID:10612
- C:\Windows\System\baPtcMA.exe
  C:\Windows\System\baPtcMA.exe
  2⤵
  PID:10488
- C:\Windows\System\qWNJtnt.exe
  C:\Windows\System\qWNJtnt.exe
  2⤵
  PID:8556
- C:\Windows\System\OabTPGi.exe
  C:\Windows\System\OabTPGi.exe
  2⤵
  PID:10312
- C:\Windows\System\tADVWZl.exe
  C:\Windows\System\tADVWZl.exe
  2⤵
  PID:11100
- C:\Windows\System\OyBtHUO.exe
  C:\Windows\System\OyBtHUO.exe
  2⤵
  PID:11488
- C:\Windows\System\XukuCyE.exe
  C:\Windows\System\XukuCyE.exe
  2⤵
  PID:2748
- C:\Windows\System\jFLySTX.exe
  C:\Windows\System\jFLySTX.exe
  2⤵
  PID:11348
- C:\Windows\System\nFnzCmW.exe
  C:\Windows\System\nFnzCmW.exe
  2⤵
  PID:10956
- C:\Windows\System\tiNalnL.exe
  C:\Windows\System\tiNalnL.exe
  2⤵
  PID:11252
- C:\Windows\System\DJwjTJd.exe
  C:\Windows\System\DJwjTJd.exe
  2⤵
  PID:12124
- C:\Windows\System\jDXdGpq.exe
  C:\Windows\System\jDXdGpq.exe
  2⤵
  PID:8812
- C:\Windows\System\tKHRFuY.exe
  C:\Windows\System\tKHRFuY.exe
  2⤵
  PID:10492
- C:\Windows\System\xOdrqWK.exe
  C:\Windows\System\xOdrqWK.exe
  2⤵
  PID:9284
- C:\Windows\System\OGqWTty.exe
  C:\Windows\System\OGqWTty.exe
  2⤵
  PID:13336
- C:\Windows\System\QkBRUBf.exe
  C:\Windows\System\QkBRUBf.exe
  2⤵
  PID:13364
- C:\Windows\System\OciqkRz.exe
  C:\Windows\System\OciqkRz.exe
  2⤵
  PID:13400
- C:\Windows\System\xHQGCTd.exe
  C:\Windows\System\xHQGCTd.exe
  2⤵
  PID:13416
- C:\Windows\System\ExfmkuB.exe
  C:\Windows\System\ExfmkuB.exe
  2⤵
  PID:13432
- C:\Windows\System\IXlzvQW.exe
  C:\Windows\System\IXlzvQW.exe
  2⤵
  PID:13448
- C:\Windows\System\NTDPelP.exe
  C:\Windows\System\NTDPelP.exe
  2⤵
  PID:13468
- C:\Windows\System\EJaPCnT.exe
  C:\Windows\System\EJaPCnT.exe
  2⤵
  PID:13484
- C:\Windows\System\FrWjnFU.exe
  C:\Windows\System\FrWjnFU.exe
  2⤵
  PID:13500
- C:\Windows\System\BQDPLuo.exe
  C:\Windows\System\BQDPLuo.exe
  2⤵
  PID:13552
- C:\Windows\System\vrHoOPb.exe
  C:\Windows\System\vrHoOPb.exe
  2⤵
  PID:13592
- C:\Windows\System\jgvliWm.exe
  C:\Windows\System\jgvliWm.exe
  2⤵
  PID:13632
- C:\Windows\System\zQCcsqR.exe
  C:\Windows\System\zQCcsqR.exe
  2⤵
  PID:13680
- C:\Windows\System\rBIcZfP.exe
  C:\Windows\System\rBIcZfP.exe
  2⤵
  PID:13712
- C:\Windows\System\zMvyqfU.exe
  C:\Windows\System\zMvyqfU.exe
  2⤵
  PID:13876
- C:\Windows\System\djytPnj.exe
  C:\Windows\System\djytPnj.exe
  2⤵
  PID:13916
- C:\Windows\System\cUjKHkT.exe
  C:\Windows\System\cUjKHkT.exe
  2⤵
  PID:13948
- C:\Windows\System\ZgqjPDd.exe
  C:\Windows\System\ZgqjPDd.exe
  2⤵
  PID:13976
- C:\Windows\System\HLobjsc.exe
  C:\Windows\System\HLobjsc.exe
  2⤵
  PID:14004
- C:\Windows\System\HVQGEqj.exe
  C:\Windows\System\HVQGEqj.exe
  2⤵
  PID:14044
- C:\Windows\System\UQVVbtz.exe
  C:\Windows\System\UQVVbtz.exe
  2⤵
  PID:14084
- C:\Windows\System\cuFzxmK.exe
  C:\Windows\System\cuFzxmK.exe
  2⤵
  PID:14104
- C:\Windows\System\rAFZWcM.exe
  C:\Windows\System\rAFZWcM.exe
  2⤵
  PID:14124
- C:\Windows\System\YBRupzh.exe
  C:\Windows\System\YBRupzh.exe
  2⤵
  PID:14152
- C:\Windows\System\nZuasLP.exe
  C:\Windows\System\nZuasLP.exe
  2⤵
  PID:14176
- C:\Windows\System\kQlvSiS.exe
  C:\Windows\System\kQlvSiS.exe
  2⤵
  PID:14200
- C:\Windows\System\MDFSRQy.exe
  C:\Windows\System\MDFSRQy.exe
  2⤵
  PID:14216
- C:\Windows\System\uxUVhDh.exe
  C:\Windows\System\uxUVhDh.exe
  2⤵
  PID:14240
- C:\Windows\System\KdfECgw.exe
  C:\Windows\System\KdfECgw.exe
  2⤵
  PID:14284
- C:\Windows\System\lgJOaOd.exe
  C:\Windows\System\lgJOaOd.exe
  2⤵
  PID:14316
- C:\Windows\System\ZJOdAio.exe
  C:\Windows\System\ZJOdAio.exe
  2⤵
  PID:2340
- C:\Windows\System\ehKxcCD.exe
  C:\Windows\System\ehKxcCD.exe
  2⤵
  PID:8644
- C:\Windows\System\FokPlHH.exe
  C:\Windows\System\FokPlHH.exe
  2⤵
  PID:9388
- C:\Windows\System\ZTSSbni.exe
  C:\Windows\System\ZTSSbni.exe
  2⤵
  PID:11084
- C:\Windows\System\dtzwlIi.exe
  C:\Windows\System\dtzwlIi.exe
  2⤵
  PID:11768
- C:\Windows\System\fuDWQRu.exe
  C:\Windows\System\fuDWQRu.exe
  2⤵
  PID:12172
- C:\Windows\System\acCDznd.exe
  C:\Windows\System\acCDznd.exe
  2⤵
  PID:13320
- C:\Windows\System\AZjQYsM.exe
  C:\Windows\System\AZjQYsM.exe
  2⤵
  PID:13380
- C:\Windows\System\aStCBiY.exe
  C:\Windows\System\aStCBiY.exe
  2⤵
  PID:10908
- C:\Windows\System\rbCUBkQ.exe
  C:\Windows\System\rbCUBkQ.exe
  2⤵
  PID:13464
- C:\Windows\System\EGNqUiC.exe
  C:\Windows\System\EGNqUiC.exe
  2⤵
  PID:13496
- C:\Windows\System\dHzBKbY.exe
  C:\Windows\System\dHzBKbY.exe
  2⤵
  PID:9172
- C:\Windows\System\xithaRR.exe
  C:\Windows\System\xithaRR.exe
  2⤵
  PID:12040
- C:\Windows\System\ZJFCXXo.exe
  C:\Windows\System\ZJFCXXo.exe
  2⤵
  PID:12116
- C:\Windows\System\McseWtN.exe
  C:\Windows\System\McseWtN.exe
  2⤵
  PID:3628
- C:\Windows\System\mfZmmhb.exe
  C:\Windows\System\mfZmmhb.exe
  2⤵
  PID:13440
- C:\Windows\System\zvfhaxH.exe
  C:\Windows\System\zvfhaxH.exe
  2⤵
  PID:13508
- C:\Windows\System\otBOHAw.exe
  C:\Windows\System\otBOHAw.exe
  2⤵
  PID:13544
- C:\Windows\System\KshBNnU.exe
  C:\Windows\System\KshBNnU.exe
  2⤵
  PID:13612
- C:\Windows\System\BxOTfmJ.exe
  C:\Windows\System\BxOTfmJ.exe
  2⤵
  PID:11492
- C:\Windows\System\yxpJJtS.exe
  C:\Windows\System\yxpJJtS.exe
  2⤵
  PID:13704
- C:\Windows\System\JrJlPbL.exe
  C:\Windows\System\JrJlPbL.exe
  2⤵
  PID:12320
- C:\Windows\System\jAxojmW.exe
  C:\Windows\System\jAxojmW.exe
  2⤵
  PID:13936
- C:\Windows\System\fiAyVkf.exe
  C:\Windows\System\fiAyVkf.exe
  2⤵
  PID:13988
- C:\Windows\System\uzemjrL.exe
  C:\Windows\System\uzemjrL.exe
  2⤵
  PID:14052
- C:\Windows\System\XcxihWs.exe
  C:\Windows\System\XcxihWs.exe
  2⤵
  PID:13800
- C:\Windows\System\axqIdkk.exe
  C:\Windows\System\axqIdkk.exe
  2⤵
  PID:14140
- C:\Windows\System\wGxCliP.exe
  C:\Windows\System\wGxCliP.exe
  2⤵
  PID:14184
- C:\Windows\System\evDgJyJ.exe
  C:\Windows\System\evDgJyJ.exe
  2⤵
  PID:13960
- C:\Windows\System\cbXCCwO.exe
  C:\Windows\System\cbXCCwO.exe
  2⤵
  PID:14096
- C:\Windows\System\yowxQYI.exe
  C:\Windows\System\yowxQYI.exe
  2⤵
  PID:11332
- C:\Windows\System\RhdjuPS.exe
  C:\Windows\System\RhdjuPS.exe
  2⤵
  PID:14228
- C:\Windows\System\orPlQZy.exe
  C:\Windows\System\orPlQZy.exe
  2⤵
  PID:14276
- C:\Windows\System\TZiFsQO.exe
  C:\Windows\System\TZiFsQO.exe
  2⤵
  PID:13356
- C:\Windows\System\OTQMnlE.exe
  C:\Windows\System\OTQMnlE.exe
  2⤵
  PID:12828
- C:\Windows\System\hHZafJQ.exe
  C:\Windows\System\hHZafJQ.exe
  2⤵
  PID:11724
- C:\Windows\System\QtPBLTp.exe
  C:\Windows\System\QtPBLTp.exe
  2⤵
  PID:11908
- C:\Windows\System\YTJCSbJ.exe
  C:\Windows\System\YTJCSbJ.exe
  2⤵
  PID:11080
- C:\Windows\System\XiEGtWT.exe
  C:\Windows\System\XiEGtWT.exe
  2⤵
  PID:8704
- C:\Windows\System\YIfBksN.exe
  C:\Windows\System\YIfBksN.exe
  2⤵
  PID:10724
- C:\Windows\System\ZPIbSrk.exe
  C:\Windows\System\ZPIbSrk.exe
  2⤵
  PID:13516
- C:\Windows\System\QXwufSH.exe
  C:\Windows\System\QXwufSH.exe
  2⤵
  PID:13652
- C:\Windows\System\MEjKOkb.exe
  C:\Windows\System\MEjKOkb.exe
  2⤵
  PID:13528
- C:\Windows\System\uKAPawQ.exe
  C:\Windows\System\uKAPawQ.exe
  2⤵
  PID:12776
- C:\Windows\System\mpBvNFZ.exe
  C:\Windows\System\mpBvNFZ.exe
  2⤵
  PID:14292
- C:\Windows\System\STQdjzk.exe
  C:\Windows\System\STQdjzk.exe
  2⤵
  PID:13180
- C:\Windows\System\xxwHgvX.exe
  C:\Windows\System\xxwHgvX.exe
  2⤵
  PID:14148
- C:\Windows\System\dUVaMJD.exe
  C:\Windows\System\dUVaMJD.exe
  2⤵
  PID:13872
- C:\Windows\System\IyxZUNc.exe
  C:\Windows\System\IyxZUNc.exe
  2⤵
  PID:12316
- C:\Windows\System\AlsvsZe.exe
  C:\Windows\System\AlsvsZe.exe
  2⤵
  PID:13060
- C:\Windows\System\gEstYpN.exe
  C:\Windows\System\gEstYpN.exe
  2⤵
  PID:13672
- C:\Windows\System\XgjcMfX.exe
  C:\Windows\System\XgjcMfX.exe
  2⤵
  PID:13480
- C:\Windows\System\UrXsdfR.exe
  C:\Windows\System\UrXsdfR.exe
  2⤵
  PID:10600
- C:\Windows\System\gqyyvtU.exe
  C:\Windows\System\gqyyvtU.exe
  2⤵
  PID:14072
- C:\Windows\System\TRwzEwl.exe
  C:\Windows\System\TRwzEwl.exe
  2⤵
  PID:12728
- C:\Windows\System\MGsTbUS.exe
  C:\Windows\System\MGsTbUS.exe
  2⤵
  PID:13852
- C:\Windows\System\tIncFQq.exe
  C:\Windows\System\tIncFQq.exe
  2⤵
  PID:14312
- C:\Windows\System\SMzAMWq.exe
  C:\Windows\System\SMzAMWq.exe
  2⤵
  PID:11104
- C:\Windows\System\LJPGpAj.exe
  C:\Windows\System\LJPGpAj.exe
  2⤵
  PID:13512
- C:\Windows\System\qrbjksI.exe
  C:\Windows\System\qrbjksI.exe
  2⤵
  PID:11832
- C:\Windows\System\FgNCfrm.exe
  C:\Windows\System\FgNCfrm.exe
  2⤵
  PID:13728
- C:\Windows\System\HEmkMHn.exe
  C:\Windows\System\HEmkMHn.exe
  2⤵
  PID:11612
- C:\Windows\System\FsJHQsO.exe
  C:\Windows\System\FsJHQsO.exe
  2⤵
  PID:14364
- C:\Windows\System\EaqafWh.exe
  C:\Windows\System\EaqafWh.exe
  2⤵
  PID:14400
- C:\Windows\System\CeHNnFE.exe
  C:\Windows\System\CeHNnFE.exe
  2⤵
  PID:14428
- C:\Windows\System\yfXOsrB.exe
  C:\Windows\System\yfXOsrB.exe
  2⤵
  PID:14456
- C:\Windows\System\DhvFFQP.exe
  C:\Windows\System\DhvFFQP.exe
  2⤵
  PID:14480
- C:\Windows\System\ePMJApK.exe
  C:\Windows\System\ePMJApK.exe
  2⤵
  PID:14504
- C:\Windows\System\DGCccLU.exe
  C:\Windows\System\DGCccLU.exe
  2⤵
  PID:14524
- C:\Windows\System\AyWTwlr.exe
  C:\Windows\System\AyWTwlr.exe
  2⤵
  PID:14564
- C:\Windows\System\bjDGKSE.exe
  C:\Windows\System\bjDGKSE.exe
  2⤵
  PID:14596
- C:\Windows\System\fZHfRVC.exe
  C:\Windows\System\fZHfRVC.exe
  2⤵
  PID:14628
- C:\Windows\System\PctUDfq.exe
  C:\Windows\System\PctUDfq.exe
  2⤵
  PID:14652
- C:\Windows\System\UhyMwpE.exe
  C:\Windows\System\UhyMwpE.exe
  2⤵
  PID:14684
- C:\Windows\System\UUFWpvd.exe
  C:\Windows\System\UUFWpvd.exe
  2⤵
  PID:14704
- C:\Windows\System\gedMwMt.exe
  C:\Windows\System\gedMwMt.exe
  2⤵
  PID:14724
- C:\Windows\System\GXgIoTl.exe
  C:\Windows\System\GXgIoTl.exe
  2⤵
  PID:14756
- C:\Windows\System\ZJhUSvi.exe
  C:\Windows\System\ZJhUSvi.exe
  2⤵
  PID:14772
- C:\Windows\System\ufwfLnq.exe
  C:\Windows\System\ufwfLnq.exe
  2⤵
  PID:14788
- C:\Windows\System\ILRizOa.exe
  C:\Windows\System\ILRizOa.exe
  2⤵
  PID:14812
- C:\Windows\System\TMTTITZ.exe
  C:\Windows\System\TMTTITZ.exe
  2⤵
  PID:14848
- C:\Windows\System\aNTHqWM.exe
  C:\Windows\System\aNTHqWM.exe
  2⤵
  PID:14904
- C:\Windows\System\ZwAYSKE.exe
  C:\Windows\System\ZwAYSKE.exe
  2⤵
  PID:14928
- C:\Windows\System\rBBKJUy.exe
  C:\Windows\System\rBBKJUy.exe
  2⤵
  PID:14948
- C:\Windows\System\kiiSLey.exe
  C:\Windows\System\kiiSLey.exe
  2⤵
  PID:14972
- C:\Windows\System\xolEOOP.exe
  C:\Windows\System\xolEOOP.exe
  2⤵
  PID:15012
- C:\Windows\System\bUEtOpx.exe
  C:\Windows\System\bUEtOpx.exe
  2⤵
  PID:15032
- C:\Windows\System\mpsKDyR.exe
  C:\Windows\System\mpsKDyR.exe
  2⤵
  PID:15056
- C:\Windows\System\AFLCoSO.exe
  C:\Windows\System\AFLCoSO.exe
  2⤵
  PID:15084
- C:\Windows\System\tHZFQqI.exe
  C:\Windows\System\tHZFQqI.exe
  2⤵
  PID:15104
- C:\Windows\System\LqyPkUA.exe
  C:\Windows\System\LqyPkUA.exe
  2⤵
  PID:15132
- C:\Windows\System\oYwFWYq.exe
  C:\Windows\System\oYwFWYq.exe
  2⤵
  PID:15156
- C:\Windows\System\ZuQYqxn.exe
  C:\Windows\System\ZuQYqxn.exe
  2⤵
  PID:15196
- C:\Windows\System\NnQqLWp.exe
  C:\Windows\System\NnQqLWp.exe
  2⤵
  PID:15232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wxozm0cd.5z4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AqCAyrw.exe

Filesize
2.1MB

MD5
b8792c0c919e56d2bcad82dbe2a68548

SHA1
27afc435e277b9d68cb78ac67862c55fd4d45316

SHA256
0a3965048093b67a09331749204d37465d061371a9db2ba5d18b6f5fe3986f22

SHA512
fe571a13f04af6725e646043b82b256f1b63335c6833c3b1d68e23078beec148c5229b91b0298788ec2f7d9e750d9f0550bb46d73af3b59aa782a2dfcd8df06a

Download Submit
C:\Windows\System\Ckjzqfo.exe

Filesize
2.1MB

MD5
74138fded9a9cbe2f8b7dbed9a1c0a35

SHA1
74e3008655a40609f3195ca0f3d025557de8a4e6

SHA256
fc02d83fb371ed085a55c0d418b54c3d272a68e0bea8c54ee9f2ee232f21932f

SHA512
2e7bfb0381649633cba15c06c549cc331aae8fdd71ba42739b4e3865bd6a24b4c5ac19b258ffd7a35862df0b6307fca2de9c6c29ea6c7910506429f0bf7d4789

Download Submit
C:\Windows\System\EABDUAg.exe

Filesize
2.1MB

MD5
dde91bef16fdfdae5c358bcb010ec5d9

SHA1
5e3a7266729c73e1f4ace58d5d89266561840a6d

SHA256
ad2b6ccfae4c10299577f4351003e4d29520e074380d5c7ac400c4b7e16d97c1

SHA512
639961870ad7bff4ee76607b35fb69cefb5516c81d29210914c6d37ad1ed1c5743f4bd8ff419ff19ae78d1ab5641237117da409e400f8fc1ecf8ab2dec55d5fd

Download Submit
C:\Windows\System\FHATjiE.exe

Filesize
2.1MB

MD5
21a731a9556ad703942d827bc03c7723

SHA1
f71473d10e9626987f394b70b2ff213e230ae722

SHA256
dc8883bb0cb648b6f923388593e68f4026cbde00183c7451163456ea49a7f064

SHA512
3704008d7c3b6bd5f0504ee1e6c10299f72c910a31a345275cc902a4e99b5af5fbf4a0564805e65ea39cb0bdcc2a93135c367f54407e7c7f95b59d28067dfbe6

Download Submit
C:\Windows\System\FtcFaVv.exe

Filesize
2.1MB

MD5
918a132175369ea32610595f8d0514ee

SHA1
52d9ecd1ed81899c62e498e7a70f3daa66a00700

SHA256
4af47259703b28ad8be5accb0da748e5af31fe760c2f11a52eaf3bd391d039e3

SHA512
e7f1027de197d134393a568582aa503dfc03a113a7856520d1b9dad76cd0e732917c681e2d4ad76f388edd3684b777549a910ee6bd6c8e96c3fc1199346afb12

Download Submit
C:\Windows\System\GJHNfwo.exe

Filesize
2.1MB

MD5
bf2d2bca5ded02e9cc1ca07beac29397

SHA1
638d13feb85ed91a695b0124b89b5b95d544477f

SHA256
e5215d7db8878dd5e4c6ec3beff56f808b412aa31b0132317b0178d1bc7cbb16

SHA512
31275e0a65dda56e7590b6e989d0fb41403b12aa48e234efa20f5b81cf455458cfec2dfa3daf32ad68ba110e591cc49f731065c756c52f54b956b2894960a9d4

Download Submit
C:\Windows\System\GlTmSgI.exe

Filesize
2.1MB

MD5
e563e065eb3bd861f6039c501bd90d35

SHA1
f0728bae5b326ebc5f7aeb25140faf83bc8273b2

SHA256
9ce00758d6aa3435b9f051c9f389c63307d271af22a826709345f060feee065e

SHA512
39168e4d3028dc734b8b990e1add1d633e824a6767107f01717e914e95b280b4d3dfa2e707eefbe064ccd430e9c122e6ef80aab43ac57ed6338a6d466b31d20c

Download Submit
C:\Windows\System\GqZOHHE.exe

Filesize
2.1MB

MD5
026a02c4b07e1397d4a0fb47880fa14e

SHA1
a8c731456636f10319dcc56b699155704c313b67

SHA256
b46604e34e87ccb9afb8fe4b606e27c9f8a7f4b6ee7c13686eac5926a7f8a6e4

SHA512
55a3bbd3119e5938cac7347a9113b2c2a70c868f4c0cbbf2eeaec3609de096f87f01f3e638edf7ff417824bc987ba96c7af12c04b788b8c0c9f376596dbf60c3

Download Submit
C:\Windows\System\HLLhhke.exe

Filesize
2.1MB

MD5
a5830130dfe145ce551df3ca9bf77b9c

SHA1
cdb61de5af7983330f3b2ad601d66814ca6c80e1

SHA256
efb5fa91645cc5b9950ff6308db6147af558e09cd06a8e7f6eda2907347ede2e

SHA512
1c02001047ac85bded65118858b4d0473103be121eba6044970b6516b556ed354efa8c19d834f9ee48f33193d16eb9560fb5bcee776a4f4f99f0e2b97ac22120

Download Submit
C:\Windows\System\HajukVS.exe

Filesize
2.1MB

MD5
d0a3844ebe7a72f8c6d06cc150b5815d

SHA1
1c3cd10fbd69e5f9df12e5d564fe7cecd3e435e5

SHA256
13dce45903f57b3f82336f6abb0d4a55193b2175a5ec8532606dd0ed01a9d206

SHA512
5c31dbe1901b4dbf22082387197eae5a1ad81c9b562f137102a667494062c53a4cf2873265847be63c6b50d6380277b2ff3204c11de119042fc13f4e5a3d5507

Download Submit
C:\Windows\System\JnhYvdM.exe

Filesize
2.1MB

MD5
b26f986ef1e2edac72e047d94e75b845

SHA1
df1feac2afc3dadb3c166a05c851932a42622373

SHA256
c60640cfc94579a2b5ca7688515f3310c8f0f2c25d7af81e70d8ad1954c92a86

SHA512
f044f654930f8f293824200f618d4ff383fc47ac8204da6cfa0b56726b258d6c9bb125c75f3d49d0bf40bda70fbaa41af8e0d6d4e773ee9c2cffdc9b6e84e1f8

Download Submit
C:\Windows\System\LDvpEwe.exe

Filesize
2.1MB

MD5
6022207d395bc21e6a0fb925cddf81ef

SHA1
47f3ac1fe6c71aee472039f7a83b1f35e0a6e86c

SHA256
2fe1bfeeaf3de60642237bde34df9502e08bf6d54fe7e8e4140bd1e5643601bd

SHA512
90da5dd5331db5705eee8ba62492b34b1e78979193ae3a73f43db18da015abcaed9459f952689c13afe9b766d7c7dbd6d241513ff1318965298a6f6a151b7c75

Download Submit
C:\Windows\System\LciugeS.exe

Filesize
2.1MB

MD5
60174fc0862fa7a684aee682f6d7bfd1

SHA1
64175d5fb0e8678460a04b0710e5ba4baff0eddf

SHA256
5a708489d032797ef96bcc9083a7f98225d51c6b618ab8b0f8f659d0116ad97e

SHA512
0608ab5a4d1d73d5cf3b3fbcd5500c05aabda78b933be82b4dbfd9170a5f4ed44a89db0cbcd43eb5fc3abc2b88a409b0d0e08db6926c2818d62f31f5db767928

Download Submit
C:\Windows\System\PKxbEUV.exe

Filesize
2.1MB

MD5
d0ebfb29bdb1261081788ad624760b00

SHA1
ce353deda2d60842f3df27cbdab7fcdca813ebe6

SHA256
ede369092fefa91b084db8fa48f931b1f4b47dad2cb8b51cadcb26e3522f221b

SHA512
2dc3704cd6c69b26490f40a2387d77ce1389925609b99a87f56f806900df74cd65396c86e0de3b7638529f5d307e8e6809859eadf484c639dc642115f7a33590

Download Submit
C:\Windows\System\TjjJiiX.exe

Filesize
2.1MB

MD5
662f8066c87e8bda191f5b46202ad2a0

SHA1
9dc1f826aba6d70eb335382d70e3a5523859995e

SHA256
4fab773a2c8a04527337e78955a3cff8c5742344e0c9707fc998c23c6df940bb

SHA512
1785b4897f76706be0bd864fd66f73fe62449b3aa03b31c303a15beac726f85c5e65c0a5fdfc1b34356c53b2f0edf88f67603e10568220dbf198d174a1e66ebe

Download Submit
C:\Windows\System\ZAMJrdd.exe

Filesize
2.1MB

MD5
c576e549a8a72fbca9d1d8861ab431e5

SHA1
73ab56bdb5bc057521e8f7cdd0c7345f74882cb8

SHA256
ee59679c32c0fc2060bf7883e574c9d287e7e1d16c305d9285f448efa0f0b287

SHA512
196e08670e1eed10a28ca9cbefc7eeda3293edfb4306a94119ce406617dec9273708f63a14638bb79931c7ec6a992b9fe96c8bcffe4aebaf494f414b33546f21

Download Submit
C:\Windows\System\cbUXTpS.exe

Filesize
2.1MB

MD5
c9aaee1ae71c2cf7fec3924621695a29

SHA1
e1895b3f6e714956dd7364042cfd6d59e5c09180

SHA256
9a585c9cb1eb7615b7facf34b5eaff38507aaff3ca1e5fb9c76360d3cfc0673c

SHA512
3f13d1df083501324c8b6ff883542b9900ef1b29233a6095cc19ae20f9e3d8bad20f7f3435deafbcd4ce6762004b9a0103eea579303a493938086f2da38ff6b3

Download Submit
C:\Windows\System\feoePDL.exe

Filesize
2.1MB

MD5
4fbc727ad026d4e5701ad938a90251e3

SHA1
cb945387e09c7fde7ac265070ee2e2f486441c75

SHA256
3c6fe15b01248acbf09a6e0bb320b5f431e6b2ab79aae7486ed09b66fe0e5384

SHA512
d69c35b7dd120da08c0fe596799232b279f57c39632c87bb03b5f7bd46a184e787bb40ea8cbcf7866cc35a16679604b4335c71cb4434e602560553d07ee89460

Download Submit
C:\Windows\System\fgqIIOF.exe

Filesize
2.1MB

MD5
e9376bc2a55477f0ee2f49bfb70ccab7

SHA1
e9cc15f7817ae2c7e590c54c46747d9cb579440c

SHA256
d6796836712533eb49fa25c0f6a38f14849d40934b66a16c21fce3db03c0f6c1

SHA512
cc531bbb7ed98b425b14af90dcc0942370c23ecf1f8122a53c8b3028cb9ce18bd9305973ffc5981b971513ed7a95c737d2788a52c1195144d3aba33a748c86db

Download Submit
C:\Windows\System\gvkyHlw.exe

Filesize
2.1MB

MD5
34134214bfd1c97180927413dec87b88

SHA1
25deabf338e5eac9f0160b0eed0f42d52c69e8a5

SHA256
0b03d9fe17e9c1161f5a302932b23803e5d5894c3c8ea29eaa7cde9c20ec1f26

SHA512
71b070bfb2b544bbd22500b7a570973264cc990a724b5147dac0d4ceabcb4fcfbc2821f7543c7cc05434f3ac10a559a50d6101d9e277520924e0b147f1b8cf8e

Download Submit
C:\Windows\System\koNItUt.exe

Filesize
2.1MB

MD5
c643abc01ad3407aa4ef534c59525e93

SHA1
52d5b41bda445a9928bb00fd7258a8bc4201db8d

SHA256
3c8630a11ec446792175d80e5cc78b2fbf88ba04b37a98c8d4505fb65088228c

SHA512
23cba999b949c0d79251aa1e8195e051f942255b624d0790cc208cea42a1d13343ee4c530ff756b6ad35749e6f04722e439a185a4be8ff2c33a5b5d99378c4f9

Download Submit
C:\Windows\System\mQnlAHy.exe

Filesize
18B

MD5
ef758e56e906b9892f08e5e0fd0f13b2

SHA1
5d91983aa1bb61c5754ee9a01242f0bb098e7d43

SHA256
55949f339b372645d839eaa0847f4e244396f7e39c4586ddc776fb793deda110

SHA512
efd8bb7ef71cf583c97f5d0eac4e2fae239c80d85643b80c586971498ace127bb0c9565e46052e55211bb3dead5ae54145b84fc68e9ff4a6be2a5f6b0f086760

Download Submit
C:\Windows\System\nEdNsof.exe

Filesize
2.1MB

MD5
4bcc3d5f3b704deb8bab74dff4297ce0

SHA1
8f116f530e9a44b9a67b4550ce7d1f2c5904706d

SHA256
c0b5e37691231155cdd92a63cacec1d69f3ddb0fe1cd32042ac98eb25550d8d7

SHA512
387b3ca48c29b2eddea6ca32d5985df5575462aa63c3590693470aa4f1a7b7169f773ba6bf69e9b83e3c3e6e9cbd5af7885e9c8073302d9c6923275546bafc1f

Download Submit
C:\Windows\System\pmYuzmr.exe

Filesize
2.1MB

MD5
c27c23bd79b534857ece72b863105448

SHA1
5be0d0c185e75ea89237c36e43a3cd47967920ab

SHA256
c2197341a830aa0d8acc4ff73aa62e22a8a55a228b9860224eaabcf8e7d3e296

SHA512
3f90ee7bfd42339d82febfb8418ccfc1d3466aede698fad4feac370ad1e3617665d403e4b7b77d8b22f5b81ddc532da906b6a3262825e976516704fe36d36229

Download Submit
C:\Windows\System\pvPAtNL.exe

Filesize
2.1MB

MD5
34ab9d5e6302b9c22129e025d6858106

SHA1
69bf07bd9e6daa36b78f024fc61b43d0319adbef

SHA256
1293f0b94921d0744cbefa1f10c2c11064cae30bc5ca8c781d6957684f2747c9

SHA512
a90f8989f216a93de57ca022be87652955d46dd6be90f06ac03beb2d335dacc76af4ba21cc73946b615f9d0b8b7673ad740bdc37212449c1a0204ed0232d9472

Download Submit
C:\Windows\System\qVacuGE.exe

Filesize
2.1MB

MD5
ced369dc7e33ef2d3e900fc8081f3e6d

SHA1
feb60f3fdf950b099a1851cf6043ae8c18771b7e

SHA256
be64f60233ce738aee1408f6d7f2f584ec48f3fae683b53c6758e5a8eebe70f7

SHA512
413d18879c6b4847145763abb59624d9d58f1139f7947d5ee2de4c078320b1d0137896323ba71237affab1fe911727281afc4ff7e95e8bb60267cbebb48fd513

Download Submit
C:\Windows\System\qznvCej.exe

Filesize
2.1MB

MD5
9fd5bb6ea82c483148550c1557e29877

SHA1
572b83c940b03fdc6afa5843dacc0e007f022ee7

SHA256
ab20b8f31bbffdd7aaefc0afa6781673c0b2b48d933a3e58fde6600d2d599c74

SHA512
b64bb0c08479881050365bed5b5895382f7da50037aa223cb275833023fc0175149c0a0bb42b71d9f03475e712de941241becc62e31f0f6a24f26fa624a71275

Download Submit
C:\Windows\System\tLZwUKr.exe

Filesize
8B

MD5
3f9cfe8a165fbe5ed357bf4fb6550d1a

SHA1
d1f76cef8b11f404ce3021901f1968e523167625

SHA256
fe7331c05f745b95f5509c04136ec2be8073cae1c2054bbe90290f3a5e3a1c01

SHA512
7c297d93de1529b68ba232f55d08c5bdfcf13a5c3741f810e605eeec9da08911d3d07e6bd5c21436fbf2be3db2070f19515d3ae2f1e7604c2ff2f34139c616ce

Download Submit
C:\Windows\System\vjpUrMm.exe

Filesize
2.1MB

MD5
6a5cf0c81d7acf65e92465a30fc3b711

SHA1
17bd5cd323e36e367a15d9d1287c3f07fdcccd7c

SHA256
d98016c83ef7efcd55a0bf1335d51e0b6d1bb8131c20a5f59ff971aa9e4cbed8

SHA512
995f3d1c673c2e6f6bc322e1eaa158995446d976cd2ed41173483a343e429ff92d33733d89839fca4ef793d2bebdca4724f89add2f254a52755b60111fcfde61

Download Submit
C:\Windows\System\vtSMZFR.exe

Filesize
2.1MB

MD5
748951f563f0ee1346e98c82d1aebac4

SHA1
fc8dc18a302378b85a31899a7dfca28c3a661096

SHA256
d2fa090603b8398de3632e46335719d10067d5836c63c9b27b87967af636311f

SHA512
323f68ceed8d1c84d9b6eb7e7884962dba3a0ad1f5552d4f34b427a1e14e44746c942128d27bfa5267968b774cf7c2c562007115bb6e3ba9a48c9fc9f69e8636

Download Submit
C:\Windows\System\wBPeoeD.exe

Filesize
2.1MB

MD5
07574d1b1a5681b5ac0a63e1bebf0e17

SHA1
33968ad94c33ed5ad480edc7fc39ed7f551e352f

SHA256
bf2026abe4ec4c8956e4d5a7287bad5eb1b30c44fb4154b850283b83bd4ce0be

SHA512
6ff16706c8edcdc5cc4727263996abbf30f0448a77d3821d7d13aa23895afd61010f015e0a3e583221d60685adfa59350a526fe607872f0e40bf838d8968aa4e

Download Submit
C:\Windows\System\wIDOopA.exe

Filesize
2.1MB

MD5
cb6ad153e05570e4421fa11589bdd149

SHA1
ad8c672a6227343d188c39e82e05110b4a5c8ab5

SHA256
f6f81a67207762d81eaf0a908204d8b7b2bd4099d7061ed5251f51869148af39

SHA512
0bab60a7142268748b939b5e188c677936961a994a8611d935e8a6d035baa150cbbc407a56146a593eaf97a2f530e8c961a577f49ccae51f99e7b6050ec3d411

Download Submit
C:\Windows\System\xLuVLyX.exe

Filesize
2.1MB

MD5
44254fddae811fcb58b323c36d410f01

SHA1
5d9d29fafa6164403851945343363f08a68018a5

SHA256
47ea18be37e786331904266ce767b48345a80a8e13b9f7497e5cfe2bee330814

SHA512
65f0de4bf5fa3ae9eda3a602e42b8a71121387333c65a31b51fbeda98e4bbb95f2ba23df0a79125163abbd40f98a34303ac87cc53c16b1f97fe1559c33d78a62

Download Submit
C:\Windows\System\yKFekDi.exe

Filesize
2.1MB

MD5
44eac45030033484eab1c2a050986e8d

SHA1
e31aa2465fff00823d8c5519d38041a4036dc390

SHA256
00b6ee81fd029224e31b585a9cbf261cb3f1bdf2d7f09dbe0a799f4e5da9886f

SHA512
0645f3f2131bc91306e614cc3c4994dd31ed6a1d072386b048f7b2f274b79bf71430440f8d9e5a2fb595bec2c1779516840943b6cd39871e6e5baea1b2970123

Download Submit
C:\Windows\System\zSlLDpu.exe

Filesize
2.1MB

MD5
c66a73d66a0362da068afe3c37cb4675

SHA1
71fba4be895e48e2a190a6882bbcbffb667b8d61

SHA256
2b3c4e27e9e3cf2d4ad33767b181342947158d942696f0ae72363618a9db797e

SHA512
39fd99ab62ea282690730c0054039fdb825844f7145238eddd2ae20625463d63a009a27447aa658faaf7755c6b67fdd21e4185408332c1e8b7afe2d4340fde6a

Download Submit
memory/864-42-0x00007FF697DA0000-0x00007FF698192000-memory.dmp

Filesize
3.9MB

Download
memory/872-5291-0x00007FF740D30000-0x00007FF741122000-memory.dmp

Filesize
3.9MB

Download
memory/872-83-0x00007FF740D30000-0x00007FF741122000-memory.dmp

Filesize
3.9MB

Download
memory/1012-47-0x00007FF796580000-0x00007FF796972000-memory.dmp

Filesize
3.9MB

Download
memory/1260-3816-0x00007FF6C87B0000-0x00007FF6C8BA2000-memory.dmp

Filesize
3.9MB

Download
memory/1260-131-0x00007FF6C87B0000-0x00007FF6C8BA2000-memory.dmp

Filesize
3.9MB

Download
memory/1472-34-0x000001A657F70000-0x000001A657F80000-memory.dmp

Filesize
64KB

Download
memory/1472-33-0x00007FFEDADA0000-0x00007FFEDB861000-memory.dmp

Filesize
10.8MB

Download
memory/1472-87-0x000001A6583A0000-0x000001A6583C2000-memory.dmp

Filesize
136KB

Download
memory/1472-40-0x000001A657F70000-0x000001A657F80000-memory.dmp

Filesize
64KB

Download
memory/1980-5294-0x00007FF71B4F0000-0x00007FF71B8E2000-memory.dmp

Filesize
3.9MB

Download
memory/1980-51-0x00007FF71B4F0000-0x00007FF71B8E2000-memory.dmp

Filesize
3.9MB

Download
memory/1980-2623-0x00007FF71B4F0000-0x00007FF71B8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2132-106-0x00007FF6C4400000-0x00007FF6C47F2000-memory.dmp

Filesize
3.9MB

Download
memory/2212-76-0x00007FF79DBA0000-0x00007FF79DF92000-memory.dmp

Filesize
3.9MB

Download
memory/2784-113-0x00007FF7D5AD0000-0x00007FF7D5EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-70-0x00007FF72A580000-0x00007FF72A972000-memory.dmp

Filesize
3.9MB

Download
memory/2928-84-0x00007FF76F500000-0x00007FF76F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/3408-4773-0x00007FF7E4CA0000-0x00007FF7E5092000-memory.dmp

Filesize
3.9MB

Download
memory/3408-149-0x00007FF7E4CA0000-0x00007FF7E5092000-memory.dmp

Filesize
3.9MB

Download
memory/3408-5377-0x00007FF7E4CA0000-0x00007FF7E5092000-memory.dmp

Filesize
3.9MB

Download
memory/3436-37-0x00007FF7C8320000-0x00007FF7C8712000-memory.dmp

Filesize
3.9MB

Download
memory/3436-5222-0x00007FF7C8320000-0x00007FF7C8712000-memory.dmp

Filesize
3.9MB

Download
memory/3544-90-0x00007FF77C870000-0x00007FF77CC62000-memory.dmp

Filesize
3.9MB

Download
memory/3544-5307-0x00007FF77C870000-0x00007FF77CC62000-memory.dmp

Filesize
3.9MB

Download
memory/3696-1-0x0000023347D30000-0x0000023347D40000-memory.dmp

Filesize
64KB

Download
memory/3696-0-0x00007FF7417E0000-0x00007FF741BD2000-memory.dmp

Filesize
3.9MB

Download
memory/3960-125-0x00007FF7DE490000-0x00007FF7DE882000-memory.dmp

Filesize
3.9MB

Download
memory/3988-137-0x00007FF6B9380000-0x00007FF6B9772000-memory.dmp

Filesize
3.9MB

Download
memory/3988-3817-0x00007FF6B9380000-0x00007FF6B9772000-memory.dmp

Filesize
3.9MB

Download
memory/4276-107-0x00007FF6C82B0000-0x00007FF6C86A2000-memory.dmp

Filesize
3.9MB

Download
memory/4472-9-0x00007FF749F80000-0x00007FF74A372000-memory.dmp

Filesize
3.9MB

Download
memory/4488-119-0x00007FF6ABD80000-0x00007FF6AC172000-memory.dmp

Filesize
3.9MB

Download
memory/4512-143-0x00007FF6802E0000-0x00007FF6806D2000-memory.dmp

Filesize
3.9MB

Download
memory/4512-5371-0x00007FF6802E0000-0x00007FF6806D2000-memory.dmp

Filesize
3.9MB

Download
memory/4836-100-0x00007FF64BE90000-0x00007FF64C282000-memory.dmp

Filesize
3.9MB

Download
memory/5092-2626-0x00007FF7885F0000-0x00007FF7889E2000-memory.dmp

Filesize
3.9MB

Download
memory/5092-5304-0x00007FF7885F0000-0x00007FF7889E2000-memory.dmp

Filesize
3.9MB

Download
memory/5092-96-0x00007FF7885F0000-0x00007FF7889E2000-memory.dmp

Filesize
3.9MB

Download