xmrig | 7fd13ab54a8b056db8b22717ce0df5f194673afbb6bcb0f744699a266975f49b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 00:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
Size

1.9MB
MD5

02078c765028b3783d2e65ad6b0b6d4b
SHA1

098b5ae6dccbcb2555bb3250a6353217a47d4ae4
SHA256

7fd13ab54a8b056db8b22717ce0df5f194673afbb6bcb0f744699a266975f49b
SHA512

976e1a28e317cf20f437e91875a65dfe7b393c235b9723a1d0aaf8a8f5ce9fe157153aa39c88ef251299835554e074265f8bbf2ebeb5a62196946642db6cbcd7
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Uj4:NAB9

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 31 IoCs

miner

resource	yara_rule
behavioral2/memory/1420-235-0x00007FF6769F0000-0x00007FF676DE2000-memory.dmp	xmrig
behavioral2/memory/4300-245-0x00007FF76A700000-0x00007FF76AAF2000-memory.dmp	xmrig
behavioral2/memory/3340-250-0x00007FF74F540000-0x00007FF74F932000-memory.dmp	xmrig
behavioral2/memory/3464-249-0x00007FF78AB20000-0x00007FF78AF12000-memory.dmp	xmrig
behavioral2/memory/4992-248-0x00007FF663E70000-0x00007FF664262000-memory.dmp	xmrig
behavioral2/memory/3764-247-0x00007FF63F5B0000-0x00007FF63F9A2000-memory.dmp	xmrig
behavioral2/memory/4500-244-0x00007FF702C30000-0x00007FF703022000-memory.dmp	xmrig
behavioral2/memory/2144-243-0x00007FF7E12C0000-0x00007FF7E16B2000-memory.dmp	xmrig
behavioral2/memory/752-242-0x00007FF7918F0000-0x00007FF791CE2000-memory.dmp	xmrig
behavioral2/memory/3668-241-0x00007FF73E890000-0x00007FF73EC82000-memory.dmp	xmrig
behavioral2/memory/1972-240-0x00007FF726FF0000-0x00007FF7273E2000-memory.dmp	xmrig
behavioral2/memory/4704-239-0x00007FF7AFA00000-0x00007FF7AFDF2000-memory.dmp	xmrig
behavioral2/memory/3628-208-0x00007FF65B540000-0x00007FF65B932000-memory.dmp	xmrig
behavioral2/memory/5076-169-0x00007FF615A20000-0x00007FF615E12000-memory.dmp	xmrig
behavioral2/memory/4584-147-0x00007FF6E8500000-0x00007FF6E88F2000-memory.dmp	xmrig
behavioral2/memory/940-121-0x00007FF7B48E0000-0x00007FF7B4CD2000-memory.dmp	xmrig
behavioral2/memory/4488-92-0x00007FF61BF00000-0x00007FF61C2F2000-memory.dmp	xmrig
behavioral2/memory/4324-66-0x00007FF71AC10000-0x00007FF71B002000-memory.dmp	xmrig
behavioral2/memory/2332-63-0x00007FF6D6B70000-0x00007FF6D6F62000-memory.dmp	xmrig
behavioral2/memory/4584-4390-0x00007FF6E8500000-0x00007FF6E88F2000-memory.dmp	xmrig
behavioral2/memory/4704-4444-0x00007FF7AFA00000-0x00007FF7AFDF2000-memory.dmp	xmrig
behavioral2/memory/1420-4441-0x00007FF6769F0000-0x00007FF676DE2000-memory.dmp	xmrig
behavioral2/memory/3464-4463-0x00007FF78AB20000-0x00007FF78AF12000-memory.dmp	xmrig
behavioral2/memory/5076-4460-0x00007FF615A20000-0x00007FF615E12000-memory.dmp	xmrig
behavioral2/memory/1972-4454-0x00007FF726FF0000-0x00007FF7273E2000-memory.dmp	xmrig
behavioral2/memory/3628-4428-0x00007FF65B540000-0x00007FF65B932000-memory.dmp	xmrig
behavioral2/memory/4488-4418-0x00007FF61BF00000-0x00007FF61C2F2000-memory.dmp	xmrig
behavioral2/memory/2144-4562-0x00007FF7E12C0000-0x00007FF7E16B2000-memory.dmp	xmrig
behavioral2/memory/752-4577-0x00007FF7918F0000-0x00007FF791CE2000-memory.dmp	xmrig
behavioral2/memory/4300-4535-0x00007FF76A700000-0x00007FF76AAF2000-memory.dmp	xmrig
behavioral2/memory/4500-4473-0x00007FF702C30000-0x00007FF703022000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1436	AhOjuHq.exe
3764	rcQiYuv.exe
2332	WmwgRpq.exe
4324	zCLtWla.exe
4488	IfedBQr.exe
940	zYAwySV.exe
4584	lKvTIPA.exe
5076	mZPLTzg.exe
3628	PMVxyTD.exe
1420	edulxJD.exe
4992	bxboPyz.exe
4704	fcGZghI.exe
3464	XopXLiL.exe
1972	dbynkKU.exe
3668	cyWSxtX.exe
752	TqEtmmt.exe
2144	CDwylfW.exe
3340	HShecqo.exe
4500	XGlgoXj.exe
4300	kSWtcwZ.exe
1944	ZMXZWUC.exe
2908	frsNlTv.exe
4412	dOaBKXS.exe
4316	VTPsUJZ.exe
552	zuKSXnk.exe
3204	JkZxiER.exe
3504	DoyIqWM.exe
3004	POfmdLS.exe
1872	xyTHGUh.exe
3392	DdUniin.exe
2192	PlYjcvb.exe
2488	Onvmzpl.exe
1588	puzVdIq.exe
4888	hbnxyxq.exe
1988	xiKdAos.exe
3168	hZvRLEY.exe
816	RCRYlzS.exe
4800	kluWlxl.exe
1632	fRtgPhw.exe
1172	TMrFzUu.exe
1368	evlRBYC.exe
4708	UdpSrdA.exe
4184	kQLnRdC.exe
4544	vcklzXx.exe
4880	OhfvGHo.exe
4156	sIVsodW.exe
3932	Elxjyhh.exe
4548	HxUDCoV.exe
4392	EewhDed.exe
4424	LIMOzdk.exe
920	ZmULtLi.exe
4244	IgjMxDE.exe
4252	KqgkMXj.exe
3968	FROGTRQ.exe
4372	eftAbYF.exe
1456	ulWHWOK.exe
5032	OpGqWxf.exe
964	uUcieLa.exe
2040	bZLbJzw.exe
3580	lKGdfyn.exe
1596	btGcSBy.exe
3076	OBleoIC.exe
4552	geyBMqI.exe
4212	mUPwyPX.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1912-0-0x00007FF662CB0000-0x00007FF6630A2000-memory.dmp	upx
behavioral2/files/0x000b000000023ba1-5.dat	upx
behavioral2/files/0x000a000000023ba6-7.dat	upx
behavioral2/files/0x000a000000023ba5-11.dat	upx
behavioral2/files/0x000a000000023ba8-22.dat	upx
behavioral2/memory/1436-10-0x00007FF758A40000-0x00007FF758E32000-memory.dmp	upx
behavioral2/files/0x000a000000023ba7-17.dat	upx
behavioral2/files/0x000a000000023bad-45.dat	upx
behavioral2/files/0x000a000000023bac-74.dat	upx
behavioral2/files/0x000a000000023bb9-110.dat	upx
behavioral2/files/0x000a000000023bc4-184.dat	upx
behavioral2/files/0x0031000000023bb7-183.dat	upx
behavioral2/files/0x000a000000023bc7-200.dat	upx
behavioral2/memory/1420-235-0x00007FF6769F0000-0x00007FF676DE2000-memory.dmp	upx
behavioral2/memory/4300-245-0x00007FF76A700000-0x00007FF76AAF2000-memory.dmp	upx
behavioral2/memory/3340-250-0x00007FF74F540000-0x00007FF74F932000-memory.dmp	upx
behavioral2/memory/3464-249-0x00007FF78AB20000-0x00007FF78AF12000-memory.dmp	upx
behavioral2/memory/4992-248-0x00007FF663E70000-0x00007FF664262000-memory.dmp	upx
behavioral2/memory/3764-247-0x00007FF63F5B0000-0x00007FF63F9A2000-memory.dmp	upx
behavioral2/memory/1944-246-0x00007FF640080000-0x00007FF640472000-memory.dmp	upx
behavioral2/memory/4500-244-0x00007FF702C30000-0x00007FF703022000-memory.dmp	upx
behavioral2/memory/2144-243-0x00007FF7E12C0000-0x00007FF7E16B2000-memory.dmp	upx
behavioral2/memory/752-242-0x00007FF7918F0000-0x00007FF791CE2000-memory.dmp	upx
behavioral2/memory/3668-241-0x00007FF73E890000-0x00007FF73EC82000-memory.dmp	upx
behavioral2/memory/1972-240-0x00007FF726FF0000-0x00007FF7273E2000-memory.dmp	upx
behavioral2/memory/4704-239-0x00007FF7AFA00000-0x00007FF7AFDF2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb4-199.dat	upx
behavioral2/files/0x000a000000023bba-192.dat	upx
behavioral2/files/0x000a000000023bc6-188.dat	upx
behavioral2/files/0x000a000000023bc0-187.dat	upx
behavioral2/files/0x000a000000023bc5-186.dat	upx
behavioral2/files/0x000b000000023ba2-185.dat	upx
behavioral2/files/0x000a000000023bbf-176.dat	upx
behavioral2/files/0x000a000000023bbe-175.dat	upx
behavioral2/files/0x000a000000023bc3-173.dat	upx
behavioral2/files/0x000a000000023bbd-170.dat	upx
behavioral2/memory/3628-208-0x00007FF65B540000-0x00007FF65B932000-memory.dmp	upx
behavioral2/memory/5076-169-0x00007FF615A20000-0x00007FF615E12000-memory.dmp	upx
behavioral2/files/0x000a000000023bbc-153.dat	upx
behavioral2/files/0x000a000000023bc2-151.dat	upx
behavioral2/files/0x000a000000023bb3-149.dat	upx
behavioral2/memory/4584-147-0x00007FF6E8500000-0x00007FF6E88F2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc1-146.dat	upx
behavioral2/files/0x000a000000023bb2-144.dat	upx
behavioral2/files/0x000a000000023bb5-125.dat	upx
behavioral2/memory/940-121-0x00007FF7B48E0000-0x00007FF7B4CD2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb0-119.dat	upx
behavioral2/files/0x000a000000023bbb-118.dat	upx
behavioral2/files/0x000a000000023bb1-113.dat	upx
behavioral2/files/0x0031000000023bb8-109.dat	upx
behavioral2/files/0x0031000000023bb6-106.dat	upx
behavioral2/files/0x000a000000023bab-99.dat	upx
behavioral2/files/0x000a000000023bae-95.dat	upx
behavioral2/memory/4488-92-0x00007FF61BF00000-0x00007FF61C2F2000-memory.dmp	upx
behavioral2/memory/4324-66-0x00007FF71AC10000-0x00007FF71B002000-memory.dmp	upx
behavioral2/memory/2332-63-0x00007FF6D6B70000-0x00007FF6D6F62000-memory.dmp	upx
behavioral2/files/0x000a000000023baf-84.dat	upx
behavioral2/files/0x000a000000023ba9-49.dat	upx
behavioral2/files/0x000a000000023baa-35.dat	upx
behavioral2/memory/4584-4390-0x00007FF6E8500000-0x00007FF6E88F2000-memory.dmp	upx
behavioral2/memory/4704-4444-0x00007FF7AFA00000-0x00007FF7AFDF2000-memory.dmp	upx
behavioral2/memory/1420-4441-0x00007FF6769F0000-0x00007FF676DE2000-memory.dmp	upx
behavioral2/memory/3464-4463-0x00007FF78AB20000-0x00007FF78AF12000-memory.dmp	upx
behavioral2/memory/5076-4460-0x00007FF615A20000-0x00007FF615E12000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DoSuzJl.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\iopXBZv.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\YufhMvq.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\BatoWyU.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\ottIfqz.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\jRIHapk.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\nXDMhzk.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\znNcdgA.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\KPtOveN.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\YTCmphy.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\xuAfllG.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\GCrAZLY.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\NpwUDeM.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\ozEneLg.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\kYOloEJ.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\ghhGKCU.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\OIExBTO.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\CnyVZxM.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\cLRcZha.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\IAcLYvv.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\aCgvQPy.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\kzHNabm.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\GpeUJHX.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\PDybNmX.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\qWJrRNN.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\Lxbmylq.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\QArQmTF.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\kxenJIf.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\wxVzPCI.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\ZmpGaxK.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\aCTWJcs.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\EThrLAC.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\HYDKBrm.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\ljWmdHy.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\FpBvzIp.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\cfZaJna.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\fguOeHf.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\nZLvwPZ.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\sbZhunB.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\CphWomu.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\JSJwioD.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\ZpVPVON.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\LqGyFtv.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\zRiYjrp.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\VOXNajl.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\eukEAFw.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\xAzEycq.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\ytjgGpK.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\gKCvEpW.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\LAQXBzQ.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\RSgsrDk.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\cEWIKjL.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\zNeUCkc.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\EfcaXFz.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\zZNnVHw.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\cTgCuoS.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\JTzOmXz.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\WPkjJOI.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\ODcTLRp.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\BuqFyTu.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\xLjoiYv.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\vFNGRWb.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\jbkpCGU.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
File created	C:\Windows\System\FULNpAP.exe	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
556	powershell.exe
556	powershell.exe
556	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
Token: SeDebugPrivilege	556	powershell.exe
Token: SeLockMemoryPrivilege	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 556	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	87
PID 1912 wrote to memory of 556	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	87
PID 1912 wrote to memory of 1436	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	88
PID 1912 wrote to memory of 1436	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	88
PID 1912 wrote to memory of 3764	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	89
PID 1912 wrote to memory of 3764	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	89
PID 1912 wrote to memory of 2332	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	90
PID 1912 wrote to memory of 2332	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	90
PID 1912 wrote to memory of 4324	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	91
PID 1912 wrote to memory of 4324	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	91
PID 1912 wrote to memory of 4488	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	92
PID 1912 wrote to memory of 4488	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	92
PID 1912 wrote to memory of 940	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	93
PID 1912 wrote to memory of 940	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	93
PID 1912 wrote to memory of 4584	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	94
PID 1912 wrote to memory of 4584	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	94
PID 1912 wrote to memory of 5076	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	95
PID 1912 wrote to memory of 5076	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	95
PID 1912 wrote to memory of 3628	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	96
PID 1912 wrote to memory of 3628	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	96
PID 1912 wrote to memory of 1420	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	97
PID 1912 wrote to memory of 1420	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	97
PID 1912 wrote to memory of 4992	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	98
PID 1912 wrote to memory of 4992	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	98
PID 1912 wrote to memory of 4704	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	99
PID 1912 wrote to memory of 4704	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	99
PID 1912 wrote to memory of 3464	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	100
PID 1912 wrote to memory of 3464	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	100
PID 1912 wrote to memory of 1972	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	101
PID 1912 wrote to memory of 1972	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	101
PID 1912 wrote to memory of 3668	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	102
PID 1912 wrote to memory of 3668	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	102
PID 1912 wrote to memory of 752	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	103
PID 1912 wrote to memory of 752	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	103
PID 1912 wrote to memory of 2144	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	104
PID 1912 wrote to memory of 2144	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	104
PID 1912 wrote to memory of 3340	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	105
PID 1912 wrote to memory of 3340	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	105
PID 1912 wrote to memory of 4500	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	106
PID 1912 wrote to memory of 4500	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	106
PID 1912 wrote to memory of 4300	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	107
PID 1912 wrote to memory of 4300	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	107
PID 1912 wrote to memory of 1944	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	108
PID 1912 wrote to memory of 1944	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	108
PID 1912 wrote to memory of 2908	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	109
PID 1912 wrote to memory of 2908	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	109
PID 1912 wrote to memory of 4412	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	110
PID 1912 wrote to memory of 4412	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	110
PID 1912 wrote to memory of 4316	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	111
PID 1912 wrote to memory of 4316	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	111
PID 1912 wrote to memory of 552	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	112
PID 1912 wrote to memory of 552	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	112
PID 1912 wrote to memory of 3204	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	113
PID 1912 wrote to memory of 3204	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	113
PID 1912 wrote to memory of 3504	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	114
PID 1912 wrote to memory of 3504	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	114
PID 1912 wrote to memory of 3004	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	115
PID 1912 wrote to memory of 3004	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	115
PID 1912 wrote to memory of 1872	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	116
PID 1912 wrote to memory of 1872	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	116
PID 1912 wrote to memory of 3392	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	117
PID 1912 wrote to memory of 3392	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	117
PID 1912 wrote to memory of 2192	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	118
PID 1912 wrote to memory of 2192	1912	02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe	118

C:\Users\Admin\AppData\Local\Temp\02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02078c765028b3783d2e65ad6b0b6d4b_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:556
- C:\Windows\System\AhOjuHq.exe
  C:\Windows\System\AhOjuHq.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\rcQiYuv.exe
  C:\Windows\System\rcQiYuv.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\WmwgRpq.exe
  C:\Windows\System\WmwgRpq.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\zCLtWla.exe
  C:\Windows\System\zCLtWla.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\IfedBQr.exe
  C:\Windows\System\IfedBQr.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\zYAwySV.exe
  C:\Windows\System\zYAwySV.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\lKvTIPA.exe
  C:\Windows\System\lKvTIPA.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\mZPLTzg.exe
  C:\Windows\System\mZPLTzg.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\PMVxyTD.exe
  C:\Windows\System\PMVxyTD.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\edulxJD.exe
  C:\Windows\System\edulxJD.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\bxboPyz.exe
  C:\Windows\System\bxboPyz.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\fcGZghI.exe
  C:\Windows\System\fcGZghI.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\XopXLiL.exe
  C:\Windows\System\XopXLiL.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\dbynkKU.exe
  C:\Windows\System\dbynkKU.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\cyWSxtX.exe
  C:\Windows\System\cyWSxtX.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\TqEtmmt.exe
  C:\Windows\System\TqEtmmt.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\CDwylfW.exe
  C:\Windows\System\CDwylfW.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\HShecqo.exe
  C:\Windows\System\HShecqo.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\XGlgoXj.exe
  C:\Windows\System\XGlgoXj.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\kSWtcwZ.exe
  C:\Windows\System\kSWtcwZ.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\ZMXZWUC.exe
  C:\Windows\System\ZMXZWUC.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\frsNlTv.exe
  C:\Windows\System\frsNlTv.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\dOaBKXS.exe
  C:\Windows\System\dOaBKXS.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\VTPsUJZ.exe
  C:\Windows\System\VTPsUJZ.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\zuKSXnk.exe
  C:\Windows\System\zuKSXnk.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\JkZxiER.exe
  C:\Windows\System\JkZxiER.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\DoyIqWM.exe
  C:\Windows\System\DoyIqWM.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\POfmdLS.exe
  C:\Windows\System\POfmdLS.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\xyTHGUh.exe
  C:\Windows\System\xyTHGUh.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\DdUniin.exe
  C:\Windows\System\DdUniin.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\PlYjcvb.exe
  C:\Windows\System\PlYjcvb.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\Onvmzpl.exe
  C:\Windows\System\Onvmzpl.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\puzVdIq.exe
  C:\Windows\System\puzVdIq.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\hbnxyxq.exe
  C:\Windows\System\hbnxyxq.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\xiKdAos.exe
  C:\Windows\System\xiKdAos.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\hZvRLEY.exe
  C:\Windows\System\hZvRLEY.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\RCRYlzS.exe
  C:\Windows\System\RCRYlzS.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\kluWlxl.exe
  C:\Windows\System\kluWlxl.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\fRtgPhw.exe
  C:\Windows\System\fRtgPhw.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\TMrFzUu.exe
  C:\Windows\System\TMrFzUu.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\evlRBYC.exe
  C:\Windows\System\evlRBYC.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\UdpSrdA.exe
  C:\Windows\System\UdpSrdA.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\kQLnRdC.exe
  C:\Windows\System\kQLnRdC.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\vcklzXx.exe
  C:\Windows\System\vcklzXx.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\OhfvGHo.exe
  C:\Windows\System\OhfvGHo.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\sIVsodW.exe
  C:\Windows\System\sIVsodW.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\Elxjyhh.exe
  C:\Windows\System\Elxjyhh.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\HxUDCoV.exe
  C:\Windows\System\HxUDCoV.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\EewhDed.exe
  C:\Windows\System\EewhDed.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\LIMOzdk.exe
  C:\Windows\System\LIMOzdk.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\ZmULtLi.exe
  C:\Windows\System\ZmULtLi.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\IgjMxDE.exe
  C:\Windows\System\IgjMxDE.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\KqgkMXj.exe
  C:\Windows\System\KqgkMXj.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\FROGTRQ.exe
  C:\Windows\System\FROGTRQ.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\eftAbYF.exe
  C:\Windows\System\eftAbYF.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\ulWHWOK.exe
  C:\Windows\System\ulWHWOK.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\OpGqWxf.exe
  C:\Windows\System\OpGqWxf.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\uUcieLa.exe
  C:\Windows\System\uUcieLa.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\bZLbJzw.exe
  C:\Windows\System\bZLbJzw.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\lKGdfyn.exe
  C:\Windows\System\lKGdfyn.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\btGcSBy.exe
  C:\Windows\System\btGcSBy.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\OBleoIC.exe
  C:\Windows\System\OBleoIC.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\geyBMqI.exe
  C:\Windows\System\geyBMqI.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\mUPwyPX.exe
  C:\Windows\System\mUPwyPX.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\OUsqYHi.exe
  C:\Windows\System\OUsqYHi.exe
  2⤵
  PID:2292
- C:\Windows\System\xYbLzev.exe
  C:\Windows\System\xYbLzev.exe
  2⤵
  PID:3396
- C:\Windows\System\uVsYiMc.exe
  C:\Windows\System\uVsYiMc.exe
  2⤵
  PID:724
- C:\Windows\System\aBbNLRG.exe
  C:\Windows\System\aBbNLRG.exe
  2⤵
  PID:5140
- C:\Windows\System\MDEofua.exe
  C:\Windows\System\MDEofua.exe
  2⤵
  PID:5156
- C:\Windows\System\oOglUeP.exe
  C:\Windows\System\oOglUeP.exe
  2⤵
  PID:5172
- C:\Windows\System\qzSkdlU.exe
  C:\Windows\System\qzSkdlU.exe
  2⤵
  PID:5400
- C:\Windows\System\lfYPUhS.exe
  C:\Windows\System\lfYPUhS.exe
  2⤵
  PID:5420
- C:\Windows\System\wfyvQdy.exe
  C:\Windows\System\wfyvQdy.exe
  2⤵
  PID:5436
- C:\Windows\System\poxzSzP.exe
  C:\Windows\System\poxzSzP.exe
  2⤵
  PID:5456
- C:\Windows\System\ONMVJHK.exe
  C:\Windows\System\ONMVJHK.exe
  2⤵
  PID:5476
- C:\Windows\System\NjKncmF.exe
  C:\Windows\System\NjKncmF.exe
  2⤵
  PID:5500
- C:\Windows\System\NtbyxFm.exe
  C:\Windows\System\NtbyxFm.exe
  2⤵
  PID:5524
- C:\Windows\System\DjUKFbZ.exe
  C:\Windows\System\DjUKFbZ.exe
  2⤵
  PID:5552
- C:\Windows\System\tRiPpes.exe
  C:\Windows\System\tRiPpes.exe
  2⤵
  PID:5584
- C:\Windows\System\TrUIeYD.exe
  C:\Windows\System\TrUIeYD.exe
  2⤵
  PID:5616
- C:\Windows\System\zXuCmuD.exe
  C:\Windows\System\zXuCmuD.exe
  2⤵
  PID:5644
- C:\Windows\System\lribAPy.exe
  C:\Windows\System\lribAPy.exe
  2⤵
  PID:5668
- C:\Windows\System\RrtWYyd.exe
  C:\Windows\System\RrtWYyd.exe
  2⤵
  PID:5700
- C:\Windows\System\tglkTiJ.exe
  C:\Windows\System\tglkTiJ.exe
  2⤵
  PID:5724
- C:\Windows\System\orxnTUm.exe
  C:\Windows\System\orxnTUm.exe
  2⤵
  PID:5756
- C:\Windows\System\sZKgnzj.exe
  C:\Windows\System\sZKgnzj.exe
  2⤵
  PID:5776
- C:\Windows\System\XOGkQic.exe
  C:\Windows\System\XOGkQic.exe
  2⤵
  PID:5820
- C:\Windows\System\FMeYLJx.exe
  C:\Windows\System\FMeYLJx.exe
  2⤵
  PID:5848
- C:\Windows\System\wzxVjoZ.exe
  C:\Windows\System\wzxVjoZ.exe
  2⤵
  PID:5864
- C:\Windows\System\FLDMVhX.exe
  C:\Windows\System\FLDMVhX.exe
  2⤵
  PID:5892
- C:\Windows\System\nRqeeie.exe
  C:\Windows\System\nRqeeie.exe
  2⤵
  PID:5916
- C:\Windows\System\mrGKiZq.exe
  C:\Windows\System\mrGKiZq.exe
  2⤵
  PID:5944
- C:\Windows\System\PaTWgyp.exe
  C:\Windows\System\PaTWgyp.exe
  2⤵
  PID:5968
- C:\Windows\System\OswdIXF.exe
  C:\Windows\System\OswdIXF.exe
  2⤵
  PID:5992
- C:\Windows\System\MKApLAN.exe
  C:\Windows\System\MKApLAN.exe
  2⤵
  PID:6016
- C:\Windows\System\lKPcDlc.exe
  C:\Windows\System\lKPcDlc.exe
  2⤵
  PID:6040
- C:\Windows\System\ElRktdG.exe
  C:\Windows\System\ElRktdG.exe
  2⤵
  PID:6084
- C:\Windows\System\hUkjkzw.exe
  C:\Windows\System\hUkjkzw.exe
  2⤵
  PID:6104
- C:\Windows\System\fnPfxps.exe
  C:\Windows\System\fnPfxps.exe
  2⤵
  PID:6124
- C:\Windows\System\tJHmSxl.exe
  C:\Windows\System\tJHmSxl.exe
  2⤵
  PID:4248
- C:\Windows\System\StqGkWt.exe
  C:\Windows\System\StqGkWt.exe
  2⤵
  PID:1532
- C:\Windows\System\WXzElGM.exe
  C:\Windows\System\WXzElGM.exe
  2⤵
  PID:3992
- C:\Windows\System\wseXMXr.exe
  C:\Windows\System\wseXMXr.exe
  2⤵
  PID:4536
- C:\Windows\System\datikIq.exe
  C:\Windows\System\datikIq.exe
  2⤵
  PID:4856
- C:\Windows\System\NkkRwML.exe
  C:\Windows\System\NkkRwML.exe
  2⤵
  PID:4864
- C:\Windows\System\DGTwyDv.exe
  C:\Windows\System\DGTwyDv.exe
  2⤵
  PID:4804
- C:\Windows\System\HYbAYSd.exe
  C:\Windows\System\HYbAYSd.exe
  2⤵
  PID:4160
- C:\Windows\System\heftbfN.exe
  C:\Windows\System\heftbfN.exe
  2⤵
  PID:3164
- C:\Windows\System\SbCjTlp.exe
  C:\Windows\System\SbCjTlp.exe
  2⤵
  PID:1008
- C:\Windows\System\uzVJRYp.exe
  C:\Windows\System\uzVJRYp.exe
  2⤵
  PID:5124
- C:\Windows\System\zMhFMUO.exe
  C:\Windows\System\zMhFMUO.exe
  2⤵
  PID:5152
- C:\Windows\System\nITtvnP.exe
  C:\Windows\System\nITtvnP.exe
  2⤵
  PID:5236
- C:\Windows\System\XKXmjXH.exe
  C:\Windows\System\XKXmjXH.exe
  2⤵
  PID:5268
- C:\Windows\System\gSGQiwH.exe
  C:\Windows\System\gSGQiwH.exe
  2⤵
  PID:3364
- C:\Windows\System\qoYiBEm.exe
  C:\Windows\System\qoYiBEm.exe
  2⤵
  PID:2596
- C:\Windows\System\iitoaSk.exe
  C:\Windows\System\iitoaSk.exe
  2⤵
  PID:2284
- C:\Windows\System\eMFNvfH.exe
  C:\Windows\System\eMFNvfH.exe
  2⤵
  PID:4624
- C:\Windows\System\HgjFLhw.exe
  C:\Windows\System\HgjFLhw.exe
  2⤵
  PID:4044
- C:\Windows\System\bJIBxaW.exe
  C:\Windows\System\bJIBxaW.exe
  2⤵
  PID:3400
- C:\Windows\System\vrRIXRd.exe
  C:\Windows\System\vrRIXRd.exe
  2⤵
  PID:3644
- C:\Windows\System\rdCAeGj.exe
  C:\Windows\System\rdCAeGj.exe
  2⤵
  PID:2008
- C:\Windows\System\yStdTkk.exe
  C:\Windows\System\yStdTkk.exe
  2⤵
  PID:5068
- C:\Windows\System\DdyEXDq.exe
  C:\Windows\System\DdyEXDq.exe
  2⤵
  PID:3460
- C:\Windows\System\wNackPO.exe
  C:\Windows\System\wNackPO.exe
  2⤵
  PID:5008
- C:\Windows\System\vmChXFQ.exe
  C:\Windows\System\vmChXFQ.exe
  2⤵
  PID:2916
- C:\Windows\System\IOXKCYQ.exe
  C:\Windows\System\IOXKCYQ.exe
  2⤵
  PID:4780
- C:\Windows\System\zKXICMr.exe
  C:\Windows\System\zKXICMr.exe
  2⤵
  PID:4696
- C:\Windows\System\JyaSrvd.exe
  C:\Windows\System\JyaSrvd.exe
  2⤵
  PID:2476
- C:\Windows\System\WvGSOdz.exe
  C:\Windows\System\WvGSOdz.exe
  2⤵
  PID:4836
- C:\Windows\System\AjAfwhu.exe
  C:\Windows\System\AjAfwhu.exe
  2⤵
  PID:5396
- C:\Windows\System\HLaIjnl.exe
  C:\Windows\System\HLaIjnl.exe
  2⤵
  PID:5468
- C:\Windows\System\TEaOQoc.exe
  C:\Windows\System\TEaOQoc.exe
  2⤵
  PID:5508
- C:\Windows\System\dhXCMxc.exe
  C:\Windows\System\dhXCMxc.exe
  2⤵
  PID:5516
- C:\Windows\System\PDxItkq.exe
  C:\Windows\System\PDxItkq.exe
  2⤵
  PID:5568
- C:\Windows\System\epoVSGF.exe
  C:\Windows\System\epoVSGF.exe
  2⤵
  PID:5656
- C:\Windows\System\BCbSxbh.exe
  C:\Windows\System\BCbSxbh.exe
  2⤵
  PID:5680
- C:\Windows\System\fKrFHQa.exe
  C:\Windows\System\fKrFHQa.exe
  2⤵
  PID:5828
- C:\Windows\System\VgGRjpm.exe
  C:\Windows\System\VgGRjpm.exe
  2⤵
  PID:5736
- C:\Windows\System\lYShisd.exe
  C:\Windows\System\lYShisd.exe
  2⤵
  PID:5856
- C:\Windows\System\XnuTUiY.exe
  C:\Windows\System\XnuTUiY.exe
  2⤵
  PID:5884
- C:\Windows\System\Lnawxas.exe
  C:\Windows\System\Lnawxas.exe
  2⤵
  PID:6024
- C:\Windows\System\EULyeFH.exe
  C:\Windows\System\EULyeFH.exe
  2⤵
  PID:5960
- C:\Windows\System\GldxFST.exe
  C:\Windows\System\GldxFST.exe
  2⤵
  PID:6120
- C:\Windows\System\vxuuFXg.exe
  C:\Windows\System\vxuuFXg.exe
  2⤵
  PID:1656
- C:\Windows\System\kvhfFct.exe
  C:\Windows\System\kvhfFct.exe
  2⤵
  PID:1232
- C:\Windows\System\cJhHmtP.exe
  C:\Windows\System\cJhHmtP.exe
  2⤵
  PID:5040
- C:\Windows\System\gKCvEpW.exe
  C:\Windows\System\gKCvEpW.exe
  2⤵
  PID:4312
- C:\Windows\System\ASbpjim.exe
  C:\Windows\System\ASbpjim.exe
  2⤵
  PID:4772
- C:\Windows\System\solzsAl.exe
  C:\Windows\System\solzsAl.exe
  2⤵
  PID:5168
- C:\Windows\System\HgDMtIw.exe
  C:\Windows\System\HgDMtIw.exe
  2⤵
  PID:824
- C:\Windows\System\HNOcXOo.exe
  C:\Windows\System\HNOcXOo.exe
  2⤵
  PID:4284
- C:\Windows\System\tDSLApW.exe
  C:\Windows\System\tDSLApW.exe
  2⤵
  PID:988
- C:\Windows\System\sZDuHQo.exe
  C:\Windows\System\sZDuHQo.exe
  2⤵
  PID:2112
- C:\Windows\System\GzajcyZ.exe
  C:\Windows\System\GzajcyZ.exe
  2⤵
  PID:656
- C:\Windows\System\fIbjYeP.exe
  C:\Windows\System\fIbjYeP.exe
  2⤵
  PID:5492
- C:\Windows\System\AdUsvlr.exe
  C:\Windows\System\AdUsvlr.exe
  2⤵
  PID:1076
- C:\Windows\System\hnjgZQW.exe
  C:\Windows\System\hnjgZQW.exe
  2⤵
  PID:5880
- C:\Windows\System\bbZLTKu.exe
  C:\Windows\System\bbZLTKu.exe
  2⤵
  PID:5600
- C:\Windows\System\MPJskzB.exe
  C:\Windows\System\MPJskzB.exe
  2⤵
  PID:3780
- C:\Windows\System\QTVhxFL.exe
  C:\Windows\System\QTVhxFL.exe
  2⤵
  PID:3104
- C:\Windows\System\GYeVWoQ.exe
  C:\Windows\System\GYeVWoQ.exe
  2⤵
  PID:5472
- C:\Windows\System\iUKlVUV.exe
  C:\Windows\System\iUKlVUV.exe
  2⤵
  PID:4336
- C:\Windows\System\zmdQNuL.exe
  C:\Windows\System\zmdQNuL.exe
  2⤵
  PID:5596
- C:\Windows\System\sIWvOJM.exe
  C:\Windows\System\sIWvOJM.exe
  2⤵
  PID:4484
- C:\Windows\System\bPkcmlL.exe
  C:\Windows\System\bPkcmlL.exe
  2⤵
  PID:1084
- C:\Windows\System\mIbIllt.exe
  C:\Windows\System\mIbIllt.exe
  2⤵
  PID:6164
- C:\Windows\System\rkuTuKH.exe
  C:\Windows\System\rkuTuKH.exe
  2⤵
  PID:6188
- C:\Windows\System\HzkDQFm.exe
  C:\Windows\System\HzkDQFm.exe
  2⤵
  PID:6204
- C:\Windows\System\UpKSfzD.exe
  C:\Windows\System\UpKSfzD.exe
  2⤵
  PID:6228
- C:\Windows\System\zROygFW.exe
  C:\Windows\System\zROygFW.exe
  2⤵
  PID:6244
- C:\Windows\System\ulFcbfw.exe
  C:\Windows\System\ulFcbfw.exe
  2⤵
  PID:6264
- C:\Windows\System\SnVvXqv.exe
  C:\Windows\System\SnVvXqv.exe
  2⤵
  PID:6296
- C:\Windows\System\qOaPDTd.exe
  C:\Windows\System\qOaPDTd.exe
  2⤵
  PID:6312
- C:\Windows\System\yCaEfeW.exe
  C:\Windows\System\yCaEfeW.exe
  2⤵
  PID:6336
- C:\Windows\System\FoozDlm.exe
  C:\Windows\System\FoozDlm.exe
  2⤵
  PID:6360
- C:\Windows\System\MqPbEJI.exe
  C:\Windows\System\MqPbEJI.exe
  2⤵
  PID:6376
- C:\Windows\System\FeFfYJu.exe
  C:\Windows\System\FeFfYJu.exe
  2⤵
  PID:6404
- C:\Windows\System\ldaGPUy.exe
  C:\Windows\System\ldaGPUy.exe
  2⤵
  PID:6420
- C:\Windows\System\sBWtElt.exe
  C:\Windows\System\sBWtElt.exe
  2⤵
  PID:6452
- C:\Windows\System\eprRMnC.exe
  C:\Windows\System\eprRMnC.exe
  2⤵
  PID:6480
- C:\Windows\System\aoLhhjl.exe
  C:\Windows\System\aoLhhjl.exe
  2⤵
  PID:6500
- C:\Windows\System\TPoVPAu.exe
  C:\Windows\System\TPoVPAu.exe
  2⤵
  PID:6524
- C:\Windows\System\rCqYMqQ.exe
  C:\Windows\System\rCqYMqQ.exe
  2⤵
  PID:6544
- C:\Windows\System\izmwEXP.exe
  C:\Windows\System\izmwEXP.exe
  2⤵
  PID:6576
- C:\Windows\System\ecvvysw.exe
  C:\Windows\System\ecvvysw.exe
  2⤵
  PID:6596
- C:\Windows\System\MWajXVa.exe
  C:\Windows\System\MWajXVa.exe
  2⤵
  PID:6616
- C:\Windows\System\wjplzPD.exe
  C:\Windows\System\wjplzPD.exe
  2⤵
  PID:6640
- C:\Windows\System\NZWgGvW.exe
  C:\Windows\System\NZWgGvW.exe
  2⤵
  PID:6660
- C:\Windows\System\kRrEYxC.exe
  C:\Windows\System\kRrEYxC.exe
  2⤵
  PID:6688
- C:\Windows\System\NnNvtqj.exe
  C:\Windows\System\NnNvtqj.exe
  2⤵
  PID:6712
- C:\Windows\System\sLjQplM.exe
  C:\Windows\System\sLjQplM.exe
  2⤵
  PID:6736
- C:\Windows\System\FWPezWk.exe
  C:\Windows\System\FWPezWk.exe
  2⤵
  PID:6756
- C:\Windows\System\VWzolht.exe
  C:\Windows\System\VWzolht.exe
  2⤵
  PID:6780
- C:\Windows\System\EgresUZ.exe
  C:\Windows\System\EgresUZ.exe
  2⤵
  PID:6800
- C:\Windows\System\pDVaSOi.exe
  C:\Windows\System\pDVaSOi.exe
  2⤵
  PID:6824
- C:\Windows\System\LYVJvsU.exe
  C:\Windows\System\LYVJvsU.exe
  2⤵
  PID:6840
- C:\Windows\System\SOMfTgm.exe
  C:\Windows\System\SOMfTgm.exe
  2⤵
  PID:6864
- C:\Windows\System\RRlkMgv.exe
  C:\Windows\System\RRlkMgv.exe
  2⤵
  PID:6884
- C:\Windows\System\RuucYAI.exe
  C:\Windows\System\RuucYAI.exe
  2⤵
  PID:6904
- C:\Windows\System\aQoUAiT.exe
  C:\Windows\System\aQoUAiT.exe
  2⤵
  PID:6932
- C:\Windows\System\sNXdjBo.exe
  C:\Windows\System\sNXdjBo.exe
  2⤵
  PID:6948
- C:\Windows\System\KawiCXw.exe
  C:\Windows\System\KawiCXw.exe
  2⤵
  PID:6972
- C:\Windows\System\dgfxmGP.exe
  C:\Windows\System\dgfxmGP.exe
  2⤵
  PID:6992
- C:\Windows\System\LCCDgDl.exe
  C:\Windows\System\LCCDgDl.exe
  2⤵
  PID:7020
- C:\Windows\System\tzbRACy.exe
  C:\Windows\System\tzbRACy.exe
  2⤵
  PID:7036
- C:\Windows\System\sGJLhWS.exe
  C:\Windows\System\sGJLhWS.exe
  2⤵
  PID:7056
- C:\Windows\System\RpdkuQv.exe
  C:\Windows\System\RpdkuQv.exe
  2⤵
  PID:7080
- C:\Windows\System\omugLue.exe
  C:\Windows\System\omugLue.exe
  2⤵
  PID:7096
- C:\Windows\System\GHXOYPZ.exe
  C:\Windows\System\GHXOYPZ.exe
  2⤵
  PID:7120
- C:\Windows\System\MNtiSCA.exe
  C:\Windows\System\MNtiSCA.exe
  2⤵
  PID:7148
- C:\Windows\System\wYxHFcr.exe
  C:\Windows\System\wYxHFcr.exe
  2⤵
  PID:3832
- C:\Windows\System\FpBvzIp.exe
  C:\Windows\System\FpBvzIp.exe
  2⤵
  PID:5748
- C:\Windows\System\cjzreYs.exe
  C:\Windows\System\cjzreYs.exe
  2⤵
  PID:5544
- C:\Windows\System\EfYxvgK.exe
  C:\Windows\System\EfYxvgK.exe
  2⤵
  PID:5428
- C:\Windows\System\OZSdSKl.exe
  C:\Windows\System\OZSdSKl.exe
  2⤵
  PID:6048
- C:\Windows\System\mNQdfKl.exe
  C:\Windows\System\mNQdfKl.exe
  2⤵
  PID:5072
- C:\Windows\System\KuVoUCc.exe
  C:\Windows\System\KuVoUCc.exe
  2⤵
  PID:5684
- C:\Windows\System\jCKEcIT.exe
  C:\Windows\System\jCKEcIT.exe
  2⤵
  PID:728
- C:\Windows\System\QJijmSl.exe
  C:\Windows\System\QJijmSl.exe
  2⤵
  PID:6276
- C:\Windows\System\hKpyNHy.exe
  C:\Windows\System\hKpyNHy.exe
  2⤵
  PID:5928
- C:\Windows\System\QDuFYOa.exe
  C:\Windows\System\QDuFYOa.exe
  2⤵
  PID:6372
- C:\Windows\System\wyxaWfg.exe
  C:\Windows\System\wyxaWfg.exe
  2⤵
  PID:6140
- C:\Windows\System\mPtxBZL.exe
  C:\Windows\System\mPtxBZL.exe
  2⤵
  PID:6536
- C:\Windows\System\wnxxLEV.exe
  C:\Windows\System\wnxxLEV.exe
  2⤵
  PID:6184
- C:\Windows\System\nbzbnpv.exe
  C:\Windows\System\nbzbnpv.exe
  2⤵
  PID:2964
- C:\Windows\System\wiVasmm.exe
  C:\Windows\System\wiVasmm.exe
  2⤵
  PID:6416
- C:\Windows\System\TyGEjDe.exe
  C:\Windows\System\TyGEjDe.exe
  2⤵
  PID:6496
- C:\Windows\System\FAxyXzY.exe
  C:\Windows\System\FAxyXzY.exe
  2⤵
  PID:7180
- C:\Windows\System\kCIQrEk.exe
  C:\Windows\System\kCIQrEk.exe
  2⤵
  PID:7204
- C:\Windows\System\eyPESSz.exe
  C:\Windows\System\eyPESSz.exe
  2⤵
  PID:7224
- C:\Windows\System\IjNZgEc.exe
  C:\Windows\System\IjNZgEc.exe
  2⤵
  PID:7248
- C:\Windows\System\iSufelC.exe
  C:\Windows\System\iSufelC.exe
  2⤵
  PID:7264
- C:\Windows\System\ZzkZzzD.exe
  C:\Windows\System\ZzkZzzD.exe
  2⤵
  PID:7280
- C:\Windows\System\cjTGEDg.exe
  C:\Windows\System\cjTGEDg.exe
  2⤵
  PID:7308
- C:\Windows\System\eFwgAom.exe
  C:\Windows\System\eFwgAom.exe
  2⤵
  PID:7324
- C:\Windows\System\FUqSoTm.exe
  C:\Windows\System\FUqSoTm.exe
  2⤵
  PID:7348
- C:\Windows\System\vnUilZx.exe
  C:\Windows\System\vnUilZx.exe
  2⤵
  PID:7372
- C:\Windows\System\JaaTiNI.exe
  C:\Windows\System\JaaTiNI.exe
  2⤵
  PID:7388
- C:\Windows\System\xonniwb.exe
  C:\Windows\System\xonniwb.exe
  2⤵
  PID:7416
- C:\Windows\System\xGJMqct.exe
  C:\Windows\System\xGJMqct.exe
  2⤵
  PID:7440
- C:\Windows\System\VSPvNWH.exe
  C:\Windows\System\VSPvNWH.exe
  2⤵
  PID:7456
- C:\Windows\System\raveXkV.exe
  C:\Windows\System\raveXkV.exe
  2⤵
  PID:7480
- C:\Windows\System\aziPxHk.exe
  C:\Windows\System\aziPxHk.exe
  2⤵
  PID:7504
- C:\Windows\System\pTxLzWu.exe
  C:\Windows\System\pTxLzWu.exe
  2⤵
  PID:7532
- C:\Windows\System\feEttzc.exe
  C:\Windows\System\feEttzc.exe
  2⤵
  PID:7560
- C:\Windows\System\WSFvAZN.exe
  C:\Windows\System\WSFvAZN.exe
  2⤵
  PID:7580
- C:\Windows\System\pIPMYIs.exe
  C:\Windows\System\pIPMYIs.exe
  2⤵
  PID:7604
- C:\Windows\System\xRdcLqV.exe
  C:\Windows\System\xRdcLqV.exe
  2⤵
  PID:7624
- C:\Windows\System\sTTgTCQ.exe
  C:\Windows\System\sTTgTCQ.exe
  2⤵
  PID:7652
- C:\Windows\System\JMawBmD.exe
  C:\Windows\System\JMawBmD.exe
  2⤵
  PID:7668
- C:\Windows\System\lrXlCsU.exe
  C:\Windows\System\lrXlCsU.exe
  2⤵
  PID:7700
- C:\Windows\System\VIiKAwT.exe
  C:\Windows\System\VIiKAwT.exe
  2⤵
  PID:7716
- C:\Windows\System\NePfuOY.exe
  C:\Windows\System\NePfuOY.exe
  2⤵
  PID:7740
- C:\Windows\System\YkPFJak.exe
  C:\Windows\System\YkPFJak.exe
  2⤵
  PID:7764
- C:\Windows\System\YsXdwAj.exe
  C:\Windows\System\YsXdwAj.exe
  2⤵
  PID:7788
- C:\Windows\System\qlSORiO.exe
  C:\Windows\System\qlSORiO.exe
  2⤵
  PID:7812
- C:\Windows\System\fxzSAvO.exe
  C:\Windows\System\fxzSAvO.exe
  2⤵
  PID:7828
- C:\Windows\System\UvkInwv.exe
  C:\Windows\System\UvkInwv.exe
  2⤵
  PID:7856
- C:\Windows\System\HJCAwWP.exe
  C:\Windows\System\HJCAwWP.exe
  2⤵
  PID:7880
- C:\Windows\System\KnQIWDx.exe
  C:\Windows\System\KnQIWDx.exe
  2⤵
  PID:7900
- C:\Windows\System\wkfHJLP.exe
  C:\Windows\System\wkfHJLP.exe
  2⤵
  PID:7920
- C:\Windows\System\FfEwfyK.exe
  C:\Windows\System\FfEwfyK.exe
  2⤵
  PID:7940
- C:\Windows\System\tswMXBM.exe
  C:\Windows\System\tswMXBM.exe
  2⤵
  PID:7968
- C:\Windows\System\bcWKNEV.exe
  C:\Windows\System\bcWKNEV.exe
  2⤵
  PID:7984
- C:\Windows\System\lprODRM.exe
  C:\Windows\System\lprODRM.exe
  2⤵
  PID:8012
- C:\Windows\System\vPAugiS.exe
  C:\Windows\System\vPAugiS.exe
  2⤵
  PID:8032
- C:\Windows\System\ibcgMjV.exe
  C:\Windows\System\ibcgMjV.exe
  2⤵
  PID:8060
- C:\Windows\System\qNtkhXP.exe
  C:\Windows\System\qNtkhXP.exe
  2⤵
  PID:8080
- C:\Windows\System\BKKmNWM.exe
  C:\Windows\System\BKKmNWM.exe
  2⤵
  PID:8100
- C:\Windows\System\iTjJoZQ.exe
  C:\Windows\System\iTjJoZQ.exe
  2⤵
  PID:8120
- C:\Windows\System\uJHFnRp.exe
  C:\Windows\System\uJHFnRp.exe
  2⤵
  PID:8140
- C:\Windows\System\WFjwDly.exe
  C:\Windows\System\WFjwDly.exe
  2⤵
  PID:8160
- C:\Windows\System\gMIpAZD.exe
  C:\Windows\System\gMIpAZD.exe
  2⤵
  PID:8180
- C:\Windows\System\McnUqAM.exe
  C:\Windows\System\McnUqAM.exe
  2⤵
  PID:6812
- C:\Windows\System\JfRzeQA.exe
  C:\Windows\System\JfRzeQA.exe
  2⤵
  PID:6912
- C:\Windows\System\GEDGYlO.exe
  C:\Windows\System\GEDGYlO.exe
  2⤵
  PID:6320
- C:\Windows\System\NUeKEsm.exe
  C:\Windows\System\NUeKEsm.exe
  2⤵
  PID:7088
- C:\Windows\System\YCEDHGT.exe
  C:\Windows\System\YCEDHGT.exe
  2⤵
  PID:6052
- C:\Windows\System\AIlfeDg.exe
  C:\Windows\System\AIlfeDg.exe
  2⤵
  PID:3292
- C:\Windows\System\bAnCWLB.exe
  C:\Windows\System\bAnCWLB.exe
  2⤵
  PID:5116
- C:\Windows\System\XELLVqL.exe
  C:\Windows\System\XELLVqL.exe
  2⤵
  PID:6396
- C:\Windows\System\eDJBslg.exe
  C:\Windows\System\eDJBslg.exe
  2⤵
  PID:6720
- C:\Windows\System\WparmzS.exe
  C:\Windows\System\WparmzS.exe
  2⤵
  PID:6224
- C:\Windows\System\pfrCDMy.exe
  C:\Windows\System\pfrCDMy.exe
  2⤵
  PID:6556
- C:\Windows\System\bOydWkp.exe
  C:\Windows\System\bOydWkp.exe
  2⤵
  PID:7236
- C:\Windows\System\CVNDWPc.exe
  C:\Windows\System\CVNDWPc.exe
  2⤵
  PID:7304
- C:\Windows\System\IwIeChq.exe
  C:\Windows\System\IwIeChq.exe
  2⤵
  PID:7364
- C:\Windows\System\hMCQXsz.exe
  C:\Windows\System\hMCQXsz.exe
  2⤵
  PID:7424
- C:\Windows\System\ebQKNAE.exe
  C:\Windows\System\ebQKNAE.exe
  2⤵
  PID:7496
- C:\Windows\System\TOClqzC.exe
  C:\Windows\System\TOClqzC.exe
  2⤵
  PID:7076
- C:\Windows\System\nVXLsZp.exe
  C:\Windows\System\nVXLsZp.exe
  2⤵
  PID:5212
- C:\Windows\System\RfbOQKy.exe
  C:\Windows\System\RfbOQKy.exe
  2⤵
  PID:7644
- C:\Windows\System\zoJsqni.exe
  C:\Windows\System\zoJsqni.exe
  2⤵
  PID:6080
- C:\Windows\System\oYOhrZO.exe
  C:\Windows\System\oYOhrZO.exe
  2⤵
  PID:7756
- C:\Windows\System\ALBzfYw.exe
  C:\Windows\System\ALBzfYw.exe
  2⤵
  PID:7784
- C:\Windows\System\BbApjee.exe
  C:\Windows\System\BbApjee.exe
  2⤵
  PID:7824
- C:\Windows\System\AomgkKy.exe
  C:\Windows\System\AomgkKy.exe
  2⤵
  PID:8204
- C:\Windows\System\lSmFDGa.exe
  C:\Windows\System\lSmFDGa.exe
  2⤵
  PID:8228
- C:\Windows\System\znNyfqc.exe
  C:\Windows\System\znNyfqc.exe
  2⤵
  PID:8252
- C:\Windows\System\nNvOhtL.exe
  C:\Windows\System\nNvOhtL.exe
  2⤵
  PID:8272
- C:\Windows\System\VPIYNgw.exe
  C:\Windows\System\VPIYNgw.exe
  2⤵
  PID:8292
- C:\Windows\System\CdtEBPs.exe
  C:\Windows\System\CdtEBPs.exe
  2⤵
  PID:8316
- C:\Windows\System\UYxMRNa.exe
  C:\Windows\System\UYxMRNa.exe
  2⤵
  PID:8336
- C:\Windows\System\zIpsYbG.exe
  C:\Windows\System\zIpsYbG.exe
  2⤵
  PID:8360
- C:\Windows\System\DPITTUl.exe
  C:\Windows\System\DPITTUl.exe
  2⤵
  PID:8376
- C:\Windows\System\uqxmyDL.exe
  C:\Windows\System\uqxmyDL.exe
  2⤵
  PID:8400
- C:\Windows\System\MrHoFYP.exe
  C:\Windows\System\MrHoFYP.exe
  2⤵
  PID:8424
- C:\Windows\System\zKbSuoT.exe
  C:\Windows\System\zKbSuoT.exe
  2⤵
  PID:8440
- C:\Windows\System\kySLgrq.exe
  C:\Windows\System\kySLgrq.exe
  2⤵
  PID:8472
- C:\Windows\System\rRhByjS.exe
  C:\Windows\System\rRhByjS.exe
  2⤵
  PID:8496
- C:\Windows\System\aWxcQlW.exe
  C:\Windows\System\aWxcQlW.exe
  2⤵
  PID:8524
- C:\Windows\System\BBRqcMS.exe
  C:\Windows\System\BBRqcMS.exe
  2⤵
  PID:8540
- C:\Windows\System\cDKBdVp.exe
  C:\Windows\System\cDKBdVp.exe
  2⤵
  PID:8568
- C:\Windows\System\csHgpEY.exe
  C:\Windows\System\csHgpEY.exe
  2⤵
  PID:8584
- C:\Windows\System\nSyozAd.exe
  C:\Windows\System\nSyozAd.exe
  2⤵
  PID:8608
- C:\Windows\System\sjhYqHz.exe
  C:\Windows\System\sjhYqHz.exe
  2⤵
  PID:8624
- C:\Windows\System\rVYgcCZ.exe
  C:\Windows\System\rVYgcCZ.exe
  2⤵
  PID:8644
- C:\Windows\System\itVMJFv.exe
  C:\Windows\System\itVMJFv.exe
  2⤵
  PID:8664
- C:\Windows\System\idigsgD.exe
  C:\Windows\System\idigsgD.exe
  2⤵
  PID:8680
- C:\Windows\System\PNORKyT.exe
  C:\Windows\System\PNORKyT.exe
  2⤵
  PID:8700
- C:\Windows\System\jUkxBrY.exe
  C:\Windows\System\jUkxBrY.exe
  2⤵
  PID:8724
- C:\Windows\System\tYiCAga.exe
  C:\Windows\System\tYiCAga.exe
  2⤵
  PID:8748
- C:\Windows\System\CxhxUlo.exe
  C:\Windows\System\CxhxUlo.exe
  2⤵
  PID:8776
- C:\Windows\System\LvaJhwg.exe
  C:\Windows\System\LvaJhwg.exe
  2⤵
  PID:8800
- C:\Windows\System\HFjDlCw.exe
  C:\Windows\System\HFjDlCw.exe
  2⤵
  PID:8820
- C:\Windows\System\wVjyfXP.exe
  C:\Windows\System\wVjyfXP.exe
  2⤵
  PID:8844
- C:\Windows\System\NmFhKIC.exe
  C:\Windows\System\NmFhKIC.exe
  2⤵
  PID:8868
- C:\Windows\System\VKuWaLe.exe
  C:\Windows\System\VKuWaLe.exe
  2⤵
  PID:8888
- C:\Windows\System\YdaTQXJ.exe
  C:\Windows\System\YdaTQXJ.exe
  2⤵
  PID:8904
- C:\Windows\System\AVOBUUc.exe
  C:\Windows\System\AVOBUUc.exe
  2⤵
  PID:8924
- C:\Windows\System\Lswuthj.exe
  C:\Windows\System\Lswuthj.exe
  2⤵
  PID:8944
- C:\Windows\System\LBAvrZe.exe
  C:\Windows\System\LBAvrZe.exe
  2⤵
  PID:8972
- C:\Windows\System\EXKFNep.exe
  C:\Windows\System\EXKFNep.exe
  2⤵
  PID:9000
- C:\Windows\System\OMYEzhj.exe
  C:\Windows\System\OMYEzhj.exe
  2⤵
  PID:9024
- C:\Windows\System\mReeVXx.exe
  C:\Windows\System\mReeVXx.exe
  2⤵
  PID:9048
- C:\Windows\System\MOJMaIv.exe
  C:\Windows\System\MOJMaIv.exe
  2⤵
  PID:9072
- C:\Windows\System\wUuiAdG.exe
  C:\Windows\System\wUuiAdG.exe
  2⤵
  PID:9092
- C:\Windows\System\RRGJUKh.exe
  C:\Windows\System\RRGJUKh.exe
  2⤵
  PID:9112
- C:\Windows\System\qgfFlfR.exe
  C:\Windows\System\qgfFlfR.exe
  2⤵
  PID:9132
- C:\Windows\System\pykVOLc.exe
  C:\Windows\System\pykVOLc.exe
  2⤵
  PID:9156
- C:\Windows\System\XDLUsck.exe
  C:\Windows\System\XDLUsck.exe
  2⤵
  PID:9176
- C:\Windows\System\PFoSaio.exe
  C:\Windows\System\PFoSaio.exe
  2⤵
  PID:9200
- C:\Windows\System\YQQXOyd.exe
  C:\Windows\System\YQQXOyd.exe
  2⤵
  PID:7896
- C:\Windows\System\tdAODrw.exe
  C:\Windows\System\tdAODrw.exe
  2⤵
  PID:6724
- C:\Windows\System\idVLLti.exe
  C:\Windows\System\idVLLti.exe
  2⤵
  PID:6636
- C:\Windows\System\cbhdGLB.exe
  C:\Windows\System\cbhdGLB.exe
  2⤵
  PID:8052
- C:\Windows\System\YKIFcLC.exe
  C:\Windows\System\YKIFcLC.exe
  2⤵
  PID:6880
- C:\Windows\System\vdYvmKg.exe
  C:\Windows\System\vdYvmKg.exe
  2⤵
  PID:7384
- C:\Windows\System\nScwvXw.exe
  C:\Windows\System\nScwvXw.exe
  2⤵
  PID:6944
- C:\Windows\System\IAYcLcR.exe
  C:\Windows\System\IAYcLcR.exe
  2⤵
  PID:7464
- C:\Windows\System\vNkRlqL.exe
  C:\Windows\System\vNkRlqL.exe
  2⤵
  PID:2004
- C:\Windows\System\mHCbpEw.exe
  C:\Windows\System\mHCbpEw.exe
  2⤵
  PID:7128
- C:\Windows\System\jiUWDdj.exe
  C:\Windows\System\jiUWDdj.exe
  2⤵
  PID:844
- C:\Windows\System\ugFgexq.exe
  C:\Windows\System\ugFgexq.exe
  2⤵
  PID:7616
- C:\Windows\System\YKjdMWz.exe
  C:\Windows\System\YKjdMWz.exe
  2⤵
  PID:7188
- C:\Windows\System\cjFgyEO.exe
  C:\Windows\System\cjFgyEO.exe
  2⤵
  PID:7684
- C:\Windows\System\pwVfYqi.exe
  C:\Windows\System\pwVfYqi.exe
  2⤵
  PID:4352
- C:\Windows\System\oSFMRTY.exe
  C:\Windows\System\oSFMRTY.exe
  2⤵
  PID:7064
- C:\Windows\System\LnIPnFx.exe
  C:\Windows\System\LnIPnFx.exe
  2⤵
  PID:7780
- C:\Windows\System\VudbWnR.exe
  C:\Windows\System\VudbWnR.exe
  2⤵
  PID:8248
- C:\Windows\System\HSMkVHC.exe
  C:\Windows\System\HSMkVHC.exe
  2⤵
  PID:8284
- C:\Windows\System\nguUlks.exe
  C:\Windows\System\nguUlks.exe
  2⤵
  PID:6624
- C:\Windows\System\VfDfKoh.exe
  C:\Windows\System\VfDfKoh.exe
  2⤵
  PID:8408
- C:\Windows\System\ITsvsip.exe
  C:\Windows\System\ITsvsip.exe
  2⤵
  PID:8040
- C:\Windows\System\PNxBlaz.exe
  C:\Windows\System\PNxBlaz.exe
  2⤵
  PID:8108
- C:\Windows\System\mAAihji.exe
  C:\Windows\System\mAAihji.exe
  2⤵
  PID:7288
- C:\Windows\System\hEgCKhK.exe
  C:\Windows\System\hEgCKhK.exe
  2⤵
  PID:9224
- C:\Windows\System\hALPMGK.exe
  C:\Windows\System\hALPMGK.exe
  2⤵
  PID:9248
- C:\Windows\System\pjdYGVt.exe
  C:\Windows\System\pjdYGVt.exe
  2⤵
  PID:9272
- C:\Windows\System\tMJNDLp.exe
  C:\Windows\System\tMJNDLp.exe
  2⤵
  PID:9296
- C:\Windows\System\kuyczJh.exe
  C:\Windows\System\kuyczJh.exe
  2⤵
  PID:9316
- C:\Windows\System\XZUvmDK.exe
  C:\Windows\System\XZUvmDK.exe
  2⤵
  PID:9348
- C:\Windows\System\KoZlVvk.exe
  C:\Windows\System\KoZlVvk.exe
  2⤵
  PID:9368
- C:\Windows\System\DANtkQh.exe
  C:\Windows\System\DANtkQh.exe
  2⤵
  PID:9384
- C:\Windows\System\ykdOsPN.exe
  C:\Windows\System\ykdOsPN.exe
  2⤵
  PID:9412
- C:\Windows\System\hUfAxfn.exe
  C:\Windows\System\hUfAxfn.exe
  2⤵
  PID:9428
- C:\Windows\System\nDuEcSD.exe
  C:\Windows\System\nDuEcSD.exe
  2⤵
  PID:9448
- C:\Windows\System\ryyHBeB.exe
  C:\Windows\System\ryyHBeB.exe
  2⤵
  PID:9476
- C:\Windows\System\qGninlx.exe
  C:\Windows\System\qGninlx.exe
  2⤵
  PID:9496
- C:\Windows\System\BLDTKFP.exe
  C:\Windows\System\BLDTKFP.exe
  2⤵
  PID:9516
- C:\Windows\System\lnCNcru.exe
  C:\Windows\System\lnCNcru.exe
  2⤵
  PID:9544
- C:\Windows\System\PHWgSJL.exe
  C:\Windows\System\PHWgSJL.exe
  2⤵
  PID:9564
- C:\Windows\System\DuFPsrd.exe
  C:\Windows\System\DuFPsrd.exe
  2⤵
  PID:9588
- C:\Windows\System\YUcLWGd.exe
  C:\Windows\System\YUcLWGd.exe
  2⤵
  PID:9608
- C:\Windows\System\qYketOj.exe
  C:\Windows\System\qYketOj.exe
  2⤵
  PID:9632
- C:\Windows\System\WzdyIsz.exe
  C:\Windows\System\WzdyIsz.exe
  2⤵
  PID:9652
- C:\Windows\System\qTZkzsk.exe
  C:\Windows\System\qTZkzsk.exe
  2⤵
  PID:9676
- C:\Windows\System\rTkHpvQ.exe
  C:\Windows\System\rTkHpvQ.exe
  2⤵
  PID:9852
- C:\Windows\System\SMVlhqZ.exe
  C:\Windows\System\SMVlhqZ.exe
  2⤵
  PID:9872
- C:\Windows\System\CMaRfNZ.exe
  C:\Windows\System\CMaRfNZ.exe
  2⤵
  PID:9896
- C:\Windows\System\zjZrGFO.exe
  C:\Windows\System\zjZrGFO.exe
  2⤵
  PID:9916
- C:\Windows\System\XOrmBeT.exe
  C:\Windows\System\XOrmBeT.exe
  2⤵
  PID:9940
- C:\Windows\System\JUyWKrk.exe
  C:\Windows\System\JUyWKrk.exe
  2⤵
  PID:9960
- C:\Windows\System\OKRPvfq.exe
  C:\Windows\System\OKRPvfq.exe
  2⤵
  PID:9980
- C:\Windows\System\pXBrBTE.exe
  C:\Windows\System\pXBrBTE.exe
  2⤵
  PID:10008
- C:\Windows\System\fcPbKZc.exe
  C:\Windows\System\fcPbKZc.exe
  2⤵
  PID:10024
- C:\Windows\System\xaocEvO.exe
  C:\Windows\System\xaocEvO.exe
  2⤵
  PID:10052
- C:\Windows\System\mKJRbsP.exe
  C:\Windows\System\mKJRbsP.exe
  2⤵
  PID:10080
- C:\Windows\System\FhEZQPi.exe
  C:\Windows\System\FhEZQPi.exe
  2⤵
  PID:10116
- C:\Windows\System\XJayXjn.exe
  C:\Windows\System\XJayXjn.exe
  2⤵
  PID:10152
- C:\Windows\System\WVSIFaf.exe
  C:\Windows\System\WVSIFaf.exe
  2⤵
  PID:10172
- C:\Windows\System\jzLNkEQ.exe
  C:\Windows\System\jzLNkEQ.exe
  2⤵
  PID:10196
- C:\Windows\System\fIDPLzN.exe
  C:\Windows\System\fIDPLzN.exe
  2⤵
  PID:10212
- C:\Windows\System\iZlfYEI.exe
  C:\Windows\System\iZlfYEI.exe
  2⤵
  PID:10228
- C:\Windows\System\OlJSzYG.exe
  C:\Windows\System\OlJSzYG.exe
  2⤵
  PID:7452
- C:\Windows\System\ZIUmrws.exe
  C:\Windows\System\ZIUmrws.exe
  2⤵
  PID:7472
- C:\Windows\System\TgLzjMf.exe
  C:\Windows\System\TgLzjMf.exe
  2⤵
  PID:8732
- C:\Windows\System\UtzZqgT.exe
  C:\Windows\System\UtzZqgT.exe
  2⤵
  PID:7588
- C:\Windows\System\xDyQmBE.exe
  C:\Windows\System\xDyQmBE.exe
  2⤵
  PID:6472
- C:\Windows\System\wAOkWwN.exe
  C:\Windows\System\wAOkWwN.exe
  2⤵
  PID:8936
- C:\Windows\System\jmvTGAC.exe
  C:\Windows\System\jmvTGAC.exe
  2⤵
  PID:9012
- C:\Windows\System\feEtODQ.exe
  C:\Windows\System\feEtODQ.exe
  2⤵
  PID:9064
- C:\Windows\System\YsDDqtP.exe
  C:\Windows\System\YsDDqtP.exe
  2⤵
  PID:7840
- C:\Windows\System\wgLTswE.exe
  C:\Windows\System\wgLTswE.exe
  2⤵
  PID:9184
- C:\Windows\System\OnKJjGy.exe
  C:\Windows\System\OnKJjGy.exe
  2⤵
  PID:8412
- C:\Windows\System\UxywSoB.exe
  C:\Windows\System\UxywSoB.exe
  2⤵
  PID:8464
- C:\Windows\System\IGgDSML.exe
  C:\Windows\System\IGgDSML.exe
  2⤵
  PID:6796
- C:\Windows\System\NxyjiTW.exe
  C:\Windows\System\NxyjiTW.exe
  2⤵
  PID:6900
- C:\Windows\System\SKASGAN.exe
  C:\Windows\System\SKASGAN.exe
  2⤵
  PID:9192
- C:\Windows\System\JrrmoRb.exe
  C:\Windows\System\JrrmoRb.exe
  2⤵
  PID:9212
- C:\Windows\System\BydhERH.exe
  C:\Windows\System\BydhERH.exe
  2⤵
  PID:7544
- C:\Windows\System\XRgbwCX.exe
  C:\Windows\System\XRgbwCX.exe
  2⤵
  PID:7748
- C:\Windows\System\NPqrLJz.exe
  C:\Windows\System\NPqrLJz.exe
  2⤵
  PID:8172
- C:\Windows\System\iTPARgw.exe
  C:\Windows\System\iTPARgw.exe
  2⤵
  PID:6964
- C:\Windows\System\MwxarmQ.exe
  C:\Windows\System\MwxarmQ.exe
  2⤵
  PID:7112
- C:\Windows\System\SYoGdPZ.exe
  C:\Windows\System\SYoGdPZ.exe
  2⤵
  PID:9332
- C:\Windows\System\HNzUHRO.exe
  C:\Windows\System\HNzUHRO.exe
  2⤵
  PID:9420
- C:\Windows\System\vZRBWZu.exe
  C:\Windows\System\vZRBWZu.exe
  2⤵
  PID:9468
- C:\Windows\System\GpkBDlu.exe
  C:\Windows\System\GpkBDlu.exe
  2⤵
  PID:8828
- C:\Windows\System\pAvBupy.exe
  C:\Windows\System\pAvBupy.exe
  2⤵
  PID:9560
- C:\Windows\System\doxZLSs.exe
  C:\Windows\System\doxZLSs.exe
  2⤵
  PID:7356
- C:\Windows\System\oWiNvJC.exe
  C:\Windows\System\oWiNvJC.exe
  2⤵
  PID:9668
- C:\Windows\System\JYCalcD.exe
  C:\Windows\System\JYCalcD.exe
  2⤵
  PID:10264
- C:\Windows\System\FIDnPzy.exe
  C:\Windows\System\FIDnPzy.exe
  2⤵
  PID:10288
- C:\Windows\System\Yvivwjr.exe
  C:\Windows\System\Yvivwjr.exe
  2⤵
  PID:10320
- C:\Windows\System\acoRPFr.exe
  C:\Windows\System\acoRPFr.exe
  2⤵
  PID:10352
- C:\Windows\System\tlzadTJ.exe
  C:\Windows\System\tlzadTJ.exe
  2⤵
  PID:10376
- C:\Windows\System\STRiLfd.exe
  C:\Windows\System\STRiLfd.exe
  2⤵
  PID:10404
- C:\Windows\System\ESKdisG.exe
  C:\Windows\System\ESKdisG.exe
  2⤵
  PID:10424
- C:\Windows\System\iNjZrWs.exe
  C:\Windows\System\iNjZrWs.exe
  2⤵
  PID:10444
- C:\Windows\System\AfNcjRn.exe
  C:\Windows\System\AfNcjRn.exe
  2⤵
  PID:10468
- C:\Windows\System\XPWeubh.exe
  C:\Windows\System\XPWeubh.exe
  2⤵
  PID:10488
- C:\Windows\System\tFdsNCJ.exe
  C:\Windows\System\tFdsNCJ.exe
  2⤵
  PID:10508
- C:\Windows\System\BbmsSUa.exe
  C:\Windows\System\BbmsSUa.exe
  2⤵
  PID:10532
- C:\Windows\System\oKCpGHL.exe
  C:\Windows\System\oKCpGHL.exe
  2⤵
  PID:10556
- C:\Windows\System\uILRwUQ.exe
  C:\Windows\System\uILRwUQ.exe
  2⤵
  PID:10580
- C:\Windows\System\TDEvKUw.exe
  C:\Windows\System\TDEvKUw.exe
  2⤵
  PID:10604
- C:\Windows\System\GkEcxfh.exe
  C:\Windows\System\GkEcxfh.exe
  2⤵
  PID:10620
- C:\Windows\System\IvHELSI.exe
  C:\Windows\System\IvHELSI.exe
  2⤵
  PID:10648
- C:\Windows\System\kBmyfol.exe
  C:\Windows\System\kBmyfol.exe
  2⤵
  PID:10668
- C:\Windows\System\GnTTFAn.exe
  C:\Windows\System\GnTTFAn.exe
  2⤵
  PID:10692
- C:\Windows\System\mnyGeUC.exe
  C:\Windows\System\mnyGeUC.exe
  2⤵
  PID:10720
- C:\Windows\System\uVtvKpV.exe
  C:\Windows\System\uVtvKpV.exe
  2⤵
  PID:10748
- C:\Windows\System\HudlUCx.exe
  C:\Windows\System\HudlUCx.exe
  2⤵
  PID:10764
- C:\Windows\System\EWCvigP.exe
  C:\Windows\System\EWCvigP.exe
  2⤵
  PID:10788
- C:\Windows\System\ugmgaxL.exe
  C:\Windows\System\ugmgaxL.exe
  2⤵
  PID:10820
- C:\Windows\System\hwQXYNV.exe
  C:\Windows\System\hwQXYNV.exe
  2⤵
  PID:10856
- C:\Windows\System\llxgItL.exe
  C:\Windows\System\llxgItL.exe
  2⤵
  PID:10872
- C:\Windows\System\fZEPLcN.exe
  C:\Windows\System\fZEPLcN.exe
  2⤵
  PID:10892
- C:\Windows\System\dAVLljP.exe
  C:\Windows\System\dAVLljP.exe
  2⤵
  PID:10912
- C:\Windows\System\aHMBtQn.exe
  C:\Windows\System\aHMBtQn.exe
  2⤵
  PID:10932
- C:\Windows\System\gnmKMxt.exe
  C:\Windows\System\gnmKMxt.exe
  2⤵
  PID:10956
- C:\Windows\System\WRdcjuN.exe
  C:\Windows\System\WRdcjuN.exe
  2⤵
  PID:10976
- C:\Windows\System\SeXMbSb.exe
  C:\Windows\System\SeXMbSb.exe
  2⤵
  PID:10996
- C:\Windows\System\khHviqh.exe
  C:\Windows\System\khHviqh.exe
  2⤵
  PID:11016
- C:\Windows\System\Voexvuo.exe
  C:\Windows\System\Voexvuo.exe
  2⤵
  PID:11032
- C:\Windows\System\dywszCY.exe
  C:\Windows\System\dywszCY.exe
  2⤵
  PID:11064
- C:\Windows\System\eExpPDV.exe
  C:\Windows\System\eExpPDV.exe
  2⤵
  PID:11080
- C:\Windows\System\FsVugVT.exe
  C:\Windows\System\FsVugVT.exe
  2⤵
  PID:11096
- C:\Windows\System\lAIwgsp.exe
  C:\Windows\System\lAIwgsp.exe
  2⤵
  PID:11112
- C:\Windows\System\tQZRNTj.exe
  C:\Windows\System\tQZRNTj.exe
  2⤵
  PID:11132
- C:\Windows\System\fzLsEFd.exe
  C:\Windows\System\fzLsEFd.exe
  2⤵
  PID:11152
- C:\Windows\System\WZOLBLz.exe
  C:\Windows\System\WZOLBLz.exe
  2⤵
  PID:11180
- C:\Windows\System\sfByBaZ.exe
  C:\Windows\System\sfByBaZ.exe
  2⤵
  PID:11204
- C:\Windows\System\XctkadK.exe
  C:\Windows\System\XctkadK.exe
  2⤵
  PID:11232
- C:\Windows\System\WAQYOmV.exe
  C:\Windows\System\WAQYOmV.exe
  2⤵
  PID:11256
- C:\Windows\System\thocIkO.exe
  C:\Windows\System\thocIkO.exe
  2⤵
  PID:7676
- C:\Windows\System\mQFzmZk.exe
  C:\Windows\System\mQFzmZk.exe
  2⤵
  PID:6356
- C:\Windows\System\vMJufdG.exe
  C:\Windows\System\vMJufdG.exe
  2⤵
  PID:9140
- C:\Windows\System\jxpBChK.exe
  C:\Windows\System\jxpBChK.exe
  2⤵
  PID:8264
- C:\Windows\System\bFnFCut.exe
  C:\Windows\System\bFnFCut.exe
  2⤵
  PID:2892
- C:\Windows\System\WTgsPJZ.exe
  C:\Windows\System\WTgsPJZ.exe
  2⤵
  PID:9008
- C:\Windows\System\UzKLrdD.exe
  C:\Windows\System\UzKLrdD.exe
  2⤵
  PID:9880
- C:\Windows\System\RPslfju.exe
  C:\Windows\System\RPslfju.exe
  2⤵
  PID:9936
- C:\Windows\System\BuMGbxP.exe
  C:\Windows\System\BuMGbxP.exe
  2⤵
  PID:9972
- C:\Windows\System\NjyUXkn.exe
  C:\Windows\System\NjyUXkn.exe
  2⤵
  PID:7952
- C:\Windows\System\pTchoTf.exe
  C:\Windows\System\pTchoTf.exe
  2⤵
  PID:10040
- C:\Windows\System\cmDxFFG.exe
  C:\Windows\System\cmDxFFG.exe
  2⤵
  PID:7200
- C:\Windows\System\LaNhFbP.exe
  C:\Windows\System\LaNhFbP.exe
  2⤵
  PID:10168
- C:\Windows\System\dugrQWC.exe
  C:\Windows\System\dugrQWC.exe
  2⤵
  PID:8660
- C:\Windows\System\adtvibf.exe
  C:\Windows\System\adtvibf.exe
  2⤵
  PID:8676
- C:\Windows\System\pPVtyvb.exe
  C:\Windows\System\pPVtyvb.exe
  2⤵
  PID:8692
- C:\Windows\System\aPgoDjs.exe
  C:\Windows\System\aPgoDjs.exe
  2⤵
  PID:8744
- C:\Windows\System\KwyNLdX.exe
  C:\Windows\System\KwyNLdX.exe
  2⤵
  PID:9032
- C:\Windows\System\wNnqAqk.exe
  C:\Windows\System\wNnqAqk.exe
  2⤵
  PID:9456
- C:\Windows\System\QCObgNd.exe
  C:\Windows\System\QCObgNd.exe
  2⤵
  PID:11280
- C:\Windows\System\zRmiVFG.exe
  C:\Windows\System\zRmiVFG.exe
  2⤵
  PID:11300
- C:\Windows\System\CyrctbQ.exe
  C:\Windows\System\CyrctbQ.exe
  2⤵
  PID:11320
- C:\Windows\System\kpIBDJs.exe
  C:\Windows\System\kpIBDJs.exe
  2⤵
  PID:11344
- C:\Windows\System\TXQDMBt.exe
  C:\Windows\System\TXQDMBt.exe
  2⤵
  PID:11368
- C:\Windows\System\snVycEC.exe
  C:\Windows\System\snVycEC.exe
  2⤵
  PID:11396
- C:\Windows\System\AHcwuRH.exe
  C:\Windows\System\AHcwuRH.exe
  2⤵
  PID:11416
- C:\Windows\System\dAyuIix.exe
  C:\Windows\System\dAyuIix.exe
  2⤵
  PID:11440
- C:\Windows\System\fXkJVNA.exe
  C:\Windows\System\fXkJVNA.exe
  2⤵
  PID:11460
- C:\Windows\System\IHbleXJ.exe
  C:\Windows\System\IHbleXJ.exe
  2⤵
  PID:11484
- C:\Windows\System\fNoEjlB.exe
  C:\Windows\System\fNoEjlB.exe
  2⤵
  PID:11504
- C:\Windows\System\FGhAWjh.exe
  C:\Windows\System\FGhAWjh.exe
  2⤵
  PID:11528
- C:\Windows\System\MnMxqOm.exe
  C:\Windows\System\MnMxqOm.exe
  2⤵
  PID:11552
- C:\Windows\System\EUgQUcH.exe
  C:\Windows\System\EUgQUcH.exe
  2⤵
  PID:11568
- C:\Windows\System\EePgCMk.exe
  C:\Windows\System\EePgCMk.exe
  2⤵
  PID:11596
- C:\Windows\System\BtKFjzB.exe
  C:\Windows\System\BtKFjzB.exe
  2⤵
  PID:11620
- C:\Windows\System\xDNQKPi.exe
  C:\Windows\System\xDNQKPi.exe
  2⤵
  PID:11644
- C:\Windows\System\wHPHpZD.exe
  C:\Windows\System\wHPHpZD.exe
  2⤵
  PID:11664
- C:\Windows\System\XsltUsG.exe
  C:\Windows\System\XsltUsG.exe
  2⤵
  PID:11684
- C:\Windows\System\qtWFpgn.exe
  C:\Windows\System\qtWFpgn.exe
  2⤵
  PID:11704
- C:\Windows\System\fDfWkMa.exe
  C:\Windows\System\fDfWkMa.exe
  2⤵
  PID:11732
- C:\Windows\System\mYWHjVJ.exe
  C:\Windows\System\mYWHjVJ.exe
  2⤵
  PID:11752
- C:\Windows\System\WErXKoG.exe
  C:\Windows\System\WErXKoG.exe
  2⤵
  PID:11776
- C:\Windows\System\PISTwli.exe
  C:\Windows\System\PISTwli.exe
  2⤵
  PID:11804
- C:\Windows\System\SEuOmcT.exe
  C:\Windows\System\SEuOmcT.exe
  2⤵
  PID:11828
- C:\Windows\System\UkPgjBf.exe
  C:\Windows\System\UkPgjBf.exe
  2⤵
  PID:11848
- C:\Windows\System\hSQJlow.exe
  C:\Windows\System\hSQJlow.exe
  2⤵
  PID:11892
- C:\Windows\System\mkEGkal.exe
  C:\Windows\System\mkEGkal.exe
  2⤵
  PID:11916
- C:\Windows\System\LYrJRMj.exe
  C:\Windows\System\LYrJRMj.exe
  2⤵
  PID:11932
- C:\Windows\System\citCZcX.exe
  C:\Windows\System\citCZcX.exe
  2⤵
  PID:11952
- C:\Windows\System\gReBChx.exe
  C:\Windows\System\gReBChx.exe
  2⤵
  PID:11976
- C:\Windows\System\yeGRHHB.exe
  C:\Windows\System\yeGRHHB.exe
  2⤵
  PID:12000
- C:\Windows\System\qxvBWZa.exe
  C:\Windows\System\qxvBWZa.exe
  2⤵
  PID:12028
- C:\Windows\System\UGfnEBy.exe
  C:\Windows\System\UGfnEBy.exe
  2⤵
  PID:12048
- C:\Windows\System\cTybRIb.exe
  C:\Windows\System\cTybRIb.exe
  2⤵
  PID:12068
- C:\Windows\System\QejHWGz.exe
  C:\Windows\System\QejHWGz.exe
  2⤵
  PID:12084
- C:\Windows\System\dfZAzTY.exe
  C:\Windows\System\dfZAzTY.exe
  2⤵
  PID:12100
- C:\Windows\System\kKryoxA.exe
  C:\Windows\System\kKryoxA.exe
  2⤵
  PID:12116
- C:\Windows\System\nveXqmk.exe
  C:\Windows\System\nveXqmk.exe
  2⤵
  PID:12132
- C:\Windows\System\RknYXhk.exe
  C:\Windows\System\RknYXhk.exe
  2⤵
  PID:12156
- C:\Windows\System\fbFNpqU.exe
  C:\Windows\System\fbFNpqU.exe
  2⤵
  PID:12184
- C:\Windows\System\pbHeZIH.exe
  C:\Windows\System\pbHeZIH.exe
  2⤵
  PID:12204
- C:\Windows\System\glmnrkx.exe
  C:\Windows\System\glmnrkx.exe
  2⤵
  PID:12228
- C:\Windows\System\jTbMYuO.exe
  C:\Windows\System\jTbMYuO.exe
  2⤵
  PID:12252
- C:\Windows\System\gKIsDKM.exe
  C:\Windows\System\gKIsDKM.exe
  2⤵
  PID:12276
- C:\Windows\System\nvDphHA.exe
  C:\Windows\System\nvDphHA.exe
  2⤵
  PID:7916
- C:\Windows\System\QjokZdf.exe
  C:\Windows\System\QjokZdf.exe
  2⤵
  PID:8876
- C:\Windows\System\LpvErxE.exe
  C:\Windows\System\LpvErxE.exe
  2⤵
  PID:8600
- C:\Windows\System\SHIAIBy.exe
  C:\Windows\System\SHIAIBy.exe
  2⤵
  PID:9624
- C:\Windows\System\EhqwKGx.exe
  C:\Windows\System\EhqwKGx.exe
  2⤵
  PID:9464
- C:\Windows\System\bUrUkUE.exe
  C:\Windows\System\bUrUkUE.exe
  2⤵
  PID:9664
- C:\Windows\System\HajzbjQ.exe
  C:\Windows\System\HajzbjQ.exe
  2⤵
  PID:9688
- C:\Windows\System\DbFuXbe.exe
  C:\Windows\System\DbFuXbe.exe
  2⤵
  PID:10364
- C:\Windows\System\WAwzBMP.exe
  C:\Windows\System\WAwzBMP.exe
  2⤵
  PID:10452
- C:\Windows\System\NesWjAR.exe
  C:\Windows\System\NesWjAR.exe
  2⤵
  PID:7892
- C:\Windows\System\IXagxQJ.exe
  C:\Windows\System\IXagxQJ.exe
  2⤵
  PID:10740
- C:\Windows\System\qvMMRGY.exe
  C:\Windows\System\qvMMRGY.exe
  2⤵
  PID:5080
- C:\Windows\System\FQlckio.exe
  C:\Windows\System\FQlckio.exe
  2⤵
  PID:1728
- C:\Windows\System\hatPaJv.exe
  C:\Windows\System\hatPaJv.exe
  2⤵
  PID:10840
- C:\Windows\System\ZMQaIZb.exe
  C:\Windows\System\ZMQaIZb.exe
  2⤵
  PID:10884
- C:\Windows\System\mMUlGaD.exe
  C:\Windows\System\mMUlGaD.exe
  2⤵
  PID:7048
- C:\Windows\System\mPWTTiW.exe
  C:\Windows\System\mPWTTiW.exe
  2⤵
  PID:9912
- C:\Windows\System\KbsukIZ.exe
  C:\Windows\System\KbsukIZ.exe
  2⤵
  PID:10968
- C:\Windows\System\NVwbXwF.exe
  C:\Windows\System\NVwbXwF.exe
  2⤵
  PID:11012
- C:\Windows\System\koxXosR.exe
  C:\Windows\System\koxXosR.exe
  2⤵
  PID:11056
- C:\Windows\System\BtyDlkf.exe
  C:\Windows\System\BtyDlkf.exe
  2⤵
  PID:11124
- C:\Windows\System\TigYugQ.exe
  C:\Windows\System\TigYugQ.exe
  2⤵
  PID:11192
- C:\Windows\System\dGAPmKJ.exe
  C:\Windows\System\dGAPmKJ.exe
  2⤵
  PID:11212
- C:\Windows\System\PSsrGft.exe
  C:\Windows\System\PSsrGft.exe
  2⤵
  PID:7164
- C:\Windows\System\cIaNdlT.exe
  C:\Windows\System\cIaNdlT.exe
  2⤵
  PID:8196
- C:\Windows\System\wuzjWYT.exe
  C:\Windows\System\wuzjWYT.exe
  2⤵
  PID:8564
- C:\Windows\System\IqGzCXZ.exe
  C:\Windows\System\IqGzCXZ.exe
  2⤵
  PID:12300
- C:\Windows\System\GkfQRYE.exe
  C:\Windows\System\GkfQRYE.exe
  2⤵
  PID:12324
- C:\Windows\System\jfBLmHB.exe
  C:\Windows\System\jfBLmHB.exe
  2⤵
  PID:12344
- C:\Windows\System\USzQGDF.exe
  C:\Windows\System\USzQGDF.exe
  2⤵
  PID:12372
- C:\Windows\System\ptXMuYY.exe
  C:\Windows\System\ptXMuYY.exe
  2⤵
  PID:12392
- C:\Windows\System\RTNIfKw.exe
  C:\Windows\System\RTNIfKw.exe
  2⤵
  PID:12412
- C:\Windows\System\EfcaXFz.exe
  C:\Windows\System\EfcaXFz.exe
  2⤵
  PID:12432
- C:\Windows\System\xkvPhjl.exe
  C:\Windows\System\xkvPhjl.exe
  2⤵
  PID:12456
- C:\Windows\System\eiowWBQ.exe
  C:\Windows\System\eiowWBQ.exe
  2⤵
  PID:12476
- C:\Windows\System\ZwEPJbK.exe
  C:\Windows\System\ZwEPJbK.exe
  2⤵
  PID:12500
- C:\Windows\System\DnBXzhv.exe
  C:\Windows\System\DnBXzhv.exe
  2⤵
  PID:12520
- C:\Windows\System\yyyefkL.exe
  C:\Windows\System\yyyefkL.exe
  2⤵
  PID:12540
- C:\Windows\System\oqYfIYu.exe
  C:\Windows\System\oqYfIYu.exe
  2⤵
  PID:12560
- C:\Windows\System\LLgzmZn.exe
  C:\Windows\System\LLgzmZn.exe
  2⤵
  PID:12584
- C:\Windows\System\QtxvqgJ.exe
  C:\Windows\System\QtxvqgJ.exe
  2⤵
  PID:12604
- C:\Windows\System\fXIFQdl.exe
  C:\Windows\System\fXIFQdl.exe
  2⤵
  PID:12628
- C:\Windows\System\qCRVBMP.exe
  C:\Windows\System\qCRVBMP.exe
  2⤵
  PID:12652
- C:\Windows\System\GTNvRrT.exe
  C:\Windows\System\GTNvRrT.exe
  2⤵
  PID:12672
- C:\Windows\System\eAhaSnj.exe
  C:\Windows\System\eAhaSnj.exe
  2⤵
  PID:12688
- C:\Windows\System\JxIQnrk.exe
  C:\Windows\System\JxIQnrk.exe
  2⤵
  PID:12712
- C:\Windows\System\OBWEjdy.exe
  C:\Windows\System\OBWEjdy.exe
  2⤵
  PID:12736
- C:\Windows\System\nEkwxCa.exe
  C:\Windows\System\nEkwxCa.exe
  2⤵
  PID:12760
- C:\Windows\System\ejgWAdK.exe
  C:\Windows\System\ejgWAdK.exe
  2⤵
  PID:12780
- C:\Windows\System\MTKVgin.exe
  C:\Windows\System\MTKVgin.exe
  2⤵
  PID:12800
- C:\Windows\System\lKTLQFz.exe
  C:\Windows\System\lKTLQFz.exe
  2⤵
  PID:12824
- C:\Windows\System\vLIVTlJ.exe
  C:\Windows\System\vLIVTlJ.exe
  2⤵
  PID:12852
- C:\Windows\System\yDjALNf.exe
  C:\Windows\System\yDjALNf.exe
  2⤵
  PID:12872
- C:\Windows\System\LxwNxmB.exe
  C:\Windows\System\LxwNxmB.exe
  2⤵
  PID:12892
- C:\Windows\System\ccvePGK.exe
  C:\Windows\System\ccvePGK.exe
  2⤵
  PID:12912
- C:\Windows\System\CTNcjSV.exe
  C:\Windows\System\CTNcjSV.exe
  2⤵
  PID:12932
- C:\Windows\System\MWyEbCQ.exe
  C:\Windows\System\MWyEbCQ.exe
  2⤵
  PID:12948
- C:\Windows\System\sXFmYGg.exe
  C:\Windows\System\sXFmYGg.exe
  2⤵
  PID:12964
- C:\Windows\System\nhhMeJP.exe
  C:\Windows\System\nhhMeJP.exe
  2⤵
  PID:12980
- C:\Windows\System\sMpuEAh.exe
  C:\Windows\System\sMpuEAh.exe
  2⤵
  PID:12996
- C:\Windows\System\jxzjqPC.exe
  C:\Windows\System\jxzjqPC.exe
  2⤵
  PID:13012
- C:\Windows\System\WRcDwuw.exe
  C:\Windows\System\WRcDwuw.exe
  2⤵
  PID:13028
- C:\Windows\System\YJAHRrp.exe
  C:\Windows\System\YJAHRrp.exe
  2⤵
  PID:13048
- C:\Windows\System\pgfIrYr.exe
  C:\Windows\System\pgfIrYr.exe
  2⤵
  PID:10528
- C:\Windows\System\iVMqQPj.exe
  C:\Windows\System\iVMqQPj.exe
  2⤵
  PID:10588
- C:\Windows\System\jxvmnAj.exe
  C:\Windows\System\jxvmnAj.exe
  2⤵
  PID:13236
- C:\Windows\System\EifuvcS.exe
  C:\Windows\System\EifuvcS.exe
  2⤵
  PID:13280
- C:\Windows\System\SHlzJGn.exe
  C:\Windows\System\SHlzJGn.exe
  2⤵
  PID:12112
- C:\Windows\System\vINCzpP.exe
  C:\Windows\System\vINCzpP.exe
  2⤵
  PID:12212
- C:\Windows\System\LLLssuZ.exe
  C:\Windows\System\LLLssuZ.exe
  2⤵
  PID:12240
- C:\Windows\System\waWehvy.exe
  C:\Windows\System\waWehvy.exe
  2⤵
  PID:7632
- C:\Windows\System\tSdIVHm.exe
  C:\Windows\System\tSdIVHm.exe
  2⤵
  PID:6172
- C:\Windows\System\gFotGRr.exe
  C:\Windows\System\gFotGRr.exe
  2⤵
  PID:10900
- C:\Windows\System\oxoCBTj.exe
  C:\Windows\System\oxoCBTj.exe
  2⤵
  PID:10256
- C:\Windows\System\ACmLUTZ.exe
  C:\Windows\System\ACmLUTZ.exe
  2⤵
  PID:10500
- C:\Windows\System\ThuTlsp.exe
  C:\Windows\System\ThuTlsp.exe
  2⤵
  PID:7936
- C:\Windows\System\rkeVRfr.exe
  C:\Windows\System\rkeVRfr.exe
  2⤵
  PID:11092
- C:\Windows\System\ziddKzK.exe
  C:\Windows\System\ziddKzK.exe
  2⤵
  PID:11148
- C:\Windows\System\fzkJFsQ.exe
  C:\Windows\System\fzkJFsQ.exe
  2⤵
  PID:9104
- C:\Windows\System\YNzaEGJ.exe
  C:\Windows\System\YNzaEGJ.exe
  2⤵
  PID:12384
- C:\Windows\System\WapmfAe.exe
  C:\Windows\System\WapmfAe.exe
  2⤵
  PID:6584
- C:\Windows\System\IlXeUMN.exe
  C:\Windows\System\IlXeUMN.exe
  2⤵
  PID:12528
- C:\Windows\System\hxxAwqZ.exe
  C:\Windows\System\hxxAwqZ.exe
  2⤵
  PID:12636
- C:\Windows\System\EMafNcP.exe
  C:\Windows\System\EMafNcP.exe
  2⤵
  PID:12860
- C:\Windows\System\iVgdfeS.exe
  C:\Windows\System\iVgdfeS.exe
  2⤵
  PID:12900
- C:\Windows\System\xnEOzre.exe
  C:\Windows\System\xnEOzre.exe
  2⤵
  PID:12956
- C:\Windows\System\zLmqOLG.exe
  C:\Windows\System\zLmqOLG.exe
  2⤵
  PID:13008
- C:\Windows\System\uoTadOI.exe
  C:\Windows\System\uoTadOI.exe
  2⤵
  PID:13040
- C:\Windows\System\VRBhuzT.exe
  C:\Windows\System\VRBhuzT.exe
  2⤵
  PID:11316
- C:\Windows\System\acKfUOi.exe
  C:\Windows\System\acKfUOi.exe
  2⤵
  PID:13072
- C:\Windows\System\gveQzft.exe
  C:\Windows\System\gveQzft.exe
  2⤵
  PID:8116
- C:\Windows\System\LyTdNzc.exe
  C:\Windows\System\LyTdNzc.exe
  2⤵
  PID:13144
- C:\Windows\System\JfGCylQ.exe
  C:\Windows\System\JfGCylQ.exe
  2⤵
  PID:13256
- C:\Windows\System\mtXtZma.exe
  C:\Windows\System\mtXtZma.exe
  2⤵
  PID:13268
- C:\Windows\System\CWnbAgW.exe
  C:\Windows\System\CWnbAgW.exe
  2⤵
  PID:9232
- C:\Windows\System\wZPETce.exe
  C:\Windows\System\wZPETce.exe
  2⤵
  PID:10312
- C:\Windows\System\DQyILxR.exe
  C:\Windows\System\DQyILxR.exe
  2⤵
  PID:9220
- C:\Windows\System\OAosPHI.exe
  C:\Windows\System\OAosPHI.exe
  2⤵
  PID:10828
- C:\Windows\System\VDgouqK.exe
  C:\Windows\System\VDgouqK.exe
  2⤵
  PID:10940
- C:\Windows\System\RmjGHhg.exe
  C:\Windows\System\RmjGHhg.exe
  2⤵
  PID:7992
- C:\Windows\System\XdphyZB.exe
  C:\Windows\System\XdphyZB.exe
  2⤵
  PID:12660
- C:\Windows\System\zZYFsOW.exe
  C:\Windows\System\zZYFsOW.exe
  2⤵
  PID:12668
- C:\Windows\System\vSpLmgH.exe
  C:\Windows\System\vSpLmgH.exe
  2⤵
  PID:12772
- C:\Windows\System\pfDJQmn.exe
  C:\Windows\System\pfDJQmn.exe
  2⤵
  PID:13100
- C:\Windows\System\kAxrUvj.exe
  C:\Windows\System\kAxrUvj.exe
  2⤵
  PID:13104
- C:\Windows\System\FSFpCjA.exe
  C:\Windows\System\FSFpCjA.exe
  2⤵
  PID:9820
- C:\Windows\System\hMWodhW.exe
  C:\Windows\System\hMWodhW.exe
  2⤵
  PID:8708
- C:\Windows\System\SkgIchX.exe
  C:\Windows\System\SkgIchX.exe
  2⤵
  PID:2920
- C:\Windows\System\BYzolBZ.exe
  C:\Windows\System\BYzolBZ.exe
  2⤵
  PID:9604
- C:\Windows\System\ygOqZsh.exe
  C:\Windows\System\ygOqZsh.exe
  2⤵
  PID:10416
- C:\Windows\System\VgVPhAd.exe
  C:\Windows\System\VgVPhAd.exe
  2⤵
  PID:5376
- C:\Windows\System\GUjORZJ.exe
  C:\Windows\System\GUjORZJ.exe
  2⤵
  PID:4844
- C:\Windows\System\PpTyEvK.exe
  C:\Windows\System\PpTyEvK.exe
  2⤵
  PID:5016
- C:\Windows\System\WKMzQHW.exe
  C:\Windows\System\WKMzQHW.exe
  2⤵
  PID:3252
- C:\Windows\System\gcUHTms.exe
  C:\Windows\System\gcUHTms.exe
  2⤵
  PID:10908
- C:\Windows\System\OURpUXM.exe
  C:\Windows\System\OURpUXM.exe
  2⤵
  PID:11228
- C:\Windows\System\hgDDodD.exe
  C:\Windows\System\hgDDodD.exe
  2⤵
  PID:7272
- C:\Windows\System\eWyLBLw.exe
  C:\Windows\System\eWyLBLw.exe
  2⤵
  PID:12428
- C:\Windows\System\oPGGcwZ.exe
  C:\Windows\System\oPGGcwZ.exe
  2⤵
  PID:12868
- C:\Windows\System\TYFlEpt.exe
  C:\Windows\System\TYFlEpt.exe
  2⤵
  PID:8020
- C:\Windows\System\kyvKGkk.exe
  C:\Windows\System\kyvKGkk.exe
  2⤵
  PID:6260
- C:\Windows\System\sJaVzmG.exe
  C:\Windows\System\sJaVzmG.exe
  2⤵
  PID:8580
- C:\Windows\System\ObPVWBf.exe
  C:\Windows\System\ObPVWBf.exe
  2⤵
  PID:11700
- C:\Windows\System\zCetTqT.exe
  C:\Windows\System\zCetTqT.exe
  2⤵
  PID:1692
- C:\Windows\System\YUteNVq.exe
  C:\Windows\System\YUteNVq.exe
  2⤵
  PID:13240
- C:\Windows\System\mHyRcVa.exe
  C:\Windows\System\mHyRcVa.exe
  2⤵
  PID:13272
- C:\Windows\System\rhucmfk.exe
  C:\Windows\System\rhucmfk.exe
  2⤵
  PID:12236
- C:\Windows\System\ccjQPAq.exe
  C:\Windows\System\ccjQPAq.exe
  2⤵
  PID:7232
- C:\Windows\System\LtYwhbx.exe
  C:\Windows\System\LtYwhbx.exe
  2⤵
  PID:10596
- C:\Windows\System\rsGVIWa.exe
  C:\Windows\System\rsGVIWa.exe
  2⤵
  PID:976
- C:\Windows\System\XpHzbmg.exe
  C:\Windows\System\XpHzbmg.exe
  2⤵
  PID:10572
- C:\Windows\System\CGZCPdE.exe
  C:\Windows\System\CGZCPdE.exe
  2⤵
  PID:12512
- C:\Windows\System\lBgsbrb.exe
  C:\Windows\System\lBgsbrb.exe
  2⤵
  PID:12928
- C:\Windows\System\BIBISKu.exe
  C:\Windows\System\BIBISKu.exe
  2⤵
  PID:11292
- C:\Windows\System\UrIEyke.exe
  C:\Windows\System\UrIEyke.exe
  2⤵
  PID:13068
- C:\Windows\System\LVFmeUU.exe
  C:\Windows\System\LVFmeUU.exe
  2⤵
  PID:12284
- C:\Windows\System\mxPrlZf.exe
  C:\Windows\System\mxPrlZf.exe
  2⤵
  PID:6988
- C:\Windows\System\lDNyNBY.exe
  C:\Windows\System\lDNyNBY.exe
  2⤵
  PID:12684
- C:\Windows\System\ADOKQga.exe
  C:\Windows\System\ADOKQga.exe
  2⤵
  PID:12128
- C:\Windows\System\WgYRcMv.exe
  C:\Windows\System\WgYRcMv.exe
  2⤵
  PID:12944
- C:\Windows\System\HBppCHC.exe
  C:\Windows\System\HBppCHC.exe
  2⤵
  PID:10928
- C:\Windows\System\ssbHIJI.exe
  C:\Windows\System\ssbHIJI.exe
  2⤵
  PID:13024
- C:\Windows\System\jefCJAC.exe
  C:\Windows\System\jefCJAC.exe
  2⤵
  PID:12796
- C:\Windows\System\iRLBshJ.exe
  C:\Windows\System\iRLBshJ.exe
  2⤵
  PID:11940
- C:\Windows\System\tUcjDZg.exe
  C:\Windows\System\tUcjDZg.exe
  2⤵
  PID:6512
- C:\Windows\System\WURIXMA.exe
  C:\Windows\System\WURIXMA.exe
  2⤵
  PID:11360
- C:\Windows\System\OZJYLof.exe
  C:\Windows\System\OZJYLof.exe
  2⤵
  PID:13196
- C:\Windows\System\pkJnwPu.exe
  C:\Windows\System\pkJnwPu.exe
  2⤵
  PID:10548
- C:\Windows\System\ZYaphQZ.exe
  C:\Windows\System\ZYaphQZ.exe
  2⤵
  PID:8640
- C:\Windows\System\nmCFspL.exe
  C:\Windows\System\nmCFspL.exe
  2⤵
  PID:2952
- C:\Windows\System\iVElvfH.exe
  C:\Windows\System\iVElvfH.exe
  2⤵
  PID:10564
- C:\Windows\System\NKFHwNh.exe
  C:\Windows\System\NKFHwNh.exe
  2⤵
  PID:9404
- C:\Windows\System\DFyUfuf.exe
  C:\Windows\System\DFyUfuf.exe
  2⤵
  PID:13332
- C:\Windows\System\BGWTfOX.exe
  C:\Windows\System\BGWTfOX.exe
  2⤵
  PID:13352
- C:\Windows\System\TyeCmhz.exe
  C:\Windows\System\TyeCmhz.exe
  2⤵
  PID:13376
- C:\Windows\System\uNSbdhb.exe
  C:\Windows\System\uNSbdhb.exe
  2⤵
  PID:13396
- C:\Windows\System\iRZzjMo.exe
  C:\Windows\System\iRZzjMo.exe
  2⤵
  PID:13416
- C:\Windows\System\jireovS.exe
  C:\Windows\System\jireovS.exe
  2⤵
  PID:13440
- C:\Windows\System\zrkcdga.exe
  C:\Windows\System\zrkcdga.exe
  2⤵
  PID:13464
- C:\Windows\System\PjlqEDj.exe
  C:\Windows\System\PjlqEDj.exe
  2⤵
  PID:13500
- C:\Windows\System\SlfwXjp.exe
  C:\Windows\System\SlfwXjp.exe
  2⤵
  PID:13520
- C:\Windows\System\EzHUGek.exe
  C:\Windows\System\EzHUGek.exe
  2⤵
  PID:13540
- C:\Windows\System\efZHKmd.exe
  C:\Windows\System\efZHKmd.exe
  2⤵
  PID:13556
- C:\Windows\System\KoHYSdb.exe
  C:\Windows\System\KoHYSdb.exe
  2⤵
  PID:13576
- C:\Windows\System\AAKxLGw.exe
  C:\Windows\System\AAKxLGw.exe
  2⤵
  PID:13600
- C:\Windows\System\GEpxOnu.exe
  C:\Windows\System\GEpxOnu.exe
  2⤵
  PID:13620
- C:\Windows\System\kjrFFeZ.exe
  C:\Windows\System\kjrFFeZ.exe
  2⤵
  PID:13640
- C:\Windows\System\svHErty.exe
  C:\Windows\System\svHErty.exe
  2⤵
  PID:13664
- C:\Windows\System\unjQVnY.exe
  C:\Windows\System\unjQVnY.exe
  2⤵
  PID:13696
- C:\Windows\System\WOHzWYo.exe
  C:\Windows\System\WOHzWYo.exe
  2⤵
  PID:13712
- C:\Windows\System\xnxLBfn.exe
  C:\Windows\System\xnxLBfn.exe
  2⤵
  PID:13736
- C:\Windows\System\LAzYWjb.exe
  C:\Windows\System\LAzYWjb.exe
  2⤵
  PID:13764
- C:\Windows\System\PdFZUlN.exe
  C:\Windows\System\PdFZUlN.exe
  2⤵
  PID:13784
- C:\Windows\System\RSZKWUZ.exe
  C:\Windows\System\RSZKWUZ.exe
  2⤵
  PID:13812
- C:\Windows\System\NVazRvZ.exe
  C:\Windows\System\NVazRvZ.exe
  2⤵
  PID:13836
- C:\Windows\System\bRaAJez.exe
  C:\Windows\System\bRaAJez.exe
  2⤵
  PID:13852
- C:\Windows\System\sgoYcpd.exe
  C:\Windows\System\sgoYcpd.exe
  2⤵
  PID:13880
- C:\Windows\System\pZdqBfO.exe
  C:\Windows\System\pZdqBfO.exe
  2⤵
  PID:13904
- C:\Windows\System\TJVgeTj.exe
  C:\Windows\System\TJVgeTj.exe
  2⤵
  PID:13920
- C:\Windows\System\cXSwFFj.exe
  C:\Windows\System\cXSwFFj.exe
  2⤵
  PID:13944
- C:\Windows\System\ExadCLg.exe
  C:\Windows\System\ExadCLg.exe
  2⤵
  PID:13968
- C:\Windows\System\AQTSjRl.exe
  C:\Windows\System\AQTSjRl.exe
  2⤵
  PID:13996
- C:\Windows\System\gZppcNk.exe
  C:\Windows\System\gZppcNk.exe
  2⤵
  PID:14016
- C:\Windows\System\ULnzNdU.exe
  C:\Windows\System\ULnzNdU.exe
  2⤵
  PID:14044
- C:\Windows\System\DhrpdHH.exe
  C:\Windows\System\DhrpdHH.exe
  2⤵
  PID:14064
- C:\Windows\System\ChozuKy.exe
  C:\Windows\System\ChozuKy.exe
  2⤵
  PID:14088
- C:\Windows\System\dZIteEU.exe
  C:\Windows\System\dZIteEU.exe
  2⤵
  PID:2632
- C:\Windows\System\cOtEVlh.exe
  C:\Windows\System\cOtEVlh.exe
  2⤵
  PID:11592
- C:\Windows\System\BbVXhHW.exe
  C:\Windows\System\BbVXhHW.exe
  2⤵
  PID:8960
- C:\Windows\System\wuhVIrs.exe
  C:\Windows\System\wuhVIrs.exe
  2⤵
  PID:12732
- C:\Windows\System\yEqqPoI.exe
  C:\Windows\System\yEqqPoI.exe
  2⤵
  PID:13152
- C:\Windows\System\ZzOdrQr.exe
  C:\Windows\System\ZzOdrQr.exe
  2⤵
  PID:13448
- C:\Windows\System\DwriRTN.exe
  C:\Windows\System\DwriRTN.exe
  2⤵
  PID:13508
- C:\Windows\System\mXGQmVK.exe
  C:\Windows\System\mXGQmVK.exe
  2⤵
  PID:11612
- C:\Windows\System\WhjoMZx.exe
  C:\Windows\System\WhjoMZx.exe
  2⤵
  PID:14036
- C:\Windows\System\SkdzIEr.exe
  C:\Windows\System\SkdzIEr.exe
  2⤵
  PID:14176
- C:\Windows\System\CWaBqaB.exe
  C:\Windows\System\CWaBqaB.exe
  2⤵
  PID:14204
- C:\Windows\System\MLEDJWm.exe
  C:\Windows\System\MLEDJWm.exe
  2⤵
  PID:4080
- C:\Windows\System\ixYnTQC.exe
  C:\Windows\System\ixYnTQC.exe
  2⤵
  PID:3876
- C:\Windows\System\ZmUeWAR.exe
  C:\Windows\System\ZmUeWAR.exe
  2⤵
  PID:13384
- C:\Windows\System\WWdOGHF.exe
  C:\Windows\System\WWdOGHF.exe
  2⤵
  PID:14116
- C:\Windows\System\QEvUvNU.exe
  C:\Windows\System\QEvUvNU.exe
  2⤵
  PID:9796
- C:\Windows\System\KMvVFFe.exe
  C:\Windows\System\KMvVFFe.exe
  2⤵
  PID:13392
- C:\Windows\System\XSSBLPf.exe
  C:\Windows\System\XSSBLPf.exe
  2⤵
  PID:12644
- C:\Windows\System\TzDlgtx.exe
  C:\Windows\System\TzDlgtx.exe
  2⤵
  PID:8516
- C:\Windows\System\qabPjAP.exe
  C:\Windows\System\qabPjAP.exe
  2⤵
  PID:14124
- C:\Windows\System\XWbPJib.exe
  C:\Windows\System\XWbPJib.exe
  2⤵
  PID:14184
- C:\Windows\System\ZZunOrr.exe
  C:\Windows\System\ZZunOrr.exe
  2⤵
  PID:11944
- C:\Windows\System\QCGhJUa.exe
  C:\Windows\System\QCGhJUa.exe
  2⤵
  PID:9728
- C:\Windows\System\kfjLJtb.exe
  C:\Windows\System\kfjLJtb.exe
  2⤵
  PID:13952
- C:\Windows\System\sTWvPSY.exe
  C:\Windows\System\sTWvPSY.exe
  2⤵
  PID:13916
- C:\Windows\System\xIBHVmR.exe
  C:\Windows\System\xIBHVmR.exe
  2⤵
  PID:9424
- C:\Windows\System\qSYJwEo.exe
  C:\Windows\System\qSYJwEo.exe
  2⤵
  PID:13592
- C:\Windows\System\OtUssDX.exe
  C:\Windows\System\OtUssDX.exe
  2⤵
  PID:14220
- C:\Windows\System\MJqkPCn.exe
  C:\Windows\System\MJqkPCn.exe
  2⤵
  PID:13760
- C:\Windows\System\AiVgXtr.exe
  C:\Windows\System\AiVgXtr.exe
  2⤵
  PID:13548
- C:\Windows\System\ExTVrwe.exe
  C:\Windows\System\ExTVrwe.exe
  2⤵
  PID:13888
- C:\Windows\System\KcYeHBG.exe
  C:\Windows\System\KcYeHBG.exe
  2⤵
  PID:14148
- C:\Windows\System\HdCCmqz.exe
  C:\Windows\System\HdCCmqz.exe
  2⤵
  PID:12316
- C:\Windows\System\ZzIVETU.exe
  C:\Windows\System\ZzIVETU.exe
  2⤵
  PID:13492
- C:\Windows\System\PseintL.exe
  C:\Windows\System\PseintL.exe
  2⤵
  PID:4304
- C:\Windows\System\qkkAPNt.exe
  C:\Windows\System\qkkAPNt.exe
  2⤵
  PID:13672
- C:\Windows\System\mJqNQRL.exe
  C:\Windows\System\mJqNQRL.exe
  2⤵
  PID:3576
- C:\Windows\System\CypohhX.exe
  C:\Windows\System\CypohhX.exe
  2⤵
  PID:5392
- C:\Windows\System\TraHhuy.exe
  C:\Windows\System\TraHhuy.exe
  2⤵
  PID:13324
- C:\Windows\System\ZdEHNMZ.exe
  C:\Windows\System\ZdEHNMZ.exe
  2⤵
  PID:10436
- C:\Windows\System\gFVmZBE.exe
  C:\Windows\System\gFVmZBE.exe
  2⤵
  PID:3120
- C:\Windows\System\ObcqfjJ.exe
  C:\Windows\System\ObcqfjJ.exe
  2⤵
  PID:4436
- C:\Windows\System\WMbjMYU.exe
  C:\Windows\System\WMbjMYU.exe
  2⤵
  PID:13348
- C:\Windows\System\SoNJmCf.exe
  C:\Windows\System\SoNJmCf.exe
  2⤵
  PID:14152
- C:\Windows\System\VbIaUkF.exe
  C:\Windows\System\VbIaUkF.exe
  2⤵
  PID:14260
- C:\Windows\System\DaADXWd.exe
  C:\Windows\System\DaADXWd.exe
  2⤵
  PID:4616
- C:\Windows\System\uZGyBhD.exe
  C:\Windows\System\uZGyBhD.exe
  2⤵
  PID:11844
- C:\Windows\System\FpsYmyH.exe
  C:\Windows\System\FpsYmyH.exe
  2⤵
  PID:3936
- C:\Windows\System\ypDymcx.exe
  C:\Windows\System\ypDymcx.exe
  2⤵
  PID:13608
- C:\Windows\System\VHWsixK.exe
  C:\Windows\System\VHWsixK.exe
  2⤵
  PID:5332
- C:\Windows\System\qbbUbZH.exe
  C:\Windows\System\qbbUbZH.exe
  2⤵
  PID:5348
- C:\Windows\System\dVZUqUG.exe
  C:\Windows\System\dVZUqUG.exe
  2⤵
  PID:208
- C:\Windows\System\gpFWkSg.exe
  C:\Windows\System\gpFWkSg.exe
  2⤵
  PID:1120
- C:\Windows\System\XyFikxX.exe
  C:\Windows\System\XyFikxX.exe
  2⤵
  PID:14056
- C:\Windows\System\lolixjB.exe
  C:\Windows\System\lolixjB.exe
  2⤵
  PID:1144
- C:\Windows\System\PrugiSZ.exe
  C:\Windows\System\PrugiSZ.exe
  2⤵
  PID:1516
- C:\Windows\System\iBAAClK.exe
  C:\Windows\System\iBAAClK.exe
  2⤵
  PID:13652
- C:\Windows\System\GqrBKCx.exe
  C:\Windows\System\GqrBKCx.exe
  2⤵
  PID:4012
- C:\Windows\System\IBYIPlU.exe
  C:\Windows\System\IBYIPlU.exe
  2⤵
  PID:3988
- C:\Windows\System\MoyoSmu.exe
  C:\Windows\System\MoyoSmu.exe
  2⤵
  PID:3280
- C:\Windows\System\ZNOHbZA.exe
  C:\Windows\System\ZNOHbZA.exe
  2⤵
  PID:3260
- C:\Windows\System\FVKoLKq.exe
  C:\Windows\System\FVKoLKq.exe
  2⤵
  PID:3264
- C:\Windows\System\BNQEVsG.exe
  C:\Windows\System\BNQEVsG.exe
  2⤵
  PID:12988
- C:\Windows\System\ouqVjLj.exe
  C:\Windows\System\ouqVjLj.exe
  2⤵
  PID:2852
- C:\Windows\System\gaZEanV.exe
  C:\Windows\System\gaZEanV.exe
  2⤵
  PID:3868
- C:\Windows\System\dilUlUU.exe
  C:\Windows\System\dilUlUU.exe
  2⤵
  PID:1508
- C:\Windows\System\qwvIcMt.exe
  C:\Windows\System\qwvIcMt.exe
  2⤵
  PID:14108
- C:\Windows\System\ulTdSqu.exe
  C:\Windows\System\ulTdSqu.exe
  2⤵
  PID:4576
- C:\Windows\System\RISfFDz.exe
  C:\Windows\System\RISfFDz.exe
  2⤵
  PID:4216
- C:\Windows\System\kUtyPiH.exe
  C:\Windows\System\kUtyPiH.exe
  2⤵
  PID:4832
- C:\Windows\System\YRzAjYP.exe
  C:\Windows\System\YRzAjYP.exe
  2⤵
  PID:14312
- C:\Windows\System\yAItwMh.exe
  C:\Windows\System\yAItwMh.exe
  2⤵
  PID:13632
- C:\Windows\System\InEutBC.exe
  C:\Windows\System\InEutBC.exe
  2⤵
  PID:3284
- C:\Windows\System\eoMJXAH.exe
  C:\Windows\System\eoMJXAH.exe
  2⤵
  PID:4532
- C:\Windows\System\udmFJMs.exe
  C:\Windows\System\udmFJMs.exe
  2⤵
  PID:3212
- C:\Windows\System\pyMKFEF.exe
  C:\Windows\System\pyMKFEF.exe
  2⤵
  PID:4972
- C:\Windows\System\lCvKctk.exe
  C:\Windows\System\lCvKctk.exe
  2⤵
  PID:1928
- C:\Windows\System\yNIicVU.exe
  C:\Windows\System\yNIicVU.exe
  2⤵
  PID:13820
- C:\Windows\System\fAUtRRm.exe
  C:\Windows\System\fAUtRRm.exe
  2⤵
  PID:2416
- C:\Windows\System\MILRrBg.exe
  C:\Windows\System\MILRrBg.exe
  2⤵
  PID:4024
- C:\Windows\System\TCJQQRW.exe
  C:\Windows\System\TCJQQRW.exe
  2⤵
  PID:4048
- C:\Windows\System\afyoFHZ.exe
  C:\Windows\System\afyoFHZ.exe
  2⤵
  PID:3636
- C:\Windows\System\vsrGViV.exe
  C:\Windows\System\vsrGViV.exe
  2⤵
  PID:3972
- C:\Windows\System\RBWHQGI.exe
  C:\Windows\System\RBWHQGI.exe
  2⤵
  PID:4112
- C:\Windows\System\RGSnjvv.exe
  C:\Windows\System\RGSnjvv.exe
  2⤵
  PID:3960
- C:\Windows\System\tcmausI.exe
  C:\Windows\System\tcmausI.exe
  2⤵
  PID:3956
- C:\Windows\System\uTmEAQp.exe
  C:\Windows\System\uTmEAQp.exe
  2⤵
  PID:3496
- C:\Windows\System\VDDbdNf.exe
  C:\Windows\System\VDDbdNf.exe
  2⤵
  PID:4948
- C:\Windows\System\LYATiOB.exe
  C:\Windows\System\LYATiOB.exe
  2⤵
  PID:3664
- C:\Windows\System\LMkhOxZ.exe
  C:\Windows\System\LMkhOxZ.exe
  2⤵
  PID:232
- C:\Windows\System\FTWCzPj.exe
  C:\Windows\System\FTWCzPj.exe
  2⤵
  PID:3248
- C:\Windows\System\iaiEYXm.exe
  C:\Windows\System\iaiEYXm.exe
  2⤵
  PID:4768
- C:\Windows\System\dseJtpR.exe
  C:\Windows\System\dseJtpR.exe
  2⤵
  PID:1408
- C:\Windows\System\Umgyarf.exe
  C:\Windows\System\Umgyarf.exe
  2⤵
  PID:4952
- C:\Windows\System\CatJAIR.exe
  C:\Windows\System\CatJAIR.exe
  2⤵
  PID:748
- C:\Windows\System\mFMFEKL.exe
  C:\Windows\System\mFMFEKL.exe
  2⤵
  PID:2904
- C:\Windows\System\imyqoTR.exe
  C:\Windows\System\imyqoTR.exe
  2⤵
  PID:4368
- C:\Windows\System\AmhrnQG.exe
  C:\Windows\System\AmhrnQG.exe
  2⤵
  PID:14340
- C:\Windows\System\khvITUu.exe
  C:\Windows\System\khvITUu.exe
  2⤵
  PID:14584
- C:\Windows\System\uwfJftk.exe
  C:\Windows\System\uwfJftk.exe
  2⤵
  PID:14668
- C:\Windows\System\ZenGIjY.exe
  C:\Windows\System\ZenGIjY.exe
  2⤵
  PID:14732
- C:\Windows\System\iygWLGl.exe
  C:\Windows\System\iygWLGl.exe
  2⤵
  PID:14748
- C:\Windows\System\jKYYTOw.exe
  C:\Windows\System\jKYYTOw.exe
  2⤵
  PID:14764
- C:\Windows\System\JzwagTG.exe
  C:\Windows\System\JzwagTG.exe
  2⤵
  PID:14780
- C:\Windows\System\bPAFBxg.exe
  C:\Windows\System\bPAFBxg.exe
  2⤵
  PID:14796
- C:\Windows\System\POqZEAs.exe
  C:\Windows\System\POqZEAs.exe
  2⤵
  PID:14812
- C:\Windows\System\JCuchLG.exe
  C:\Windows\System\JCuchLG.exe
  2⤵
  PID:14828
- C:\Windows\System\IKYYEXa.exe
  C:\Windows\System\IKYYEXa.exe
  2⤵
  PID:14848
- C:\Windows\System\RyiOAvn.exe
  C:\Windows\System\RyiOAvn.exe
  2⤵
  PID:14876
- C:\Windows\System\EAKQTck.exe
  C:\Windows\System\EAKQTck.exe
  2⤵
  PID:14896
- C:\Windows\System\CKpiNPh.exe
  C:\Windows\System\CKpiNPh.exe
  2⤵
  PID:14916
- C:\Windows\System\ldzYaMf.exe
  C:\Windows\System\ldzYaMf.exe
  2⤵
  PID:14936
- C:\Windows\System\rFTxzHn.exe
  C:\Windows\System\rFTxzHn.exe
  2⤵
  PID:14972
- C:\Windows\System\QsgasPb.exe
  C:\Windows\System\QsgasPb.exe
  2⤵
  PID:15000
- C:\Windows\System\AYBnHNN.exe
  C:\Windows\System\AYBnHNN.exe
  2⤵
  PID:15080
- C:\Windows\System\eEDHVZv.exe
  C:\Windows\System\eEDHVZv.exe
  2⤵
  PID:15112
- C:\Windows\System\eVVwkTK.exe
  C:\Windows\System\eVVwkTK.exe
  2⤵
  PID:15156
- C:\Windows\System\PDaIScz.exe
  C:\Windows\System\PDaIScz.exe
  2⤵
  PID:15176
- C:\Windows\System\mwKMiLI.exe
  C:\Windows\System\mwKMiLI.exe
  2⤵
  PID:15212
- C:\Windows\System\LjGamrd.exe
  C:\Windows\System\LjGamrd.exe
  2⤵
  PID:15240
- C:\Windows\System\PWpPCZE.exe
  C:\Windows\System\PWpPCZE.exe
  2⤵
  PID:15272
- C:\Windows\System\rPyVzuE.exe
  C:\Windows\System\rPyVzuE.exe
  2⤵
  PID:15292
- C:\Windows\System\qLalIMl.exe
  C:\Windows\System\qLalIMl.exe
  2⤵
  PID:15320
- C:\Windows\System\laXomiG.exe
  C:\Windows\System\laXomiG.exe
  2⤵
  PID:15348
- C:\Windows\System\gYxFLRO.exe
  C:\Windows\System\gYxFLRO.exe
  2⤵
  PID:3068
- C:\Windows\System\fMNqumC.exe
  C:\Windows\System\fMNqumC.exe
  2⤵
  PID:3444
- C:\Windows\System\BgACdwc.exe
  C:\Windows\System\BgACdwc.exe
  2⤵
  PID:14356
- C:\Windows\System\FyMUvfc.exe
  C:\Windows\System\FyMUvfc.exe
  2⤵
  PID:14376
- C:\Windows\System\QRoRZQX.exe
  C:\Windows\System\QRoRZQX.exe
  2⤵
  PID:436
- C:\Windows\System\RlTPora.exe
  C:\Windows\System\RlTPora.exe
  2⤵
  PID:1140
- C:\Windows\System\mHYLRNc.exe
  C:\Windows\System\mHYLRNc.exe
  2⤵
  PID:13848
- C:\Windows\System\cnnadkZ.exe
  C:\Windows\System\cnnadkZ.exe
  2⤵
  PID:7400
- C:\Windows\System\hBHwkLN.exe
  C:\Windows\System\hBHwkLN.exe
  2⤵
  PID:3600
- C:\Windows\System\mAkgJKR.exe
  C:\Windows\System\mAkgJKR.exe
  2⤵
  PID:14460
- C:\Windows\System\hfrrNLc.exe
  C:\Windows\System\hfrrNLc.exe
  2⤵
  PID:5256
- C:\Windows\System\ZsELtWn.exe
  C:\Windows\System\ZsELtWn.exe
  2⤵
  PID:4596
- C:\Windows\System\zwbFhuL.exe
  C:\Windows\System\zwbFhuL.exe
  2⤵
  PID:5192
- C:\Windows\System\SJYZVZr.exe
  C:\Windows\System\SJYZVZr.exe
  2⤵
  PID:5012
- C:\Windows\System\orNTYib.exe
  C:\Windows\System\orNTYib.exe
  2⤵
  PID:5104
- C:\Windows\System\yjRdEhD.exe
  C:\Windows\System\yjRdEhD.exe
  2⤵
  PID:2676
- C:\Windows\System\QLXoKsx.exe
  C:\Windows\System\QLXoKsx.exe
  2⤵
  PID:4508
- C:\Windows\System\CgevmpA.exe
  C:\Windows\System\CgevmpA.exe
  2⤵
  PID:2340
- C:\Windows\System\MVfMxhL.exe
  C:\Windows\System\MVfMxhL.exe
  2⤵
  PID:3156
- C:\Windows\System\aPMCNWS.exe
  C:\Windows\System\aPMCNWS.exe
  2⤵
  PID:14548
- C:\Windows\System\kplZddg.exe
  C:\Windows\System\kplZddg.exe
  2⤵
  PID:14564
- C:\Windows\System\vIvYvzO.exe
  C:\Windows\System\vIvYvzO.exe
  2⤵
  PID:14576
- C:\Windows\System\Doklycc.exe
  C:\Windows\System\Doklycc.exe
  2⤵
  PID:14624
- C:\Windows\System\AjTVvrv.exe
  C:\Windows\System\AjTVvrv.exe
  2⤵
  PID:14680
- C:\Windows\System\NITzVyQ.exe
  C:\Windows\System\NITzVyQ.exe
  2⤵
  PID:14792
- C:\Windows\System\utZxzld.exe
  C:\Windows\System\utZxzld.exe
  2⤵
  PID:14724
- C:\Windows\System\ckvyJVB.exe
  C:\Windows\System\ckvyJVB.exe
  2⤵
  PID:14856
- C:\Windows\System\GCkuIzb.exe
  C:\Windows\System\GCkuIzb.exe
  2⤵
  PID:15076
- C:\Windows\System\yXbGvhk.exe
  C:\Windows\System\yXbGvhk.exe
  2⤵
  PID:15140
- C:\Windows\System\sCHbtHL.exe
  C:\Windows\System\sCHbtHL.exe
  2⤵
  PID:15280
- C:\Windows\System\SmTcDLM.exe
  C:\Windows\System\SmTcDLM.exe
  2⤵
  PID:4976
- C:\Windows\System\AZSoKLp.exe
  C:\Windows\System\AZSoKLp.exe
  2⤵
  PID:14932
- C:\Windows\System\PlkuRxm.exe
  C:\Windows\System\PlkuRxm.exe
  2⤵
  PID:396
- C:\Windows\System\fVGnUyg.exe
  C:\Windows\System\fVGnUyg.exe
  2⤵
  PID:7196
- C:\Windows\System\RmqyUZC.exe
  C:\Windows\System\RmqyUZC.exe
  2⤵
  PID:15260
- C:\Windows\System\IgQVwMi.exe
  C:\Windows\System\IgQVwMi.exe
  2⤵
  PID:4448
- C:\Windows\System\yYNMiDs.exe
  C:\Windows\System\yYNMiDs.exe
  2⤵
  PID:1776
- C:\Windows\System\zZoNnat.exe
  C:\Windows\System\zZoNnat.exe
  2⤵
  PID:2592
- C:\Windows\System\tGPlErg.exe
  C:\Windows\System\tGPlErg.exe
  2⤵
  PID:14572
- C:\Windows\System\izTnLQt.exe
  C:\Windows\System\izTnLQt.exe
  2⤵
  PID:5752
- C:\Windows\System\OJtRNdi.exe
  C:\Windows\System\OJtRNdi.exe
  2⤵
  PID:5800
- C:\Windows\System\dtxvShw.exe
  C:\Windows\System\dtxvShw.exe
  2⤵
  PID:14620
- C:\Windows\System\WAOKwpn.exe
  C:\Windows\System\WAOKwpn.exe
  2⤵
  PID:14552
- C:\Windows\System\yxMeZIB.exe
  C:\Windows\System\yxMeZIB.exe
  2⤵
  PID:14728
- C:\Windows\System\JglYyJo.exe
  C:\Windows\System\JglYyJo.exe
  2⤵
  PID:14804
- C:\Windows\System\qUlcYoO.exe
  C:\Windows\System\qUlcYoO.exe
  2⤵
  PID:1896
- C:\Windows\System\oysoxcz.exe
  C:\Windows\System\oysoxcz.exe
  2⤵
  PID:14944
- C:\Windows\System\PBEVBiC.exe
  C:\Windows\System\PBEVBiC.exe
  2⤵
  PID:1184
- C:\Windows\System\rHLzQTx.exe
  C:\Windows\System\rHLzQTx.exe
  2⤵
  PID:14912
- C:\Windows\System\MRwsonj.exe
  C:\Windows\System\MRwsonj.exe
  2⤵
  PID:5220
- C:\Windows\System\zzdBOsA.exe
  C:\Windows\System\zzdBOsA.exe
  2⤵
  PID:2880
- C:\Windows\System\wxZMfHG.exe
  C:\Windows\System\wxZMfHG.exe
  2⤵
  PID:3640
- C:\Windows\System\HdEOEAK.exe
  C:\Windows\System\HdEOEAK.exe
  2⤵
  PID:4276
- C:\Windows\System\qaTzWVa.exe
  C:\Windows\System\qaTzWVa.exe
  2⤵
  PID:5448
- C:\Windows\System\KOllRQj.exe
  C:\Windows\System\KOllRQj.exe
  2⤵
  PID:5772
- C:\Windows\System\pfJGKsl.exe
  C:\Windows\System\pfJGKsl.exe
  2⤵
  PID:1236
- C:\Windows\System\kcsagFz.exe
  C:\Windows\System\kcsagFz.exe
  2⤵
  PID:4204
- C:\Windows\System\xjkQSWX.exe
  C:\Windows\System\xjkQSWX.exe
  2⤵
  PID:6100
- C:\Windows\System\OeHpKtr.exe
  C:\Windows\System\OeHpKtr.exe
  2⤵
  PID:1820
- C:\Windows\System\WGgmLCL.exe
  C:\Windows\System\WGgmLCL.exe
  2⤵
  PID:6288
- C:\Windows\System\XBTRVrM.exe
  C:\Windows\System\XBTRVrM.exe
  2⤵
  PID:5808
- C:\Windows\System\vbJmigU.exe
  C:\Windows\System\vbJmigU.exe
  2⤵
  PID:5136
- C:\Windows\System\XZDZOkk.exe
  C:\Windows\System\XZDZOkk.exe
  2⤵
  PID:5952
- C:\Windows\System\uUmzbkW.exe
  C:\Windows\System\uUmzbkW.exe
  2⤵
  PID:1976
- C:\Windows\System\bsaCPGt.exe
  C:\Windows\System\bsaCPGt.exe
  2⤵
  PID:5988
- C:\Windows\System\OdAhPuy.exe
  C:\Windows\System\OdAhPuy.exe
  2⤵
  PID:6552
- C:\Windows\System\FvpWGCz.exe
  C:\Windows\System\FvpWGCz.exe
  2⤵
  PID:6072
- C:\Windows\System\Yqafncb.exe
  C:\Windows\System\Yqafncb.exe
  2⤵
  PID:6280
- C:\Windows\System\nfekXSa.exe
  C:\Windows\System\nfekXSa.exe
  2⤵
  PID:6676
- C:\Windows\System\CocNFwa.exe
  C:\Windows\System\CocNFwa.exe
  2⤵
  PID:6432
- C:\Windows\System\qObTLpc.exe
  C:\Windows\System\qObTLpc.exe
  2⤵
  PID:6732
- C:\Windows\System\KUNuWYA.exe
  C:\Windows\System\KUNuWYA.exe
  2⤵
  PID:3124
- C:\Windows\System\XjbJdCT.exe
  C:\Windows\System\XjbJdCT.exe
  2⤵
  PID:3520
- C:\Windows\System\NMLTpFF.exe
  C:\Windows\System\NMLTpFF.exe
  2⤵
  PID:15192
- C:\Windows\System\oitOtum.exe
  C:\Windows\System\oitOtum.exe
  2⤵
  PID:14420
- C:\Windows\System\GIcQHcy.exe
  C:\Windows\System\GIcQHcy.exe
  2⤵
  PID:6928
- C:\Windows\System\LrLARtQ.exe
  C:\Windows\System\LrLARtQ.exe
  2⤵
  PID:5564
- C:\Windows\System\fcdAyFp.exe
  C:\Windows\System\fcdAyFp.exe
  2⤵
  PID:7548
- C:\Windows\System\xYwEDqt.exe
  C:\Windows\System\xYwEDqt.exe
  2⤵
  PID:1060
- C:\Windows\System\kETVUOT.exe
  C:\Windows\System\kETVUOT.exe
  2⤵
  PID:7760
- C:\Windows\System\oVKduSR.exe
  C:\Windows\System\oVKduSR.exe
  2⤵
  PID:7772
- C:\Windows\System\KaTDBGj.exe
  C:\Windows\System\KaTDBGj.exe
  2⤵
  PID:1192
- C:\Windows\System\PAOzeWw.exe
  C:\Windows\System\PAOzeWw.exe
  2⤵
  PID:1160
- C:\Windows\System\lNILnTG.exe
  C:\Windows\System\lNILnTG.exe
  2⤵
  PID:14524
- C:\Windows\System\qwVWAuV.exe
  C:\Windows\System\qwVWAuV.exe
  2⤵
  PID:5876
- C:\Windows\System\rStblGr.exe
  C:\Windows\System\rStblGr.exe
  2⤵
  PID:14684
- C:\Windows\System\jfKtzWy.exe
  C:\Windows\System\jfKtzWy.exe
  2⤵
  PID:6520
- C:\Windows\System\TpmOKso.exe
  C:\Windows\System\TpmOKso.exe
  2⤵
  PID:7724
- C:\Windows\System\VYLZApJ.exe
  C:\Windows\System\VYLZApJ.exe
  2⤵
  PID:64
- C:\Windows\System\PgJuraG.exe
  C:\Windows\System\PgJuraG.exe
  2⤵
  PID:15032
- C:\Windows\System\JkeYLLQ.exe
  C:\Windows\System\JkeYLLQ.exe
  2⤵
  PID:6776
- C:\Windows\System\uHeovdk.exe
  C:\Windows\System\uHeovdk.exe
  2⤵
  PID:15316
- C:\Windows\System\xzbSEhf.exe
  C:\Windows\System\xzbSEhf.exe
  2⤵
  PID:4904
- C:\Windows\System\bybXuCa.exe
  C:\Windows\System\bybXuCa.exe
  2⤵
  PID:6304
- C:\Windows\System\TQUVfcA.exe
  C:\Windows\System\TQUVfcA.exe
  2⤵
  PID:5844
- C:\Windows\System\BWlabRk.exe
  C:\Windows\System\BWlabRk.exe
  2⤵
  PID:7688
- C:\Windows\System\cldVoSJ.exe
  C:\Windows\System\cldVoSJ.exe
  2⤵
  PID:8952
- C:\Windows\System\ggtkMeZ.exe
  C:\Windows\System\ggtkMeZ.exe
  2⤵
  PID:7528
- C:\Windows\System\cxBbFrf.exe
  C:\Windows\System\cxBbFrf.exe
  2⤵
  PID:1012
- C:\Windows\System\DcImnQz.exe
  C:\Windows\System\DcImnQz.exe
  2⤵
  PID:8460
- C:\Windows\System\UlOvgiG.exe
  C:\Windows\System\UlOvgiG.exe
  2⤵
  PID:14504
- C:\Windows\System\qWMSfQm.exe
  C:\Windows\System\qWMSfQm.exe
  2⤵
  PID:9268
- C:\Windows\System\XpxKgAJ.exe
  C:\Windows\System\XpxKgAJ.exe
  2⤵
  PID:9344
- C:\Windows\System\SfInebC.exe
  C:\Windows\System\SfInebC.exe
  2⤵
  PID:14640
- C:\Windows\System\UXUXsgd.exe
  C:\Windows\System\UXUXsgd.exe
  2⤵
  PID:5904
- C:\Windows\System\HzcsFCh.exe
  C:\Windows\System\HzcsFCh.exe
  2⤵
  PID:8992
- C:\Windows\System\pgyQkfS.exe
  C:\Windows\System\pgyQkfS.exe
  2⤵
  PID:9756
- C:\Windows\System\hBvBxHx.exe
  C:\Windows\System\hBvBxHx.exe
  2⤵
  PID:6064
- C:\Windows\System\gIvgZEV.exe
  C:\Windows\System\gIvgZEV.exe
  2⤵
  PID:7256
- C:\Windows\System\bfRYFPU.exe
  C:\Windows\System\bfRYFPU.exe
  2⤵
  PID:6672
- C:\Windows\System\WzTSMlU.exe
  C:\Windows\System\WzTSMlU.exe
  2⤵
  PID:7492
- C:\Windows\System\vkMXgDU.exe
  C:\Windows\System\vkMXgDU.exe
  2⤵
  PID:9924
- C:\Windows\System\dAfpmyO.exe
  C:\Windows\System\dAfpmyO.exe
  2⤵
  PID:6508
- C:\Windows\System\ewThvDa.exe
  C:\Windows\System\ewThvDa.exe
  2⤵
  PID:5520
- C:\Windows\System\XrSMRLJ.exe
  C:\Windows\System\XrSMRLJ.exe
  2⤵
  PID:9504
- C:\Windows\System\QniBXiS.exe
  C:\Windows\System\QniBXiS.exe
  2⤵
  PID:9068
- C:\Windows\System\MsKdwOE.exe
  C:\Windows\System\MsKdwOE.exe
  2⤵
  PID:10300
- C:\Windows\System\TLQSLoL.exe
  C:\Windows\System\TLQSLoL.exe
  2⤵
  PID:14464
- C:\Windows\System\hhCrhSP.exe
  C:\Windows\System\hhCrhSP.exe
  2⤵
  PID:10348
- C:\Windows\System\DEjcvJB.exe
  C:\Windows\System\DEjcvJB.exe
  2⤵
  PID:7596
- C:\Windows\System\yAWqeZS.exe
  C:\Windows\System\yAWqeZS.exe
  2⤵
  PID:8388
- C:\Windows\System\peQEids.exe
  C:\Windows\System\peQEids.exe
  2⤵
  PID:9840
- C:\Windows\System\VEtKxEY.exe
  C:\Windows\System\VEtKxEY.exe
  2⤵
  PID:5444
- C:\Windows\System\WkmMGWF.exe
  C:\Windows\System\WkmMGWF.exe
  2⤵
  PID:10124
- C:\Windows\System\tpywCoA.exe
  C:\Windows\System\tpywCoA.exe
  2⤵
  PID:9472
- C:\Windows\System\YLbjSPe.exe
  C:\Windows\System\YLbjSPe.exe
  2⤵
  PID:8760
- C:\Windows\System\zcfwdaA.exe
  C:\Windows\System\zcfwdaA.exe
  2⤵
  PID:9324
- C:\Windows\System\UzGealy.exe
  C:\Windows\System\UzGealy.exe
  2⤵
  PID:8236
- C:\Windows\System\rVrRmuM.exe
  C:\Windows\System\rVrRmuM.exe
  2⤵
  PID:7568
- C:\Windows\System\jiVDcFV.exe
  C:\Windows\System\jiVDcFV.exe
  2⤵
  PID:9532
- C:\Windows\System\mRmpStr.exe
  C:\Windows\System\mRmpStr.exe
  2⤵
  PID:6352
- C:\Windows\System\YVcmpYr.exe
  C:\Windows\System\YVcmpYr.exe
  2⤵
  PID:7636
- C:\Windows\System\hSMMTlD.exe
  C:\Windows\System\hSMMTlD.exe
  2⤵
  PID:10272
- C:\Windows\System\JboDukh.exe
  C:\Windows\System\JboDukh.exe
  2⤵
  PID:3384
- C:\Windows\System\MshJQWI.exe
  C:\Windows\System\MshJQWI.exe
  2⤵
  PID:9284
- C:\Windows\System\IQIRBNJ.exe
  C:\Windows\System\IQIRBNJ.exe
  2⤵
  PID:11800
- C:\Windows\System\XxJlbZJ.exe
  C:\Windows\System\XxJlbZJ.exe
  2⤵
  PID:9408
- C:\Windows\System\BqlvYvP.exe
  C:\Windows\System\BqlvYvP.exe
  2⤵
  PID:10544
- C:\Windows\System\ynhoSNm.exe
  C:\Windows\System\ynhoSNm.exe
  2⤵
  PID:12016
- C:\Windows\System\ZmCboNk.exe
  C:\Windows\System\ZmCboNk.exe
  2⤵
  PID:9400
- C:\Windows\System\ZCwrcOx.exe
  C:\Windows\System\ZCwrcOx.exe
  2⤵
  PID:10920
- C:\Windows\System\WKatqgm.exe
  C:\Windows\System\WKatqgm.exe
  2⤵
  PID:9660
- C:\Windows\System\tqnttQK.exe
  C:\Windows\System\tqnttQK.exe
  2⤵
  PID:10284
- C:\Windows\System\ERRXlKA.exe
  C:\Windows\System\ERRXlKA.exe
  2⤵
  PID:10964
- C:\Windows\System\dfizRov.exe
  C:\Windows\System\dfizRov.exe
  2⤵
  PID:9764
- C:\Windows\System\tYXOyWo.exe
  C:\Windows\System\tYXOyWo.exe
  2⤵
  PID:6808
- C:\Windows\System\EXBQgaw.exe
  C:\Windows\System\EXBQgaw.exe
  2⤵
  PID:10848
- C:\Windows\System\rPTjCPU.exe
  C:\Windows\System\rPTjCPU.exe
  2⤵
  PID:6132
- C:\Windows\System\vZIGxTa.exe
  C:\Windows\System\vZIGxTa.exe
  2⤵
  PID:5252
- C:\Windows\System\YgCCHrl.exe
  C:\Windows\System\YgCCHrl.exe
  2⤵
  PID:8008
- C:\Windows\System\ytYoUbv.exe
  C:\Windows\System\ytYoUbv.exe
  2⤵
  PID:10128
- C:\Windows\System\szOsWHQ.exe
  C:\Windows\System\szOsWHQ.exe
  2⤵
  PID:11516
- C:\Windows\System\ZnOwpyj.exe
  C:\Windows\System\ZnOwpyj.exe
  2⤵
  PID:11588
- C:\Windows\System\hrAdjae.exe
  C:\Windows\System\hrAdjae.exe
  2⤵
  PID:5228
- C:\Windows\System\MThRHdW.exe
  C:\Windows\System\MThRHdW.exe
  2⤵
  PID:13208
- C:\Windows\System\GjQafwr.exe
  C:\Windows\System\GjQafwr.exe
  2⤵
  PID:7612
- C:\Windows\System\BQUrbcT.exe
  C:\Windows\System\BQUrbcT.exe
  2⤵
  PID:6984
- C:\Windows\System\qpaetSE.exe
  C:\Windows\System\qpaetSE.exe
  2⤵
  PID:6428
- C:\Windows\System\yKIYSEs.exe
  C:\Windows\System\yKIYSEs.exe
  2⤵
  PID:12148
- C:\Windows\System\DXyucFK.exe
  C:\Windows\System\DXyucFK.exe
  2⤵
  PID:3908
- C:\Windows\System\kveUEEe.exe
  C:\Windows\System\kveUEEe.exe
  2⤵
  PID:11576
- C:\Windows\System\rgXKnki.exe
  C:\Windows\System\rgXKnki.exe
  2⤵
  PID:6788
- C:\Windows\System\nKcTUSe.exe
  C:\Windows\System\nKcTUSe.exe
  2⤵
  PID:8384
- C:\Windows\System\MLtDgcC.exe
  C:\Windows\System\MLtDgcC.exe
  2⤵
  PID:10496
- C:\Windows\System\yTdMZPt.exe
  C:\Windows\System\yTdMZPt.exe
  2⤵
  PID:9932
- C:\Windows\System\kqcvVPG.exe
  C:\Windows\System\kqcvVPG.exe
  2⤵
  PID:9460
- C:\Windows\System\ClEFvHb.exe
  C:\Windows\System\ClEFvHb.exe
  2⤵
  PID:11500
- C:\Windows\System\evPNtyw.exe
  C:\Windows\System\evPNtyw.exe
  2⤵
  PID:12420
- C:\Windows\System\ihAuhsK.exe
  C:\Windows\System\ihAuhsK.exe
  2⤵
  PID:9904
- C:\Windows\System\dBpQjJv.exe
  C:\Windows\System\dBpQjJv.exe
  2⤵
  PID:12548
- C:\Windows\System\TGCKmJP.exe
  C:\Windows\System\TGCKmJP.exe
  2⤵
  PID:8240

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:7820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_scruumh2.qo3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AhOjuHq.exe

Filesize
1.9MB

MD5
73e6d97b7faa357549b2d206f0b5e93c

SHA1
911c3921a762303d66020779630a2b45c5cba745

SHA256
c74ac1d6230153e29bc89e0804708c5e5a29c26eadc2cbd1ebed8801e0c27470

SHA512
85ae30a37bbb9db5fd5f7caf140f3d503bba4c703df5bae8f204679e74551db56d14e5f9679155603c5da5930d30eb8f365ed1bfacca8cc5736932f68f34029c

Download Submit
C:\Windows\System\BeTrZpu.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\System\CDwylfW.exe

Filesize
1.9MB

MD5
92a6a90db82e5315d76d84cac9be8a63

SHA1
199182dfe1e0517160c92a33a37105a46c564bf3

SHA256
55c94ee219a93cd1e22ace72c8f3527ef30d70d31a255dc18aa0456bdc0fb7be

SHA512
f1644b3c71bddfe368aa00af69b4a37cbf3b8d35b3a289a21561c85231d81280ecaf103cc470e1c732d347f8291f14a32ac1ddc257b781196946b05090899586

Download Submit
C:\Windows\System\DdUniin.exe

Filesize
1.9MB

MD5
c3cea8cf472356b06246fdfb621c52b7

SHA1
aa897f6fbc7b749cde4da63b3302cbe5a97114c9

SHA256
8f118dc262d2b6776d9334b6d5c9cae9f4fb2b4b61705fc9ae0e1c56a90555ca

SHA512
285f7c3240d0c8404e9bbf1984724b6c76f1e6b64eadde900a1e9fed9092f3401a5c0ab7f2fb8c5185b0ee8e95ad964f32345c5ce5dff6ab4176fb69811d288a

Download Submit
C:\Windows\System\DoyIqWM.exe

Filesize
1.9MB

MD5
bbd580e8d6d8a409d69498c28e6e7fa9

SHA1
28ff0f17267064c0be4bc3b2c99eac89dfe7535d

SHA256
cebae7c74ae512350d4aad7829c4ce4f962f4004e41fef94aa800e9e8f2eb258

SHA512
6d13b4665efccf07b5c9bcd2543abd72552a6f74ae217563cfa18588aa1f5909e2d78b7fef865cc7af64a7014c855d4dcae1090dc908e6523149317e1bfb5d40

Download Submit
C:\Windows\System\HShecqo.exe

Filesize
1.9MB

MD5
337cf056b04cfa150c5785d3b289824f

SHA1
5e74c2b5e8407bf8f6ea5c908bdcb291e049a704

SHA256
c6d57596bc8d1fe466e70858a08cc81a4bcd956d4a7856d4057dd189558a9592

SHA512
eade1e8e6d4da7028d60db3c39b29ebc4f86ac83269bc84c9ee671f44b6d4cc6fa2b8cf5d8f7b96f0a1c5c4bf3f241e516b9e2b67495507c302edd560a430c33

Download Submit
C:\Windows\System\IfedBQr.exe

Filesize
1.9MB

MD5
71a0d1cc62a7483ef14a270b816b7994

SHA1
667a5a5fe25a6007c8a2019fdda7d184c78ef10b

SHA256
e5e622acfb11fe6ed8b64033e190afbbff404230a0466363fc5accbcb5146213

SHA512
f3394325b57baecd1bf4e32fcdfbcf6f0fa4fb1a34a1d0c7dc99ef01f2abaadc79eeff0e69e34bf59eec67002cf67e678e7d4a5c82aee5f473c1f19ef95093ca

Download Submit
C:\Windows\System\JkZxiER.exe

Filesize
1.9MB

MD5
c2c263dc4ff6a448b0fa4adb50a40fff

SHA1
52efc0cc82b7606346d34a4a43cb80b427eb407e

SHA256
5138a45112d3616bebef56dd56192f21cfdf0d389f19c001a066258f238f686f

SHA512
f1739257d830a55c68906b6f05f567ba587559e11717f5211b5eb9c945d5621978723db7515838e7d1645de597006e621a76e80cac0374d5db894477a2440946

Download Submit
C:\Windows\System\Onvmzpl.exe

Filesize
1.9MB

MD5
b2fe1bce2addf507452666e25c14590d

SHA1
48876f86da7ccb530d9174a3a6652ea0e02724c8

SHA256
f5b08aaff389540dfafbb1b1ad39bffbfa4197e2998595ccdaabbf4e99134728

SHA512
2a1d1e6b4cd039a9b01ea9d98f69d391169fef7249626a4af44904403f045eef10ae5839543ec9a607545717636008e3fb8246b2cc624058082baa06bd6e07b1

Download Submit
C:\Windows\System\PMVxyTD.exe

Filesize
1.9MB

MD5
90adbae313156f1d84f005d3d58f00e1

SHA1
df310d66068951fc816a237be3191a8034cf50cb

SHA256
3ecd333fc6e7af7bcff541503b06f77545cb664c6d6c61bffdb9ee6d536d9d1a

SHA512
2cbbde5a0d799986e54c9d93b11290fba4dc7e995b50f808d293033b011d7b4270f38d35350030e723f8acbd3dd89019d7fe17ca52285046a114c4a70ad57294

Download Submit
C:\Windows\System\POfmdLS.exe

Filesize
1.9MB

MD5
a8ee1e0100e00f0491784fb8050f562a

SHA1
9f5e81a85f6265a1882662e43598f93739ec7ded

SHA256
3b0e5e00aefc997092a0d6a602ac31cd81c82de454474f336341a03ba582c9c1

SHA512
6a3a5468ae2e64442e648054b94ed228e48a8567f9a2e28c001fa179a6996b3844d8fbc497112f9f39e6668b8b8f278dd7eac04489e35923be99dad6d9204f38

Download Submit
C:\Windows\System\PlYjcvb.exe

Filesize
1.9MB

MD5
8719715b488b7f186b6d742f98c59b7f

SHA1
3190eec55c9b7c7776d9190dfabb6e6b3732804f

SHA256
b2241a7e461e7f115a2b73db84fdff1e386b5a572cf2cc1c4e64e4560b238e3c

SHA512
3553ebd39e1d747443b2e5902c94159f3c0114a7102263106c7ff4c3b31f8d464aea93f88517d21422a9c53417c107ed73bcb01b117dba2bc17b8a4c47a1f15e

Download Submit
C:\Windows\System\RCRYlzS.exe

Filesize
1.9MB

MD5
aad62e2407c4f6e9c0755105d13e70fa

SHA1
57d86b5b8d978994d13c9d72c7a9110cf85686fa

SHA256
bafa3d0d8987c13cdb19cb6b5ba7f7d0b8fe1b202fec68500fa2f8c9160bbb4f

SHA512
f7ddf2d9584788acbdce518b4cc3ca7883616de663b4c0d0a4702e2a2bc5a6c84ee117530e5b24261b5bee6d367884013219ce999017f8691b742bf8320f9823

Download Submit
C:\Windows\System\TqEtmmt.exe

Filesize
1.9MB

MD5
7e053087088d0579dcec3e032778b9be

SHA1
b20112a6a7d2785fca6ecf048bbb6416565ee166

SHA256
817a4d55f569e1c05f4bf1ad3bc2533a36745ba45fbf3ae89432b20fc3de5256

SHA512
a285de149fd468677ca0d5ddf3f1f2d3996cfdab7a7537fdf8d607dff00ac9606aaaf89eee40ef0c538050aca74c69f0142cb968e558a2f6dd6e8239fd280cbe

Download Submit
C:\Windows\System\VTPsUJZ.exe

Filesize
1.9MB

MD5
97fd39632cff7f26285fd17c5996bda1

SHA1
7d297bd9898b66c56fcc54e5c14d321df0ff4c17

SHA256
9648b1761ab968f1c8c29c2e67a9700da594ad6a6d0bfedfb55d8d1da2af1848

SHA512
3b236083b5e1a923faa3af541389a2be28c84ca7b1ca4825cabc635d208bd4e2a975f73f8aadbdab80c98634520167fddc23fbc72c24563aa2212ac3c4e8705a

Download Submit
C:\Windows\System\WmwgRpq.exe

Filesize
1.9MB

MD5
e5d36010ed44af0d728e5307163125a5

SHA1
e66531b4dbc3841027e26c8d651c87b93c97fa2e

SHA256
53bc34328a3b32f15102542b3c6e948f007907170beef8c95e95ede252f6a39b

SHA512
41c8eb96efcbbbdd36f7ed01894b03fef78dd3d4dc983c0a284a3265d8cdea30379570481127a399721d05c5ba512e0cdb16a5391670cb887a0f6843a9a3814b

Download Submit
C:\Windows\System\XGlgoXj.exe

Filesize
1.9MB

MD5
72c46a3fe9668f5268dff7516fb0db03

SHA1
fd16d21519e3389058c1b2616a5c82d2277f2708

SHA256
65ea6881a71b7d97f121fb6866827b6ee91907eb2d750d33b53b6a56bd8484c0

SHA512
68981652fbb3676ac7a02814c2aab1e9e2ab7ffeb1debbec40360cef0905b40d07b243c9330fb1684ac6137f051ff4dd9d742e8c3f81ce646b51e10aead513ae

Download Submit
C:\Windows\System\XopXLiL.exe

Filesize
1.9MB

MD5
d69541c272e1258596f05b16a4bdbbde

SHA1
0c3f72945b4db0e89b1601d4155714b0b14c049a

SHA256
e8a430bb3cf7855cc40150bc52b0445e5a49b7c9adb44a2afcc68039d8813ae7

SHA512
ed99c1533c6d3b078c8b4b22f7a1f1a7329ddcaaf7a6e4ec6f9702d342b417b757a9b0cf8562cb9efd1b46072e53d2c412ce4b9b3af73afbcc1f72ebfbb4fe90

Download Submit
C:\Windows\System\ZMXZWUC.exe

Filesize
1.9MB

MD5
ed6e293a279e8c81d441b7d5a07dfaec

SHA1
f2d08c7b8da958221dc3e49e46c10c6a52da726a

SHA256
db32d13bc05bbb2a608fdcbbd24d6e40917968d1afffe119275312a270aab339

SHA512
163b57d143c7a520c539c0801b7ce0944f4f97c90872f55c6ac0c5bd3fb52775fc37d4992d72f8872971f5ffb4c8242560227093e1740f2ff162517f58e9dd2a

Download Submit
C:\Windows\System\bxboPyz.exe

Filesize
1.9MB

MD5
65fd8b0b33f496e3e158a9a24cd022c1

SHA1
18a61b5460de417f80fdaa4b3b7fde6316a8e950

SHA256
9b16392659c9f59464593f886d975decc05b64bcf79197f4e654d66cdfcac1f3

SHA512
97eb6524c6a1130e2b4023cd7d2b9564520909e75bcd8b2c528620104dbe0f8bc676af35116c0b6a9084b7ea3fe7fd33e7c6256a9fb05558281fbb34cb069304

Download Submit
C:\Windows\System\cyWSxtX.exe

Filesize
1.9MB

MD5
18281a0577a6372faf0a0139801f7829

SHA1
106e5768ddd4954344bc0a174c65ca4f87524be3

SHA256
f47358282ab0ff64512d4e108e910eafab0ec5ceefca0aa2a5d30abefb94ec50

SHA512
b1dcc30457781034f7935104e1758728bc1ca02c24bf4f3f33dbf49ce54161e1c406fde11a6f06f421ed6ca0b6a4d21e3ab272e79e16d6ee924d551df795d7cd

Download Submit
C:\Windows\System\dOaBKXS.exe

Filesize
1.9MB

MD5
3115eb758e4734726c137386cc5c61c2

SHA1
922928e38e5fd3827e3b4b4819506073061e3d61

SHA256
879ad013c7471792c35e839a53e7dc46b46a1bc6f63e57e8db78d177412fc67d

SHA512
1f4f32a569df73db7106aec901132a76ce50930f162f34a016b426851ea011d0fc82f661a8bd21685dc1cb400a2f901c6e2055df7a48a2457a327fc9994c3aae

Download Submit
C:\Windows\System\dbynkKU.exe

Filesize
1.9MB

MD5
36dba0cfd1981ad839cd578fef3c082b

SHA1
1a48217ece1693e351db18e0571a9d00b4a55b12

SHA256
2a0878580ec68335d7feaab1325b09432f0e70ad1d003ebe8ce2447f0b557c8a

SHA512
6d9fb0d80fed7dc4b9623e13cc8e9544cf6e0840e21996e421441d6b8dc66f5815f27a4beeb2057fb27a7eae8187f10de7a1bc18cf329be68fb453d827626fc1

Download Submit
C:\Windows\System\edulxJD.exe

Filesize
1.9MB

MD5
dee21faec62f51257ca435edc80a4979

SHA1
6e096c0d7c94091fc8ecd7f15c6891930e7e0324

SHA256
4f9994981e4be99358aa61349bbf2a8b1df9914569afb9f8bfc922bcd905cbc8

SHA512
e02fd09b15d3d2ed2bc5db5868607d8214981c5afa427ed9284438f826d50af84125f6697ac893dd031a2b908afdd8472540a5b1f6bc125ab1fe02f28a2e4031

Download Submit
C:\Windows\System\fcGZghI.exe

Filesize
1.9MB

MD5
0ff23cbedad466153adf8fa9fe041877

SHA1
ab16e66b87116f8d0e3e6e9fdc23209a7c53ebf6

SHA256
fc4d99791dd10afdc7d2cbe5dee2a16bbcf910af2a80a16dcb277555f7131499

SHA512
2783c062fc8e47f9814ed6c2157ac059eceef245f0cb863b065c1f7c7dc86656e97a84f14af199f84f8d386fa48520f360fafc8ef0c6017f9c568c30cff70794

Download Submit
C:\Windows\System\frsNlTv.exe

Filesize
1.9MB

MD5
7695c660f7ca3b14e390521002651bd2

SHA1
5f82666ef0e72339132b2b2f8cd61c3e32cf1e15

SHA256
c9ed8d125f9cfde6cd294e8cd346ec0fbe3a3f0857bc6f13147c659ac7f9e078

SHA512
17c0ceeaba6f074c4c6be002ca4889aeab0e9c229e4abcc3d6b5e5b43dba5a7bf128532461d9976f50b4382629513174a330dd3ff8738f571d6e9d199c625f21

Download Submit
C:\Windows\System\hZvRLEY.exe

Filesize
1.9MB

MD5
5fca59d6b6ac42e71369f8f487f94962

SHA1
b84a10d67f32cb89af38acda73f1d5f09af0d1e1

SHA256
4ffaa0da87cd53c62b43caf1c07d08e4cd8bdab4175b8031a78765b9bbc813ed

SHA512
379b78ce6708431ef0dbe66353bc4a618faff18aa6e7e39f65e284a751ed054c28e13d48bb0dfe050608c8d9d8d02b248f04f86bc509c97f71a18705809cb4de

Download Submit
C:\Windows\System\hbnxyxq.exe

Filesize
1.9MB

MD5
34309d4f86924d21df995edfa879d6f2

SHA1
b92ffae946da96816e8a7c4325814c871d3527c1

SHA256
024e853d2457760d3f64ce9976518c78dc0d022b4bedcd151de6efbb71e8bfb5

SHA512
6c6616324a3761ffe6ea6bb5d597f6964d196c7207c4627d1b4988bd98c87a2834fe9f8dfbc4e3421883394f3bbb2a6fc26de8203e91b219c946828dbf5e869b

Download Submit
C:\Windows\System\kSWtcwZ.exe

Filesize
1.9MB

MD5
cbdbcf1233305385f77aaf8c67ceb90b

SHA1
4b92a6018ee20758a15236751ab104e8d2cf0aec

SHA256
9b14de9f67d16ae624b38e27fea0351bd7c7557cc9d99149bd7b898f28dc7469

SHA512
f237ced9a335d68f4ab955891ebd2b66d687449cd90b51a7066a9b2a48bfb2c86ac11c2a10352b4f39af516da4a3070115bd9d364007ee9e7a7f6450e4a9f418

Download Submit
C:\Windows\System\lKvTIPA.exe

Filesize
1.9MB

MD5
ba4731fda59854d17dd3d9d302384bb5

SHA1
d95f6e6b1de744d9a13c02dc36118339485b414a

SHA256
556875535f1df9f6ceec3cc457cc2d07f9968168ddfb8d3988d22db12575fc5d

SHA512
04164e4d794287416a8edc2526e6d6c20cafeab77148bf1c155237460d0d42bad9d53cb30264e01ccaf51d59350a4cd7be90f616012324c20046895b2ce192a0

Download Submit
C:\Windows\System\mZPLTzg.exe

Filesize
1.9MB

MD5
38a1c3412984e91dbbcaff668aac0465

SHA1
d7df3803c7bc4f47277eb384f283723ef7fd9368

SHA256
a4b48587c52feb8fed753d821d10c6c121b930f07f43c4e2761c83476438a6b9

SHA512
307860d721b241e33b0f492041e0001430fed8ba3175b6ad0f924fd5e98e2cc5eb7157de2c59f15aa9e2e0611d7d478a3e82e55dd2d99134044356656d36cd5a

Download Submit
C:\Windows\System\puzVdIq.exe

Filesize
1.9MB

MD5
0d0de8650606d73de0f39fe7549c28b3

SHA1
25023664fa046fa872f8048b5e1ea45cb246a093

SHA256
28688156823464eaa5e599e11fc471497ba7ebddbf28dfeadcdef0392f689f2c

SHA512
9cd5b53e79adc1f059ef2d865cb172114e4f02894b899782a1f5bd731227ed6bb890cc381c4d2968406778ad70dd47dca40ca2c6717e898c8b637562c7b8dd76

Download Submit
C:\Windows\System\rcQiYuv.exe

Filesize
1.9MB

MD5
77825dd7b88af481aa180005e162922d

SHA1
9931af70117d4bc40d4f1d3c9a2a38c480e3656b

SHA256
90edd058978ffc1badce4c6517af6a762723eec3a8e9955e31845ab728dc5959

SHA512
025fe861b36ab433df042b1c9d623925a3efdda606747c59c3ecf88129ae51bc48751613be4692bd776dfd6015a0cc86db4d7e385539c87cd26b3b2f9ceced14

Download Submit
C:\Windows\System\xiKdAos.exe

Filesize
1.9MB

MD5
08a5c930b922b85466904e0c5ea7cf9e

SHA1
442b373bef17f50210a9c2b8aceba1aa5a79fbb5

SHA256
af136975bd5159a15d7a93532dc465eef902c30b8de3ba20252d92c6deba7c77

SHA512
15783eed6b3ac4456cdac0bf1c043767e7313b7111b12c20714b144c5abeb1adcf1621401d1a2e59483822818c253bf8d0dd79ad66b67b289c2b1493eb198d75

Download Submit
C:\Windows\System\xyTHGUh.exe

Filesize
1.9MB

MD5
7b3eba22e39321cd132dde8ab7d01de9

SHA1
62782497c1ba377d6e3649466f216f858e8a7e16

SHA256
49cb672b1894f5145a214fe6d7b3a3dba4b9ea297c376d36d8b6aa5d7c229486

SHA512
0f23c8d14b67e9573d1c87842c84171a1950dfae87b629c5293cf5002e20dfdc5dd28ccb70fd3439a570037fd000030cdcaff222926c1c3f22856ffd1451fb26

Download Submit
C:\Windows\System\zCLtWla.exe

Filesize
1.9MB

MD5
be1c9c4b13d419d44dee339a84564ac6

SHA1
dc4ebca58cd6012fbf4f291c6664c537cccdfe50

SHA256
a6a1b574e05abfff28a7d58b8aa27de3d3f22411ecefae22951b2ff1de2362b5

SHA512
087a07dd578851a783fe2302975ea9c4ef4cd6034511f42ac8e0ec9e5f1c6aad0629b0aaa6980c92b30672159ad386a52005b2ae9ef7d73a9a2fc9b12515bf32

Download Submit
C:\Windows\System\zMrQwQv.exe

Filesize
18B

MD5
5db3df0964e5c695675f39e99d1f288b

SHA1
84b597ea47f1f6b13b223cbb576a55e47a79cfaa

SHA256
15f5f6f9d4846d3bfaf7f8740e9c849aebfecfea6fc86fee82eb18d6ec03fd9f

SHA512
f71b3480e977c4ca4affaaec3f3bd31e3598fdd986ea7bafee42b5d6a8676e69449256bbab19fc0cc61412a454871e6b79cebb0c5e3610b9e98c4f089888aa18

Download Submit
C:\Windows\System\zYAwySV.exe

Filesize
1.9MB

MD5
a9194fa7237dddb68f352b407d0d5f58

SHA1
83f98e608c236cf5f82800835016a3285c125316

SHA256
9d85770282269a0bbd81f2f03c32a6460125bc2334f101b1e9719ea1cb29965c

SHA512
3341a8182c1c75dae7abffc93e82a03dde6d59743bb74874215c09d4bce3b1bcc0f1dd2f20442013c7165202cd67265dc428ece1b2b5dda933bfc50758855b4e

Download Submit
C:\Windows\System\zuKSXnk.exe

Filesize
1.9MB

MD5
caab8bdc785532877ec74ad8db8313d3

SHA1
e21458e175a6d97296cb35d9d2cd6a3ffc076314

SHA256
1664d22f63f4d0e27101eb7066aa1cfcc80d5feee735db652fe59c38941c44bf

SHA512
4fedce654763df49011edfcc02ffe426a029e2d3e58505de76c429f1c7dc8189d1439daf62e7de94d8f937fc313d58f095982a07173ebe734850083ce826c50d

Download Submit
memory/556-48-0x00007FFE33BC0000-0x00007FFE34681000-memory.dmp

Filesize
10.8MB

Download
memory/556-50-0x00000219DA000000-0x00000219DA010000-memory.dmp

Filesize
64KB

Download
memory/556-51-0x00000219DA000000-0x00000219DA010000-memory.dmp

Filesize
64KB

Download
memory/556-166-0x00000219D9FB0000-0x00000219D9FD2000-memory.dmp

Filesize
136KB

Download
memory/752-4577-0x00007FF7918F0000-0x00007FF791CE2000-memory.dmp

Filesize
3.9MB

Download
memory/752-242-0x00007FF7918F0000-0x00007FF791CE2000-memory.dmp

Filesize
3.9MB

Download
memory/940-121-0x00007FF7B48E0000-0x00007FF7B4CD2000-memory.dmp

Filesize
3.9MB

Download
memory/1420-235-0x00007FF6769F0000-0x00007FF676DE2000-memory.dmp

Filesize
3.9MB

Download
memory/1420-4441-0x00007FF6769F0000-0x00007FF676DE2000-memory.dmp

Filesize
3.9MB

Download
memory/1436-10-0x00007FF758A40000-0x00007FF758E32000-memory.dmp

Filesize
3.9MB

Download
memory/1912-0-0x00007FF662CB0000-0x00007FF6630A2000-memory.dmp

Filesize
3.9MB

Download
memory/1912-1-0x000002594A560000-0x000002594A570000-memory.dmp

Filesize
64KB

Download
memory/1944-246-0x00007FF640080000-0x00007FF640472000-memory.dmp

Filesize
3.9MB

Download
memory/1972-4454-0x00007FF726FF0000-0x00007FF7273E2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-240-0x00007FF726FF0000-0x00007FF7273E2000-memory.dmp

Filesize
3.9MB

Download
memory/2144-4562-0x00007FF7E12C0000-0x00007FF7E16B2000-memory.dmp

Filesize
3.9MB

Download
memory/2144-243-0x00007FF7E12C0000-0x00007FF7E16B2000-memory.dmp

Filesize
3.9MB

Download
memory/2332-63-0x00007FF6D6B70000-0x00007FF6D6F62000-memory.dmp

Filesize
3.9MB

Download
memory/3340-250-0x00007FF74F540000-0x00007FF74F932000-memory.dmp

Filesize
3.9MB

Download
memory/3464-4463-0x00007FF78AB20000-0x00007FF78AF12000-memory.dmp

Filesize
3.9MB

Download
memory/3464-249-0x00007FF78AB20000-0x00007FF78AF12000-memory.dmp

Filesize
3.9MB

Download
memory/3628-208-0x00007FF65B540000-0x00007FF65B932000-memory.dmp

Filesize
3.9MB

Download
memory/3628-4428-0x00007FF65B540000-0x00007FF65B932000-memory.dmp

Filesize
3.9MB

Download
memory/3668-241-0x00007FF73E890000-0x00007FF73EC82000-memory.dmp

Filesize
3.9MB

Download
memory/3764-247-0x00007FF63F5B0000-0x00007FF63F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/4300-245-0x00007FF76A700000-0x00007FF76AAF2000-memory.dmp

Filesize
3.9MB

Download
memory/4300-4535-0x00007FF76A700000-0x00007FF76AAF2000-memory.dmp

Filesize
3.9MB

Download
memory/4324-66-0x00007FF71AC10000-0x00007FF71B002000-memory.dmp

Filesize
3.9MB

Download
memory/4488-4418-0x00007FF61BF00000-0x00007FF61C2F2000-memory.dmp

Filesize
3.9MB

Download
memory/4488-92-0x00007FF61BF00000-0x00007FF61C2F2000-memory.dmp

Filesize
3.9MB

Download
memory/4500-244-0x00007FF702C30000-0x00007FF703022000-memory.dmp

Filesize
3.9MB

Download
memory/4500-4473-0x00007FF702C30000-0x00007FF703022000-memory.dmp

Filesize
3.9MB

Download
memory/4584-147-0x00007FF6E8500000-0x00007FF6E88F2000-memory.dmp

Filesize
3.9MB

Download
memory/4584-4390-0x00007FF6E8500000-0x00007FF6E88F2000-memory.dmp

Filesize
3.9MB

Download
memory/4704-239-0x00007FF7AFA00000-0x00007FF7AFDF2000-memory.dmp

Filesize
3.9MB

Download
memory/4704-4444-0x00007FF7AFA00000-0x00007FF7AFDF2000-memory.dmp

Filesize
3.9MB

Download
memory/4992-248-0x00007FF663E70000-0x00007FF664262000-memory.dmp

Filesize
3.9MB

Download
memory/5076-169-0x00007FF615A20000-0x00007FF615E12000-memory.dmp

Filesize
3.9MB

Download
memory/5076-4460-0x00007FF615A20000-0x00007FF615E12000-memory.dmp

Filesize
3.9MB

Download