xmrig | 5f88468781ca8dbb60545d0e85e3a1a5be2da51fb2c8ea3644fbbb041a97d4f3

Analysis

max time kernel
36s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 00:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
Size

1.9MB
MD5

0402bdd9eaa6bac2b63bf2e5975f7d47
SHA1

87bdf62c5e9d18df2a279068b5ab974509ef8e95
SHA256

5f88468781ca8dbb60545d0e85e3a1a5be2da51fb2c8ea3644fbbb041a97d4f3
SHA512

a1dca81b294d30c236077e75401aac32f9b6b8aa60164f68c6d94e37ff7653a47ca9c63c87940f71fc8b848f0452d837c235e0324d518cac0558c2d992590323
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlx/E:NABB

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/4888-43-0x00007FF7F0FF0000-0x00007FF7F13E2000-memory.dmp	xmrig
behavioral2/memory/4332-44-0x00007FF6DC5A0000-0x00007FF6DC992000-memory.dmp	xmrig
behavioral2/memory/5008-42-0x00007FF686A90000-0x00007FF686E82000-memory.dmp	xmrig
behavioral2/memory/3892-40-0x00007FF700410000-0x00007FF700802000-memory.dmp	xmrig
behavioral2/memory/4208-57-0x00007FF785D30000-0x00007FF786122000-memory.dmp	xmrig
behavioral2/memory/4380-106-0x00007FF621610000-0x00007FF621A02000-memory.dmp	xmrig
behavioral2/memory/3088-134-0x00007FF67A890000-0x00007FF67AC82000-memory.dmp	xmrig
behavioral2/memory/2408-142-0x00007FF655380000-0x00007FF655772000-memory.dmp	xmrig
behavioral2/memory/4888-2126-0x00007FF7F0FF0000-0x00007FF7F13E2000-memory.dmp	xmrig
behavioral2/memory/4332-2123-0x00007FF6DC5A0000-0x00007FF6DC992000-memory.dmp	xmrig
behavioral2/memory/5008-2114-0x00007FF686A90000-0x00007FF686E82000-memory.dmp	xmrig
behavioral2/memory/3892-2111-0x00007FF700410000-0x00007FF700802000-memory.dmp	xmrig
behavioral2/memory/1516-151-0x00007FF74D400000-0x00007FF74D7F2000-memory.dmp	xmrig
behavioral2/memory/2616-145-0x00007FF79BE90000-0x00007FF79C282000-memory.dmp	xmrig
behavioral2/memory/2804-137-0x00007FF64C590000-0x00007FF64C982000-memory.dmp	xmrig
behavioral2/memory/2700-129-0x00007FF6F33E0000-0x00007FF6F37D2000-memory.dmp	xmrig
behavioral2/memory/2040-122-0x00007FF662700000-0x00007FF662AF2000-memory.dmp	xmrig
behavioral2/memory/4304-115-0x00007FF72A5C0000-0x00007FF72A9B2000-memory.dmp	xmrig
behavioral2/memory/4148-91-0x00007FF7ADAB0000-0x00007FF7ADEA2000-memory.dmp	xmrig
behavioral2/memory/2024-85-0x00007FF6A3FE0000-0x00007FF6A43D2000-memory.dmp	xmrig
behavioral2/memory/1756-74-0x00007FF61D060000-0x00007FF61D452000-memory.dmp	xmrig
behavioral2/memory/4492-2163-0x00007FF6550C0000-0x00007FF6554B2000-memory.dmp	xmrig
behavioral2/memory/2616-2182-0x00007FF79BE90000-0x00007FF79C282000-memory.dmp	xmrig
behavioral2/memory/2160-2307-0x00007FF7FF750000-0x00007FF7FFB42000-memory.dmp	xmrig
behavioral2/memory/656-2216-0x00007FF70BC40000-0x00007FF70C032000-memory.dmp	xmrig
behavioral2/memory/2040-2173-0x00007FF662700000-0x00007FF662AF2000-memory.dmp	xmrig
behavioral2/memory/2408-2203-0x00007FF655380000-0x00007FF655772000-memory.dmp	xmrig
behavioral2/memory/4304-2196-0x00007FF72A5C0000-0x00007FF72A9B2000-memory.dmp	xmrig
behavioral2/memory/1516-2192-0x00007FF74D400000-0x00007FF74D7F2000-memory.dmp	xmrig
behavioral2/memory/2120-2188-0x00007FF777B30000-0x00007FF777F22000-memory.dmp	xmrig
behavioral2/memory/3088-2175-0x00007FF67A890000-0x00007FF67AC82000-memory.dmp	xmrig
behavioral2/memory/2804-2201-0x00007FF64C590000-0x00007FF64C982000-memory.dmp	xmrig
behavioral2/memory/4208-2164-0x00007FF785D30000-0x00007FF786122000-memory.dmp	xmrig
behavioral2/memory/1756-2162-0x00007FF61D060000-0x00007FF61D452000-memory.dmp	xmrig
behavioral2/memory/4148-2161-0x00007FF7ADAB0000-0x00007FF7ADEA2000-memory.dmp	xmrig
behavioral2/memory/2700-2170-0x00007FF6F33E0000-0x00007FF6F37D2000-memory.dmp	xmrig
behavioral2/memory/2024-2160-0x00007FF6A3FE0000-0x00007FF6A43D2000-memory.dmp	xmrig
behavioral2/memory/3248-2151-0x00007FF659910000-0x00007FF659D02000-memory.dmp	xmrig
behavioral2/memory/4380-2159-0x00007FF621610000-0x00007FF621A02000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	1916	powershell.exe
9	1916	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3892	yTkuRju.exe
5008	vxBGzGk.exe
4888	qAnycDq.exe
4332	YwdDuLh.exe
2120	OjRRgQL.exe
656	KdSZkiw.exe
4208	FmHlKar.exe
3248	LdwHymz.exe
1756	KdhOxby.exe
2024	xfXfwuY.exe
4380	NYvZyzq.exe
4148	RrYWEyB.exe
4304	kRsuibp.exe
4492	idfkcLU.exe
2040	JoeNEAm.exe
2700	HnnvUjn.exe
3088	yvKxWpH.exe
2804	BQUwOUa.exe
2616	aXhXzyK.exe
2408	ixiqvGr.exe
1516	RbYZMNc.exe
2132	rzlDWZU.exe
4288	rlvAtpR.exe
4920	ditculd.exe
3588	nKRHsRn.exe
4140	yCffBna.exe
2168	oKRVljf.exe
4412	bDOXUZN.exe
3100	vOnIUWV.exe
1344	vqqRFHe.exe
1648	EaqfOkf.exe
4328	SZaQRXC.exe
4044	sPSauWo.exe
916	CWbSVAO.exe
4936	nYXqnqr.exe
972	crREdaG.exe
1296	iHRYDGM.exe
5084	DIvJatw.exe
1576	NFUdOGU.exe
2248	WblvlfN.exe
3452	qUpfPpb.exe
3008	CXpgZpw.exe
4664	fMxRIPo.exe
1612	jawqMob.exe
4264	FzQejNX.exe
960	QDiKDtO.exe
4612	xUYHTFZ.exe
3644	FmqJXie.exe
1932	JaVtvKz.exe
1852	tjBAJLZ.exe
728	AodoLGl.exe
3480	gWChAky.exe
3628	PxgxWUc.exe
3460	wIyitai.exe
2484	yHLcgPj.exe
3988	cXghhHc.exe
1768	EnuKozk.exe
1800	TbAvYMo.exe
5136	TqRZwHy.exe
5152	uXrSCrJ.exe
5192	WvdBGMc.exe
5208	wczapbQ.exe
5244	FFFGnro.exe
5272	NSpjMiU.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2160-0-0x00007FF7FF750000-0x00007FF7FFB42000-memory.dmp	upx
behavioral2/files/0x0008000000023244-5.dat	upx
behavioral2/files/0x0008000000023247-10.dat	upx
behavioral2/files/0x000800000002324a-9.dat	upx
behavioral2/files/0x000700000002324f-32.dat	upx
behavioral2/files/0x000800000002324c-26.dat	upx
behavioral2/files/0x0007000000023250-37.dat	upx
behavioral2/memory/4888-43-0x00007FF7F0FF0000-0x00007FF7F13E2000-memory.dmp	upx
behavioral2/memory/4332-44-0x00007FF6DC5A0000-0x00007FF6DC992000-memory.dmp	upx
behavioral2/memory/2120-45-0x00007FF777B30000-0x00007FF777F22000-memory.dmp	upx
behavioral2/memory/656-46-0x00007FF70BC40000-0x00007FF70C032000-memory.dmp	upx
behavioral2/memory/5008-42-0x00007FF686A90000-0x00007FF686E82000-memory.dmp	upx
behavioral2/memory/3892-40-0x00007FF700410000-0x00007FF700802000-memory.dmp	upx
behavioral2/files/0x0008000000023248-53.dat	upx
behavioral2/memory/4208-57-0x00007FF785D30000-0x00007FF786122000-memory.dmp	upx
behavioral2/files/0x000800000002324d-60.dat	upx
behavioral2/files/0x000800000002324e-63.dat	upx
behavioral2/files/0x0007000000023252-77.dat	upx
behavioral2/files/0x0007000000023253-88.dat	upx
behavioral2/files/0x0007000000023255-90.dat	upx
behavioral2/files/0x0007000000023256-98.dat	upx
behavioral2/memory/4380-106-0x00007FF621610000-0x00007FF621A02000-memory.dmp	upx
behavioral2/files/0x0007000000023258-120.dat	upx
behavioral2/files/0x0007000000023259-116.dat	upx
behavioral2/files/0x000700000002325b-125.dat	upx
behavioral2/files/0x000700000002325d-131.dat	upx
behavioral2/memory/3088-134-0x00007FF67A890000-0x00007FF67AC82000-memory.dmp	upx
behavioral2/memory/2408-142-0x00007FF655380000-0x00007FF655772000-memory.dmp	upx
behavioral2/files/0x0007000000023261-157.dat	upx
behavioral2/files/0x0007000000023263-175.dat	upx
behavioral2/files/0x0007000000023266-182.dat	upx
behavioral2/files/0x0007000000023269-197.dat	upx
behavioral2/memory/4888-2126-0x00007FF7F0FF0000-0x00007FF7F13E2000-memory.dmp	upx
behavioral2/memory/4332-2123-0x00007FF6DC5A0000-0x00007FF6DC992000-memory.dmp	upx
behavioral2/memory/5008-2114-0x00007FF686A90000-0x00007FF686E82000-memory.dmp	upx
behavioral2/memory/3892-2111-0x00007FF700410000-0x00007FF700802000-memory.dmp	upx
behavioral2/files/0x0007000000023267-195.dat	upx
behavioral2/files/0x0007000000023268-192.dat	upx
behavioral2/files/0x0007000000023265-185.dat	upx
behavioral2/files/0x0007000000023264-180.dat	upx
behavioral2/files/0x0007000000023262-170.dat	upx
behavioral2/files/0x0007000000023260-160.dat	upx
behavioral2/files/0x000700000002325f-155.dat	upx
behavioral2/memory/1516-151-0x00007FF74D400000-0x00007FF74D7F2000-memory.dmp	upx
behavioral2/files/0x000700000002325e-146.dat	upx
behavioral2/memory/2616-145-0x00007FF79BE90000-0x00007FF79C282000-memory.dmp	upx
behavioral2/memory/2804-137-0x00007FF64C590000-0x00007FF64C982000-memory.dmp	upx
behavioral2/files/0x000700000002325c-132.dat	upx
behavioral2/memory/2700-129-0x00007FF6F33E0000-0x00007FF6F37D2000-memory.dmp	upx
behavioral2/files/0x000700000002325a-124.dat	upx
behavioral2/memory/2040-122-0x00007FF662700000-0x00007FF662AF2000-memory.dmp	upx
behavioral2/memory/4304-115-0x00007FF72A5C0000-0x00007FF72A9B2000-memory.dmp	upx
behavioral2/files/0x0007000000023257-110.dat	upx
behavioral2/memory/4492-96-0x00007FF6550C0000-0x00007FF6554B2000-memory.dmp	upx
behavioral2/memory/4148-91-0x00007FF7ADAB0000-0x00007FF7ADEA2000-memory.dmp	upx
behavioral2/memory/2024-85-0x00007FF6A3FE0000-0x00007FF6A43D2000-memory.dmp	upx
behavioral2/files/0x0007000000023254-80.dat	upx
behavioral2/memory/1756-74-0x00007FF61D060000-0x00007FF61D452000-memory.dmp	upx
behavioral2/memory/3248-67-0x00007FF659910000-0x00007FF659D02000-memory.dmp	upx
behavioral2/memory/4492-2163-0x00007FF6550C0000-0x00007FF6554B2000-memory.dmp	upx
behavioral2/memory/2616-2182-0x00007FF79BE90000-0x00007FF79C282000-memory.dmp	upx
behavioral2/memory/2160-2307-0x00007FF7FF750000-0x00007FF7FFB42000-memory.dmp	upx
behavioral2/memory/656-2216-0x00007FF70BC40000-0x00007FF70C032000-memory.dmp	upx
behavioral2/memory/2040-2173-0x00007FF662700000-0x00007FF662AF2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yVOJVCW.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\OPYbXqH.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\OUSAcrl.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\hhiUIDp.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\BMSWOqE.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\DQllpSo.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\bBPltyy.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\DmFsecB.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\hwTYvxR.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\HFtgbzO.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\ixiqvGr.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\rDzYNfh.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\XZWkUqH.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\QDiKDtO.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\yqzbdJf.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\oHPYENh.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\dLQzoMP.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\XQUQFNQ.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\GkGHntD.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\qUpfPpb.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\SIyoQpr.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\ZuItMbv.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\rTCmOwc.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\NGqdLmR.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\ZGNTxVh.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\SVdHjtL.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\neghEWg.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\EnuKozk.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\OGOJHoK.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\lgYYbTv.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\pVjygMx.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\drCPyhC.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\aiWmuCt.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\hjBpKzD.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\BAnoyIq.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\CXpgZpw.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\EssniXv.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\WblvlfN.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\xUYHTFZ.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\hwFgbDM.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\hxXupXd.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\BbqYxeL.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\SzdFMfe.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\KYiuaRE.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\vgOOvoo.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\vOnIUWV.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\uXrSCrJ.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\fvJIKCH.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\DlAgTwc.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\aKPNlJn.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\PQCRMpm.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\zNMgnDN.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\zfAZVdJ.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\yXjATQU.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\fjQtJvs.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\zdijGkH.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\xDpZxoD.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\PILCJIz.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\yNBZwfj.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\CBjUoep.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\ohpGUks.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\lPSchtE.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\SeOmETP.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
File created	C:\Windows\System\clRekyG.exe	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1916	powershell.exe
1916	powershell.exe
1916	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeLockMemoryPrivilege	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 1916	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	91
PID 2160 wrote to memory of 1916	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	91
PID 2160 wrote to memory of 3892	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	92
PID 2160 wrote to memory of 3892	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	92
PID 2160 wrote to memory of 5008	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	93
PID 2160 wrote to memory of 5008	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	93
PID 2160 wrote to memory of 4888	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	94
PID 2160 wrote to memory of 4888	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	94
PID 2160 wrote to memory of 4332	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	95
PID 2160 wrote to memory of 4332	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	95
PID 2160 wrote to memory of 2120	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	96
PID 2160 wrote to memory of 2120	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	96
PID 2160 wrote to memory of 656	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	97
PID 2160 wrote to memory of 656	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	97
PID 2160 wrote to memory of 4208	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	98
PID 2160 wrote to memory of 4208	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	98
PID 2160 wrote to memory of 3248	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	99
PID 2160 wrote to memory of 3248	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	99
PID 2160 wrote to memory of 1756	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	100
PID 2160 wrote to memory of 1756	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	100
PID 2160 wrote to memory of 2024	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	101
PID 2160 wrote to memory of 2024	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	101
PID 2160 wrote to memory of 4380	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	102
PID 2160 wrote to memory of 4380	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	102
PID 2160 wrote to memory of 4148	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	103
PID 2160 wrote to memory of 4148	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	103
PID 2160 wrote to memory of 4492	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	104
PID 2160 wrote to memory of 4492	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	104
PID 2160 wrote to memory of 4304	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	105
PID 2160 wrote to memory of 4304	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	105
PID 2160 wrote to memory of 2040	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	106
PID 2160 wrote to memory of 2040	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	106
PID 2160 wrote to memory of 2700	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	107
PID 2160 wrote to memory of 2700	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	107
PID 2160 wrote to memory of 3088	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	108
PID 2160 wrote to memory of 3088	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	108
PID 2160 wrote to memory of 2804	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	109
PID 2160 wrote to memory of 2804	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	109
PID 2160 wrote to memory of 2408	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	110
PID 2160 wrote to memory of 2408	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	110
PID 2160 wrote to memory of 2616	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	111
PID 2160 wrote to memory of 2616	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	111
PID 2160 wrote to memory of 1516	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	112
PID 2160 wrote to memory of 1516	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	112
PID 2160 wrote to memory of 2132	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	113
PID 2160 wrote to memory of 2132	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	113
PID 2160 wrote to memory of 4288	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	114
PID 2160 wrote to memory of 4288	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	114
PID 2160 wrote to memory of 4920	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	115
PID 2160 wrote to memory of 4920	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	115
PID 2160 wrote to memory of 3588	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	116
PID 2160 wrote to memory of 3588	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	116
PID 2160 wrote to memory of 4140	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	117
PID 2160 wrote to memory of 4140	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	117
PID 2160 wrote to memory of 2168	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	118
PID 2160 wrote to memory of 2168	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	118
PID 2160 wrote to memory of 4412	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	119
PID 2160 wrote to memory of 4412	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	119
PID 2160 wrote to memory of 3100	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	120
PID 2160 wrote to memory of 3100	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	120
PID 2160 wrote to memory of 1344	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	121
PID 2160 wrote to memory of 1344	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	121
PID 2160 wrote to memory of 1648	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	122
PID 2160 wrote to memory of 1648	2160	0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe	122

C:\Users\Admin\AppData\Local\Temp\0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0402bdd9eaa6bac2b63bf2e5975f7d47_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1916
- C:\Windows\System\yTkuRju.exe
  C:\Windows\System\yTkuRju.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\vxBGzGk.exe
  C:\Windows\System\vxBGzGk.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\qAnycDq.exe
  C:\Windows\System\qAnycDq.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\YwdDuLh.exe
  C:\Windows\System\YwdDuLh.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\OjRRgQL.exe
  C:\Windows\System\OjRRgQL.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\KdSZkiw.exe
  C:\Windows\System\KdSZkiw.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\FmHlKar.exe
  C:\Windows\System\FmHlKar.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\LdwHymz.exe
  C:\Windows\System\LdwHymz.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\KdhOxby.exe
  C:\Windows\System\KdhOxby.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\xfXfwuY.exe
  C:\Windows\System\xfXfwuY.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\NYvZyzq.exe
  C:\Windows\System\NYvZyzq.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\RrYWEyB.exe
  C:\Windows\System\RrYWEyB.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\idfkcLU.exe
  C:\Windows\System\idfkcLU.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\kRsuibp.exe
  C:\Windows\System\kRsuibp.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\JoeNEAm.exe
  C:\Windows\System\JoeNEAm.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\HnnvUjn.exe
  C:\Windows\System\HnnvUjn.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\yvKxWpH.exe
  C:\Windows\System\yvKxWpH.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\BQUwOUa.exe
  C:\Windows\System\BQUwOUa.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\ixiqvGr.exe
  C:\Windows\System\ixiqvGr.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\aXhXzyK.exe
  C:\Windows\System\aXhXzyK.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\RbYZMNc.exe
  C:\Windows\System\RbYZMNc.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\rzlDWZU.exe
  C:\Windows\System\rzlDWZU.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\rlvAtpR.exe
  C:\Windows\System\rlvAtpR.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\ditculd.exe
  C:\Windows\System\ditculd.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\nKRHsRn.exe
  C:\Windows\System\nKRHsRn.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\yCffBna.exe
  C:\Windows\System\yCffBna.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\oKRVljf.exe
  C:\Windows\System\oKRVljf.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\bDOXUZN.exe
  C:\Windows\System\bDOXUZN.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\vOnIUWV.exe
  C:\Windows\System\vOnIUWV.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\vqqRFHe.exe
  C:\Windows\System\vqqRFHe.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\EaqfOkf.exe
  C:\Windows\System\EaqfOkf.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\SZaQRXC.exe
  C:\Windows\System\SZaQRXC.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\sPSauWo.exe
  C:\Windows\System\sPSauWo.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\CWbSVAO.exe
  C:\Windows\System\CWbSVAO.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\nYXqnqr.exe
  C:\Windows\System\nYXqnqr.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\crREdaG.exe
  C:\Windows\System\crREdaG.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\iHRYDGM.exe
  C:\Windows\System\iHRYDGM.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\DIvJatw.exe
  C:\Windows\System\DIvJatw.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\NFUdOGU.exe
  C:\Windows\System\NFUdOGU.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\WblvlfN.exe
  C:\Windows\System\WblvlfN.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\qUpfPpb.exe
  C:\Windows\System\qUpfPpb.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\CXpgZpw.exe
  C:\Windows\System\CXpgZpw.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\fMxRIPo.exe
  C:\Windows\System\fMxRIPo.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\jawqMob.exe
  C:\Windows\System\jawqMob.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\FzQejNX.exe
  C:\Windows\System\FzQejNX.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\QDiKDtO.exe
  C:\Windows\System\QDiKDtO.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\xUYHTFZ.exe
  C:\Windows\System\xUYHTFZ.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\FmqJXie.exe
  C:\Windows\System\FmqJXie.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\JaVtvKz.exe
  C:\Windows\System\JaVtvKz.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\tjBAJLZ.exe
  C:\Windows\System\tjBAJLZ.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\AodoLGl.exe
  C:\Windows\System\AodoLGl.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\gWChAky.exe
  C:\Windows\System\gWChAky.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\PxgxWUc.exe
  C:\Windows\System\PxgxWUc.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\wIyitai.exe
  C:\Windows\System\wIyitai.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\yHLcgPj.exe
  C:\Windows\System\yHLcgPj.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\cXghhHc.exe
  C:\Windows\System\cXghhHc.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\EnuKozk.exe
  C:\Windows\System\EnuKozk.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\TbAvYMo.exe
  C:\Windows\System\TbAvYMo.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\TqRZwHy.exe
  C:\Windows\System\TqRZwHy.exe
  2⤵
  - Executes dropped EXE
  PID:5136
- C:\Windows\System\uXrSCrJ.exe
  C:\Windows\System\uXrSCrJ.exe
  2⤵
  - Executes dropped EXE
  PID:5152
- C:\Windows\System\ayfbgVA.exe
  C:\Windows\System\ayfbgVA.exe
  2⤵
  PID:5172
- C:\Windows\System\WvdBGMc.exe
  C:\Windows\System\WvdBGMc.exe
  2⤵
  - Executes dropped EXE
  PID:5192
- C:\Windows\System\wczapbQ.exe
  C:\Windows\System\wczapbQ.exe
  2⤵
  - Executes dropped EXE
  PID:5208
- C:\Windows\System\FFFGnro.exe
  C:\Windows\System\FFFGnro.exe
  2⤵
  - Executes dropped EXE
  PID:5244
- C:\Windows\System\NSpjMiU.exe
  C:\Windows\System\NSpjMiU.exe
  2⤵
  - Executes dropped EXE
  PID:5272
- C:\Windows\System\XMfVhpC.exe
  C:\Windows\System\XMfVhpC.exe
  2⤵
  PID:5292
- C:\Windows\System\yNBZwfj.exe
  C:\Windows\System\yNBZwfj.exe
  2⤵
  PID:5316
- C:\Windows\System\eUWevCM.exe
  C:\Windows\System\eUWevCM.exe
  2⤵
  PID:5332
- C:\Windows\System\EjhawOr.exe
  C:\Windows\System\EjhawOr.exe
  2⤵
  PID:5484
- C:\Windows\System\SOmVjOR.exe
  C:\Windows\System\SOmVjOR.exe
  2⤵
  PID:5504
- C:\Windows\System\iIiBKiO.exe
  C:\Windows\System\iIiBKiO.exe
  2⤵
  PID:5520
- C:\Windows\System\RZtoAZf.exe
  C:\Windows\System\RZtoAZf.exe
  2⤵
  PID:5548
- C:\Windows\System\VXgOZsX.exe
  C:\Windows\System\VXgOZsX.exe
  2⤵
  PID:5564
- C:\Windows\System\xVmFmTA.exe
  C:\Windows\System\xVmFmTA.exe
  2⤵
  PID:5600
- C:\Windows\System\SIyoQpr.exe
  C:\Windows\System\SIyoQpr.exe
  2⤵
  PID:5632
- C:\Windows\System\KqlTeSa.exe
  C:\Windows\System\KqlTeSa.exe
  2⤵
  PID:5648
- C:\Windows\System\BeMXSCE.exe
  C:\Windows\System\BeMXSCE.exe
  2⤵
  PID:5668
- C:\Windows\System\iUJnklt.exe
  C:\Windows\System\iUJnklt.exe
  2⤵
  PID:5684
- C:\Windows\System\EcJhTlH.exe
  C:\Windows\System\EcJhTlH.exe
  2⤵
  PID:5812
- C:\Windows\System\KvrWCqV.exe
  C:\Windows\System\KvrWCqV.exe
  2⤵
  PID:5836
- C:\Windows\System\UtasYSr.exe
  C:\Windows\System\UtasYSr.exe
  2⤵
  PID:5856
- C:\Windows\System\VJRecvz.exe
  C:\Windows\System\VJRecvz.exe
  2⤵
  PID:5872
- C:\Windows\System\bbUoAgh.exe
  C:\Windows\System\bbUoAgh.exe
  2⤵
  PID:5888
- C:\Windows\System\pNjWJkm.exe
  C:\Windows\System\pNjWJkm.exe
  2⤵
  PID:5920
- C:\Windows\System\JwaBAbL.exe
  C:\Windows\System\JwaBAbL.exe
  2⤵
  PID:5936
- C:\Windows\System\ZiHMMfM.exe
  C:\Windows\System\ZiHMMfM.exe
  2⤵
  PID:5956
- C:\Windows\System\wQxKqoj.exe
  C:\Windows\System\wQxKqoj.exe
  2⤵
  PID:5980
- C:\Windows\System\PcsmTkJ.exe
  C:\Windows\System\PcsmTkJ.exe
  2⤵
  PID:5996
- C:\Windows\System\SFXRcRZ.exe
  C:\Windows\System\SFXRcRZ.exe
  2⤵
  PID:6020
- C:\Windows\System\CLtSsAv.exe
  C:\Windows\System\CLtSsAv.exe
  2⤵
  PID:6036
- C:\Windows\System\GwrtkKM.exe
  C:\Windows\System\GwrtkKM.exe
  2⤵
  PID:6060
- C:\Windows\System\QCabHsd.exe
  C:\Windows\System\QCabHsd.exe
  2⤵
  PID:6080
- C:\Windows\System\dBmjRVL.exe
  C:\Windows\System\dBmjRVL.exe
  2⤵
  PID:6104
- C:\Windows\System\CROcnwu.exe
  C:\Windows\System\CROcnwu.exe
  2⤵
  PID:6124
- C:\Windows\System\SZLZAOS.exe
  C:\Windows\System\SZLZAOS.exe
  2⤵
  PID:6140
- C:\Windows\System\KOcKiRr.exe
  C:\Windows\System\KOcKiRr.exe
  2⤵
  PID:5160
- C:\Windows\System\bXVAWTp.exe
  C:\Windows\System\bXVAWTp.exe
  2⤵
  PID:5204
- C:\Windows\System\vLZKUVw.exe
  C:\Windows\System\vLZKUVw.exe
  2⤵
  PID:4472
- C:\Windows\System\DLYjVBY.exe
  C:\Windows\System\DLYjVBY.exe
  2⤵
  PID:1808
- C:\Windows\System\qjJEzqQ.exe
  C:\Windows\System\qjJEzqQ.exe
  2⤵
  PID:2604
- C:\Windows\System\zSStkkb.exe
  C:\Windows\System\zSStkkb.exe
  2⤵
  PID:5132
- C:\Windows\System\KxGmFTc.exe
  C:\Windows\System\KxGmFTc.exe
  2⤵
  PID:5228
- C:\Windows\System\viMQBqY.exe
  C:\Windows\System\viMQBqY.exe
  2⤵
  PID:5268
- C:\Windows\System\dBNfEcu.exe
  C:\Windows\System\dBNfEcu.exe
  2⤵
  PID:5324
- C:\Windows\System\rNkCJGO.exe
  C:\Windows\System\rNkCJGO.exe
  2⤵
  PID:5376
- C:\Windows\System\BBJqvmv.exe
  C:\Windows\System\BBJqvmv.exe
  2⤵
  PID:5412
- C:\Windows\System\fvJIKCH.exe
  C:\Windows\System\fvJIKCH.exe
  2⤵
  PID:1700
- C:\Windows\System\FHViagF.exe
  C:\Windows\System\FHViagF.exe
  2⤵
  PID:5496
- C:\Windows\System\YJITPaf.exe
  C:\Windows\System\YJITPaf.exe
  2⤵
  PID:5516
- C:\Windows\System\IoPKUvb.exe
  C:\Windows\System\IoPKUvb.exe
  2⤵
  PID:5572
- C:\Windows\System\YIhYnYg.exe
  C:\Windows\System\YIhYnYg.exe
  2⤵
  PID:2868
- C:\Windows\System\yqzbdJf.exe
  C:\Windows\System\yqzbdJf.exe
  2⤵
  PID:5792
- C:\Windows\System\rNWtCJn.exe
  C:\Windows\System\rNWtCJn.exe
  2⤵
  PID:5804
- C:\Windows\System\leuBcAW.exe
  C:\Windows\System\leuBcAW.exe
  2⤵
  PID:5784
- C:\Windows\System\yXjATQU.exe
  C:\Windows\System\yXjATQU.exe
  2⤵
  PID:5884
- C:\Windows\System\bkCROPJ.exe
  C:\Windows\System\bkCROPJ.exe
  2⤵
  PID:5868
- C:\Windows\System\ydvBNmZ.exe
  C:\Windows\System\ydvBNmZ.exe
  2⤵
  PID:5988
- C:\Windows\System\CBjUoep.exe
  C:\Windows\System\CBjUoep.exe
  2⤵
  PID:6004
- C:\Windows\System\UMJNTSC.exe
  C:\Windows\System\UMJNTSC.exe
  2⤵
  PID:5948
- C:\Windows\System\fuqhJYI.exe
  C:\Windows\System\fuqhJYI.exe
  2⤵
  PID:5068
- C:\Windows\System\twdcuvq.exe
  C:\Windows\System\twdcuvq.exe
  2⤵
  PID:6028
- C:\Windows\System\HnEzjDb.exe
  C:\Windows\System\HnEzjDb.exe
  2⤵
  PID:6068
- C:\Windows\System\QolZnWZ.exe
  C:\Windows\System\QolZnWZ.exe
  2⤵
  PID:6072
- C:\Windows\System\IpflAqn.exe
  C:\Windows\System\IpflAqn.exe
  2⤵
  PID:6136
- C:\Windows\System\diiQMqX.exe
  C:\Windows\System\diiQMqX.exe
  2⤵
  PID:920
- C:\Windows\System\epysDgl.exe
  C:\Windows\System\epysDgl.exe
  2⤵
  PID:3076
- C:\Windows\System\WofQwjS.exe
  C:\Windows\System\WofQwjS.exe
  2⤵
  PID:5260
- C:\Windows\System\xWoIfND.exe
  C:\Windows\System\xWoIfND.exe
  2⤵
  PID:5400
- C:\Windows\System\TWLyVUo.exe
  C:\Windows\System\TWLyVUo.exe
  2⤵
  PID:2348
- C:\Windows\System\VPBXaBY.exe
  C:\Windows\System\VPBXaBY.exe
  2⤵
  PID:3700
- C:\Windows\System\fqZtQdI.exe
  C:\Windows\System\fqZtQdI.exe
  2⤵
  PID:6176
- C:\Windows\System\VNkvFXS.exe
  C:\Windows\System\VNkvFXS.exe
  2⤵
  PID:6196
- C:\Windows\System\flkmVpc.exe
  C:\Windows\System\flkmVpc.exe
  2⤵
  PID:6216
- C:\Windows\System\xPHbLVs.exe
  C:\Windows\System\xPHbLVs.exe
  2⤵
  PID:6236
- C:\Windows\System\CwZeYlD.exe
  C:\Windows\System\CwZeYlD.exe
  2⤵
  PID:6256
- C:\Windows\System\ZUcaRFQ.exe
  C:\Windows\System\ZUcaRFQ.exe
  2⤵
  PID:6276
- C:\Windows\System\UPnrmJH.exe
  C:\Windows\System\UPnrmJH.exe
  2⤵
  PID:6292
- C:\Windows\System\oHPYENh.exe
  C:\Windows\System\oHPYENh.exe
  2⤵
  PID:6320
- C:\Windows\System\hbEOhow.exe
  C:\Windows\System\hbEOhow.exe
  2⤵
  PID:6340
- C:\Windows\System\aiWmuCt.exe
  C:\Windows\System\aiWmuCt.exe
  2⤵
  PID:6356
- C:\Windows\System\ZlbSYxc.exe
  C:\Windows\System\ZlbSYxc.exe
  2⤵
  PID:6376
- C:\Windows\System\tQvrwyD.exe
  C:\Windows\System\tQvrwyD.exe
  2⤵
  PID:6400
- C:\Windows\System\bFwLLxO.exe
  C:\Windows\System\bFwLLxO.exe
  2⤵
  PID:6420
- C:\Windows\System\aLmFslw.exe
  C:\Windows\System\aLmFslw.exe
  2⤵
  PID:6440
- C:\Windows\System\yVOJVCW.exe
  C:\Windows\System\yVOJVCW.exe
  2⤵
  PID:6460
- C:\Windows\System\OWelhbJ.exe
  C:\Windows\System\OWelhbJ.exe
  2⤵
  PID:6484
- C:\Windows\System\RDRReoj.exe
  C:\Windows\System\RDRReoj.exe
  2⤵
  PID:6500
- C:\Windows\System\oLduwRI.exe
  C:\Windows\System\oLduwRI.exe
  2⤵
  PID:6524
- C:\Windows\System\iPmYDJi.exe
  C:\Windows\System\iPmYDJi.exe
  2⤵
  PID:6548
- C:\Windows\System\TreHvMW.exe
  C:\Windows\System\TreHvMW.exe
  2⤵
  PID:6572
- C:\Windows\System\wPQWICE.exe
  C:\Windows\System\wPQWICE.exe
  2⤵
  PID:6592
- C:\Windows\System\mhCnIsV.exe
  C:\Windows\System\mhCnIsV.exe
  2⤵
  PID:6616
- C:\Windows\System\FhaKipM.exe
  C:\Windows\System\FhaKipM.exe
  2⤵
  PID:6640
- C:\Windows\System\ZLLCDLQ.exe
  C:\Windows\System\ZLLCDLQ.exe
  2⤵
  PID:6664
- C:\Windows\System\daVZiTZ.exe
  C:\Windows\System\daVZiTZ.exe
  2⤵
  PID:6680
- C:\Windows\System\vOjwvaE.exe
  C:\Windows\System\vOjwvaE.exe
  2⤵
  PID:6700
- C:\Windows\System\Nicezti.exe
  C:\Windows\System\Nicezti.exe
  2⤵
  PID:6724
- C:\Windows\System\EJOWDMo.exe
  C:\Windows\System\EJOWDMo.exe
  2⤵
  PID:6744
- C:\Windows\System\DlAgTwc.exe
  C:\Windows\System\DlAgTwc.exe
  2⤵
  PID:6764
- C:\Windows\System\lGpcCss.exe
  C:\Windows\System\lGpcCss.exe
  2⤵
  PID:6788
- C:\Windows\System\eIpFfOg.exe
  C:\Windows\System\eIpFfOg.exe
  2⤵
  PID:6812
- C:\Windows\System\lnmvPjj.exe
  C:\Windows\System\lnmvPjj.exe
  2⤵
  PID:6836
- C:\Windows\System\hGgRiBq.exe
  C:\Windows\System\hGgRiBq.exe
  2⤵
  PID:6852
- C:\Windows\System\IRJOStp.exe
  C:\Windows\System\IRJOStp.exe
  2⤵
  PID:6876
- C:\Windows\System\tsaqQUT.exe
  C:\Windows\System\tsaqQUT.exe
  2⤵
  PID:6900
- C:\Windows\System\mDNpiQH.exe
  C:\Windows\System\mDNpiQH.exe
  2⤵
  PID:6920
- C:\Windows\System\NUcEFQm.exe
  C:\Windows\System\NUcEFQm.exe
  2⤵
  PID:6944
- C:\Windows\System\Cigebrf.exe
  C:\Windows\System\Cigebrf.exe
  2⤵
  PID:6968
- C:\Windows\System\AXgPuuw.exe
  C:\Windows\System\AXgPuuw.exe
  2⤵
  PID:6988
- C:\Windows\System\yOwtNke.exe
  C:\Windows\System\yOwtNke.exe
  2⤵
  PID:7004
- C:\Windows\System\ZiUnHdr.exe
  C:\Windows\System\ZiUnHdr.exe
  2⤵
  PID:7028
- C:\Windows\System\rybVojG.exe
  C:\Windows\System\rybVojG.exe
  2⤵
  PID:7048
- C:\Windows\System\NHDoPIj.exe
  C:\Windows\System\NHDoPIj.exe
  2⤵
  PID:7072
- C:\Windows\System\hjBpKzD.exe
  C:\Windows\System\hjBpKzD.exe
  2⤵
  PID:7096
- C:\Windows\System\KKXrUpD.exe
  C:\Windows\System\KKXrUpD.exe
  2⤵
  PID:7112
- C:\Windows\System\hpsWWNo.exe
  C:\Windows\System\hpsWWNo.exe
  2⤵
  PID:7140
- C:\Windows\System\VlkLjGp.exe
  C:\Windows\System\VlkLjGp.exe
  2⤵
  PID:1100
- C:\Windows\System\XstaDfY.exe
  C:\Windows\System\XstaDfY.exe
  2⤵
  PID:4580
- C:\Windows\System\llPIiiT.exe
  C:\Windows\System\llPIiiT.exe
  2⤵
  PID:1580
- C:\Windows\System\Onbyrqb.exe
  C:\Windows\System\Onbyrqb.exe
  2⤵
  PID:4728
- C:\Windows\System\WgUgNtq.exe
  C:\Windows\System\WgUgNtq.exe
  2⤵
  PID:6120
- C:\Windows\System\omYBAAL.exe
  C:\Windows\System\omYBAAL.exe
  2⤵
  PID:5896
- C:\Windows\System\KmMcIDM.exe
  C:\Windows\System\KmMcIDM.exe
  2⤵
  PID:1096
- C:\Windows\System\zNMgnDN.exe
  C:\Windows\System\zNMgnDN.exe
  2⤵
  PID:5432
- C:\Windows\System\OPYbXqH.exe
  C:\Windows\System\OPYbXqH.exe
  2⤵
  PID:2924
- C:\Windows\System\sTSWBKC.exe
  C:\Windows\System\sTSWBKC.exe
  2⤵
  PID:4712
- C:\Windows\System\StABWfl.exe
  C:\Windows\System\StABWfl.exe
  2⤵
  PID:4924
- C:\Windows\System\CIwiPcT.exe
  C:\Windows\System\CIwiPcT.exe
  2⤵
  PID:6100
- C:\Windows\System\ydDBPZy.exe
  C:\Windows\System\ydDBPZy.exe
  2⤵
  PID:6132
- C:\Windows\System\jvLoBjk.exe
  C:\Windows\System\jvLoBjk.exe
  2⤵
  PID:6208
- C:\Windows\System\LxvxBWr.exe
  C:\Windows\System\LxvxBWr.exe
  2⤵
  PID:6452
- C:\Windows\System\OGOJHoK.exe
  C:\Windows\System\OGOJHoK.exe
  2⤵
  PID:6268
- C:\Windows\System\mQtAIyi.exe
  C:\Windows\System\mQtAIyi.exe
  2⤵
  PID:6608
- C:\Windows\System\wxhKzpb.exe
  C:\Windows\System\wxhKzpb.exe
  2⤵
  PID:5912
- C:\Windows\System\CKIUDEe.exe
  C:\Windows\System\CKIUDEe.exe
  2⤵
  PID:6780
- C:\Windows\System\qTjWBDe.exe
  C:\Windows\System\qTjWBDe.exe
  2⤵
  PID:6416
- C:\Windows\System\kjJbdBW.exe
  C:\Windows\System\kjJbdBW.exe
  2⤵
  PID:6940
- C:\Windows\System\EeIfUUj.exe
  C:\Windows\System\EeIfUUj.exe
  2⤵
  PID:6508
- C:\Windows\System\OtWuQjm.exe
  C:\Windows\System\OtWuQjm.exe
  2⤵
  PID:6544
- C:\Windows\System\LXiniKe.exe
  C:\Windows\System\LXiniKe.exe
  2⤵
  PID:6648
- C:\Windows\System\fkbvxNe.exe
  C:\Windows\System\fkbvxNe.exe
  2⤵
  PID:6388
- C:\Windows\System\DfMWavK.exe
  C:\Windows\System\DfMWavK.exe
  2⤵
  PID:6756
- C:\Windows\System\ydhpbEy.exe
  C:\Windows\System\ydhpbEy.exe
  2⤵
  PID:6828
- C:\Windows\System\dLQzoMP.exe
  C:\Windows\System\dLQzoMP.exe
  2⤵
  PID:7184
- C:\Windows\System\DQllpSo.exe
  C:\Windows\System\DQllpSo.exe
  2⤵
  PID:7208
- C:\Windows\System\ndhQtqh.exe
  C:\Windows\System\ndhQtqh.exe
  2⤵
  PID:7228
- C:\Windows\System\BLgfFIH.exe
  C:\Windows\System\BLgfFIH.exe
  2⤵
  PID:7248
- C:\Windows\System\LdIHoOY.exe
  C:\Windows\System\LdIHoOY.exe
  2⤵
  PID:7268
- C:\Windows\System\vZKYKxL.exe
  C:\Windows\System\vZKYKxL.exe
  2⤵
  PID:7292
- C:\Windows\System\cplIeMD.exe
  C:\Windows\System\cplIeMD.exe
  2⤵
  PID:7308
- C:\Windows\System\KPZrTpK.exe
  C:\Windows\System\KPZrTpK.exe
  2⤵
  PID:7332
- C:\Windows\System\zfAZVdJ.exe
  C:\Windows\System\zfAZVdJ.exe
  2⤵
  PID:7356
- C:\Windows\System\KuRMeZa.exe
  C:\Windows\System\KuRMeZa.exe
  2⤵
  PID:7376
- C:\Windows\System\NllBhEL.exe
  C:\Windows\System\NllBhEL.exe
  2⤵
  PID:7396
- C:\Windows\System\sVPwEfr.exe
  C:\Windows\System\sVPwEfr.exe
  2⤵
  PID:7416
- C:\Windows\System\bBPltyy.exe
  C:\Windows\System\bBPltyy.exe
  2⤵
  PID:7432
- C:\Windows\System\kWyoRHH.exe
  C:\Windows\System\kWyoRHH.exe
  2⤵
  PID:7456
- C:\Windows\System\ZjDVmvZ.exe
  C:\Windows\System\ZjDVmvZ.exe
  2⤵
  PID:7472
- C:\Windows\System\azplVQA.exe
  C:\Windows\System\azplVQA.exe
  2⤵
  PID:7492
- C:\Windows\System\XgoAeLS.exe
  C:\Windows\System\XgoAeLS.exe
  2⤵
  PID:7520
- C:\Windows\System\KrxpAKy.exe
  C:\Windows\System\KrxpAKy.exe
  2⤵
  PID:7540
- C:\Windows\System\Srnypqt.exe
  C:\Windows\System\Srnypqt.exe
  2⤵
  PID:7560
- C:\Windows\System\sbuGgRY.exe
  C:\Windows\System\sbuGgRY.exe
  2⤵
  PID:7584
- C:\Windows\System\NJEpeXh.exe
  C:\Windows\System\NJEpeXh.exe
  2⤵
  PID:7608
- C:\Windows\System\IqWjGhy.exe
  C:\Windows\System\IqWjGhy.exe
  2⤵
  PID:7632
- C:\Windows\System\JnuoiXu.exe
  C:\Windows\System\JnuoiXu.exe
  2⤵
  PID:7652
- C:\Windows\System\ZjiHvml.exe
  C:\Windows\System\ZjiHvml.exe
  2⤵
  PID:7676
- C:\Windows\System\igafavd.exe
  C:\Windows\System\igafavd.exe
  2⤵
  PID:7696
- C:\Windows\System\guZjcpH.exe
  C:\Windows\System\guZjcpH.exe
  2⤵
  PID:7724
- C:\Windows\System\knAGtco.exe
  C:\Windows\System\knAGtco.exe
  2⤵
  PID:7748
- C:\Windows\System\LDcrHGz.exe
  C:\Windows\System\LDcrHGz.exe
  2⤵
  PID:7764
- C:\Windows\System\YmdiJHN.exe
  C:\Windows\System\YmdiJHN.exe
  2⤵
  PID:7788
- C:\Windows\System\YDFuDuY.exe
  C:\Windows\System\YDFuDuY.exe
  2⤵
  PID:7808
- C:\Windows\System\sSycfvm.exe
  C:\Windows\System\sSycfvm.exe
  2⤵
  PID:7824
- C:\Windows\System\tLKCheP.exe
  C:\Windows\System\tLKCheP.exe
  2⤵
  PID:7856
- C:\Windows\System\UmJFZZl.exe
  C:\Windows\System\UmJFZZl.exe
  2⤵
  PID:7876
- C:\Windows\System\cfkVeHM.exe
  C:\Windows\System\cfkVeHM.exe
  2⤵
  PID:6432
- C:\Windows\System\EnLVmzN.exe
  C:\Windows\System\EnLVmzN.exe
  2⤵
  PID:7468
- C:\Windows\System\MxtNbxw.exe
  C:\Windows\System\MxtNbxw.exe
  2⤵
  PID:5004
- C:\Windows\System\FXfJHLS.exe
  C:\Windows\System\FXfJHLS.exe
  2⤵
  PID:7716
- C:\Windows\System\KmvbCDq.exe
  C:\Windows\System\KmvbCDq.exe
  2⤵
  PID:7060
- C:\Windows\System\yZMjamC.exe
  C:\Windows\System\yZMjamC.exe
  2⤵
  PID:7128
- C:\Windows\System\OTCnheC.exe
  C:\Windows\System\OTCnheC.exe
  2⤵
  PID:7924
- C:\Windows\System\szgmIjn.exe
  C:\Windows\System\szgmIjn.exe
  2⤵
  PID:5128
- C:\Windows\System\VeNonRx.exe
  C:\Windows\System\VeNonRx.exe
  2⤵
  PID:7244
- C:\Windows\System\WdNfiuX.exe
  C:\Windows\System\WdNfiuX.exe
  2⤵
  PID:7448
- C:\Windows\System\IukNroN.exe
  C:\Windows\System\IukNroN.exe
  2⤵
  PID:7532
- C:\Windows\System\FLkcuvS.exe
  C:\Windows\System\FLkcuvS.exe
  2⤵
  PID:3052
- C:\Windows\System\aKPNlJn.exe
  C:\Windows\System\aKPNlJn.exe
  2⤵
  PID:7668
- C:\Windows\System\DmXecDu.exe
  C:\Windows\System\DmXecDu.exe
  2⤵
  PID:6556
- C:\Windows\System\iyhJUhR.exe
  C:\Windows\System\iyhJUhR.exe
  2⤵
  PID:6732
- C:\Windows\System\PQCRMpm.exe
  C:\Windows\System\PQCRMpm.exe
  2⤵
  PID:7648
- C:\Windows\System\AvrOaYK.exe
  C:\Windows\System\AvrOaYK.exe
  2⤵
  PID:7744
- C:\Windows\System\CHUnGGG.exe
  C:\Windows\System\CHUnGGG.exe
  2⤵
  PID:7784
- C:\Windows\System\oLHAjsz.exe
  C:\Windows\System\oLHAjsz.exe
  2⤵
  PID:7816
- C:\Windows\System\Jlzfjhy.exe
  C:\Windows\System\Jlzfjhy.exe
  2⤵
  PID:8128
- C:\Windows\System\MSAnQmA.exe
  C:\Windows\System\MSAnQmA.exe
  2⤵
  PID:7944
- C:\Windows\System\ZuItMbv.exe
  C:\Windows\System\ZuItMbv.exe
  2⤵
  PID:8004
- C:\Windows\System\rFukCcR.exe
  C:\Windows\System\rFukCcR.exe
  2⤵
  PID:6912
- C:\Windows\System\cfzgKDl.exe
  C:\Windows\System\cfzgKDl.exe
  2⤵
  PID:8092
- C:\Windows\System\ygZsxTo.exe
  C:\Windows\System\ygZsxTo.exe
  2⤵
  PID:7160
- C:\Windows\System\KimxIVH.exe
  C:\Windows\System\KimxIVH.exe
  2⤵
  PID:8200
- C:\Windows\System\RPjoZJI.exe
  C:\Windows\System\RPjoZJI.exe
  2⤵
  PID:8216
- C:\Windows\System\CdfRWBU.exe
  C:\Windows\System\CdfRWBU.exe
  2⤵
  PID:8252
- C:\Windows\System\tFcRdsw.exe
  C:\Windows\System\tFcRdsw.exe
  2⤵
  PID:8280
- C:\Windows\System\BfOdXzc.exe
  C:\Windows\System\BfOdXzc.exe
  2⤵
  PID:8300
- C:\Windows\System\NyUtEyR.exe
  C:\Windows\System\NyUtEyR.exe
  2⤵
  PID:8316
- C:\Windows\System\ghrKTCD.exe
  C:\Windows\System\ghrKTCD.exe
  2⤵
  PID:8332
- C:\Windows\System\DmFsecB.exe
  C:\Windows\System\DmFsecB.exe
  2⤵
  PID:8356
- C:\Windows\System\hwTYvxR.exe
  C:\Windows\System\hwTYvxR.exe
  2⤵
  PID:8384
- C:\Windows\System\TiJZYWk.exe
  C:\Windows\System\TiJZYWk.exe
  2⤵
  PID:8500
- C:\Windows\System\LTkiJUc.exe
  C:\Windows\System\LTkiJUc.exe
  2⤵
  PID:8600
- C:\Windows\System\APzlqHP.exe
  C:\Windows\System\APzlqHP.exe
  2⤵
  PID:8624
- C:\Windows\System\NAaTWGy.exe
  C:\Windows\System\NAaTWGy.exe
  2⤵
  PID:8640
- C:\Windows\System\gxTtUse.exe
  C:\Windows\System\gxTtUse.exe
  2⤵
  PID:8656
- C:\Windows\System\JnHuAQF.exe
  C:\Windows\System\JnHuAQF.exe
  2⤵
  PID:8700
- C:\Windows\System\vrHcRFu.exe
  C:\Windows\System\vrHcRFu.exe
  2⤵
  PID:8716
- C:\Windows\System\HFtgbzO.exe
  C:\Windows\System\HFtgbzO.exe
  2⤵
  PID:8740
- C:\Windows\System\rDzYNfh.exe
  C:\Windows\System\rDzYNfh.exe
  2⤵
  PID:8760
- C:\Windows\System\ONSixkM.exe
  C:\Windows\System\ONSixkM.exe
  2⤵
  PID:8780
- C:\Windows\System\SgeJiNs.exe
  C:\Windows\System\SgeJiNs.exe
  2⤵
  PID:8800
- C:\Windows\System\LNlxMQL.exe
  C:\Windows\System\LNlxMQL.exe
  2⤵
  PID:8820
- C:\Windows\System\ljARPvK.exe
  C:\Windows\System\ljARPvK.exe
  2⤵
  PID:8856
- C:\Windows\System\qCGaJoi.exe
  C:\Windows\System\qCGaJoi.exe
  2⤵
  PID:8884
- C:\Windows\System\hjUFNAC.exe
  C:\Windows\System\hjUFNAC.exe
  2⤵
  PID:8908
- C:\Windows\System\QJxAAUs.exe
  C:\Windows\System\QJxAAUs.exe
  2⤵
  PID:8928
- C:\Windows\System\BRZyPor.exe
  C:\Windows\System\BRZyPor.exe
  2⤵
  PID:8948
- C:\Windows\System\acqHhtw.exe
  C:\Windows\System\acqHhtw.exe
  2⤵
  PID:8972
- C:\Windows\System\iFrIjPH.exe
  C:\Windows\System\iFrIjPH.exe
  2⤵
  PID:8992
- C:\Windows\System\PVcxMzO.exe
  C:\Windows\System\PVcxMzO.exe
  2⤵
  PID:9012
- C:\Windows\System\qQTpMBA.exe
  C:\Windows\System\qQTpMBA.exe
  2⤵
  PID:9036
- C:\Windows\System\LUMdEIn.exe
  C:\Windows\System\LUMdEIn.exe
  2⤵
  PID:9060
- C:\Windows\System\uuCMHnD.exe
  C:\Windows\System\uuCMHnD.exe
  2⤵
  PID:9080
- C:\Windows\System\fjQtJvs.exe
  C:\Windows\System\fjQtJvs.exe
  2⤵
  PID:9104
- C:\Windows\System\VLxAfzm.exe
  C:\Windows\System\VLxAfzm.exe
  2⤵
  PID:9124
- C:\Windows\System\ohpGUks.exe
  C:\Windows\System\ohpGUks.exe
  2⤵
  PID:9140
- C:\Windows\System\gfOHrUC.exe
  C:\Windows\System\gfOHrUC.exe
  2⤵
  PID:9164
- C:\Windows\System\QFCaobO.exe
  C:\Windows\System\QFCaobO.exe
  2⤵
  PID:9188
- C:\Windows\System\qMqVZYI.exe
  C:\Windows\System\qMqVZYI.exe
  2⤵
  PID:9204
- C:\Windows\System\tSoPjyj.exe
  C:\Windows\System\tSoPjyj.exe
  2⤵
  PID:7040
- C:\Windows\System\kHgOdAB.exe
  C:\Windows\System\kHgOdAB.exe
  2⤵
  PID:4940
- C:\Windows\System\EcuQkCa.exe
  C:\Windows\System\EcuQkCa.exe
  2⤵
  PID:7408
- C:\Windows\System\pYkcTxn.exe
  C:\Windows\System\pYkcTxn.exe
  2⤵
  PID:7992
- C:\Windows\System\bVsojdB.exe
  C:\Windows\System\bVsojdB.exe
  2⤵
  PID:7620
- C:\Windows\System\XgLxCqF.exe
  C:\Windows\System\XgLxCqF.exe
  2⤵
  PID:6804
- C:\Windows\System\bJgUEPC.exe
  C:\Windows\System\bJgUEPC.exe
  2⤵
  PID:1396
- C:\Windows\System\BHzjoPS.exe
  C:\Windows\System\BHzjoPS.exe
  2⤵
  PID:7216
- C:\Windows\System\GgqcAEG.exe
  C:\Windows\System\GgqcAEG.exe
  2⤵
  PID:6248
- C:\Windows\System\AHsYimn.exe
  C:\Windows\System\AHsYimn.exe
  2⤵
  PID:8268
- C:\Windows\System\PlwYZPq.exe
  C:\Windows\System\PlwYZPq.exe
  2⤵
  PID:8292
- C:\Windows\System\RvMxLYA.exe
  C:\Windows\System\RvMxLYA.exe
  2⤵
  PID:8328
- C:\Windows\System\xYKYgVc.exe
  C:\Windows\System\xYKYgVc.exe
  2⤵
  PID:4476
- C:\Windows\System\yDUcBGp.exe
  C:\Windows\System\yDUcBGp.exe
  2⤵
  PID:5392
- C:\Windows\System\EQjieMu.exe
  C:\Windows\System\EQjieMu.exe
  2⤵
  PID:7772
- C:\Windows\System\IFxtyFm.exe
  C:\Windows\System\IFxtyFm.exe
  2⤵
  PID:6540
- C:\Windows\System\TBYWqBA.exe
  C:\Windows\System\TBYWqBA.exe
  2⤵
  PID:6888
- C:\Windows\System\HJlstZn.exe
  C:\Windows\System\HJlstZn.exe
  2⤵
  PID:8212
- C:\Windows\System\yJSxwHn.exe
  C:\Windows\System\yJSxwHn.exe
  2⤵
  PID:8068
- C:\Windows\System\cSYZuKh.exe
  C:\Windows\System\cSYZuKh.exe
  2⤵
  PID:264
- C:\Windows\System\xLyRyqL.exe
  C:\Windows\System\xLyRyqL.exe
  2⤵
  PID:8208
- C:\Windows\System\tWYRhRs.exe
  C:\Windows\System\tWYRhRs.exe
  2⤵
  PID:8364
- C:\Windows\System\EeOAQyX.exe
  C:\Windows\System\EeOAQyX.exe
  2⤵
  PID:8616
- C:\Windows\System\lPSchtE.exe
  C:\Windows\System\lPSchtE.exe
  2⤵
  PID:8756
- C:\Windows\System\FfbLFlP.exe
  C:\Windows\System\FfbLFlP.exe
  2⤵
  PID:9076
- C:\Windows\System\DUUlUpH.exe
  C:\Windows\System\DUUlUpH.exe
  2⤵
  PID:9120
- C:\Windows\System\VrIVVeP.exe
  C:\Windows\System\VrIVVeP.exe
  2⤵
  PID:4716
- C:\Windows\System\xyUgzWl.exe
  C:\Windows\System\xyUgzWl.exe
  2⤵
  PID:8596
- C:\Windows\System\zdijGkH.exe
  C:\Windows\System\zdijGkH.exe
  2⤵
  PID:8664
- C:\Windows\System\XsCtXOg.exe
  C:\Windows\System\XsCtXOg.exe
  2⤵
  PID:7984
- C:\Windows\System\klMEIYL.exe
  C:\Windows\System\klMEIYL.exe
  2⤵
  PID:8968
- C:\Windows\System\JGGAFYc.exe
  C:\Windows\System\JGGAFYc.exe
  2⤵
  PID:8684
- C:\Windows\System\XZWkUqH.exe
  C:\Windows\System\XZWkUqH.exe
  2⤵
  PID:9156
- C:\Windows\System\EssniXv.exe
  C:\Windows\System\EssniXv.exe
  2⤵
  PID:6204
- C:\Windows\System\qfnFIkT.exe
  C:\Windows\System\qfnFIkT.exe
  2⤵
  PID:8676
- C:\Windows\System\YjSGaHf.exe
  C:\Windows\System\YjSGaHf.exe
  2⤵
  PID:9232
- C:\Windows\System\EUzBxfx.exe
  C:\Windows\System\EUzBxfx.exe
  2⤵
  PID:9248
- C:\Windows\System\NixYTNC.exe
  C:\Windows\System\NixYTNC.exe
  2⤵
  PID:9272
- C:\Windows\System\WGGGuxt.exe
  C:\Windows\System\WGGGuxt.exe
  2⤵
  PID:9296
- C:\Windows\System\TvAbcff.exe
  C:\Windows\System\TvAbcff.exe
  2⤵
  PID:9316
- C:\Windows\System\rhgNoHT.exe
  C:\Windows\System\rhgNoHT.exe
  2⤵
  PID:9336
- C:\Windows\System\xEnILPM.exe
  C:\Windows\System\xEnILPM.exe
  2⤵
  PID:9352
- C:\Windows\System\QhWyQWc.exe
  C:\Windows\System\QhWyQWc.exe
  2⤵
  PID:9372
- C:\Windows\System\WCUDkaZ.exe
  C:\Windows\System\WCUDkaZ.exe
  2⤵
  PID:9392
- C:\Windows\System\CnkcxUq.exe
  C:\Windows\System\CnkcxUq.exe
  2⤵
  PID:9448
- C:\Windows\System\kbePVWU.exe
  C:\Windows\System\kbePVWU.exe
  2⤵
  PID:9472
- C:\Windows\System\OaiBRnG.exe
  C:\Windows\System\OaiBRnG.exe
  2⤵
  PID:9492
- C:\Windows\System\GmhdYbu.exe
  C:\Windows\System\GmhdYbu.exe
  2⤵
  PID:9516
- C:\Windows\System\sGQOLfB.exe
  C:\Windows\System\sGQOLfB.exe
  2⤵
  PID:9536
- C:\Windows\System\eyuwlTn.exe
  C:\Windows\System\eyuwlTn.exe
  2⤵
  PID:9556
- C:\Windows\System\FZHhRqT.exe
  C:\Windows\System\FZHhRqT.exe
  2⤵
  PID:9576
- C:\Windows\System\JpJAQfU.exe
  C:\Windows\System\JpJAQfU.exe
  2⤵
  PID:9596
- C:\Windows\System\SeOmETP.exe
  C:\Windows\System\SeOmETP.exe
  2⤵
  PID:9620
- C:\Windows\System\HNByuwW.exe
  C:\Windows\System\HNByuwW.exe
  2⤵
  PID:9640
- C:\Windows\System\OLBSelT.exe
  C:\Windows\System\OLBSelT.exe
  2⤵
  PID:9664
- C:\Windows\System\JXKfscv.exe
  C:\Windows\System\JXKfscv.exe
  2⤵
  PID:9688
- C:\Windows\System\AJOqcAA.exe
  C:\Windows\System\AJOqcAA.exe
  2⤵
  PID:9708
- C:\Windows\System\NGqdLmR.exe
  C:\Windows\System\NGqdLmR.exe
  2⤵
  PID:9736
- C:\Windows\System\JRVGzJH.exe
  C:\Windows\System\JRVGzJH.exe
  2⤵
  PID:9760
- C:\Windows\System\udTfhzY.exe
  C:\Windows\System\udTfhzY.exe
  2⤵
  PID:9780
- C:\Windows\System\KkTdtmH.exe
  C:\Windows\System\KkTdtmH.exe
  2⤵
  PID:9800
- C:\Windows\System\URIGvKQ.exe
  C:\Windows\System\URIGvKQ.exe
  2⤵
  PID:9824
- C:\Windows\System\CnxZUdr.exe
  C:\Windows\System\CnxZUdr.exe
  2⤵
  PID:9844
- C:\Windows\System\RMmBCbt.exe
  C:\Windows\System\RMmBCbt.exe
  2⤵
  PID:9864
- C:\Windows\System\lgYYbTv.exe
  C:\Windows\System\lgYYbTv.exe
  2⤵
  PID:9880
- C:\Windows\System\eJOULZr.exe
  C:\Windows\System\eJOULZr.exe
  2⤵
  PID:9896
- C:\Windows\System\riNdzYu.exe
  C:\Windows\System\riNdzYu.exe
  2⤵
  PID:9920
- C:\Windows\System\bZYiRcu.exe
  C:\Windows\System\bZYiRcu.exe
  2⤵
  PID:9944
- C:\Windows\System\jFoLfIY.exe
  C:\Windows\System\jFoLfIY.exe
  2⤵
  PID:9960
- C:\Windows\System\vwnpcNz.exe
  C:\Windows\System\vwnpcNz.exe
  2⤵
  PID:9984
- C:\Windows\System\elQJqpV.exe
  C:\Windows\System\elQJqpV.exe
  2⤵
  PID:10004
- C:\Windows\System\xeQUGFb.exe
  C:\Windows\System\xeQUGFb.exe
  2⤵
  PID:10032
- C:\Windows\System\secEhIY.exe
  C:\Windows\System\secEhIY.exe
  2⤵
  PID:10052
- C:\Windows\System\uXhsMIP.exe
  C:\Windows\System\uXhsMIP.exe
  2⤵
  PID:10080
- C:\Windows\System\ctLXWnr.exe
  C:\Windows\System\ctLXWnr.exe
  2⤵
  PID:10100
- C:\Windows\System\KEZKRLC.exe
  C:\Windows\System\KEZKRLC.exe
  2⤵
  PID:10120
- C:\Windows\System\yUjQSvO.exe
  C:\Windows\System\yUjQSvO.exe
  2⤵
  PID:10140
- C:\Windows\System\axdSeSP.exe
  C:\Windows\System\axdSeSP.exe
  2⤵
  PID:10164
- C:\Windows\System\exKujLf.exe
  C:\Windows\System\exKujLf.exe
  2⤵
  PID:10180
- C:\Windows\System\bEERPlQ.exe
  C:\Windows\System\bEERPlQ.exe
  2⤵
  PID:10204
- C:\Windows\System\ILDxGkw.exe
  C:\Windows\System\ILDxGkw.exe
  2⤵
  PID:10224
- C:\Windows\System\ZViJrfI.exe
  C:\Windows\System\ZViJrfI.exe
  2⤵
  PID:8924
- C:\Windows\System\hntYLEf.exe
  C:\Windows\System\hntYLEf.exe
  2⤵
  PID:5828
- C:\Windows\System\sWqYsGC.exe
  C:\Windows\System\sWqYsGC.exe
  2⤵
  PID:8868
- C:\Windows\System\XQUQFNQ.exe
  C:\Windows\System\XQUQFNQ.exe
  2⤵
  PID:7760
- C:\Windows\System\LXEcpku.exe
  C:\Windows\System\LXEcpku.exe
  2⤵
  PID:9052
- C:\Windows\System\QhCvEXM.exe
  C:\Windows\System\QhCvEXM.exe
  2⤵
  PID:7516
- C:\Windows\System\hwFgbDM.exe
  C:\Windows\System\hwFgbDM.exe
  2⤵
  PID:9244
- C:\Windows\System\dpjleLH.exe
  C:\Windows\System\dpjleLH.exe
  2⤵
  PID:8944
- C:\Windows\System\AXlyLVX.exe
  C:\Windows\System\AXlyLVX.exe
  2⤵
  PID:7172
- C:\Windows\System\qNTDDmB.exe
  C:\Windows\System\qNTDDmB.exe
  2⤵
  PID:6808
- C:\Windows\System\naGmYZx.exe
  C:\Windows\System\naGmYZx.exe
  2⤵
  PID:8964
- C:\Windows\System\ZNkxihP.exe
  C:\Windows\System\ZNkxihP.exe
  2⤵
  PID:7580
- C:\Windows\System\wFMEjIO.exe
  C:\Windows\System\wFMEjIO.exe
  2⤵
  PID:6916
- C:\Windows\System\UbAHxCu.exe
  C:\Windows\System\UbAHxCu.exe
  2⤵
  PID:8612
- C:\Windows\System\CJeLlos.exe
  C:\Windows\System\CJeLlos.exe
  2⤵
  PID:1924
- C:\Windows\System\BdSMvKd.exe
  C:\Windows\System\BdSMvKd.exe
  2⤵
  PID:5692
- C:\Windows\System\LUKXmTd.exe
  C:\Windows\System\LUKXmTd.exe
  2⤵
  PID:8632
- C:\Windows\System\XzyNyho.exe
  C:\Windows\System\XzyNyho.exe
  2⤵
  PID:10248
- C:\Windows\System\NooUIHg.exe
  C:\Windows\System\NooUIHg.exe
  2⤵
  PID:10264
- C:\Windows\System\WAcBtry.exe
  C:\Windows\System\WAcBtry.exe
  2⤵
  PID:10280
- C:\Windows\System\JekduRH.exe
  C:\Windows\System\JekduRH.exe
  2⤵
  PID:10300
- C:\Windows\System\ynBRemZ.exe
  C:\Windows\System\ynBRemZ.exe
  2⤵
  PID:10320
- C:\Windows\System\AAfZUzQ.exe
  C:\Windows\System\AAfZUzQ.exe
  2⤵
  PID:10344
- C:\Windows\System\ZgQqCog.exe
  C:\Windows\System\ZgQqCog.exe
  2⤵
  PID:10364
- C:\Windows\System\FgytpOd.exe
  C:\Windows\System\FgytpOd.exe
  2⤵
  PID:10384
- C:\Windows\System\oSbeiPt.exe
  C:\Windows\System\oSbeiPt.exe
  2⤵
  PID:10404
- C:\Windows\System\ZGNTxVh.exe
  C:\Windows\System\ZGNTxVh.exe
  2⤵
  PID:10424
- C:\Windows\System\kFIGFVl.exe
  C:\Windows\System\kFIGFVl.exe
  2⤵
  PID:10452
- C:\Windows\System\dgjMdaK.exe
  C:\Windows\System\dgjMdaK.exe
  2⤵
  PID:10472
- C:\Windows\System\rfuBHCq.exe
  C:\Windows\System\rfuBHCq.exe
  2⤵
  PID:10496
- C:\Windows\System\YMlyKnt.exe
  C:\Windows\System\YMlyKnt.exe
  2⤵
  PID:10520
- C:\Windows\System\OjfMaKS.exe
  C:\Windows\System\OjfMaKS.exe
  2⤵
  PID:10544
- C:\Windows\System\sESnKnZ.exe
  C:\Windows\System\sESnKnZ.exe
  2⤵
  PID:10564
- C:\Windows\System\KOfXTCf.exe
  C:\Windows\System\KOfXTCf.exe
  2⤵
  PID:10584
- C:\Windows\System\ZWNICmN.exe
  C:\Windows\System\ZWNICmN.exe
  2⤵
  PID:10608
- C:\Windows\System\bLxMTSe.exe
  C:\Windows\System\bLxMTSe.exe
  2⤵
  PID:10632
- C:\Windows\System\giAbmVg.exe
  C:\Windows\System\giAbmVg.exe
  2⤵
  PID:10652
- C:\Windows\System\HHgUscU.exe
  C:\Windows\System\HHgUscU.exe
  2⤵
  PID:10672
- C:\Windows\System\aixBExz.exe
  C:\Windows\System\aixBExz.exe
  2⤵
  PID:10696
- C:\Windows\System\UbJsNTE.exe
  C:\Windows\System\UbJsNTE.exe
  2⤵
  PID:10796
- C:\Windows\System\VkYeNGe.exe
  C:\Windows\System\VkYeNGe.exe
  2⤵
  PID:10812
- C:\Windows\System\uAuxOzk.exe
  C:\Windows\System\uAuxOzk.exe
  2⤵
  PID:10832
- C:\Windows\System\OUSAcrl.exe
  C:\Windows\System\OUSAcrl.exe
  2⤵
  PID:10864
- C:\Windows\System\NFEJDBX.exe
  C:\Windows\System\NFEJDBX.exe
  2⤵
  PID:10888
- C:\Windows\System\LQSruXI.exe
  C:\Windows\System\LQSruXI.exe
  2⤵
  PID:11108
- C:\Windows\System\hZWQRMk.exe
  C:\Windows\System\hZWQRMk.exe
  2⤵
  PID:11124
- C:\Windows\System\hfbkqnX.exe
  C:\Windows\System\hfbkqnX.exe
  2⤵
  PID:11140
- C:\Windows\System\iHEHAOq.exe
  C:\Windows\System\iHEHAOq.exe
  2⤵
  PID:11156
- C:\Windows\System\azrtlkC.exe
  C:\Windows\System\azrtlkC.exe
  2⤵
  PID:11176
- C:\Windows\System\OlKXkBx.exe
  C:\Windows\System\OlKXkBx.exe
  2⤵
  PID:11192
- C:\Windows\System\HbwtAqC.exe
  C:\Windows\System\HbwtAqC.exe
  2⤵
  PID:11208
- C:\Windows\System\gBXiTVY.exe
  C:\Windows\System\gBXiTVY.exe
  2⤵
  PID:11228
- C:\Windows\System\XQnnwLj.exe
  C:\Windows\System\XQnnwLj.exe
  2⤵
  PID:11244
- C:\Windows\System\SLijDcC.exe
  C:\Windows\System\SLijDcC.exe
  2⤵
  PID:9388
- C:\Windows\System\zFmIkcR.exe
  C:\Windows\System\zFmIkcR.exe
  2⤵
  PID:10640
- C:\Windows\System\RyLzMvo.exe
  C:\Windows\System\RyLzMvo.exe
  2⤵
  PID:4956
- C:\Windows\System\xDpZxoD.exe
  C:\Windows\System\xDpZxoD.exe
  2⤵
  PID:9860
- C:\Windows\System\BbqYxeL.exe
  C:\Windows\System\BbqYxeL.exe
  2⤵
  PID:9908
- C:\Windows\System\TPTKcxy.exe
  C:\Windows\System\TPTKcxy.exe
  2⤵
  PID:10040
- C:\Windows\System\pbfkvjx.exe
  C:\Windows\System\pbfkvjx.exe
  2⤵
  PID:10792
- C:\Windows\System\pECiBmy.exe
  C:\Windows\System\pECiBmy.exe
  2⤵
  PID:8708
- C:\Windows\System\eBzyELd.exe
  C:\Windows\System\eBzyELd.exe
  2⤵
  PID:8536
- C:\Windows\System\clRekyG.exe
  C:\Windows\System\clRekyG.exe
  2⤵
  PID:9256
- C:\Windows\System\cKGOgWX.exe
  C:\Windows\System\cKGOgWX.exe
  2⤵
  PID:9568
- C:\Windows\System\MpKvJKi.exe
  C:\Windows\System\MpKvJKi.exe
  2⤵
  PID:9704
- C:\Windows\System\IaYNREl.exe
  C:\Windows\System\IaYNREl.exe
  2⤵
  PID:9748
- C:\Windows\System\sjltbil.exe
  C:\Windows\System\sjltbil.exe
  2⤵
  PID:9952
- C:\Windows\System\flMePhC.exe
  C:\Windows\System\flMePhC.exe
  2⤵
  PID:9996
- C:\Windows\System\YgZKVWQ.exe
  C:\Windows\System\YgZKVWQ.exe
  2⤵
  PID:8832
- C:\Windows\System\VfknfQq.exe
  C:\Windows\System\VfknfQq.exe
  2⤵
  PID:9240
- C:\Windows\System\uVaRoiR.exe
  C:\Windows\System\uVaRoiR.exe
  2⤵
  PID:7740
- C:\Windows\System\qsAlQUG.exe
  C:\Windows\System\qsAlQUG.exe
  2⤵
  PID:9360
- C:\Windows\System\URAgKCP.exe
  C:\Windows\System\URAgKCP.exe
  2⤵
  PID:3448
- C:\Windows\System\EcLMftR.exe
  C:\Windows\System\EcLMftR.exe
  2⤵
  PID:9456
- C:\Windows\System\SPVOdEn.exe
  C:\Windows\System\SPVOdEn.exe
  2⤵
  PID:10276
- C:\Windows\System\SIMfVbz.exe
  C:\Windows\System\SIMfVbz.exe
  2⤵
  PID:10312
- C:\Windows\System\RqGUAgY.exe
  C:\Windows\System\RqGUAgY.exe
  2⤵
  PID:10340
- C:\Windows\System\uUDulhq.exe
  C:\Windows\System\uUDulhq.exe
  2⤵
  PID:10392
- C:\Windows\System\OIFrtdg.exe
  C:\Windows\System\OIFrtdg.exe
  2⤵
  PID:10440
- C:\Windows\System\DXjpLNB.exe
  C:\Windows\System\DXjpLNB.exe
  2⤵
  PID:10504
- C:\Windows\System\rTCmOwc.exe
  C:\Windows\System\rTCmOwc.exe
  2⤵
  PID:10592
- C:\Windows\System\kFTjNuo.exe
  C:\Windows\System\kFTjNuo.exe
  2⤵
  PID:11272
- C:\Windows\System\KHnJZnQ.exe
  C:\Windows\System\KHnJZnQ.exe
  2⤵
  PID:11292
- C:\Windows\System\qbYcxIA.exe
  C:\Windows\System\qbYcxIA.exe
  2⤵
  PID:11320
- C:\Windows\System\NXPMOsv.exe
  C:\Windows\System\NXPMOsv.exe
  2⤵
  PID:11348
- C:\Windows\System\XvStJzi.exe
  C:\Windows\System\XvStJzi.exe
  2⤵
  PID:11364
- C:\Windows\System\jldPUZa.exe
  C:\Windows\System\jldPUZa.exe
  2⤵
  PID:11380
- C:\Windows\System\KYiuaRE.exe
  C:\Windows\System\KYiuaRE.exe
  2⤵
  PID:11404
- C:\Windows\System\fLXlmGw.exe
  C:\Windows\System\fLXlmGw.exe
  2⤵
  PID:11424
- C:\Windows\System\VdVEVkU.exe
  C:\Windows\System\VdVEVkU.exe
  2⤵
  PID:11456
- C:\Windows\System\LsXujiC.exe
  C:\Windows\System\LsXujiC.exe
  2⤵
  PID:11472
- C:\Windows\System\wWkQkDI.exe
  C:\Windows\System\wWkQkDI.exe
  2⤵
  PID:11492
- C:\Windows\System\SVdHjtL.exe
  C:\Windows\System\SVdHjtL.exe
  2⤵
  PID:11512
- C:\Windows\System\SzdFMfe.exe
  C:\Windows\System\SzdFMfe.exe
  2⤵
  PID:11532
- C:\Windows\System\UFMqWRi.exe
  C:\Windows\System\UFMqWRi.exe
  2⤵
  PID:11552
- C:\Windows\System\kFTpWku.exe
  C:\Windows\System\kFTpWku.exe
  2⤵
  PID:11580
- C:\Windows\System\MZdDdFz.exe
  C:\Windows\System\MZdDdFz.exe
  2⤵
  PID:11600
- C:\Windows\System\GkGHntD.exe
  C:\Windows\System\GkGHntD.exe
  2⤵
  PID:11616
- C:\Windows\System\Ffyeybj.exe
  C:\Windows\System\Ffyeybj.exe
  2⤵
  PID:11636
- C:\Windows\System\hyviqGb.exe
  C:\Windows\System\hyviqGb.exe
  2⤵
  PID:11660
- C:\Windows\System\pVjygMx.exe
  C:\Windows\System\pVjygMx.exe
  2⤵
  PID:11680
- C:\Windows\System\yXaddfu.exe
  C:\Windows\System\yXaddfu.exe
  2⤵
  PID:11704
- C:\Windows\System\QQdzYrY.exe
  C:\Windows\System\QQdzYrY.exe
  2⤵
  PID:11720
- C:\Windows\System\IixBgCS.exe
  C:\Windows\System\IixBgCS.exe
  2⤵
  PID:11748
- C:\Windows\System\oWxvQbF.exe
  C:\Windows\System\oWxvQbF.exe
  2⤵
  PID:11772
- C:\Windows\System\LfALfrs.exe
  C:\Windows\System\LfALfrs.exe
  2⤵
  PID:12120
- C:\Windows\System\mAhrIJZ.exe
  C:\Windows\System\mAhrIJZ.exe
  2⤵
  PID:12136
- C:\Windows\System\GmoGIFg.exe
  C:\Windows\System\GmoGIFg.exe
  2⤵
  PID:12156
- C:\Windows\System\qXNTGPG.exe
  C:\Windows\System\qXNTGPG.exe
  2⤵
  PID:12176
- C:\Windows\System\aVqwlzL.exe
  C:\Windows\System\aVqwlzL.exe
  2⤵
  PID:12200
- C:\Windows\System\PhkMqUK.exe
  C:\Windows\System\PhkMqUK.exe
  2⤵
  PID:12220
- C:\Windows\System\BcNgvpw.exe
  C:\Windows\System\BcNgvpw.exe
  2⤵
  PID:12240
- C:\Windows\System\DAjPaLB.exe
  C:\Windows\System\DAjPaLB.exe
  2⤵
  PID:12264
- C:\Windows\System\YpOkuxG.exe
  C:\Windows\System\YpOkuxG.exe
  2⤵
  PID:11072
- C:\Windows\System\QDRnhzW.exe
  C:\Windows\System\QDRnhzW.exe
  2⤵
  PID:9756
- C:\Windows\System\fQwimrg.exe
  C:\Windows\System\fQwimrg.exe
  2⤵
  PID:9832
- C:\Windows\System\mqJINEP.exe
  C:\Windows\System\mqJINEP.exe
  2⤵
  PID:10828
- C:\Windows\System\AdmQkIf.exe
  C:\Windows\System\AdmQkIf.exe
  2⤵
  PID:10904
- C:\Windows\System\zzYMlkT.exe
  C:\Windows\System\zzYMlkT.exe
  2⤵
  PID:11148
- C:\Windows\System\eiLvAJL.exe
  C:\Windows\System\eiLvAJL.exe
  2⤵
  PID:10092
- C:\Windows\System\VNsRvoI.exe
  C:\Windows\System\VNsRvoI.exe
  2⤵
  PID:8776
- C:\Windows\System\drCPyhC.exe
  C:\Windows\System\drCPyhC.exe
  2⤵
  PID:4820
- C:\Windows\System\PQJYVSR.exe
  C:\Windows\System\PQJYVSR.exe
  2⤵
  PID:9308
- C:\Windows\System\hhiUIDp.exe
  C:\Windows\System\hhiUIDp.exe
  2⤵
  PID:10416
- C:\Windows\System\Ecooaxg.exe
  C:\Windows\System\Ecooaxg.exe
  2⤵
  PID:1556
- C:\Windows\System\PILCJIz.exe
  C:\Windows\System\PILCJIz.exe
  2⤵
  PID:11500
- C:\Windows\System\vWNnldd.exe
  C:\Windows\System\vWNnldd.exe
  2⤵
  PID:11204
- C:\Windows\System\YnWVHLg.exe
  C:\Windows\System\YnWVHLg.exe
  2⤵
  PID:9604
- C:\Windows\System\EEkAGCc.exe
  C:\Windows\System\EEkAGCc.exe
  2⤵
  PID:11240
- C:\Windows\System\WrgxzDZ.exe
  C:\Windows\System\WrgxzDZ.exe
  2⤵
  PID:10624
- C:\Windows\System\ryEkvNX.exe
  C:\Windows\System\ryEkvNX.exe
  2⤵
  PID:10072
- C:\Windows\System\QgPoWeU.exe
  C:\Windows\System\QgPoWeU.exe
  2⤵
  PID:12300
- C:\Windows\System\oTOqoHL.exe
  C:\Windows\System\oTOqoHL.exe
  2⤵
  PID:12320
- C:\Windows\System\BMSWOqE.exe
  C:\Windows\System\BMSWOqE.exe
  2⤵
  PID:12344
- C:\Windows\System\dgqxyvO.exe
  C:\Windows\System\dgqxyvO.exe
  2⤵
  PID:12368
- C:\Windows\System\hrqCgEs.exe
  C:\Windows\System\hrqCgEs.exe
  2⤵
  PID:12404
- C:\Windows\System\BbDBUgM.exe
  C:\Windows\System\BbDBUgM.exe
  2⤵
  PID:12428
- C:\Windows\System\hxXupXd.exe
  C:\Windows\System\hxXupXd.exe
  2⤵
  PID:12448
- C:\Windows\System\EJYYZiz.exe
  C:\Windows\System\EJYYZiz.exe
  2⤵
  PID:12464
- C:\Windows\System\neghEWg.exe
  C:\Windows\System\neghEWg.exe
  2⤵
  PID:12480
- C:\Windows\System\uACLPsU.exe
  C:\Windows\System\uACLPsU.exe
  2⤵
  PID:12496
- C:\Windows\System\KosFQOK.exe
  C:\Windows\System\KosFQOK.exe
  2⤵
  PID:12512
- C:\Windows\System\PxPmweh.exe
  C:\Windows\System\PxPmweh.exe
  2⤵
  PID:12532
- C:\Windows\System\JaMRJfM.exe
  C:\Windows\System\JaMRJfM.exe
  2⤵
  PID:12548
- C:\Windows\System\hWNiKyQ.exe
  C:\Windows\System\hWNiKyQ.exe
  2⤵
  PID:12572
- C:\Windows\System\MMQrrhC.exe
  C:\Windows\System\MMQrrhC.exe
  2⤵
  PID:12608
- C:\Windows\System\CDCsPFz.exe
  C:\Windows\System\CDCsPFz.exe
  2⤵
  PID:12628
- C:\Windows\System\oSLEkKP.exe
  C:\Windows\System\oSLEkKP.exe
  2⤵
  PID:12648
- C:\Windows\System\oxOCIPa.exe
  C:\Windows\System\oxOCIPa.exe
  2⤵
  PID:12676
- C:\Windows\System\WyyMsSL.exe
  C:\Windows\System\WyyMsSL.exe
  2⤵
  PID:12692
- C:\Windows\System\vgOOvoo.exe
  C:\Windows\System\vgOOvoo.exe
  2⤵
  PID:12708
- C:\Windows\System\PpADLdW.exe
  C:\Windows\System\PpADLdW.exe
  2⤵
  PID:12724
- C:\Windows\System\jVHBTvz.exe
  C:\Windows\System\jVHBTvz.exe
  2⤵
  PID:12740
- C:\Windows\System\BAnoyIq.exe
  C:\Windows\System\BAnoyIq.exe
  2⤵
  PID:12764
- C:\Windows\System\RDevXzb.exe
  C:\Windows\System\RDevXzb.exe
  2⤵
  PID:12780
- C:\Windows\System\tGtXfGM.exe
  C:\Windows\System\tGtXfGM.exe
  2⤵
  PID:12800
- C:\Windows\System\rMcMScL.exe
  C:\Windows\System\rMcMScL.exe
  2⤵
  PID:12824
- C:\Windows\System\alaFUAm.exe
  C:\Windows\System\alaFUAm.exe
  2⤵
  PID:12840
- C:\Windows\System\JJBPzgD.exe
  C:\Windows\System\JJBPzgD.exe
  2⤵
  PID:12860
- C:\Windows\System\ewYbYdB.exe
  C:\Windows\System\ewYbYdB.exe
  2⤵
  PID:12888
- C:\Windows\System\ZtKrFTe.exe
  C:\Windows\System\ZtKrFTe.exe
  2⤵
  PID:12916
- C:\Windows\System\LnyyZEp.exe
  C:\Windows\System\LnyyZEp.exe
  2⤵
  PID:12932
- C:\Windows\System\ASXPPjp.exe
  C:\Windows\System\ASXPPjp.exe
  2⤵
  PID:12956
- C:\Windows\System\xJElgYb.exe
  C:\Windows\System\xJElgYb.exe
  2⤵
  PID:12976
- C:\Windows\System\lUjLfGE.exe
  C:\Windows\System\lUjLfGE.exe
  2⤵
  PID:13000
- C:\Windows\System\Ombnegg.exe
  C:\Windows\System\Ombnegg.exe
  2⤵
  PID:13020
- C:\Windows\System\wBlmreW.exe
  C:\Windows\System\wBlmreW.exe
  2⤵
  PID:13040
- C:\Windows\System\wHdUxvb.exe
  C:\Windows\System\wHdUxvb.exe
  2⤵
  PID:13068
- C:\Windows\System\XPlBSmA.exe
  C:\Windows\System\XPlBSmA.exe
  2⤵
  PID:13084
- C:\Windows\System\IUvmSHz.exe
  C:\Windows\System\IUvmSHz.exe
  2⤵
  PID:10328
- C:\Windows\System\CYIFbjz.exe
  C:\Windows\System\CYIFbjz.exe
  2⤵
  PID:10468
- C:\Windows\System\xiraJzl.exe
  C:\Windows\System\xiraJzl.exe
  2⤵
  PID:11284
- C:\Windows\System\FsxUUCw.exe
  C:\Windows\System\FsxUUCw.exe
  2⤵
  PID:9632
- C:\Windows\System\hZlvEkh.exe
  C:\Windows\System\hZlvEkh.exe
  2⤵
  PID:9672
- C:\Windows\System\DKijNLF.exe
  C:\Windows\System\DKijNLF.exe
  2⤵
  PID:11396
- C:\Windows\System\RpLHsSd.exe
  C:\Windows\System\RpLHsSd.exe
  2⤵
  PID:11452
- C:\Windows\System\KIdhcIF.exe
  C:\Windows\System\KIdhcIF.exe
  2⤵
  PID:11568
- C:\Windows\System\KGUUSoh.exe
  C:\Windows\System\KGUUSoh.exe
  2⤵
  PID:11628
- C:\Windows\System\gTOjsnw.exe
  C:\Windows\System\gTOjsnw.exe
  2⤵
  PID:11728
- C:\Windows\System\gNEthaJ.exe
  C:\Windows\System\gNEthaJ.exe
  2⤵
  PID:11784
- C:\Windows\System\mZjKbVY.exe
  C:\Windows\System\mZjKbVY.exe
  2⤵
  PID:12144
- C:\Windows\System\giSKZlg.exe
  C:\Windows\System\giSKZlg.exe
  2⤵
  PID:12232
- C:\Windows\System\OopHFnu.exe
  C:\Windows\System\OopHFnu.exe
  2⤵
  PID:12564
- C:\Windows\System\UKVwoBO.exe
  C:\Windows\System\UKVwoBO.exe
  2⤵
  PID:12644
- C:\Windows\System\TYyeFli.exe
  C:\Windows\System\TYyeFli.exe
  2⤵
  PID:13264
- C:\Windows\System\puMXBRq.exe
  C:\Windows\System\puMXBRq.exe
  2⤵
  PID:9212
- C:\Windows\System\mlASNgL.exe
  C:\Windows\System\mlASNgL.exe
  2⤵
  PID:2284
- C:\Windows\System\oBdhnha.exe
  C:\Windows\System\oBdhnha.exe
  2⤵
  PID:11376
- C:\Windows\System\yBEiBEI.exe
  C:\Windows\System\yBEiBEI.exe
  2⤵
  PID:10712
- C:\Windows\System\TBVDyir.exe
  C:\Windows\System\TBVDyir.exe
  2⤵
  PID:10116
- C:\Windows\System\OULwnqp.exe
  C:\Windows\System\OULwnqp.exe
  2⤵
  PID:3440
- C:\Windows\System\YZdbktJ.exe
  C:\Windows\System\YZdbktJ.exe
  2⤵
  PID:11508
- C:\Windows\System\pUgJFJf.exe
  C:\Windows\System\pUgJFJf.exe
  2⤵
  PID:12796
- C:\Windows\System\dOedEcD.exe
  C:\Windows\System\dOedEcD.exe
  2⤵
  PID:4420
- C:\Windows\System\oqerYmV.exe
  C:\Windows\System\oqerYmV.exe
  2⤵
  PID:12276
- C:\Windows\System\WsHcAEx.exe
  C:\Windows\System\WsHcAEx.exe
  2⤵
  PID:10196
- C:\Windows\System\fcNkGyN.exe
  C:\Windows\System\fcNkGyN.exe
  2⤵
  PID:2980
- C:\Windows\System\CwECSgh.exe
  C:\Windows\System\CwECSgh.exe
  2⤵
  PID:3080
- C:\Windows\System\AwSqtYR.exe
  C:\Windows\System\AwSqtYR.exe
  2⤵
  PID:4832
- C:\Windows\System\UhVMldv.exe
  C:\Windows\System\UhVMldv.exe
  2⤵
  PID:13276
- C:\Windows\System\TtrSmwl.exe
  C:\Windows\System\TtrSmwl.exe
  2⤵
  PID:12904
- C:\Windows\System\OfAuFvK.exe
  C:\Windows\System\OfAuFvK.exe
  2⤵
  PID:13076
- C:\Windows\System\cYuvrtQ.exe
  C:\Windows\System\cYuvrtQ.exe
  2⤵
  PID:4064
- C:\Windows\System\axDMBVS.exe
  C:\Windows\System\axDMBVS.exe
  2⤵
  PID:5780
- C:\Windows\System\ZNOKBXj.exe
  C:\Windows\System\ZNOKBXj.exe
  2⤵
  PID:13252
- C:\Windows\System\fcopsIE.exe
  C:\Windows\System\fcopsIE.exe
  2⤵
  PID:13176
- C:\Windows\System\CKOdXpY.exe
  C:\Windows\System\CKOdXpY.exe
  2⤵
  PID:11700
- C:\Windows\System\GHAFqwp.exe
  C:\Windows\System\GHAFqwp.exe
  2⤵
  PID:9616
- C:\Windows\System\lmpDHoe.exe
  C:\Windows\System\lmpDHoe.exe
  2⤵
  PID:4408
- C:\Windows\System\QVYlzUx.exe
  C:\Windows\System\QVYlzUx.exe
  2⤵
  PID:3260
- C:\Windows\System\wbDuxPO.exe
  C:\Windows\System\wbDuxPO.exe
  2⤵
  PID:13052
- C:\Windows\System\pdRfjlK.exe
  C:\Windows\System\pdRfjlK.exe
  2⤵
  PID:13144
- C:\Windows\System\ITFUUNQ.exe
  C:\Windows\System\ITFUUNQ.exe
  2⤵
  PID:6712
- C:\Windows\System\lQLgcyV.exe
  C:\Windows\System\lQLgcyV.exe
  2⤵
  PID:4428
- C:\Windows\System\KOdfWIe.exe
  C:\Windows\System\KOdfWIe.exe
  2⤵
  PID:11280
- C:\Windows\System\wSxyhFS.exe
  C:\Windows\System\wSxyhFS.exe
  2⤵
  PID:4884
- C:\Windows\System\pLqfBUF.exe
  C:\Windows\System\pLqfBUF.exe
  2⤵
  PID:9564
- C:\Windows\System\xdLKtKX.exe
  C:\Windows\System\xdLKtKX.exe
  2⤵
  PID:11868
- C:\Windows\System\lkEdhhD.exe
  C:\Windows\System\lkEdhhD.exe
  2⤵
  PID:13032
- C:\Windows\System\fYLesGb.exe
  C:\Windows\System\fYLesGb.exe
  2⤵
  PID:5732
- C:\Windows\System\AnTYCeF.exe
  C:\Windows\System\AnTYCeF.exe
  2⤵
  PID:5708
- C:\Windows\System\TVUVIhM.exe
  C:\Windows\System\TVUVIhM.exe
  2⤵
  PID:13172
- C:\Windows\System\ffHyfTI.exe
  C:\Windows\System\ffHyfTI.exe
  2⤵
  PID:4952
- C:\Windows\System\wPXOxoS.exe
  C:\Windows\System\wPXOxoS.exe
  2⤵
  PID:8576
- C:\Windows\System\kkekrzL.exe
  C:\Windows\System\kkekrzL.exe
  2⤵
  PID:12364
- C:\Windows\System\OcpstAX.exe
  C:\Windows\System\OcpstAX.exe
  2⤵
  PID:11488
- C:\Windows\System\kHKWrRZ.exe
  C:\Windows\System\kHKWrRZ.exe
  2⤵
  PID:1476
- C:\Windows\System\IClUFRm.exe
  C:\Windows\System\IClUFRm.exe
  2⤵
  PID:3964
- C:\Windows\System\kPVfouI.exe
  C:\Windows\System\kPVfouI.exe
  2⤵
  PID:13296
- C:\Windows\System\BtDZHnw.exe
  C:\Windows\System\BtDZHnw.exe
  2⤵
  PID:10688
- C:\Windows\System\jOnvvbS.exe
  C:\Windows\System\jOnvvbS.exe
  2⤵
  PID:11656
- C:\Windows\System\OGfGSjg.exe
  C:\Windows\System\OGfGSjg.exe
  2⤵
  PID:11792
- C:\Windows\System\ucLXSCd.exe
  C:\Windows\System\ucLXSCd.exe
  2⤵
  PID:4948
- C:\Windows\System\kPhAIhl.exe
  C:\Windows\System\kPhAIhl.exe
  2⤵
  PID:876
- C:\Windows\System\udGDYyU.exe
  C:\Windows\System\udGDYyU.exe
  2⤵
  PID:12184
- C:\Windows\System\ZjXYSYE.exe
  C:\Windows\System\ZjXYSYE.exe
  2⤵
  PID:11712
- C:\Windows\System\BRtYqmU.exe
  C:\Windows\System\BRtYqmU.exe
  2⤵
  PID:2544
- C:\Windows\System\eLyhzrp.exe
  C:\Windows\System\eLyhzrp.exe
  2⤵
  PID:5644
- C:\Windows\System\MYeCxuc.exe
  C:\Windows\System\MYeCxuc.exe
  2⤵
  PID:1092
- C:\Windows\System\NImfFsw.exe
  C:\Windows\System\NImfFsw.exe
  2⤵
  PID:13012
- C:\Windows\System\tDLyFQq.exe
  C:\Windows\System\tDLyFQq.exe
  2⤵
  PID:1704
- C:\Windows\System\bSwQatE.exe
  C:\Windows\System\bSwQatE.exe
  2⤵
  PID:11332
- C:\Windows\System\lyIcQij.exe
  C:\Windows\System\lyIcQij.exe
  2⤵
  PID:9976
- C:\Windows\System\bkolMFI.exe
  C:\Windows\System\bkolMFI.exe
  2⤵
  PID:5020
- C:\Windows\System\usQplgm.exe
  C:\Windows\System\usQplgm.exe
  2⤵
  PID:12196
- C:\Windows\System\lRcdDmT.exe
  C:\Windows\System\lRcdDmT.exe
  2⤵
  PID:2272
- C:\Windows\System\GZTfWbd.exe
  C:\Windows\System\GZTfWbd.exe
  2⤵
  PID:1152
- C:\Windows\System\gtgdjej.exe
  C:\Windows\System\gtgdjej.exe
  2⤵
  PID:3060
- C:\Windows\System\XyCUsAE.exe
  C:\Windows\System\XyCUsAE.exe
  2⤵
  PID:13232
- C:\Windows\System\nSJhsaO.exe
  C:\Windows\System\nSJhsaO.exe
  2⤵
  PID:12216
- C:\Windows\System\xeOfERk.exe
  C:\Windows\System\xeOfERk.exe
  2⤵
  PID:12940
- C:\Windows\System\NKCWpwN.exe
  C:\Windows\System\NKCWpwN.exe
  2⤵
  PID:13320
- C:\Windows\System\vGETJFj.exe
  C:\Windows\System\vGETJFj.exe
  2⤵
  PID:13340
- C:\Windows\System\aURowBU.exe
  C:\Windows\System\aURowBU.exe
  2⤵
  PID:13372
- C:\Windows\System\HvyTevm.exe
  C:\Windows\System\HvyTevm.exe
  2⤵
  PID:13388
- C:\Windows\System\kAyYXzM.exe
  C:\Windows\System\kAyYXzM.exe
  2⤵
  PID:13648
- C:\Windows\System\PDefxED.exe
  C:\Windows\System\PDefxED.exe
  2⤵
  PID:13668
- C:\Windows\System\fVcbXEa.exe
  C:\Windows\System\fVcbXEa.exe
  2⤵
  PID:13684
- C:\Windows\System\xiTQEoN.exe
  C:\Windows\System\xiTQEoN.exe
  2⤵
  PID:13700
- C:\Windows\System\azqvfAO.exe
  C:\Windows\System\azqvfAO.exe
  2⤵
  PID:13716
- C:\Windows\System\ZisaVMf.exe
  C:\Windows\System\ZisaVMf.exe
  2⤵
  PID:13804
- C:\Windows\System\ijLCGSw.exe
  C:\Windows\System\ijLCGSw.exe
  2⤵
  PID:13832
- C:\Windows\System\fexVVhm.exe
  C:\Windows\System\fexVVhm.exe
  2⤵
  PID:13852
- C:\Windows\System\KtZeTvP.exe
  C:\Windows\System\KtZeTvP.exe
  2⤵
  PID:14104
- C:\Windows\System\DLlZRFk.exe
  C:\Windows\System\DLlZRFk.exe
  2⤵
  PID:14132
- C:\Windows\System\neafsAd.exe
  C:\Windows\System\neafsAd.exe
  2⤵
  PID:14160
- C:\Windows\System\GaWacWg.exe
  C:\Windows\System\GaWacWg.exe
  2⤵
  PID:14244
- C:\Windows\System\pDKUIAn.exe
  C:\Windows\System\pDKUIAn.exe
  2⤵
  PID:14264
- C:\Windows\System\nQPFmeM.exe
  C:\Windows\System\nQPFmeM.exe
  2⤵
  PID:14284
- C:\Windows\System\HHqmELC.exe
  C:\Windows\System\HHqmELC.exe
  2⤵
  PID:14300
- C:\Windows\System\gEvkSFy.exe
  C:\Windows\System\gEvkSFy.exe
  2⤵
  PID:14324
- C:\Windows\System\gusNRrG.exe
  C:\Windows\System\gusNRrG.exe
  2⤵
  PID:12716
- C:\Windows\System\yuQuefJ.exe
  C:\Windows\System\yuQuefJ.exe
  2⤵
  PID:2840
- C:\Windows\System\VCXzazJ.exe
  C:\Windows\System\VCXzazJ.exe
  2⤵
  PID:9000
- C:\Windows\System\tAPzNMG.exe
  C:\Windows\System\tAPzNMG.exe
  2⤵
  PID:10808
- C:\Windows\System\dhslQSh.exe
  C:\Windows\System\dhslQSh.exe
  2⤵
  PID:5964
- C:\Windows\System\sqqDTIN.exe
  C:\Windows\System\sqqDTIN.exe
  2⤵
  PID:6600
- C:\Windows\System\NChWneH.exe
  C:\Windows\System\NChWneH.exe
  2⤵
  PID:3096
- C:\Windows\System\fgLyzJY.exe
  C:\Windows\System\fgLyzJY.exe
  2⤵
  PID:2276
- C:\Windows\System\fWCUELM.exe
  C:\Windows\System\fWCUELM.exe
  2⤵
  PID:4720
- C:\Windows\System\ewiYMgV.exe
  C:\Windows\System\ewiYMgV.exe
  2⤵
  PID:13460
- C:\Windows\System\SebQJqY.exe
  C:\Windows\System\SebQJqY.exe
  2⤵
  PID:13396
- C:\Windows\System\ZABkLyc.exe
  C:\Windows\System\ZABkLyc.exe
  2⤵
  PID:13588
- C:\Windows\System\wLUfavC.exe
  C:\Windows\System\wLUfavC.exe
  2⤵
  PID:13572
- C:\Windows\System\JruGdmn.exe
  C:\Windows\System\JruGdmn.exe
  2⤵
  PID:13788
- C:\Windows\System\zQMGmzQ.exe
  C:\Windows\System\zQMGmzQ.exe
  2⤵
  PID:13916
- C:\Windows\System\eZFzSVT.exe
  C:\Windows\System\eZFzSVT.exe
  2⤵
  PID:13932
- C:\Windows\System\usMKlmK.exe
  C:\Windows\System\usMKlmK.exe
  2⤵
  PID:13744
- C:\Windows\System\atQgIOp.exe
  C:\Windows\System\atQgIOp.exe
  2⤵
  PID:13792
- C:\Windows\System\FpqECHd.exe
  C:\Windows\System\FpqECHd.exe
  2⤵
  PID:13952
- C:\Windows\System\BJzYTmB.exe
  C:\Windows\System\BJzYTmB.exe
  2⤵
  PID:4592
- C:\Windows\System\eYSlsri.exe
  C:\Windows\System\eYSlsri.exe
  2⤵
  PID:1088
- C:\Windows\System\eKEfkAi.exe
  C:\Windows\System\eKEfkAi.exe
  2⤵
  PID:14148
- C:\Windows\System\MbyKmGh.exe
  C:\Windows\System\MbyKmGh.exe
  2⤵
  PID:5372
- C:\Windows\System\OHRyyFi.exe
  C:\Windows\System\OHRyyFi.exe
  2⤵
  PID:1960
- C:\Windows\System\ERNcjiC.exe
  C:\Windows\System\ERNcjiC.exe
  2⤵
  PID:5252
- C:\Windows\System\wkcClTw.exe
  C:\Windows\System\wkcClTw.exe
  2⤵
  PID:14236
- C:\Windows\System\iWDaCbw.exe
  C:\Windows\System\iWDaCbw.exe
  2⤵
  PID:2012
- C:\Windows\System\mZkNORi.exe
  C:\Windows\System\mZkNORi.exe
  2⤵
  PID:12668
- C:\Windows\System\qdjJVkC.exe
  C:\Windows\System\qdjJVkC.exe
  2⤵
  PID:3784
- C:\Windows\System\frVNiNF.exe
  C:\Windows\System\frVNiNF.exe
  2⤵
  PID:6224
- C:\Windows\System\kATuVRF.exe
  C:\Windows\System\kATuVRF.exe
  2⤵
  PID:12508
- C:\Windows\System\RTdVUri.exe
  C:\Windows\System\RTdVUri.exe
  2⤵
  PID:12624
- C:\Windows\System\iEAkMch.exe
  C:\Windows\System\iEAkMch.exe
  2⤵
  PID:1068
- C:\Windows\System\nAZUAPd.exe
  C:\Windows\System\nAZUAPd.exe
  2⤵
  PID:12952
- C:\Windows\System\QFDzAIW.exe
  C:\Windows\System\QFDzAIW.exe
  2⤵
  PID:12896
- C:\Windows\System\WEPCorx.exe
  C:\Windows\System\WEPCorx.exe
  2⤵
  PID:14208
- C:\Windows\System\SpKEsgv.exe
  C:\Windows\System\SpKEsgv.exe
  2⤵
  PID:5408
- C:\Windows\System\QEJilQi.exe
  C:\Windows\System\QEJilQi.exe
  2⤵
  PID:5444
- C:\Windows\System\rpeMcbd.exe
  C:\Windows\System\rpeMcbd.exe
  2⤵
  PID:13944
- C:\Windows\System\zcqbLsm.exe
  C:\Windows\System\zcqbLsm.exe
  2⤵
  PID:14044
- C:\Windows\System\fqNVBFZ.exe
  C:\Windows\System\fqNVBFZ.exe
  2⤵
  PID:7776
- C:\Windows\System\FsYadHy.exe
  C:\Windows\System\FsYadHy.exe
  2⤵
  PID:12880
- C:\Windows\System\LCLWQzH.exe
  C:\Windows\System\LCLWQzH.exe
  2⤵
  PID:12256
- C:\Windows\System\lhMnJap.exe
  C:\Windows\System\lhMnJap.exe
  2⤵
  PID:13904
- C:\Windows\System\pFckspv.exe
  C:\Windows\System\pFckspv.exe
  2⤵
  PID:1424
- C:\Windows\System\bNCydPa.exe
  C:\Windows\System\bNCydPa.exe
  2⤵
  PID:13332
- C:\Windows\System\Djhpajt.exe
  C:\Windows\System\Djhpajt.exe
  2⤵
  PID:14276
- C:\Windows\System\pqtcYly.exe
  C:\Windows\System\pqtcYly.exe
  2⤵
  PID:13496
- C:\Windows\System\UXsNZSl.exe
  C:\Windows\System\UXsNZSl.exe
  2⤵
  PID:1772
- C:\Windows\System\vSoDJrO.exe
  C:\Windows\System\vSoDJrO.exe
  2⤵
  PID:2988
- C:\Windows\System\IWAaurS.exe
  C:\Windows\System\IWAaurS.exe
  2⤵
  PID:13492
- C:\Windows\System\VYZjeOv.exe
  C:\Windows\System\VYZjeOv.exe
  2⤵
  PID:3952
- C:\Windows\System\TXMsABU.exe
  C:\Windows\System\TXMsABU.exe
  2⤵
  PID:5476
- C:\Windows\System\WoGjwfN.exe
  C:\Windows\System\WoGjwfN.exe
  2⤵
  PID:5624
- C:\Windows\System\fiItTaj.exe
  C:\Windows\System\fiItTaj.exe
  2⤵
  PID:14116
- C:\Windows\System\dfpKKbl.exe
  C:\Windows\System\dfpKKbl.exe
  2⤵
  PID:11596
- C:\Windows\System\mHNYtge.exe
  C:\Windows\System\mHNYtge.exe
  2⤵
  PID:2972
- C:\Windows\System\KcMTvbS.exe
  C:\Windows\System\KcMTvbS.exe
  2⤵
  PID:5436
- C:\Windows\System\bVthPIz.exe
  C:\Windows\System\bVthPIz.exe
  2⤵
  PID:2984
- C:\Windows\System\HqsuaAo.exe
  C:\Windows\System\HqsuaAo.exe
  2⤵
  PID:5788
- C:\Windows\System\yGvpITK.exe
  C:\Windows\System\yGvpITK.exe
  2⤵
  PID:6396
- C:\Windows\System\zRxlJdy.exe
  C:\Windows\System\zRxlJdy.exe
  2⤵
  PID:4568
- C:\Windows\System\YyAgHMP.exe
  C:\Windows\System\YyAgHMP.exe
  2⤵
  PID:2476
- C:\Windows\System\piGnnEU.exe
  C:\Windows\System\piGnnEU.exe
  2⤵
  PID:5220
- C:\Windows\System\iIBKaoW.exe
  C:\Windows\System\iIBKaoW.exe
  2⤵
  PID:2524
- C:\Windows\System\JZEvprI.exe
  C:\Windows\System\JZEvprI.exe
  2⤵
  PID:13416
- C:\Windows\System\CMtFrTp.exe
  C:\Windows\System\CMtFrTp.exe
  2⤵
  PID:3160
- C:\Windows\System\dAjdbGs.exe
  C:\Windows\System\dAjdbGs.exe
  2⤵
  PID:12384
- C:\Windows\System\hxQQdqe.exe
  C:\Windows\System\hxQQdqe.exe
  2⤵
  PID:6472
- C:\Windows\System\zlDFzos.exe
  C:\Windows\System\zlDFzos.exe
  2⤵
  PID:12488
- C:\Windows\System\IQljgSv.exe
  C:\Windows\System\IQljgSv.exe
  2⤵
  PID:6316
- C:\Windows\System\UyjRfZS.exe
  C:\Windows\System\UyjRfZS.exe
  2⤵
  PID:5388
- C:\Windows\System\yLpowed.exe
  C:\Windows\System\yLpowed.exe
  2⤵
  PID:9724
- C:\Windows\System\BIZDTzs.exe
  C:\Windows\System\BIZDTzs.exe
  2⤵
  PID:3384
- C:\Windows\System\ShCApBm.exe
  C:\Windows\System\ShCApBm.exe
  2⤵
  PID:13692
- C:\Windows\System\cJWMmWq.exe
  C:\Windows\System\cJWMmWq.exe
  2⤵
  PID:13924
- C:\Windows\System\IOOGZGZ.exe
  C:\Windows\System\IOOGZGZ.exe
  2⤵
  PID:6172
- C:\Windows\System\YiRiuZP.exe
  C:\Windows\System\YiRiuZP.exe
  2⤵
  PID:6832
- C:\Windows\System\qLejrqC.exe
  C:\Windows\System\qLejrqC.exe
  2⤵
  PID:2816
- C:\Windows\System\aNYdkVH.exe
  C:\Windows\System\aNYdkVH.exe
  2⤵
  PID:13448
- C:\Windows\System\tiKmKfp.exe
  C:\Windows\System\tiKmKfp.exe
  2⤵
  PID:4320
- C:\Windows\System\KYauuse.exe
  C:\Windows\System\KYauuse.exe
  2⤵
  PID:6332
- C:\Windows\System\UvUMeMZ.exe
  C:\Windows\System\UvUMeMZ.exe
  2⤵
  PID:9200
- C:\Windows\System\NzTuivC.exe
  C:\Windows\System\NzTuivC.exe
  2⤵
  PID:5464
- C:\Windows\System\GAjCpeF.exe
  C:\Windows\System\GAjCpeF.exe
  2⤵
  PID:6864
- C:\Windows\System\HZLfuJG.exe
  C:\Windows\System\HZLfuJG.exe
  2⤵
  PID:7900
- C:\Windows\System\QQYdBWr.exe
  C:\Windows\System\QQYdBWr.exe
  2⤵
  PID:6088
- C:\Windows\System\FDHSxAC.exe
  C:\Windows\System\FDHSxAC.exe
  2⤵
  PID:13576
- C:\Windows\System\XYPRxZW.exe
  C:\Windows\System\XYPRxZW.exe
  2⤵
  PID:7256
- C:\Windows\System\oTkHfPc.exe
  C:\Windows\System\oTkHfPc.exe
  2⤵
  PID:13632
- C:\Windows\System\eWJgPCv.exe
  C:\Windows\System\eWJgPCv.exe
  2⤵
  PID:7364
- C:\Windows\System\IadnipB.exe
  C:\Windows\System\IadnipB.exe
  2⤵
  PID:1148
- C:\Windows\System\TuDMxwH.exe
  C:\Windows\System\TuDMxwH.exe
  2⤵
  PID:5696
- C:\Windows\System\uIXJSum.exe
  C:\Windows\System\uIXJSum.exe
  2⤵
  PID:4528
- C:\Windows\System\pdqpYPJ.exe
  C:\Windows\System\pdqpYPJ.exe
  2⤵
  PID:7548
- C:\Windows\System\sXZYjHp.exe
  C:\Windows\System\sXZYjHp.exe
  2⤵
  PID:7988
- C:\Windows\System\keVWOSG.exe
  C:\Windows\System\keVWOSG.exe
  2⤵
  PID:13628
- C:\Windows\System\SDPnbmJ.exe
  C:\Windows\System\SDPnbmJ.exe
  2⤵
  PID:3144
- C:\Windows\System\PcuGNpU.exe
  C:\Windows\System\PcuGNpU.exe
  2⤵
  PID:7148
- C:\Windows\System\sHDwdpR.exe
  C:\Windows\System\sHDwdpR.exe
  2⤵
  PID:5312
- C:\Windows\System\LpswsRb.exe
  C:\Windows\System\LpswsRb.exe
  2⤵
  PID:5584
- C:\Windows\System\bPkILZh.exe
  C:\Windows\System\bPkILZh.exe
  2⤵
  PID:6056
- C:\Windows\System\hwrkAVN.exe
  C:\Windows\System\hwrkAVN.exe
  2⤵
  PID:7056
- C:\Windows\System\mOvgXIb.exe
  C:\Windows\System\mOvgXIb.exe
  2⤵
  PID:6860
- C:\Windows\System\YCWrGCe.exe
  C:\Windows\System\YCWrGCe.exe
  2⤵
  PID:1796
- C:\Windows\System\VkaKvvO.exe
  C:\Windows\System\VkaKvvO.exe
  2⤵
  PID:5404
- C:\Windows\System\UjrDLCs.exe
  C:\Windows\System\UjrDLCs.exe
  2⤵
  PID:6736
- C:\Windows\System\fSYefCZ.exe
  C:\Windows\System\fSYefCZ.exe
  2⤵
  PID:3220
- C:\Windows\System\seasqti.exe
  C:\Windows\System\seasqti.exe
  2⤵
  PID:5844
- C:\Windows\System\kGRRjgh.exe
  C:\Windows\System\kGRRjgh.exe
  2⤵
  PID:8016
- C:\Windows\System\UTgKLnI.exe
  C:\Windows\System\UTgKLnI.exe
  2⤵
  PID:7124
- C:\Windows\System\YdWUlon.exe
  C:\Windows\System\YdWUlon.exe
  2⤵
  PID:3592
- C:\Windows\System\oZOaJCh.exe
  C:\Windows\System\oZOaJCh.exe
  2⤵
  PID:7852
- C:\Windows\System\gCNizdQ.exe
  C:\Windows\System\gCNizdQ.exe
  2⤵
  PID:6536
- C:\Windows\System\AGBeWWl.exe
  C:\Windows\System\AGBeWWl.exe
  2⤵
  PID:7344
- C:\Windows\System\GbDqQUe.exe
  C:\Windows\System\GbDqQUe.exe
  2⤵
  PID:12312
- C:\Windows\System\VRgxbDZ.exe
  C:\Windows\System\VRgxbDZ.exe
  2⤵
  PID:8112
- C:\Windows\System\nXAIDDL.exe
  C:\Windows\System\nXAIDDL.exe
  2⤵
  PID:5200
- C:\Windows\System\zVjrZnS.exe
  C:\Windows\System\zVjrZnS.exe
  2⤵
  PID:7904
- C:\Windows\System\GoLordo.exe
  C:\Windows\System\GoLordo.exe
  2⤵
  PID:3748
- C:\Windows\System\flUDXRH.exe
  C:\Windows\System\flUDXRH.exe
  2⤵
  PID:7936
- C:\Windows\System\lFdkXmz.exe
  C:\Windows\System\lFdkXmz.exe
  2⤵
  PID:7440
- C:\Windows\System\nglYCEo.exe
  C:\Windows\System\nglYCEo.exe
  2⤵
  PID:13864
- C:\Windows\System\CVlrQQK.exe
  C:\Windows\System\CVlrQQK.exe
  2⤵
  PID:7428
- C:\Windows\System\DwYhdCI.exe
  C:\Windows\System\DwYhdCI.exe
  2⤵
  PID:7692
- C:\Windows\System\DrTewCF.exe
  C:\Windows\System\DrTewCF.exe
  2⤵
  PID:8392
- C:\Windows\System\bGfcOaS.exe
  C:\Windows\System\bGfcOaS.exe
  2⤵
  PID:6284
- C:\Windows\System\qOkkDPm.exe
  C:\Windows\System\qOkkDPm.exe
  2⤵
  PID:5776
- C:\Windows\System\ZajHBrv.exe
  C:\Windows\System\ZajHBrv.exe
  2⤵
  PID:6312
- C:\Windows\System\olOmzfe.exe
  C:\Windows\System\olOmzfe.exe
  2⤵
  PID:5396
- C:\Windows\System\ApZEtzf.exe
  C:\Windows\System\ApZEtzf.exe
  2⤵
  PID:8448
- C:\Windows\System\HOvDLKb.exe
  C:\Windows\System\HOvDLKb.exe
  2⤵
  PID:7644
- C:\Windows\System\hYLrvgu.exe
  C:\Windows\System\hYLrvgu.exe
  2⤵
  PID:5532
- C:\Windows\System\EAqjssY.exe
  C:\Windows\System\EAqjssY.exe
  2⤵
  PID:8188
- C:\Windows\System\xpWHszN.exe
  C:\Windows\System\xpWHszN.exe
  2⤵
  PID:7888
- C:\Windows\System\AeJGnBi.exe
  C:\Windows\System\AeJGnBi.exe
  2⤵
  PID:6252
- C:\Windows\System\WrRgaPQ.exe
  C:\Windows\System\WrRgaPQ.exe
  2⤵
  PID:6588
- C:\Windows\System\OXpTAMQ.exe
  C:\Windows\System\OXpTAMQ.exe
  2⤵
  PID:2076
- C:\Windows\System\rNRJWoj.exe
  C:\Windows\System\rNRJWoj.exe
  2⤵
  PID:8416
- C:\Windows\System\GMPdwht.exe
  C:\Windows\System\GMPdwht.exe
  2⤵
  PID:7996
- C:\Windows\System\YWsatVx.exe
  C:\Windows\System\YWsatVx.exe
  2⤵
  PID:7196
- C:\Windows\System\HpZjXME.exe
  C:\Windows\System\HpZjXME.exe
  2⤵
  PID:8044
- C:\Windows\System\YouBqoa.exe
  C:\Windows\System\YouBqoa.exe
  2⤵
  PID:8424
- C:\Windows\System\vZPuDSX.exe
  C:\Windows\System\vZPuDSX.exe
  2⤵
  PID:7868
- C:\Windows\System\tPahiTd.exe
  C:\Windows\System\tPahiTd.exe
  2⤵
  PID:7012
- C:\Windows\System\RyCLAdO.exe
  C:\Windows\System\RyCLAdO.exe
  2⤵
  PID:6936
- C:\Windows\System\iUaitSx.exe
  C:\Windows\System\iUaitSx.exe
  2⤵
  PID:7600
- C:\Windows\System\HKZpnaq.exe
  C:\Windows\System\HKZpnaq.exe
  2⤵
  PID:7508
- C:\Windows\System\SDnxXaE.exe
  C:\Windows\System\SDnxXaE.exe
  2⤵
  PID:8272
- C:\Windows\System\wXDHqRg.exe
  C:\Windows\System\wXDHqRg.exe
  2⤵
  PID:8456
- C:\Windows\System\PVtizhB.exe
  C:\Windows\System\PVtizhB.exe
  2⤵
  PID:7352
- C:\Windows\System\inQHvbh.exe
  C:\Windows\System\inQHvbh.exe
  2⤵
  PID:6868
- C:\Windows\System\ReFYVIA.exe
  C:\Windows\System\ReFYVIA.exe
  2⤵
  PID:7568
- C:\Windows\System\YnlVNsG.exe
  C:\Windows\System\YnlVNsG.exe
  2⤵
  PID:1940
- C:\Windows\System\CsUDfWp.exe
  C:\Windows\System\CsUDfWp.exe
  2⤵
  PID:8540
- C:\Windows\System\OQkHlcL.exe
  C:\Windows\System\OQkHlcL.exe
  2⤵
  PID:7108
- C:\Windows\System\AvPUnHN.exe
  C:\Windows\System\AvPUnHN.exe
  2⤵
  PID:7276
- C:\Windows\System\kDWTZiz.exe
  C:\Windows\System\kDWTZiz.exe
  2⤵
  PID:9024
- C:\Windows\System\FdtGKCR.exe
  C:\Windows\System\FdtGKCR.exe
  2⤵
  PID:6480
- C:\Windows\System\bEDXeIo.exe
  C:\Windows\System\bEDXeIo.exe
  2⤵
  PID:216
- C:\Windows\System\unJBtvp.exe
  C:\Windows\System\unJBtvp.exe
  2⤵
  PID:8460
- C:\Windows\System\MlLpVKy.exe
  C:\Windows\System\MlLpVKy.exe
  2⤵
  PID:8404
- C:\Windows\System\vbzuLPt.exe
  C:\Windows\System\vbzuLPt.exe
  2⤵
  PID:8516
- C:\Windows\System\shgyQKc.exe
  C:\Windows\System\shgyQKc.exe
  2⤵
  PID:14344
- C:\Windows\System\RaQQNsS.exe
  C:\Windows\System\RaQQNsS.exe
  2⤵
  PID:14368
- C:\Windows\System\NZeORgp.exe
  C:\Windows\System\NZeORgp.exe
  2⤵
  PID:14396
- C:\Windows\System\xoGYwJi.exe
  C:\Windows\System\xoGYwJi.exe
  2⤵
  PID:14420
- C:\Windows\System\rVFMMoz.exe
  C:\Windows\System\rVFMMoz.exe
  2⤵
  PID:14440
- C:\Windows\System\NFhvHMx.exe
  C:\Windows\System\NFhvHMx.exe
  2⤵
  PID:14460
- C:\Windows\System\bsCHqZE.exe
  C:\Windows\System\bsCHqZE.exe
  2⤵
  PID:14480
- C:\Windows\System\OCYHVVQ.exe
  C:\Windows\System\OCYHVVQ.exe
  2⤵
  PID:14496
- C:\Windows\System\IjCSBXD.exe
  C:\Windows\System\IjCSBXD.exe
  2⤵
  PID:14516
- C:\Windows\System\IBvPAIV.exe
  C:\Windows\System\IBvPAIV.exe
  2⤵
  PID:14536
- C:\Windows\System\ZlasGFI.exe
  C:\Windows\System\ZlasGFI.exe
  2⤵
  PID:14552
- C:\Windows\System\gMPJkqB.exe
  C:\Windows\System\gMPJkqB.exe
  2⤵
  PID:14568
- C:\Windows\System\IaiuALB.exe
  C:\Windows\System\IaiuALB.exe
  2⤵
  PID:14592
- C:\Windows\System\TvILJhf.exe
  C:\Windows\System\TvILJhf.exe
  2⤵
  PID:14612
- C:\Windows\System\ezvSONz.exe
  C:\Windows\System\ezvSONz.exe
  2⤵
  PID:14632
- C:\Windows\System\sdLWgmr.exe
  C:\Windows\System\sdLWgmr.exe
  2⤵
  PID:14648
- C:\Windows\System\dCoyntz.exe
  C:\Windows\System\dCoyntz.exe
  2⤵
  PID:14672
- C:\Windows\System\otdddVd.exe
  C:\Windows\System\otdddVd.exe
  2⤵
  PID:14692
- C:\Windows\System\cdKwIXo.exe
  C:\Windows\System\cdKwIXo.exe
  2⤵
  PID:14712
- C:\Windows\System\BJqjwtv.exe
  C:\Windows\System\BJqjwtv.exe
  2⤵
  PID:14740
- C:\Windows\System\IITJCIq.exe
  C:\Windows\System\IITJCIq.exe
  2⤵
  PID:14760
- C:\Windows\System\esnmqZq.exe
  C:\Windows\System\esnmqZq.exe
  2⤵
  PID:14784
- C:\Windows\System\CJNqiQK.exe
  C:\Windows\System\CJNqiQK.exe
  2⤵
  PID:14804
- C:\Windows\System\EmWDzcd.exe
  C:\Windows\System\EmWDzcd.exe
  2⤵
  PID:14820
- C:\Windows\System\QZGmouT.exe
  C:\Windows\System\QZGmouT.exe
  2⤵
  PID:14836
- C:\Windows\System\QHSpMka.exe
  C:\Windows\System\QHSpMka.exe
  2⤵
  PID:14856
- C:\Windows\System\LIDWzEg.exe
  C:\Windows\System\LIDWzEg.exe
  2⤵
  PID:14880
- C:\Windows\System\AyMmyen.exe
  C:\Windows\System\AyMmyen.exe
  2⤵
  PID:14900
- C:\Windows\System\AZKUYSj.exe
  C:\Windows\System\AZKUYSj.exe
  2⤵
  PID:14920
- C:\Windows\System\HxNRxwZ.exe
  C:\Windows\System\HxNRxwZ.exe
  2⤵
  PID:14940
- C:\Windows\System\OhHaBGJ.exe
  C:\Windows\System\OhHaBGJ.exe
  2⤵
  PID:14972
- C:\Windows\System\DprVajZ.exe
  C:\Windows\System\DprVajZ.exe
  2⤵
  PID:14992
- C:\Windows\System\gkweYED.exe
  C:\Windows\System\gkweYED.exe
  2⤵
  PID:15008
- C:\Windows\System\VWURbyK.exe
  C:\Windows\System\VWURbyK.exe
  2⤵
  PID:15028
- C:\Windows\System\PCzYTfs.exe
  C:\Windows\System\PCzYTfs.exe
  2⤵
  PID:15044
- C:\Windows\System\IfTxQbp.exe
  C:\Windows\System\IfTxQbp.exe
  2⤵
  PID:15064
- C:\Windows\System\dwlWShd.exe
  C:\Windows\System\dwlWShd.exe
  2⤵
  PID:15092
- C:\Windows\System\VuAJNGo.exe
  C:\Windows\System\VuAJNGo.exe
  2⤵
  PID:15112
- C:\Windows\System\BzRlibK.exe
  C:\Windows\System\BzRlibK.exe
  2⤵
  PID:15132
- C:\Windows\System\NLNcoEL.exe
  C:\Windows\System\NLNcoEL.exe
  2⤵
  PID:15152
- C:\Windows\System\mzbwqVO.exe
  C:\Windows\System\mzbwqVO.exe
  2⤵
  PID:15176
- C:\Windows\System\ZgrgLtU.exe
  C:\Windows\System\ZgrgLtU.exe
  2⤵
  PID:15196
- C:\Windows\System\zlLLyDd.exe
  C:\Windows\System\zlLLyDd.exe
  2⤵
  PID:15220
- C:\Windows\System\ltIgiLI.exe
  C:\Windows\System\ltIgiLI.exe
  2⤵
  PID:15244
- C:\Windows\System\CLzuCvC.exe
  C:\Windows\System\CLzuCvC.exe
  2⤵
  PID:15260
- C:\Windows\System\DvhxDEl.exe
  C:\Windows\System\DvhxDEl.exe
  2⤵
  PID:6928
- C:\Windows\System\DQVuEYM.exe
  C:\Windows\System\DQVuEYM.exe
  2⤵
  PID:9056
- C:\Windows\System\ZEZgTYh.exe
  C:\Windows\System\ZEZgTYh.exe
  2⤵
  PID:6932
- C:\Windows\System\wJuZIkb.exe
  C:\Windows\System\wJuZIkb.exe
  2⤵
  PID:7444
- C:\Windows\System\PQlCFyq.exe
  C:\Windows\System\PQlCFyq.exe
  2⤵
  PID:14308
- C:\Windows\System\WINvtNp.exe
  C:\Windows\System\WINvtNp.exe
  2⤵
  PID:14376
- C:\Windows\System\ljhcfDF.exe
  C:\Windows\System\ljhcfDF.exe
  2⤵
  PID:14416
- C:\Windows\System\EyewnKr.exe
  C:\Windows\System\EyewnKr.exe
  2⤵
  PID:14456
- C:\Windows\System\ZlIEmMo.exe
  C:\Windows\System\ZlIEmMo.exe
  2⤵
  PID:12700
- C:\Windows\System\HMKgTGp.exe
  C:\Windows\System\HMKgTGp.exe
  2⤵
  PID:9436
- C:\Windows\System\TooFyCm.exe
  C:\Windows\System\TooFyCm.exe
  2⤵
  PID:6160
- C:\Windows\System\ERbkltG.exe
  C:\Windows\System\ERbkltG.exe
  2⤵
  PID:10332
- C:\Windows\System\iBJnXlj.exe
  C:\Windows\System\iBJnXlj.exe
  2⤵
  PID:10356
- C:\Windows\System\OhvNvhw.exe
  C:\Windows\System\OhvNvhw.exe
  2⤵
  PID:7556
- C:\Windows\System\LRKVoXC.exe
  C:\Windows\System\LRKVoXC.exe
  2⤵
  PID:15000
- C:\Windows\System\cYmFXJQ.exe
  C:\Windows\System\cYmFXJQ.exe
  2⤵
  PID:14380
- C:\Windows\System\TkVilsm.exe
  C:\Windows\System\TkVilsm.exe
  2⤵
  PID:15128
- C:\Windows\System\lkuvfvk.exe
  C:\Windows\System\lkuvfvk.exe
  2⤵
  PID:14452
- C:\Windows\System\koKpkJM.exe
  C:\Windows\System\koKpkJM.exe
  2⤵
  PID:11032
- C:\Windows\System\KLoOLBd.exe
  C:\Windows\System\KLoOLBd.exe
  2⤵
  PID:14492
- C:\Windows\System\stpYlks.exe
  C:\Windows\System\stpYlks.exe
  2⤵
  PID:7044
- C:\Windows\System\gWGfRsR.exe
  C:\Windows\System\gWGfRsR.exe
  2⤵
  PID:14548
- C:\Windows\System\QPYUgsR.exe
  C:\Windows\System\QPYUgsR.exe
  2⤵
  PID:14600
- C:\Windows\System\kiYsoEx.exe
  C:\Windows\System\kiYsoEx.exe
  2⤵
  PID:15296
- C:\Windows\System\JdRJQcC.exe
  C:\Windows\System\JdRJQcC.exe
  2⤵
  PID:15312
- C:\Windows\System\vsipDVK.exe
  C:\Windows\System\vsipDVK.exe
  2⤵
  PID:14664
- C:\Windows\System\kXLqdcQ.exe
  C:\Windows\System\kXLqdcQ.exe
  2⤵
  PID:8024
- C:\Windows\System\oINXQDS.exe
  C:\Windows\System\oINXQDS.exe
  2⤵
  PID:10376
- C:\Windows\System\lmItEEQ.exe
  C:\Windows\System\lmItEEQ.exe
  2⤵
  PID:10764
- C:\Windows\System\snwdJaL.exe
  C:\Windows\System\snwdJaL.exe
  2⤵
  PID:10776
- C:\Windows\System\itGEvzc.exe
  C:\Windows\System\itGEvzc.exe
  2⤵
  PID:10128
- C:\Windows\System\sFvwGmi.exe
  C:\Windows\System\sFvwGmi.exe
  2⤵
  PID:7736
- C:\Windows\System\VmCGaCT.exe
  C:\Windows\System\VmCGaCT.exe
  2⤵
  PID:9224
- C:\Windows\System\QDMrpDn.exe
  C:\Windows\System\QDMrpDn.exe
  2⤵
  PID:8920
- C:\Windows\System\ZtHshGI.exe
  C:\Windows\System\ZtHshGI.exe
  2⤵
  PID:10852
- C:\Windows\System\rluPyXS.exe
  C:\Windows\System\rluPyXS.exe
  2⤵
  PID:8344
- C:\Windows\System\XfosqaR.exe
  C:\Windows\System\XfosqaR.exe
  2⤵
  PID:1012
- C:\Windows\System\NYPcwEt.exe
  C:\Windows\System\NYPcwEt.exe
  2⤵
  PID:10956
- C:\Windows\System\fdkcbai.exe
  C:\Windows\System\fdkcbai.exe
  2⤵
  PID:9732
- C:\Windows\System\eCxdsDU.exe
  C:\Windows\System\eCxdsDU.exe
  2⤵
  PID:10212
- C:\Windows\System\LGVXJza.exe
  C:\Windows\System\LGVXJza.exe
  2⤵
  PID:9180
- C:\Windows\System\eGeRnva.exe
  C:\Windows\System\eGeRnva.exe
  2⤵
  PID:8040
- C:\Windows\System\BFmpTpa.exe
  C:\Windows\System\BFmpTpa.exe
  2⤵
  PID:5592
- C:\Windows\System\xIyBkSU.exe
  C:\Windows\System\xIyBkSU.exe
  2⤵
  PID:100
- C:\Windows\System\OpXXJXk.exe
  C:\Windows\System\OpXXJXk.exe
  2⤵
  PID:10244
- C:\Windows\System\LnNtotn.exe
  C:\Windows\System\LnNtotn.exe
  2⤵
  PID:11840
- C:\Windows\System\suSJqpt.exe
  C:\Windows\System\suSJqpt.exe
  2⤵
  PID:6352
- C:\Windows\System\SqroZBo.exe
  C:\Windows\System\SqroZBo.exe
  2⤵
  PID:8788
- C:\Windows\System\LPKoJLV.exe
  C:\Windows\System\LPKoJLV.exe
  2⤵
  PID:12640
- C:\Windows\System\qeYLQur.exe
  C:\Windows\System\qeYLQur.exe
  2⤵
  PID:11040
- C:\Windows\System\qDnSWDK.exe
  C:\Windows\System\qDnSWDK.exe
  2⤵
  PID:7960
- C:\Windows\System\XOUfVdt.exe
  C:\Windows\System\XOUfVdt.exe
  2⤵
  PID:11168
- C:\Windows\System\SqKJbXe.exe
  C:\Windows\System\SqKJbXe.exe
  2⤵
  PID:15108
- C:\Windows\System\ViSxQbw.exe
  C:\Windows\System\ViSxQbw.exe
  2⤵
  PID:8560
- C:\Windows\System\ilvIkse.exe
  C:\Windows\System\ilvIkse.exe
  2⤵
  PID:10932
- C:\Windows\System\qsvZgBY.exe
  C:\Windows\System\qsvZgBY.exe
  2⤵
  PID:10012
- C:\Windows\System\uBnXYji.exe
  C:\Windows\System\uBnXYji.exe
  2⤵
  PID:11836
- C:\Windows\System\mHokwIt.exe
  C:\Windows\System\mHokwIt.exe
  2⤵
  PID:10088
- C:\Windows\System\vTmDGjX.exe
  C:\Windows\System\vTmDGjX.exe
  2⤵
  PID:14956
- C:\Windows\System\RffICgs.exe
  C:\Windows\System\RffICgs.exe
  2⤵
  PID:15084
- C:\Windows\System\ucvBVhq.exe
  C:\Windows\System\ucvBVhq.exe
  2⤵
  PID:12580
- C:\Windows\System\MnKaLOy.exe
  C:\Windows\System\MnKaLOy.exe
  2⤵
  PID:12148
- C:\Windows\System\VOLlPxo.exe
  C:\Windows\System\VOLlPxo.exe
  2⤵
  PID:5500
- C:\Windows\System\wnVGbkt.exe
  C:\Windows\System\wnVGbkt.exe
  2⤵
  PID:9304
- C:\Windows\System\sclnIUM.exe
  C:\Windows\System\sclnIUM.exe
  2⤵
  PID:10752
- C:\Windows\System\cPslvNc.exe
  C:\Windows\System\cPslvNc.exe
  2⤵
  PID:10824
- C:\Windows\System\kVKYMKU.exe
  C:\Windows\System\kVKYMKU.exe
  2⤵
  PID:8904
- C:\Windows\System\PorbZYj.exe
  C:\Windows\System\PorbZYj.exe
  2⤵
  PID:9808
- C:\Windows\System\wvVSxeE.exe
  C:\Windows\System\wvVSxeE.exe
  2⤵
  PID:9280
- C:\Windows\System\MiUaSSO.exe
  C:\Windows\System\MiUaSSO.exe
  2⤵
  PID:14436
- C:\Windows\System\GZBrOHj.exe
  C:\Windows\System\GZBrOHj.exe
  2⤵
  PID:14488
- C:\Windows\System\njiEHVg.exe
  C:\Windows\System\njiEHVg.exe
  2⤵
  PID:12052
- C:\Windows\System\cTqmrrJ.exe
  C:\Windows\System\cTqmrrJ.exe
  2⤵
  PID:11224
- C:\Windows\System\gJaIyzC.exe
  C:\Windows\System\gJaIyzC.exe
  2⤵
  PID:11732
- C:\Windows\System\NXunTDa.exe
  C:\Windows\System\NXunTDa.exe
  2⤵
  PID:10044
- C:\Windows\System\nGtmxML.exe
  C:\Windows\System\nGtmxML.exe
  2⤵
  PID:11120
- C:\Windows\System\MqsZakU.exe
  C:\Windows\System\MqsZakU.exe
  2⤵
  PID:8520
- C:\Windows\System\lFqeHgs.exe
  C:\Windows\System\lFqeHgs.exe
  2⤵
  PID:11788
- C:\Windows\System\dVTsifN.exe
  C:\Windows\System\dVTsifN.exe
  2⤵
  PID:11920
- C:\Windows\System\FuIifKO.exe
  C:\Windows\System\FuIifKO.exe
  2⤵
  PID:9700
- C:\Windows\System\fcwbJSh.exe
  C:\Windows\System\fcwbJSh.exe
  2⤵
  PID:12024
- C:\Windows\System\YeZrebU.exe
  C:\Windows\System\YeZrebU.exe
  2⤵
  PID:10628
- C:\Windows\System\ZfGvbfA.exe
  C:\Windows\System\ZfGvbfA.exe
  2⤵
  PID:11444
- C:\Windows\System\PJUzXHs.exe
  C:\Windows\System\PJUzXHs.exe
  2⤵
  PID:13104
- C:\Windows\System\gxUuUoC.exe
  C:\Windows\System\gxUuUoC.exe
  2⤵
  PID:12328
- C:\Windows\System\HpkrQTJ.exe
  C:\Windows\System\HpkrQTJ.exe
  2⤵
  PID:10556
- C:\Windows\System\NHStlgI.exe
  C:\Windows\System\NHStlgI.exe
  2⤵
  PID:11416
- C:\Windows\System\VeQWLMg.exe
  C:\Windows\System\VeQWLMg.exe
  2⤵
  PID:13292
- C:\Windows\System\QEkDWLV.exe
  C:\Windows\System\QEkDWLV.exe
  2⤵
  PID:11688
- C:\Windows\System\GzRUTjf.exe
  C:\Windows\System\GzRUTjf.exe
  2⤵
  PID:12528
- C:\Windows\System\zirwHsb.exe
  C:\Windows\System\zirwHsb.exe
  2⤵
  PID:10664
- C:\Windows\System\KuTKrtc.exe
  C:\Windows\System\KuTKrtc.exe
  2⤵
  PID:14620
- C:\Windows\System\OawSSTn.exe
  C:\Windows\System\OawSSTn.exe
  2⤵
  PID:12380
- C:\Windows\System\fqYlikx.exe
  C:\Windows\System\fqYlikx.exe
  2⤵
  PID:12388
- C:\Windows\System\zigduWc.exe
  C:\Windows\System\zigduWc.exe
  2⤵
  PID:14544
- C:\Windows\System\lOFIOpz.exe
  C:\Windows\System\lOFIOpz.exe
  2⤵
  PID:10160
- C:\Windows\System\xtbqMoY.exe
  C:\Windows\System\xtbqMoY.exe
  2⤵
  PID:12228
- C:\Windows\System\EcNZuDi.exe
  C:\Windows\System\EcNZuDi.exe
  2⤵
  PID:12352
- C:\Windows\System\jANuxeN.exe
  C:\Windows\System\jANuxeN.exe
  2⤵
  PID:12660
- C:\Windows\System\nECJWMS.exe
  C:\Windows\System\nECJWMS.exe
  2⤵
  PID:8492
- C:\Windows\System\eHMOBkx.exe
  C:\Windows\System\eHMOBkx.exe
  2⤵
  PID:12260
- C:\Windows\System\wFpjPoG.exe
  C:\Windows\System\wFpjPoG.exe
  2⤵
  PID:11360
- C:\Windows\System\fAiRkxv.exe
  C:\Windows\System\fAiRkxv.exe
  2⤵
  PID:11468
- C:\Windows\System\FFYowyF.exe
  C:\Windows\System\FFYowyF.exe
  2⤵
  PID:12688
- C:\Windows\System\cBTZJKE.exe
  C:\Windows\System\cBTZJKE.exe
  2⤵
  PID:1592
- C:\Windows\System\VjSGAdD.exe
  C:\Windows\System\VjSGAdD.exe
  2⤵
  PID:8528
- C:\Windows\System\fDaONpX.exe
  C:\Windows\System\fDaONpX.exe
  2⤵
  PID:11992
- C:\Windows\System\IEKiJAE.exe
  C:\Windows\System\IEKiJAE.exe
  2⤵
  PID:7104
- C:\Windows\System\xVwZqBt.exe
  C:\Windows\System\xVwZqBt.exe
  2⤵
  PID:11560
- C:\Windows\System\Ystjkel.exe
  C:\Windows\System\Ystjkel.exe
  2⤵
  PID:11300
- C:\Windows\System\KOnRjxd.exe
  C:\Windows\System\KOnRjxd.exe
  2⤵
  PID:8436
- C:\Windows\System\SRVukIZ.exe
  C:\Windows\System\SRVukIZ.exe
  2⤵
  PID:14468
- C:\Windows\System\SWTcuQz.exe
  C:\Windows\System\SWTcuQz.exe
  2⤵
  PID:15236
- C:\Windows\System\wWhWLpZ.exe
  C:\Windows\System\wWhWLpZ.exe
  2⤵
  PID:3968
- C:\Windows\System\SbENFbg.exe
  C:\Windows\System\SbENFbg.exe
  2⤵
  PID:12356
- C:\Windows\System\pIgQvbg.exe
  C:\Windows\System\pIgQvbg.exe
  2⤵
  PID:9404
- C:\Windows\System\gQulltq.exe
  C:\Windows\System\gQulltq.exe
  2⤵
  PID:11976
- C:\Windows\System\dESIxqM.exe
  C:\Windows\System\dESIxqM.exe
  2⤵
  PID:9328
- C:\Windows\System\HbXQGMd.exe
  C:\Windows\System\HbXQGMd.exe
  2⤵
  PID:9856
- C:\Windows\System\tzHLQRi.exe
  C:\Windows\System\tzHLQRi.exe
  2⤵
  PID:5472
- C:\Windows\System\WtyigvK.exe
  C:\Windows\System\WtyigvK.exe
  2⤵
  PID:11896
- C:\Windows\System\OenHgfy.exe
  C:\Windows\System\OenHgfy.exe
  2⤵
  PID:12560
- C:\Windows\System\OBNpiei.exe
  C:\Windows\System\OBNpiei.exe
  2⤵
  PID:13220
- C:\Windows\System\bivllVw.exe
  C:\Windows\System\bivllVw.exe
  2⤵
  PID:12336
- C:\Windows\System\zHKWREh.exe
  C:\Windows\System\zHKWREh.exe
  2⤵
  PID:9612
- C:\Windows\System\lIrEYeK.exe
  C:\Windows\System\lIrEYeK.exe
  2⤵
  PID:10756
- C:\Windows\System\XLdGISx.exe
  C:\Windows\System\XLdGISx.exe
  2⤵
  PID:9980
- C:\Windows\System\QqMUnJw.exe
  C:\Windows\System\QqMUnJw.exe
  2⤵
  PID:10912
- C:\Windows\System\QNchOew.exe
  C:\Windows\System\QNchOew.exe
  2⤵
  PID:12308
- C:\Windows\System\LVvagoh.exe
  C:\Windows\System\LVvagoh.exe
  2⤵
  PID:13140
- C:\Windows\System\YNBTbMP.exe
  C:\Windows\System\YNBTbMP.exe
  2⤵
  PID:5560
- C:\Windows\System\BvYyDJz.exe
  C:\Windows\System\BvYyDJz.exe
  2⤵
  PID:12968
- C:\Windows\System\KMqqHuh.exe
  C:\Windows\System\KMqqHuh.exe
  2⤵
  PID:11528
- C:\Windows\System\GnpBini.exe
  C:\Windows\System\GnpBini.exe
  2⤵
  PID:9768
- C:\Windows\System\dbdvLRa.exe
  C:\Windows\System\dbdvLRa.exe
  2⤵
  PID:11288
- C:\Windows\System\SygDUQe.exe
  C:\Windows\System\SygDUQe.exe
  2⤵
  PID:8732
- C:\Windows\System\OeUYiYQ.exe
  C:\Windows\System\OeUYiYQ.exe
  2⤵
  PID:12848
- C:\Windows\System\UdORtNt.exe
  C:\Windows\System\UdORtNt.exe
  2⤵
  PID:12492
- C:\Windows\System\jUSzWfX.exe
  C:\Windows\System\jUSzWfX.exe
  2⤵
  PID:3240
- C:\Windows\System\WovpeGd.exe
  C:\Windows\System\WovpeGd.exe
  2⤵
  PID:13152
- C:\Windows\System\zpFqYPm.exe
  C:\Windows\System\zpFqYPm.exe
  2⤵
  PID:10336
- C:\Windows\System\BfCdGQo.exe
  C:\Windows\System\BfCdGQo.exe
  2⤵
  PID:12396
- C:\Windows\System\ARMZOce.exe
  C:\Windows\System\ARMZOce.exe
  2⤵
  PID:13244
- C:\Windows\System\ummKxoB.exe
  C:\Windows\System\ummKxoB.exe
  2⤵
  PID:13156
- C:\Windows\System\JhzeiWy.exe
  C:\Windows\System\JhzeiWy.exe
  2⤵
  PID:13260
- C:\Windows\System\CRgoiwq.exe
  C:\Windows\System\CRgoiwq.exe
  2⤵
  PID:11312
- C:\Windows\System\PUNgQJa.exe
  C:\Windows\System\PUNgQJa.exe
  2⤵
  PID:13124
- C:\Windows\System\uDDlLSI.exe
  C:\Windows\System\uDDlLSI.exe
  2⤵
  PID:11104
- C:\Windows\System\wwhLxEf.exe
  C:\Windows\System\wwhLxEf.exe
  2⤵
  PID:1076
- C:\Windows\System\HSjyGLk.exe
  C:\Windows\System\HSjyGLk.exe
  2⤵
  PID:3528
- C:\Windows\System\BfEEnze.exe
  C:\Windows\System\BfEEnze.exe
  2⤵
  PID:11988
- C:\Windows\System\EHDkdAm.exe
  C:\Windows\System\EHDkdAm.exe
  2⤵
  PID:8648
- C:\Windows\System\xsmXYHJ.exe
  C:\Windows\System\xsmXYHJ.exe
  2⤵
  PID:12912
- C:\Windows\System\oLXNFLx.exe
  C:\Windows\System\oLXNFLx.exe
  2⤵
  PID:6976
- C:\Windows\System\uzRJZnK.exe
  C:\Windows\System\uzRJZnK.exe
  2⤵
  PID:12392
- C:\Windows\System\vbVZMVu.exe
  C:\Windows\System\vbVZMVu.exe
  2⤵
  PID:15368
- C:\Windows\System\AvRaELd.exe
  C:\Windows\System\AvRaELd.exe
  2⤵
  PID:15388
- C:\Windows\System\CEStZJL.exe
  C:\Windows\System\CEStZJL.exe
  2⤵
  PID:15416
- C:\Windows\System\GDCrJzC.exe
  C:\Windows\System\GDCrJzC.exe
  2⤵
  PID:15440
- C:\Windows\System\jCWsJwj.exe
  C:\Windows\System\jCWsJwj.exe
  2⤵
  PID:15464
- C:\Windows\System\MocfCBv.exe
  C:\Windows\System\MocfCBv.exe
  2⤵
  PID:15488
- C:\Windows\System\mEZgqBx.exe
  C:\Windows\System\mEZgqBx.exe
  2⤵
  PID:15508
- C:\Windows\System\xMlLoDK.exe
  C:\Windows\System\xMlLoDK.exe
  2⤵
  PID:15536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ywzivnpt.tok.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BQUwOUa.exe

Filesize
1.9MB

MD5
fc058c5444762fac0501933ca007ac96

SHA1
a53c74bf88fd2186753cf89f2d102f47192881a4

SHA256
1d8fa7cf1ffa7857c40d67ebf83cb7838da93db5f7927d479ad2644693f68fcc

SHA512
1d97cc34ed84e3ddc52cd5fbd8e9689004f9aa357eb1b1ba1d58aae08ddc71942c49c87db3737cb2a7c6455a44b44072a55c259d14cfcb48164ea707dd8d8493

Download Submit
C:\Windows\System\EaqfOkf.exe

Filesize
1.9MB

MD5
82e2d958394975970e3862642f9a9a56

SHA1
344df879ead8beb36e461d4954e87a6a2f4dd47d

SHA256
4218673a0ea09fe5184e89d7db3efda0c28a2c20147777cef7f2f72dfcd249bd

SHA512
89dfc27a4a8aeff8f4c23a54f8d521a977ac6227034d3149e8b8f668a9716966062c53831e791f86cf7a59f4f5cced6fcf15af9f190eba570a1cc26639c9784a

Download Submit
C:\Windows\System\FmHlKar.exe

Filesize
1.9MB

MD5
fcfe5111170d8c0d9d2f038464723a36

SHA1
14672bfdb1a35596c6abe34831c4c272c338b9ce

SHA256
3409e58125ae353019976e97016db6923c210845aa634b3396781426c587782d

SHA512
72578ddc1c644f34715f085a358751dffbd3eb1333deedc6921646846672e99638cfcb1ecf5d5c7700db0392c2c0a95d94ea29c8f431cfb5798c4a578c18ef4d

Download Submit
C:\Windows\System\HnnvUjn.exe

Filesize
1.9MB

MD5
fd686a81c541417876e9f35abdbd8603

SHA1
df1bad2ddafd58d56bd7228e438d2874c9124fd9

SHA256
c4905a0523b734b7194e3ab6a8ac4f4f87be85338b1eb5ee1bd2d3be847511e7

SHA512
66cb74091b7f1ef74417ef87679c194bc8e5b56612bd315b9ab109d470dc5932101c5f6df5f9f365ce3c5897272906ab60ed38a80cea3f1ea2f806028b3644fc

Download Submit
C:\Windows\System\JoeNEAm.exe

Filesize
1.9MB

MD5
6c359c47a3f0aada90398626f52c0389

SHA1
ea43d3425256767bbae960a76edd8589be6587d3

SHA256
242d5e7c475d3a0b1418a3c13308eb866946d3ec60c9ae4cadbeeabf7386f54b

SHA512
f55c6113f7f145e6dfc29f53c587701556d0cf956ae8822e1eea17584a9f830ca4e3d72d8c20a3f728f3f9b692cce1c5a68921090e985b4e9ee1a8d677836447

Download Submit
C:\Windows\System\KdSZkiw.exe

Filesize
1.9MB

MD5
0be89c2286faaa96617bb2a708268e7b

SHA1
c5f3762325e24ae78e992aa7bf287947f26755bf

SHA256
ca140be3ab17d1cbad52482808a599e09c49da0bf2e5bc50c4d7a71cc74b2f88

SHA512
f3a2818ce8314cf6b90ce351fc22240d8fd2bc3c8c4f3eb95089a0a86d48917f8b07fea67b7ad7fe992fe38f44d8bf51507cdc490a529bf6cbbec2069fbcf55b

Download Submit
C:\Windows\System\KdhOxby.exe

Filesize
1.9MB

MD5
2efccd5745dfe9f0b2197f838c47eebc

SHA1
35ccc6670cc9fa27b198cb5515037d54dfb47457

SHA256
8fefb28e75abfacc65df1b1e89ecb03322398b6a378610c00e5d50eeaa3fe4ca

SHA512
cd753de68b43e792766cb6cec966e7a53d6db23100051d474695c5ee3c4d4982c52c33c8c730d7eff2094f5758238faef14580ef36bc587d5354e92f143b514f

Download Submit
C:\Windows\System\LdwHymz.exe

Filesize
1.9MB

MD5
98fb11c598c9ac26929ce0a3118e9c37

SHA1
bd5416cdd4561d5d5f4572283ea304f7340b6760

SHA256
6aaeb2e5e11932cf56b10d4c472b8f427f8c790e845ab5ca2087ca4c757d08b8

SHA512
ca490d2ebcfefacf4f53a31e3e4e7a12199d8a97133a59f13ad38e1f52480481e164ca7cdde3aa649d0696cd845032a3d2b992c72d4b5c5925db1cca615a7804

Download Submit
C:\Windows\System\NYvZyzq.exe

Filesize
1.9MB

MD5
e0cf9844cc54828c049971bf0718f9c8

SHA1
b7e2ff06491a35673c80d6be02b5737092330f4a

SHA256
304dc8cce73a75a792e8908273a7dfb01166e7407976e0040934f264a26289bd

SHA512
56317a4c763d898160fd478850152c7d52e61f91bf16381348210e0140d0448cd63dca8832cf4659138b791ae79a6bf2e086f4c53ad77467e1bfacd908ffe882

Download Submit
C:\Windows\System\OjRRgQL.exe

Filesize
1.9MB

MD5
9457826ccfbd967192afa98bdc6beab7

SHA1
e5533ba6deaad5d8e5ef2f0b8b2aa335aa1ba0a1

SHA256
d5faf00af7f6decf13e29a7de250e78223a5a49cf1e1c31429eed59936b6dd24

SHA512
41df1e09c1ed8cc0573dbff85bac410af951ba6f8c8a954684edb67436a5cc5837a3d6e9aef10613ef204fcb6b41666eb6b842805a9e30b4f9b993e68edaef17

Download Submit
C:\Windows\System\RbYZMNc.exe

Filesize
1.9MB

MD5
37c0db8a878f69d02b47c8662da1b294

SHA1
5f873feaf25edfc55abbf6cd55af68608bc820c4

SHA256
cb9c5f2f16dea6d9b10658c7820cba5374578d4e324e3ffd3a2f95373f7638d6

SHA512
14a75c3cb0fdd2028dea37239960173e7c688d29bc33f91ba0bdbca58cf8d009af6150b1a78d850c378782be1fb5fcfa87e69c7963cd5ed7178b4367cc2f18c4

Download Submit
C:\Windows\System\RrYWEyB.exe

Filesize
1.9MB

MD5
7213fb8492d70c9c3fa4e00912cb9a4c

SHA1
e2f770bef457ae13d4e594daf33822fd30bcdb22

SHA256
b9b3ccbc0a5dfdb2214840b7052b4675651c7f3740da0a18415a6b468f7ba9cc

SHA512
70d29e373133c97b8361ac481b16f2fe04ad6e1fb0cd751e51c59fea9a3f35ad4e67d1ea0f01aee24f4c680d9eb54914c52238b9a0d6d11384ea365378dd56aa

Download Submit
C:\Windows\System\SZaQRXC.exe

Filesize
1.9MB

MD5
d283dedb239fe31faa1b5ce888d46a57

SHA1
a9e0cd0ca863bf7645f1049cc94b0fa374c771ae

SHA256
9ea8c9c35c89692fc086c9cd25e3b16198411da61a1a330733646dd2b4ccba1d

SHA512
b871980e65cd1a7a38473f63b7c374a0ed8cb98df8188218f77331996ff4bd173c02ee3a01f5905df6726718cd5919d3ffe9a805252dee899cd9183c4e67a47d

Download Submit
C:\Windows\System\YwdDuLh.exe

Filesize
1.9MB

MD5
6afc5eae69db657acdb363519bcb0b2c

SHA1
05a2a9f9874a1a8bfe4548e0806c66b6e7bac54b

SHA256
59a30c87c966f0c04ec50b83f61d01054c2368f72fb17fba55d131f50db728b7

SHA512
0d6bc94f8eb482921fefdf472b79ee2f1c4f028017daf05ead4fed968a272cea7a6d1e08ee01549dd50fbb67a6bfed96f058c5d0b71c939798a68ae424d26da4

Download Submit
C:\Windows\System\aXhXzyK.exe

Filesize
1.9MB

MD5
413cc673c7920bfecc734922a7edf511

SHA1
61f24e1b170b86bcad7a562b0aa3f8a3fc793ef7

SHA256
f878ef1872f24b54c98c05c6b5fb91379c6e33a45421a77ab857e2fe38aaadc8

SHA512
094a4e712387f29d6cd25de4a8cb3bab0c876a9765f5537731295fdaf8bfeee5531681e64af9a8ade739c38fcdd996a8ca470b020f0b1710475fd8846ba0ef3c

Download Submit
C:\Windows\System\bDOXUZN.exe

Filesize
1.9MB

MD5
d165f6c988a45b2bcc1b99e1a38ce52c

SHA1
e9732739672edce6af75d440bd1f29c0d12d8fb5

SHA256
0a33df25abd792515cd69ef51c4406a26eee1976c2f2a432705f458483738786

SHA512
8f3b6f5141f1a4572acb5cc533cbcbc8f80bd4d7d7667289e6504b6cc3852ff71930b3c98b5efdfb712dc1c8b48e06df736ae1fda41fc0ce17ca3f2b683822da

Download Submit
C:\Windows\System\ditculd.exe

Filesize
1.9MB

MD5
9641c6d53597e677fcf8e3cf2f3ea585

SHA1
51c296a4f4a7a3109e2895045f691accefa131ff

SHA256
9febc2e1b7b355603237b930b539b5bdf44c7865a78f42745a2470e25efb547a

SHA512
abce9703f9614534fd58c864b3fe561368403e532583c70f5591bca54297127284487398266acd36abc6e78edc10289b06aa1813a2e05e08879237b69a00ae0f

Download Submit
C:\Windows\System\idfkcLU.exe

Filesize
1.9MB

MD5
8ff8b763c3a2a79ae8aea78a7d14a518

SHA1
7e81e44df232d9c53fd1dea8c594e36d1204da7e

SHA256
530ff7bd9919e185fbf65a157ea9e45e54613e5d40df2c53f17aa960e94b35ef

SHA512
dcfdadb817bec2cfdd0bc6b6a1c91517bbd95d3312631b7fab956cf80421b5f8d0a888a7f49fe45053d1ebb7ecb54bd9d7609b6e94c150ed2e76819ca7f16856

Download Submit
C:\Windows\System\ixiqvGr.exe

Filesize
1.9MB

MD5
e1777a4d12a6f8377f0a3aeaa3ac39e9

SHA1
a90551abacc8657f8dc93729ae798dc179641d30

SHA256
e484eb379a0391efc9a60268f4c13dd47a5ecd304c7f56979279846f8d5f16e7

SHA512
64849568e4fa17d9ff1d30b5c7f5d05ec698c7bd5c1c2422cbb2be69bc499ce0d38e3bb7751690e4d0f27d3e0303fac310151f545af379eb6ed2cbd75f91f0ea

Download Submit
C:\Windows\System\kRsuibp.exe

Filesize
1.9MB

MD5
41a02deb350cf826f27c2f7f7406f1e8

SHA1
689913a085f4ab4e3fceaf5fcd89d6b4763e91c8

SHA256
cd46e0b5dbc59274c3f3cc4c896802d44831c39f7caadcab3f22bad598bf872c

SHA512
6333439c9f627cffab5fc4b38744238d454ddc48846f162a81b150b5fb760dca938aa9f1a7c4bd1f0044a4388b41f899a26968378fd39bfd57ca19126833e7f6

Download Submit
C:\Windows\System\nKRHsRn.exe

Filesize
1.9MB

MD5
a2d50690b51069d7626f8a4a35d5e75f

SHA1
b009dcaaa328c03d10148a9952edfc5d11ad1a0a

SHA256
e52b01fbb59a8d66c2c2305c722a8734e7524e995f1a283b9d995d881a4b8899

SHA512
4adc4cc183f9f406d09607845e3fafc8ea21d3f2effe1897ee1d7a7753f2e47cb9566fd5db63d6756c7dc844a91f473ca6a8401ed16e93c936ee627fc6a0061c

Download Submit
C:\Windows\System\oKRVljf.exe

Filesize
1.9MB

MD5
58287ede1f615fe419a094dcf0093412

SHA1
dd004436f76b140aa41bdc24a5417fd58ceeca58

SHA256
7a88a66ceca009b03e8cfecc1a8f3e39913b31b3152e1f2e124dda9717d86bc4

SHA512
236ff0031e3866d4f833fee71f6c615675077c04e17805766bc8c82fbf850ee3a48ada8391587aafae6fd6806e158ab22711e695cf1f3e2cfa3492cb06abc59b

Download Submit
C:\Windows\System\qAnycDq.exe

Filesize
1.9MB

MD5
fea87ded8eefb2e3b472ba458fbe11db

SHA1
ea3eef9e70f78986cd871e48cdf6e9664b54ab80

SHA256
ffa086a3fd0b9baaba090156e016a4632848f1d8990470dc1fa45e8a81446594

SHA512
f31a6b980b177097b00d3829ffbc2472a0d2628a6475c1081801124c81dec1bb3b028bdae2c92cba64cb0140ea46ac8bba278fad972618289cd4777f84e5a5a5

Download Submit
C:\Windows\System\rlvAtpR.exe

Filesize
1.9MB

MD5
c7093573ef996e7a44807a5465a1741f

SHA1
837e695a74dec845e550c34f0085e267dd0ce074

SHA256
7d825fe80d88d60a8cfc4b152854cc7b89701a41bd41ef23777f6fbf7c2d7eda

SHA512
b89fb954fb20dcc8c7ac47d3642563f26bfc8c1df99a9ee5f38531b4c479acf9c9a5226c1d2e41cf48f1c1c215a4bb5b4c6883394dbd015231d47080146c6054

Download Submit
C:\Windows\System\rzlDWZU.exe

Filesize
1.9MB

MD5
ccf7a2db84896e1103b17d3f50edf136

SHA1
81b88488271bef38a4a989743fb215db0e16c7be

SHA256
2855528b7b019d93c274f177772a166f4cf524a53336226d355d6f20fbf0d891

SHA512
e1c279a0f1c15019324f15346f6c4049547cdb8a5bf498a125cc084ecfd394bcfe432f33295f3ab6ff490aca8f0a5a4a9f806c6bdb2ed6c5a41d0d32e34d922e

Download Submit
C:\Windows\System\sPSauWo.exe

Filesize
1.9MB

MD5
52ee8becb6bb917e8f47bcae0fcbdcb1

SHA1
c05361dd5a44ff8ada020ce0d741217fc9ec4e75

SHA256
f11091c3753090b748a5d70c62a541c53ed6e82b4ca0e07bf418f5a5f4ab4972

SHA512
ea792c2c2304408a848f7addeaf2fe0582afde604fd867ff31a74a827019f5873ae2166d199098431e8c77c8efd0a462403bc16999aed074128762bfa417ef9e

Download Submit
C:\Windows\System\vOnIUWV.exe

Filesize
1.9MB

MD5
184821215b3348bde21e69c5db8c7cc6

SHA1
b7110771254fbb59ee71281eac1a808a57d96b69

SHA256
459169737bbb30d77abc2e9115847a5d346d1e6211d470374776facb8d9d8ca3

SHA512
e5059dae9000ad80453470881cbfdd64364efb02ce5951b6d6d7df403d76e06b396ba7321427929a2436680c758d6a685f53e7a2f9676ec86be10764d40d0352

Download Submit
C:\Windows\System\vqqRFHe.exe

Filesize
1.9MB

MD5
de1c14594145fa2f16cb209713e02541

SHA1
f97f12e0a85aeb8fb49bd66d9a68700e75398aca

SHA256
72b61efc8c2df16437f4b3330b33325c72b8e9dd66ff02770d99e4d18dbca269

SHA512
229371d5843750f806de2c9d990f67a3de29fa59eef76f94c21d83c770865d9f1219600afde66dfdfe8c42115e0ffe0173b000a7f93bd58982e955bb8b1fd509

Download Submit
C:\Windows\System\vxBGzGk.exe

Filesize
1.9MB

MD5
b201434916a941576177bf5b6c694eeb

SHA1
8d281dfd62ea2fe51b150b58166dd2069159aeb7

SHA256
f125badf17fb89017c9d39e3ea3c57859185b269c87cd3eee8fbe0f22dcca521

SHA512
4b758a44d4bde7f5a2533f3c4ebe97c96d1315bb26c5d1a64ae8b2e08368a4495e26902fdc13420dc39d3fcb1cb42a68e30109f2d7339ddbf8590914a6af85bd

Download Submit
C:\Windows\System\xfXfwuY.exe

Filesize
1.9MB

MD5
1f5126e727acc1d09c66b70568a52155

SHA1
6000c01f034def1e421b81e60965cedbbe7d9350

SHA256
ff3f482b2bccc74fe6d02e104bdd0edd83fdbd0250825d2dbfe2ae6d8a0cbe8e

SHA512
40313c5ed2075db58e570741c02e195fd5c1ba9b5d37634c4aa34e76f3a130cbdeff4e5408043d732f3689881d6dcdd1bc8cb442fdd020c3ff7accedbda92d0b

Download Submit
C:\Windows\System\yCffBna.exe

Filesize
1.9MB

MD5
2647560f31cc5c2c18a8ecb37c1e7606

SHA1
109a30e71cca6946dc2f2a32355a315a669fc1f7

SHA256
c358b71b4d7865f5aada57786497d02bd697ec633c9fcf1a67a2a79e403037dc

SHA512
7f0b36686a75525490389b6b2739e3446f6fd69d328caef79e6536153c4f5dea8a6e30be9c9c4eadbb0fd0d0a88ff20fb8b02f732676d848b55c65cc69d11908

Download Submit
C:\Windows\System\yTkuRju.exe

Filesize
1.9MB

MD5
cf2ec9d9d56f22b8a7120b7d4a5d632d

SHA1
503b67c2f5456a1f76642a21a0e62c2bf5f85548

SHA256
3056823ec745b26783ccc61567e3bf1915ce4b839e363c1999210c173753264e

SHA512
eaa7069886ffbd75bab358a0676593a3a093caa1c353de67c990a9455aad7c2099ab3a427d7efa30b6f3bd6559f393836d588f9b25b6e354816b06af286ab07e

Download Submit
C:\Windows\System\yvKxWpH.exe

Filesize
1.9MB

MD5
ec4e4ad46e0f34b0cf68222fd87267f9

SHA1
c7a75f5bda434886203d9ee9df9dfc4e58a85de5

SHA256
3da04ffd22b231883e82f61d4516311fca0c1709e3c12ba920355ca8a214ff24

SHA512
01218d60ed4d8d31c315cb2235fcc7e564312f58319d8e0b216673efbbef2cbb5a82f9c553826bec07fd141264aeb3647f6eb3611204dc7827292781bfef244a

Download Submit
memory/656-2216-0x00007FF70BC40000-0x00007FF70C032000-memory.dmp

Filesize
3.9MB

Download
memory/656-46-0x00007FF70BC40000-0x00007FF70C032000-memory.dmp

Filesize
3.9MB

Download
memory/1516-2192-0x00007FF74D400000-0x00007FF74D7F2000-memory.dmp

Filesize
3.9MB

Download
memory/1516-151-0x00007FF74D400000-0x00007FF74D7F2000-memory.dmp

Filesize
3.9MB

Download
memory/1756-74-0x00007FF61D060000-0x00007FF61D452000-memory.dmp

Filesize
3.9MB

Download
memory/1756-2162-0x00007FF61D060000-0x00007FF61D452000-memory.dmp

Filesize
3.9MB

Download
memory/1916-38-0x00007FFC3DC90000-0x00007FFC3E751000-memory.dmp

Filesize
10.8MB

Download
memory/1916-41-0x0000021EEF1D0000-0x0000021EEF1E0000-memory.dmp

Filesize
64KB

Download
memory/1916-346-0x0000021EF2060000-0x0000021EF2806000-memory.dmp

Filesize
7.6MB

Download
memory/1916-47-0x0000021EEF1D0000-0x0000021EEF1E0000-memory.dmp

Filesize
64KB

Download
memory/1916-21-0x0000021EEF100000-0x0000021EEF122000-memory.dmp

Filesize
136KB

Download
memory/2024-2160-0x00007FF6A3FE0000-0x00007FF6A43D2000-memory.dmp

Filesize
3.9MB

Download
memory/2024-85-0x00007FF6A3FE0000-0x00007FF6A43D2000-memory.dmp

Filesize
3.9MB

Download
memory/2040-2173-0x00007FF662700000-0x00007FF662AF2000-memory.dmp

Filesize
3.9MB

Download
memory/2040-122-0x00007FF662700000-0x00007FF662AF2000-memory.dmp

Filesize
3.9MB

Download
memory/2120-2188-0x00007FF777B30000-0x00007FF777F22000-memory.dmp

Filesize
3.9MB

Download
memory/2120-45-0x00007FF777B30000-0x00007FF777F22000-memory.dmp

Filesize
3.9MB

Download
memory/2160-2307-0x00007FF7FF750000-0x00007FF7FFB42000-memory.dmp

Filesize
3.9MB

Download
memory/2160-0-0x00007FF7FF750000-0x00007FF7FFB42000-memory.dmp

Filesize
3.9MB

Download
memory/2160-1-0x000001ABA73A0000-0x000001ABA73B0000-memory.dmp

Filesize
64KB

Download
memory/2408-142-0x00007FF655380000-0x00007FF655772000-memory.dmp

Filesize
3.9MB

Download
memory/2408-2203-0x00007FF655380000-0x00007FF655772000-memory.dmp

Filesize
3.9MB

Download
memory/2616-2182-0x00007FF79BE90000-0x00007FF79C282000-memory.dmp

Filesize
3.9MB

Download
memory/2616-145-0x00007FF79BE90000-0x00007FF79C282000-memory.dmp

Filesize
3.9MB

Download
memory/2700-129-0x00007FF6F33E0000-0x00007FF6F37D2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-2170-0x00007FF6F33E0000-0x00007FF6F37D2000-memory.dmp

Filesize
3.9MB

Download
memory/2804-2201-0x00007FF64C590000-0x00007FF64C982000-memory.dmp

Filesize
3.9MB

Download
memory/2804-137-0x00007FF64C590000-0x00007FF64C982000-memory.dmp

Filesize
3.9MB

Download
memory/3088-2175-0x00007FF67A890000-0x00007FF67AC82000-memory.dmp

Filesize
3.9MB

Download
memory/3088-134-0x00007FF67A890000-0x00007FF67AC82000-memory.dmp

Filesize
3.9MB

Download
memory/3248-67-0x00007FF659910000-0x00007FF659D02000-memory.dmp

Filesize
3.9MB

Download
memory/3248-2151-0x00007FF659910000-0x00007FF659D02000-memory.dmp

Filesize
3.9MB

Download
memory/3892-40-0x00007FF700410000-0x00007FF700802000-memory.dmp

Filesize
3.9MB

Download
memory/3892-2111-0x00007FF700410000-0x00007FF700802000-memory.dmp

Filesize
3.9MB

Download
memory/4148-2161-0x00007FF7ADAB0000-0x00007FF7ADEA2000-memory.dmp

Filesize
3.9MB

Download
memory/4148-91-0x00007FF7ADAB0000-0x00007FF7ADEA2000-memory.dmp

Filesize
3.9MB

Download
memory/4208-57-0x00007FF785D30000-0x00007FF786122000-memory.dmp

Filesize
3.9MB

Download
memory/4208-2164-0x00007FF785D30000-0x00007FF786122000-memory.dmp

Filesize
3.9MB

Download
memory/4304-2196-0x00007FF72A5C0000-0x00007FF72A9B2000-memory.dmp

Filesize
3.9MB

Download
memory/4304-115-0x00007FF72A5C0000-0x00007FF72A9B2000-memory.dmp

Filesize
3.9MB

Download
memory/4332-2123-0x00007FF6DC5A0000-0x00007FF6DC992000-memory.dmp

Filesize
3.9MB

Download
memory/4332-44-0x00007FF6DC5A0000-0x00007FF6DC992000-memory.dmp

Filesize
3.9MB

Download
memory/4380-106-0x00007FF621610000-0x00007FF621A02000-memory.dmp

Filesize
3.9MB

Download
memory/4380-2159-0x00007FF621610000-0x00007FF621A02000-memory.dmp

Filesize
3.9MB

Download
memory/4492-2163-0x00007FF6550C0000-0x00007FF6554B2000-memory.dmp

Filesize
3.9MB

Download
memory/4492-96-0x00007FF6550C0000-0x00007FF6554B2000-memory.dmp

Filesize
3.9MB

Download
memory/4888-43-0x00007FF7F0FF0000-0x00007FF7F13E2000-memory.dmp

Filesize
3.9MB

Download
memory/4888-2126-0x00007FF7F0FF0000-0x00007FF7F13E2000-memory.dmp

Filesize
3.9MB

Download
memory/5008-42-0x00007FF686A90000-0x00007FF686E82000-memory.dmp

Filesize
3.9MB

Download
memory/5008-2114-0x00007FF686A90000-0x00007FF686E82000-memory.dmp

Filesize
3.9MB

Download