xmrig | 370f876899e3da876b0dfcf828e8b8cfb0c76c24d4653df4bddd6595ef63eaef

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
Size

1.9MB
MD5

0404ae7c727edc93400c41b17f8ef6dc
SHA1

62473b1857a67ecc1e2f82ce430774336b32688c
SHA256

370f876899e3da876b0dfcf828e8b8cfb0c76c24d4653df4bddd6595ef63eaef
SHA512

5f712c550cc9e65e5e852eb21cf7c10ed3aa4201a06c555baa6658a37aef26c35438d81515ef5768ca07d395af081bcf4d969e388753bcf7de007b85c6eae793
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl/:NABC

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 30 IoCs

miner

resource	yara_rule
behavioral2/memory/2244-228-0x00007FF71D830000-0x00007FF71DC22000-memory.dmp	xmrig
behavioral2/memory/1508-284-0x00007FF6291F0000-0x00007FF6295E2000-memory.dmp	xmrig
behavioral2/memory/1336-399-0x00007FF791720000-0x00007FF791B12000-memory.dmp	xmrig
behavioral2/memory/5096-525-0x00007FF6FFD80000-0x00007FF700172000-memory.dmp	xmrig
behavioral2/memory/2112-607-0x00007FF798200000-0x00007FF7985F2000-memory.dmp	xmrig
behavioral2/memory/4952-646-0x00007FF7544C0000-0x00007FF7548B2000-memory.dmp	xmrig
behavioral2/memory/2312-913-0x00007FF7BF0C0000-0x00007FF7BF4B2000-memory.dmp	xmrig
behavioral2/memory/1764-910-0x00007FF753650000-0x00007FF753A42000-memory.dmp	xmrig
behavioral2/memory/2700-647-0x00007FF6CD030000-0x00007FF6CD422000-memory.dmp	xmrig
behavioral2/memory/4628-645-0x00007FF76CEE0000-0x00007FF76D2D2000-memory.dmp	xmrig
behavioral2/memory/3724-467-0x00007FF7F23B0000-0x00007FF7F27A2000-memory.dmp	xmrig
behavioral2/memory/4984-466-0x00007FF600370000-0x00007FF600762000-memory.dmp	xmrig
behavioral2/memory/4004-398-0x00007FF632810000-0x00007FF632C02000-memory.dmp	xmrig
behavioral2/memory/1984-347-0x00007FF60F9A0000-0x00007FF60FD92000-memory.dmp	xmrig
behavioral2/memory/4152-317-0x00007FF652C90000-0x00007FF653082000-memory.dmp	xmrig
behavioral2/memory/3112-316-0x00007FF7A3280000-0x00007FF7A3672000-memory.dmp	xmrig
behavioral2/memory/1916-205-0x00007FF74F8C0000-0x00007FF74FCB2000-memory.dmp	xmrig
behavioral2/memory/4764-227-0x00007FF66F470000-0x00007FF66F862000-memory.dmp	xmrig
behavioral2/memory/1420-127-0x00007FF620800000-0x00007FF620BF2000-memory.dmp	xmrig
behavioral2/memory/4640-124-0x00007FF75FDF0000-0x00007FF7601E2000-memory.dmp	xmrig
behavioral2/memory/3660-5379-0x00007FF6C6CF0000-0x00007FF6C70E2000-memory.dmp	xmrig
behavioral2/memory/1764-6237-0x00007FF753650000-0x00007FF753A42000-memory.dmp	xmrig
behavioral2/memory/4764-6332-0x00007FF66F470000-0x00007FF66F862000-memory.dmp	xmrig
behavioral2/memory/3112-6355-0x00007FF7A3280000-0x00007FF7A3672000-memory.dmp	xmrig
behavioral2/memory/3724-6366-0x00007FF7F23B0000-0x00007FF7F27A2000-memory.dmp	xmrig
behavioral2/memory/4952-6386-0x00007FF7544C0000-0x00007FF7548B2000-memory.dmp	xmrig
behavioral2/memory/1336-6407-0x00007FF791720000-0x00007FF791B12000-memory.dmp	xmrig
behavioral2/memory/5096-6398-0x00007FF6FFD80000-0x00007FF700172000-memory.dmp	xmrig
behavioral2/memory/2312-6409-0x00007FF7BF0C0000-0x00007FF7BF4B2000-memory.dmp	xmrig
behavioral2/memory/2112-6400-0x00007FF798200000-0x00007FF7985F2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4136	XzffESO.exe
4640	UqYDkyU.exe
1764	dKdtvzv.exe
1420	WiUcrEV.exe
1916	jRyoDYY.exe
4764	FnaXdMA.exe
2244	dLcRPHX.exe
1508	RtdKuiG.exe
3112	hxAVLZS.exe
4152	LcPbnae.exe
1984	fxDjHUg.exe
4004	uKhLiOG.exe
1336	KZgLZwd.exe
4984	HsZIxwB.exe
3724	mLmpvNj.exe
5096	LCctUqb.exe
2112	XlmOzcv.exe
4628	AVQTdJY.exe
2312	ljDIcvC.exe
4952	szwXPai.exe
2700	HODxPLi.exe
4792	xGqCSRT.exe
4936	WbrkvAX.exe
3736	zqKbRuC.exe
2276	NiSJmXa.exe
2852	iIfFMPT.exe
4072	eVScDkC.exe
4060	qASrVwK.exe
3992	tteirTo.exe
4756	MRurZtp.exe
4500	WUEqpdz.exe
4704	ZrKcZmG.exe
808	ylPAmsM.exe
2400	sTJFxlF.exe
1080	PBGAsbl.exe
1196	UFkCCSA.exe
5076	vAOsepn.exe
4812	YZPxFzq.exe
4108	zrgOVyX.exe
3940	PRPnYVv.exe
3464	AzUrDDN.exe
3772	xAvItJD.exe
2968	gneoIoa.exe
3496	GVZvRMi.exe
3512	KFXscpb.exe
3588	pqPRGaF.exe
3608	rrKGhYY.exe
4784	bkepnai.exe
3420	WXAneNm.exe
2696	DoCvwjy.exe
4864	IczeuiM.exe
3804	RAyEOay.exe
3516	mfDmNwR.exe
4476	ysPllCN.exe
4456	JbaurCn.exe
1424	kipXGXa.exe
1636	JhqhTjk.exe
2672	wOMiWZH.exe
1844	EJHXPXL.exe
5040	fITuMme.exe
4496	KSvmxyZ.exe
2468	HPbnTvP.exe
2912	vhOzOZx.exe
1644	cYWqPMr.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3660-0-0x00007FF6C6CF0000-0x00007FF6C70E2000-memory.dmp	upx
behavioral2/files/0x0006000000023266-5.dat	upx
behavioral2/files/0x0009000000023405-11.dat	upx
behavioral2/memory/4136-10-0x00007FF705D30000-0x00007FF706122000-memory.dmp	upx
behavioral2/files/0x000800000002343a-14.dat	upx
behavioral2/files/0x000700000002343e-40.dat	upx
behavioral2/files/0x000700000002343c-53.dat	upx
behavioral2/files/0x0007000000023446-106.dat	upx
behavioral2/files/0x000700000002344c-136.dat	upx
behavioral2/files/0x000700000002345a-181.dat	upx
behavioral2/memory/2244-228-0x00007FF71D830000-0x00007FF71DC22000-memory.dmp	upx
behavioral2/memory/1508-284-0x00007FF6291F0000-0x00007FF6295E2000-memory.dmp	upx
behavioral2/memory/1336-399-0x00007FF791720000-0x00007FF791B12000-memory.dmp	upx
behavioral2/memory/5096-525-0x00007FF6FFD80000-0x00007FF700172000-memory.dmp	upx
behavioral2/memory/2112-607-0x00007FF798200000-0x00007FF7985F2000-memory.dmp	upx
behavioral2/memory/4952-646-0x00007FF7544C0000-0x00007FF7548B2000-memory.dmp	upx
behavioral2/memory/2312-913-0x00007FF7BF0C0000-0x00007FF7BF4B2000-memory.dmp	upx
behavioral2/memory/1764-910-0x00007FF753650000-0x00007FF753A42000-memory.dmp	upx
behavioral2/memory/2700-647-0x00007FF6CD030000-0x00007FF6CD422000-memory.dmp	upx
behavioral2/memory/4628-645-0x00007FF76CEE0000-0x00007FF76D2D2000-memory.dmp	upx
behavioral2/memory/3724-467-0x00007FF7F23B0000-0x00007FF7F27A2000-memory.dmp	upx
behavioral2/memory/4984-466-0x00007FF600370000-0x00007FF600762000-memory.dmp	upx
behavioral2/memory/4004-398-0x00007FF632810000-0x00007FF632C02000-memory.dmp	upx
behavioral2/memory/1984-347-0x00007FF60F9A0000-0x00007FF60FD92000-memory.dmp	upx
behavioral2/memory/4152-317-0x00007FF652C90000-0x00007FF653082000-memory.dmp	upx
behavioral2/memory/3112-316-0x00007FF7A3280000-0x00007FF7A3672000-memory.dmp	upx
behavioral2/memory/1916-205-0x00007FF74F8C0000-0x00007FF74FCB2000-memory.dmp	upx
behavioral2/memory/4764-227-0x00007FF66F470000-0x00007FF66F862000-memory.dmp	upx
behavioral2/files/0x0007000000023454-192.dat	upx
behavioral2/files/0x000700000002345c-191.dat	upx
behavioral2/files/0x000700000002345b-190.dat	upx
behavioral2/files/0x000700000002344d-185.dat	upx
behavioral2/files/0x000700000002344a-178.dat	upx
behavioral2/files/0x0007000000023459-177.dat	upx
behavioral2/files/0x0007000000023458-169.dat	upx
behavioral2/files/0x0007000000023457-166.dat	upx
behavioral2/files/0x0007000000023456-159.dat	upx
behavioral2/files/0x000700000002344f-156.dat	upx
behavioral2/files/0x0007000000023448-151.dat	upx
behavioral2/files/0x0007000000023447-147.dat	upx
behavioral2/files/0x0007000000023455-146.dat	upx
behavioral2/files/0x0007000000023444-139.dat	upx
behavioral2/files/0x000700000002344b-132.dat	upx
behavioral2/files/0x0007000000023453-131.dat	upx
behavioral2/files/0x0007000000023452-130.dat	upx
behavioral2/files/0x0007000000023451-129.dat	upx
behavioral2/memory/1420-127-0x00007FF620800000-0x00007FF620BF2000-memory.dmp	upx
behavioral2/memory/4640-124-0x00007FF75FDF0000-0x00007FF7601E2000-memory.dmp	upx
behavioral2/files/0x000700000002344e-115.dat	upx
behavioral2/files/0x0007000000023445-109.dat	upx
behavioral2/files/0x0007000000023442-96.dat	upx
behavioral2/files/0x0007000000023441-90.dat	upx
behavioral2/files/0x0007000000023450-128.dat	upx
behavioral2/files/0x0007000000023449-120.dat	upx
behavioral2/files/0x000700000002343f-79.dat	upx
behavioral2/files/0x0007000000023443-72.dat	upx
behavioral2/files/0x0007000000023440-89.dat	upx
behavioral2/files/0x000700000002343d-60.dat	upx
behavioral2/files/0x000700000002343b-28.dat	upx
behavioral2/memory/3660-5379-0x00007FF6C6CF0000-0x00007FF6C70E2000-memory.dmp	upx
behavioral2/memory/1764-6237-0x00007FF753650000-0x00007FF753A42000-memory.dmp	upx
behavioral2/memory/4764-6332-0x00007FF66F470000-0x00007FF66F862000-memory.dmp	upx
behavioral2/memory/3112-6355-0x00007FF7A3280000-0x00007FF7A3672000-memory.dmp	upx
behavioral2/memory/3724-6366-0x00007FF7F23B0000-0x00007FF7F27A2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MlkZIGY.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\UxEMeZO.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\wPFQlbO.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\aKHWsAN.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\eVOsVDh.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\ybFHtsZ.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\HHfwAhx.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\VMmhotM.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\AreDrxI.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\LBYgTbc.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\XQmknPk.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\FRKAwap.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\AKkENUf.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\wAiYgxC.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\VIbftzO.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\djTuPMX.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\RxZcYJq.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\JNOlIqe.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\ZZLAlIm.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\TsHFybU.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\IWDmeCT.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\WePalrV.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\hKKNPhA.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\INkDNJv.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\XTfJAfl.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\bGTmOFY.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\gDDarnC.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\QzYOpmP.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\UQjEHyk.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\YQFIjrj.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\PEWcPdX.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\uMyMyZo.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\pHpATws.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\SxPRVEo.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\cdHlBJW.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\yCZnvuI.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\uCDvtKe.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\rGNsEPz.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\eWkraCz.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\mXRLBea.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\pJuSgTV.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\jrfVdHs.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\DDLUJnJ.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\aBojugN.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\dDQYTWo.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\EKHuKgy.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\tJnYCRV.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\erUZMRj.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\JvpPLHX.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\eeCsrmQ.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\xspmauZ.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\fYOzyej.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\wwxXlmI.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\TlvoGhc.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\NvcGWfV.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\GPmvFEV.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\zTKpofk.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\lLqSuyI.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\forSoMA.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\lTLmQnC.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\jMWcYtj.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\KWsiDvE.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\HcIporr.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
File created	C:\Windows\System\MqbNTjm.exe	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3240	powershell.exe
Token: SeLockMemoryPrivilege	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 3240	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	85
PID 3660 wrote to memory of 3240	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	85
PID 3660 wrote to memory of 4136	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	86
PID 3660 wrote to memory of 4136	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	86
PID 3660 wrote to memory of 4640	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	87
PID 3660 wrote to memory of 4640	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	87
PID 3660 wrote to memory of 1764	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	88
PID 3660 wrote to memory of 1764	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	88
PID 3660 wrote to memory of 1916	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	89
PID 3660 wrote to memory of 1916	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	89
PID 3660 wrote to memory of 1420	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	90
PID 3660 wrote to memory of 1420	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	90
PID 3660 wrote to memory of 4764	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	91
PID 3660 wrote to memory of 4764	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	91
PID 3660 wrote to memory of 2244	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	92
PID 3660 wrote to memory of 2244	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	92
PID 3660 wrote to memory of 1508	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	93
PID 3660 wrote to memory of 1508	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	93
PID 3660 wrote to memory of 3112	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	94
PID 3660 wrote to memory of 3112	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	94
PID 3660 wrote to memory of 4152	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	95
PID 3660 wrote to memory of 4152	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	95
PID 3660 wrote to memory of 1984	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	96
PID 3660 wrote to memory of 1984	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	96
PID 3660 wrote to memory of 4004	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	97
PID 3660 wrote to memory of 4004	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	97
PID 3660 wrote to memory of 1336	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	98
PID 3660 wrote to memory of 1336	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	98
PID 3660 wrote to memory of 4984	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	99
PID 3660 wrote to memory of 4984	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	99
PID 3660 wrote to memory of 3724	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	100
PID 3660 wrote to memory of 3724	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	100
PID 3660 wrote to memory of 5096	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	101
PID 3660 wrote to memory of 5096	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	101
PID 3660 wrote to memory of 2112	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	102
PID 3660 wrote to memory of 2112	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	102
PID 3660 wrote to memory of 4628	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	103
PID 3660 wrote to memory of 4628	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	103
PID 3660 wrote to memory of 2312	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	104
PID 3660 wrote to memory of 2312	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	104
PID 3660 wrote to memory of 4952	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	105
PID 3660 wrote to memory of 4952	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	105
PID 3660 wrote to memory of 2700	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	106
PID 3660 wrote to memory of 2700	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	106
PID 3660 wrote to memory of 4792	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	107
PID 3660 wrote to memory of 4792	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	107
PID 3660 wrote to memory of 4936	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	108
PID 3660 wrote to memory of 4936	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	108
PID 3660 wrote to memory of 3736	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	109
PID 3660 wrote to memory of 3736	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	109
PID 3660 wrote to memory of 2276	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	110
PID 3660 wrote to memory of 2276	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	110
PID 3660 wrote to memory of 2852	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	111
PID 3660 wrote to memory of 2852	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	111
PID 3660 wrote to memory of 4072	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	112
PID 3660 wrote to memory of 4072	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	112
PID 3660 wrote to memory of 4060	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	113
PID 3660 wrote to memory of 4060	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	113
PID 3660 wrote to memory of 3992	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	114
PID 3660 wrote to memory of 3992	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	114
PID 3660 wrote to memory of 4756	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	115
PID 3660 wrote to memory of 4756	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	115
PID 3660 wrote to memory of 4500	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	116
PID 3660 wrote to memory of 4500	3660	0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0404ae7c727edc93400c41b17f8ef6dc_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3240
- C:\Windows\System\XzffESO.exe
  C:\Windows\System\XzffESO.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\UqYDkyU.exe
  C:\Windows\System\UqYDkyU.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\dKdtvzv.exe
  C:\Windows\System\dKdtvzv.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\jRyoDYY.exe
  C:\Windows\System\jRyoDYY.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\WiUcrEV.exe
  C:\Windows\System\WiUcrEV.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\FnaXdMA.exe
  C:\Windows\System\FnaXdMA.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\dLcRPHX.exe
  C:\Windows\System\dLcRPHX.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\RtdKuiG.exe
  C:\Windows\System\RtdKuiG.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\hxAVLZS.exe
  C:\Windows\System\hxAVLZS.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\LcPbnae.exe
  C:\Windows\System\LcPbnae.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\fxDjHUg.exe
  C:\Windows\System\fxDjHUg.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\uKhLiOG.exe
  C:\Windows\System\uKhLiOG.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\KZgLZwd.exe
  C:\Windows\System\KZgLZwd.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\HsZIxwB.exe
  C:\Windows\System\HsZIxwB.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\mLmpvNj.exe
  C:\Windows\System\mLmpvNj.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\LCctUqb.exe
  C:\Windows\System\LCctUqb.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\XlmOzcv.exe
  C:\Windows\System\XlmOzcv.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\AVQTdJY.exe
  C:\Windows\System\AVQTdJY.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\ljDIcvC.exe
  C:\Windows\System\ljDIcvC.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\szwXPai.exe
  C:\Windows\System\szwXPai.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\HODxPLi.exe
  C:\Windows\System\HODxPLi.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\xGqCSRT.exe
  C:\Windows\System\xGqCSRT.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\WbrkvAX.exe
  C:\Windows\System\WbrkvAX.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\zqKbRuC.exe
  C:\Windows\System\zqKbRuC.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\NiSJmXa.exe
  C:\Windows\System\NiSJmXa.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\iIfFMPT.exe
  C:\Windows\System\iIfFMPT.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\eVScDkC.exe
  C:\Windows\System\eVScDkC.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\qASrVwK.exe
  C:\Windows\System\qASrVwK.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\tteirTo.exe
  C:\Windows\System\tteirTo.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\MRurZtp.exe
  C:\Windows\System\MRurZtp.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\WUEqpdz.exe
  C:\Windows\System\WUEqpdz.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\ZrKcZmG.exe
  C:\Windows\System\ZrKcZmG.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\ylPAmsM.exe
  C:\Windows\System\ylPAmsM.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\sTJFxlF.exe
  C:\Windows\System\sTJFxlF.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\PBGAsbl.exe
  C:\Windows\System\PBGAsbl.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\UFkCCSA.exe
  C:\Windows\System\UFkCCSA.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\vAOsepn.exe
  C:\Windows\System\vAOsepn.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\YZPxFzq.exe
  C:\Windows\System\YZPxFzq.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\zrgOVyX.exe
  C:\Windows\System\zrgOVyX.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\WXAneNm.exe
  C:\Windows\System\WXAneNm.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\PRPnYVv.exe
  C:\Windows\System\PRPnYVv.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\AzUrDDN.exe
  C:\Windows\System\AzUrDDN.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\xAvItJD.exe
  C:\Windows\System\xAvItJD.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\gneoIoa.exe
  C:\Windows\System\gneoIoa.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\GVZvRMi.exe
  C:\Windows\System\GVZvRMi.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\KFXscpb.exe
  C:\Windows\System\KFXscpb.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\mfDmNwR.exe
  C:\Windows\System\mfDmNwR.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\pqPRGaF.exe
  C:\Windows\System\pqPRGaF.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\rrKGhYY.exe
  C:\Windows\System\rrKGhYY.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\bkepnai.exe
  C:\Windows\System\bkepnai.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\DoCvwjy.exe
  C:\Windows\System\DoCvwjy.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\IczeuiM.exe
  C:\Windows\System\IczeuiM.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\RAyEOay.exe
  C:\Windows\System\RAyEOay.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\ysPllCN.exe
  C:\Windows\System\ysPllCN.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\JbaurCn.exe
  C:\Windows\System\JbaurCn.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\kipXGXa.exe
  C:\Windows\System\kipXGXa.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\JhqhTjk.exe
  C:\Windows\System\JhqhTjk.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\wOMiWZH.exe
  C:\Windows\System\wOMiWZH.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\EJHXPXL.exe
  C:\Windows\System\EJHXPXL.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\fITuMme.exe
  C:\Windows\System\fITuMme.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\KSvmxyZ.exe
  C:\Windows\System\KSvmxyZ.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\HPbnTvP.exe
  C:\Windows\System\HPbnTvP.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\vhOzOZx.exe
  C:\Windows\System\vhOzOZx.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\cYWqPMr.exe
  C:\Windows\System\cYWqPMr.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\IwwBRyr.exe
  C:\Windows\System\IwwBRyr.exe
  2⤵
  PID:2508
- C:\Windows\System\focDuxE.exe
  C:\Windows\System\focDuxE.exe
  2⤵
  PID:5028
- C:\Windows\System\pMRqaFh.exe
  C:\Windows\System\pMRqaFh.exe
  2⤵
  PID:4532
- C:\Windows\System\yLGhkHr.exe
  C:\Windows\System\yLGhkHr.exe
  2⤵
  PID:392
- C:\Windows\System\ejUXNDf.exe
  C:\Windows\System\ejUXNDf.exe
  2⤵
  PID:2736
- C:\Windows\System\DxFEuzI.exe
  C:\Windows\System\DxFEuzI.exe
  2⤵
  PID:3352
- C:\Windows\System\NOEQJAF.exe
  C:\Windows\System\NOEQJAF.exe
  2⤵
  PID:4580
- C:\Windows\System\NsKZgfy.exe
  C:\Windows\System\NsKZgfy.exe
  2⤵
  PID:220
- C:\Windows\System\iIgkGKf.exe
  C:\Windows\System\iIgkGKf.exe
  2⤵
  PID:1884
- C:\Windows\System\fCLHUCW.exe
  C:\Windows\System\fCLHUCW.exe
  2⤵
  PID:3000
- C:\Windows\System\RqIgfwH.exe
  C:\Windows\System\RqIgfwH.exe
  2⤵
  PID:3348
- C:\Windows\System\WVTxytP.exe
  C:\Windows\System\WVTxytP.exe
  2⤵
  PID:5132
- C:\Windows\System\jwsMTDE.exe
  C:\Windows\System\jwsMTDE.exe
  2⤵
  PID:5152
- C:\Windows\System\fsPiluk.exe
  C:\Windows\System\fsPiluk.exe
  2⤵
  PID:5168
- C:\Windows\System\wfYSFkb.exe
  C:\Windows\System\wfYSFkb.exe
  2⤵
  PID:5184
- C:\Windows\System\saQlSWq.exe
  C:\Windows\System\saQlSWq.exe
  2⤵
  PID:5200
- C:\Windows\System\BMIqdNy.exe
  C:\Windows\System\BMIqdNy.exe
  2⤵
  PID:5216
- C:\Windows\System\oceUYPP.exe
  C:\Windows\System\oceUYPP.exe
  2⤵
  PID:5236
- C:\Windows\System\XzYYXXh.exe
  C:\Windows\System\XzYYXXh.exe
  2⤵
  PID:5260
- C:\Windows\System\OJctjsd.exe
  C:\Windows\System\OJctjsd.exe
  2⤵
  PID:5288
- C:\Windows\System\frPECEy.exe
  C:\Windows\System\frPECEy.exe
  2⤵
  PID:5304
- C:\Windows\System\QaTurIe.exe
  C:\Windows\System\QaTurIe.exe
  2⤵
  PID:5336
- C:\Windows\System\ohzWcUV.exe
  C:\Windows\System\ohzWcUV.exe
  2⤵
  PID:5360
- C:\Windows\System\FypSYeM.exe
  C:\Windows\System\FypSYeM.exe
  2⤵
  PID:5384
- C:\Windows\System\zcuyThm.exe
  C:\Windows\System\zcuyThm.exe
  2⤵
  PID:5424
- C:\Windows\System\BnyjsYf.exe
  C:\Windows\System\BnyjsYf.exe
  2⤵
  PID:5448
- C:\Windows\System\HpfGiUa.exe
  C:\Windows\System\HpfGiUa.exe
  2⤵
  PID:5480
- C:\Windows\System\oHzcYEF.exe
  C:\Windows\System\oHzcYEF.exe
  2⤵
  PID:5508
- C:\Windows\System\cJYQmdS.exe
  C:\Windows\System\cJYQmdS.exe
  2⤵
  PID:5568
- C:\Windows\System\JkfAowI.exe
  C:\Windows\System\JkfAowI.exe
  2⤵
  PID:5604
- C:\Windows\System\YmVSYBt.exe
  C:\Windows\System\YmVSYBt.exe
  2⤵
  PID:5624
- C:\Windows\System\XfDAPkw.exe
  C:\Windows\System\XfDAPkw.exe
  2⤵
  PID:5648
- C:\Windows\System\HEWYcob.exe
  C:\Windows\System\HEWYcob.exe
  2⤵
  PID:5664
- C:\Windows\System\zQMBrsN.exe
  C:\Windows\System\zQMBrsN.exe
  2⤵
  PID:5684
- C:\Windows\System\DCVERWf.exe
  C:\Windows\System\DCVERWf.exe
  2⤵
  PID:5744
- C:\Windows\System\jZOSXIy.exe
  C:\Windows\System\jZOSXIy.exe
  2⤵
  PID:5760
- C:\Windows\System\taaxzqH.exe
  C:\Windows\System\taaxzqH.exe
  2⤵
  PID:5784
- C:\Windows\System\RRoFWyx.exe
  C:\Windows\System\RRoFWyx.exe
  2⤵
  PID:5800
- C:\Windows\System\ZSgCtFm.exe
  C:\Windows\System\ZSgCtFm.exe
  2⤵
  PID:5816
- C:\Windows\System\CtfEqJJ.exe
  C:\Windows\System\CtfEqJJ.exe
  2⤵
  PID:5844
- C:\Windows\System\NpwGxDB.exe
  C:\Windows\System\NpwGxDB.exe
  2⤵
  PID:5860
- C:\Windows\System\HyUNnRf.exe
  C:\Windows\System\HyUNnRf.exe
  2⤵
  PID:5880
- C:\Windows\System\lPNmxDQ.exe
  C:\Windows\System\lPNmxDQ.exe
  2⤵
  PID:5912
- C:\Windows\System\WzEXjYc.exe
  C:\Windows\System\WzEXjYc.exe
  2⤵
  PID:5932
- C:\Windows\System\wbHtFvI.exe
  C:\Windows\System\wbHtFvI.exe
  2⤵
  PID:5948
- C:\Windows\System\sFVeXEv.exe
  C:\Windows\System\sFVeXEv.exe
  2⤵
  PID:5972
- C:\Windows\System\DdfWfak.exe
  C:\Windows\System\DdfWfak.exe
  2⤵
  PID:5996
- C:\Windows\System\YbrCfIO.exe
  C:\Windows\System\YbrCfIO.exe
  2⤵
  PID:6012
- C:\Windows\System\YwCNwAm.exe
  C:\Windows\System\YwCNwAm.exe
  2⤵
  PID:6036
- C:\Windows\System\fxzxfEw.exe
  C:\Windows\System\fxzxfEw.exe
  2⤵
  PID:6060
- C:\Windows\System\qkRjQLU.exe
  C:\Windows\System\qkRjQLU.exe
  2⤵
  PID:6076
- C:\Windows\System\mwJPLAC.exe
  C:\Windows\System\mwJPLAC.exe
  2⤵
  PID:6100
- C:\Windows\System\nuHIoBQ.exe
  C:\Windows\System\nuHIoBQ.exe
  2⤵
  PID:6128
- C:\Windows\System\QCGHHdS.exe
  C:\Windows\System\QCGHHdS.exe
  2⤵
  PID:916
- C:\Windows\System\Iadcuyt.exe
  C:\Windows\System\Iadcuyt.exe
  2⤵
  PID:4140
- C:\Windows\System\NdzdjPk.exe
  C:\Windows\System\NdzdjPk.exe
  2⤵
  PID:4752
- C:\Windows\System\EnNoaeV.exe
  C:\Windows\System\EnNoaeV.exe
  2⤵
  PID:1956
- C:\Windows\System\xPUaRoo.exe
  C:\Windows\System\xPUaRoo.exe
  2⤵
  PID:4504
- C:\Windows\System\TlNrNgY.exe
  C:\Windows\System\TlNrNgY.exe
  2⤵
  PID:2992
- C:\Windows\System\tTEMFjL.exe
  C:\Windows\System\tTEMFjL.exe
  2⤵
  PID:1500
- C:\Windows\System\VdUgSgH.exe
  C:\Windows\System\VdUgSgH.exe
  2⤵
  PID:5584
- C:\Windows\System\CZklUgy.exe
  C:\Windows\System\CZklUgy.exe
  2⤵
  PID:2800
- C:\Windows\System\hBIGJxO.exe
  C:\Windows\System\hBIGJxO.exe
  2⤵
  PID:3056
- C:\Windows\System\ApYMIYG.exe
  C:\Windows\System\ApYMIYG.exe
  2⤵
  PID:3032
- C:\Windows\System\EgocvBR.exe
  C:\Windows\System\EgocvBR.exe
  2⤵
  PID:4964
- C:\Windows\System\jcVmuJQ.exe
  C:\Windows\System\jcVmuJQ.exe
  2⤵
  PID:1652
- C:\Windows\System\hwCGEoD.exe
  C:\Windows\System\hwCGEoD.exe
  2⤵
  PID:4616
- C:\Windows\System\kILoaRH.exe
  C:\Windows\System\kILoaRH.exe
  2⤵
  PID:1388
- C:\Windows\System\rbIJduV.exe
  C:\Windows\System\rbIJduV.exe
  2⤵
  PID:2500
- C:\Windows\System\XPAryIC.exe
  C:\Windows\System\XPAryIC.exe
  2⤵
  PID:5160
- C:\Windows\System\UqlIcMM.exe
  C:\Windows\System\UqlIcMM.exe
  2⤵
  PID:5196
- C:\Windows\System\ytgqRAF.exe
  C:\Windows\System\ytgqRAF.exe
  2⤵
  PID:5248
- C:\Windows\System\lcprZox.exe
  C:\Windows\System\lcprZox.exe
  2⤵
  PID:5300
- C:\Windows\System\wqwLQrS.exe
  C:\Windows\System\wqwLQrS.exe
  2⤵
  PID:5368
- C:\Windows\System\EuDUqza.exe
  C:\Windows\System\EuDUqza.exe
  2⤵
  PID:5588
- C:\Windows\System\ItsgjiF.exe
  C:\Windows\System\ItsgjiF.exe
  2⤵
  PID:5940
- C:\Windows\System\iehtvNq.exe
  C:\Windows\System\iehtvNq.exe
  2⤵
  PID:6044
- C:\Windows\System\BwcNOPR.exe
  C:\Windows\System\BwcNOPR.exe
  2⤵
  PID:6168
- C:\Windows\System\QHWRfmU.exe
  C:\Windows\System\QHWRfmU.exe
  2⤵
  PID:6188
- C:\Windows\System\Jhxsihl.exe
  C:\Windows\System\Jhxsihl.exe
  2⤵
  PID:6280
- C:\Windows\System\pfnrkcC.exe
  C:\Windows\System\pfnrkcC.exe
  2⤵
  PID:6320
- C:\Windows\System\xUOcNuF.exe
  C:\Windows\System\xUOcNuF.exe
  2⤵
  PID:6352
- C:\Windows\System\qmVLMDg.exe
  C:\Windows\System\qmVLMDg.exe
  2⤵
  PID:6368
- C:\Windows\System\jypogkS.exe
  C:\Windows\System\jypogkS.exe
  2⤵
  PID:6400
- C:\Windows\System\cGauvZZ.exe
  C:\Windows\System\cGauvZZ.exe
  2⤵
  PID:6424
- C:\Windows\System\hOEopmq.exe
  C:\Windows\System\hOEopmq.exe
  2⤵
  PID:6444
- C:\Windows\System\hAaFlZH.exe
  C:\Windows\System\hAaFlZH.exe
  2⤵
  PID:6460
- C:\Windows\System\yzaQraX.exe
  C:\Windows\System\yzaQraX.exe
  2⤵
  PID:6484
- C:\Windows\System\EmllQuY.exe
  C:\Windows\System\EmllQuY.exe
  2⤵
  PID:6504
- C:\Windows\System\MxnoGoW.exe
  C:\Windows\System\MxnoGoW.exe
  2⤵
  PID:6524
- C:\Windows\System\smZsrYB.exe
  C:\Windows\System\smZsrYB.exe
  2⤵
  PID:6552
- C:\Windows\System\kObanDz.exe
  C:\Windows\System\kObanDz.exe
  2⤵
  PID:6568
- C:\Windows\System\AfriRjg.exe
  C:\Windows\System\AfriRjg.exe
  2⤵
  PID:6588
- C:\Windows\System\yXsmTWU.exe
  C:\Windows\System\yXsmTWU.exe
  2⤵
  PID:6612
- C:\Windows\System\BZMbPsZ.exe
  C:\Windows\System\BZMbPsZ.exe
  2⤵
  PID:6636
- C:\Windows\System\cJySkhh.exe
  C:\Windows\System\cJySkhh.exe
  2⤵
  PID:6656
- C:\Windows\System\iaUdqCN.exe
  C:\Windows\System\iaUdqCN.exe
  2⤵
  PID:6676
- C:\Windows\System\XTEktcU.exe
  C:\Windows\System\XTEktcU.exe
  2⤵
  PID:6696
- C:\Windows\System\LqBkwho.exe
  C:\Windows\System\LqBkwho.exe
  2⤵
  PID:6720
- C:\Windows\System\wpAHWdR.exe
  C:\Windows\System\wpAHWdR.exe
  2⤵
  PID:6736
- C:\Windows\System\bWnAbnr.exe
  C:\Windows\System\bWnAbnr.exe
  2⤵
  PID:6760
- C:\Windows\System\NWFHDqN.exe
  C:\Windows\System\NWFHDqN.exe
  2⤵
  PID:6836
- C:\Windows\System\FKNGbmG.exe
  C:\Windows\System\FKNGbmG.exe
  2⤵
  PID:6856
- C:\Windows\System\HuIOoaF.exe
  C:\Windows\System\HuIOoaF.exe
  2⤵
  PID:6884
- C:\Windows\System\xkknCnk.exe
  C:\Windows\System\xkknCnk.exe
  2⤵
  PID:6900
- C:\Windows\System\XbDqWMc.exe
  C:\Windows\System\XbDqWMc.exe
  2⤵
  PID:6920
- C:\Windows\System\mApszBl.exe
  C:\Windows\System\mApszBl.exe
  2⤵
  PID:6948
- C:\Windows\System\KbBWamO.exe
  C:\Windows\System\KbBWamO.exe
  2⤵
  PID:6964
- C:\Windows\System\XUcRmWH.exe
  C:\Windows\System\XUcRmWH.exe
  2⤵
  PID:6992
- C:\Windows\System\rpCSqBl.exe
  C:\Windows\System\rpCSqBl.exe
  2⤵
  PID:7012
- C:\Windows\System\eMrEJTw.exe
  C:\Windows\System\eMrEJTw.exe
  2⤵
  PID:7036
- C:\Windows\System\obaPytL.exe
  C:\Windows\System\obaPytL.exe
  2⤵
  PID:7052
- C:\Windows\System\IMbkHua.exe
  C:\Windows\System\IMbkHua.exe
  2⤵
  PID:7076
- C:\Windows\System\BFVRuzC.exe
  C:\Windows\System\BFVRuzC.exe
  2⤵
  PID:7096
- C:\Windows\System\BWihXfr.exe
  C:\Windows\System\BWihXfr.exe
  2⤵
  PID:7120
- C:\Windows\System\CcnEUHW.exe
  C:\Windows\System\CcnEUHW.exe
  2⤵
  PID:7140
- C:\Windows\System\yyuEkYa.exe
  C:\Windows\System\yyuEkYa.exe
  2⤵
  PID:7164
- C:\Windows\System\oJMvJFZ.exe
  C:\Windows\System\oJMvJFZ.exe
  2⤵
  PID:6092
- C:\Windows\System\qEYsxAw.exe
  C:\Windows\System\qEYsxAw.exe
  2⤵
  PID:5444
- C:\Windows\System\kZKvHiL.exe
  C:\Windows\System\kZKvHiL.exe
  2⤵
  PID:1252
- C:\Windows\System\WiQPSYf.exe
  C:\Windows\System\WiQPSYf.exe
  2⤵
  PID:5560
- C:\Windows\System\GNuxnKN.exe
  C:\Windows\System\GNuxnKN.exe
  2⤵
  PID:3544
- C:\Windows\System\GIgemaZ.exe
  C:\Windows\System\GIgemaZ.exe
  2⤵
  PID:5620
- C:\Windows\System\HiEzand.exe
  C:\Windows\System\HiEzand.exe
  2⤵
  PID:5680
- C:\Windows\System\kvqdeBs.exe
  C:\Windows\System\kvqdeBs.exe
  2⤵
  PID:5980
- C:\Windows\System\YFkTZjj.exe
  C:\Windows\System\YFkTZjj.exe
  2⤵
  PID:6056
- C:\Windows\System\tpGFxed.exe
  C:\Windows\System\tpGFxed.exe
  2⤵
  PID:2612
- C:\Windows\System\oUcIEPN.exe
  C:\Windows\System\oUcIEPN.exe
  2⤵
  PID:5780
- C:\Windows\System\HlZUOuZ.exe
  C:\Windows\System\HlZUOuZ.exe
  2⤵
  PID:1116
- C:\Windows\System\EmoJswT.exe
  C:\Windows\System\EmoJswT.exe
  2⤵
  PID:5140
- C:\Windows\System\afhKAvY.exe
  C:\Windows\System\afhKAvY.exe
  2⤵
  PID:5212
- C:\Windows\System\kSDXFlN.exe
  C:\Windows\System\kSDXFlN.exe
  2⤵
  PID:6420
- C:\Windows\System\IIPWEJG.exe
  C:\Windows\System\IIPWEJG.exe
  2⤵
  PID:5828
- C:\Windows\System\iZXDgzq.exe
  C:\Windows\System\iZXDgzq.exe
  2⤵
  PID:6496
- C:\Windows\System\uFARAOB.exe
  C:\Windows\System\uFARAOB.exe
  2⤵
  PID:5888
- C:\Windows\System\vUjrlgw.exe
  C:\Windows\System\vUjrlgw.exe
  2⤵
  PID:6608
- C:\Windows\System\CvRIhpp.exe
  C:\Windows\System\CvRIhpp.exe
  2⤵
  PID:5924
- C:\Windows\System\OUPRCgN.exe
  C:\Windows\System\OUPRCgN.exe
  2⤵
  PID:6148
- C:\Windows\System\kAwzPnh.exe
  C:\Windows\System\kAwzPnh.exe
  2⤵
  PID:2956
- C:\Windows\System\tSiIkVM.exe
  C:\Windows\System\tSiIkVM.exe
  2⤵
  PID:6744
- C:\Windows\System\NGgNOwV.exe
  C:\Windows\System\NGgNOwV.exe
  2⤵
  PID:1572
- C:\Windows\System\GISVYFr.exe
  C:\Windows\System\GISVYFr.exe
  2⤵
  PID:3988
- C:\Windows\System\zLntKOn.exe
  C:\Windows\System\zLntKOn.exe
  2⤵
  PID:2184
- C:\Windows\System\gSwPQhM.exe
  C:\Windows\System\gSwPQhM.exe
  2⤵
  PID:5660
- C:\Windows\System\JFdNMmh.exe
  C:\Windows\System\JFdNMmh.exe
  2⤵
  PID:3844
- C:\Windows\System\fTwriwn.exe
  C:\Windows\System\fTwriwn.exe
  2⤵
  PID:7176
- C:\Windows\System\WnpNVvK.exe
  C:\Windows\System\WnpNVvK.exe
  2⤵
  PID:7200
- C:\Windows\System\OAYgafV.exe
  C:\Windows\System\OAYgafV.exe
  2⤵
  PID:7224
- C:\Windows\System\pnVbnml.exe
  C:\Windows\System\pnVbnml.exe
  2⤵
  PID:7388
- C:\Windows\System\pyQCPiU.exe
  C:\Windows\System\pyQCPiU.exe
  2⤵
  PID:7404
- C:\Windows\System\gLFVjgA.exe
  C:\Windows\System\gLFVjgA.exe
  2⤵
  PID:7420
- C:\Windows\System\hbgusFE.exe
  C:\Windows\System\hbgusFE.exe
  2⤵
  PID:7436
- C:\Windows\System\XhAqyQn.exe
  C:\Windows\System\XhAqyQn.exe
  2⤵
  PID:7452
- C:\Windows\System\gAlQTRx.exe
  C:\Windows\System\gAlQTRx.exe
  2⤵
  PID:7468
- C:\Windows\System\xSVdPkc.exe
  C:\Windows\System\xSVdPkc.exe
  2⤵
  PID:7484
- C:\Windows\System\nVrWWca.exe
  C:\Windows\System\nVrWWca.exe
  2⤵
  PID:7500
- C:\Windows\System\gsBiZQk.exe
  C:\Windows\System\gsBiZQk.exe
  2⤵
  PID:7516
- C:\Windows\System\QigtDiu.exe
  C:\Windows\System\QigtDiu.exe
  2⤵
  PID:7532
- C:\Windows\System\wrcZLgG.exe
  C:\Windows\System\wrcZLgG.exe
  2⤵
  PID:7548
- C:\Windows\System\fFqhvfl.exe
  C:\Windows\System\fFqhvfl.exe
  2⤵
  PID:7564
- C:\Windows\System\AFWkBGD.exe
  C:\Windows\System\AFWkBGD.exe
  2⤵
  PID:7600
- C:\Windows\System\UQqdxzH.exe
  C:\Windows\System\UQqdxzH.exe
  2⤵
  PID:7760
- C:\Windows\System\kvfDxYJ.exe
  C:\Windows\System\kvfDxYJ.exe
  2⤵
  PID:7784
- C:\Windows\System\khadlIy.exe
  C:\Windows\System\khadlIy.exe
  2⤵
  PID:7800
- C:\Windows\System\roTnRIS.exe
  C:\Windows\System\roTnRIS.exe
  2⤵
  PID:7816
- C:\Windows\System\DSZNZIk.exe
  C:\Windows\System\DSZNZIk.exe
  2⤵
  PID:7832
- C:\Windows\System\YRAMMxQ.exe
  C:\Windows\System\YRAMMxQ.exe
  2⤵
  PID:7848
- C:\Windows\System\BAeSprr.exe
  C:\Windows\System\BAeSprr.exe
  2⤵
  PID:7864
- C:\Windows\System\gQHIYZF.exe
  C:\Windows\System\gQHIYZF.exe
  2⤵
  PID:7880
- C:\Windows\System\beSuwTd.exe
  C:\Windows\System\beSuwTd.exe
  2⤵
  PID:7924
- C:\Windows\System\ovmcUjW.exe
  C:\Windows\System\ovmcUjW.exe
  2⤵
  PID:7948
- C:\Windows\System\kcGfOaT.exe
  C:\Windows\System\kcGfOaT.exe
  2⤵
  PID:7972
- C:\Windows\System\KvBMblI.exe
  C:\Windows\System\KvBMblI.exe
  2⤵
  PID:8004
- C:\Windows\System\OpbyGtI.exe
  C:\Windows\System\OpbyGtI.exe
  2⤵
  PID:8028
- C:\Windows\System\dWvihGm.exe
  C:\Windows\System\dWvihGm.exe
  2⤵
  PID:8048
- C:\Windows\System\VlJXwPA.exe
  C:\Windows\System\VlJXwPA.exe
  2⤵
  PID:8072
- C:\Windows\System\TlONPzf.exe
  C:\Windows\System\TlONPzf.exe
  2⤵
  PID:8096
- C:\Windows\System\jayfcGQ.exe
  C:\Windows\System\jayfcGQ.exe
  2⤵
  PID:8120
- C:\Windows\System\RGcjBLp.exe
  C:\Windows\System\RGcjBLp.exe
  2⤵
  PID:8140
- C:\Windows\System\cwBvyQf.exe
  C:\Windows\System\cwBvyQf.exe
  2⤵
  PID:8172
- C:\Windows\System\VcjSvTn.exe
  C:\Windows\System\VcjSvTn.exe
  2⤵
  PID:6456
- C:\Windows\System\HbLcYIm.exe
  C:\Windows\System\HbLcYIm.exe
  2⤵
  PID:3912
- C:\Windows\System\jnrVdde.exe
  C:\Windows\System\jnrVdde.exe
  2⤵
  PID:6196
- C:\Windows\System\jILUmuo.exe
  C:\Windows\System\jILUmuo.exe
  2⤵
  PID:6316
- C:\Windows\System\HojkSvz.exe
  C:\Windows\System\HojkSvz.exe
  2⤵
  PID:6364
- C:\Windows\System\JCRirtC.exe
  C:\Windows\System\JCRirtC.exe
  2⤵
  PID:6972
- C:\Windows\System\SYpYOAu.exe
  C:\Windows\System\SYpYOAu.exe
  2⤵
  PID:5732
- C:\Windows\System\jdMvkxZ.exe
  C:\Windows\System\jdMvkxZ.exe
  2⤵
  PID:6828
- C:\Windows\System\BGmRYrx.exe
  C:\Windows\System\BGmRYrx.exe
  2⤵
  PID:5276
- C:\Windows\System\cYYjvAG.exe
  C:\Windows\System\cYYjvAG.exe
  2⤵
  PID:2884
- C:\Windows\System\PqfGCtR.exe
  C:\Windows\System\PqfGCtR.exe
  2⤵
  PID:6864
- C:\Windows\System\NZBYWzX.exe
  C:\Windows\System\NZBYWzX.exe
  2⤵
  PID:6912
- C:\Windows\System\IukptVH.exe
  C:\Windows\System\IukptVH.exe
  2⤵
  PID:6984
- C:\Windows\System\NeNKaUB.exe
  C:\Windows\System\NeNKaUB.exe
  2⤵
  PID:7044
- C:\Windows\System\HHiozLV.exe
  C:\Windows\System\HHiozLV.exe
  2⤵
  PID:7084
- C:\Windows\System\gUmIsPl.exe
  C:\Windows\System\gUmIsPl.exe
  2⤵
  PID:7132
- C:\Windows\System\hfjzqML.exe
  C:\Windows\System\hfjzqML.exe
  2⤵
  PID:5412
- C:\Windows\System\AoJIqFX.exe
  C:\Windows\System\AoJIqFX.exe
  2⤵
  PID:5556
- C:\Windows\System\KRIfoOA.exe
  C:\Windows\System\KRIfoOA.exe
  2⤵
  PID:5232
- C:\Windows\System\pKdTHNr.exe
  C:\Windows\System\pKdTHNr.exe
  2⤵
  PID:6004
- C:\Windows\System\LbQOtkn.exe
  C:\Windows\System\LbQOtkn.exe
  2⤵
  PID:5740
- C:\Windows\System\QRojfBA.exe
  C:\Windows\System\QRojfBA.exe
  2⤵
  PID:2652
- C:\Windows\System\QYWFIzc.exe
  C:\Windows\System\QYWFIzc.exe
  2⤵
  PID:6436
- C:\Windows\System\RaqRWii.exe
  C:\Windows\System\RaqRWii.exe
  2⤵
  PID:5872
- C:\Windows\System\kUUDQzW.exe
  C:\Windows\System\kUUDQzW.exe
  2⤵
  PID:6664
- C:\Windows\System\SkmSCJX.exe
  C:\Windows\System\SkmSCJX.exe
  2⤵
  PID:6732
- C:\Windows\System\YQRqtMw.exe
  C:\Windows\System\YQRqtMw.exe
  2⤵
  PID:4740
- C:\Windows\System\PBhweMa.exe
  C:\Windows\System\PBhweMa.exe
  2⤵
  PID:7172
- C:\Windows\System\rkTUQRd.exe
  C:\Windows\System\rkTUQRd.exe
  2⤵
  PID:4344
- C:\Windows\System\RIfhZvB.exe
  C:\Windows\System\RIfhZvB.exe
  2⤵
  PID:8204
- C:\Windows\System\nSaibfT.exe
  C:\Windows\System\nSaibfT.exe
  2⤵
  PID:8224
- C:\Windows\System\YOkRYHh.exe
  C:\Windows\System\YOkRYHh.exe
  2⤵
  PID:8240
- C:\Windows\System\nCHvhPU.exe
  C:\Windows\System\nCHvhPU.exe
  2⤵
  PID:8376
- C:\Windows\System\zjYBbEH.exe
  C:\Windows\System\zjYBbEH.exe
  2⤵
  PID:8396
- C:\Windows\System\qdzLdqe.exe
  C:\Windows\System\qdzLdqe.exe
  2⤵
  PID:8412
- C:\Windows\System\IRrektu.exe
  C:\Windows\System\IRrektu.exe
  2⤵
  PID:8432
- C:\Windows\System\ZMWDlBM.exe
  C:\Windows\System\ZMWDlBM.exe
  2⤵
  PID:8452
- C:\Windows\System\pKFzDSA.exe
  C:\Windows\System\pKFzDSA.exe
  2⤵
  PID:8472
- C:\Windows\System\ErTpWQS.exe
  C:\Windows\System\ErTpWQS.exe
  2⤵
  PID:8488
- C:\Windows\System\EYXOqry.exe
  C:\Windows\System\EYXOqry.exe
  2⤵
  PID:8508
- C:\Windows\System\AeEmlyp.exe
  C:\Windows\System\AeEmlyp.exe
  2⤵
  PID:8528
- C:\Windows\System\GNoVbsK.exe
  C:\Windows\System\GNoVbsK.exe
  2⤵
  PID:8548
- C:\Windows\System\aVfscaF.exe
  C:\Windows\System\aVfscaF.exe
  2⤵
  PID:8572
- C:\Windows\System\ewgKdMJ.exe
  C:\Windows\System\ewgKdMJ.exe
  2⤵
  PID:8596
- C:\Windows\System\ockwxsU.exe
  C:\Windows\System\ockwxsU.exe
  2⤵
  PID:8632
- C:\Windows\System\FcmSznt.exe
  C:\Windows\System\FcmSznt.exe
  2⤵
  PID:8660
- C:\Windows\System\ePCpuba.exe
  C:\Windows\System\ePCpuba.exe
  2⤵
  PID:8688
- C:\Windows\System\DNXEAhp.exe
  C:\Windows\System\DNXEAhp.exe
  2⤵
  PID:8716
- C:\Windows\System\nFwRyNl.exe
  C:\Windows\System\nFwRyNl.exe
  2⤵
  PID:8740
- C:\Windows\System\cjdtvRQ.exe
  C:\Windows\System\cjdtvRQ.exe
  2⤵
  PID:8780
- C:\Windows\System\GhravqY.exe
  C:\Windows\System\GhravqY.exe
  2⤵
  PID:8808
- C:\Windows\System\vxGhkMG.exe
  C:\Windows\System\vxGhkMG.exe
  2⤵
  PID:8840
- C:\Windows\System\OEvnfBf.exe
  C:\Windows\System\OEvnfBf.exe
  2⤵
  PID:8860
- C:\Windows\System\jvkFEim.exe
  C:\Windows\System\jvkFEim.exe
  2⤵
  PID:8896
- C:\Windows\System\DcpIDhq.exe
  C:\Windows\System\DcpIDhq.exe
  2⤵
  PID:8912
- C:\Windows\System\BMrYONB.exe
  C:\Windows\System\BMrYONB.exe
  2⤵
  PID:8932
- C:\Windows\System\ecpneAK.exe
  C:\Windows\System\ecpneAK.exe
  2⤵
  PID:8956
- C:\Windows\System\XNsofmt.exe
  C:\Windows\System\XNsofmt.exe
  2⤵
  PID:8976
- C:\Windows\System\xdiJsTB.exe
  C:\Windows\System\xdiJsTB.exe
  2⤵
  PID:9000
- C:\Windows\System\eBzylhI.exe
  C:\Windows\System\eBzylhI.exe
  2⤵
  PID:9028
- C:\Windows\System\AuebkRu.exe
  C:\Windows\System\AuebkRu.exe
  2⤵
  PID:9048
- C:\Windows\System\RaEtQYp.exe
  C:\Windows\System\RaEtQYp.exe
  2⤵
  PID:9068
- C:\Windows\System\SUYcVvu.exe
  C:\Windows\System\SUYcVvu.exe
  2⤵
  PID:9088
- C:\Windows\System\doySxEC.exe
  C:\Windows\System\doySxEC.exe
  2⤵
  PID:9108
- C:\Windows\System\GwlYBGT.exe
  C:\Windows\System\GwlYBGT.exe
  2⤵
  PID:9136
- C:\Windows\System\pqMaTVs.exe
  C:\Windows\System\pqMaTVs.exe
  2⤵
  PID:9152
- C:\Windows\System\aapXavx.exe
  C:\Windows\System\aapXavx.exe
  2⤵
  PID:9172
- C:\Windows\System\ixlsvON.exe
  C:\Windows\System\ixlsvON.exe
  2⤵
  PID:9192
- C:\Windows\System\erVeHhx.exe
  C:\Windows\System\erVeHhx.exe
  2⤵
  PID:7812
- C:\Windows\System\QhmzmYT.exe
  C:\Windows\System\QhmzmYT.exe
  2⤵
  PID:7896
- C:\Windows\System\CPbaMqK.exe
  C:\Windows\System\CPbaMqK.exe
  2⤵
  PID:7984
- C:\Windows\System\qVfoSta.exe
  C:\Windows\System\qVfoSta.exe
  2⤵
  PID:8108
- C:\Windows\System\yAgQVJJ.exe
  C:\Windows\System\yAgQVJJ.exe
  2⤵
  PID:6344
- C:\Windows\System\afvsinS.exe
  C:\Windows\System\afvsinS.exe
  2⤵
  PID:7212
- C:\Windows\System\BywEzLj.exe
  C:\Windows\System\BywEzLj.exe
  2⤵
  PID:5964
- C:\Windows\System\SZgWMHN.exe
  C:\Windows\System\SZgWMHN.exe
  2⤵
  PID:6032
- C:\Windows\System\kHMbhyu.exe
  C:\Windows\System\kHMbhyu.exe
  2⤵
  PID:2228
- C:\Windows\System\SYbKqIP.exe
  C:\Windows\System\SYbKqIP.exe
  2⤵
  PID:3084
- C:\Windows\System\pikCNaB.exe
  C:\Windows\System\pikCNaB.exe
  2⤵
  PID:7932
- C:\Windows\System\tWJmQzW.exe
  C:\Windows\System\tWJmQzW.exe
  2⤵
  PID:8064
- C:\Windows\System\cdpSqcE.exe
  C:\Windows\System\cdpSqcE.exe
  2⤵
  PID:8700
- C:\Windows\System\cOyjAgG.exe
  C:\Windows\System\cOyjAgG.exe
  2⤵
  PID:6348
- C:\Windows\System\xdXaBgQ.exe
  C:\Windows\System\xdXaBgQ.exe
  2⤵
  PID:6576
- C:\Windows\System\ktblojx.exe
  C:\Windows\System\ktblojx.exe
  2⤵
  PID:8852
- C:\Windows\System\hDbZOlG.exe
  C:\Windows\System\hDbZOlG.exe
  2⤵
  PID:8928
- C:\Windows\System\PDCnSOu.exe
  C:\Windows\System\PDCnSOu.exe
  2⤵
  PID:9236
- C:\Windows\System\hXBqGvq.exe
  C:\Windows\System\hXBqGvq.exe
  2⤵
  PID:9264
- C:\Windows\System\YqrMlSh.exe
  C:\Windows\System\YqrMlSh.exe
  2⤵
  PID:9284
- C:\Windows\System\EwaZpaI.exe
  C:\Windows\System\EwaZpaI.exe
  2⤵
  PID:9300
- C:\Windows\System\UdjQdYp.exe
  C:\Windows\System\UdjQdYp.exe
  2⤵
  PID:9320
- C:\Windows\System\ccxgGQu.exe
  C:\Windows\System\ccxgGQu.exe
  2⤵
  PID:9344
- C:\Windows\System\mGPhZAQ.exe
  C:\Windows\System\mGPhZAQ.exe
  2⤵
  PID:9360
- C:\Windows\System\XrkBdbC.exe
  C:\Windows\System\XrkBdbC.exe
  2⤵
  PID:9380
- C:\Windows\System\ovInmme.exe
  C:\Windows\System\ovInmme.exe
  2⤵
  PID:9400
- C:\Windows\System\UgdDpLV.exe
  C:\Windows\System\UgdDpLV.exe
  2⤵
  PID:9424
- C:\Windows\System\EwnLTOv.exe
  C:\Windows\System\EwnLTOv.exe
  2⤵
  PID:9452
- C:\Windows\System\tPuuTge.exe
  C:\Windows\System\tPuuTge.exe
  2⤵
  PID:9468
- C:\Windows\System\wbouCEN.exe
  C:\Windows\System\wbouCEN.exe
  2⤵
  PID:9488
- C:\Windows\System\SoVFAVC.exe
  C:\Windows\System\SoVFAVC.exe
  2⤵
  PID:9512
- C:\Windows\System\AlMWfaD.exe
  C:\Windows\System\AlMWfaD.exe
  2⤵
  PID:9532
- C:\Windows\System\megVkzD.exe
  C:\Windows\System\megVkzD.exe
  2⤵
  PID:9552
- C:\Windows\System\uWvKBja.exe
  C:\Windows\System\uWvKBja.exe
  2⤵
  PID:9580
- C:\Windows\System\PvWYwAU.exe
  C:\Windows\System\PvWYwAU.exe
  2⤵
  PID:9596
- C:\Windows\System\YHygHIB.exe
  C:\Windows\System\YHygHIB.exe
  2⤵
  PID:9616
- C:\Windows\System\aTUlHEx.exe
  C:\Windows\System\aTUlHEx.exe
  2⤵
  PID:9640
- C:\Windows\System\yFXzoMb.exe
  C:\Windows\System\yFXzoMb.exe
  2⤵
  PID:9664
- C:\Windows\System\PwettXO.exe
  C:\Windows\System\PwettXO.exe
  2⤵
  PID:9688
- C:\Windows\System\JAwmimx.exe
  C:\Windows\System\JAwmimx.exe
  2⤵
  PID:9708
- C:\Windows\System\DntApca.exe
  C:\Windows\System\DntApca.exe
  2⤵
  PID:9728
- C:\Windows\System\ftfGgjD.exe
  C:\Windows\System\ftfGgjD.exe
  2⤵
  PID:9752
- C:\Windows\System\wZTWJva.exe
  C:\Windows\System\wZTWJva.exe
  2⤵
  PID:9792
- C:\Windows\System\QxUdIYV.exe
  C:\Windows\System\QxUdIYV.exe
  2⤵
  PID:9820
- C:\Windows\System\jMKSSXv.exe
  C:\Windows\System\jMKSSXv.exe
  2⤵
  PID:9840
- C:\Windows\System\EfFGKHJ.exe
  C:\Windows\System\EfFGKHJ.exe
  2⤵
  PID:9864
- C:\Windows\System\KtOGqBF.exe
  C:\Windows\System\KtOGqBF.exe
  2⤵
  PID:9884
- C:\Windows\System\uvgwmBU.exe
  C:\Windows\System\uvgwmBU.exe
  2⤵
  PID:9904
- C:\Windows\System\CDOunLr.exe
  C:\Windows\System\CDOunLr.exe
  2⤵
  PID:9928
- C:\Windows\System\FnnvPRC.exe
  C:\Windows\System\FnnvPRC.exe
  2⤵
  PID:9948
- C:\Windows\System\CgmTxPK.exe
  C:\Windows\System\CgmTxPK.exe
  2⤵
  PID:9968
- C:\Windows\System\FIPDnuZ.exe
  C:\Windows\System\FIPDnuZ.exe
  2⤵
  PID:9988
- C:\Windows\System\mDGQwLn.exe
  C:\Windows\System\mDGQwLn.exe
  2⤵
  PID:10012
- C:\Windows\System\zOsLMao.exe
  C:\Windows\System\zOsLMao.exe
  2⤵
  PID:10032
- C:\Windows\System\IbweRSC.exe
  C:\Windows\System\IbweRSC.exe
  2⤵
  PID:10056
- C:\Windows\System\fTeoYLk.exe
  C:\Windows\System\fTeoYLk.exe
  2⤵
  PID:10076
- C:\Windows\System\ITBqVaG.exe
  C:\Windows\System\ITBqVaG.exe
  2⤵
  PID:10096
- C:\Windows\System\gwreHfa.exe
  C:\Windows\System\gwreHfa.exe
  2⤵
  PID:10120
- C:\Windows\System\DtZMzAT.exe
  C:\Windows\System\DtZMzAT.exe
  2⤵
  PID:10136
- C:\Windows\System\ZYbvoRX.exe
  C:\Windows\System\ZYbvoRX.exe
  2⤵
  PID:10160
- C:\Windows\System\OGtoSqU.exe
  C:\Windows\System\OGtoSqU.exe
  2⤵
  PID:10180
- C:\Windows\System\JwONUpw.exe
  C:\Windows\System\JwONUpw.exe
  2⤵
  PID:10196
- C:\Windows\System\AljarUJ.exe
  C:\Windows\System\AljarUJ.exe
  2⤵
  PID:10212
- C:\Windows\System\yUVEjjC.exe
  C:\Windows\System\yUVEjjC.exe
  2⤵
  PID:10228
- C:\Windows\System\wOXFEwF.exe
  C:\Windows\System\wOXFEwF.exe
  2⤵
  PID:7072
- C:\Windows\System\fSlvfjj.exe
  C:\Windows\System\fSlvfjj.exe
  2⤵
  PID:3036
- C:\Windows\System\gMTaJom.exe
  C:\Windows\System\gMTaJom.exe
  2⤵
  PID:4248
- C:\Windows\System\fMbSpbd.exe
  C:\Windows\System\fMbSpbd.exe
  2⤵
  PID:8252
- C:\Windows\System\DsgXksR.exe
  C:\Windows\System\DsgXksR.exe
  2⤵
  PID:7396
- C:\Windows\System\UTqmKYw.exe
  C:\Windows\System\UTqmKYw.exe
  2⤵
  PID:7432
- C:\Windows\System\BTcLEja.exe
  C:\Windows\System\BTcLEja.exe
  2⤵
  PID:7476
- C:\Windows\System\UvpgXTb.exe
  C:\Windows\System\UvpgXTb.exe
  2⤵
  PID:7524
- C:\Windows\System\SsbrFVD.exe
  C:\Windows\System\SsbrFVD.exe
  2⤵
  PID:7560
- C:\Windows\System\VVvGQYp.exe
  C:\Windows\System\VVvGQYp.exe
  2⤵
  PID:7708
- C:\Windows\System\LbYqJGd.exe
  C:\Windows\System\LbYqJGd.exe
  2⤵
  PID:7732
- C:\Windows\System\mxERgFN.exe
  C:\Windows\System\mxERgFN.exe
  2⤵
  PID:7748
- C:\Windows\System\bdsAtLg.exe
  C:\Windows\System\bdsAtLg.exe
  2⤵
  PID:8500
- C:\Windows\System\ftYCEqa.exe
  C:\Windows\System\ftYCEqa.exe
  2⤵
  PID:8588
- C:\Windows\System\ydCWyEa.exe
  C:\Windows\System\ydCWyEa.exe
  2⤵
  PID:8020
- C:\Windows\System\TXkfXQn.exe
  C:\Windows\System\TXkfXQn.exe
  2⤵
  PID:6868
- C:\Windows\System\TyqGwtO.exe
  C:\Windows\System\TyqGwtO.exe
  2⤵
  PID:8184
- C:\Windows\System\XvWLJfg.exe
  C:\Windows\System\XvWLJfg.exe
  2⤵
  PID:6652
- C:\Windows\System\SPjWQgI.exe
  C:\Windows\System\SPjWQgI.exe
  2⤵
  PID:8760
- C:\Windows\System\xjbzscB.exe
  C:\Windows\System\xjbzscB.exe
  2⤵
  PID:7980
- C:\Windows\System\dOKvIFF.exe
  C:\Windows\System\dOKvIFF.exe
  2⤵
  PID:7060
- C:\Windows\System\NZnPplY.exe
  C:\Windows\System\NZnPplY.exe
  2⤵
  PID:6940
- C:\Windows\System\fRaDeuq.exe
  C:\Windows\System\fRaDeuq.exe
  2⤵
  PID:7032
- C:\Windows\System\Sdnswwm.exe
  C:\Windows\System\Sdnswwm.exe
  2⤵
  PID:7104
- C:\Windows\System\qzpXDam.exe
  C:\Windows\System\qzpXDam.exe
  2⤵
  PID:5148
- C:\Windows\System\bwCHqRf.exe
  C:\Windows\System\bwCHqRf.exe
  2⤵
  PID:9080
- C:\Windows\System\hHVWhAq.exe
  C:\Windows\System\hHVWhAq.exe
  2⤵
  PID:6492
- C:\Windows\System\PjiKHOu.exe
  C:\Windows\System\PjiKHOu.exe
  2⤵
  PID:8200
- C:\Windows\System\ASbEeus.exe
  C:\Windows\System\ASbEeus.exe
  2⤵
  PID:10248
- C:\Windows\System\jMHUvmL.exe
  C:\Windows\System\jMHUvmL.exe
  2⤵
  PID:10280
- C:\Windows\System\anXdznT.exe
  C:\Windows\System\anXdznT.exe
  2⤵
  PID:10308
- C:\Windows\System\APXZAWw.exe
  C:\Windows\System\APXZAWw.exe
  2⤵
  PID:10324
- C:\Windows\System\RlKNMQX.exe
  C:\Windows\System\RlKNMQX.exe
  2⤵
  PID:10344
- C:\Windows\System\wkibNII.exe
  C:\Windows\System\wkibNII.exe
  2⤵
  PID:10380
- C:\Windows\System\KVnmswa.exe
  C:\Windows\System\KVnmswa.exe
  2⤵
  PID:10408
- C:\Windows\System\PDdGZjB.exe
  C:\Windows\System\PDdGZjB.exe
  2⤵
  PID:10432
- C:\Windows\System\fmaqkzN.exe
  C:\Windows\System\fmaqkzN.exe
  2⤵
  PID:10452
- C:\Windows\System\UkCZSqO.exe
  C:\Windows\System\UkCZSqO.exe
  2⤵
  PID:10468
- C:\Windows\System\OfwuTSo.exe
  C:\Windows\System\OfwuTSo.exe
  2⤵
  PID:10500
- C:\Windows\System\KPZRBQN.exe
  C:\Windows\System\KPZRBQN.exe
  2⤵
  PID:10524
- C:\Windows\System\VOuuyeN.exe
  C:\Windows\System\VOuuyeN.exe
  2⤵
  PID:10548
- C:\Windows\System\KJVSYDh.exe
  C:\Windows\System\KJVSYDh.exe
  2⤵
  PID:10564
- C:\Windows\System\TtqijGu.exe
  C:\Windows\System\TtqijGu.exe
  2⤵
  PID:10592
- C:\Windows\System\XpxyJJj.exe
  C:\Windows\System\XpxyJJj.exe
  2⤵
  PID:10616
- C:\Windows\System\dcmGowl.exe
  C:\Windows\System\dcmGowl.exe
  2⤵
  PID:10636
- C:\Windows\System\eYUQeko.exe
  C:\Windows\System\eYUQeko.exe
  2⤵
  PID:10656
- C:\Windows\System\FRNHqWo.exe
  C:\Windows\System\FRNHqWo.exe
  2⤵
  PID:10708
- C:\Windows\System\ygvBLqN.exe
  C:\Windows\System\ygvBLqN.exe
  2⤵
  PID:10724
- C:\Windows\System\tnwrLjU.exe
  C:\Windows\System\tnwrLjU.exe
  2⤵
  PID:10744
- C:\Windows\System\nFYcEEe.exe
  C:\Windows\System\nFYcEEe.exe
  2⤵
  PID:10768
- C:\Windows\System\hFMFqZa.exe
  C:\Windows\System\hFMFqZa.exe
  2⤵
  PID:10784
- C:\Windows\System\DlLfwEK.exe
  C:\Windows\System\DlLfwEK.exe
  2⤵
  PID:10808
- C:\Windows\System\shwpQqc.exe
  C:\Windows\System\shwpQqc.exe
  2⤵
  PID:10828
- C:\Windows\System\lCwaGMQ.exe
  C:\Windows\System\lCwaGMQ.exe
  2⤵
  PID:10852
- C:\Windows\System\CKOoiXd.exe
  C:\Windows\System\CKOoiXd.exe
  2⤵
  PID:10876
- C:\Windows\System\KTHBKxf.exe
  C:\Windows\System\KTHBKxf.exe
  2⤵
  PID:10896
- C:\Windows\System\aNQWLFQ.exe
  C:\Windows\System\aNQWLFQ.exe
  2⤵
  PID:10924
- C:\Windows\System\kccWIOb.exe
  C:\Windows\System\kccWIOb.exe
  2⤵
  PID:10944
- C:\Windows\System\xLoflos.exe
  C:\Windows\System\xLoflos.exe
  2⤵
  PID:10964
- C:\Windows\System\bcPtUpB.exe
  C:\Windows\System\bcPtUpB.exe
  2⤵
  PID:10984
- C:\Windows\System\kWrIlhc.exe
  C:\Windows\System\kWrIlhc.exe
  2⤵
  PID:11008
- C:\Windows\System\UDbdUue.exe
  C:\Windows\System\UDbdUue.exe
  2⤵
  PID:11032
- C:\Windows\System\QkQWtDP.exe
  C:\Windows\System\QkQWtDP.exe
  2⤵
  PID:11052
- C:\Windows\System\PmPWdDf.exe
  C:\Windows\System\PmPWdDf.exe
  2⤵
  PID:11080
- C:\Windows\System\BZYVfSe.exe
  C:\Windows\System\BZYVfSe.exe
  2⤵
  PID:11104
- C:\Windows\System\HFpyHyD.exe
  C:\Windows\System\HFpyHyD.exe
  2⤵
  PID:11120
- C:\Windows\System\CjZOQDl.exe
  C:\Windows\System\CjZOQDl.exe
  2⤵
  PID:11148
- C:\Windows\System\XUxxJLy.exe
  C:\Windows\System\XUxxJLy.exe
  2⤵
  PID:11164
- C:\Windows\System\uNhgaqp.exe
  C:\Windows\System\uNhgaqp.exe
  2⤵
  PID:11180
- C:\Windows\System\MqpZSLg.exe
  C:\Windows\System\MqpZSLg.exe
  2⤵
  PID:11196
- C:\Windows\System\fcQLekw.exe
  C:\Windows\System\fcQLekw.exe
  2⤵
  PID:11212
- C:\Windows\System\uirJKPA.exe
  C:\Windows\System\uirJKPA.exe
  2⤵
  PID:11244
- C:\Windows\System\gKOPqaJ.exe
  C:\Windows\System\gKOPqaJ.exe
  2⤵
  PID:8236
- C:\Windows\System\EUZxVsL.exe
  C:\Windows\System\EUZxVsL.exe
  2⤵
  PID:8408
- C:\Windows\System\DmGmkpB.exe
  C:\Windows\System\DmGmkpB.exe
  2⤵
  PID:8460
- C:\Windows\System\lXzpONu.exe
  C:\Windows\System\lXzpONu.exe
  2⤵
  PID:8516
- C:\Windows\System\WzdSzPA.exe
  C:\Windows\System\WzdSzPA.exe
  2⤵
  PID:8540
- C:\Windows\System\xwFXAeQ.exe
  C:\Windows\System\xwFXAeQ.exe
  2⤵
  PID:8560
- C:\Windows\System\uJwcQqy.exe
  C:\Windows\System\uJwcQqy.exe
  2⤵
  PID:7384
- C:\Windows\System\jbOBVZA.exe
  C:\Windows\System\jbOBVZA.exe
  2⤵
  PID:8628
- C:\Windows\System\fOUPqaR.exe
  C:\Windows\System\fOUPqaR.exe
  2⤵
  PID:8656
- C:\Windows\System\bqIaFIa.exe
  C:\Windows\System\bqIaFIa.exe
  2⤵
  PID:6832
- C:\Windows\System\AGaqIUB.exe
  C:\Windows\System\AGaqIUB.exe
  2⤵
  PID:10092
- C:\Windows\System\gLycQjn.exe
  C:\Windows\System\gLycQjn.exe
  2⤵
  PID:5708
- C:\Windows\System\SjgPWlV.exe
  C:\Windows\System\SjgPWlV.exe
  2⤵
  PID:3960
- C:\Windows\System\JGfYxQV.exe
  C:\Windows\System\JGfYxQV.exe
  2⤵
  PID:8904
- C:\Windows\System\MWaUoeb.exe
  C:\Windows\System\MWaUoeb.exe
  2⤵
  PID:9020
- C:\Windows\System\XyBPdUH.exe
  C:\Windows\System\XyBPdUH.exe
  2⤵
  PID:8992
- C:\Windows\System\MOWhBQP.exe
  C:\Windows\System\MOWhBQP.exe
  2⤵
  PID:11276
- C:\Windows\System\DHyjNUn.exe
  C:\Windows\System\DHyjNUn.exe
  2⤵
  PID:11304
- C:\Windows\System\konBvxa.exe
  C:\Windows\System\konBvxa.exe
  2⤵
  PID:11332
- C:\Windows\System\lZgPjVb.exe
  C:\Windows\System\lZgPjVb.exe
  2⤵
  PID:11356
- C:\Windows\System\sTJJtvC.exe
  C:\Windows\System\sTJJtvC.exe
  2⤵
  PID:11376
- C:\Windows\System\ilqekvw.exe
  C:\Windows\System\ilqekvw.exe
  2⤵
  PID:11404
- C:\Windows\System\vqIqIHm.exe
  C:\Windows\System\vqIqIHm.exe
  2⤵
  PID:11420
- C:\Windows\System\dwADLKg.exe
  C:\Windows\System\dwADLKg.exe
  2⤵
  PID:11444
- C:\Windows\System\fVTpxbJ.exe
  C:\Windows\System\fVTpxbJ.exe
  2⤵
  PID:11460
- C:\Windows\System\CcvIpeW.exe
  C:\Windows\System\CcvIpeW.exe
  2⤵
  PID:11480
- C:\Windows\System\GxpPedP.exe
  C:\Windows\System\GxpPedP.exe
  2⤵
  PID:11504
- C:\Windows\System\ofoSbgu.exe
  C:\Windows\System\ofoSbgu.exe
  2⤵
  PID:11524
- C:\Windows\System\GvefPpF.exe
  C:\Windows\System\GvefPpF.exe
  2⤵
  PID:11544
- C:\Windows\System\uAMJFXK.exe
  C:\Windows\System\uAMJFXK.exe
  2⤵
  PID:11568
- C:\Windows\System\sSihKDY.exe
  C:\Windows\System\sSihKDY.exe
  2⤵
  PID:11600
- C:\Windows\System\LAwcHbg.exe
  C:\Windows\System\LAwcHbg.exe
  2⤵
  PID:11624
- C:\Windows\System\amaJfOL.exe
  C:\Windows\System\amaJfOL.exe
  2⤵
  PID:11640
- C:\Windows\System\Vuqszbu.exe
  C:\Windows\System\Vuqszbu.exe
  2⤵
  PID:11660
- C:\Windows\System\avmqrKp.exe
  C:\Windows\System\avmqrKp.exe
  2⤵
  PID:11676
- C:\Windows\System\WqFJixj.exe
  C:\Windows\System\WqFJixj.exe
  2⤵
  PID:11696
- C:\Windows\System\bnUNxav.exe
  C:\Windows\System\bnUNxav.exe
  2⤵
  PID:11716
- C:\Windows\System\HVLLmXB.exe
  C:\Windows\System\HVLLmXB.exe
  2⤵
  PID:11732
- C:\Windows\System\rljpKhI.exe
  C:\Windows\System\rljpKhI.exe
  2⤵
  PID:11752
- C:\Windows\System\yrgmGwT.exe
  C:\Windows\System\yrgmGwT.exe
  2⤵
  PID:11772
- C:\Windows\System\SwqZDik.exe
  C:\Windows\System\SwqZDik.exe
  2⤵
  PID:11816
- C:\Windows\System\poaFkLt.exe
  C:\Windows\System\poaFkLt.exe
  2⤵
  PID:11836
- C:\Windows\System\KpwyNwd.exe
  C:\Windows\System\KpwyNwd.exe
  2⤵
  PID:11884
- C:\Windows\System\wGKgbht.exe
  C:\Windows\System\wGKgbht.exe
  2⤵
  PID:11908
- C:\Windows\System\FsQZTdc.exe
  C:\Windows\System\FsQZTdc.exe
  2⤵
  PID:11924
- C:\Windows\System\OPvDpcG.exe
  C:\Windows\System\OPvDpcG.exe
  2⤵
  PID:11948
- C:\Windows\System\TFczIrZ.exe
  C:\Windows\System\TFczIrZ.exe
  2⤵
  PID:11968
- C:\Windows\System\VahqGHq.exe
  C:\Windows\System\VahqGHq.exe
  2⤵
  PID:11992
- C:\Windows\System\nqycqiY.exe
  C:\Windows\System\nqycqiY.exe
  2⤵
  PID:12012
- C:\Windows\System\IXrxBFb.exe
  C:\Windows\System\IXrxBFb.exe
  2⤵
  PID:12032
- C:\Windows\System\QAdlpZE.exe
  C:\Windows\System\QAdlpZE.exe
  2⤵
  PID:12060
- C:\Windows\System\UhIstnV.exe
  C:\Windows\System\UhIstnV.exe
  2⤵
  PID:12080
- C:\Windows\System\KVCjulv.exe
  C:\Windows\System\KVCjulv.exe
  2⤵
  PID:12100
- C:\Windows\System\dKwzuNd.exe
  C:\Windows\System\dKwzuNd.exe
  2⤵
  PID:12116
- C:\Windows\System\Hvljrbf.exe
  C:\Windows\System\Hvljrbf.exe
  2⤵
  PID:12140
- C:\Windows\System\UBGbKXb.exe
  C:\Windows\System\UBGbKXb.exe
  2⤵
  PID:12156
- C:\Windows\System\ootaqmo.exe
  C:\Windows\System\ootaqmo.exe
  2⤵
  PID:12172
- C:\Windows\System\AGWpKya.exe
  C:\Windows\System\AGWpKya.exe
  2⤵
  PID:12188
- C:\Windows\System\cIMFeVY.exe
  C:\Windows\System\cIMFeVY.exe
  2⤵
  PID:12204
- C:\Windows\System\CYAJdaF.exe
  C:\Windows\System\CYAJdaF.exe
  2⤵
  PID:12220
- C:\Windows\System\sNDZDEM.exe
  C:\Windows\System\sNDZDEM.exe
  2⤵
  PID:12236
- C:\Windows\System\ueQVuJh.exe
  C:\Windows\System\ueQVuJh.exe
  2⤵
  PID:12252
- C:\Windows\System\oBcwhsa.exe
  C:\Windows\System\oBcwhsa.exe
  2⤵
  PID:12268
- C:\Windows\System\ysjavbB.exe
  C:\Windows\System\ysjavbB.exe
  2⤵
  PID:9040
- C:\Windows\System\TvsdEyR.exe
  C:\Windows\System\TvsdEyR.exe
  2⤵
  PID:6936
- C:\Windows\System\bQkThAI.exe
  C:\Windows\System\bQkThAI.exe
  2⤵
  PID:9128
- C:\Windows\System\untVuZI.exe
  C:\Windows\System\untVuZI.exe
  2⤵
  PID:9168
- C:\Windows\System\iVZqrAM.exe
  C:\Windows\System\iVZqrAM.exe
  2⤵
  PID:9604
- C:\Windows\System\CbnbLmL.exe
  C:\Windows\System\CbnbLmL.exe
  2⤵
  PID:9560
- C:\Windows\System\dnREQwU.exe
  C:\Windows\System\dnREQwU.exe
  2⤵
  PID:9636
- C:\Windows\System\VpqOHTD.exe
  C:\Windows\System\VpqOHTD.exe
  2⤵
  PID:9736
- C:\Windows\System\rEiJOjp.exe
  C:\Windows\System\rEiJOjp.exe
  2⤵
  PID:10612
- C:\Windows\System\GHCthSN.exe
  C:\Windows\System\GHCthSN.exe
  2⤵
  PID:9212
- C:\Windows\System\oPbIVGn.exe
  C:\Windows\System\oPbIVGn.exe
  2⤵
  PID:10844
- C:\Windows\System\HeWseFq.exe
  C:\Windows\System\HeWseFq.exe
  2⤵
  PID:10872
- C:\Windows\System\qAitAtP.exe
  C:\Windows\System\qAitAtP.exe
  2⤵
  PID:10940
- C:\Windows\System\kRDeagN.exe
  C:\Windows\System\kRDeagN.exe
  2⤵
  PID:10064
- C:\Windows\System\POiVSog.exe
  C:\Windows\System\POiVSog.exe
  2⤵
  PID:11136
- C:\Windows\System\cPaFuln.exe
  C:\Windows\System\cPaFuln.exe
  2⤵
  PID:5596
- C:\Windows\System\sqsFBhc.exe
  C:\Windows\System\sqsFBhc.exe
  2⤵
  PID:12388
- C:\Windows\System\ERWxAsN.exe
  C:\Windows\System\ERWxAsN.exe
  2⤵
  PID:12408
- C:\Windows\System\UowxXvv.exe
  C:\Windows\System\UowxXvv.exe
  2⤵
  PID:12428
- C:\Windows\System\TUDXhtK.exe
  C:\Windows\System\TUDXhtK.exe
  2⤵
  PID:12452
- C:\Windows\System\NnGgMSy.exe
  C:\Windows\System\NnGgMSy.exe
  2⤵
  PID:12476
- C:\Windows\System\sDRaptI.exe
  C:\Windows\System\sDRaptI.exe
  2⤵
  PID:12496
- C:\Windows\System\fWUKiFu.exe
  C:\Windows\System\fWUKiFu.exe
  2⤵
  PID:12516
- C:\Windows\System\UhBMAhz.exe
  C:\Windows\System\UhBMAhz.exe
  2⤵
  PID:12536
- C:\Windows\System\HuWgSjE.exe
  C:\Windows\System\HuWgSjE.exe
  2⤵
  PID:12560
- C:\Windows\System\PQUrSMM.exe
  C:\Windows\System\PQUrSMM.exe
  2⤵
  PID:12584
- C:\Windows\System\FnuYHbr.exe
  C:\Windows\System\FnuYHbr.exe
  2⤵
  PID:12604
- C:\Windows\System\jHVEEZQ.exe
  C:\Windows\System\jHVEEZQ.exe
  2⤵
  PID:12624
- C:\Windows\System\ESabNkp.exe
  C:\Windows\System\ESabNkp.exe
  2⤵
  PID:12648
- C:\Windows\System\JGMshbY.exe
  C:\Windows\System\JGMshbY.exe
  2⤵
  PID:12672
- C:\Windows\System\aAXuMBM.exe
  C:\Windows\System\aAXuMBM.exe
  2⤵
  PID:12692
- C:\Windows\System\kBfMROC.exe
  C:\Windows\System\kBfMROC.exe
  2⤵
  PID:12712
- C:\Windows\System\gLZGPlu.exe
  C:\Windows\System\gLZGPlu.exe
  2⤵
  PID:12736
- C:\Windows\System\hZOhttq.exe
  C:\Windows\System\hZOhttq.exe
  2⤵
  PID:12752
- C:\Windows\System\NqQBYHf.exe
  C:\Windows\System\NqQBYHf.exe
  2⤵
  PID:12776
- C:\Windows\System\yfEIKGp.exe
  C:\Windows\System\yfEIKGp.exe
  2⤵
  PID:12796
- C:\Windows\System\PuVlkqI.exe
  C:\Windows\System\PuVlkqI.exe
  2⤵
  PID:12820
- C:\Windows\System\xwzfpMs.exe
  C:\Windows\System\xwzfpMs.exe
  2⤵
  PID:12840
- C:\Windows\System\DSdnfEU.exe
  C:\Windows\System\DSdnfEU.exe
  2⤵
  PID:12856
- C:\Windows\System\PFZgLzS.exe
  C:\Windows\System\PFZgLzS.exe
  2⤵
  PID:12876
- C:\Windows\System\rwbekZU.exe
  C:\Windows\System\rwbekZU.exe
  2⤵
  PID:12896
- C:\Windows\System\KcUoVmZ.exe
  C:\Windows\System\KcUoVmZ.exe
  2⤵
  PID:12912
- C:\Windows\System\FWasTvs.exe
  C:\Windows\System\FWasTvs.exe
  2⤵
  PID:12928
- C:\Windows\System\zOBqnKQ.exe
  C:\Windows\System\zOBqnKQ.exe
  2⤵
  PID:12944
- C:\Windows\System\AOdapUd.exe
  C:\Windows\System\AOdapUd.exe
  2⤵
  PID:12960
- C:\Windows\System\seqEpFc.exe
  C:\Windows\System\seqEpFc.exe
  2⤵
  PID:12976
- C:\Windows\System\CsuWQGh.exe
  C:\Windows\System\CsuWQGh.exe
  2⤵
  PID:12996
- C:\Windows\System\yQqDOQf.exe
  C:\Windows\System\yQqDOQf.exe
  2⤵
  PID:13076
- C:\Windows\System\BSJpdFE.exe
  C:\Windows\System\BSJpdFE.exe
  2⤵
  PID:13092
- C:\Windows\System\TYYOJRJ.exe
  C:\Windows\System\TYYOJRJ.exe
  2⤵
  PID:13116
- C:\Windows\System\KzjPHAH.exe
  C:\Windows\System\KzjPHAH.exe
  2⤵
  PID:13136
- C:\Windows\System\jCUmzSU.exe
  C:\Windows\System\jCUmzSU.exe
  2⤵
  PID:13152
- C:\Windows\System\Mdfcuff.exe
  C:\Windows\System\Mdfcuff.exe
  2⤵
  PID:13172
- C:\Windows\System\YBHJSov.exe
  C:\Windows\System\YBHJSov.exe
  2⤵
  PID:13196
- C:\Windows\System\pFEBYPK.exe
  C:\Windows\System\pFEBYPK.exe
  2⤵
  PID:13220
- C:\Windows\System\ZWmmXGY.exe
  C:\Windows\System\ZWmmXGY.exe
  2⤵
  PID:13244
- C:\Windows\System\mbbYeMX.exe
  C:\Windows\System\mbbYeMX.exe
  2⤵
  PID:13264
- C:\Windows\System\xDWVtYR.exe
  C:\Windows\System\xDWVtYR.exe
  2⤵
  PID:13284
- C:\Windows\System\pyuaXdp.exe
  C:\Windows\System\pyuaXdp.exe
  2⤵
  PID:13308
- C:\Windows\System\TjhbLgn.exe
  C:\Windows\System\TjhbLgn.exe
  2⤵
  PID:7792
- C:\Windows\System\LPOLCqI.exe
  C:\Windows\System\LPOLCqI.exe
  2⤵
  PID:7004
- C:\Windows\System\AHfoqzz.exe
  C:\Windows\System\AHfoqzz.exe
  2⤵
  PID:9064
- C:\Windows\System\saqXwQo.exe
  C:\Windows\System\saqXwQo.exe
  2⤵
  PID:5836
- C:\Windows\System\cWwiBSD.exe
  C:\Windows\System\cWwiBSD.exe
  2⤵
  PID:11468
- C:\Windows\System\uUsVnEx.exe
  C:\Windows\System\uUsVnEx.exe
  2⤵
  PID:11496
- C:\Windows\System\KtWvKMj.exe
  C:\Windows\System\KtWvKMj.exe
  2⤵
  PID:10244
- C:\Windows\System\PzZILEs.exe
  C:\Windows\System\PzZILEs.exe
  2⤵
  PID:2192
- C:\Windows\System\LmBbidr.exe
  C:\Windows\System\LmBbidr.exe
  2⤵
  PID:9392
- C:\Windows\System\vEuFWMY.exe
  C:\Windows\System\vEuFWMY.exe
  2⤵
  PID:9432
- C:\Windows\System\bxwfiem.exe
  C:\Windows\System\bxwfiem.exe
  2⤵
  PID:9476
- C:\Windows\System\wKKLJUp.exe
  C:\Windows\System\wKKLJUp.exe
  2⤵
  PID:9524
- C:\Windows\System\jRsOyhS.exe
  C:\Windows\System\jRsOyhS.exe
  2⤵
  PID:9660
- C:\Windows\System\hIzEBAi.exe
  C:\Windows\System\hIzEBAi.exe
  2⤵
  PID:9696
- C:\Windows\System\nvgtBHv.exe
  C:\Windows\System\nvgtBHv.exe
  2⤵
  PID:4000
- C:\Windows\System\qmQxXLc.exe
  C:\Windows\System\qmQxXLc.exe
  2⤵
  PID:9800
- C:\Windows\System\TGDuUXe.exe
  C:\Windows\System\TGDuUXe.exe
  2⤵
  PID:12344
- C:\Windows\System\bZRmtug.exe
  C:\Windows\System\bZRmtug.exe
  2⤵
  PID:8556
- C:\Windows\System\vRyPSen.exe
  C:\Windows\System\vRyPSen.exe
  2⤵
  PID:10904
- C:\Windows\System\TBrMOeO.exe
  C:\Windows\System\TBrMOeO.exe
  2⤵
  PID:12968
- C:\Windows\System\DGjerXG.exe
  C:\Windows\System\DGjerXG.exe
  2⤵
  PID:11728
- C:\Windows\System\YFIoORp.exe
  C:\Windows\System\YFIoORp.exe
  2⤵
  PID:10664
- C:\Windows\System\tUrCRku.exe
  C:\Windows\System\tUrCRku.exe
  2⤵
  PID:10004
- C:\Windows\System\HbbkTBi.exe
  C:\Windows\System\HbbkTBi.exe
  2⤵
  PID:12248
- C:\Windows\System\UbsRvfm.exe
  C:\Windows\System\UbsRvfm.exe
  2⤵
  PID:7344
- C:\Windows\System\fmzUjxF.exe
  C:\Windows\System\fmzUjxF.exe
  2⤵
  PID:10128
- C:\Windows\System\aiwwKEu.exe
  C:\Windows\System\aiwwKEu.exe
  2⤵
  PID:12852
- C:\Windows\System\oXEqxLY.exe
  C:\Windows\System\oXEqxLY.exe
  2⤵
  PID:7968
- C:\Windows\System\IamHYcZ.exe
  C:\Windows\System\IamHYcZ.exe
  2⤵
  PID:10912
- C:\Windows\System\MHQmCxB.exe
  C:\Windows\System\MHQmCxB.exe
  2⤵
  PID:3280
- C:\Windows\System\fXGcuaP.exe
  C:\Windows\System\fXGcuaP.exe
  2⤵
  PID:10320
- C:\Windows\System\oRYwrVx.exe
  C:\Windows\System\oRYwrVx.exe
  2⤵
  PID:10332
- C:\Windows\System\NvtGtFx.exe
  C:\Windows\System\NvtGtFx.exe
  2⤵
  PID:10364
- C:\Windows\System\engxhkP.exe
  C:\Windows\System\engxhkP.exe
  2⤵
  PID:12568
- C:\Windows\System\uMHxElp.exe
  C:\Windows\System\uMHxElp.exe
  2⤵
  PID:12616
- C:\Windows\System\pdDspZd.exe
  C:\Windows\System\pdDspZd.exe
  2⤵
  PID:10448
- C:\Windows\System\kWpJKxl.exe
  C:\Windows\System\kWpJKxl.exe
  2⤵
  PID:11388
- C:\Windows\System\IEqzkKn.exe
  C:\Windows\System\IEqzkKn.exe
  2⤵
  PID:10560
- C:\Windows\System\PsPiPvr.exe
  C:\Windows\System\PsPiPvr.exe
  2⤵
  PID:10632
- C:\Windows\System\ZVeVvAA.exe
  C:\Windows\System\ZVeVvAA.exe
  2⤵
  PID:2848
- C:\Windows\System\fsajYFj.exe
  C:\Windows\System\fsajYFj.exe
  2⤵
  PID:11112
- C:\Windows\System\mAnqGjW.exe
  C:\Windows\System\mAnqGjW.exe
  2⤵
  PID:12664
- C:\Windows\System\kYEbmUx.exe
  C:\Windows\System\kYEbmUx.exe
  2⤵
  PID:12924
- C:\Windows\System\ODyiXBs.exe
  C:\Windows\System\ODyiXBs.exe
  2⤵
  PID:10868
- C:\Windows\System\STQpqMX.exe
  C:\Windows\System\STQpqMX.exe
  2⤵
  PID:6580
- C:\Windows\System\PXaUUth.exe
  C:\Windows\System\PXaUUth.exe
  2⤵
  PID:6892
- C:\Windows\System\JQFfiFX.exe
  C:\Windows\System\JQFfiFX.exe
  2⤵
  PID:12400
- C:\Windows\System\HNKPlmD.exe
  C:\Windows\System\HNKPlmD.exe
  2⤵
  PID:12436
- C:\Windows\System\xMhhCLH.exe
  C:\Windows\System\xMhhCLH.exe
  2⤵
  PID:12472
- C:\Windows\System\rCiIkzv.exe
  C:\Windows\System\rCiIkzv.exe
  2⤵
  PID:12512
- C:\Windows\System\LTSNrCT.exe
  C:\Windows\System\LTSNrCT.exe
  2⤵
  PID:9204
- C:\Windows\System\vaAcvlV.exe
  C:\Windows\System\vaAcvlV.exe
  2⤵
  PID:5796
- C:\Windows\System\zTvchDI.exe
  C:\Windows\System\zTvchDI.exe
  2⤵
  PID:10000
- C:\Windows\System\ugYpYby.exe
  C:\Windows\System\ugYpYby.exe
  2⤵
  PID:9832
- C:\Windows\System\wFIbhKx.exe
  C:\Windows\System\wFIbhKx.exe
  2⤵
  PID:2352
- C:\Windows\System\ZYgqjVt.exe
  C:\Windows\System\ZYgqjVt.exe
  2⤵
  PID:11608
- C:\Windows\System\KFUOxyR.exe
  C:\Windows\System\KFUOxyR.exe
  2⤵
  PID:13040
- C:\Windows\System\rSJUxlP.exe
  C:\Windows\System\rSJUxlP.exe
  2⤵
  PID:10600
- C:\Windows\System\gxYjgoE.exe
  C:\Windows\System\gxYjgoE.exe
  2⤵
  PID:1048
- C:\Windows\System\LbTbiTO.exe
  C:\Windows\System\LbTbiTO.exe
  2⤵
  PID:9144
- C:\Windows\System\lVGtjyf.exe
  C:\Windows\System\lVGtjyf.exe
  2⤵
  PID:13380
- C:\Windows\System\IhsPKYe.exe
  C:\Windows\System\IhsPKYe.exe
  2⤵
  PID:13404
- C:\Windows\System\oSHXwob.exe
  C:\Windows\System\oSHXwob.exe
  2⤵
  PID:13496
- C:\Windows\System\UgNorbk.exe
  C:\Windows\System\UgNorbk.exe
  2⤵
  PID:13516
- C:\Windows\System\cGySnjn.exe
  C:\Windows\System\cGySnjn.exe
  2⤵
  PID:13540
- C:\Windows\System\IEjyMzx.exe
  C:\Windows\System\IEjyMzx.exe
  2⤵
  PID:13664
- C:\Windows\System\zsPleQG.exe
  C:\Windows\System\zsPleQG.exe
  2⤵
  PID:13728
- C:\Windows\System\gRGtwWp.exe
  C:\Windows\System\gRGtwWp.exe
  2⤵
  PID:13832
- C:\Windows\System\gLWzDoZ.exe
  C:\Windows\System\gLWzDoZ.exe
  2⤵
  PID:13884
- C:\Windows\System\YzAzSCl.exe
  C:\Windows\System\YzAzSCl.exe
  2⤵
  PID:13904
- C:\Windows\System\kVERRaj.exe
  C:\Windows\System\kVERRaj.exe
  2⤵
  PID:13928
- C:\Windows\System\TJxALZF.exe
  C:\Windows\System\TJxALZF.exe
  2⤵
  PID:14260
- C:\Windows\System\gVjiLfb.exe
  C:\Windows\System\gVjiLfb.exe
  2⤵
  PID:12704
- C:\Windows\System\RtqQyPg.exe
  C:\Windows\System\RtqQyPg.exe
  2⤵
  PID:10144
- C:\Windows\System\RnPwQmy.exe
  C:\Windows\System\RnPwQmy.exe
  2⤵
  PID:9764
- C:\Windows\System\RkApMbg.exe
  C:\Windows\System\RkApMbg.exe
  2⤵
  PID:9232
- C:\Windows\System\eqjWVjY.exe
  C:\Windows\System\eqjWVjY.exe
  2⤵
  PID:12184
- C:\Windows\System\MvFSpzp.exe
  C:\Windows\System\MvFSpzp.exe
  2⤵
  PID:8504
- C:\Windows\System\EWHJkFA.exe
  C:\Windows\System\EWHJkFA.exe
  2⤵
  PID:12620
- C:\Windows\System\lXZTcmb.exe
  C:\Windows\System\lXZTcmb.exe
  2⤵
  PID:12812
- C:\Windows\System\setPMii.exe
  C:\Windows\System\setPMii.exe
  2⤵
  PID:12072
- C:\Windows\System\jGZzEMz.exe
  C:\Windows\System\jGZzEMz.exe
  2⤵
  PID:2396
- C:\Windows\System\zNKUMoQ.exe
  C:\Windows\System\zNKUMoQ.exe
  2⤵
  PID:13320
- C:\Windows\System\pRaNVfo.exe
  C:\Windows\System\pRaNVfo.exe
  2⤵
  PID:5268
- C:\Windows\System\prHpFoO.exe
  C:\Windows\System\prHpFoO.exe
  2⤵
  PID:13352
- C:\Windows\System\dxeiawp.exe
  C:\Windows\System\dxeiawp.exe
  2⤵
  PID:12544
- C:\Windows\System\pDdKqoV.exe
  C:\Windows\System\pDdKqoV.exe
  2⤵
  PID:13532
- C:\Windows\System\mvpAnbO.exe
  C:\Windows\System\mvpAnbO.exe
  2⤵
  PID:8880
- C:\Windows\System\Lpwtvro.exe
  C:\Windows\System\Lpwtvro.exe
  2⤵
  PID:13824
- C:\Windows\System\BULBUhU.exe
  C:\Windows\System\BULBUhU.exe
  2⤵
  PID:13556
- C:\Windows\System\rOsVztj.exe
  C:\Windows\System\rOsVztj.exe
  2⤵
  PID:13744
- C:\Windows\System\EimpEok.exe
  C:\Windows\System\EimpEok.exe
  2⤵
  PID:13960
- C:\Windows\System\vOvGnSQ.exe
  C:\Windows\System\vOvGnSQ.exe
  2⤵
  PID:13760
- C:\Windows\System\UfsdYfH.exe
  C:\Windows\System\UfsdYfH.exe
  2⤵
  PID:13964
- C:\Windows\System\hwNPrEb.exe
  C:\Windows\System\hwNPrEb.exe
  2⤵
  PID:4972
- C:\Windows\System\QOmduVv.exe
  C:\Windows\System\QOmduVv.exe
  2⤵
  PID:13924
- C:\Windows\System\oyObTpX.exe
  C:\Windows\System\oyObTpX.exe
  2⤵
  PID:13868
- C:\Windows\System\zhwJsfa.exe
  C:\Windows\System\zhwJsfa.exe
  2⤵
  PID:3704
- C:\Windows\System\ohyKNcA.exe
  C:\Windows\System\ohyKNcA.exe
  2⤵
  PID:13820
- C:\Windows\System\kbMGvzV.exe
  C:\Windows\System\kbMGvzV.exe
  2⤵
  PID:11708
- C:\Windows\System\FBOPCpF.exe
  C:\Windows\System\FBOPCpF.exe
  2⤵
  PID:13564
- C:\Windows\System\dIDGGhX.exe
  C:\Windows\System\dIDGGhX.exe
  2⤵
  PID:10780
- C:\Windows\System\UgqKnNc.exe
  C:\Windows\System\UgqKnNc.exe
  2⤵
  PID:10316
- C:\Windows\System\WHdstBp.exe
  C:\Windows\System\WHdstBp.exe
  2⤵
  PID:3904
- C:\Windows\System\zYTFSEc.exe
  C:\Windows\System\zYTFSEc.exe
  2⤵
  PID:13084
- C:\Windows\System\DXANuSJ.exe
  C:\Windows\System\DXANuSJ.exe
  2⤵
  PID:8468
- C:\Windows\System\MmpPmqC.exe
  C:\Windows\System\MmpPmqC.exe
  2⤵
  PID:13348
- C:\Windows\System\VVpwjAW.exe
  C:\Windows\System\VVpwjAW.exe
  2⤵
  PID:13568
- C:\Windows\System\ZNTXEaX.exe
  C:\Windows\System\ZNTXEaX.exe
  2⤵
  PID:12420
- C:\Windows\System\TrkZsPF.exe
  C:\Windows\System\TrkZsPF.exe
  2⤵
  PID:13436
- C:\Windows\System\TInWIwA.exe
  C:\Windows\System\TInWIwA.exe
  2⤵
  PID:13624
- C:\Windows\System\pMjFLMZ.exe
  C:\Windows\System\pMjFLMZ.exe
  2⤵
  PID:13372
- C:\Windows\System\NzPVDur.exe
  C:\Windows\System\NzPVDur.exe
  2⤵
  PID:13484
- C:\Windows\System\lkHniGE.exe
  C:\Windows\System\lkHniGE.exe
  2⤵
  PID:13616
- C:\Windows\System\SHDUHup.exe
  C:\Windows\System\SHDUHup.exe
  2⤵
  PID:6184
- C:\Windows\System\FxgBGXH.exe
  C:\Windows\System\FxgBGXH.exe
  2⤵
  PID:13712
- C:\Windows\System\Tidcqvy.exe
  C:\Windows\System\Tidcqvy.exe
  2⤵
  PID:13764
- C:\Windows\System\VZyOzDs.exe
  C:\Windows\System\VZyOzDs.exe
  2⤵
  PID:13684
- C:\Windows\System\CLiRbyN.exe
  C:\Windows\System\CLiRbyN.exe
  2⤵
  PID:2424
- C:\Windows\System\wllBHqE.exe
  C:\Windows\System\wllBHqE.exe
  2⤵
  PID:2636
- C:\Windows\System\YhzcVYp.exe
  C:\Windows\System\YhzcVYp.exe
  2⤵
  PID:12556
- C:\Windows\System\XmTwXsk.exe
  C:\Windows\System\XmTwXsk.exe
  2⤵
  PID:14300
- C:\Windows\System\WDPsdrZ.exe
  C:\Windows\System\WDPsdrZ.exe
  2⤵
  PID:14292
- C:\Windows\System\vTUiFKV.exe
  C:\Windows\System\vTUiFKV.exe
  2⤵
  PID:4652
- C:\Windows\System\fzvluxT.exe
  C:\Windows\System\fzvluxT.exe
  2⤵
  PID:9096
- C:\Windows\System\oDRhydT.exe
  C:\Windows\System\oDRhydT.exe
  2⤵
  PID:13488
- C:\Windows\System\KoWJctN.exe
  C:\Windows\System\KoWJctN.exe
  2⤵
  PID:13400
- C:\Windows\System\FPCzNUn.exe
  C:\Windows\System\FPCzNUn.exe
  2⤵
  PID:9996
- C:\Windows\System\LZoaKYy.exe
  C:\Windows\System\LZoaKYy.exe
  2⤵
  PID:5772
- C:\Windows\System\ztxFZcN.exe
  C:\Windows\System\ztxFZcN.exe
  2⤵
  PID:13872
- C:\Windows\System\EaVyLHj.exe
  C:\Windows\System\EaVyLHj.exe
  2⤵
  PID:10516
- C:\Windows\System\rvARPas.exe
  C:\Windows\System\rvARPas.exe
  2⤵
  PID:2208
- C:\Windows\System\AFhlHVW.exe
  C:\Windows\System\AFhlHVW.exe
  2⤵
  PID:12216
- C:\Windows\System\nVHXVQG.exe
  C:\Windows\System\nVHXVQG.exe
  2⤵
  PID:13476
- C:\Windows\System\OtrzcGH.exe
  C:\Windows\System\OtrzcGH.exe
  2⤵
  PID:13724
- C:\Windows\System\tIojUHj.exe
  C:\Windows\System\tIojUHj.exe
  2⤵
  PID:4348
- C:\Windows\System\riWrXRs.exe
  C:\Windows\System\riWrXRs.exe
  2⤵
  PID:5012
- C:\Windows\System\NBmMfQv.exe
  C:\Windows\System\NBmMfQv.exe
  2⤵
  PID:3632
- C:\Windows\System\dfZImel.exe
  C:\Windows\System\dfZImel.exe
  2⤵
  PID:3936
- C:\Windows\System\lsBXTlt.exe
  C:\Windows\System\lsBXTlt.exe
  2⤵
  PID:3520
- C:\Windows\System\socOPDG.exe
  C:\Windows\System\socOPDG.exe
  2⤵
  PID:4416
- C:\Windows\System\rMRueSk.exe
  C:\Windows\System\rMRueSk.exe
  2⤵
  PID:4076
- C:\Windows\System\mONfEMD.exe
  C:\Windows\System\mONfEMD.exe
  2⤵
  PID:3332
- C:\Windows\System\mMLUCAa.exe
  C:\Windows\System\mMLUCAa.exe
  2⤵
  PID:4020
- C:\Windows\System\khUQADv.exe
  C:\Windows\System\khUQADv.exe
  2⤵
  PID:3440
- C:\Windows\System\azQUWQo.exe
  C:\Windows\System\azQUWQo.exe
  2⤵
  PID:12052
- C:\Windows\System\EFRmytp.exe
  C:\Windows\System\EFRmytp.exe
  2⤵
  PID:4280
- C:\Windows\System\jlvaMmW.exe
  C:\Windows\System\jlvaMmW.exe
  2⤵
  PID:4448
- C:\Windows\System\eajycwM.exe
  C:\Windows\System\eajycwM.exe
  2⤵
  PID:14016
- C:\Windows\System\JRlNUvI.exe
  C:\Windows\System\JRlNUvI.exe
  2⤵
  PID:13968
- C:\Windows\System\kxvEpSE.exe
  C:\Windows\System\kxvEpSE.exe
  2⤵
  PID:11760
- C:\Windows\System\SyhwTLG.exe
  C:\Windows\System\SyhwTLG.exe
  2⤵
  PID:13772
- C:\Windows\System\RYsoObG.exe
  C:\Windows\System\RYsoObG.exe
  2⤵
  PID:3288
- C:\Windows\System\qltfCnq.exe
  C:\Windows\System\qltfCnq.exe
  2⤵
  PID:1044
- C:\Windows\System\yZOwbVC.exe
  C:\Windows\System\yZOwbVC.exe
  2⤵
  PID:4352
- C:\Windows\System\ZxSLuzE.exe
  C:\Windows\System\ZxSLuzE.exe
  2⤵
  PID:3700
- C:\Windows\System\paQaXZF.exe
  C:\Windows\System\paQaXZF.exe
  2⤵
  PID:10392
- C:\Windows\System\rQLIOxX.exe
  C:\Windows\System\rQLIOxX.exe
  2⤵
  PID:6248
- C:\Windows\System\NQRaxlF.exe
  C:\Windows\System\NQRaxlF.exe
  2⤵
  PID:4268
- C:\Windows\System\zhjFWSL.exe
  C:\Windows\System\zhjFWSL.exe
  2⤵
  PID:13912
- C:\Windows\System\uzgsQVo.exe
  C:\Windows\System\uzgsQVo.exe
  2⤵
  PID:14256
- C:\Windows\System\YiCpmZY.exe
  C:\Windows\System\YiCpmZY.exe
  2⤵
  PID:12376
- C:\Windows\System\avsapaD.exe
  C:\Windows\System\avsapaD.exe
  2⤵
  PID:436
- C:\Windows\System\OBVSqxH.exe
  C:\Windows\System\OBVSqxH.exe
  2⤵
  PID:1888
- C:\Windows\System\LronMsR.exe
  C:\Windows\System\LronMsR.exe
  2⤵
  PID:3696
- C:\Windows\System\oHvtdZX.exe
  C:\Windows\System\oHvtdZX.exe
  2⤵
  PID:12884
- C:\Windows\System\jnWtvHj.exe
  C:\Windows\System\jnWtvHj.exe
  2⤵
  PID:14296
- C:\Windows\System\DRcUphP.exe
  C:\Windows\System\DRcUphP.exe
  2⤵
  PID:3664
- C:\Windows\System\eqsoNys.exe
  C:\Windows\System\eqsoNys.exe
  2⤵
  PID:12868
- C:\Windows\System\oCZHfkV.exe
  C:\Windows\System\oCZHfkV.exe
  2⤵
  PID:4664
- C:\Windows\System\rvSRcuH.exe
  C:\Windows\System\rvSRcuH.exe
  2⤵
  PID:11564
- C:\Windows\System\pIXjldD.exe
  C:\Windows\System\pIXjldD.exe
  2⤵
  PID:2292
- C:\Windows\System\UYoKSZt.exe
  C:\Windows\System\UYoKSZt.exe
  2⤵
  PID:1528
- C:\Windows\System\KHyBFLT.exe
  C:\Windows\System\KHyBFLT.exe
  2⤵
  PID:4252
- C:\Windows\System\rXcNWgT.exe
  C:\Windows\System\rXcNWgT.exe
  2⤵
  PID:3892
- C:\Windows\System\gfInJdV.exe
  C:\Windows\System\gfInJdV.exe
  2⤵
  PID:3888
- C:\Windows\System\SKssFYq.exe
  C:\Windows\System\SKssFYq.exe
  2⤵
  PID:4120
- C:\Windows\System\GYYpkXs.exe
  C:\Windows\System\GYYpkXs.exe
  2⤵
  PID:3628
- C:\Windows\System\YiIUxkK.exe
  C:\Windows\System\YiIUxkK.exe
  2⤵
  PID:1640
- C:\Windows\System\nDwippi.exe
  C:\Windows\System\nDwippi.exe
  2⤵
  PID:536
- C:\Windows\System\XrwsWab.exe
  C:\Windows\System\XrwsWab.exe
  2⤵
  PID:2792
- C:\Windows\System\kcxJlaq.exe
  C:\Windows\System\kcxJlaq.exe
  2⤵
  PID:3408
- C:\Windows\System\WMfSSZp.exe
  C:\Windows\System\WMfSSZp.exe
  2⤵
  PID:13952
- C:\Windows\System\unysZXK.exe
  C:\Windows\System\unysZXK.exe
  2⤵
  PID:5404
- C:\Windows\System\OAhePCL.exe
  C:\Windows\System\OAhePCL.exe
  2⤵
  PID:13988
- C:\Windows\System\kwtglVL.exe
  C:\Windows\System\kwtglVL.exe
  2⤵
  PID:3900
- C:\Windows\System\YuGewXJ.exe
  C:\Windows\System\YuGewXJ.exe
  2⤵
  PID:4396
- C:\Windows\System\htWlGEK.exe
  C:\Windows\System\htWlGEK.exe
  2⤵
  PID:2608
- C:\Windows\System\gFcfTfD.exe
  C:\Windows\System\gFcfTfD.exe
  2⤵
  PID:4264
- C:\Windows\System\pfzEmHN.exe
  C:\Windows\System\pfzEmHN.exe
  2⤵
  PID:2656
- C:\Windows\System\XBGrJPV.exe
  C:\Windows\System\XBGrJPV.exe
  2⤵
  PID:2284
- C:\Windows\System\MUEReum.exe
  C:\Windows\System\MUEReum.exe
  2⤵
  PID:5548
- C:\Windows\System\wUWEbqR.exe
  C:\Windows\System\wUWEbqR.exe
  2⤵
  PID:5840
- C:\Windows\System\IlpqhgE.exe
  C:\Windows\System\IlpqhgE.exe
  2⤵
  PID:5728
- C:\Windows\System\oxRoUtl.exe
  C:\Windows\System\oxRoUtl.exe
  2⤵
  PID:5736
- C:\Windows\System\MSEpyCa.exe
  C:\Windows\System\MSEpyCa.exe
  2⤵
  PID:4720
- C:\Windows\System\VFGIWGS.exe
  C:\Windows\System\VFGIWGS.exe
  2⤵
  PID:5332
- C:\Windows\System\wKeJtZj.exe
  C:\Windows\System\wKeJtZj.exe
  2⤵
  PID:5960
- C:\Windows\System\yRMwtfq.exe
  C:\Windows\System\yRMwtfq.exe
  2⤵
  PID:912
- C:\Windows\System\zpnUfZr.exe
  C:\Windows\System\zpnUfZr.exe
  2⤵
  PID:532
- C:\Windows\System\oqkZqYw.exe
  C:\Windows\System\oqkZqYw.exe
  2⤵
  PID:4820
- C:\Windows\System\RuaHSxm.exe
  C:\Windows\System\RuaHSxm.exe
  2⤵
  PID:5048
- C:\Windows\System\hrxoxan.exe
  C:\Windows\System\hrxoxan.exe
  2⤵
  PID:6260
- C:\Windows\System\itjxgYi.exe
  C:\Windows\System\itjxgYi.exe
  2⤵
  PID:5600
- C:\Windows\System\nIxmHSo.exe
  C:\Windows\System\nIxmHSo.exe
  2⤵
  PID:6396
- C:\Windows\System\DrPWEHM.exe
  C:\Windows\System\DrPWEHM.exe
  2⤵
  PID:5144
- C:\Windows\System\sVpQLLy.exe
  C:\Windows\System\sVpQLLy.exe
  2⤵
  PID:5712
- C:\Windows\System\bqKGXps.exe
  C:\Windows\System\bqKGXps.exe
  2⤵
  PID:6756
- C:\Windows\System\FChPDnA.exe
  C:\Windows\System\FChPDnA.exe
  2⤵
  PID:14332
- C:\Windows\System\YEpsFsN.exe
  C:\Windows\System\YEpsFsN.exe
  2⤵
  PID:6816
- C:\Windows\System\xPnUnka.exe
  C:\Windows\System\xPnUnka.exe
  2⤵
  PID:2124
- C:\Windows\System\BTjzMjI.exe
  C:\Windows\System\BTjzMjI.exe
  2⤵
  PID:1628
- C:\Windows\System\mYUqwOt.exe
  C:\Windows\System\mYUqwOt.exe
  2⤵
  PID:5356
- C:\Windows\System\NCOZzzP.exe
  C:\Windows\System\NCOZzzP.exe
  2⤵
  PID:5392
- C:\Windows\System\kagdQMF.exe
  C:\Windows\System\kagdQMF.exe
  2⤵
  PID:5928
- C:\Windows\System\IfovYSY.exe
  C:\Windows\System\IfovYSY.exe
  2⤵
  PID:6796
- C:\Windows\System\CUCoWLH.exe
  C:\Windows\System\CUCoWLH.exe
  2⤵
  PID:5324
- C:\Windows\System\ZSSPsUp.exe
  C:\Windows\System\ZSSPsUp.exe
  2⤵
  PID:1880
- C:\Windows\System\sIRnNFc.exe
  C:\Windows\System\sIRnNFc.exe
  2⤵
  PID:7240
- C:\Windows\System\PzCdavb.exe
  C:\Windows\System\PzCdavb.exe
  2⤵
  PID:7248
- C:\Windows\System\inOpWdZ.exe
  C:\Windows\System\inOpWdZ.exe
  2⤵
  PID:3568
- C:\Windows\System\ArExFOo.exe
  C:\Windows\System\ArExFOo.exe
  2⤵
  PID:3292
- C:\Windows\System\IVvaWtS.exe
  C:\Windows\System\IVvaWtS.exe
  2⤵
  PID:6300
- C:\Windows\System\lBquDhK.exe
  C:\Windows\System\lBquDhK.exe
  2⤵
  PID:5904
- C:\Windows\System\RGheESH.exe
  C:\Windows\System\RGheESH.exe
  2⤵
  PID:7272
- C:\Windows\System\iYRuIEK.exe
  C:\Windows\System\iYRuIEK.exe
  2⤵
  PID:7284
- C:\Windows\System\kLtgBUk.exe
  C:\Windows\System\kLtgBUk.exe
  2⤵
  PID:7260
- C:\Windows\System\NciYJhy.exe
  C:\Windows\System\NciYJhy.exe
  2⤵
  PID:5776
- C:\Windows\System\SVSMtxm.exe
  C:\Windows\System\SVSMtxm.exe
  2⤵
  PID:7296
- C:\Windows\System\OUlcEIP.exe
  C:\Windows\System\OUlcEIP.exe
  2⤵
  PID:7324
- C:\Windows\System\LwKSZEW.exe
  C:\Windows\System\LwKSZEW.exe
  2⤵
  PID:3108
- C:\Windows\System\SHZoscD.exe
  C:\Windows\System\SHZoscD.exe
  2⤵
  PID:7008
- C:\Windows\System\mCWlvNX.exe
  C:\Windows\System\mCWlvNX.exe
  2⤵
  PID:6088
- C:\Windows\System\gttkbEw.exe
  C:\Windows\System\gttkbEw.exe
  2⤵
  PID:7232
- C:\Windows\System\USDRYkN.exe
  C:\Windows\System\USDRYkN.exe
  2⤵
  PID:5532
- C:\Windows\System\qtZRHRj.exe
  C:\Windows\System\qtZRHRj.exe
  2⤵
  PID:5348
- C:\Windows\System\KJNSjfX.exe
  C:\Windows\System\KJNSjfX.exe
  2⤵
  PID:6116
- C:\Windows\System\oqotMNt.exe
  C:\Windows\System\oqotMNt.exe
  2⤵
  PID:7280
- C:\Windows\System\xalCvdc.exe
  C:\Windows\System\xalCvdc.exe
  2⤵
  PID:5328
- C:\Windows\System\bTQjbrK.exe
  C:\Windows\System\bTQjbrK.exe
  2⤵
  PID:8356
- C:\Windows\System\lgTOnto.exe
  C:\Windows\System\lgTOnto.exe
  2⤵
  PID:7908
- C:\Windows\System\nRjUOZc.exe
  C:\Windows\System\nRjUOZc.exe
  2⤵
  PID:6232
- C:\Windows\System\OMmVfdn.exe
  C:\Windows\System\OMmVfdn.exe
  2⤵
  PID:7320
- C:\Windows\System\uvVyULa.exe
  C:\Windows\System\uvVyULa.exe
  2⤵
  PID:8644
- C:\Windows\System\CXFVTkr.exe
  C:\Windows\System\CXFVTkr.exe
  2⤵
  PID:8060
- C:\Windows\System\ajuZljD.exe
  C:\Windows\System\ajuZljD.exe
  2⤵
  PID:6596
- C:\Windows\System\JKjdBkA.exe
  C:\Windows\System\JKjdBkA.exe
  2⤵
  PID:7336
- C:\Windows\System\CnztBED.exe
  C:\Windows\System\CnztBED.exe
  2⤵
  PID:6704
- C:\Windows\System\ztrbwtz.exe
  C:\Windows\System\ztrbwtz.exe
  2⤵
  PID:7236
- C:\Windows\System\ZPllDNK.exe
  C:\Windows\System\ZPllDNK.exe
  2⤵
  PID:5036
- C:\Windows\System\kcirdLv.exe
  C:\Windows\System\kcirdLv.exe
  2⤵
  PID:2324
- C:\Windows\System\GzTdQyp.exe
  C:\Windows\System\GzTdQyp.exe
  2⤵
  PID:7576
- C:\Windows\System\LwgBgup.exe
  C:\Windows\System\LwgBgup.exe
  2⤵
  PID:6632
- C:\Windows\System\GrzMukO.exe
  C:\Windows\System\GrzMukO.exe
  2⤵
  PID:10836
- C:\Windows\System\UjdmNWt.exe
  C:\Windows\System\UjdmNWt.exe
  2⤵
  PID:7376
- C:\Windows\System\ogNDmLk.exe
  C:\Windows\System\ogNDmLk.exe
  2⤵
  PID:7656
- C:\Windows\System\NsKDQIB.exe
  C:\Windows\System\NsKDQIB.exe
  2⤵
  PID:7608
- C:\Windows\System\VmcIHlv.exe
  C:\Windows\System\VmcIHlv.exe
  2⤵
  PID:8352
- C:\Windows\System\ViWyWaB.exe
  C:\Windows\System\ViWyWaB.exe
  2⤵
  PID:7644
- C:\Windows\System\swycPQD.exe
  C:\Windows\System\swycPQD.exe
  2⤵
  PID:8584
- C:\Windows\System\ldEcAyv.exe
  C:\Windows\System\ldEcAyv.exe
  2⤵
  PID:8668
- C:\Windows\System\pFJRINp.exe
  C:\Windows\System\pFJRINp.exe
  2⤵
  PID:8564
- C:\Windows\System\UFJkvQj.exe
  C:\Windows\System\UFJkvQj.exe
  2⤵
  PID:13736
- C:\Windows\System\lumUmsq.exe
  C:\Windows\System\lumUmsq.exe
  2⤵
  PID:8772
- C:\Windows\System\wqEnhJS.exe
  C:\Windows\System\wqEnhJS.exe
  2⤵
  PID:6752
- C:\Windows\System\EJtpzHP.exe
  C:\Windows\System\EJtpzHP.exe
  2⤵
  PID:8892
- C:\Windows\System\kxPNRRL.exe
  C:\Windows\System\kxPNRRL.exe
  2⤵
  PID:8152
- C:\Windows\System\xxVmRLy.exe
  C:\Windows\System\xxVmRLy.exe
  2⤵
  PID:6628
- C:\Windows\System\wPQeDhN.exe
  C:\Windows\System\wPQeDhN.exe
  2⤵
  PID:8920
- C:\Windows\System\JkUgujT.exe
  C:\Windows\System\JkUgujT.exe
  2⤵
  PID:9116
- C:\Windows\System\hAsfEeT.exe
  C:\Windows\System\hAsfEeT.exe
  2⤵
  PID:6728
- C:\Windows\System\ykFcTJJ.exe
  C:\Windows\System\ykFcTJJ.exe
  2⤵
  PID:8292
- C:\Windows\System\qrJxcwc.exe
  C:\Windows\System\qrJxcwc.exe
  2⤵
  PID:7624
- C:\Windows\System\PINqZOr.exe
  C:\Windows\System\PINqZOr.exe
  2⤵
  PID:9540
- C:\Windows\System\jDpsbcQ.exe
  C:\Windows\System\jDpsbcQ.exe
  2⤵
  PID:7276
- C:\Windows\System\jULzpqc.exe
  C:\Windows\System\jULzpqc.exe
  2⤵
  PID:5856
- C:\Windows\System\ZiAGKvm.exe
  C:\Windows\System\ZiAGKvm.exe
  2⤵
  PID:8348
- C:\Windows\System\aNdOCUR.exe
  C:\Windows\System\aNdOCUR.exe
  2⤵
  PID:8580
- C:\Windows\System\JCAMxHO.exe
  C:\Windows\System\JCAMxHO.exe
  2⤵
  PID:11316
- C:\Windows\System\GXiwMLT.exe
  C:\Windows\System\GXiwMLT.exe
  2⤵
  PID:10920
- C:\Windows\System\qpKmDou.exe
  C:\Windows\System\qpKmDou.exe
  2⤵
  PID:13708
- C:\Windows\System\tWsNiJI.exe
  C:\Windows\System\tWsNiJI.exe
  2⤵
  PID:9036
- C:\Windows\System\spbgGeY.exe
  C:\Windows\System\spbgGeY.exe
  2⤵
  PID:6272
- C:\Windows\System\KvQpzRL.exe
  C:\Windows\System\KvQpzRL.exe
  2⤵
  PID:11100
- C:\Windows\System\MhEGwWG.exe
  C:\Windows\System\MhEGwWG.exe
  2⤵
  PID:8480
- C:\Windows\System\CBkmOWS.exe
  C:\Windows\System\CBkmOWS.exe
  2⤵
  PID:7960
- C:\Windows\System\FnoWDJp.exe
  C:\Windows\System\FnoWDJp.exe
  2⤵
  PID:11368
- C:\Windows\System\lQezNfs.exe
  C:\Windows\System\lQezNfs.exe
  2⤵
  PID:3004
- C:\Windows\System\AZFpzMt.exe
  C:\Windows\System\AZFpzMt.exe
  2⤵
  PID:5380
- C:\Windows\System\QsMzmQP.exe
  C:\Windows\System\QsMzmQP.exe
  2⤵
  PID:8800
- C:\Windows\System\hxNHhos.exe
  C:\Windows\System\hxNHhos.exe
  2⤵
  PID:5284
- C:\Windows\System\dSmdXsS.exe
  C:\Windows\System\dSmdXsS.exe
  2⤵
  PID:11804
- C:\Windows\System\jPPSizf.exe
  C:\Windows\System\jPPSizf.exe
  2⤵
  PID:11844
- C:\Windows\System\dLBUDds.exe
  C:\Windows\System\dLBUDds.exe
  2⤵
  PID:8260
- C:\Windows\System\tbklZjY.exe
  C:\Windows\System\tbklZjY.exe
  2⤵
  PID:10860
- C:\Windows\System\YXqMnhA.exe
  C:\Windows\System\YXqMnhA.exe
  2⤵
  PID:11988
- C:\Windows\System\xnlcwUl.exe
  C:\Windows\System\xnlcwUl.exe
  2⤵
  PID:8364
- C:\Windows\System\XMxHFPJ.exe
  C:\Windows\System\XMxHFPJ.exe
  2⤵
  PID:9804
- C:\Windows\System\porWogP.exe
  C:\Windows\System\porWogP.exe
  2⤵
  PID:13944
- C:\Windows\System\rYIEuYU.exe
  C:\Windows\System\rYIEuYU.exe
  2⤵
  PID:11312
- C:\Windows\System\KEFHvbh.exe
  C:\Windows\System\KEFHvbh.exe
  2⤵
  PID:11488
- C:\Windows\System\rIYMITI.exe
  C:\Windows\System\rIYMITI.exe
  2⤵
  PID:11556
- C:\Windows\System\mKieJaZ.exe
  C:\Windows\System\mKieJaZ.exe
  2⤵
  PID:8340
- C:\Windows\System\XXWHxFI.exe
  C:\Windows\System\XXWHxFI.exe
  2⤵
  PID:8372
- C:\Windows\System\YbHLTOt.exe
  C:\Windows\System\YbHLTOt.exe
  2⤵
  PID:11328
- C:\Windows\System\MfjdGLW.exe
  C:\Windows\System\MfjdGLW.exe
  2⤵
  PID:6208
- C:\Windows\System\JSDDRIR.exe
  C:\Windows\System\JSDDRIR.exe
  2⤵
  PID:6244
- C:\Windows\System\IpAbtMW.exe
  C:\Windows\System\IpAbtMW.exe
  2⤵
  PID:6140
- C:\Windows\System\ybQDDvQ.exe
  C:\Windows\System\ybQDDvQ.exe
  2⤵
  PID:12180
- C:\Windows\System\dtieYNf.exe
  C:\Windows\System\dtieYNf.exe
  2⤵
  PID:8012
- C:\Windows\System\sFbPVXe.exe
  C:\Windows\System\sFbPVXe.exe
  2⤵
  PID:11432
- C:\Windows\System\oTDyxVQ.exe
  C:\Windows\System\oTDyxVQ.exe
  2⤵
  PID:9228
- C:\Windows\System\krGNxcq.exe
  C:\Windows\System\krGNxcq.exe
  2⤵
  PID:10644
- C:\Windows\System\ZUOruQk.exe
  C:\Windows\System\ZUOruQk.exe
  2⤵
  PID:10604
- C:\Windows\System\LIuZGMl.exe
  C:\Windows\System\LIuZGMl.exe
  2⤵
  PID:10488
- C:\Windows\System\ThdMrMe.exe
  C:\Windows\System\ThdMrMe.exe
  2⤵
  PID:10916
- C:\Windows\System\XywSJLY.exe
  C:\Windows\System\XywSJLY.exe
  2⤵
  PID:10908
- C:\Windows\System\JDOwJPQ.exe
  C:\Windows\System\JDOwJPQ.exe
  2⤵
  PID:8424
- C:\Windows\System\QqVDHZU.exe
  C:\Windows\System\QqVDHZU.exe
  2⤵
  PID:10220
- C:\Windows\System\BYtZqYv.exe
  C:\Windows\System\BYtZqYv.exe
  2⤵
  PID:10156
- C:\Windows\System\OWXgOhT.exe
  C:\Windows\System\OWXgOhT.exe
  2⤵
  PID:9720
- C:\Windows\System\KlLfgBO.exe
  C:\Windows\System\KlLfgBO.exe
  2⤵
  PID:8428
- C:\Windows\System\IRhbXlO.exe
  C:\Windows\System\IRhbXlO.exe
  2⤵
  PID:10172
- C:\Windows\System\bKceZBj.exe
  C:\Windows\System\bKceZBj.exe
  2⤵
  PID:12332
- C:\Windows\System\ndYTmox.exe
  C:\Windows\System\ndYTmox.exe
  2⤵
  PID:12316
- C:\Windows\System\ewGVjbU.exe
  C:\Windows\System\ewGVjbU.exe
  2⤵
  PID:8388
- C:\Windows\System\YSziJLu.exe
  C:\Windows\System\YSziJLu.exe
  2⤵
  PID:7160
- C:\Windows\System\hOoEEKV.exe
  C:\Windows\System\hOoEEKV.exe
  2⤵
  PID:8796
- C:\Windows\System\fwFjmBP.exe
  C:\Windows\System\fwFjmBP.exe
  2⤵
  PID:12572
- C:\Windows\System\jdLVCoc.exe
  C:\Windows\System\jdLVCoc.exe
  2⤵
  PID:10084
- C:\Windows\System\gjwRBtQ.exe
  C:\Windows\System\gjwRBtQ.exe
  2⤵
  PID:12700
- C:\Windows\System\vaRFTCN.exe
  C:\Windows\System\vaRFTCN.exe
  2⤵
  PID:8640
- C:\Windows\System\budfjFO.exe
  C:\Windows\System\budfjFO.exe
  2⤵
  PID:8232
- C:\Windows\System\WPMezgy.exe
  C:\Windows\System\WPMezgy.exe
  2⤵
  PID:6800
- C:\Windows\System\GZbMzIa.exe
  C:\Windows\System\GZbMzIa.exe
  2⤵
  PID:6180
- C:\Windows\System\bdzGHfv.exe
  C:\Windows\System\bdzGHfv.exe
  2⤵
  PID:7756
- C:\Windows\System\nhFYzPS.exe
  C:\Windows\System\nhFYzPS.exe
  2⤵
  PID:8804
- C:\Windows\System\tANqczf.exe
  C:\Windows\System\tANqczf.exe
  2⤵
  PID:13012
- C:\Windows\System\fPNLLRu.exe
  C:\Windows\System\fPNLLRu.exe
  2⤵
  PID:6204
- C:\Windows\System\FCQGLNX.exe
  C:\Windows\System\FCQGLNX.exe
  2⤵
  PID:9332
- C:\Windows\System\ufnJoMH.exe
  C:\Windows\System\ufnJoMH.exe
  2⤵
  PID:10536
- C:\Windows\System\QnSjOew.exe
  C:\Windows\System\QnSjOew.exe
  2⤵
  PID:9612
- C:\Windows\System\SgJoNtN.exe
  C:\Windows\System\SgJoNtN.exe
  2⤵
  PID:9412
- C:\Windows\System\fabZrSe.exe
  C:\Windows\System\fabZrSe.exe
  2⤵
  PID:9672
- C:\Windows\System\TUohWIH.exe
  C:\Windows\System\TUohWIH.exe
  2⤵
  PID:13208
- C:\Windows\System\AzzECuR.exe
  C:\Windows\System\AzzECuR.exe
  2⤵
  PID:11220
- C:\Windows\System\VqXuHXd.exe
  C:\Windows\System\VqXuHXd.exe
  2⤵
  PID:9188
- C:\Windows\System\kpyWRrW.exe
  C:\Windows\System\kpyWRrW.exe
  2⤵
  PID:12404
- C:\Windows\System\fjUwkLj.exe
  C:\Windows\System\fjUwkLj.exe
  2⤵
  PID:11156
- C:\Windows\System\GqyIXQE.exe
  C:\Windows\System\GqyIXQE.exe
  2⤵
  PID:8672
- C:\Windows\System\dTOVyJA.exe
  C:\Windows\System\dTOVyJA.exe
  2⤵
  PID:8728
- C:\Windows\System\wZVzinX.exe
  C:\Windows\System\wZVzinX.exe
  2⤵
  PID:12464
- C:\Windows\System\GJLRocc.exe
  C:\Windows\System\GJLRocc.exe
  2⤵
  PID:7412
- C:\Windows\System\HNPBhwb.exe
  C:\Windows\System\HNPBhwb.exe
  2⤵
  PID:8856
- C:\Windows\System\lWPKUme.exe
  C:\Windows\System\lWPKUme.exe
  2⤵
  PID:12828
- C:\Windows\System\AhPbGid.exe
  C:\Windows\System\AhPbGid.exe
  2⤵
  PID:6516
- C:\Windows\System\hbiAGnJ.exe
  C:\Windows\System\hbiAGnJ.exe
  2⤵
  PID:12232
- C:\Windows\System\JCYghjh.exe
  C:\Windows\System\JCYghjh.exe
  2⤵
  PID:6712
- C:\Windows\System\cHCLLCl.exe
  C:\Windows\System\cHCLLCl.exe
  2⤵
  PID:3104
- C:\Windows\System\XvcgVLp.exe
  C:\Windows\System\XvcgVLp.exe
  2⤵
  PID:11412
- C:\Windows\System\VFgRKNd.exe
  C:\Windows\System\VFgRKNd.exe
  2⤵
  PID:10952
- C:\Windows\System\ewHcAFQ.exe
  C:\Windows\System\ewHcAFQ.exe
  2⤵
  PID:10608
- C:\Windows\System\hFFLENu.exe
  C:\Windows\System\hFFLENu.exe
  2⤵
  PID:9568
- C:\Windows\System\DcfGLex.exe
  C:\Windows\System\DcfGLex.exe
  2⤵
  PID:3652
- C:\Windows\System\kSbjycd.exe
  C:\Windows\System\kSbjycd.exe
  2⤵
  PID:12348
- C:\Windows\System\UpDIDLo.exe
  C:\Windows\System\UpDIDLo.exe
  2⤵
  PID:12296
- C:\Windows\System\uMMAFRz.exe
  C:\Windows\System\uMMAFRz.exe
  2⤵
  PID:12816
- C:\Windows\System\VaYTaVS.exe
  C:\Windows\System\VaYTaVS.exe
  2⤵
  PID:12000
- C:\Windows\System\fMvlgtg.exe
  C:\Windows\System\fMvlgtg.exe
  2⤵
  PID:11096
- C:\Windows\System\IXzcjXg.exe
  C:\Windows\System\IXzcjXg.exe
  2⤵
  PID:13104
- C:\Windows\System\aWGMCDX.exe
  C:\Windows\System\aWGMCDX.exe
  2⤵
  PID:13256
- C:\Windows\System\aXvHAcI.exe
  C:\Windows\System\aXvHAcI.exe
  2⤵
  PID:11956
- C:\Windows\System\rdutnjd.exe
  C:\Windows\System\rdutnjd.exe
  2⤵
  PID:12784
- C:\Windows\System\KOYDzct.exe
  C:\Windows\System\KOYDzct.exe
  2⤵
  PID:11532
- C:\Windows\System\yxprvVe.exe
  C:\Windows\System\yxprvVe.exe
  2⤵
  PID:9148
- C:\Windows\System\ryBPwgp.exe
  C:\Windows\System\ryBPwgp.exe
  2⤵
  PID:9044
- C:\Windows\System\kfmmBtP.exe
  C:\Windows\System\kfmmBtP.exe
  2⤵
  PID:9632
- C:\Windows\System\YavMfqN.exe
  C:\Windows\System\YavMfqN.exe
  2⤵
  PID:13036
- C:\Windows\System\SIAPXyN.exe
  C:\Windows\System\SIAPXyN.exe
  2⤵
  PID:13188
- C:\Windows\System\zdQEkdO.exe
  C:\Windows\System\zdQEkdO.exe
  2⤵
  PID:8792
- C:\Windows\System\Vrqcxtr.exe
  C:\Windows\System\Vrqcxtr.exe
  2⤵
  PID:7068
- C:\Windows\System\FCrfETX.exe
  C:\Windows\System\FCrfETX.exe
  2⤵
  PID:10936
- C:\Windows\System\fHpTuOF.exe
  C:\Windows\System\fHpTuOF.exe
  2⤵
  PID:12788
- C:\Windows\System\VnjINuy.exe
  C:\Windows\System\VnjINuy.exe
  2⤵
  PID:12200
- C:\Windows\System\WkcDWdo.exe
  C:\Windows\System\WkcDWdo.exe
  2⤵
  PID:10892
- C:\Windows\System\qMuFlcq.exe
  C:\Windows\System\qMuFlcq.exe
  2⤵
  PID:11944
- C:\Windows\System\oUvsMVo.exe
  C:\Windows\System\oUvsMVo.exe
  2⤵
  PID:13192
- C:\Windows\System\mevppBa.exe
  C:\Windows\System\mevppBa.exe
  2⤵
  PID:10648
- C:\Windows\System\SPSXYib.exe
  C:\Windows\System\SPSXYib.exe
  2⤵
  PID:12112
- C:\Windows\System\CLuKhRP.exe
  C:\Windows\System\CLuKhRP.exe
  2⤵
  PID:6020
- C:\Windows\System\xxhzWts.exe
  C:\Windows\System\xxhzWts.exe
  2⤵
  PID:8092
- C:\Windows\System\XmskGcl.exe
  C:\Windows\System\XmskGcl.exe
  2⤵
  PID:6560
- C:\Windows\System\eWXdRkr.exe
  C:\Windows\System\eWXdRkr.exe
  2⤵
  PID:9464
- C:\Windows\System\yaLnqTn.exe
  C:\Windows\System\yaLnqTn.exe
  2⤵
  PID:13576
- C:\Windows\System\nvPuJTm.exe
  C:\Windows\System\nvPuJTm.exe
  2⤵
  PID:12532
- C:\Windows\System\hUEGePj.exe
  C:\Windows\System\hUEGePj.exe
  2⤵
  PID:9252
- C:\Windows\System\AEwYSGb.exe
  C:\Windows\System\AEwYSGb.exe
  2⤵
  PID:13752
- C:\Windows\System\kaeofuW.exe
  C:\Windows\System\kaeofuW.exe
  2⤵
  PID:5280
- C:\Windows\System\DjkKEpw.exe
  C:\Windows\System\DjkKEpw.exe
  2⤵
  PID:9848
- C:\Windows\System\CCAdCtW.exe
  C:\Windows\System\CCAdCtW.exe
  2⤵
  PID:14068
- C:\Windows\System\TkZmfKn.exe
  C:\Windows\System\TkZmfKn.exe
  2⤵
  PID:1064
- C:\Windows\System\gWaMcTF.exe
  C:\Windows\System\gWaMcTF.exe
  2⤵
  PID:12228
- C:\Windows\System\BhvCarx.exe
  C:\Windows\System\BhvCarx.exe
  2⤵
  PID:14240
- C:\Windows\System\XBxrGDI.exe
  C:\Windows\System\XBxrGDI.exe
  2⤵
  PID:13112
- C:\Windows\System\ZjUlCHc.exe
  C:\Windows\System\ZjUlCHc.exe
  2⤵
  PID:14092
- C:\Windows\System\csOINyo.exe
  C:\Windows\System\csOINyo.exe
  2⤵
  PID:14100
- C:\Windows\System\mmPfhee.exe
  C:\Windows\System\mmPfhee.exe
  2⤵
  PID:14136
- C:\Windows\System\pBbjyRS.exe
  C:\Windows\System\pBbjyRS.exe
  2⤵
  PID:12688
- C:\Windows\System\TUmzWPw.exe
  C:\Windows\System\TUmzWPw.exe
  2⤵
  PID:13068
- C:\Windows\System\ElLeARs.exe
  C:\Windows\System\ElLeARs.exe
  2⤵
  PID:14080
- C:\Windows\System\HVTsTGb.exe
  C:\Windows\System\HVTsTGb.exe
  2⤵
  PID:13368
- C:\Windows\System\ePtaFLH.exe
  C:\Windows\System\ePtaFLH.exe
  2⤵
  PID:8420
- C:\Windows\System\kgQypKt.exe
  C:\Windows\System\kgQypKt.exe
  2⤵
  PID:9416
- C:\Windows\System\zvTOwaH.exe
  C:\Windows\System\zvTOwaH.exe
  2⤵
  PID:13328
- C:\Windows\System\IEYxqko.exe
  C:\Windows\System\IEYxqko.exe
  2⤵
  PID:11092
- C:\Windows\System\EBOXvAn.exe
  C:\Windows\System\EBOXvAn.exe
  2⤵
  PID:12068
- C:\Windows\System\gHIDjIj.exe
  C:\Windows\System\gHIDjIj.exe
  2⤵
  PID:14084
- C:\Windows\System\lTPqVep.exe
  C:\Windows\System\lTPqVep.exe
  2⤵
  PID:13292
- C:\Windows\System\CeJqHYQ.exe
  C:\Windows\System\CeJqHYQ.exe
  2⤵
  PID:1040
- C:\Windows\System\qOIAnYH.exe
  C:\Windows\System\qOIAnYH.exe
  2⤵
  PID:4444
- C:\Windows\System\RPAmpUw.exe
  C:\Windows\System\RPAmpUw.exe
  2⤵
  PID:13808
- C:\Windows\System\UHBBjxP.exe
  C:\Windows\System\UHBBjxP.exe
  2⤵
  PID:9896
- C:\Windows\System\KAwmWAw.exe
  C:\Windows\System\KAwmWAw.exe
  2⤵
  PID:12008
- C:\Windows\System\XOekbFn.exe
  C:\Windows\System\XOekbFn.exe
  2⤵
  PID:13184
- C:\Windows\System\bExgVKg.exe
  C:\Windows\System\bExgVKg.exe
  2⤵
  PID:13704
- C:\Windows\System\MWonJLb.exe
  C:\Windows\System\MWonJLb.exe
  2⤵
  PID:13020
- C:\Windows\System\ilivLnW.exe
  C:\Windows\System\ilivLnW.exe
  2⤵
  PID:14060
- C:\Windows\System\DwoeZbM.exe
  C:\Windows\System\DwoeZbM.exe
  2⤵
  PID:6072
- C:\Windows\System\fwsoCVR.exe
  C:\Windows\System\fwsoCVR.exe
  2⤵
  PID:11428
- C:\Windows\System\rqhUtAQ.exe
  C:\Windows\System\rqhUtAQ.exe
  2⤵
  PID:14040
- C:\Windows\System\HmeQjQR.exe
  C:\Windows\System\HmeQjQR.exe
  2⤵
  PID:14232
- C:\Windows\System\wNQIHHt.exe
  C:\Windows\System\wNQIHHt.exe
  2⤵
  PID:11576
- C:\Windows\System\dtQqPbO.exe
  C:\Windows\System\dtQqPbO.exe
  2⤵
  PID:9328
- C:\Windows\System\wLIdyGr.exe
  C:\Windows\System\wLIdyGr.exe
  2⤵
  PID:10464
- C:\Windows\System\FOgGbEO.exe
  C:\Windows\System\FOgGbEO.exe
  2⤵
  PID:11204
- C:\Windows\System\IvmptEc.exe
  C:\Windows\System\IvmptEc.exe
  2⤵
  PID:9748
- C:\Windows\System\fDKjiIX.exe
  C:\Windows\System\fDKjiIX.exe
  2⤵
  PID:9220
- C:\Windows\System\FzJNGIP.exe
  C:\Windows\System\FzJNGIP.exe
  2⤵
  PID:12724
- C:\Windows\System\VbfJTRB.exe
  C:\Windows\System\VbfJTRB.exe
  2⤵
  PID:13528
- C:\Windows\System\kXSobcU.exe
  C:\Windows\System\kXSobcU.exe
  2⤵
  PID:10700
- C:\Windows\System\vDOhiGO.exe
  C:\Windows\System\vDOhiGO.exe
  2⤵
  PID:13460
- C:\Windows\System\HJJChrU.exe
  C:\Windows\System\HJJChrU.exe
  2⤵
  PID:7540
- C:\Windows\System\EDMxnuc.exe
  C:\Windows\System\EDMxnuc.exe
  2⤵
  PID:13356
- C:\Windows\System\DqHLbFh.exe
  C:\Windows\System\DqHLbFh.exe
  2⤵
  PID:11684
- C:\Windows\System\BECKOgY.exe
  C:\Windows\System\BECKOgY.exe
  2⤵
  PID:1752
- C:\Windows\System\XsYzvkK.exe
  C:\Windows\System\XsYzvkK.exe
  2⤵
  PID:4200
- C:\Windows\System\XYFsTnV.exe
  C:\Windows\System\XYFsTnV.exe
  2⤵
  PID:1684

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 532 -p 7072 -ip 7072
1⤵
PID:13084

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2608

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:13424

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3276

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hz1ulvr4.2rd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AVQTdJY.exe

Filesize
1.9MB

MD5
7d72e1081e7eff2801e13d82a4f6cbf8

SHA1
232640edadb9ce5f97ba0e7e5c2e560cf9f033be

SHA256
8ed710d496e9a7e57a6cfe39aaf678f7b03b355923994c95e1718206860885d8

SHA512
329ef21fcc6a94d8864c72a6b11bb3e9c6af3d816fb684ab7364beea8cb58ee567fee9f6cca7cdcba8f33f8c66bb11a80f7d6718d3b91122eefe48b2a0931532

Download Submit
C:\Windows\System\FnaXdMA.exe

Filesize
1.9MB

MD5
72347d6e967abbd401ab6ca8299b5245

SHA1
689fd3d6643c44d9aa34fa974a3f0f67576f31bd

SHA256
74682091c3c2a0efce420077a1bda0d0e5ab29e98af291ef137fb5767350979f

SHA512
f6ba87a61786b117df640a03ed1e761dfcb10b165ee8754904c58d1b4159be166e16fe4121d0f45cff307918ee6426f13d1f5d187b16f4fa497ace66106a4653

Download Submit
C:\Windows\System\HODxPLi.exe

Filesize
1.9MB

MD5
5ff017fbc79539c729257684bd8273ff

SHA1
737759e1f14074855371cd67297c3d4ae27ae2ca

SHA256
17f3c0890dcc2af0a55afd83a66c8073f8370001b31c5e9a7a54e0c48d0ea8cf

SHA512
afc2cc6f3d72bbb1c4fa962da063d4cef5b9225b75784a5f7236a4b21c4522f98a7d87965656dc253fb7cf2750866a0467f4e83abd1ad2049fdffa30c8f34df2

Download Submit
C:\Windows\System\HsZIxwB.exe

Filesize
1.9MB

MD5
58981eb486125537376ed8bcb3d4eeaa

SHA1
5479d102a32fb269542d7785d7a07f9168f60d8f

SHA256
1b0acda6d4cf0131c0aa16555cd814df63e8410aa554c80f37c511b9dd148162

SHA512
89f9e4d21f7ea9d596143c35a37d922de46d98fc3ba6f07da092d86d8a8c26eaa4ef965e42ccd2f29dd598807fd8c244a9b88ef05255fc25dd426a84444f4524

Download Submit
C:\Windows\System\KZgLZwd.exe

Filesize
1.9MB

MD5
cc75432019441bc5b71b56e014b8880c

SHA1
97a9cba5ab810d13b99f3cbc32ab8795ac278eb0

SHA256
dec77d38e8074961069294cfce5e65f85dbe084920fcdb12ae3ca42549531e92

SHA512
c2fb73fd9f72d7ceda56f9fb24f6cf1afa507db575ee93155f8a098bb7bbebec780c70697390de1cee924fd0f98ec4942a5188630f1c787cd8b081e41e2578c4

Download Submit
C:\Windows\System\LCctUqb.exe

Filesize
1.9MB

MD5
4d7e15d8b248089fbfeb1fbf61be8a48

SHA1
69065e6a7a0d81708d63398e1481c41b36d576bc

SHA256
df357de39fbe6313442030336ab03f2154b48f189814747e8d1adb1de912b7d0

SHA512
0576ed9b7eb75884c7befe3db70bdedff35012f265886dd5cf2379bd5840000beb92f240939a585ada6bd9b66f9539e9bef8f5f4e196fddc8d40b4d1321c7805

Download Submit
C:\Windows\System\LcPbnae.exe

Filesize
1.9MB

MD5
4a0dd0f6902438ae37690386fb44cf82

SHA1
8b0952bd1aae6d30d6026ea199456ec715f1efc4

SHA256
c208d78cf2cc1129fd23a395a9100c2140382e9d4c889c591ae9fa639ab5d588

SHA512
6a8e1d2eaf3adac932736cd493a8b40b093b1c096f2cedb1d90c67597fe5207b6c3c6878fe13fd79cc9d8ba686a513f5b5aa2ae094477e9bbc6d072b9a294223

Download Submit
C:\Windows\System\MRurZtp.exe

Filesize
1.9MB

MD5
8e3c2a383b565c599a7c30ddaf256875

SHA1
a6e0d149533029ef560fafaee84ea7e323d9fa6c

SHA256
8899ad033380555e8179f0e970e90e47d69940c165318c75bff7c4b86e241ebb

SHA512
d681847e220ae320921eb05ce4d2543ac38a70f5509d7599830017751179cb64645dfb3c84f2251049ea967e7fa574395a2f5ae46071768af71bfd80cded794b

Download Submit
C:\Windows\System\NiSJmXa.exe

Filesize
1.9MB

MD5
81cc4d977bf8d5cb6b69f1a452c46252

SHA1
0cce40425cc023fdc4c9826e315b69a15b267176

SHA256
e6abdafc9bf9b9a080779e301b3687d3e919def184a07974382e294d02dc95dd

SHA512
6471c308cdeaf557c4df6bbbd4530000cd7db4b0d947677c9ec6a4f4fab78069721b83226fa2139d1794d716f5639ba983fb6820e770ae21653e7a8ede10237e

Download Submit
C:\Windows\System\PBGAsbl.exe

Filesize
1.9MB

MD5
05ead68d6a3e74fbf10b163eec857b4d

SHA1
cd47d16f9e672f6d4dc0fbaf97292829a8237a73

SHA256
0ac249be8be8b169bbc721cf43e63189a3da0e8709a2622baa6c2d1c339e1eb7

SHA512
19419d0265b23a932b92e17099695342eb78df1b3c26d597087109e718c26fefff53b13dd2cd4700a3c3d43df460f891484db85b10a2815597a634b283b26365

Download Submit
C:\Windows\System\RtdKuiG.exe

Filesize
1.9MB

MD5
9bb9c89b1e3535f996f3c007b5f2cb28

SHA1
3a929df83aa4add883e085cabc024792e694e6e2

SHA256
017ac695c1ee7cb49edc535f88f2ed442bbde2cde454c88aba6ca9a39d528f48

SHA512
e0308ebdd9df1388501fd91d57dac21e63822ed800678b35aef44e0f4a7621b16cbe6c4bad255581f83ca3df1e14469aa19c5abcfa77454f72d3072452b94b72

Download Submit
C:\Windows\System\UFkCCSA.exe

Filesize
1.9MB

MD5
9aa67c81184bba298b6eda0ea11c7c84

SHA1
20e090377e9b74815c188ba321f77e3fbb0d53d8

SHA256
31f01db803a4ccfa2f293694c3811e976689b411da2f041c54d0ed65279a7de8

SHA512
001c9666ae98b650f7a5419e7c1033a2b1a71ba1b4f66feb91d7d90cca03805d0a368584636ce1acd8633176a59379707d2ce22bcfac303efeb4700981b49554

Download Submit
C:\Windows\System\UqYDkyU.exe

Filesize
1.9MB

MD5
f3eb6cc9466598f9d067937c91748781

SHA1
e8b9e7a7afb36c16ac89f99dbb0a07ba1fa3760e

SHA256
2bb2d32e1e811cc1eb4c7a882d2218e0aac274ea3a83e97ddbee64d0e68d6e6b

SHA512
b2090a335c2f1c92b9b9d9ea9d8ef59e18d93320068ceab706e8d4483096e10d57c94684fcb742e6dbf4d24c362401887db83ef4dbace05d3f17ae13b73a4ad9

Download Submit
C:\Windows\System\WUEqpdz.exe

Filesize
1.9MB

MD5
91c9e59a4864b442e8f0a520d4569288

SHA1
4dcaed932e00f4c1ac4fb66afc8af1051e1bd908

SHA256
b64397bf8d87a5a0aa1c825a7a2442518fe1b2bfd99cca07879da37dae922c45

SHA512
25679e3adb87cadd9ff4e5d38c801a04f5f4c8bab190947314f6156247f87f4eb735d705d062e8b00e81c6eb14bd72359c3025aa1d896d3b17c4c721420ab54a

Download Submit
C:\Windows\System\WbrkvAX.exe

Filesize
1.9MB

MD5
b073a9633192cbe0681789fdfd991845

SHA1
afca840bb0319b66b6513afb18ade50b03ae1bdb

SHA256
6b35f8c42c0729487d2c00cd35c314ac73cd86508a9c8d5090e17a59787cf01f

SHA512
543aa2175781771d95235ed1b2e7b3fdada72a82d06f72ebcdbb5bf8dd7478df9b998a4924d98f1854ffeb8dbe92cc23494140946fb696191f1932c2b70ef595

Download Submit
C:\Windows\System\WiUcrEV.exe

Filesize
1.9MB

MD5
8c21e75e5aab0cb80c1046e63fdd168c

SHA1
7eff34a63a4b4eaf5b842333c3ba8be9eb5fe0ce

SHA256
911a82a04208e39257c167d405dbb17f7c2e1533126ec1513560ce0692137284

SHA512
96023d8909f3f33bc9bb76433beae84f368c39a4bdbf47f4567f11a52e9b00e2019dd6c37893f293aaa3e72bc024ab131a4ff780b4cee9cad3f121d2fa0a8061

Download Submit
C:\Windows\System\XlmOzcv.exe

Filesize
1.9MB

MD5
f4db0fcc44b2ff6ad36b32f76902ba98

SHA1
3be9197fe74f69ed0a1d8255cabb78c8afe1dc1f

SHA256
d9ba8e630cbdf919db070f0ef23cb782eb58607efa8e2604b2051e9d81d0812c

SHA512
5596722bbb96dc26c52bb9cbb595df49bc83080d1dcb85e58959117bb82dcab13afd009cc2fab42fc4c4356ac4f961f26df4ff93e3405d4598f9b9ffd1fa48b5

Download Submit
C:\Windows\System\XzffESO.exe

Filesize
1.9MB

MD5
eb640d7b0e3cced5dd7ddc26a1a8b460

SHA1
c55848b1c5e5693f5c67fcf64ec68346c6d8d6b2

SHA256
ac0284df60355a42c39f7a508889d15a22323faa8e2b2fe3b0f9b5696a774f91

SHA512
263de95c3ca2384274e653d5806ce2860984b2eb3e7bfb68d47b247bb7ea2aebbdb787e021fb1c0b7b778380a2ae4b04cb017f11730f8042eafb837e5fcf087a

Download Submit
C:\Windows\System\ZrKcZmG.exe

Filesize
1.9MB

MD5
2a24f0664cb9564ac46c2ecbbad441e4

SHA1
a288d2d2557d90846fe33c5caff74a1bf4845b72

SHA256
4ef9d2825567e44e42c8219000463761bf182996eac66a3bce24bdc350f2db21

SHA512
fa30bf15e1cc6404f67d466c794efb21a3c3e88ea899b5fdda2fab5f001c28fca013500dafce34af3c299e6bbdc1ff8b97b19b810cc0adf83a672d2ea533d461

Download Submit
C:\Windows\System\dKdtvzv.exe

Filesize
1.9MB

MD5
7007295ccf2b77abaadeeba5fdf5c3d3

SHA1
37eb9e02aef509358dcd86ec1e5b32530d1e92ae

SHA256
0bc6c3bec7f9a4a025768fbd08b9b9875a96f0a23edc30f49535c6f97fa74980

SHA512
6a68cd3f7ce1e1b0d351b0a559c40480bdd78a4da4776002c9f4b583faf45cf308cfabead7b6d516994bb7fc8456822b46a529b46c543eb13f4d2b97de75b9af

Download Submit
C:\Windows\System\dLcRPHX.exe

Filesize
1.9MB

MD5
63384e6a7d56b447dac900f81aad6c4b

SHA1
9af51a00c62993d3216b7f0a9281107d7cbabca8

SHA256
fa30faeb8a0b6dccf90ea8e8c6a97688c1e3b36873ec595bd2dfb01a04e38a0d

SHA512
41eb92c6ff66e7b438415c1ca9cacbb2697869ab1cc894ee192a6d27671489ee47aee2ebacd84a307821e9aef7819259fd2913c74860c83a97665f3b8132ad59

Download Submit
C:\Windows\System\eVScDkC.exe

Filesize
1.9MB

MD5
4a9e061a35d701efd0ceaa8de8a8be08

SHA1
68ccb1a724a5cbb096b53888d83a4d72d1dd9a4b

SHA256
9fc768c467ff97ee7b939cc09b3b00954c8cba0252c82b334f633b57248daaee

SHA512
7c12c9a5f42e97e49fc58c5163affd437d359ac306bd62d7329cdba2fc6cc3116659f12bf51e080caf209670d41d0ca6d2a03250e3c4655c7e181324247df5d3

Download Submit
C:\Windows\System\fxDjHUg.exe

Filesize
1.9MB

MD5
215ff11aec7a099dcc44f41564381930

SHA1
1b1f5390138932c95a85d14289d5e66dc20fd4bf

SHA256
5f4e2f4ed3c934f49b41a030660ae751cc58e267ef8ee2abb4fccba80de32e69

SHA512
035dfb1ec74844970e261b23fb5e756f1fd975415f037d5b9a574cd01f669c2d6dd1f46e886544fea01e124e0fe367fcee7b33f9aaf7a49486c6d3f7cf936922

Download Submit
C:\Windows\System\hxAVLZS.exe

Filesize
1.9MB

MD5
527f2dc66c1be2bf33ccb3512919c006

SHA1
118fc6fba05776164466a4e0915cf100a53ac3db

SHA256
fa3bbfee653c423219c53050d75b613a0f2833e133bef46b2449fd620a6650ec

SHA512
fd2122a12c3f6a95af9fb9667647b6921fe8627eb7df89d98f521f8dc19ab6b1092943148e759dedf7a4de7d160401cd61d29bdc2fcabc5d6ac49d8e6f15323a

Download Submit
C:\Windows\System\iIfFMPT.exe

Filesize
1.9MB

MD5
f068b99975079c4e79bffdebdcd48b70

SHA1
7d8a6e9dd303af1299ce960c8d00119d20f692cb

SHA256
81ff14aa4d62de974602319faf79a841cfd73dd233801c6472064e6b97ad464d

SHA512
a5cbe6a066ccb781690f0294cc14dc866ab1d413f12c0bf6dfa80242b67e51d08238e02263bf1bf0d0423f0673c101cbb7b471cf76ca1b7155e22155d4c3dc6f

Download Submit
C:\Windows\System\jRyoDYY.exe

Filesize
1.9MB

MD5
07ef6edac864c32f7ff3e99b5a216b1f

SHA1
97401320a1ee95adb55aa821fc52cbceeecd6c62

SHA256
6c1eba6bdf769d75d1909f8318a5e8c80fa7a4395f1f8195c94fe1a1d8b4477d

SHA512
3dfe968acfeb6668389192a7bc0ddc5f6d4b8206dbe463af605dd05b9c52d08400155d3b560ca50409d549a7b3ebb404200a4aa5142fabfa18eaef878877d53f

Download Submit
C:\Windows\System\lQUouyu.exe

Filesize
8B

MD5
3277aa72bb7d7f1eb1043502fbd1c406

SHA1
8712dca2f3fbc82bf0cbbeecdc5d6a26c87f443c

SHA256
e94b62f30c9ce8b0b5cea14d4367a52fe08005d1bd56ca932a1fd7fc15c61bc9

SHA512
9fb0369549dba8937fb796cbc4ade6bacf540f10f98e02675f1b04c615cbb49e396cdbd25cd29de56c7bfb889c8464199939a84fa31434a75c020caeb4f9f503

Download Submit
C:\Windows\System\ljDIcvC.exe

Filesize
1.9MB

MD5
d390533aa464ac9822738d3a35e46d4b

SHA1
d3c3219a1021d6b4c5de09ecc7b1ff25f745f1eb

SHA256
6a7289852313bfb5ac4aff00e2afe2a752c17966cf000edf993813bc68bfff9a

SHA512
bf1c32e383fdcc9cef3da6fea92166243fb12c2a1f39c57b8b9964a7c641bc861f30725f04d7d877c5ffb6963cc520e48d5785e0cd0e5eed68a2f176fc93957f

Download Submit
C:\Windows\System\mLmpvNj.exe

Filesize
1.9MB

MD5
116cc7e2a07409c0d4fafa18cc8d0a60

SHA1
bd000a0102c4052667fc0ad46ddbcc2034fd913d

SHA256
8603b189af64e3a66755673faec34e563ba9518dfb092d40158b6e6087254ad1

SHA512
7a893ef0d37da9dc996846ddebb85c9651fb1683619803f36a0ec2c878376edf77ef60aa6ed07f0d342fe4318eb6837c07ff676e559233e7783caf5599034456

Download Submit
C:\Windows\System\pwxktqC.exe

Filesize
18B

MD5
245dee33bd0829fb0a14fffbb01cddca

SHA1
3098465efbb0ab58d084dea73fb53b7464aa2124

SHA256
42ab9954ae85f062ea70b5a38d7cb35251b9594624f80f499a57a579cabb5d86

SHA512
4a249b410305275b4e8f1049bfb6debe0c906ca24cdd1c084f91263bd1208ad51b8937135ff9506b71885993cc7bafe2c69d5ba8bf11fa3ad12e247f4d803429

Download Submit
C:\Windows\System\qASrVwK.exe

Filesize
1.9MB

MD5
cad4a456c5a2074d7be318d26b97ac22

SHA1
44c7ebe8b1b2af5140988767edb8fbad3da9b64b

SHA256
e7544d5bb48b329d0ed1496439f3a2b6a9b324a41612aa8172d7c493cdae973c

SHA512
6b94855339173de07d44436e9db42c3f9837a0bca9141724f0b2640617e2b541e01738342d99c7b3715346521f2aba0526ee51b330f2c9f5d7974b0345ca736d

Download Submit
C:\Windows\System\sTJFxlF.exe

Filesize
1.9MB

MD5
e7b9f01f2888472856cca774736014d9

SHA1
d8fafce984feb57fec1f4cebcc3d2e66cddf90f1

SHA256
fa18d2033eff0844779001bdf9115e2a0bfedb57c91d725f31cc1d58f5800098

SHA512
20365fb8d191104eb5075fbb50f0e4275b2f4a2af67319cfd813e8b5cc3352ab8044e6070dd293942780410b2b8560627cd1d13aab5a7fc6f81ecf0e930a2bca

Download Submit
C:\Windows\System\szwXPai.exe

Filesize
1.9MB

MD5
11120d42bb3de86fd02c7cbe036d9b48

SHA1
d1b2a6ec08120f2a43a09a95b513b669e9bfcfcf

SHA256
a89b3b9f6ae405e448c6061acbd729af432624e1fd2ce18e34814114aeb65506

SHA512
7c2e0902a5d170511f950e05edae508178b2a380bf6aff5d46b15622d657b66d9c7a6e6fe73e9e5ab51b84368897b28a312ff79c1b17e78242642085b9809979

Download Submit
C:\Windows\System\tteirTo.exe

Filesize
1.9MB

MD5
6545ce1b15a568d64761a0c37d9df4eb

SHA1
f3b582a3271fa351e10ca3c594027b3586804e47

SHA256
268940e7029c18a5a691bb30f42adb53f4d4b5386598989799fc1df54c92cea7

SHA512
b83e5d1ec7f69e0fe7b33c51d1474c0159638dbe53b6b1539325467c973a7bc3da0b669b1bc8a0af51123c01468e84d7d185336ad87d843479dc0bdc503f04e9

Download Submit
C:\Windows\System\uKhLiOG.exe

Filesize
1.9MB

MD5
f8f43cfb20f9703e1c1d43c67fe02eaa

SHA1
411168470f81497f6e94949a63516999de0417f5

SHA256
eb2d87ce2a14766d08891fcecf4c71af14bb94f5932a5fe1c01722c0a96b2242

SHA512
f56bb1e833fe1f261fa51e67a2091a35b1ab2602ff67feb7d16d4409bb0e0f56aaa25090f8bafd131e3e5052a2806b15ee28c5ccefd1e836d5c9e388d25ce4ad

Download Submit
C:\Windows\System\vAOsepn.exe

Filesize
1.9MB

MD5
d1849bf342bd21d4c1fcfeec2ac0534e

SHA1
5425bb49fbda3330f153a51240267693f3265419

SHA256
b3659ba0fdd0d29005bd16973022404bd327438c5c6956d8f0491c1bac334efe

SHA512
a4ce66b78594d07af328a4c8bfd21f515e2d1f5c03980fdb74032b580de3884e55f4a24fefcbc3d53dd88ac9548dfa6d2b90606931879765704df8fe05e38363

Download Submit
C:\Windows\System\xGqCSRT.exe

Filesize
1.9MB

MD5
8c04efc95c0847e8df410a8d6135e665

SHA1
2383c24c02f1643b49ba24ee2b2da00380a57747

SHA256
e1d211e540028b30c6c930b35685316570387ce0b7082da476a287b3faec7ea1

SHA512
32cfe04b276d0b47aeb958729a531d067cf394dac3dc3e3a45f69b35c2ae33145180829cb690782e1caf25b8b90f8d3e830000f1deb22dd0e18430f72882c409

Download Submit
C:\Windows\System\ylPAmsM.exe

Filesize
1.9MB

MD5
95ed745b5b37f2bc16271b24e0716779

SHA1
c9e6ae8094cf08b4a694be0f769a9e251c5067c3

SHA256
f22e8ba676b06792226da8f7de397038ebfa5591f16fc3795f9612a316a6fa53

SHA512
c986b34790379dada6286cd5963e7c299e0c15a4eeee8d61b667f89c027354d7f3944ad63e35fd9bc71b7fc07c0ec8b20082a220daebcc503dd1466cb983ae37

Download Submit
C:\Windows\System\zqKbRuC.exe

Filesize
1.9MB

MD5
d0171d5a0ec7d8660a172cbf36776e68

SHA1
a74458c6b81cd6a6971ed662d95a2f8611306d81

SHA256
9d436d657dc4b90919cad6021f77ec724488aa6d53ca5d56a585d132cc65aba9

SHA512
f706a45217e7eb34833aa0eb85cb4fd8b26980314ee0d66578a40d3daa0f7630462b440d536cb6ca90f4305349e764625cfb746537ffee7b19a859d9ab713bb0

Download Submit
memory/1336-6407-0x00007FF791720000-0x00007FF791B12000-memory.dmp

Filesize
3.9MB

Download
memory/1336-399-0x00007FF791720000-0x00007FF791B12000-memory.dmp

Filesize
3.9MB

Download
memory/1420-127-0x00007FF620800000-0x00007FF620BF2000-memory.dmp

Filesize
3.9MB

Download
memory/1508-284-0x00007FF6291F0000-0x00007FF6295E2000-memory.dmp

Filesize
3.9MB

Download
memory/1764-6237-0x00007FF753650000-0x00007FF753A42000-memory.dmp

Filesize
3.9MB

Download
memory/1764-910-0x00007FF753650000-0x00007FF753A42000-memory.dmp

Filesize
3.9MB

Download
memory/1916-205-0x00007FF74F8C0000-0x00007FF74FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/1984-347-0x00007FF60F9A0000-0x00007FF60FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2112-6400-0x00007FF798200000-0x00007FF7985F2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-607-0x00007FF798200000-0x00007FF7985F2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-228-0x00007FF71D830000-0x00007FF71DC22000-memory.dmp

Filesize
3.9MB

Download
memory/2312-6409-0x00007FF7BF0C0000-0x00007FF7BF4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-913-0x00007FF7BF0C0000-0x00007FF7BF4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-647-0x00007FF6CD030000-0x00007FF6CD422000-memory.dmp

Filesize
3.9MB

Download
memory/3112-316-0x00007FF7A3280000-0x00007FF7A3672000-memory.dmp

Filesize
3.9MB

Download
memory/3112-6355-0x00007FF7A3280000-0x00007FF7A3672000-memory.dmp

Filesize
3.9MB

Download
memory/3240-87-0x0000026BA21E0000-0x0000026BA21F0000-memory.dmp

Filesize
64KB

Download
memory/3240-84-0x00007FFA33CB0000-0x00007FFA34771000-memory.dmp

Filesize
10.8MB

Download
memory/3240-221-0x0000026BA2160000-0x0000026BA2182000-memory.dmp

Filesize
136KB

Download
memory/3660-5379-0x00007FF6C6CF0000-0x00007FF6C70E2000-memory.dmp

Filesize
3.9MB

Download
memory/3660-1-0x0000020ACA7B0000-0x0000020ACA7C0000-memory.dmp

Filesize
64KB

Download
memory/3660-0-0x00007FF6C6CF0000-0x00007FF6C70E2000-memory.dmp

Filesize
3.9MB

Download
memory/3724-6366-0x00007FF7F23B0000-0x00007FF7F27A2000-memory.dmp

Filesize
3.9MB

Download
memory/3724-467-0x00007FF7F23B0000-0x00007FF7F27A2000-memory.dmp

Filesize
3.9MB

Download
memory/4004-398-0x00007FF632810000-0x00007FF632C02000-memory.dmp

Filesize
3.9MB

Download
memory/4136-10-0x00007FF705D30000-0x00007FF706122000-memory.dmp

Filesize
3.9MB

Download
memory/4152-317-0x00007FF652C90000-0x00007FF653082000-memory.dmp

Filesize
3.9MB

Download
memory/4628-645-0x00007FF76CEE0000-0x00007FF76D2D2000-memory.dmp

Filesize
3.9MB

Download
memory/4640-124-0x00007FF75FDF0000-0x00007FF7601E2000-memory.dmp

Filesize
3.9MB

Download
memory/4764-6332-0x00007FF66F470000-0x00007FF66F862000-memory.dmp

Filesize
3.9MB

Download
memory/4764-227-0x00007FF66F470000-0x00007FF66F862000-memory.dmp

Filesize
3.9MB

Download
memory/4952-646-0x00007FF7544C0000-0x00007FF7548B2000-memory.dmp

Filesize
3.9MB

Download
memory/4952-6386-0x00007FF7544C0000-0x00007FF7548B2000-memory.dmp

Filesize
3.9MB

Download
memory/4984-466-0x00007FF600370000-0x00007FF600762000-memory.dmp

Filesize
3.9MB

Download
memory/5096-6398-0x00007FF6FFD80000-0x00007FF700172000-memory.dmp

Filesize
3.9MB

Download
memory/5096-525-0x00007FF6FFD80000-0x00007FF700172000-memory.dmp

Filesize
3.9MB

Download