xmrig | a255cce6e1276a5fd066d675917a641db8f40b2f0abaa01fbe4d864b6725e5fd

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
Size

1.9MB
MD5

04671ca5646e3be595c34e8e2f62b027
SHA1

4b989aa5c0300bb2fc7dae73effdc637f5667ae7
SHA256

a255cce6e1276a5fd066d675917a641db8f40b2f0abaa01fbe4d864b6725e5fd
SHA512

4e8d7acfd9e6a5fac2f264835d3b06c8e9425bdeef23c5e5581273033304bcf200ee89c04094136fd1fb7974f17a1016fbcc6f68b44fb2a14570750b99b81258
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UX:NABQ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral2/memory/2396-16-0x00007FF6C8910000-0x00007FF6C8D02000-memory.dmp	xmrig
behavioral2/memory/1880-97-0x00007FF7546C0000-0x00007FF754AB2000-memory.dmp	xmrig
behavioral2/memory/4312-134-0x00007FF754AE0000-0x00007FF754ED2000-memory.dmp	xmrig
behavioral2/memory/448-130-0x00007FF6FE500000-0x00007FF6FE8F2000-memory.dmp	xmrig
behavioral2/memory/2028-123-0x00007FF6BB190000-0x00007FF6BB582000-memory.dmp	xmrig
behavioral2/memory/4844-119-0x00007FF72CB90000-0x00007FF72CF82000-memory.dmp	xmrig
behavioral2/memory/3196-104-0x00007FF757520000-0x00007FF757912000-memory.dmp	xmrig
behavioral2/memory/2456-101-0x00007FF717E30000-0x00007FF718222000-memory.dmp	xmrig
behavioral2/memory/4348-98-0x00007FF7C1AA0000-0x00007FF7C1E92000-memory.dmp	xmrig
behavioral2/memory/3444-91-0x00007FF680840000-0x00007FF680C32000-memory.dmp	xmrig
behavioral2/memory/2640-47-0x00007FF7E5820000-0x00007FF7E5C12000-memory.dmp	xmrig
behavioral2/memory/1548-42-0x00007FF707390000-0x00007FF707782000-memory.dmp	xmrig
behavioral2/memory/2396-2372-0x00007FF6C8910000-0x00007FF6C8D02000-memory.dmp	xmrig
behavioral2/memory/2900-2373-0x00007FF75B970000-0x00007FF75BD62000-memory.dmp	xmrig
behavioral2/memory/3832-2374-0x00007FF6EFC10000-0x00007FF6F0002000-memory.dmp	xmrig
behavioral2/memory/3284-2375-0x00007FF6D1340000-0x00007FF6D1732000-memory.dmp	xmrig
behavioral2/memory/3444-2377-0x00007FF680840000-0x00007FF680C32000-memory.dmp	xmrig
behavioral2/memory/5016-2378-0x00007FF7C9EE0000-0x00007FF7CA2D2000-memory.dmp	xmrig
behavioral2/memory/1856-2403-0x00007FF7CCEE0000-0x00007FF7CD2D2000-memory.dmp	xmrig
behavioral2/memory/3960-2411-0x00007FF67B130000-0x00007FF67B522000-memory.dmp	xmrig
behavioral2/memory/2648-2522-0x00007FF6167E0000-0x00007FF616BD2000-memory.dmp	xmrig
behavioral2/memory/4740-2519-0x00007FF761330000-0x00007FF761722000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4252	CJHbnBl.exe
2396	DTBhpun.exe
2640	zTFmHMm.exe
1548	zpjPTkC.exe
2900	srUEotI.exe
1880	WXslMwP.exe
3832	OowVUlI.exe
4348	dSuyMSG.exe
3284	oMnpPPj.exe
1856	AQTnhkK.exe
2456	JSSTUhQ.exe
3444	GoYrXXt.exe
3196	vwbDAfq.exe
2028	IDuRqfR.exe
5016	Gqkiasu.exe
4844	hkbzHam.exe
3960	qutLwBc.exe
448	mGdyydk.exe
4312	mJocEeM.exe
4740	jYNrcaV.exe
2648	QMCfyAY.exe
4372	dQestpu.exe
3640	ASpkLMe.exe
516	LdFRRfk.exe
2140	gsqECvu.exe
2008	UkpvqDy.exe
2828	GuLmkQa.exe
4840	UcWySCx.exe
4992	ORWySGX.exe
5012	LdCnYWo.exe
3032	STkYmyK.exe
1484	wKJawSt.exe
1056	wBBeiNd.exe
4332	xRNQjYY.exe
1736	YWDyEmQ.exe
1500	HojtHLw.exe
2316	Hvvrtwj.exe
2416	tbRdldU.exe
4248	IUAmAqn.exe
668	UDzHONq.exe
3452	ZQxztuc.exe
3952	lKDBQgC.exe
3228	JuftOhE.exe
4396	IsBGqaB.exe
4944	LJelXwz.exe
2872	egdPpfa.exe
3824	cgqNIpk.exe
624	qdRyTru.exe
1352	nripmQd.exe
512	HUZUMXE.exe
2452	WeEgtcy.exe
3184	yQEcsdN.exe
3624	PoyVPmT.exe
2288	allKZFT.exe
4540	sJNHZtx.exe
1884	oMVBivc.exe
372	ULuOnRA.exe
1576	soLqdcJ.exe
2772	hAdBOnB.exe
3080	Fwakcrq.exe
4424	apowiwu.exe
3676	PSZmgym.exe
4344	cseuCAp.exe
4572	arJswhZ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1764-0-0x00007FF72A220000-0x00007FF72A612000-memory.dmp	upx
behavioral2/files/0x000a000000023bc7-7.dat	upx
behavioral2/files/0x000b000000023bc2-5.dat	upx
behavioral2/memory/2396-16-0x00007FF6C8910000-0x00007FF6C8D02000-memory.dmp	upx
behavioral2/files/0x000a000000023bc8-23.dat	upx
behavioral2/files/0x000a000000023bc6-11.dat	upx
behavioral2/memory/4252-9-0x00007FF7FC1D0000-0x00007FF7FC5C2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc9-41.dat	upx
behavioral2/memory/2900-55-0x00007FF75B970000-0x00007FF75BD62000-memory.dmp	upx
behavioral2/files/0x000a000000023bcf-74.dat	upx
behavioral2/files/0x000a000000023bd2-94.dat	upx
behavioral2/memory/1880-97-0x00007FF7546C0000-0x00007FF754AB2000-memory.dmp	upx
behavioral2/memory/5016-115-0x00007FF7C9EE0000-0x00007FF7CA2D2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd6-120.dat	upx
behavioral2/memory/3960-129-0x00007FF67B130000-0x00007FF67B522000-memory.dmp	upx
behavioral2/memory/4312-134-0x00007FF754AE0000-0x00007FF754ED2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd9-142.dat	upx
behavioral2/files/0x000b000000023bdf-179.dat	upx
behavioral2/files/0x0008000000023bf9-196.dat	upx
behavioral2/files/0x000a000000023be9-194.dat	upx
behavioral2/files/0x000e000000023bf0-191.dat	upx
behavioral2/files/0x000b000000023be1-189.dat	upx
behavioral2/files/0x000b000000023be0-184.dat	upx
behavioral2/files/0x000a000000023bde-174.dat	upx
behavioral2/files/0x000a000000023bdd-169.dat	upx
behavioral2/files/0x000a000000023bdc-164.dat	upx
behavioral2/files/0x000a000000023bdb-159.dat	upx
behavioral2/files/0x000a000000023bda-154.dat	upx
behavioral2/memory/2648-145-0x00007FF6167E0000-0x00007FF616BD2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd7-140.dat	upx
behavioral2/files/0x000a000000023bd8-138.dat	upx
behavioral2/memory/4740-137-0x00007FF761330000-0x00007FF761722000-memory.dmp	upx
behavioral2/memory/448-130-0x00007FF6FE500000-0x00007FF6FE8F2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd5-124.dat	upx
behavioral2/memory/2028-123-0x00007FF6BB190000-0x00007FF6BB582000-memory.dmp	upx
behavioral2/memory/4844-119-0x00007FF72CB90000-0x00007FF72CF82000-memory.dmp	upx
behavioral2/files/0x000a000000023bd4-111.dat	upx
behavioral2/files/0x000a000000023bd3-108.dat	upx
behavioral2/files/0x000a000000023bd0-106.dat	upx
behavioral2/memory/3196-104-0x00007FF757520000-0x00007FF757912000-memory.dmp	upx
behavioral2/memory/2456-101-0x00007FF717E30000-0x00007FF718222000-memory.dmp	upx
behavioral2/files/0x000a000000023bd1-99.dat	upx
behavioral2/memory/4348-98-0x00007FF7C1AA0000-0x00007FF7C1E92000-memory.dmp	upx
behavioral2/memory/3444-91-0x00007FF680840000-0x00007FF680C32000-memory.dmp	upx
behavioral2/memory/1856-86-0x00007FF7CCEE0000-0x00007FF7CD2D2000-memory.dmp	upx
behavioral2/files/0x000a000000023bcd-81.dat	upx
behavioral2/memory/3284-77-0x00007FF6D1340000-0x00007FF6D1732000-memory.dmp	upx
behavioral2/files/0x000a000000023bce-75.dat	upx
behavioral2/files/0x000b000000023bcb-71.dat	upx
behavioral2/files/0x000b000000023bca-69.dat	upx
behavioral2/files/0x000a000000023bcc-67.dat	upx
behavioral2/memory/3832-63-0x00007FF6EFC10000-0x00007FF6F0002000-memory.dmp	upx
behavioral2/files/0x000b000000023bc3-58.dat	upx
behavioral2/memory/2640-47-0x00007FF7E5820000-0x00007FF7E5C12000-memory.dmp	upx
behavioral2/memory/1548-42-0x00007FF707390000-0x00007FF707782000-memory.dmp	upx
behavioral2/memory/2396-2372-0x00007FF6C8910000-0x00007FF6C8D02000-memory.dmp	upx
behavioral2/memory/2900-2373-0x00007FF75B970000-0x00007FF75BD62000-memory.dmp	upx
behavioral2/memory/3832-2374-0x00007FF6EFC10000-0x00007FF6F0002000-memory.dmp	upx
behavioral2/memory/3284-2375-0x00007FF6D1340000-0x00007FF6D1732000-memory.dmp	upx
behavioral2/memory/3444-2377-0x00007FF680840000-0x00007FF680C32000-memory.dmp	upx
behavioral2/memory/5016-2378-0x00007FF7C9EE0000-0x00007FF7CA2D2000-memory.dmp	upx
behavioral2/memory/1856-2403-0x00007FF7CCEE0000-0x00007FF7CD2D2000-memory.dmp	upx
behavioral2/memory/3960-2411-0x00007FF67B130000-0x00007FF67B522000-memory.dmp	upx
behavioral2/memory/2648-2522-0x00007FF6167E0000-0x00007FF616BD2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zrcgBsp.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\PwKFFTg.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\PkIhgar.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\bnXUMud.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\Zmxmfjd.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\ItMGofc.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\KccGngc.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\xyniWwS.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\PkscXet.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\fPfxuHl.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\PAupALd.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\wavoSWw.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\EnYnpgA.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\OfYMlzG.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\KaOoJQr.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\Vzgysjf.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\lwhixOl.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\lTcmRmg.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\oOzKjzr.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\BaXTizo.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\QbYUUWw.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\iWeSJGA.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\XjasrmS.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\VEedWPY.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\iAYOoDy.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\muNNqMg.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\dGbpIJJ.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\aGkNvbr.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\xywvzTV.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\Iowgdpj.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\BQKBgkc.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\cppcUTH.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\hlWobxK.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\kbGdJIl.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\rjlEvUv.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\oXoHwCx.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\fvTpqlA.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\bOUdpuR.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\RUVpKZc.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\fnKTAud.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\zXGXVOp.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\Fslmbnx.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\KijgfbD.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\bAojfGV.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\pHqlmHD.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\ToliLWP.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\pSgGDFD.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\TvCYten.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\rUYdnEv.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\CAWwfjO.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\UPeEnoe.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\RLFcQGi.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\WJVoOyJ.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\KseoqBZ.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\BlTlWvS.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\gfzyHPQ.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\WZDjvmS.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\MyWjWFK.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\fuKYFZE.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\dXZVKSp.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\oxLXCYm.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\BwPlCYy.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\nbTvhwl.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
File created	C:\Windows\System\AQTnhkK.exe	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4884	powershell.exe
4884	powershell.exe
4884	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeLockMemoryPrivilege	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 4884	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	85
PID 1764 wrote to memory of 4884	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	85
PID 1764 wrote to memory of 4252	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	86
PID 1764 wrote to memory of 4252	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	86
PID 1764 wrote to memory of 2396	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	87
PID 1764 wrote to memory of 2396	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	87
PID 1764 wrote to memory of 2640	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	88
PID 1764 wrote to memory of 2640	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	88
PID 1764 wrote to memory of 1548	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	89
PID 1764 wrote to memory of 1548	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	89
PID 1764 wrote to memory of 2900	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	90
PID 1764 wrote to memory of 2900	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	90
PID 1764 wrote to memory of 1880	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	91
PID 1764 wrote to memory of 1880	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	91
PID 1764 wrote to memory of 4348	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	92
PID 1764 wrote to memory of 4348	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	92
PID 1764 wrote to memory of 3832	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	93
PID 1764 wrote to memory of 3832	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	93
PID 1764 wrote to memory of 3284	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	94
PID 1764 wrote to memory of 3284	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	94
PID 1764 wrote to memory of 1856	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	95
PID 1764 wrote to memory of 1856	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	95
PID 1764 wrote to memory of 2456	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	96
PID 1764 wrote to memory of 2456	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	96
PID 1764 wrote to memory of 3444	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	97
PID 1764 wrote to memory of 3444	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	97
PID 1764 wrote to memory of 5016	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	98
PID 1764 wrote to memory of 5016	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	98
PID 1764 wrote to memory of 3196	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	99
PID 1764 wrote to memory of 3196	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	99
PID 1764 wrote to memory of 2028	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	100
PID 1764 wrote to memory of 2028	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	100
PID 1764 wrote to memory of 4844	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	101
PID 1764 wrote to memory of 4844	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	101
PID 1764 wrote to memory of 3960	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	102
PID 1764 wrote to memory of 3960	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	102
PID 1764 wrote to memory of 448	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	103
PID 1764 wrote to memory of 448	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	103
PID 1764 wrote to memory of 4312	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	104
PID 1764 wrote to memory of 4312	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	104
PID 1764 wrote to memory of 4740	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	105
PID 1764 wrote to memory of 4740	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	105
PID 1764 wrote to memory of 2648	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	106
PID 1764 wrote to memory of 2648	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	106
PID 1764 wrote to memory of 4372	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	107
PID 1764 wrote to memory of 4372	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	107
PID 1764 wrote to memory of 3640	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	108
PID 1764 wrote to memory of 3640	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	108
PID 1764 wrote to memory of 516	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	109
PID 1764 wrote to memory of 516	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	109
PID 1764 wrote to memory of 2140	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	110
PID 1764 wrote to memory of 2140	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	110
PID 1764 wrote to memory of 2008	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	111
PID 1764 wrote to memory of 2008	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	111
PID 1764 wrote to memory of 2828	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	112
PID 1764 wrote to memory of 2828	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	112
PID 1764 wrote to memory of 4840	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	113
PID 1764 wrote to memory of 4840	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	113
PID 1764 wrote to memory of 4992	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	114
PID 1764 wrote to memory of 4992	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	114
PID 1764 wrote to memory of 5012	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	115
PID 1764 wrote to memory of 5012	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	115
PID 1764 wrote to memory of 3032	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	116
PID 1764 wrote to memory of 3032	1764	04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04671ca5646e3be595c34e8e2f62b027_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4884
- C:\Windows\System\CJHbnBl.exe
  C:\Windows\System\CJHbnBl.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\DTBhpun.exe
  C:\Windows\System\DTBhpun.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\zTFmHMm.exe
  C:\Windows\System\zTFmHMm.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\zpjPTkC.exe
  C:\Windows\System\zpjPTkC.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\srUEotI.exe
  C:\Windows\System\srUEotI.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\WXslMwP.exe
  C:\Windows\System\WXslMwP.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\dSuyMSG.exe
  C:\Windows\System\dSuyMSG.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\OowVUlI.exe
  C:\Windows\System\OowVUlI.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\oMnpPPj.exe
  C:\Windows\System\oMnpPPj.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\AQTnhkK.exe
  C:\Windows\System\AQTnhkK.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\JSSTUhQ.exe
  C:\Windows\System\JSSTUhQ.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\GoYrXXt.exe
  C:\Windows\System\GoYrXXt.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\Gqkiasu.exe
  C:\Windows\System\Gqkiasu.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\vwbDAfq.exe
  C:\Windows\System\vwbDAfq.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\IDuRqfR.exe
  C:\Windows\System\IDuRqfR.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\hkbzHam.exe
  C:\Windows\System\hkbzHam.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\qutLwBc.exe
  C:\Windows\System\qutLwBc.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\mGdyydk.exe
  C:\Windows\System\mGdyydk.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\mJocEeM.exe
  C:\Windows\System\mJocEeM.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\jYNrcaV.exe
  C:\Windows\System\jYNrcaV.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\QMCfyAY.exe
  C:\Windows\System\QMCfyAY.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\dQestpu.exe
  C:\Windows\System\dQestpu.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\ASpkLMe.exe
  C:\Windows\System\ASpkLMe.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\LdFRRfk.exe
  C:\Windows\System\LdFRRfk.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\gsqECvu.exe
  C:\Windows\System\gsqECvu.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\UkpvqDy.exe
  C:\Windows\System\UkpvqDy.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\GuLmkQa.exe
  C:\Windows\System\GuLmkQa.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\UcWySCx.exe
  C:\Windows\System\UcWySCx.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\ORWySGX.exe
  C:\Windows\System\ORWySGX.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\LdCnYWo.exe
  C:\Windows\System\LdCnYWo.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\STkYmyK.exe
  C:\Windows\System\STkYmyK.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\wKJawSt.exe
  C:\Windows\System\wKJawSt.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\wBBeiNd.exe
  C:\Windows\System\wBBeiNd.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\xRNQjYY.exe
  C:\Windows\System\xRNQjYY.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\YWDyEmQ.exe
  C:\Windows\System\YWDyEmQ.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\HojtHLw.exe
  C:\Windows\System\HojtHLw.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\Hvvrtwj.exe
  C:\Windows\System\Hvvrtwj.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\tbRdldU.exe
  C:\Windows\System\tbRdldU.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\IUAmAqn.exe
  C:\Windows\System\IUAmAqn.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\UDzHONq.exe
  C:\Windows\System\UDzHONq.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\ZQxztuc.exe
  C:\Windows\System\ZQxztuc.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\lKDBQgC.exe
  C:\Windows\System\lKDBQgC.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\JuftOhE.exe
  C:\Windows\System\JuftOhE.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\IsBGqaB.exe
  C:\Windows\System\IsBGqaB.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\LJelXwz.exe
  C:\Windows\System\LJelXwz.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\egdPpfa.exe
  C:\Windows\System\egdPpfa.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\cgqNIpk.exe
  C:\Windows\System\cgqNIpk.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\qdRyTru.exe
  C:\Windows\System\qdRyTru.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\nripmQd.exe
  C:\Windows\System\nripmQd.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\HUZUMXE.exe
  C:\Windows\System\HUZUMXE.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\WeEgtcy.exe
  C:\Windows\System\WeEgtcy.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\yQEcsdN.exe
  C:\Windows\System\yQEcsdN.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\PoyVPmT.exe
  C:\Windows\System\PoyVPmT.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\allKZFT.exe
  C:\Windows\System\allKZFT.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\sJNHZtx.exe
  C:\Windows\System\sJNHZtx.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\oMVBivc.exe
  C:\Windows\System\oMVBivc.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\ULuOnRA.exe
  C:\Windows\System\ULuOnRA.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\soLqdcJ.exe
  C:\Windows\System\soLqdcJ.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\hAdBOnB.exe
  C:\Windows\System\hAdBOnB.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\Fwakcrq.exe
  C:\Windows\System\Fwakcrq.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\apowiwu.exe
  C:\Windows\System\apowiwu.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\PSZmgym.exe
  C:\Windows\System\PSZmgym.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\cseuCAp.exe
  C:\Windows\System\cseuCAp.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\arJswhZ.exe
  C:\Windows\System\arJswhZ.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\RgpiLdk.exe
  C:\Windows\System\RgpiLdk.exe
  2⤵
  PID:4320
- C:\Windows\System\mwPHVFr.exe
  C:\Windows\System\mwPHVFr.exe
  2⤵
  PID:2888
- C:\Windows\System\jPYipEd.exe
  C:\Windows\System\jPYipEd.exe
  2⤵
  PID:3856
- C:\Windows\System\KpwYeGY.exe
  C:\Windows\System\KpwYeGY.exe
  2⤵
  PID:5008
- C:\Windows\System\bLqsHdH.exe
  C:\Windows\System\bLqsHdH.exe
  2⤵
  PID:1412
- C:\Windows\System\GacxRGL.exe
  C:\Windows\System\GacxRGL.exe
  2⤵
  PID:976
- C:\Windows\System\vonjjeo.exe
  C:\Windows\System\vonjjeo.exe
  2⤵
  PID:1996
- C:\Windows\System\itFNlsQ.exe
  C:\Windows\System\itFNlsQ.exe
  2⤵
  PID:3816
- C:\Windows\System\toBtWLQ.exe
  C:\Windows\System\toBtWLQ.exe
  2⤵
  PID:1928
- C:\Windows\System\hOPbUba.exe
  C:\Windows\System\hOPbUba.exe
  2⤵
  PID:2428
- C:\Windows\System\VKJduwZ.exe
  C:\Windows\System\VKJduwZ.exe
  2⤵
  PID:468
- C:\Windows\System\oyCoyJO.exe
  C:\Windows\System\oyCoyJO.exe
  2⤵
  PID:5124
- C:\Windows\System\fGFyAOy.exe
  C:\Windows\System\fGFyAOy.exe
  2⤵
  PID:5152
- C:\Windows\System\gnOiXNn.exe
  C:\Windows\System\gnOiXNn.exe
  2⤵
  PID:5180
- C:\Windows\System\PxxtNWX.exe
  C:\Windows\System\PxxtNWX.exe
  2⤵
  PID:5208
- C:\Windows\System\yQqmnLW.exe
  C:\Windows\System\yQqmnLW.exe
  2⤵
  PID:5236
- C:\Windows\System\AcxgALm.exe
  C:\Windows\System\AcxgALm.exe
  2⤵
  PID:5264
- C:\Windows\System\RVBIKRf.exe
  C:\Windows\System\RVBIKRf.exe
  2⤵
  PID:5292
- C:\Windows\System\vtvqXgQ.exe
  C:\Windows\System\vtvqXgQ.exe
  2⤵
  PID:5320
- C:\Windows\System\CpmTYng.exe
  C:\Windows\System\CpmTYng.exe
  2⤵
  PID:5348
- C:\Windows\System\dGBuEbh.exe
  C:\Windows\System\dGBuEbh.exe
  2⤵
  PID:5376
- C:\Windows\System\krEOCts.exe
  C:\Windows\System\krEOCts.exe
  2⤵
  PID:5404
- C:\Windows\System\uQyIyrX.exe
  C:\Windows\System\uQyIyrX.exe
  2⤵
  PID:5432
- C:\Windows\System\eYdluqT.exe
  C:\Windows\System\eYdluqT.exe
  2⤵
  PID:5460
- C:\Windows\System\tUPjZSj.exe
  C:\Windows\System\tUPjZSj.exe
  2⤵
  PID:5488
- C:\Windows\System\OEhbSfi.exe
  C:\Windows\System\OEhbSfi.exe
  2⤵
  PID:5516
- C:\Windows\System\XVBojBj.exe
  C:\Windows\System\XVBojBj.exe
  2⤵
  PID:5544
- C:\Windows\System\iSMpWuS.exe
  C:\Windows\System\iSMpWuS.exe
  2⤵
  PID:5572
- C:\Windows\System\rnNjocS.exe
  C:\Windows\System\rnNjocS.exe
  2⤵
  PID:5600
- C:\Windows\System\dtQFAGh.exe
  C:\Windows\System\dtQFAGh.exe
  2⤵
  PID:5628
- C:\Windows\System\snxJZPO.exe
  C:\Windows\System\snxJZPO.exe
  2⤵
  PID:5656
- C:\Windows\System\cDmUimz.exe
  C:\Windows\System\cDmUimz.exe
  2⤵
  PID:5684
- C:\Windows\System\fRFXXqs.exe
  C:\Windows\System\fRFXXqs.exe
  2⤵
  PID:5712
- C:\Windows\System\iUqsxCM.exe
  C:\Windows\System\iUqsxCM.exe
  2⤵
  PID:5740
- C:\Windows\System\FQBlQVj.exe
  C:\Windows\System\FQBlQVj.exe
  2⤵
  PID:5768
- C:\Windows\System\iMSXUaR.exe
  C:\Windows\System\iMSXUaR.exe
  2⤵
  PID:5796
- C:\Windows\System\BjlHHwY.exe
  C:\Windows\System\BjlHHwY.exe
  2⤵
  PID:5824
- C:\Windows\System\pTzuQYv.exe
  C:\Windows\System\pTzuQYv.exe
  2⤵
  PID:5852
- C:\Windows\System\EEVDOOp.exe
  C:\Windows\System\EEVDOOp.exe
  2⤵
  PID:5880
- C:\Windows\System\YuIVlrG.exe
  C:\Windows\System\YuIVlrG.exe
  2⤵
  PID:5908
- C:\Windows\System\UzjamiP.exe
  C:\Windows\System\UzjamiP.exe
  2⤵
  PID:5936
- C:\Windows\System\CMUFbfw.exe
  C:\Windows\System\CMUFbfw.exe
  2⤵
  PID:5964
- C:\Windows\System\gubrXxn.exe
  C:\Windows\System\gubrXxn.exe
  2⤵
  PID:5992
- C:\Windows\System\cokyAPv.exe
  C:\Windows\System\cokyAPv.exe
  2⤵
  PID:6020
- C:\Windows\System\WGZvHpD.exe
  C:\Windows\System\WGZvHpD.exe
  2⤵
  PID:6048
- C:\Windows\System\NisWIQs.exe
  C:\Windows\System\NisWIQs.exe
  2⤵
  PID:6076
- C:\Windows\System\uSnCYqh.exe
  C:\Windows\System\uSnCYqh.exe
  2⤵
  PID:6104
- C:\Windows\System\SpdmiAo.exe
  C:\Windows\System\SpdmiAo.exe
  2⤵
  PID:6132
- C:\Windows\System\NOsTKkC.exe
  C:\Windows\System\NOsTKkC.exe
  2⤵
  PID:4524
- C:\Windows\System\jtdsBhT.exe
  C:\Windows\System\jtdsBhT.exe
  2⤵
  PID:2444
- C:\Windows\System\ZvPRvpP.exe
  C:\Windows\System\ZvPRvpP.exe
  2⤵
  PID:1828
- C:\Windows\System\SSLNZkq.exe
  C:\Windows\System\SSLNZkq.exe
  2⤵
  PID:3744
- C:\Windows\System\LdbEhFO.exe
  C:\Windows\System\LdbEhFO.exe
  2⤵
  PID:5144
- C:\Windows\System\ZpuIXDZ.exe
  C:\Windows\System\ZpuIXDZ.exe
  2⤵
  PID:5220
- C:\Windows\System\sKxyuEX.exe
  C:\Windows\System\sKxyuEX.exe
  2⤵
  PID:5280
- C:\Windows\System\TJEbdhA.exe
  C:\Windows\System\TJEbdhA.exe
  2⤵
  PID:5340
- C:\Windows\System\buPDNDO.exe
  C:\Windows\System\buPDNDO.exe
  2⤵
  PID:5392
- C:\Windows\System\eIYnhZM.exe
  C:\Windows\System\eIYnhZM.exe
  2⤵
  PID:5448
- C:\Windows\System\UHsQMQk.exe
  C:\Windows\System\UHsQMQk.exe
  2⤵
  PID:5504
- C:\Windows\System\BHsDTbg.exe
  C:\Windows\System\BHsDTbg.exe
  2⤵
  PID:5564
- C:\Windows\System\EriGOeK.exe
  C:\Windows\System\EriGOeK.exe
  2⤵
  PID:5612
- C:\Windows\System\DlbbWSc.exe
  C:\Windows\System\DlbbWSc.exe
  2⤵
  PID:5672
- C:\Windows\System\lhdZOLw.exe
  C:\Windows\System\lhdZOLw.exe
  2⤵
  PID:5732
- C:\Windows\System\QbfbmVa.exe
  C:\Windows\System\QbfbmVa.exe
  2⤵
  PID:5788
- C:\Windows\System\QkDANwl.exe
  C:\Windows\System\QkDANwl.exe
  2⤵
  PID:5864
- C:\Windows\System\Hgjxler.exe
  C:\Windows\System\Hgjxler.exe
  2⤵
  PID:5920
- C:\Windows\System\hKFeKhY.exe
  C:\Windows\System\hKFeKhY.exe
  2⤵
  PID:5980
- C:\Windows\System\UKiePis.exe
  C:\Windows\System\UKiePis.exe
  2⤵
  PID:6036
- C:\Windows\System\IWWoqCj.exe
  C:\Windows\System\IWWoqCj.exe
  2⤵
  PID:3588
- C:\Windows\System\eCEnRTZ.exe
  C:\Windows\System\eCEnRTZ.exe
  2⤵
  PID:6124
- C:\Windows\System\tPkufak.exe
  C:\Windows\System\tPkufak.exe
  2⤵
  PID:2956
- C:\Windows\System\fmFCqAw.exe
  C:\Windows\System\fmFCqAw.exe
  2⤵
  PID:216
- C:\Windows\System\qqvwSfs.exe
  C:\Windows\System\qqvwSfs.exe
  2⤵
  PID:5192
- C:\Windows\System\FbxbusO.exe
  C:\Windows\System\FbxbusO.exe
  2⤵
  PID:5308
- C:\Windows\System\TSyDLoT.exe
  C:\Windows\System\TSyDLoT.exe
  2⤵
  PID:5420
- C:\Windows\System\mkhPftO.exe
  C:\Windows\System\mkhPftO.exe
  2⤵
  PID:5556
- C:\Windows\System\rgjXWKm.exe
  C:\Windows\System\rgjXWKm.exe
  2⤵
  PID:5648
- C:\Windows\System\NspTgGz.exe
  C:\Windows\System\NspTgGz.exe
  2⤵
  PID:4000
- C:\Windows\System\lHwqGgT.exe
  C:\Windows\System\lHwqGgT.exe
  2⤵
  PID:5840
- C:\Windows\System\lnXNmNW.exe
  C:\Windows\System\lnXNmNW.exe
  2⤵
  PID:5948
- C:\Windows\System\mrmTVLi.exe
  C:\Windows\System\mrmTVLi.exe
  2⤵
  PID:6064
- C:\Windows\System\JbESGer.exe
  C:\Windows\System\JbESGer.exe
  2⤵
  PID:1784
- C:\Windows\System\nIWZnPx.exe
  C:\Windows\System\nIWZnPx.exe
  2⤵
  PID:4676
- C:\Windows\System\pczmDwN.exe
  C:\Windows\System\pczmDwN.exe
  2⤵
  PID:5364
- C:\Windows\System\ECXJaMn.exe
  C:\Windows\System\ECXJaMn.exe
  2⤵
  PID:1544
- C:\Windows\System\emTxtbN.exe
  C:\Windows\System\emTxtbN.exe
  2⤵
  PID:636
- C:\Windows\System\sXnSreu.exe
  C:\Windows\System\sXnSreu.exe
  2⤵
  PID:5896
- C:\Windows\System\OSIdTPr.exe
  C:\Windows\System\OSIdTPr.exe
  2⤵
  PID:3064
- C:\Windows\System\GCgDGsW.exe
  C:\Windows\System\GCgDGsW.exe
  2⤵
  PID:1296
- C:\Windows\System\aAjQmdD.exe
  C:\Windows\System\aAjQmdD.exe
  2⤵
  PID:1028
- C:\Windows\System\NuGTdbg.exe
  C:\Windows\System\NuGTdbg.exe
  2⤵
  PID:3528
- C:\Windows\System\csuSHmN.exe
  C:\Windows\System\csuSHmN.exe
  2⤵
  PID:3592
- C:\Windows\System\qzePSou.exe
  C:\Windows\System\qzePSou.exe
  2⤵
  PID:3036
- C:\Windows\System\NerVNWQ.exe
  C:\Windows\System\NerVNWQ.exe
  2⤵
  PID:2800
- C:\Windows\System\thXdNPA.exe
  C:\Windows\System\thXdNPA.exe
  2⤵
  PID:5252
- C:\Windows\System\daVjMnp.exe
  C:\Windows\System\daVjMnp.exe
  2⤵
  PID:2016
- C:\Windows\System\SBmxlnt.exe
  C:\Windows\System\SBmxlnt.exe
  2⤵
  PID:6200
- C:\Windows\System\oKKAPhU.exe
  C:\Windows\System\oKKAPhU.exe
  2⤵
  PID:6228
- C:\Windows\System\LsGrDsX.exe
  C:\Windows\System\LsGrDsX.exe
  2⤵
  PID:6248
- C:\Windows\System\cKCHZgl.exe
  C:\Windows\System\cKCHZgl.exe
  2⤵
  PID:6264
- C:\Windows\System\UKfryOW.exe
  C:\Windows\System\UKfryOW.exe
  2⤵
  PID:6296
- C:\Windows\System\gkCJUjd.exe
  C:\Windows\System\gkCJUjd.exe
  2⤵
  PID:6352
- C:\Windows\System\AijhFVP.exe
  C:\Windows\System\AijhFVP.exe
  2⤵
  PID:6372
- C:\Windows\System\GcrXMqL.exe
  C:\Windows\System\GcrXMqL.exe
  2⤵
  PID:6392
- C:\Windows\System\PXBrFlg.exe
  C:\Windows\System\PXBrFlg.exe
  2⤵
  PID:6436
- C:\Windows\System\McUcxMn.exe
  C:\Windows\System\McUcxMn.exe
  2⤵
  PID:6468
- C:\Windows\System\kJJBZCT.exe
  C:\Windows\System\kJJBZCT.exe
  2⤵
  PID:6508
- C:\Windows\System\sRbkgnx.exe
  C:\Windows\System\sRbkgnx.exe
  2⤵
  PID:6536
- C:\Windows\System\GjTBHaU.exe
  C:\Windows\System\GjTBHaU.exe
  2⤵
  PID:6572
- C:\Windows\System\AJAKzZR.exe
  C:\Windows\System\AJAKzZR.exe
  2⤵
  PID:6596
- C:\Windows\System\kdpBRpg.exe
  C:\Windows\System\kdpBRpg.exe
  2⤵
  PID:6616
- C:\Windows\System\IDcller.exe
  C:\Windows\System\IDcller.exe
  2⤵
  PID:6640
- C:\Windows\System\LpXXQCe.exe
  C:\Windows\System\LpXXQCe.exe
  2⤵
  PID:6656
- C:\Windows\System\sIjsrQf.exe
  C:\Windows\System\sIjsrQf.exe
  2⤵
  PID:6672
- C:\Windows\System\BjMhrXY.exe
  C:\Windows\System\BjMhrXY.exe
  2⤵
  PID:6696
- C:\Windows\System\UNzlZOz.exe
  C:\Windows\System\UNzlZOz.exe
  2⤵
  PID:6712
- C:\Windows\System\wlOzaKC.exe
  C:\Windows\System\wlOzaKC.exe
  2⤵
  PID:6728
- C:\Windows\System\sZvZfnN.exe
  C:\Windows\System\sZvZfnN.exe
  2⤵
  PID:6752
- C:\Windows\System\noiDmJw.exe
  C:\Windows\System\noiDmJw.exe
  2⤵
  PID:6768
- C:\Windows\System\gJBqswk.exe
  C:\Windows\System\gJBqswk.exe
  2⤵
  PID:6788
- C:\Windows\System\KntrkFb.exe
  C:\Windows\System\KntrkFb.exe
  2⤵
  PID:6828
- C:\Windows\System\AIvIoff.exe
  C:\Windows\System\AIvIoff.exe
  2⤵
  PID:6844
- C:\Windows\System\BgOLSaM.exe
  C:\Windows\System\BgOLSaM.exe
  2⤵
  PID:6864
- C:\Windows\System\VYqDLGp.exe
  C:\Windows\System\VYqDLGp.exe
  2⤵
  PID:6884
- C:\Windows\System\kFypGkq.exe
  C:\Windows\System\kFypGkq.exe
  2⤵
  PID:6908
- C:\Windows\System\ZgaeytV.exe
  C:\Windows\System\ZgaeytV.exe
  2⤵
  PID:6964
- C:\Windows\System\CXpBfge.exe
  C:\Windows\System\CXpBfge.exe
  2⤵
  PID:6988
- C:\Windows\System\kGzBwfa.exe
  C:\Windows\System\kGzBwfa.exe
  2⤵
  PID:7044
- C:\Windows\System\CluUcyq.exe
  C:\Windows\System\CluUcyq.exe
  2⤵
  PID:7064
- C:\Windows\System\WUnfgvA.exe
  C:\Windows\System\WUnfgvA.exe
  2⤵
  PID:7084
- C:\Windows\System\oYJnCHo.exe
  C:\Windows\System\oYJnCHo.exe
  2⤵
  PID:7108
- C:\Windows\System\hNQXqCz.exe
  C:\Windows\System\hNQXqCz.exe
  2⤵
  PID:7140
- C:\Windows\System\pRBsgoX.exe
  C:\Windows\System\pRBsgoX.exe
  2⤵
  PID:4240
- C:\Windows\System\JAlvCXT.exe
  C:\Windows\System\JAlvCXT.exe
  2⤵
  PID:2400
- C:\Windows\System\bDXMBUC.exe
  C:\Windows\System\bDXMBUC.exe
  2⤵
  PID:4408
- C:\Windows\System\lhsGXhl.exe
  C:\Windows\System\lhsGXhl.exe
  2⤵
  PID:6212
- C:\Windows\System\vcdgspa.exe
  C:\Windows\System\vcdgspa.exe
  2⤵
  PID:6284
- C:\Windows\System\WjOGcpE.exe
  C:\Windows\System\WjOGcpE.exe
  2⤵
  PID:3996
- C:\Windows\System\DQxtweh.exe
  C:\Windows\System\DQxtweh.exe
  2⤵
  PID:6348
- C:\Windows\System\PLVwWJI.exe
  C:\Windows\System\PLVwWJI.exe
  2⤵
  PID:6428
- C:\Windows\System\cqZTXqz.exe
  C:\Windows\System\cqZTXqz.exe
  2⤵
  PID:6568
- C:\Windows\System\KSRfqVx.exe
  C:\Windows\System\KSRfqVx.exe
  2⤵
  PID:6636
- C:\Windows\System\nWcqxFS.exe
  C:\Windows\System\nWcqxFS.exe
  2⤵
  PID:6612
- C:\Windows\System\aNLFJor.exe
  C:\Windows\System\aNLFJor.exe
  2⤵
  PID:6740
- C:\Windows\System\vkvZsnZ.exe
  C:\Windows\System\vkvZsnZ.exe
  2⤵
  PID:6932
- C:\Windows\System\LcSYdDL.exe
  C:\Windows\System\LcSYdDL.exe
  2⤵
  PID:6880
- C:\Windows\System\PiODBYq.exe
  C:\Windows\System\PiODBYq.exe
  2⤵
  PID:6956
- C:\Windows\System\EPKOnXY.exe
  C:\Windows\System\EPKOnXY.exe
  2⤵
  PID:6984
- C:\Windows\System\ANTcHJB.exe
  C:\Windows\System\ANTcHJB.exe
  2⤵
  PID:7116
- C:\Windows\System\ZjOrGZx.exe
  C:\Windows\System\ZjOrGZx.exe
  2⤵
  PID:7060
- C:\Windows\System\FwAqBfY.exe
  C:\Windows\System\FwAqBfY.exe
  2⤵
  PID:1972
- C:\Windows\System\QYpNgEr.exe
  C:\Windows\System\QYpNgEr.exe
  2⤵
  PID:4976
- C:\Windows\System\KRGqgqM.exe
  C:\Windows\System\KRGqgqM.exe
  2⤵
  PID:8
- C:\Windows\System\kjoBUDw.exe
  C:\Windows\System\kjoBUDw.exe
  2⤵
  PID:620
- C:\Windows\System\dQVuXZy.exe
  C:\Windows\System\dQVuXZy.exe
  2⤵
  PID:4952
- C:\Windows\System\VQASSUT.exe
  C:\Windows\System\VQASSUT.exe
  2⤵
  PID:6736
- C:\Windows\System\CiynDtS.exe
  C:\Windows\System\CiynDtS.exe
  2⤵
  PID:6812
- C:\Windows\System\mAyrMwi.exe
  C:\Windows\System\mAyrMwi.exe
  2⤵
  PID:6920
- C:\Windows\System\dQVarqW.exe
  C:\Windows\System\dQVarqW.exe
  2⤵
  PID:7076
- C:\Windows\System\ItyhGJN.exe
  C:\Windows\System\ItyhGJN.exe
  2⤵
  PID:6208
- C:\Windows\System\APjiKGA.exe
  C:\Windows\System\APjiKGA.exe
  2⤵
  PID:6852
- C:\Windows\System\TDdAMhi.exe
  C:\Windows\System\TDdAMhi.exe
  2⤵
  PID:6764
- C:\Windows\System\AIVyRxY.exe
  C:\Windows\System\AIVyRxY.exe
  2⤵
  PID:404
- C:\Windows\System\RlbptBL.exe
  C:\Windows\System\RlbptBL.exe
  2⤵
  PID:7188
- C:\Windows\System\JkHHEkJ.exe
  C:\Windows\System\JkHHEkJ.exe
  2⤵
  PID:7244
- C:\Windows\System\LeZuuUW.exe
  C:\Windows\System\LeZuuUW.exe
  2⤵
  PID:7276
- C:\Windows\System\DhqmCzK.exe
  C:\Windows\System\DhqmCzK.exe
  2⤵
  PID:7300
- C:\Windows\System\BhsCSSY.exe
  C:\Windows\System\BhsCSSY.exe
  2⤵
  PID:7340
- C:\Windows\System\SJEqSXn.exe
  C:\Windows\System\SJEqSXn.exe
  2⤵
  PID:7364
- C:\Windows\System\cczELKH.exe
  C:\Windows\System\cczELKH.exe
  2⤵
  PID:7384
- C:\Windows\System\uLiDVIj.exe
  C:\Windows\System\uLiDVIj.exe
  2⤵
  PID:7408
- C:\Windows\System\LbDQRjk.exe
  C:\Windows\System\LbDQRjk.exe
  2⤵
  PID:7440
- C:\Windows\System\smAwyNN.exe
  C:\Windows\System\smAwyNN.exe
  2⤵
  PID:7460
- C:\Windows\System\qWAhZQo.exe
  C:\Windows\System\qWAhZQo.exe
  2⤵
  PID:7504
- C:\Windows\System\NhrqUoC.exe
  C:\Windows\System\NhrqUoC.exe
  2⤵
  PID:7520
- C:\Windows\System\HAtVkBC.exe
  C:\Windows\System\HAtVkBC.exe
  2⤵
  PID:7544
- C:\Windows\System\AbylYHk.exe
  C:\Windows\System\AbylYHk.exe
  2⤵
  PID:7588
- C:\Windows\System\XLVcoIX.exe
  C:\Windows\System\XLVcoIX.exe
  2⤵
  PID:7608
- C:\Windows\System\SDsCMOB.exe
  C:\Windows\System\SDsCMOB.exe
  2⤵
  PID:7632
- C:\Windows\System\fSkyqrx.exe
  C:\Windows\System\fSkyqrx.exe
  2⤵
  PID:7652
- C:\Windows\System\vjsGDUz.exe
  C:\Windows\System\vjsGDUz.exe
  2⤵
  PID:7672
- C:\Windows\System\imYvoiI.exe
  C:\Windows\System\imYvoiI.exe
  2⤵
  PID:7716
- C:\Windows\System\vzEuDKY.exe
  C:\Windows\System\vzEuDKY.exe
  2⤵
  PID:7732
- C:\Windows\System\PgyMKoU.exe
  C:\Windows\System\PgyMKoU.exe
  2⤵
  PID:7764
- C:\Windows\System\gwHVVKy.exe
  C:\Windows\System\gwHVVKy.exe
  2⤵
  PID:7812
- C:\Windows\System\Neldzmr.exe
  C:\Windows\System\Neldzmr.exe
  2⤵
  PID:7828
- C:\Windows\System\kdmuglY.exe
  C:\Windows\System\kdmuglY.exe
  2⤵
  PID:7848
- C:\Windows\System\YLNOdgI.exe
  C:\Windows\System\YLNOdgI.exe
  2⤵
  PID:7892
- C:\Windows\System\VaiLRDm.exe
  C:\Windows\System\VaiLRDm.exe
  2⤵
  PID:7916
- C:\Windows\System\vJyAwHE.exe
  C:\Windows\System\vJyAwHE.exe
  2⤵
  PID:7940
- C:\Windows\System\KvuolhD.exe
  C:\Windows\System\KvuolhD.exe
  2⤵
  PID:7960
- C:\Windows\System\GIOwCec.exe
  C:\Windows\System\GIOwCec.exe
  2⤵
  PID:8008
- C:\Windows\System\IzKlZjs.exe
  C:\Windows\System\IzKlZjs.exe
  2⤵
  PID:8028
- C:\Windows\System\mKkNXeu.exe
  C:\Windows\System\mKkNXeu.exe
  2⤵
  PID:8048
- C:\Windows\System\plrQrSJ.exe
  C:\Windows\System\plrQrSJ.exe
  2⤵
  PID:8068
- C:\Windows\System\HsjeSwN.exe
  C:\Windows\System\HsjeSwN.exe
  2⤵
  PID:8108
- C:\Windows\System\NTeEtbk.exe
  C:\Windows\System\NTeEtbk.exe
  2⤵
  PID:8136
- C:\Windows\System\ouPVRii.exe
  C:\Windows\System\ouPVRii.exe
  2⤵
  PID:8180
- C:\Windows\System\MkmzQKb.exe
  C:\Windows\System\MkmzQKb.exe
  2⤵
  PID:3500
- C:\Windows\System\qkhGXYf.exe
  C:\Windows\System\qkhGXYf.exe
  2⤵
  PID:7184
- C:\Windows\System\rUpewbH.exe
  C:\Windows\System\rUpewbH.exe
  2⤵
  PID:7216
- C:\Windows\System\pOuaaDW.exe
  C:\Windows\System\pOuaaDW.exe
  2⤵
  PID:7292
- C:\Windows\System\ctTnpMP.exe
  C:\Windows\System\ctTnpMP.exe
  2⤵
  PID:7372
- C:\Windows\System\AnxXucl.exe
  C:\Windows\System\AnxXucl.exe
  2⤵
  PID:7420
- C:\Windows\System\iHlgEAd.exe
  C:\Windows\System\iHlgEAd.exe
  2⤵
  PID:7472
- C:\Windows\System\alipLAm.exe
  C:\Windows\System\alipLAm.exe
  2⤵
  PID:7536
- C:\Windows\System\kDNBVGr.exe
  C:\Windows\System\kDNBVGr.exe
  2⤵
  PID:7680
- C:\Windows\System\AqNgnsd.exe
  C:\Windows\System\AqNgnsd.exe
  2⤵
  PID:7700
- C:\Windows\System\ABkAwqH.exe
  C:\Windows\System\ABkAwqH.exe
  2⤵
  PID:7728
- C:\Windows\System\PFHeIio.exe
  C:\Windows\System\PFHeIio.exe
  2⤵
  PID:7800
- C:\Windows\System\eThmYhI.exe
  C:\Windows\System\eThmYhI.exe
  2⤵
  PID:7884
- C:\Windows\System\ikZFFxW.exe
  C:\Windows\System\ikZFFxW.exe
  2⤵
  PID:7956
- C:\Windows\System\ygHoTMc.exe
  C:\Windows\System\ygHoTMc.exe
  2⤵
  PID:8040
- C:\Windows\System\PlabcWk.exe
  C:\Windows\System\PlabcWk.exe
  2⤵
  PID:8084
- C:\Windows\System\mRmgxcp.exe
  C:\Windows\System\mRmgxcp.exe
  2⤵
  PID:8152
- C:\Windows\System\kgZaYnA.exe
  C:\Windows\System\kgZaYnA.exe
  2⤵
  PID:6580
- C:\Windows\System\uRULMqR.exe
  C:\Windows\System\uRULMqR.exe
  2⤵
  PID:7212
- C:\Windows\System\jtcinHm.exe
  C:\Windows\System\jtcinHm.exe
  2⤵
  PID:7380
- C:\Windows\System\iAbxtBp.exe
  C:\Windows\System\iAbxtBp.exe
  2⤵
  PID:7628
- C:\Windows\System\axwnfCI.exe
  C:\Windows\System\axwnfCI.exe
  2⤵
  PID:7804
- C:\Windows\System\khxEkHH.exe
  C:\Windows\System\khxEkHH.exe
  2⤵
  PID:7908
- C:\Windows\System\uvlvRKq.exe
  C:\Windows\System\uvlvRKq.exe
  2⤵
  PID:6244
- C:\Windows\System\hUMaiQW.exe
  C:\Windows\System\hUMaiQW.exe
  2⤵
  PID:7332
- C:\Windows\System\dLLwEIM.exe
  C:\Windows\System\dLLwEIM.exe
  2⤵
  PID:7696
- C:\Windows\System\yeRlvdO.exe
  C:\Windows\System\yeRlvdO.exe
  2⤵
  PID:7840
- C:\Windows\System\gzKpFyM.exe
  C:\Windows\System\gzKpFyM.exe
  2⤵
  PID:8132
- C:\Windows\System\qjzIDDd.exe
  C:\Windows\System\qjzIDDd.exe
  2⤵
  PID:7724
- C:\Windows\System\OtsZCZQ.exe
  C:\Windows\System\OtsZCZQ.exe
  2⤵
  PID:8216
- C:\Windows\System\fRujRYM.exe
  C:\Windows\System\fRujRYM.exe
  2⤵
  PID:8232
- C:\Windows\System\qdKtepF.exe
  C:\Windows\System\qdKtepF.exe
  2⤵
  PID:8256
- C:\Windows\System\WUJFEFZ.exe
  C:\Windows\System\WUJFEFZ.exe
  2⤵
  PID:8284
- C:\Windows\System\aCBoRTy.exe
  C:\Windows\System\aCBoRTy.exe
  2⤵
  PID:8348
- C:\Windows\System\gzkrdNC.exe
  C:\Windows\System\gzkrdNC.exe
  2⤵
  PID:8372
- C:\Windows\System\tiYAttj.exe
  C:\Windows\System\tiYAttj.exe
  2⤵
  PID:8400
- C:\Windows\System\uUCNGfQ.exe
  C:\Windows\System\uUCNGfQ.exe
  2⤵
  PID:8448
- C:\Windows\System\CarukJz.exe
  C:\Windows\System\CarukJz.exe
  2⤵
  PID:8484
- C:\Windows\System\DMTmFuL.exe
  C:\Windows\System\DMTmFuL.exe
  2⤵
  PID:8500
- C:\Windows\System\kTpGYia.exe
  C:\Windows\System\kTpGYia.exe
  2⤵
  PID:8528
- C:\Windows\System\uaCxxSz.exe
  C:\Windows\System\uaCxxSz.exe
  2⤵
  PID:8548
- C:\Windows\System\IBNMiuy.exe
  C:\Windows\System\IBNMiuy.exe
  2⤵
  PID:8576
- C:\Windows\System\ttWZpgV.exe
  C:\Windows\System\ttWZpgV.exe
  2⤵
  PID:8600
- C:\Windows\System\MRwFNiw.exe
  C:\Windows\System\MRwFNiw.exe
  2⤵
  PID:8632
- C:\Windows\System\CtDnsWU.exe
  C:\Windows\System\CtDnsWU.exe
  2⤵
  PID:8660
- C:\Windows\System\xTFSInP.exe
  C:\Windows\System\xTFSInP.exe
  2⤵
  PID:8680
- C:\Windows\System\EuERobY.exe
  C:\Windows\System\EuERobY.exe
  2⤵
  PID:8708
- C:\Windows\System\zgTYjtO.exe
  C:\Windows\System\zgTYjtO.exe
  2⤵
  PID:8752
- C:\Windows\System\NrOzynS.exe
  C:\Windows\System\NrOzynS.exe
  2⤵
  PID:8772
- C:\Windows\System\gyhDEmW.exe
  C:\Windows\System\gyhDEmW.exe
  2⤵
  PID:8792
- C:\Windows\System\enqdMWs.exe
  C:\Windows\System\enqdMWs.exe
  2⤵
  PID:8820
- C:\Windows\System\fkCaJmX.exe
  C:\Windows\System\fkCaJmX.exe
  2⤵
  PID:8840
- C:\Windows\System\gNmZNuF.exe
  C:\Windows\System\gNmZNuF.exe
  2⤵
  PID:8860
- C:\Windows\System\jKleUBa.exe
  C:\Windows\System\jKleUBa.exe
  2⤵
  PID:8884
- C:\Windows\System\YLMurLn.exe
  C:\Windows\System\YLMurLn.exe
  2⤵
  PID:8932
- C:\Windows\System\RTanrsW.exe
  C:\Windows\System\RTanrsW.exe
  2⤵
  PID:8948
- C:\Windows\System\KnDdKhC.exe
  C:\Windows\System\KnDdKhC.exe
  2⤵
  PID:8988
- C:\Windows\System\xdgXvqi.exe
  C:\Windows\System\xdgXvqi.exe
  2⤵
  PID:9032
- C:\Windows\System\izSlIXi.exe
  C:\Windows\System\izSlIXi.exe
  2⤵
  PID:9064
- C:\Windows\System\wgxTiqk.exe
  C:\Windows\System\wgxTiqk.exe
  2⤵
  PID:9092
- C:\Windows\System\YqxMfWi.exe
  C:\Windows\System\YqxMfWi.exe
  2⤵
  PID:9112
- C:\Windows\System\cxyIsmB.exe
  C:\Windows\System\cxyIsmB.exe
  2⤵
  PID:9148
- C:\Windows\System\KDaQTHd.exe
  C:\Windows\System\KDaQTHd.exe
  2⤵
  PID:9168
- C:\Windows\System\eWtqlVR.exe
  C:\Windows\System\eWtqlVR.exe
  2⤵
  PID:9212
- C:\Windows\System\xyxVazX.exe
  C:\Windows\System\xyxVazX.exe
  2⤵
  PID:7888
- C:\Windows\System\LKIrTwS.exe
  C:\Windows\System\LKIrTwS.exe
  2⤵
  PID:8224
- C:\Windows\System\bFBSVAn.exe
  C:\Windows\System\bFBSVAn.exe
  2⤵
  PID:8280
- C:\Windows\System\FtVqrHs.exe
  C:\Windows\System\FtVqrHs.exe
  2⤵
  PID:8396
- C:\Windows\System\iiIZlgu.exe
  C:\Windows\System\iiIZlgu.exe
  2⤵
  PID:2488
- C:\Windows\System\xduEAGB.exe
  C:\Windows\System\xduEAGB.exe
  2⤵
  PID:8492
- C:\Windows\System\mfHAYjA.exe
  C:\Windows\System\mfHAYjA.exe
  2⤵
  PID:8544
- C:\Windows\System\WtHNoeR.exe
  C:\Windows\System\WtHNoeR.exe
  2⤵
  PID:8568
- C:\Windows\System\ldvxuJf.exe
  C:\Windows\System\ldvxuJf.exe
  2⤵
  PID:8668
- C:\Windows\System\gCHMZRf.exe
  C:\Windows\System\gCHMZRf.exe
  2⤵
  PID:8696
- C:\Windows\System\dQPFqob.exe
  C:\Windows\System\dQPFqob.exe
  2⤵
  PID:8740
- C:\Windows\System\tsWEeuR.exe
  C:\Windows\System\tsWEeuR.exe
  2⤵
  PID:8816
- C:\Windows\System\aTThOob.exe
  C:\Windows\System\aTThOob.exe
  2⤵
  PID:8944
- C:\Windows\System\IKwdQDD.exe
  C:\Windows\System\IKwdQDD.exe
  2⤵
  PID:9004
- C:\Windows\System\SlkfEjY.exe
  C:\Windows\System\SlkfEjY.exe
  2⤵
  PID:9072
- C:\Windows\System\EEmcfbs.exe
  C:\Windows\System\EEmcfbs.exe
  2⤵
  PID:9104
- C:\Windows\System\zYZEbzd.exe
  C:\Windows\System\zYZEbzd.exe
  2⤵
  PID:9160
- C:\Windows\System\lovCkLS.exe
  C:\Windows\System\lovCkLS.exe
  2⤵
  PID:7360
- C:\Windows\System\iGDaOic.exe
  C:\Windows\System\iGDaOic.exe
  2⤵
  PID:8252
- C:\Windows\System\UWivxAp.exe
  C:\Windows\System\UWivxAp.exe
  2⤵
  PID:8312
- C:\Windows\System\dbncGmd.exe
  C:\Windows\System\dbncGmd.exe
  2⤵
  PID:8676
- C:\Windows\System\qjkrRLD.exe
  C:\Windows\System\qjkrRLD.exe
  2⤵
  PID:8652
- C:\Windows\System\MLqBIis.exe
  C:\Windows\System\MLqBIis.exe
  2⤵
  PID:8852
- C:\Windows\System\yEKWLXS.exe
  C:\Windows\System\yEKWLXS.exe
  2⤵
  PID:8960
- C:\Windows\System\hFAkLWc.exe
  C:\Windows\System\hFAkLWc.exe
  2⤵
  PID:9204
- C:\Windows\System\zkxrJJh.exe
  C:\Windows\System\zkxrJJh.exe
  2⤵
  PID:8624
- C:\Windows\System\cuMiLrr.exe
  C:\Windows\System\cuMiLrr.exe
  2⤵
  PID:9208
- C:\Windows\System\XKNBNwS.exe
  C:\Windows\System\XKNBNwS.exe
  2⤵
  PID:9016
- C:\Windows\System\Zporpye.exe
  C:\Windows\System\Zporpye.exe
  2⤵
  PID:9228
- C:\Windows\System\TPVDRIf.exe
  C:\Windows\System\TPVDRIf.exe
  2⤵
  PID:9244
- C:\Windows\System\TBDEetk.exe
  C:\Windows\System\TBDEetk.exe
  2⤵
  PID:9268
- C:\Windows\System\FhODvtq.exe
  C:\Windows\System\FhODvtq.exe
  2⤵
  PID:9292
- C:\Windows\System\wFhBQxq.exe
  C:\Windows\System\wFhBQxq.exe
  2⤵
  PID:9308
- C:\Windows\System\lJEnWtl.exe
  C:\Windows\System\lJEnWtl.exe
  2⤵
  PID:9392
- C:\Windows\System\uKkftRn.exe
  C:\Windows\System\uKkftRn.exe
  2⤵
  PID:9408
- C:\Windows\System\ZYooatc.exe
  C:\Windows\System\ZYooatc.exe
  2⤵
  PID:9432
- C:\Windows\System\kwMzKEC.exe
  C:\Windows\System\kwMzKEC.exe
  2⤵
  PID:9528
- C:\Windows\System\gWAyBnI.exe
  C:\Windows\System\gWAyBnI.exe
  2⤵
  PID:9552
- C:\Windows\System\UalJrTi.exe
  C:\Windows\System\UalJrTi.exe
  2⤵
  PID:9644
- C:\Windows\System\ymDFMsT.exe
  C:\Windows\System\ymDFMsT.exe
  2⤵
  PID:9676
- C:\Windows\System\fASzgPS.exe
  C:\Windows\System\fASzgPS.exe
  2⤵
  PID:9700
- C:\Windows\System\nMvkcoL.exe
  C:\Windows\System\nMvkcoL.exe
  2⤵
  PID:9740
- C:\Windows\System\VgjQQLl.exe
  C:\Windows\System\VgjQQLl.exe
  2⤵
  PID:9756
- C:\Windows\System\qKTNpEm.exe
  C:\Windows\System\qKTNpEm.exe
  2⤵
  PID:9784
- C:\Windows\System\TLwQwXe.exe
  C:\Windows\System\TLwQwXe.exe
  2⤵
  PID:9804
- C:\Windows\System\jaHwQeH.exe
  C:\Windows\System\jaHwQeH.exe
  2⤵
  PID:9832
- C:\Windows\System\jHjRszW.exe
  C:\Windows\System\jHjRszW.exe
  2⤵
  PID:9856
- C:\Windows\System\hUFbsnW.exe
  C:\Windows\System\hUFbsnW.exe
  2⤵
  PID:9888
- C:\Windows\System\kYiXiCT.exe
  C:\Windows\System\kYiXiCT.exe
  2⤵
  PID:9920
- C:\Windows\System\GXSRywI.exe
  C:\Windows\System\GXSRywI.exe
  2⤵
  PID:9964
- C:\Windows\System\outHMOh.exe
  C:\Windows\System\outHMOh.exe
  2⤵
  PID:9980
- C:\Windows\System\OMmPvUk.exe
  C:\Windows\System\OMmPvUk.exe
  2⤵
  PID:9996
- C:\Windows\System\qjjoWHr.exe
  C:\Windows\System\qjjoWHr.exe
  2⤵
  PID:10016
- C:\Windows\System\JeZNVmf.exe
  C:\Windows\System\JeZNVmf.exe
  2⤵
  PID:10052
- C:\Windows\System\cOwEmpZ.exe
  C:\Windows\System\cOwEmpZ.exe
  2⤵
  PID:10072
- C:\Windows\System\vKiUEdK.exe
  C:\Windows\System\vKiUEdK.exe
  2⤵
  PID:10108
- C:\Windows\System\WUZvLfU.exe
  C:\Windows\System\WUZvLfU.exe
  2⤵
  PID:10128
- C:\Windows\System\eesxsKh.exe
  C:\Windows\System\eesxsKh.exe
  2⤵
  PID:10152
- C:\Windows\System\nbLHczm.exe
  C:\Windows\System\nbLHczm.exe
  2⤵
  PID:10184
- C:\Windows\System\ABMewzj.exe
  C:\Windows\System\ABMewzj.exe
  2⤵
  PID:10204
- C:\Windows\System\QVJRrgw.exe
  C:\Windows\System\QVJRrgw.exe
  2⤵
  PID:8380
- C:\Windows\System\EPujgrf.exe
  C:\Windows\System\EPujgrf.exe
  2⤵
  PID:9224
- C:\Windows\System\ZDlxAVw.exe
  C:\Windows\System\ZDlxAVw.exe
  2⤵
  PID:9280
- C:\Windows\System\BXAsvuu.exe
  C:\Windows\System\BXAsvuu.exe
  2⤵
  PID:8368
- C:\Windows\System\lyddgfm.exe
  C:\Windows\System\lyddgfm.exe
  2⤵
  PID:9520
- C:\Windows\System\jDrrbVp.exe
  C:\Windows\System\jDrrbVp.exe
  2⤵
  PID:9544
- C:\Windows\System\HvaFEIN.exe
  C:\Windows\System\HvaFEIN.exe
  2⤵
  PID:9472
- C:\Windows\System\LeGzUgf.exe
  C:\Windows\System\LeGzUgf.exe
  2⤵
  PID:9628
- C:\Windows\System\KKMXBVO.exe
  C:\Windows\System\KKMXBVO.exe
  2⤵
  PID:9580
- C:\Windows\System\dMfIrTH.exe
  C:\Windows\System\dMfIrTH.exe
  2⤵
  PID:9616
- C:\Windows\System\gipdliL.exe
  C:\Windows\System\gipdliL.exe
  2⤵
  PID:9668
- C:\Windows\System\luhDUgj.exe
  C:\Windows\System\luhDUgj.exe
  2⤵
  PID:9752
- C:\Windows\System\xgZTqgh.exe
  C:\Windows\System\xgZTqgh.exe
  2⤵
  PID:9840
- C:\Windows\System\hpnAjXa.exe
  C:\Windows\System\hpnAjXa.exe
  2⤵
  PID:9900
- C:\Windows\System\FQOdCSS.exe
  C:\Windows\System\FQOdCSS.exe
  2⤵
  PID:9956
- C:\Windows\System\obbrAcX.exe
  C:\Windows\System\obbrAcX.exe
  2⤵
  PID:10036
- C:\Windows\System\ouIcHQi.exe
  C:\Windows\System\ouIcHQi.exe
  2⤵
  PID:10092
- C:\Windows\System\lphYJoG.exe
  C:\Windows\System\lphYJoG.exe
  2⤵
  PID:10172
- C:\Windows\System\TOticMQ.exe
  C:\Windows\System\TOticMQ.exe
  2⤵
  PID:10224
- C:\Windows\System\ZQEQxSw.exe
  C:\Windows\System\ZQEQxSw.exe
  2⤵
  PID:10196
- C:\Windows\System\XjEniKD.exe
  C:\Windows\System\XjEniKD.exe
  2⤵
  PID:9376
- C:\Windows\System\IPIHnAE.exe
  C:\Windows\System\IPIHnAE.exe
  2⤵
  PID:9516
- C:\Windows\System\KYrjdpC.exe
  C:\Windows\System\KYrjdpC.exe
  2⤵
  PID:9460
- C:\Windows\System\KmGELGU.exe
  C:\Windows\System\KmGELGU.exe
  2⤵
  PID:9600
- C:\Windows\System\eCmvvBl.exe
  C:\Windows\System\eCmvvBl.exe
  2⤵
  PID:9748
- C:\Windows\System\KWkdBmJ.exe
  C:\Windows\System\KWkdBmJ.exe
  2⤵
  PID:9988
- C:\Windows\System\doWVkOi.exe
  C:\Windows\System\doWVkOi.exe
  2⤵
  PID:10064
- C:\Windows\System\lBTazrL.exe
  C:\Windows\System\lBTazrL.exe
  2⤵
  PID:9372
- C:\Windows\System\NrMAqae.exe
  C:\Windows\System\NrMAqae.exe
  2⤵
  PID:9800
- C:\Windows\System\zEfSxma.exe
  C:\Windows\System\zEfSxma.exe
  2⤵
  PID:10080
- C:\Windows\System\BTTJMMH.exe
  C:\Windows\System\BTTJMMH.exe
  2⤵
  PID:10144
- C:\Windows\System\bQwltwN.exe
  C:\Windows\System\bQwltwN.exe
  2⤵
  PID:9884
- C:\Windows\System\OmTiXqF.exe
  C:\Windows\System\OmTiXqF.exe
  2⤵
  PID:10248
- C:\Windows\System\fBoPljZ.exe
  C:\Windows\System\fBoPljZ.exe
  2⤵
  PID:10284
- C:\Windows\System\ZpzErPA.exe
  C:\Windows\System\ZpzErPA.exe
  2⤵
  PID:10312
- C:\Windows\System\rHsKSUf.exe
  C:\Windows\System\rHsKSUf.exe
  2⤵
  PID:10336
- C:\Windows\System\mDyEeVq.exe
  C:\Windows\System\mDyEeVq.exe
  2⤵
  PID:10364
- C:\Windows\System\lQlFIhc.exe
  C:\Windows\System\lQlFIhc.exe
  2⤵
  PID:10384
- C:\Windows\System\Pbdtqha.exe
  C:\Windows\System\Pbdtqha.exe
  2⤵
  PID:10404
- C:\Windows\System\ZZuJSvC.exe
  C:\Windows\System\ZZuJSvC.exe
  2⤵
  PID:10432
- C:\Windows\System\jzApSxY.exe
  C:\Windows\System\jzApSxY.exe
  2⤵
  PID:10464
- C:\Windows\System\PrCZXTf.exe
  C:\Windows\System\PrCZXTf.exe
  2⤵
  PID:10480
- C:\Windows\System\feqoVxt.exe
  C:\Windows\System\feqoVxt.exe
  2⤵
  PID:10500
- C:\Windows\System\PGVmbJi.exe
  C:\Windows\System\PGVmbJi.exe
  2⤵
  PID:10520
- C:\Windows\System\UPWSUzw.exe
  C:\Windows\System\UPWSUzw.exe
  2⤵
  PID:10544
- C:\Windows\System\jvogCeE.exe
  C:\Windows\System\jvogCeE.exe
  2⤵
  PID:10572
- C:\Windows\System\JMgZFOj.exe
  C:\Windows\System\JMgZFOj.exe
  2⤵
  PID:10588
- C:\Windows\System\qegGhkM.exe
  C:\Windows\System\qegGhkM.exe
  2⤵
  PID:10608
- C:\Windows\System\VcodDVu.exe
  C:\Windows\System\VcodDVu.exe
  2⤵
  PID:10628
- C:\Windows\System\EtBcekR.exe
  C:\Windows\System\EtBcekR.exe
  2⤵
  PID:10712
- C:\Windows\System\TzdQbZJ.exe
  C:\Windows\System\TzdQbZJ.exe
  2⤵
  PID:10760
- C:\Windows\System\SRtQisd.exe
  C:\Windows\System\SRtQisd.exe
  2⤵
  PID:10776
- C:\Windows\System\KCxUoYa.exe
  C:\Windows\System\KCxUoYa.exe
  2⤵
  PID:10804
- C:\Windows\System\xDzQvIi.exe
  C:\Windows\System\xDzQvIi.exe
  2⤵
  PID:10824
- C:\Windows\System\BTpXuQQ.exe
  C:\Windows\System\BTpXuQQ.exe
  2⤵
  PID:10856
- C:\Windows\System\zMgMxqy.exe
  C:\Windows\System\zMgMxqy.exe
  2⤵
  PID:10872
- C:\Windows\System\KGwjfmB.exe
  C:\Windows\System\KGwjfmB.exe
  2⤵
  PID:10904
- C:\Windows\System\bMumMlS.exe
  C:\Windows\System\bMumMlS.exe
  2⤵
  PID:10936
- C:\Windows\System\iMkHkIg.exe
  C:\Windows\System\iMkHkIg.exe
  2⤵
  PID:10980
- C:\Windows\System\IOokDUF.exe
  C:\Windows\System\IOokDUF.exe
  2⤵
  PID:10996
- C:\Windows\System\VTMEDtJ.exe
  C:\Windows\System\VTMEDtJ.exe
  2⤵
  PID:11020
- C:\Windows\System\tZfUgwY.exe
  C:\Windows\System\tZfUgwY.exe
  2⤵
  PID:11044
- C:\Windows\System\EhwUKZp.exe
  C:\Windows\System\EhwUKZp.exe
  2⤵
  PID:11072
- C:\Windows\System\ZNpwKxu.exe
  C:\Windows\System\ZNpwKxu.exe
  2⤵
  PID:11116
- C:\Windows\System\qITaWjT.exe
  C:\Windows\System\qITaWjT.exe
  2⤵
  PID:11140
- C:\Windows\System\EqPAJXB.exe
  C:\Windows\System\EqPAJXB.exe
  2⤵
  PID:11180
- C:\Windows\System\WWKhYHy.exe
  C:\Windows\System\WWKhYHy.exe
  2⤵
  PID:11196
- C:\Windows\System\PlIlzzx.exe
  C:\Windows\System\PlIlzzx.exe
  2⤵
  PID:11224
- C:\Windows\System\JSqXNub.exe
  C:\Windows\System\JSqXNub.exe
  2⤵
  PID:11244
- C:\Windows\System\QzEYaKQ.exe
  C:\Windows\System\QzEYaKQ.exe
  2⤵
  PID:10244
- C:\Windows\System\qWLCcLW.exe
  C:\Windows\System\qWLCcLW.exe
  2⤵
  PID:10272
- C:\Windows\System\vfZnxun.exe
  C:\Windows\System\vfZnxun.exe
  2⤵
  PID:10372
- C:\Windows\System\skSJwTb.exe
  C:\Windows\System\skSJwTb.exe
  2⤵
  PID:10400
- C:\Windows\System\dkhlQHM.exe
  C:\Windows\System\dkhlQHM.exe
  2⤵
  PID:10476
- C:\Windows\System\YIQalPK.exe
  C:\Windows\System\YIQalPK.exe
  2⤵
  PID:10528
- C:\Windows\System\QhjHtso.exe
  C:\Windows\System\QhjHtso.exe
  2⤵
  PID:10660
- C:\Windows\System\GcboTen.exe
  C:\Windows\System\GcboTen.exe
  2⤵
  PID:10624
- C:\Windows\System\kbVQNeB.exe
  C:\Windows\System\kbVQNeB.exe
  2⤵
  PID:10752
- C:\Windows\System\pRFDMmP.exe
  C:\Windows\System\pRFDMmP.exe
  2⤵
  PID:10820
- C:\Windows\System\IkANqma.exe
  C:\Windows\System\IkANqma.exe
  2⤵
  PID:10892
- C:\Windows\System\zhjbAgG.exe
  C:\Windows\System\zhjbAgG.exe
  2⤵
  PID:1492
- C:\Windows\System\WqFlbcY.exe
  C:\Windows\System\WqFlbcY.exe
  2⤵
  PID:10944
- C:\Windows\System\CuUWLCR.exe
  C:\Windows\System\CuUWLCR.exe
  2⤵
  PID:11012
- C:\Windows\System\OdRPskG.exe
  C:\Windows\System\OdRPskG.exe
  2⤵
  PID:11168
- C:\Windows\System\LsgrPsk.exe
  C:\Windows\System\LsgrPsk.exe
  2⤵
  PID:11216
- C:\Windows\System\FFbkCfr.exe
  C:\Windows\System\FFbkCfr.exe
  2⤵
  PID:11240
- C:\Windows\System\VHEiKHP.exe
  C:\Windows\System\VHEiKHP.exe
  2⤵
  PID:10308
- C:\Windows\System\eWqqchc.exe
  C:\Windows\System\eWqqchc.exe
  2⤵
  PID:10396
- C:\Windows\System\EjgPLcB.exe
  C:\Windows\System\EjgPLcB.exe
  2⤵
  PID:10668
- C:\Windows\System\myhdmJm.exe
  C:\Windows\System\myhdmJm.exe
  2⤵
  PID:10792
- C:\Windows\System\EgZeQDN.exe
  C:\Windows\System\EgZeQDN.exe
  2⤵
  PID:10972
- C:\Windows\System\oQABBiU.exe
  C:\Windows\System\oQABBiU.exe
  2⤵
  PID:11056
- C:\Windows\System\cWNCeyt.exe
  C:\Windows\System\cWNCeyt.exe
  2⤵
  PID:2116
- C:\Windows\System\sLXpGRo.exe
  C:\Windows\System\sLXpGRo.exe
  2⤵
  PID:10276
- C:\Windows\System\ilCSvMN.exe
  C:\Windows\System\ilCSvMN.exe
  2⤵
  PID:10552
- C:\Windows\System\ZatClQt.exe
  C:\Windows\System\ZatClQt.exe
  2⤵
  PID:1932
- C:\Windows\System\ByVFUHo.exe
  C:\Windows\System\ByVFUHo.exe
  2⤵
  PID:11032
- C:\Windows\System\DdTWXka.exe
  C:\Windows\System\DdTWXka.exe
  2⤵
  PID:11160
- C:\Windows\System\UEiJIeB.exe
  C:\Windows\System\UEiJIeB.exe
  2⤵
  PID:9300
- C:\Windows\System\cZtISOh.exe
  C:\Windows\System\cZtISOh.exe
  2⤵
  PID:11280
- C:\Windows\System\UKrBpvA.exe
  C:\Windows\System\UKrBpvA.exe
  2⤵
  PID:11304
- C:\Windows\System\fuKYFZE.exe
  C:\Windows\System\fuKYFZE.exe
  2⤵
  PID:11348
- C:\Windows\System\EoDQhUc.exe
  C:\Windows\System\EoDQhUc.exe
  2⤵
  PID:11372
- C:\Windows\System\ICPdvRQ.exe
  C:\Windows\System\ICPdvRQ.exe
  2⤵
  PID:11392
- C:\Windows\System\rdYLBsn.exe
  C:\Windows\System\rdYLBsn.exe
  2⤵
  PID:11420
- C:\Windows\System\clchLDZ.exe
  C:\Windows\System\clchLDZ.exe
  2⤵
  PID:11452
- C:\Windows\System\LaxLvpt.exe
  C:\Windows\System\LaxLvpt.exe
  2⤵
  PID:11492
- C:\Windows\System\UXkVrtQ.exe
  C:\Windows\System\UXkVrtQ.exe
  2⤵
  PID:11520
- C:\Windows\System\EsDwerp.exe
  C:\Windows\System\EsDwerp.exe
  2⤵
  PID:11540
- C:\Windows\System\FtcAHyG.exe
  C:\Windows\System\FtcAHyG.exe
  2⤵
  PID:11580
- C:\Windows\System\duCDnME.exe
  C:\Windows\System\duCDnME.exe
  2⤵
  PID:11596
- C:\Windows\System\LFnCQdz.exe
  C:\Windows\System\LFnCQdz.exe
  2⤵
  PID:11624
- C:\Windows\System\ZcaqShK.exe
  C:\Windows\System\ZcaqShK.exe
  2⤵
  PID:11652
- C:\Windows\System\Zqoyhur.exe
  C:\Windows\System\Zqoyhur.exe
  2⤵
  PID:11680
- C:\Windows\System\IydIjnc.exe
  C:\Windows\System\IydIjnc.exe
  2⤵
  PID:11708
- C:\Windows\System\eWBraYT.exe
  C:\Windows\System\eWBraYT.exe
  2⤵
  PID:11744
- C:\Windows\System\YqdsMeM.exe
  C:\Windows\System\YqdsMeM.exe
  2⤵
  PID:11760
- C:\Windows\System\PvOXIdN.exe
  C:\Windows\System\PvOXIdN.exe
  2⤵
  PID:11784
- C:\Windows\System\ilituCq.exe
  C:\Windows\System\ilituCq.exe
  2⤵
  PID:11808
- C:\Windows\System\yDlNauA.exe
  C:\Windows\System\yDlNauA.exe
  2⤵
  PID:11832
- C:\Windows\System\fHnvfuw.exe
  C:\Windows\System\fHnvfuw.exe
  2⤵
  PID:11848
- C:\Windows\System\JjHVAMY.exe
  C:\Windows\System\JjHVAMY.exe
  2⤵
  PID:11908
- C:\Windows\System\WuRmdYb.exe
  C:\Windows\System\WuRmdYb.exe
  2⤵
  PID:11928
- C:\Windows\System\FjJGjHP.exe
  C:\Windows\System\FjJGjHP.exe
  2⤵
  PID:11952
- C:\Windows\System\MzHEwCU.exe
  C:\Windows\System\MzHEwCU.exe
  2⤵
  PID:11972
- C:\Windows\System\NkYAJgU.exe
  C:\Windows\System\NkYAJgU.exe
  2⤵
  PID:11996
- C:\Windows\System\xAGmujy.exe
  C:\Windows\System\xAGmujy.exe
  2⤵
  PID:12040
- C:\Windows\System\MYOPTsO.exe
  C:\Windows\System\MYOPTsO.exe
  2⤵
  PID:12068
- C:\Windows\System\CSEAVCq.exe
  C:\Windows\System\CSEAVCq.exe
  2⤵
  PID:12088
- C:\Windows\System\UqYcgaJ.exe
  C:\Windows\System\UqYcgaJ.exe
  2⤵
  PID:12148
- C:\Windows\System\YRaqZbC.exe
  C:\Windows\System\YRaqZbC.exe
  2⤵
  PID:12176
- C:\Windows\System\YsIEgrD.exe
  C:\Windows\System\YsIEgrD.exe
  2⤵
  PID:12200
- C:\Windows\System\FIknfQn.exe
  C:\Windows\System\FIknfQn.exe
  2⤵
  PID:12220
- C:\Windows\System\PnfRVOd.exe
  C:\Windows\System\PnfRVOd.exe
  2⤵
  PID:12260
- C:\Windows\System\JWlZCyZ.exe
  C:\Windows\System\JWlZCyZ.exe
  2⤵
  PID:12280
- C:\Windows\System\UGkjJBM.exe
  C:\Windows\System\UGkjJBM.exe
  2⤵
  PID:10840
- C:\Windows\System\MSOkziI.exe
  C:\Windows\System\MSOkziI.exe
  2⤵
  PID:11320
- C:\Windows\System\sdIhHfI.exe
  C:\Windows\System\sdIhHfI.exe
  2⤵
  PID:11332
- C:\Windows\System\dFTjsOi.exe
  C:\Windows\System\dFTjsOi.exe
  2⤵
  PID:11444
- C:\Windows\System\jEqZoTD.exe
  C:\Windows\System\jEqZoTD.exe
  2⤵
  PID:11484
- C:\Windows\System\BxviZzW.exe
  C:\Windows\System\BxviZzW.exe
  2⤵
  PID:11536
- C:\Windows\System\NpqoGbS.exe
  C:\Windows\System\NpqoGbS.exe
  2⤵
  PID:11640
- C:\Windows\System\wjCCzRk.exe
  C:\Windows\System\wjCCzRk.exe
  2⤵
  PID:11724
- C:\Windows\System\eNzsHBJ.exe
  C:\Windows\System\eNzsHBJ.exe
  2⤵
  PID:11756
- C:\Windows\System\kOZyVrS.exe
  C:\Windows\System\kOZyVrS.exe
  2⤵
  PID:11844
- C:\Windows\System\DTLwgSh.exe
  C:\Windows\System\DTLwgSh.exe
  2⤵
  PID:11896
- C:\Windows\System\SpFSuZa.exe
  C:\Windows\System\SpFSuZa.exe
  2⤵
  PID:11944
- C:\Windows\System\uQQXhqn.exe
  C:\Windows\System\uQQXhqn.exe
  2⤵
  PID:11988
- C:\Windows\System\nixitpP.exe
  C:\Windows\System\nixitpP.exe
  2⤵
  PID:12024
- C:\Windows\System\LOmZxKW.exe
  C:\Windows\System\LOmZxKW.exe
  2⤵
  PID:12104
- C:\Windows\System\vwFPocS.exe
  C:\Windows\System\vwFPocS.exe
  2⤵
  PID:12144
- C:\Windows\System\owMHmpV.exe
  C:\Windows\System\owMHmpV.exe
  2⤵
  PID:12192
- C:\Windows\System\UkUCPgS.exe
  C:\Windows\System\UkUCPgS.exe
  2⤵
  PID:12256
- C:\Windows\System\uvbjlvl.exe
  C:\Windows\System\uvbjlvl.exe
  2⤵
  PID:11300
- C:\Windows\System\IjObrdU.exe
  C:\Windows\System\IjObrdU.exe
  2⤵
  PID:11588
- C:\Windows\System\CMreUkr.exe
  C:\Windows\System\CMreUkr.exe
  2⤵
  PID:11692
- C:\Windows\System\DKWGcgE.exe
  C:\Windows\System\DKWGcgE.exe
  2⤵
  PID:11804
- C:\Windows\System\ElqsFZW.exe
  C:\Windows\System\ElqsFZW.exe
  2⤵
  PID:1824
- C:\Windows\System\KxLCzzW.exe
  C:\Windows\System\KxLCzzW.exe
  2⤵
  PID:11924
- C:\Windows\System\BHwvoGx.exe
  C:\Windows\System\BHwvoGx.exe
  2⤵
  PID:4168
- C:\Windows\System\JaRZxdr.exe
  C:\Windows\System\JaRZxdr.exe
  2⤵
  PID:12168
- C:\Windows\System\TZiLHlZ.exe
  C:\Windows\System\TZiLHlZ.exe
  2⤵
  PID:11356
- C:\Windows\System\BlPaIqr.exe
  C:\Windows\System\BlPaIqr.exe
  2⤵
  PID:11612
- C:\Windows\System\KxYAwEj.exe
  C:\Windows\System\KxYAwEj.exe
  2⤵
  PID:11768
- C:\Windows\System\eXtRKhd.exe
  C:\Windows\System\eXtRKhd.exe
  2⤵
  PID:3152
- C:\Windows\System\LyEzRfF.exe
  C:\Windows\System\LyEzRfF.exe
  2⤵
  PID:3216
- C:\Windows\System\ATVeiKN.exe
  C:\Windows\System\ATVeiKN.exe
  2⤵
  PID:12308
- C:\Windows\System\gNzSvxL.exe
  C:\Windows\System\gNzSvxL.exe
  2⤵
  PID:12352
- C:\Windows\System\OfmegPS.exe
  C:\Windows\System\OfmegPS.exe
  2⤵
  PID:12404
- C:\Windows\System\uhvUxqy.exe
  C:\Windows\System\uhvUxqy.exe
  2⤵
  PID:12424
- C:\Windows\System\xBjCIpm.exe
  C:\Windows\System\xBjCIpm.exe
  2⤵
  PID:12448
- C:\Windows\System\wpvLssp.exe
  C:\Windows\System\wpvLssp.exe
  2⤵
  PID:12468
- C:\Windows\System\bOxEJpw.exe
  C:\Windows\System\bOxEJpw.exe
  2⤵
  PID:12496
- C:\Windows\System\cKfAAbE.exe
  C:\Windows\System\cKfAAbE.exe
  2⤵
  PID:12520
- C:\Windows\System\QBIMHFP.exe
  C:\Windows\System\QBIMHFP.exe
  2⤵
  PID:12548
- C:\Windows\System\yYNvXrb.exe
  C:\Windows\System\yYNvXrb.exe
  2⤵
  PID:12576
- C:\Windows\System\TPfjxpX.exe
  C:\Windows\System\TPfjxpX.exe
  2⤵
  PID:12620
- C:\Windows\System\xIMuOSb.exe
  C:\Windows\System\xIMuOSb.exe
  2⤵
  PID:12644
- C:\Windows\System\cBUwGbQ.exe
  C:\Windows\System\cBUwGbQ.exe
  2⤵
  PID:12660
- C:\Windows\System\yRmhYvP.exe
  C:\Windows\System\yRmhYvP.exe
  2⤵
  PID:12684
- C:\Windows\System\JiilhqF.exe
  C:\Windows\System\JiilhqF.exe
  2⤵
  PID:12708
- C:\Windows\System\uyrydmh.exe
  C:\Windows\System\uyrydmh.exe
  2⤵
  PID:12732
- C:\Windows\System\GoklnmC.exe
  C:\Windows\System\GoklnmC.exe
  2⤵
  PID:12752
- C:\Windows\System\nhMfDbv.exe
  C:\Windows\System\nhMfDbv.exe
  2⤵
  PID:12784
- C:\Windows\System\pfsyLfE.exe
  C:\Windows\System\pfsyLfE.exe
  2⤵
  PID:12812
- C:\Windows\System\eWJWWhF.exe
  C:\Windows\System\eWJWWhF.exe
  2⤵
  PID:12884
- C:\Windows\System\fnGJiEi.exe
  C:\Windows\System\fnGJiEi.exe
  2⤵
  PID:12904
- C:\Windows\System\xZoKJVX.exe
  C:\Windows\System\xZoKJVX.exe
  2⤵
  PID:12932
- C:\Windows\System\XMzdnTy.exe
  C:\Windows\System\XMzdnTy.exe
  2⤵
  PID:12960
- C:\Windows\System\DKATsUR.exe
  C:\Windows\System\DKATsUR.exe
  2⤵
  PID:12988
- C:\Windows\System\dgdeDQm.exe
  C:\Windows\System\dgdeDQm.exe
  2⤵
  PID:13012
- C:\Windows\System\QedKMQf.exe
  C:\Windows\System\QedKMQf.exe
  2⤵
  PID:13048
- C:\Windows\System\PLkhjzK.exe
  C:\Windows\System\PLkhjzK.exe
  2⤵
  PID:13068
- C:\Windows\System\MnKqwFP.exe
  C:\Windows\System\MnKqwFP.exe
  2⤵
  PID:13088
- C:\Windows\System\MAoedzI.exe
  C:\Windows\System\MAoedzI.exe
  2⤵
  PID:12436
- C:\Windows\System\BGigLqi.exe
  C:\Windows\System\BGigLqi.exe
  2⤵
  PID:12484
- C:\Windows\System\eracriQ.exe
  C:\Windows\System\eracriQ.exe
  2⤵
  PID:12556
- C:\Windows\System\QhqCbgD.exe
  C:\Windows\System\QhqCbgD.exe
  2⤵
  PID:12516
- C:\Windows\System\zCHMnIF.exe
  C:\Windows\System\zCHMnIF.exe
  2⤵
  PID:12632
- C:\Windows\System\DxpEoXB.exe
  C:\Windows\System\DxpEoXB.exe
  2⤵
  PID:12676
- C:\Windows\System\sesBwLN.exe
  C:\Windows\System\sesBwLN.exe
  2⤵
  PID:12700
- C:\Windows\System\ciwvCkx.exe
  C:\Windows\System\ciwvCkx.exe
  2⤵
  PID:12748
- C:\Windows\System\mNWOXVw.exe
  C:\Windows\System\mNWOXVw.exe
  2⤵
  PID:12804
- C:\Windows\System\LWKLcMC.exe
  C:\Windows\System\LWKLcMC.exe
  2⤵
  PID:3608
- C:\Windows\System\mSsektT.exe
  C:\Windows\System\mSsektT.exe
  2⤵
  PID:12952
- C:\Windows\System\IenqKQk.exe
  C:\Windows\System\IenqKQk.exe
  2⤵
  PID:13004
- C:\Windows\System\mzBlNQd.exe
  C:\Windows\System\mzBlNQd.exe
  2⤵
  PID:13120
- C:\Windows\System\qJEzHhD.exe
  C:\Windows\System\qJEzHhD.exe
  2⤵
  PID:13148
- C:\Windows\System\LpnbywV.exe
  C:\Windows\System\LpnbywV.exe
  2⤵
  PID:13252
- C:\Windows\System\MvDyyVk.exe
  C:\Windows\System\MvDyyVk.exe
  2⤵
  PID:13112
- C:\Windows\System\fqmBfQQ.exe
  C:\Windows\System\fqmBfQQ.exe
  2⤵
  PID:13228
- C:\Windows\System\ZoSflet.exe
  C:\Windows\System\ZoSflet.exe
  2⤵
  PID:13232
- C:\Windows\System\SFuhazt.exe
  C:\Windows\System\SFuhazt.exe
  2⤵
  PID:4292
- C:\Windows\System\BEpetrz.exe
  C:\Windows\System\BEpetrz.exe
  2⤵
  PID:13280
- C:\Windows\System\RvdBwWL.exe
  C:\Windows\System\RvdBwWL.exe
  2⤵
  PID:3224
- C:\Windows\System\vVNCjFT.exe
  C:\Windows\System\vVNCjFT.exe
  2⤵
  PID:13136
- C:\Windows\System\SwUmhug.exe
  C:\Windows\System\SwUmhug.exe
  2⤵
  PID:12544
- C:\Windows\System\oHdHAqv.exe
  C:\Windows\System\oHdHAqv.exe
  2⤵
  PID:12672
- C:\Windows\System\zdbdTaE.exe
  C:\Windows\System\zdbdTaE.exe
  2⤵
  PID:12608
- C:\Windows\System\sVKAnOI.exe
  C:\Windows\System\sVKAnOI.exe
  2⤵
  PID:4136
- C:\Windows\System\NXvwnDo.exe
  C:\Windows\System\NXvwnDo.exe
  2⤵
  PID:3172
- C:\Windows\System\UWLRAlB.exe
  C:\Windows\System\UWLRAlB.exe
  2⤵
  PID:12900
- C:\Windows\System\GDSrnOj.exe
  C:\Windows\System\GDSrnOj.exe
  2⤵
  PID:13196
- C:\Windows\System\FhsgWsj.exe
  C:\Windows\System\FhsgWsj.exe
  2⤵
  PID:2384
- C:\Windows\System\xZPmKqa.exe
  C:\Windows\System\xZPmKqa.exe
  2⤵
  PID:1652
- C:\Windows\System\HmlpuSM.exe
  C:\Windows\System\HmlpuSM.exe
  2⤵
  PID:5116
- C:\Windows\System\jnLYMql.exe
  C:\Windows\System\jnLYMql.exe
  2⤵
  PID:13060
- C:\Windows\System\JvOssXJ.exe
  C:\Windows\System\JvOssXJ.exe
  2⤵
  PID:4980
- C:\Windows\System\vCthXXG.exe
  C:\Windows\System\vCthXXG.exe
  2⤵
  PID:13300
- C:\Windows\System\NQcKPAe.exe
  C:\Windows\System\NQcKPAe.exe
  2⤵
  PID:12792
- C:\Windows\System\WBcuWBd.exe
  C:\Windows\System\WBcuWBd.exe
  2⤵
  PID:1896
- C:\Windows\System\xFbNvBN.exe
  C:\Windows\System\xFbNvBN.exe
  2⤵
  PID:3476
- C:\Windows\System\uJrkBBH.exe
  C:\Windows\System\uJrkBBH.exe
  2⤵
  PID:6328
- C:\Windows\System\SWHCPEl.exe
  C:\Windows\System\SWHCPEl.exe
  2⤵
  PID:13172
- C:\Windows\System\CgKiLWh.exe
  C:\Windows\System\CgKiLWh.exe
  2⤵
  PID:3232
- C:\Windows\System\JuRIhAp.exe
  C:\Windows\System\JuRIhAp.exe
  2⤵
  PID:1532
- C:\Windows\System\ZhnaUis.exe
  C:\Windows\System\ZhnaUis.exe
  2⤵
  PID:2056
- C:\Windows\System\HCfcuEh.exe
  C:\Windows\System\HCfcuEh.exe
  2⤵
  PID:2184
- C:\Windows\System\iwrdvdT.exe
  C:\Windows\System\iwrdvdT.exe
  2⤵
  PID:13432
- C:\Windows\System\JgKEnvR.exe
  C:\Windows\System\JgKEnvR.exe
  2⤵
  PID:13452
- C:\Windows\System\uInzsqv.exe
  C:\Windows\System\uInzsqv.exe
  2⤵
  PID:13472
- C:\Windows\System\sNboFjc.exe
  C:\Windows\System\sNboFjc.exe
  2⤵
  PID:13992
- C:\Windows\System\AvLrLhk.exe
  C:\Windows\System\AvLrLhk.exe
  2⤵
  PID:13968
- C:\Windows\System\XmhONNF.exe
  C:\Windows\System\XmhONNF.exe
  2⤵
  PID:14004
- C:\Windows\System\pcARVng.exe
  C:\Windows\System\pcARVng.exe
  2⤵
  PID:14032
- C:\Windows\System\jPiHQjI.exe
  C:\Windows\System\jPiHQjI.exe
  2⤵
  PID:14080
- C:\Windows\System\BxQAQpP.exe
  C:\Windows\System\BxQAQpP.exe
  2⤵
  PID:14144
- C:\Windows\System\gtEZaUf.exe
  C:\Windows\System\gtEZaUf.exe
  2⤵
  PID:14220
- C:\Windows\System\jdgOMnk.exe
  C:\Windows\System\jdgOMnk.exe
  2⤵
  PID:14256
- C:\Windows\System\CXXwTng.exe
  C:\Windows\System\CXXwTng.exe
  2⤵
  PID:14304
- C:\Windows\System\uvbouAB.exe
  C:\Windows\System\uvbouAB.exe
  2⤵
  PID:13532
- C:\Windows\System\UhjSFNZ.exe
  C:\Windows\System\UhjSFNZ.exe
  2⤵
  PID:13440
- C:\Windows\System\RCugIjH.exe
  C:\Windows\System\RCugIjH.exe
  2⤵
  PID:7924
- C:\Windows\System\bzbxmwg.exe
  C:\Windows\System\bzbxmwg.exe
  2⤵
  PID:13640
- C:\Windows\System\raMnGIC.exe
  C:\Windows\System\raMnGIC.exe
  2⤵
  PID:13700
- C:\Windows\System\ndYrquC.exe
  C:\Windows\System\ndYrquC.exe
  2⤵
  PID:13716
- C:\Windows\System\EpjAsOo.exe
  C:\Windows\System\EpjAsOo.exe
  2⤵
  PID:13748
- C:\Windows\System\LnxMWon.exe
  C:\Windows\System\LnxMWon.exe
  2⤵
  PID:8176
- C:\Windows\System\XRwZaXj.exe
  C:\Windows\System\XRwZaXj.exe
  2⤵
  PID:13808
- C:\Windows\System\KDXNrGO.exe
  C:\Windows\System\KDXNrGO.exe
  2⤵
  PID:13840
- C:\Windows\System\JkdcgUs.exe
  C:\Windows\System\JkdcgUs.exe
  2⤵
  PID:6936
- C:\Windows\System\qcZLoYk.exe
  C:\Windows\System\qcZLoYk.exe
  2⤵
  PID:13944
- C:\Windows\System\UwGLUyR.exe
  C:\Windows\System\UwGLUyR.exe
  2⤵
  PID:13980
- C:\Windows\System\PHLXZVx.exe
  C:\Windows\System\PHLXZVx.exe
  2⤵
  PID:14052
- C:\Windows\System\uGbLNvh.exe
  C:\Windows\System\uGbLNvh.exe
  2⤵
  PID:7784
- C:\Windows\System\eRApjxR.exe
  C:\Windows\System\eRApjxR.exe
  2⤵
  PID:14160
- C:\Windows\System\fOZJPdI.exe
  C:\Windows\System\fOZJPdI.exe
  2⤵
  PID:14204
- C:\Windows\System\TCDPNyJ.exe
  C:\Windows\System\TCDPNyJ.exe
  2⤵
  PID:14248
- C:\Windows\System\iBNbMUD.exe
  C:\Windows\System\iBNbMUD.exe
  2⤵
  PID:14268
- C:\Windows\System\GvgTRop.exe
  C:\Windows\System\GvgTRop.exe
  2⤵
  PID:8408
- C:\Windows\System\cMeYQet.exe
  C:\Windows\System\cMeYQet.exe
  2⤵
  PID:7568
- C:\Windows\System\gOhqogp.exe
  C:\Windows\System\gOhqogp.exe
  2⤵
  PID:13352
- C:\Windows\System\WbbioEE.exe
  C:\Windows\System\WbbioEE.exe
  2⤵
  PID:13364
- C:\Windows\System\MRGAgjn.exe
  C:\Windows\System\MRGAgjn.exe
  2⤵
  PID:4112
- C:\Windows\System\aOFwxwL.exe
  C:\Windows\System\aOFwxwL.exe
  2⤵
  PID:13468
- C:\Windows\System\xstRVoU.exe
  C:\Windows\System\xstRVoU.exe
  2⤵
  PID:8892
- C:\Windows\System\rpywIwq.exe
  C:\Windows\System\rpywIwq.exe
  2⤵
  PID:8996
- C:\Windows\System\eIxSKpe.exe
  C:\Windows\System\eIxSKpe.exe
  2⤵
  PID:9184
- C:\Windows\System\xtHGnQc.exe
  C:\Windows\System\xtHGnQc.exe
  2⤵
  PID:13580
- C:\Windows\System\oBgbNUt.exe
  C:\Windows\System\oBgbNUt.exe
  2⤵
  PID:13648
- C:\Windows\System\xEYQOZF.exe
  C:\Windows\System\xEYQOZF.exe
  2⤵
  PID:13668
- C:\Windows\System\XgjzdHO.exe
  C:\Windows\System\XgjzdHO.exe
  2⤵
  PID:7984
- C:\Windows\System\lXPjuuh.exe
  C:\Windows\System\lXPjuuh.exe
  2⤵
  PID:13728
- C:\Windows\System\MLelBDQ.exe
  C:\Windows\System\MLelBDQ.exe
  2⤵
  PID:13760
- C:\Windows\System\kkLsHzs.exe
  C:\Windows\System\kkLsHzs.exe
  2⤵
  PID:6904
- C:\Windows\System\nNQOHmt.exe
  C:\Windows\System\nNQOHmt.exe
  2⤵
  PID:2716
- C:\Windows\System\GyrCPKE.exe
  C:\Windows\System\GyrCPKE.exe
  2⤵
  PID:3156
- C:\Windows\System\JAFQuda.exe
  C:\Windows\System\JAFQuda.exe
  2⤵
  PID:7668
- C:\Windows\System\uSyzWKD.exe
  C:\Windows\System\uSyzWKD.exe
  2⤵
  PID:13852
- C:\Windows\System\pZigJgv.exe
  C:\Windows\System\pZigJgv.exe
  2⤵
  PID:7912
- C:\Windows\System\xIpjOUr.exe
  C:\Windows\System\xIpjOUr.exe
  2⤵
  PID:13952
- C:\Windows\System\ylbWQBQ.exe
  C:\Windows\System\ylbWQBQ.exe
  2⤵
  PID:13984
- C:\Windows\System\fGsXhwQ.exe
  C:\Windows\System\fGsXhwQ.exe
  2⤵
  PID:8168
- C:\Windows\System\wkBqCpL.exe
  C:\Windows\System\wkBqCpL.exe
  2⤵
  PID:7596
- C:\Windows\System\NFEhSFT.exe
  C:\Windows\System\NFEhSFT.exe
  2⤵
  PID:2948
- C:\Windows\System\GwfEBBn.exe
  C:\Windows\System\GwfEBBn.exe
  2⤵
  PID:14212
- C:\Windows\System\iePPxfh.exe
  C:\Windows\System\iePPxfh.exe
  2⤵
  PID:7264
- C:\Windows\System\qcDbPKN.exe
  C:\Windows\System\qcDbPKN.exe
  2⤵
  PID:9732
- C:\Windows\System\ApJSgTF.exe
  C:\Windows\System\ApJSgTF.exe
  2⤵
  PID:8308
- C:\Windows\System\QErTITI.exe
  C:\Windows\System\QErTITI.exe
  2⤵
  PID:14272
- C:\Windows\System\mOcSzxp.exe
  C:\Windows\System\mOcSzxp.exe
  2⤵
  PID:7484
- C:\Windows\System\MUPSuLj.exe
  C:\Windows\System\MUPSuLj.exe
  2⤵
  PID:14312
- C:\Windows\System\vJFOgfO.exe
  C:\Windows\System\vJFOgfO.exe
  2⤵
  PID:9952
- C:\Windows\System\TMxjXyC.exe
  C:\Windows\System\TMxjXyC.exe
  2⤵
  PID:7576
- C:\Windows\System\PRaJIcI.exe
  C:\Windows\System\PRaJIcI.exe
  2⤵
  PID:8724
- C:\Windows\System\hFGxfhD.exe
  C:\Windows\System\hFGxfhD.exe
  2⤵
  PID:8780
- C:\Windows\System\OgcFRPR.exe
  C:\Windows\System\OgcFRPR.exe
  2⤵
  PID:7752
- C:\Windows\System\muiRoKe.exe
  C:\Windows\System\muiRoKe.exe
  2⤵
  PID:9424
- C:\Windows\System\EGXZKuc.exe
  C:\Windows\System\EGXZKuc.exe
  2⤵
  PID:7788
- C:\Windows\System\faziavA.exe
  C:\Windows\System\faziavA.exe
  2⤵
  PID:7808
- C:\Windows\System\bWBumeP.exe
  C:\Windows\System\bWBumeP.exe
  2⤵
  PID:9504
- C:\Windows\System\OeKcvXf.exe
  C:\Windows\System\OeKcvXf.exe
  2⤵
  PID:1976
- C:\Windows\System\BiEcvjw.exe
  C:\Windows\System\BiEcvjw.exe
  2⤵
  PID:9200
- C:\Windows\System\SyCgSCX.exe
  C:\Windows\System\SyCgSCX.exe
  2⤵
  PID:4720
- C:\Windows\System\mRSqmck.exe
  C:\Windows\System\mRSqmck.exe
  2⤵
  PID:2984
- C:\Windows\System\rvRBtWU.exe
  C:\Windows\System\rvRBtWU.exe
  2⤵
  PID:13664
- C:\Windows\System\GmDokmZ.exe
  C:\Windows\System\GmDokmZ.exe
  2⤵
  PID:8880
- C:\Windows\System\aiyJVwL.exe
  C:\Windows\System\aiyJVwL.exe
  2⤵
  PID:4012
- C:\Windows\System\jBkfKmO.exe
  C:\Windows\System\jBkfKmO.exe
  2⤵
  PID:8904
- C:\Windows\System\LhmcqqC.exe
  C:\Windows\System\LhmcqqC.exe
  2⤵
  PID:4928
- C:\Windows\System\vVdDRbd.exe
  C:\Windows\System\vVdDRbd.exe
  2⤵
  PID:13804
- C:\Windows\System\OoNpoZa.exe
  C:\Windows\System\OoNpoZa.exe
  2⤵
  PID:13816
- C:\Windows\System\YWcFQdQ.exe
  C:\Windows\System\YWcFQdQ.exe
  2⤵
  PID:5148
- C:\Windows\System\zGNspeT.exe
  C:\Windows\System\zGNspeT.exe
  2⤵
  PID:13848
- C:\Windows\System\yVLvlvM.exe
  C:\Windows\System\yVLvlvM.exe
  2⤵
  PID:2920
- C:\Windows\System\uauGFXp.exe
  C:\Windows\System\uauGFXp.exe
  2⤵
  PID:7824
- C:\Windows\System\lsHMKDY.exe
  C:\Windows\System\lsHMKDY.exe
  2⤵
  PID:9384
- C:\Windows\System\YhsLsfI.exe
  C:\Windows\System\YhsLsfI.exe
  2⤵
  PID:13964
- C:\Windows\System\iCFAgmh.exe
  C:\Windows\System\iCFAgmh.exe
  2⤵
  PID:2432
- C:\Windows\System\tjhvBTw.exe
  C:\Windows\System\tjhvBTw.exe
  2⤵
  PID:9388
- C:\Windows\System\ZabyTJw.exe
  C:\Windows\System\ZabyTJw.exe
  2⤵
  PID:10784
- C:\Windows\System\bhXFnyN.exe
  C:\Windows\System\bhXFnyN.exe
  2⤵
  PID:5428
- C:\Windows\System\oGoSRbl.exe
  C:\Windows\System\oGoSRbl.exe
  2⤵
  PID:14180
- C:\Windows\System\NYZcYwl.exe
  C:\Windows\System\NYZcYwl.exe
  2⤵
  PID:11008
- C:\Windows\System\qCIkqnN.exe
  C:\Windows\System\qCIkqnN.exe
  2⤵
  PID:4080
- C:\Windows\System\iFCvmaw.exe
  C:\Windows\System\iFCvmaw.exe
  2⤵
  PID:14244
- C:\Windows\System\UZwBGHg.exe
  C:\Windows\System\UZwBGHg.exe
  2⤵
  PID:4548
- C:\Windows\System\yoMHIhY.exe
  C:\Windows\System\yoMHIhY.exe
  2⤵
  PID:5652
- C:\Windows\System\ImuPRYb.exe
  C:\Windows\System\ImuPRYb.exe
  2⤵
  PID:13328
- C:\Windows\System\IUTXkYz.exe
  C:\Windows\System\IUTXkYz.exe
  2⤵
  PID:3324
- C:\Windows\System\JZCwBhE.exe
  C:\Windows\System\JZCwBhE.exe
  2⤵
  PID:5776
- C:\Windows\System\bWbQFsC.exe
  C:\Windows\System\bWbQFsC.exe
  2⤵
  PID:13392
- C:\Windows\System\rCvDTnw.exe
  C:\Windows\System\rCvDTnw.exe
  2⤵
  PID:5832
- C:\Windows\System\UFfSsqd.exe
  C:\Windows\System\UFfSsqd.exe
  2⤵
  PID:8956
- C:\Windows\System\kcVHIVH.exe
  C:\Windows\System\kcVHIVH.exe
  2⤵
  PID:2500
- C:\Windows\System\EWWfrRn.exe
  C:\Windows\System\EWWfrRn.exe
  2⤵
  PID:11328
- C:\Windows\System\NhPBpFe.exe
  C:\Windows\System\NhPBpFe.exe
  2⤵
  PID:11380
- C:\Windows\System\HkVvsQi.exe
  C:\Windows\System\HkVvsQi.exe
  2⤵
  PID:6140
- C:\Windows\System\zLqxypR.exe
  C:\Windows\System\zLqxypR.exe
  2⤵
  PID:1536
- C:\Windows\System\rqVnyek.exe
  C:\Windows\System\rqVnyek.exe
  2⤵
  PID:11604
- C:\Windows\System\yfkTpyF.exe
  C:\Windows\System\yfkTpyF.exe
  2⤵
  PID:9624
- C:\Windows\System\PSqYlMU.exe
  C:\Windows\System\PSqYlMU.exe
  2⤵
  PID:13740
- C:\Windows\System\SBBUxyl.exe
  C:\Windows\System\SBBUxyl.exe
  2⤵
  PID:8144
- C:\Windows\System\xviSANH.exe
  C:\Windows\System\xviSANH.exe
  2⤵
  PID:5304
- C:\Windows\System\BHSoEYd.exe
  C:\Windows\System\BHSoEYd.exe
  2⤵
  PID:2380
- C:\Windows\System\bXykPnr.exe
  C:\Windows\System\bXykPnr.exe
  2⤵
  PID:6856
- C:\Windows\System\TBsyZBM.exe
  C:\Windows\System\TBsyZBM.exe
  2⤵
  PID:5528
- C:\Windows\System\qkoEqUW.exe
  C:\Windows\System\qkoEqUW.exe
  2⤵
  PID:13836
- C:\Windows\System\WaLHFOF.exe
  C:\Windows\System\WaLHFOF.exe
  2⤵
  PID:5584
- C:\Windows\System\DpiYojm.exe
  C:\Windows\System\DpiYojm.exe
  2⤵
  PID:12156
- C:\Windows\System\rGaEimH.exe
  C:\Windows\System\rGaEimH.exe
  2⤵
  PID:5204
- C:\Windows\System\fcVfKIE.exe
  C:\Windows\System\fcVfKIE.exe
  2⤵
  PID:13932
- C:\Windows\System\FKuXVZJ.exe
  C:\Windows\System\FKuXVZJ.exe
  2⤵
  PID:5288
- C:\Windows\System\hiuKPju.exe
  C:\Windows\System\hiuKPju.exe
  2⤵
  PID:4084
- C:\Windows\System\mZaXYEe.exe
  C:\Windows\System\mZaXYEe.exe
  2⤵
  PID:10672
- C:\Windows\System\ObIvguO.exe
  C:\Windows\System\ObIvguO.exe
  2⤵
  PID:2652
- C:\Windows\System\bKyZBLN.exe
  C:\Windows\System\bKyZBLN.exe
  2⤵
  PID:13976
- C:\Windows\System\yisoYGP.exe
  C:\Windows\System\yisoYGP.exe
  2⤵
  PID:6092
- C:\Windows\System\wEbRDBK.exe
  C:\Windows\System\wEbRDBK.exe
  2⤵
  PID:10800
- C:\Windows\System\dSZluLY.exe
  C:\Windows\System\dSZluLY.exe
  2⤵
  PID:5332
- C:\Windows\System\adCGovl.exe
  C:\Windows\System\adCGovl.exe
  2⤵
  PID:5512
- C:\Windows\System\tLNdTVW.exe
  C:\Windows\System\tLNdTVW.exe
  2⤵
  PID:5536
- C:\Windows\System\PIFcXLa.exe
  C:\Windows\System\PIFcXLa.exe
  2⤵
  PID:5524
- C:\Windows\System\BCnHJnB.exe
  C:\Windows\System\BCnHJnB.exe
  2⤵
  PID:8272
- C:\Windows\System\xmLEaZH.exe
  C:\Windows\System\xmLEaZH.exe
  2⤵
  PID:5588
- C:\Windows\System\bidFgRR.exe
  C:\Windows\System\bidFgRR.exe
  2⤵
  PID:3792
- C:\Windows\System\QyVijpm.exe
  C:\Windows\System\QyVijpm.exe
  2⤵
  PID:2392
- C:\Windows\System\SLyoBFP.exe
  C:\Windows\System\SLyoBFP.exe
  2⤵
  PID:11172
- C:\Windows\System\oiJscIh.exe
  C:\Windows\System\oiJscIh.exe
  2⤵
  PID:3768
- C:\Windows\System\DwKiLXI.exe
  C:\Windows\System\DwKiLXI.exe
  2⤵
  PID:1760
- C:\Windows\System\hSZfTbp.exe
  C:\Windows\System\hSZfTbp.exe
  2⤵
  PID:2284
- C:\Windows\System\rcYdmZp.exe
  C:\Windows\System\rcYdmZp.exe
  2⤵
  PID:3772
- C:\Windows\System\bcjiXXw.exe
  C:\Windows\System\bcjiXXw.exe
  2⤵
  PID:4728
- C:\Windows\System\nsHgdpV.exe
  C:\Windows\System\nsHgdpV.exe
  2⤵
  PID:5720
- C:\Windows\System\XPtqkHq.exe
  C:\Windows\System\XPtqkHq.exe
  2⤵
  PID:4296
- C:\Windows\System\LspUMIp.exe
  C:\Windows\System\LspUMIp.exe
  2⤵
  PID:13376
- C:\Windows\System\kUkgbEv.exe
  C:\Windows\System\kUkgbEv.exe
  2⤵
  PID:2912
- C:\Windows\System\wTOKgTr.exe
  C:\Windows\System\wTOKgTr.exe
  2⤵
  PID:3576
- C:\Windows\System\eeWyhjX.exe
  C:\Windows\System\eeWyhjX.exe
  2⤵
  PID:2552
- C:\Windows\System\vduVzPC.exe
  C:\Windows\System\vduVzPC.exe
  2⤵
  PID:12736
- C:\Windows\System\bZsgkfM.exe
  C:\Windows\System\bZsgkfM.exe
  2⤵
  PID:13420
- C:\Windows\System\lyKBpdS.exe
  C:\Windows\System\lyKBpdS.exe
  2⤵
  PID:10192
- C:\Windows\System\XBwYZEh.exe
  C:\Windows\System\XBwYZEh.exe
  2⤵
  PID:12836
- C:\Windows\System\ctTWHxZ.exe
  C:\Windows\System\ctTWHxZ.exe
  2⤵
  PID:12892
- C:\Windows\System\wUQraYm.exe
  C:\Windows\System\wUQraYm.exe
  2⤵
  PID:12928
- C:\Windows\System\JjLzKmo.exe
  C:\Windows\System\JjLzKmo.exe
  2⤵
  PID:5876
- C:\Windows\System\AcQcjpR.exe
  C:\Windows\System\AcQcjpR.exe
  2⤵
  PID:11252
- C:\Windows\System\ezeDDKO.exe
  C:\Windows\System\ezeDDKO.exe
  2⤵
  PID:10448
- C:\Windows\System\PHszapS.exe
  C:\Windows\System\PHszapS.exe
  2⤵
  PID:9476
- C:\Windows\System\qUtzJRL.exe
  C:\Windows\System\qUtzJRL.exe
  2⤵
  PID:10788
- C:\Windows\System\XVMHfpa.exe
  C:\Windows\System\XVMHfpa.exe
  2⤵
  PID:5960
- C:\Windows\System\fExaUdI.exe
  C:\Windows\System\fExaUdI.exe
  2⤵
  PID:13040
- C:\Windows\System\ftGeHKf.exe
  C:\Windows\System\ftGeHKf.exe
  2⤵
  PID:9452
- C:\Windows\System\MiOxsmS.exe
  C:\Windows\System\MiOxsmS.exe
  2⤵
  PID:6952
- C:\Windows\System\KWfZHDT.exe
  C:\Windows\System\KWfZHDT.exe
  2⤵
  PID:6016
- C:\Windows\System\iwvdegG.exe
  C:\Windows\System\iwvdegG.exe
  2⤵
  PID:9144
- C:\Windows\System\AhVACEh.exe
  C:\Windows\System\AhVACEh.exe
  2⤵
  PID:6084
- C:\Windows\System\zFbsOPe.exe
  C:\Windows\System\zFbsOPe.exe
  2⤵
  PID:6188
- C:\Windows\System\jHCJojp.exe
  C:\Windows\System\jHCJojp.exe
  2⤵
  PID:5500
- C:\Windows\System\QdNqfyf.exe
  C:\Windows\System\QdNqfyf.exe
  2⤵
  PID:10012
- C:\Windows\System\oNUUkYR.exe
  C:\Windows\System\oNUUkYR.exe
  2⤵
  PID:6176
- C:\Windows\System\BCszxvq.exe
  C:\Windows\System\BCszxvq.exe
  2⤵
  PID:6292
- C:\Windows\System\lRZGBHw.exe
  C:\Windows\System\lRZGBHw.exe
  2⤵
  PID:11552
- C:\Windows\System\YfUbtNs.exe
  C:\Windows\System\YfUbtNs.exe
  2⤵
  PID:6308
- C:\Windows\System\tbnNqJx.exe
  C:\Windows\System\tbnNqJx.exe
  2⤵
  PID:9020
- C:\Windows\System\CiEWBgb.exe
  C:\Windows\System\CiEWBgb.exe
  2⤵
  PID:1368
- C:\Windows\System\iOPNElL.exe
  C:\Windows\System\iOPNElL.exe
  2⤵
  PID:8116
- C:\Windows\System\FgSqXwn.exe
  C:\Windows\System\FgSqXwn.exe
  2⤵
  PID:12896
- C:\Windows\System\DNptpgr.exe
  C:\Windows\System\DNptpgr.exe
  2⤵
  PID:13056
- C:\Windows\System\SZMdyqm.exe
  C:\Windows\System\SZMdyqm.exe
  2⤵
  PID:8128
- C:\Windows\System\MpItmDh.exe
  C:\Windows\System\MpItmDh.exe
  2⤵
  PID:13100
- C:\Windows\System\ZyhJRaZ.exe
  C:\Windows\System\ZyhJRaZ.exe
  2⤵
  PID:5276
- C:\Windows\System\BzxBTMQ.exe
  C:\Windows\System\BzxBTMQ.exe
  2⤵
  PID:6688
- C:\Windows\System\gfRlvJV.exe
  C:\Windows\System\gfRlvJV.exe
  2⤵
  PID:7268
- C:\Windows\System\uWKVPJw.exe
  C:\Windows\System\uWKVPJw.exe
  2⤵
  PID:11876
- C:\Windows\System\mXeJeby.exe
  C:\Windows\System\mXeJeby.exe
  2⤵
  PID:4624
- C:\Windows\System\QAahXZq.exe
  C:\Windows\System\QAahXZq.exe
  2⤵
  PID:13276
- C:\Windows\System\DxkxDFv.exe
  C:\Windows\System\DxkxDFv.exe
  2⤵
  PID:1468
- C:\Windows\System\lylgXgM.exe
  C:\Windows\System\lylgXgM.exe
  2⤵
  PID:12172
- C:\Windows\System\GAOPtLw.exe
  C:\Windows\System\GAOPtLw.exe
  2⤵
  PID:9720
- C:\Windows\System\wUKtlYE.exe
  C:\Windows\System\wUKtlYE.exe
  2⤵
  PID:12116
- C:\Windows\System\NzvNMsl.exe
  C:\Windows\System\NzvNMsl.exe
  2⤵
  PID:6744
- C:\Windows\System\GGAnfOT.exe
  C:\Windows\System\GGAnfOT.exe
  2⤵
  PID:2616
- C:\Windows\System\hGIWuNb.exe
  C:\Windows\System\hGIWuNb.exe
  2⤵
  PID:10292
- C:\Windows\System\YgcFAzu.exe
  C:\Windows\System\YgcFAzu.exe
  2⤵
  PID:7644
- C:\Windows\System\YLNlMjP.exe
  C:\Windows\System\YLNlMjP.exe
  2⤵
  PID:13908
- C:\Windows\System\sgcLwpW.exe
  C:\Windows\System\sgcLwpW.exe
  2⤵
  PID:5640
- C:\Windows\System\oYZmFQB.exe
  C:\Windows\System\oYZmFQB.exe
  2⤵
  PID:11288
- C:\Windows\System\SrRimEW.exe
  C:\Windows\System\SrRimEW.exe
  2⤵
  PID:13916
- C:\Windows\System\ymvGteW.exe
  C:\Windows\System\ymvGteW.exe
  2⤵
  PID:10356
- C:\Windows\System\tjlQeBg.exe
  C:\Windows\System\tjlQeBg.exe
  2⤵
  PID:7868
- C:\Windows\System\xOWtAyl.exe
  C:\Windows\System\xOWtAyl.exe
  2⤵
  PID:7136
- C:\Windows\System\lgprPrr.exe
  C:\Windows\System\lgprPrr.exe
  2⤵
  PID:7132
- C:\Windows\System\ecUyexr.exe
  C:\Windows\System\ecUyexr.exe
  2⤵
  PID:5924
- C:\Windows\System\vynhhxh.exe
  C:\Windows\System\vynhhxh.exe
  2⤵
  PID:7008
- C:\Windows\System\hegoOGV.exe
  C:\Windows\System\hegoOGV.exe
  2⤵
  PID:6980
- C:\Windows\System\fqZPKKm.exe
  C:\Windows\System\fqZPKKm.exe
  2⤵
  PID:7128
- C:\Windows\System\RPsIlcK.exe
  C:\Windows\System\RPsIlcK.exe
  2⤵
  PID:1448
- C:\Windows\System\oPsIASa.exe
  C:\Windows\System\oPsIASa.exe
  2⤵
  PID:6192
- C:\Windows\System\WbnwIUj.exe
  C:\Windows\System\WbnwIUj.exe
  2⤵
  PID:6256
- C:\Windows\System\wYUOyYi.exe
  C:\Windows\System\wYUOyYi.exe
  2⤵
  PID:12060
- C:\Windows\System\tDwvFUH.exe
  C:\Windows\System\tDwvFUH.exe
  2⤵
  PID:6556
- C:\Windows\System\olOGICY.exe
  C:\Windows\System\olOGICY.exe
  2⤵
  PID:5552
- C:\Windows\System\HXESZvL.exe
  C:\Windows\System\HXESZvL.exe
  2⤵
  PID:4420
- C:\Windows\System\IyapcFA.exe
  C:\Windows\System\IyapcFA.exe
  2⤵
  PID:6804
- C:\Windows\System\cUsWmXO.exe
  C:\Windows\System\cUsWmXO.exe
  2⤵
  PID:10616
- C:\Windows\System\THlVnMZ.exe
  C:\Windows\System\THlVnMZ.exe
  2⤵
  PID:5692
- C:\Windows\System\QDgUFnJ.exe
  C:\Windows\System\QDgUFnJ.exe
  2⤵
  PID:10116
- C:\Windows\System\IcHLlgv.exe
  C:\Windows\System\IcHLlgv.exe
  2⤵
  PID:4380
- C:\Windows\System\RkVVivK.exe
  C:\Windows\System\RkVVivK.exe
  2⤵
  PID:8908
- C:\Windows\System\CBiPPqv.exe
  C:\Windows\System\CBiPPqv.exe
  2⤵
  PID:2968
- C:\Windows\System\hftnEMO.exe
  C:\Windows\System\hftnEMO.exe
  2⤵
  PID:12588
- C:\Windows\System\TqeMzIB.exe
  C:\Windows\System\TqeMzIB.exe
  2⤵
  PID:12948
- C:\Windows\System\RuuBXyF.exe
  C:\Windows\System\RuuBXyF.exe
  2⤵
  PID:7688
- C:\Windows\System\SlggEdL.exe
  C:\Windows\System\SlggEdL.exe
  2⤵
  PID:13564
- C:\Windows\System\DEnptwf.exe
  C:\Windows\System\DEnptwf.exe
  2⤵
  PID:7684
- C:\Windows\System\HrpajjC.exe
  C:\Windows\System\HrpajjC.exe
  2⤵
  PID:12868
- C:\Windows\System\SDcGbiS.exe
  C:\Windows\System\SDcGbiS.exe
  2⤵
  PID:11292
- C:\Windows\System\MtKTHNn.exe
  C:\Windows\System\MtKTHNn.exe
  2⤵
  PID:13164
- C:\Windows\System\BRAeAIe.exe
  C:\Windows\System\BRAeAIe.exe
  2⤵
  PID:10868
- C:\Windows\System\bhUdNHa.exe
  C:\Windows\System\bhUdNHa.exe
  2⤵
  PID:11440
- C:\Windows\System\UIyMPok.exe
  C:\Windows\System\UIyMPok.exe
  2⤵
  PID:6032
- C:\Windows\System\HsWAjMF.exe
  C:\Windows\System\HsWAjMF.exe
  2⤵
  PID:9428
- C:\Windows\System\pzFplPa.exe
  C:\Windows\System\pzFplPa.exe
  2⤵
  PID:8076
- C:\Windows\System\NNICpBD.exe
  C:\Windows\System\NNICpBD.exe
  2⤵
  PID:11728
- C:\Windows\System\uinODdm.exe
  C:\Windows\System\uinODdm.exe
  2⤵
  PID:6400
- C:\Windows\System\iRulwbY.exe
  C:\Windows\System\iRulwbY.exe
  2⤵
  PID:7284
- C:\Windows\System\IdZrtNL.exe
  C:\Windows\System\IdZrtNL.exe
  2⤵
  PID:13796
- C:\Windows\System\EdDreSb.exe
  C:\Windows\System\EdDreSb.exe
  2⤵
  PID:6316
- C:\Windows\System\IewMzhM.exe
  C:\Windows\System\IewMzhM.exe
  2⤵
  PID:8172
- C:\Windows\System\VQyueSo.exe
  C:\Windows\System\VQyueSo.exe
  2⤵
  PID:10428
- C:\Windows\System\ccpCvlw.exe
  C:\Windows\System\ccpCvlw.exe
  2⤵
  PID:10392
- C:\Windows\System\egdXTod.exe
  C:\Windows\System\egdXTod.exe
  2⤵
  PID:7000
- C:\Windows\System\TekIEst.exe
  C:\Windows\System\TekIEst.exe
  2⤵
  PID:6796
- C:\Windows\System\AKkrEKv.exe
  C:\Windows\System\AKkrEKv.exe
  2⤵
  PID:6408
- C:\Windows\System\mSvAmpy.exe
  C:\Windows\System\mSvAmpy.exe
  2⤵
  PID:8700
- C:\Windows\System\gbKIzGQ.exe
  C:\Windows\System\gbKIzGQ.exe
  2⤵
  PID:8436
- C:\Windows\System\mpUOUrs.exe
  C:\Windows\System\mpUOUrs.exe
  2⤵
  PID:6364
- C:\Windows\System\ZjIHAtm.exe
  C:\Windows\System\ZjIHAtm.exe
  2⤵
  PID:12268
- C:\Windows\System\ETPaKgT.exe
  C:\Windows\System\ETPaKgT.exe
  2⤵
  PID:5232
- C:\Windows\System\peUyoLI.exe
  C:\Windows\System\peUyoLI.exe
  2⤵
  PID:7604
- C:\Windows\System\wVeyyyS.exe
  C:\Windows\System\wVeyyyS.exe
  2⤵
  PID:14044
- C:\Windows\System\HQWYjjx.exe
  C:\Windows\System\HQWYjjx.exe
  2⤵
  PID:5620
- C:\Windows\System\DwLEadT.exe
  C:\Windows\System\DwLEadT.exe
  2⤵
  PID:8328
- C:\Windows\System\kPjLroj.exe
  C:\Windows\System\kPjLroj.exe
  2⤵
  PID:8980
- C:\Windows\System\kTUhcwr.exe
  C:\Windows\System\kTUhcwr.exe
  2⤵
  PID:14072
- C:\Windows\System\uTwmGNA.exe
  C:\Windows\System\uTwmGNA.exe
  2⤵
  PID:14200
- C:\Windows\System\FiUOwaW.exe
  C:\Windows\System\FiUOwaW.exe
  2⤵
  PID:5096
- C:\Windows\System\EikNYtr.exe
  C:\Windows\System\EikNYtr.exe
  2⤵
  PID:13924
- C:\Windows\System\elxPMVn.exe
  C:\Windows\System\elxPMVn.exe
  2⤵
  PID:2700
- C:\Windows\System\rxjRSmc.exe
  C:\Windows\System\rxjRSmc.exe
  2⤵
  PID:8964
- C:\Windows\System\pmpVFzG.exe
  C:\Windows\System\pmpVFzG.exe
  2⤵
  PID:9028
- C:\Windows\System\DaIaMfp.exe
  C:\Windows\System\DaIaMfp.exe
  2⤵
  PID:7200
- C:\Windows\System\WwMytPG.exe
  C:\Windows\System\WwMytPG.exe
  2⤵
  PID:12364
- C:\Windows\System\cnHzUvy.exe
  C:\Windows\System\cnHzUvy.exe
  2⤵
  PID:7040
- C:\Windows\System\IjGsRGq.exe
  C:\Windows\System\IjGsRGq.exe
  2⤵
  PID:7196
- C:\Windows\System\AKQrSDl.exe
  C:\Windows\System\AKQrSDl.exe
  2⤵
  PID:9048
- C:\Windows\System\dLsfbno.exe
  C:\Windows\System\dLsfbno.exe
  2⤵
  PID:2684
- C:\Windows\System\gXxexCQ.exe
  C:\Windows\System\gXxexCQ.exe
  2⤵
  PID:5860
- C:\Windows\System\drvHZzW.exe
  C:\Windows\System\drvHZzW.exe
  2⤵
  PID:12432
- C:\Windows\System\WQoyvcL.exe
  C:\Windows\System\WQoyvcL.exe
  2⤵
  PID:6704
- C:\Windows\System\EhgpxUX.exe
  C:\Windows\System\EhgpxUX.exe
  2⤵
  PID:8332
- C:\Windows\System\EJSjnRL.exe
  C:\Windows\System\EJSjnRL.exe
  2⤵
  PID:8424
- C:\Windows\System\crBlNHM.exe
  C:\Windows\System\crBlNHM.exe
  2⤵
  PID:10772
- C:\Windows\System\CLeVtZi.exe
  C:\Windows\System\CLeVtZi.exe
  2⤵
  PID:9348
- C:\Windows\System\eMTLfnW.exe
  C:\Windows\System\eMTLfnW.exe
  2⤵
  PID:7820
- C:\Windows\System\WgjYRtg.exe
  C:\Windows\System\WgjYRtg.exe
  2⤵
  PID:8524
- C:\Windows\System\BZVrPVx.exe
  C:\Windows\System\BZVrPVx.exe
  2⤵
  PID:4244
- C:\Windows\System\xVLcfXu.exe
  C:\Windows\System\xVLcfXu.exe
  2⤵
  PID:7876
- C:\Windows\System\JSlcYZf.exe
  C:\Windows\System\JSlcYZf.exe
  2⤵
  PID:9508
- C:\Windows\System\kPsLowh.exe
  C:\Windows\System\kPsLowh.exe
  2⤵
  PID:7396
- C:\Windows\System\ZBZvZgL.exe
  C:\Windows\System\ZBZvZgL.exe
  2⤵
  PID:8264
- C:\Windows\System\UdrJXtK.exe
  C:\Windows\System\UdrJXtK.exe
  2⤵
  PID:7796
- C:\Windows\System\KkiMgiz.exe
  C:\Windows\System\KkiMgiz.exe
  2⤵
  PID:8640
- C:\Windows\System\bUjvCWv.exe
  C:\Windows\System\bUjvCWv.exe
  2⤵
  PID:11472
- C:\Windows\System\ZqXVSla.exe
  C:\Windows\System\ZqXVSla.exe
  2⤵
  PID:12652
- C:\Windows\System\YmRYfSb.exe
  C:\Windows\System\YmRYfSb.exe
  2⤵
  PID:10332
- C:\Windows\System\lUqmJyC.exe
  C:\Windows\System\lUqmJyC.exe
  2⤵
  PID:9652
- C:\Windows\System\peWHxDw.exe
  C:\Windows\System\peWHxDw.exe
  2⤵
  PID:8584
- C:\Windows\System\prWgacy.exe
  C:\Windows\System\prWgacy.exe
  2⤵
  PID:5416
- C:\Windows\System\LCKfOOc.exe
  C:\Windows\System\LCKfOOc.exe
  2⤵
  PID:6748
- C:\Windows\System\nTyLMqe.exe
  C:\Windows\System\nTyLMqe.exe
  2⤵
  PID:12604
- C:\Windows\System\ntdyEXX.exe
  C:\Windows\System\ntdyEXX.exe
  2⤵
  PID:9908
- C:\Windows\System\wWnnQAy.exe
  C:\Windows\System\wWnnQAy.exe
  2⤵
  PID:5568
- C:\Windows\System\ZIPejvF.exe
  C:\Windows\System\ZIPejvF.exe
  2⤵
  PID:9548
- C:\Windows\System\mEyoqGE.exe
  C:\Windows\System\mEyoqGE.exe
  2⤵
  PID:8848
- C:\Windows\System\KjluKBv.exe
  C:\Windows\System\KjluKBv.exe
  2⤵
  PID:7252
- C:\Windows\System\AbdsfdP.exe
  C:\Windows\System\AbdsfdP.exe
  2⤵
  PID:688
- C:\Windows\System\oDJYfEw.exe
  C:\Windows\System\oDJYfEw.exe
  2⤵
  PID:8200
- C:\Windows\System\hfmvpta.exe
  C:\Windows\System\hfmvpta.exe
  2⤵
  PID:3056
- C:\Windows\System\JxGHXJC.exe
  C:\Windows\System\JxGHXJC.exe
  2⤵
  PID:9136
- C:\Windows\System\OEPEubm.exe
  C:\Windows\System\OEPEubm.exe
  2⤵
  PID:8836
- C:\Windows\System\EhvTHBv.exe
  C:\Windows\System\EhvTHBv.exe
  2⤵
  PID:10096
- C:\Windows\System\pPnUvDg.exe
  C:\Windows\System\pPnUvDg.exe
  2⤵
  PID:8320
- C:\Windows\System\SsjhvEs.exe
  C:\Windows\System\SsjhvEs.exe
  2⤵
  PID:10164
- C:\Windows\System\zUCuict.exe
  C:\Windows\System\zUCuict.exe
  2⤵
  PID:6180
- C:\Windows\System\slhydwq.exe
  C:\Windows\System\slhydwq.exe
  2⤵
  PID:9124
- C:\Windows\System\QKKLozk.exe
  C:\Windows\System\QKKLozk.exe
  2⤵
  PID:8828
- C:\Windows\System\WTzpbyS.exe
  C:\Windows\System\WTzpbyS.exe
  2⤵
  PID:9276
- C:\Windows\System\oUdlcJa.exe
  C:\Windows\System\oUdlcJa.exe
  2⤵
  PID:9664
- C:\Windows\System\UShJZuL.exe
  C:\Windows\System\UShJZuL.exe
  2⤵
  PID:1324
- C:\Windows\System\yaqKzGu.exe
  C:\Windows\System\yaqKzGu.exe
  2⤵
  PID:4360
- C:\Windows\System\aoyGQHq.exe
  C:\Windows\System\aoyGQHq.exe
  2⤵
  PID:14348
- C:\Windows\System\MJUupkp.exe
  C:\Windows\System\MJUupkp.exe
  2⤵
  PID:14380
- C:\Windows\System\shjOrxS.exe
  C:\Windows\System\shjOrxS.exe
  2⤵
  PID:14480
- C:\Windows\System\IuSuqTP.exe
  C:\Windows\System\IuSuqTP.exe
  2⤵
  PID:14496
- C:\Windows\System\LZvruRC.exe
  C:\Windows\System\LZvruRC.exe
  2⤵
  PID:14520
- C:\Windows\System\PIsjsDw.exe
  C:\Windows\System\PIsjsDw.exe
  2⤵
  PID:14552
- C:\Windows\System\slbASwD.exe
  C:\Windows\System\slbASwD.exe
  2⤵
  PID:14572
- C:\Windows\System\foXjeOe.exe
  C:\Windows\System\foXjeOe.exe
  2⤵
  PID:14816
- C:\Windows\System\UZYSLqD.exe
  C:\Windows\System\UZYSLqD.exe
  2⤵
  PID:14840
- C:\Windows\System\DyiSFLc.exe
  C:\Windows\System\DyiSFLc.exe
  2⤵
  PID:14868
- C:\Windows\System\usKrAip.exe
  C:\Windows\System\usKrAip.exe
  2⤵
  PID:14892
- C:\Windows\System\zJGsrgu.exe
  C:\Windows\System\zJGsrgu.exe
  2⤵
  PID:14924
- C:\Windows\System\qgxfFIr.exe
  C:\Windows\System\qgxfFIr.exe
  2⤵
  PID:14972
- C:\Windows\System\sAuqLbm.exe
  C:\Windows\System\sAuqLbm.exe
  2⤵
  PID:15020
- C:\Windows\System\BcEZElo.exe
  C:\Windows\System\BcEZElo.exe
  2⤵
  PID:15080
- C:\Windows\System\ZaRLTAl.exe
  C:\Windows\System\ZaRLTAl.exe
  2⤵
  PID:15108
- C:\Windows\System\KuCyfnD.exe
  C:\Windows\System\KuCyfnD.exe
  2⤵
  PID:15132
- C:\Windows\System\fjuioSQ.exe
  C:\Windows\System\fjuioSQ.exe
  2⤵
  PID:15156
- C:\Windows\System\XjjFZam.exe
  C:\Windows\System\XjjFZam.exe
  2⤵
  PID:15184
- C:\Windows\System\DxYJCNv.exe
  C:\Windows\System\DxYJCNv.exe
  2⤵
  PID:15200
- C:\Windows\System\CgXYdni.exe
  C:\Windows\System\CgXYdni.exe
  2⤵
  PID:15224
- C:\Windows\System\AWBixla.exe
  C:\Windows\System\AWBixla.exe
  2⤵
  PID:15240
- C:\Windows\System\CkZPnee.exe
  C:\Windows\System\CkZPnee.exe
  2⤵
  PID:15256
- C:\Windows\System\RwWmsNS.exe
  C:\Windows\System\RwWmsNS.exe
  2⤵
  PID:15272
- C:\Windows\System\qELjNDT.exe
  C:\Windows\System\qELjNDT.exe
  2⤵
  PID:15288
- C:\Windows\System\npGvYxH.exe
  C:\Windows\System\npGvYxH.exe
  2⤵
  PID:15312
- C:\Windows\System\TZpGSAo.exe
  C:\Windows\System\TZpGSAo.exe
  2⤵
  PID:15336
- C:\Windows\System\jkyvONF.exe
  C:\Windows\System\jkyvONF.exe
  2⤵
  PID:15352
- C:\Windows\System\zJYLObG.exe
  C:\Windows\System\zJYLObG.exe
  2⤵
  PID:9772
- C:\Windows\System\VCcTVcA.exe
  C:\Windows\System\VCcTVcA.exe
  2⤵
  PID:8540
- C:\Windows\System\rSOkqmL.exe
  C:\Windows\System\rSOkqmL.exe
  2⤵
  PID:6128
- C:\Windows\System\YNDPCKu.exe
  C:\Windows\System\YNDPCKu.exe
  2⤵
  PID:7528
- C:\Windows\System\hSDXVct.exe
  C:\Windows\System\hSDXVct.exe
  2⤵
  PID:2212
- C:\Windows\System\LdzTloL.exe
  C:\Windows\System\LdzTloL.exe
  2⤵
  PID:7540
- C:\Windows\System\hXcwIRH.exe
  C:\Windows\System\hXcwIRH.exe
  2⤵
  PID:11468
- C:\Windows\System\IoctRbM.exe
  C:\Windows\System\IoctRbM.exe
  2⤵
  PID:10768
- C:\Windows\System\WjmrjjP.exe
  C:\Windows\System\WjmrjjP.exe
  2⤵
  PID:9264
- C:\Windows\System\NFKkWho.exe
  C:\Windows\System\NFKkWho.exe
  2⤵
  PID:7448
- C:\Windows\System\VcQQpIk.exe
  C:\Windows\System\VcQQpIk.exe
  2⤵
  PID:7224
- C:\Windows\System\jtdHJDB.exe
  C:\Windows\System\jtdHJDB.exe
  2⤵
  PID:6008
- C:\Windows\System\LxUMDGI.exe
  C:\Windows\System\LxUMDGI.exe
  2⤵
  PID:15192
- C:\Windows\System\PAHmhvD.exe
  C:\Windows\System\PAHmhvD.exe
  2⤵
  PID:15212
- C:\Windows\System\uzhpvyo.exe
  C:\Windows\System\uzhpvyo.exe
  2⤵
  PID:14860
- C:\Windows\System\SRAppPi.exe
  C:\Windows\System\SRAppPi.exe
  2⤵
  PID:14956
- C:\Windows\System\TThzHSJ.exe
  C:\Windows\System\TThzHSJ.exe
  2⤵
  PID:10496
- C:\Windows\System\OlIxijj.exe
  C:\Windows\System\OlIxijj.exe
  2⤵
  PID:15060
- C:\Windows\System\ynhwsad.exe
  C:\Windows\System\ynhwsad.exe
  2⤵
  PID:15092
- C:\Windows\System\QkYQGja.exe
  C:\Windows\System\QkYQGja.exe
  2⤵
  PID:15128
- C:\Windows\System\FJPzajV.exe
  C:\Windows\System\FJPzajV.exe
  2⤵
  PID:11476
- C:\Windows\System\uqaldYl.exe
  C:\Windows\System\uqaldYl.exe
  2⤵
  PID:14432
- C:\Windows\System\CSocxEc.exe
  C:\Windows\System\CSocxEc.exe
  2⤵
  PID:1968
- C:\Windows\System\PfTBiKg.exe
  C:\Windows\System\PfTBiKg.exe
  2⤵
  PID:11676
- C:\Windows\System\VTOexid.exe
  C:\Windows\System\VTOexid.exe
  2⤵
  PID:9220
- C:\Windows\System\eRYkjKz.exe
  C:\Windows\System\eRYkjKz.exe
  2⤵
  PID:11040
- C:\Windows\System\aVEzLPe.exe
  C:\Windows\System\aVEzLPe.exe
  2⤵
  PID:5248
- C:\Windows\System\ociXtXU.exe
  C:\Windows\System\ociXtXU.exe
  2⤵
  PID:14580
- C:\Windows\System\NVnUYdo.exe
  C:\Windows\System\NVnUYdo.exe
  2⤵
  PID:10532
- C:\Windows\System\xckBZzY.exe
  C:\Windows\System\xckBZzY.exe
  2⤵
  PID:14952
- C:\Windows\System\AlVoHWf.exe
  C:\Windows\System\AlVoHWf.exe
  2⤵
  PID:9456
- C:\Windows\System\nzIogfb.exe
  C:\Windows\System\nzIogfb.exe
  2⤵
  PID:6840
- C:\Windows\System\bfEozjw.exe
  C:\Windows\System\bfEozjw.exe
  2⤵
  PID:10736
- C:\Windows\System\ggdCmHc.exe
  C:\Windows\System\ggdCmHc.exe
  2⤵
  PID:10088
- C:\Windows\System\oAKXqvU.exe
  C:\Windows\System\oAKXqvU.exe
  2⤵
  PID:5228
- C:\Windows\System\XpjsVkk.exe
  C:\Windows\System\XpjsVkk.exe
  2⤵
  PID:10412
- C:\Windows\System\RvVMBPR.exe
  C:\Windows\System\RvVMBPR.exe
  2⤵
  PID:14420
- C:\Windows\System\OrUzvRy.exe
  C:\Windows\System\OrUzvRy.exe
  2⤵
  PID:12028
- C:\Windows\System\uOLjffQ.exe
  C:\Windows\System\uOLjffQ.exe
  2⤵
  PID:2136
- C:\Windows\System\laLfSXZ.exe
  C:\Windows\System\laLfSXZ.exe
  2⤵
  PID:15280
- C:\Windows\System\yuxZnnQ.exe
  C:\Windows\System\yuxZnnQ.exe
  2⤵
  PID:11164
- C:\Windows\System\IQSYGTH.exe
  C:\Windows\System\IQSYGTH.exe
  2⤵
  PID:14608
- C:\Windows\System\fWtdsGj.exe
  C:\Windows\System\fWtdsGj.exe
  2⤵
  PID:10596
- C:\Windows\System\SszttpN.exe
  C:\Windows\System\SszttpN.exe
  2⤵
  PID:11108
- C:\Windows\System\JWILQgb.exe
  C:\Windows\System\JWILQgb.exe
  2⤵
  PID:15004
- C:\Windows\System\hgwQboB.exe
  C:\Windows\System\hgwQboB.exe
  2⤵
  PID:4592
- C:\Windows\System\asRVRAf.exe
  C:\Windows\System\asRVRAf.exe
  2⤵
  PID:9568
- C:\Windows\System\EMjebnp.exe
  C:\Windows\System\EMjebnp.exe
  2⤵
  PID:14588
- C:\Windows\System\WfoFPEq.exe
  C:\Windows\System\WfoFPEq.exe
  2⤵
  PID:11512
- C:\Windows\System\eYTXzzv.exe
  C:\Windows\System\eYTXzzv.exe
  2⤵
  PID:10512
- C:\Windows\System\YlTqDJk.exe
  C:\Windows\System\YlTqDJk.exe
  2⤵
  PID:12528
- C:\Windows\System\kvNixzJ.exe
  C:\Windows\System\kvNixzJ.exe
  2⤵
  PID:9512
- C:\Windows\System\ZsEtpXE.exe
  C:\Windows\System\ZsEtpXE.exe
  2⤵
  PID:10040
- C:\Windows\System\iNEUYeR.exe
  C:\Windows\System\iNEUYeR.exe
  2⤵
  PID:10160
- C:\Windows\System\NpLElJU.exe
  C:\Windows\System\NpLElJU.exe
  2⤵
  PID:10568
- C:\Windows\System\KCxhTvZ.exe
  C:\Windows\System\KCxhTvZ.exe
  2⤵
  PID:9496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rmvo3hh1.qmc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AQTnhkK.exe

Filesize
1.9MB

MD5
e39baa1e00d62a06f1eaf20d4e54070a

SHA1
1ab0d074e91012bde4401f206416d16e7c4480d3

SHA256
5b2431d4911d0e1b64bf7600d20f9d828d92f4e8ab850b2cd0a122e4aa2b325c

SHA512
18375b205f36b7924cc389d86f229607792859ad304c4d6051bc7b466313f29b89c368e82c6db7c5110362e80557d30968fb113c0a8045bbc9f18a7ff55b431e

Download Submit
C:\Windows\System\AQWalvZ.exe

Filesize
18B

MD5
5db3df0964e5c695675f39e99d1f288b

SHA1
84b597ea47f1f6b13b223cbb576a55e47a79cfaa

SHA256
15f5f6f9d4846d3bfaf7f8740e9c849aebfecfea6fc86fee82eb18d6ec03fd9f

SHA512
f71b3480e977c4ca4affaaec3f3bd31e3598fdd986ea7bafee42b5d6a8676e69449256bbab19fc0cc61412a454871e6b79cebb0c5e3610b9e98c4f089888aa18

Download Submit
C:\Windows\System\ASpkLMe.exe

Filesize
1.9MB

MD5
3b5e09b548d8c99e37d2980c36d5bb44

SHA1
949daad8032393bc11436986110f675308f8e13b

SHA256
4844c066e4469e2976cc68c74b7d8ac04f493cf5aa82de40e632be172dc0d670

SHA512
d62edca29880d61afc4b6b565fee08febc978ade77912f8157e34ce35e74d30678c03ba30b1df72473be96feab45c7117a4f0f0ddd1e62d881dd2ce47ed02c79

Download Submit
C:\Windows\System\CJHbnBl.exe

Filesize
1.9MB

MD5
4eb834d9d79c4f149e57a288f70aa7c9

SHA1
4a812a5d618d95be751e9660a48a70b7b1c83511

SHA256
afafe3f94c24d424cf33d7a738ee721ac695bd086714a2be03f06ecf176a2403

SHA512
5769291d837d5828d5e616d349b4842ad540350e86ba8f985906d6bf1e4fe6900fd2b02bc51e289f0c5069dd45941fa9acb81e58c4ec54773621e34988329fa7

Download Submit
C:\Windows\System\DTBhpun.exe

Filesize
1.9MB

MD5
1f7b6375400ac281c59f6ee948174bcf

SHA1
103e4ae5371159c30016cec4945610a9cae1b6d5

SHA256
56bee6ec4461744b44e12743e3efa3d3e0e9c0cfcbd719b18bb43a74bd4c9264

SHA512
0af0ca0c15f14305366cd1423475c238a0dbe2289ac58fcea3c521151fcbce5162a153b767918ba30a4df0287dfb3b85842c3e4e1badf8dc79c6518a9023dc01

Download Submit
C:\Windows\System\GoYrXXt.exe

Filesize
1.9MB

MD5
ad8b5927cdad339d4bf0e0bd57b34ad8

SHA1
1b024a5edf17aa1666a231fb54156e9f1879f9ea

SHA256
e6b0263363ba9093c65569d0168a607c3f3234f8408cd61f8e260469aba28159

SHA512
897eb6925a88040aeaaec94c4fb116a33016628fafe42d1035363a15480feec1990d55a82d4b74eee762d3d093df81aa582bf505d0fb2b621f96ae4ecd3145fe

Download Submit
C:\Windows\System\Gqkiasu.exe

Filesize
1.9MB

MD5
a9b932401400deae151a7c98a0d17f45

SHA1
8713cf25f132739e9bde958e30ff61977bc78f25

SHA256
83a2448426974a6674abc30c1af3c4828dda64b6d073612ca0af82d42bc0a0fa

SHA512
18e0ce39f90fb76c8c452179929b039f7d83879197daed4dd3798ae8ac61ba9f90182b4b4321c026f3a4e77d15377ee8b8881a40c177f6895a97720d0c53ce3b

Download Submit
C:\Windows\System\GuLmkQa.exe

Filesize
1.9MB

MD5
9e9f2273be40b39212ff5f72c1dfb8d5

SHA1
edc946cc84449e075d4b77f6773ab0c71e8db781

SHA256
b1c18a0df3cf398f0e50b60f52a5da78dc3d2a952e0a3169a58f908ac23f947e

SHA512
de6f967ac9bb0ad33cdab682d131997f3512e9b5cd6b64f4e1b46409a279afe26abf56d2f95734f881b508c249fb0bb6693786439caa474af0883148c962a874

Download Submit
C:\Windows\System\IDuRqfR.exe

Filesize
1.9MB

MD5
a5777f1cad22295eeefc83b752ce0c4d

SHA1
c4341222326d3a85582f90110941dc5157d6167c

SHA256
0db6f2cea1c7c23562571f4d0fa8079ebfa880f25994a217548c4c1a4b17cd1b

SHA512
007613e0f6ac815c3065985dc0bfa39e8e03055173c0edfff6534e59f5cee1e740cb35673cf023549f9c24225c3bfd02a49a121cd4d047ec088a5d4875f52d64

Download Submit
C:\Windows\System\JSSTUhQ.exe

Filesize
1.9MB

MD5
62cba8447c84ced8381187e723904aac

SHA1
a145039ca8db732594edb4beecdd7f0ce0c353b4

SHA256
6d4f67ba11b805e8b388249268bc9e2f3c15508a98fa865db6239dda97caaa9e

SHA512
056842b429675bb1e31b1681bf5af1ac3a1558ac363043f11e5ab192807b3e6cef615fcf09170e9d7db479d1d14c6e2c1b92e0331a2d24716cf50ada0c18ecba

Download Submit
C:\Windows\System\Kogfajr.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\System\LdCnYWo.exe

Filesize
1.9MB

MD5
3b747997a24b137977493483214137af

SHA1
362a5274ad62b1e00acc47daa7ecacb833dff675

SHA256
7dc185ef97da74e2ea49a4cb29c2b365ac30891a0c4154de225c330fef28fa28

SHA512
a5a6a29e73dffbc778a7505f4bbb2dabe3a00f8e3367949d86daae1999f285105afcd45d3159b861a0896d930306cf6e8cf5e514140b30e525c6dcd7e6bdcb5d

Download Submit
C:\Windows\System\LdFRRfk.exe

Filesize
1.9MB

MD5
ee3b4f2d0458c9b666edf8260c141485

SHA1
d9edf4bff07d6e16e5d7f476756c3b3f68bd1f7b

SHA256
16633fd8ab29e873c4b0ec0d053dc6d54e08a6437287fbe70c6e58a8312f9245

SHA512
fe08e438283f9455afdb7b3e7b4c9cff894bcf6ff6a7ea4659b4c0fb6fdae4c1e6389ab917917ef19a79b9aa5ec4c4311ff7da898e52eafac56215373e8cc378

Download Submit
C:\Windows\System\ORWySGX.exe

Filesize
1.9MB

MD5
635daaf7293eabe19459ce34d5f0e9a1

SHA1
c5a02041085600cb86e84e3e51334f1faab86006

SHA256
6c5e316c9d6e7dee24cbe369c632dc3d2302738d22a9712cff6eee7439517c46

SHA512
10895fb4ccd5939429bf8924e5bd7337658d15b95e0cc9305b565029bcfdc2047e040446a0e3425f681dc37f9816e8247fca60b6dc65f6f62210aae748ad6cc8

Download Submit
C:\Windows\System\OowVUlI.exe

Filesize
1.9MB

MD5
6d3d5126b49980e8a4deb75b39f51cec

SHA1
159c4d26e8b1efef0a558df170f78026e8a8066a

SHA256
f4efb52aa08e6ce48e1cac5efcf148cdcaf07099115cc44f36c527947279f829

SHA512
09165805482767f8b9c41a80b4e44281410d265ee3a7d65b866dd6a7d9529eb3c397263f955797e1a54efc14c5e31ff305226ee831b707894591cf5aadb44a7d

Download Submit
C:\Windows\System\QMCfyAY.exe

Filesize
1.9MB

MD5
8ae3038abb9e32c1a9cdf4d6d98284b6

SHA1
170d5622bfda4ce320d2429730dbc32957c58198

SHA256
b192fbe2c915283ecfad056448dd941a2150a05ef6586681eb5059b62354d5fa

SHA512
1ab5610935054901eba0637875069919795166f95fedd5e24dbb6423d3c340df0dd7cf7fa7510a3dd19555277238754e19eef7f3560cb3b2138584c2d402fa51

Download Submit
C:\Windows\System\STkYmyK.exe

Filesize
1.9MB

MD5
8009c4a0caa1c7e744b282b1c392f19b

SHA1
08ab965ab01f23e7551e6f5c3387d90fa7171aa3

SHA256
4f949d6f03d974520845144b27a8cd6d87e5b7582e5f8b5a46db0f6cd6115a94

SHA512
e4b9a5f9f7589f8bb45becdb746e99fc0ef9ea4cab6643ef46a92be960fa877a8efc8d5671b966b298dc9ff10990bc42ed3d170c6a73c55e1c187260eddaecd5

Download Submit
C:\Windows\System\UcWySCx.exe

Filesize
1.9MB

MD5
f86ea6cdff43ed3b23f76abc365bd89e

SHA1
6e6a75f7db9e47692e218638dfcd671a8c481dc5

SHA256
79e6aa08176800191082e371370a19c25dbff108a2efa645352e98a797edf480

SHA512
b78395b116b386189e788780029919378f0d139ba0bf26bcef619b96d4fb9892082c5f019b7ba0312142bda95a576d0e9ef361800af592102660114be5b48f42

Download Submit
C:\Windows\System\UkpvqDy.exe

Filesize
1.9MB

MD5
57f09bf2c6996df498a5074a0bffca46

SHA1
385fbfba2026b7346f3dc7e981853948c7cbb98d

SHA256
ad7027492509935dd6f93ca4f80c327f49b070a3c2bc313f665b1d76db9a5fa4

SHA512
fefb36b8e049f8e985c3db85b860e6a68c6d50441ff5b70f8a1e143449d221bdd44e47d00d4d1204cf50a61cf2e60d409dc0446edb2017080cc049dcbbba27a1

Download Submit
C:\Windows\System\WXslMwP.exe

Filesize
1.9MB

MD5
43f7dfb2056455708809ce69d18db5b5

SHA1
3d4879eb93f8ef20809a9d69d62b4d9b3a915846

SHA256
2fb9ded0d908459e75e280fcf4d6ec75555554ccebf2c41937821b5e8984901a

SHA512
749d844d3dca036f1746f8f49c34923e8df71579d7470ed28f8a04aace2382f2e6d4c17f418a1f28823f3d572cc9186fa02ae856fdd34c984f72b760d6bc2fa5

Download Submit
C:\Windows\System\dQestpu.exe

Filesize
1.9MB

MD5
b4eb71a42636c9eaa1fb96e5e3c6243f

SHA1
94da907b1caed9e7f1da9110461f5438cb412e96

SHA256
5ab64c8a089ae0dfc6cb5f9784e6e2f1bbe7dd407512fe48a60f8958426f5f2f

SHA512
bdbfddf5eaa8084f8ff1895021d30ca225aa511e5a201d23ab33a15ba2859d0cdb95c8d22ce2fc99cfeea670db915681364d28e4b8f55e0a28fe35df428bc8bc

Download Submit
C:\Windows\System\dSuyMSG.exe

Filesize
1.9MB

MD5
d8bf67605885abac9df63aebf8169981

SHA1
a0030c327a25b191ccd151534779afbf97a8966b

SHA256
45b86143ecd3623ea24114ef4b4e8429457c96f718f5bfb804c4c93814379766

SHA512
35960f0b5959d56c734f750453655b1126ddcc035e282218adf9f027d772b3826d51ae22d793303e23f9e4a91eab9ebe9791469d55389ec7ed49c20b890b4ced

Download Submit
C:\Windows\System\gsqECvu.exe

Filesize
1.9MB

MD5
695019d5fb1c83aee4dbda24e3c80c65

SHA1
546edf3055c14e3e6e9068e2d9eec0b43418105a

SHA256
54daf2227bf74814863cda0326d26d4bc348001c7789b3144d92bf63bcd3ce76

SHA512
6a377431e7db57c3adc1fb2e8df28049e5b5ad508566af6dbbb5d7f0606146a69acd46b1c503876fb7e623eb40f0a68e234e29384a9de9ebfd0fb96de8eadcb4

Download Submit
C:\Windows\System\hkbzHam.exe

Filesize
1.9MB

MD5
4a5fef3c2fc0a9e070860d5d930b7bf5

SHA1
749ddae24f4ad0195d8f6ce6f41a7116c90341c8

SHA256
2177d981c3703dd323b76c72c5b72a51d673fc392f6ea95268287876c10355a5

SHA512
9f113fa9d7947f10e7b636ce3a93ada7ee19c7e67e21b8600b17776bee68d2198285b6fb3fe7ef8d92b2dc64cc010bd4f9a101a083e8db322d7e20d6b494406e

Download Submit
C:\Windows\System\jYNrcaV.exe

Filesize
1.9MB

MD5
5d8e9faa4d6e993363b511ea73a19d97

SHA1
4a97fa8dd4edb5d89450ff55cf3b86a94a0d1294

SHA256
be3c95bd673e9a71a45aeadae41d9d17a1a0c54d56d14b2a92cec7813766a9d9

SHA512
ff56894351e74e1cd9a3aea628ca87ec4880b581bbb693c24292fed91460b6c85f6b9e33e933e0e7da5b712a5edafca85a8501cf3e006eabc082d1744e5c5fd0

Download Submit
C:\Windows\System\mGdyydk.exe

Filesize
1.9MB

MD5
fc3aa677cdc351c8ff8325489b178fc5

SHA1
766009c9400f1a6145fb2d046bec91b9a7d4989a

SHA256
fa80729bd4f00dddbe371dbfaf1ef891ee6aa8ffa26d3a456c8c086c00316bc5

SHA512
1809dc456d7e958acf4fd2198d9275c41cec764ddafe7898e60b5cd4914224d631218f4eaef8fc9167b43cfeeed85f0ca80cd3158542677c31f11443a18be36a

Download Submit
C:\Windows\System\mJocEeM.exe

Filesize
1.9MB

MD5
272f5d966b176b940b2745137dcb621f

SHA1
a93ff7a3c431c79d93cf24a2ce883aca5016f834

SHA256
3d50a4530ec359bbbb1bdd403290f3009ea020b0d77aaf1c65cf806ad79b6e10

SHA512
18fe415c1cc1065d3a99304887b4282b838ffe66054bcb94f211bd41164bead830a05ce8fde8f493e37b9165b0c4c92ef4e9c619f1a0f69aa8e7863c0017d4fb

Download Submit
C:\Windows\System\oMnpPPj.exe

Filesize
1.9MB

MD5
e3a4f98175cf32f923e9a304189e2ad2

SHA1
d960cfe6cbb340d50d55377f43a7c8af65ebd679

SHA256
6b8c414e17059dbff97a68e9fb1bd82f5f4a2bdb939f604595e6294a4d124305

SHA512
9bd7e9fb54b85db7ff2d9dfc39709379666c09ecbedaa9f163ede2533aa1cfd17f5ba23dc05a307bf75de00a5a91156ffb103a0737f6a6d7ddb610ac05ff4e9a

Download Submit
C:\Windows\System\qutLwBc.exe

Filesize
1.9MB

MD5
61c14f1a01f0c060b66eb6931f82ce39

SHA1
308564f8a686c41e531d330e1f30f3124fd1e19f

SHA256
7b239cf574cedb243fd7b1a7223dc6e96bc885bf61cfa77cc1971b8c2491b51d

SHA512
57c43aa5b246b44c1a6c47171ba1eab60873fc75704d04f9c2ce0d5e9b2cd06a82badb9dad22364de28e5d87874c5c382536f0b1b2a79b34c3694e84b83a1c26

Download Submit
C:\Windows\System\srUEotI.exe

Filesize
1.9MB

MD5
a88388a8b4d3d4b59601888c3f0a7ab9

SHA1
8736322e1ee564d032bd4afc810884d971c96999

SHA256
d6553c5e9df64e6ea18ae8e0888e686e4ad67529c60274eec0415ac7db1c2301

SHA512
31251db21165a8c4604939b0d22fc15731218d3d77b63e3ad7098f74837a4f8030aa0293932f8cef47dddcfb94020c715d93dba46a41dda2b704e3e141dd1a69

Download Submit
C:\Windows\System\vwbDAfq.exe

Filesize
1.9MB

MD5
48226498167282b350dc10d044f5a895

SHA1
5d39ac7b55facc919ccfdd2db559b457fc57361e

SHA256
2e96945a87003a5b393b5b39343ccc13365d6a4a831b6d09bf6dc7ad3ce702f3

SHA512
79335e2cf4decda6fdf1b63c359bbb32e7098fe4de72e8ce91fa51a68af53f9fc49027ca69cbb99b7e47090f8881bc1ea513403ed1a17335ddf729290550ad86

Download Submit
C:\Windows\System\wBBeiNd.exe

Filesize
1.9MB

MD5
20c09535e9d99de8dff41c626b7e75f2

SHA1
798fb27e548aefd8da95bcbe6ae2b8fd31a38647

SHA256
b7e3813a356d95327787e435fc73f8d23888d251003188c08aeb3539b99cf5f4

SHA512
7fc75abbd8e3d243644ae0a889afccd2e7f0803b0bf50551cf90998b193a1bc4c6c6a841b8bf9dec1b1d0f927e4fd2f31608066b1e78460db2dc8f500e8d0e44

Download Submit
C:\Windows\System\wKJawSt.exe

Filesize
1.9MB

MD5
361f41a8889b812f83a49891fdc151f7

SHA1
a821009e54848336932922abae07483b24f6f77d

SHA256
c8c4980392a18aa3b607c4e34db8ec82c4f7cae613dbcb973b7129ed02ac25e2

SHA512
d03abe4a2cf976b8b64780c422d10d17318b9bd8380db372244e9456172da5ade571aa14d4d7bdeeedab2fcbb584846d07aede8d7905adc9cba77be17df77df1

Download Submit
C:\Windows\System\zTFmHMm.exe

Filesize
1.9MB

MD5
e637ec389e0d5892e9e81e3d987b6303

SHA1
af33f0524edc020467c9711c2212063e0c6c51db

SHA256
5403d0b71b58e2dcba2b8b30a610aaa24180bd7bd2ad3c43b29cd091913ce376

SHA512
45a12dfca3e0a00c84faa234ebe23824d584cd7baf696b7ceb18917df552f06f9f6162d20644b922ae7fa6aaf46328648c7027a4f9c094e4da11124facebb933

Download Submit
C:\Windows\System\zpjPTkC.exe

Filesize
1.9MB

MD5
e860af783bc66dca6f6fb857a734ce78

SHA1
7381dc8b8c9b3434e4e70dfb5c5ac9e88b5af093

SHA256
21df619adc228826a144c9e6c9720b51139f472501bc4cc7be2f905f84f4808e

SHA512
c90883781a747f0ac4d4912f3ea1541bba5f92423ba28ca2661007738f1beeab3638110de79b59dd8bc279f4147cc3cbff2dd49398108a2ee63ef3cbeb58d385

Download Submit
memory/448-130-0x00007FF6FE500000-0x00007FF6FE8F2000-memory.dmp

Filesize
3.9MB

Download
memory/1548-42-0x00007FF707390000-0x00007FF707782000-memory.dmp

Filesize
3.9MB

Download
memory/1764-1-0x000001A282D40000-0x000001A282D50000-memory.dmp

Filesize
64KB

Download
memory/1764-0-0x00007FF72A220000-0x00007FF72A612000-memory.dmp

Filesize
3.9MB

Download
memory/1856-86-0x00007FF7CCEE0000-0x00007FF7CD2D2000-memory.dmp

Filesize
3.9MB

Download
memory/1856-2403-0x00007FF7CCEE0000-0x00007FF7CD2D2000-memory.dmp

Filesize
3.9MB

Download
memory/1880-97-0x00007FF7546C0000-0x00007FF754AB2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-123-0x00007FF6BB190000-0x00007FF6BB582000-memory.dmp

Filesize
3.9MB

Download
memory/2396-2372-0x00007FF6C8910000-0x00007FF6C8D02000-memory.dmp

Filesize
3.9MB

Download
memory/2396-16-0x00007FF6C8910000-0x00007FF6C8D02000-memory.dmp

Filesize
3.9MB

Download
memory/2456-101-0x00007FF717E30000-0x00007FF718222000-memory.dmp

Filesize
3.9MB

Download
memory/2640-47-0x00007FF7E5820000-0x00007FF7E5C12000-memory.dmp

Filesize
3.9MB

Download
memory/2648-2522-0x00007FF6167E0000-0x00007FF616BD2000-memory.dmp

Filesize
3.9MB

Download
memory/2648-145-0x00007FF6167E0000-0x00007FF616BD2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-55-0x00007FF75B970000-0x00007FF75BD62000-memory.dmp

Filesize
3.9MB

Download
memory/2900-2373-0x00007FF75B970000-0x00007FF75BD62000-memory.dmp

Filesize
3.9MB

Download
memory/3196-104-0x00007FF757520000-0x00007FF757912000-memory.dmp

Filesize
3.9MB

Download
memory/3284-77-0x00007FF6D1340000-0x00007FF6D1732000-memory.dmp

Filesize
3.9MB

Download
memory/3284-2375-0x00007FF6D1340000-0x00007FF6D1732000-memory.dmp

Filesize
3.9MB

Download
memory/3444-2377-0x00007FF680840000-0x00007FF680C32000-memory.dmp

Filesize
3.9MB

Download
memory/3444-91-0x00007FF680840000-0x00007FF680C32000-memory.dmp

Filesize
3.9MB

Download
memory/3832-2374-0x00007FF6EFC10000-0x00007FF6F0002000-memory.dmp

Filesize
3.9MB

Download
memory/3832-63-0x00007FF6EFC10000-0x00007FF6F0002000-memory.dmp

Filesize
3.9MB

Download
memory/3960-129-0x00007FF67B130000-0x00007FF67B522000-memory.dmp

Filesize
3.9MB

Download
memory/3960-2411-0x00007FF67B130000-0x00007FF67B522000-memory.dmp

Filesize
3.9MB

Download
memory/4252-9-0x00007FF7FC1D0000-0x00007FF7FC5C2000-memory.dmp

Filesize
3.9MB

Download
memory/4312-134-0x00007FF754AE0000-0x00007FF754ED2000-memory.dmp

Filesize
3.9MB

Download
memory/4348-98-0x00007FF7C1AA0000-0x00007FF7C1E92000-memory.dmp

Filesize
3.9MB

Download
memory/4740-137-0x00007FF761330000-0x00007FF761722000-memory.dmp

Filesize
3.9MB

Download
memory/4740-2519-0x00007FF761330000-0x00007FF761722000-memory.dmp

Filesize
3.9MB

Download
memory/4844-119-0x00007FF72CB90000-0x00007FF72CF82000-memory.dmp

Filesize
3.9MB

Download
memory/4884-14-0x0000018081490000-0x00000180814A0000-memory.dmp

Filesize
64KB

Download
memory/4884-39-0x00007FFF27AC0000-0x00007FFF28581000-memory.dmp

Filesize
10.8MB

Download
memory/4884-32-0x00000180FF2E0000-0x00000180FF302000-memory.dmp

Filesize
136KB

Download
memory/4884-13-0x0000018081490000-0x00000180814A0000-memory.dmp

Filesize
64KB

Download
memory/5016-2378-0x00007FF7C9EE0000-0x00007FF7CA2D2000-memory.dmp

Filesize
3.9MB

Download
memory/5016-115-0x00007FF7C9EE0000-0x00007FF7CA2D2000-memory.dmp

Filesize
3.9MB

Download