xmrig | 4ed90ca8f2a87fe553166b6b5d0411d0b61d21ae0f55dd2bf8ae25126e6125d1

Analysis

max time kernel
33s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
Size

2.2MB
MD5

04880c3c4966fb5faa26c7008b960c94
SHA1

2b5017d678223802fb660d26fd574a796dee9064
SHA256

4ed90ca8f2a87fe553166b6b5d0411d0b61d21ae0f55dd2bf8ae25126e6125d1
SHA512

ef86c33bef68208d87b84a61f4c423ff7c95185a48ba2fb4c686b102c9c429a5b9e54beda19ec37ff150397884b0b83bdebb19bec652e7595802b0ac777c3440
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfp:NABy

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/memory/2672-32-0x00007FF6B6500000-0x00007FF6B68F2000-memory.dmp	xmrig
behavioral2/memory/3808-34-0x00007FF71EB40000-0x00007FF71EF32000-memory.dmp	xmrig
behavioral2/memory/1288-35-0x00007FF655CC0000-0x00007FF6560B2000-memory.dmp	xmrig
behavioral2/memory/3940-98-0x00007FF7DDCD0000-0x00007FF7DE0C2000-memory.dmp	xmrig
behavioral2/memory/2352-100-0x00007FF64F240000-0x00007FF64F632000-memory.dmp	xmrig
behavioral2/memory/3856-101-0x00007FF61CB10000-0x00007FF61CF02000-memory.dmp	xmrig
behavioral2/memory/1432-99-0x00007FF760260000-0x00007FF760652000-memory.dmp	xmrig
behavioral2/memory/4140-80-0x00007FF7222B0000-0x00007FF7226A2000-memory.dmp	xmrig
behavioral2/memory/1432-108-0x00007FF760260000-0x00007FF760652000-memory.dmp	xmrig
behavioral2/memory/3160-116-0x00007FF713400000-0x00007FF7137F2000-memory.dmp	xmrig
behavioral2/memory/3132-162-0x00007FF751360000-0x00007FF751752000-memory.dmp	xmrig
behavioral2/memory/4508-167-0x00007FF6B1AD0000-0x00007FF6B1EC2000-memory.dmp	xmrig
behavioral2/memory/3088-172-0x00007FF7A8E00000-0x00007FF7A91F2000-memory.dmp	xmrig
behavioral2/memory/4300-171-0x00007FF755710000-0x00007FF755B02000-memory.dmp	xmrig
behavioral2/memory/5088-168-0x00007FF6C2490000-0x00007FF6C2882000-memory.dmp	xmrig
behavioral2/memory/792-129-0x00007FF7AFDA0000-0x00007FF7B0192000-memory.dmp	xmrig
behavioral2/memory/2672-1632-0x00007FF6B6500000-0x00007FF6B68F2000-memory.dmp	xmrig
behavioral2/memory/3808-1640-0x00007FF71EB40000-0x00007FF71EF32000-memory.dmp	xmrig
behavioral2/memory/1288-1631-0x00007FF655CC0000-0x00007FF6560B2000-memory.dmp	xmrig
behavioral2/memory/4140-1887-0x00007FF7222B0000-0x00007FF7226A2000-memory.dmp	xmrig
behavioral2/memory/4736-1878-0x00007FF7DE410000-0x00007FF7DE802000-memory.dmp	xmrig
behavioral2/memory/4396-1864-0x00007FF7280B0000-0x00007FF7284A2000-memory.dmp	xmrig
behavioral2/memory/1840-1896-0x00007FF7B3FE0000-0x00007FF7B43D2000-memory.dmp	xmrig
behavioral2/memory/3608-1916-0x00007FF7169B0000-0x00007FF716DA2000-memory.dmp	xmrig
behavioral2/memory/4088-1919-0x00007FF7C3A70000-0x00007FF7C3E62000-memory.dmp	xmrig
behavioral2/memory/2352-1915-0x00007FF64F240000-0x00007FF64F632000-memory.dmp	xmrig
behavioral2/memory/3940-1891-0x00007FF7DDCD0000-0x00007FF7DE0C2000-memory.dmp	xmrig
behavioral2/memory/4564-1854-0x00007FF768970000-0x00007FF768D62000-memory.dmp	xmrig
behavioral2/memory/3856-1806-0x00007FF61CB10000-0x00007FF61CF02000-memory.dmp	xmrig
behavioral2/memory/3132-1782-0x00007FF751360000-0x00007FF751752000-memory.dmp	xmrig
behavioral2/memory/3088-2055-0x00007FF7A8E00000-0x00007FF7A91F2000-memory.dmp	xmrig
behavioral2/memory/1732-2087-0x00007FF75D8C0000-0x00007FF75DCB2000-memory.dmp	xmrig
behavioral2/memory/792-2068-0x00007FF7AFDA0000-0x00007FF7B0192000-memory.dmp	xmrig
behavioral2/memory/4508-2036-0x00007FF6B1AD0000-0x00007FF6B1EC2000-memory.dmp	xmrig
behavioral2/memory/3160-2027-0x00007FF713400000-0x00007FF7137F2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
13	4428	powershell.exe
15	4428	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2672	JxIbIbd.exe
3808	fKzxIjX.exe
1288	aACfpJt.exe
3856	WOhBZSs.exe
3132	OyUXhti.exe
4396	wRYxULH.exe
4564	rjAcSHb.exe
4088	bjYRfsy.exe
1840	XqxYvai.exe
4140	WlzoOhN.exe
3608	LNYcpQa.exe
4736	oCsQOMt.exe
3940	iDPTeBl.exe
2352	cEfQzyb.exe
3160	tuMBgJb.exe
792	mXYbKah.exe
1732	GmYbbtu.exe
4508	ymxvLgE.exe
3088	kGmDqqn.exe
5088	oWtGsdy.exe
4300	lveBTel.exe
1960	TPIbzti.exe
4336	AsvKhcg.exe
4620	EdeckPK.exe
116	SvTOgCY.exe
1904	hOLTwLq.exe
4988	GlkMLKa.exe
3792	KISpuVG.exe
3740	LNicytb.exe
4260	qcArzgH.exe
5112	FGVOjsh.exe
4024	UPKXZQx.exe
2556	ZqBmKEe.exe
4152	gvEDlXS.exe
3312	bmJRIUY.exe
3320	KWdORXj.exe
1536	gpEllyg.exe
2356	aZBzXlt.exe
2184	mLuLjuX.exe
2128	LMPVlmV.exe
3060	pCDYvHM.exe
3840	uapCngt.exe
960	QgHlqcI.exe
1656	waEaKaE.exe
2284	ThScKbU.exe
4252	hwINMhC.exe
380	SFybtBz.exe
1748	rBsJPJk.exe
2768	wFsmeus.exe
5128	sJPddRq.exe
5164	IXnLHPp.exe
5188	sPqNDlT.exe
5216	dSzoNtZ.exe
5240	sXpKolB.exe
5264	fKapVLC.exe
5292	ylTJfmH.exe
5332	RAPjduX.exe
5356	JCROpXu.exe
5380	XrSwwzJ.exe
5408	gJotiid.exe
5424	BFxewst.exe
5460	Kjxrqgc.exe
5484	BmGxzim.exe
5508	qSTzGal.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1432-0-0x00007FF760260000-0x00007FF760652000-memory.dmp	upx
behavioral2/files/0x0009000000023285-5.dat	upx
behavioral2/files/0x000800000002328b-9.dat	upx
behavioral2/files/0x0008000000023288-10.dat	upx
behavioral2/files/0x000800000002328d-30.dat	upx
behavioral2/memory/2672-32-0x00007FF6B6500000-0x00007FF6B68F2000-memory.dmp	upx
behavioral2/memory/3808-34-0x00007FF71EB40000-0x00007FF71EF32000-memory.dmp	upx
behavioral2/memory/1288-35-0x00007FF655CC0000-0x00007FF6560B2000-memory.dmp	upx
behavioral2/memory/3856-36-0x00007FF61CB10000-0x00007FF61CF02000-memory.dmp	upx
behavioral2/files/0x000800000002328e-40.dat	upx
behavioral2/memory/3132-43-0x00007FF751360000-0x00007FF751752000-memory.dmp	upx
behavioral2/files/0x0008000000023289-46.dat	upx
behavioral2/memory/4396-49-0x00007FF7280B0000-0x00007FF7284A2000-memory.dmp	upx
behavioral2/files/0x0007000000023290-52.dat	upx
behavioral2/files/0x0007000000023292-64.dat	upx
behavioral2/files/0x0007000000023293-67.dat	upx
behavioral2/memory/4088-63-0x00007FF7C3A70000-0x00007FF7C3E62000-memory.dmp	upx
behavioral2/memory/1840-69-0x00007FF7B3FE0000-0x00007FF7B43D2000-memory.dmp	upx
behavioral2/files/0x0007000000023295-86.dat	upx
behavioral2/memory/4736-85-0x00007FF7DE410000-0x00007FF7DE802000-memory.dmp	upx
behavioral2/memory/3608-93-0x00007FF7169B0000-0x00007FF716DA2000-memory.dmp	upx
behavioral2/memory/3940-98-0x00007FF7DDCD0000-0x00007FF7DE0C2000-memory.dmp	upx
behavioral2/memory/2352-100-0x00007FF64F240000-0x00007FF64F632000-memory.dmp	upx
behavioral2/memory/3856-101-0x00007FF61CB10000-0x00007FF61CF02000-memory.dmp	upx
behavioral2/memory/1432-99-0x00007FF760260000-0x00007FF760652000-memory.dmp	upx
behavioral2/files/0x0007000000023297-96.dat	upx
behavioral2/files/0x0007000000023296-91.dat	upx
behavioral2/files/0x0007000000023294-83.dat	upx
behavioral2/memory/4140-80-0x00007FF7222B0000-0x00007FF7226A2000-memory.dmp	upx
behavioral2/files/0x0007000000023291-61.dat	upx
behavioral2/memory/4564-60-0x00007FF768970000-0x00007FF768D62000-memory.dmp	upx
behavioral2/files/0x0007000000023298-106.dat	upx
behavioral2/memory/1432-108-0x00007FF760260000-0x00007FF760652000-memory.dmp	upx
behavioral2/files/0x0007000000023299-115.dat	upx
behavioral2/files/0x000700000002329a-114.dat	upx
behavioral2/memory/3160-116-0x00007FF713400000-0x00007FF7137F2000-memory.dmp	upx
behavioral2/memory/1732-121-0x00007FF75D8C0000-0x00007FF75DCB2000-memory.dmp	upx
behavioral2/files/0x000700000002329d-133.dat	upx
behavioral2/files/0x000700000002329e-137.dat	upx
behavioral2/files/0x000700000002329c-138.dat	upx
behavioral2/files/0x000700000002329f-144.dat	upx
behavioral2/files/0x00070000000232a1-156.dat	upx
behavioral2/memory/3132-162-0x00007FF751360000-0x00007FF751752000-memory.dmp	upx
behavioral2/memory/4508-167-0x00007FF6B1AD0000-0x00007FF6B1EC2000-memory.dmp	upx
behavioral2/files/0x00070000000232a2-169.dat	upx
behavioral2/memory/3088-172-0x00007FF7A8E00000-0x00007FF7A91F2000-memory.dmp	upx
behavioral2/memory/4300-171-0x00007FF755710000-0x00007FF755B02000-memory.dmp	upx
behavioral2/files/0x00070000000232a3-176.dat	upx
behavioral2/files/0x00070000000232a4-181.dat	upx
behavioral2/files/0x00070000000232a6-191.dat	upx
behavioral2/files/0x00070000000232a9-206.dat	upx
behavioral2/files/0x00070000000232a8-201.dat	upx
behavioral2/files/0x00070000000232a7-196.dat	upx
behavioral2/files/0x00070000000232a5-186.dat	upx
behavioral2/memory/5088-168-0x00007FF6C2490000-0x00007FF6C2882000-memory.dmp	upx
behavioral2/files/0x00070000000232a0-152.dat	upx
behavioral2/files/0x000700000002329b-130.dat	upx
behavioral2/memory/792-129-0x00007FF7AFDA0000-0x00007FF7B0192000-memory.dmp	upx
behavioral2/memory/2672-1632-0x00007FF6B6500000-0x00007FF6B68F2000-memory.dmp	upx
behavioral2/memory/3808-1640-0x00007FF71EB40000-0x00007FF71EF32000-memory.dmp	upx
behavioral2/memory/1288-1631-0x00007FF655CC0000-0x00007FF6560B2000-memory.dmp	upx
behavioral2/memory/4140-1887-0x00007FF7222B0000-0x00007FF7226A2000-memory.dmp	upx
behavioral2/memory/4736-1878-0x00007FF7DE410000-0x00007FF7DE802000-memory.dmp	upx
behavioral2/memory/4396-1864-0x00007FF7280B0000-0x00007FF7284A2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
13	raw.githubusercontent.com
12	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kGugttl.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\RNRbRlw.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\nLJLwap.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\WkHGRNq.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\xIVOlUR.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\taFCTWY.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\SvTOgCY.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\KWdORXj.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\VvgsbaQ.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\mIJdIGH.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\AOGMOEx.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\waEaKaE.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\GfkbTLS.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\QPoxiSG.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\KxxcMLQ.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\Agyvepe.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\aZBzXlt.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\QkUpBQj.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\ZoApYip.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\zdalCts.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\wePihuA.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\dftHLYO.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\mReyWMj.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\jPSmyOZ.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\KISpuVG.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\lOWdVND.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\IaSxOOu.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\mvvDbYT.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\etLCqwI.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\NxzpmDL.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\BFxewst.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\PQLIxfv.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\TAHIfkC.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\TPZpQHl.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\jKuiaxW.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\kRjFWyq.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\uBusNQd.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\lSndtll.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\XuTKnFd.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\AhbPPbA.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\dMwjeZP.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\iSQbVzQ.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\aWwdlrd.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\DZyvmjb.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\XVQTReb.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\CfpbEsO.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\HHnXlKK.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\hZFVCVa.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\DDoODLX.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\pCDYvHM.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\XxytypV.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\URHQpPm.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\JLOTuWS.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\iwPDIBc.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\sPqNDlT.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\zJCohZa.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\IcMhlvP.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\atDgIuq.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\HIGYpzk.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\SHRpLIG.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\AUtWicv.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\FNIgUMC.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\XiAjFXY.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
File created	C:\Windows\System\QBqkWFA.exe	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4428	powershell.exe
4428	powershell.exe
4428	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
Token: SeDebugPrivilege	4428	powershell.exe
Token: SeLockMemoryPrivilege	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 4428	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	92
PID 1432 wrote to memory of 4428	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	92
PID 1432 wrote to memory of 2672	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	93
PID 1432 wrote to memory of 2672	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	93
PID 1432 wrote to memory of 3808	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	94
PID 1432 wrote to memory of 3808	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	94
PID 1432 wrote to memory of 1288	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	95
PID 1432 wrote to memory of 1288	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	95
PID 1432 wrote to memory of 3856	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	96
PID 1432 wrote to memory of 3856	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	96
PID 1432 wrote to memory of 3132	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	97
PID 1432 wrote to memory of 3132	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	97
PID 1432 wrote to memory of 4396	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	98
PID 1432 wrote to memory of 4396	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	98
PID 1432 wrote to memory of 4564	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	99
PID 1432 wrote to memory of 4564	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	99
PID 1432 wrote to memory of 4088	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	100
PID 1432 wrote to memory of 4088	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	100
PID 1432 wrote to memory of 1840	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	101
PID 1432 wrote to memory of 1840	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	101
PID 1432 wrote to memory of 4140	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	102
PID 1432 wrote to memory of 4140	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	102
PID 1432 wrote to memory of 3608	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	103
PID 1432 wrote to memory of 3608	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	103
PID 1432 wrote to memory of 4736	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	104
PID 1432 wrote to memory of 4736	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	104
PID 1432 wrote to memory of 3940	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	105
PID 1432 wrote to memory of 3940	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	105
PID 1432 wrote to memory of 2352	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	106
PID 1432 wrote to memory of 2352	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	106
PID 1432 wrote to memory of 3160	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	107
PID 1432 wrote to memory of 3160	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	107
PID 1432 wrote to memory of 1732	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	108
PID 1432 wrote to memory of 1732	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	108
PID 1432 wrote to memory of 792	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	109
PID 1432 wrote to memory of 792	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	109
PID 1432 wrote to memory of 4508	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	110
PID 1432 wrote to memory of 4508	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	110
PID 1432 wrote to memory of 3088	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	111
PID 1432 wrote to memory of 3088	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	111
PID 1432 wrote to memory of 5088	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	112
PID 1432 wrote to memory of 5088	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	112
PID 1432 wrote to memory of 4300	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	113
PID 1432 wrote to memory of 4300	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	113
PID 1432 wrote to memory of 1960	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	114
PID 1432 wrote to memory of 1960	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	114
PID 1432 wrote to memory of 4336	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	115
PID 1432 wrote to memory of 4336	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	115
PID 1432 wrote to memory of 4620	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	116
PID 1432 wrote to memory of 4620	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	116
PID 1432 wrote to memory of 116	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	117
PID 1432 wrote to memory of 116	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	117
PID 1432 wrote to memory of 1904	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	118
PID 1432 wrote to memory of 1904	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	118
PID 1432 wrote to memory of 4988	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	119
PID 1432 wrote to memory of 4988	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	119
PID 1432 wrote to memory of 3792	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	120
PID 1432 wrote to memory of 3792	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	120
PID 1432 wrote to memory of 3740	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	121
PID 1432 wrote to memory of 3740	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	121
PID 1432 wrote to memory of 4260	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	122
PID 1432 wrote to memory of 4260	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	122
PID 1432 wrote to memory of 5112	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	123
PID 1432 wrote to memory of 5112	1432	04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe	123

C:\Users\Admin\AppData\Local\Temp\04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04880c3c4966fb5faa26c7008b960c94_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4428
- C:\Windows\System\JxIbIbd.exe
  C:\Windows\System\JxIbIbd.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\fKzxIjX.exe
  C:\Windows\System\fKzxIjX.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\aACfpJt.exe
  C:\Windows\System\aACfpJt.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\WOhBZSs.exe
  C:\Windows\System\WOhBZSs.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\OyUXhti.exe
  C:\Windows\System\OyUXhti.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\wRYxULH.exe
  C:\Windows\System\wRYxULH.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\rjAcSHb.exe
  C:\Windows\System\rjAcSHb.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\bjYRfsy.exe
  C:\Windows\System\bjYRfsy.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\XqxYvai.exe
  C:\Windows\System\XqxYvai.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\WlzoOhN.exe
  C:\Windows\System\WlzoOhN.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\LNYcpQa.exe
  C:\Windows\System\LNYcpQa.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\oCsQOMt.exe
  C:\Windows\System\oCsQOMt.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\iDPTeBl.exe
  C:\Windows\System\iDPTeBl.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\cEfQzyb.exe
  C:\Windows\System\cEfQzyb.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\tuMBgJb.exe
  C:\Windows\System\tuMBgJb.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\GmYbbtu.exe
  C:\Windows\System\GmYbbtu.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\mXYbKah.exe
  C:\Windows\System\mXYbKah.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\ymxvLgE.exe
  C:\Windows\System\ymxvLgE.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\kGmDqqn.exe
  C:\Windows\System\kGmDqqn.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\oWtGsdy.exe
  C:\Windows\System\oWtGsdy.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\lveBTel.exe
  C:\Windows\System\lveBTel.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\TPIbzti.exe
  C:\Windows\System\TPIbzti.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\AsvKhcg.exe
  C:\Windows\System\AsvKhcg.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\EdeckPK.exe
  C:\Windows\System\EdeckPK.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\SvTOgCY.exe
  C:\Windows\System\SvTOgCY.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\hOLTwLq.exe
  C:\Windows\System\hOLTwLq.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\GlkMLKa.exe
  C:\Windows\System\GlkMLKa.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\KISpuVG.exe
  C:\Windows\System\KISpuVG.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\LNicytb.exe
  C:\Windows\System\LNicytb.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\qcArzgH.exe
  C:\Windows\System\qcArzgH.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\FGVOjsh.exe
  C:\Windows\System\FGVOjsh.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\UPKXZQx.exe
  C:\Windows\System\UPKXZQx.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\ZqBmKEe.exe
  C:\Windows\System\ZqBmKEe.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\gvEDlXS.exe
  C:\Windows\System\gvEDlXS.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\bmJRIUY.exe
  C:\Windows\System\bmJRIUY.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\KWdORXj.exe
  C:\Windows\System\KWdORXj.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\gpEllyg.exe
  C:\Windows\System\gpEllyg.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\aZBzXlt.exe
  C:\Windows\System\aZBzXlt.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\mLuLjuX.exe
  C:\Windows\System\mLuLjuX.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\LMPVlmV.exe
  C:\Windows\System\LMPVlmV.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\pCDYvHM.exe
  C:\Windows\System\pCDYvHM.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\uapCngt.exe
  C:\Windows\System\uapCngt.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\QgHlqcI.exe
  C:\Windows\System\QgHlqcI.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\waEaKaE.exe
  C:\Windows\System\waEaKaE.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\ThScKbU.exe
  C:\Windows\System\ThScKbU.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\hwINMhC.exe
  C:\Windows\System\hwINMhC.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\SFybtBz.exe
  C:\Windows\System\SFybtBz.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\rBsJPJk.exe
  C:\Windows\System\rBsJPJk.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\wFsmeus.exe
  C:\Windows\System\wFsmeus.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\sJPddRq.exe
  C:\Windows\System\sJPddRq.exe
  2⤵
  - Executes dropped EXE
  PID:5128
- C:\Windows\System\IXnLHPp.exe
  C:\Windows\System\IXnLHPp.exe
  2⤵
  - Executes dropped EXE
  PID:5164
- C:\Windows\System\sPqNDlT.exe
  C:\Windows\System\sPqNDlT.exe
  2⤵
  - Executes dropped EXE
  PID:5188
- C:\Windows\System\dSzoNtZ.exe
  C:\Windows\System\dSzoNtZ.exe
  2⤵
  - Executes dropped EXE
  PID:5216
- C:\Windows\System\sXpKolB.exe
  C:\Windows\System\sXpKolB.exe
  2⤵
  - Executes dropped EXE
  PID:5240
- C:\Windows\System\fKapVLC.exe
  C:\Windows\System\fKapVLC.exe
  2⤵
  - Executes dropped EXE
  PID:5264
- C:\Windows\System\ylTJfmH.exe
  C:\Windows\System\ylTJfmH.exe
  2⤵
  - Executes dropped EXE
  PID:5292
- C:\Windows\System\RAPjduX.exe
  C:\Windows\System\RAPjduX.exe
  2⤵
  - Executes dropped EXE
  PID:5332
- C:\Windows\System\JCROpXu.exe
  C:\Windows\System\JCROpXu.exe
  2⤵
  - Executes dropped EXE
  PID:5356
- C:\Windows\System\XrSwwzJ.exe
  C:\Windows\System\XrSwwzJ.exe
  2⤵
  - Executes dropped EXE
  PID:5380
- C:\Windows\System\gJotiid.exe
  C:\Windows\System\gJotiid.exe
  2⤵
  - Executes dropped EXE
  PID:5408
- C:\Windows\System\BFxewst.exe
  C:\Windows\System\BFxewst.exe
  2⤵
  - Executes dropped EXE
  PID:5424
- C:\Windows\System\Kjxrqgc.exe
  C:\Windows\System\Kjxrqgc.exe
  2⤵
  - Executes dropped EXE
  PID:5460
- C:\Windows\System\BmGxzim.exe
  C:\Windows\System\BmGxzim.exe
  2⤵
  - Executes dropped EXE
  PID:5484
- C:\Windows\System\qSTzGal.exe
  C:\Windows\System\qSTzGal.exe
  2⤵
  - Executes dropped EXE
  PID:5508
- C:\Windows\System\mxuiVYG.exe
  C:\Windows\System\mxuiVYG.exe
  2⤵
  PID:5560
- C:\Windows\System\dZcsNpk.exe
  C:\Windows\System\dZcsNpk.exe
  2⤵
  PID:5576
- C:\Windows\System\BuLOvJp.exe
  C:\Windows\System\BuLOvJp.exe
  2⤵
  PID:5600
- C:\Windows\System\lwqiZpl.exe
  C:\Windows\System\lwqiZpl.exe
  2⤵
  PID:5620
- C:\Windows\System\nRikEJq.exe
  C:\Windows\System\nRikEJq.exe
  2⤵
  PID:5656
- C:\Windows\System\rqqInBa.exe
  C:\Windows\System\rqqInBa.exe
  2⤵
  PID:5684
- C:\Windows\System\XmofEZu.exe
  C:\Windows\System\XmofEZu.exe
  2⤵
  PID:5712
- C:\Windows\System\ZsrjFZT.exe
  C:\Windows\System\ZsrjFZT.exe
  2⤵
  PID:5732
- C:\Windows\System\DZyvmjb.exe
  C:\Windows\System\DZyvmjb.exe
  2⤵
  PID:5772
- C:\Windows\System\XVQTReb.exe
  C:\Windows\System\XVQTReb.exe
  2⤵
  PID:5788
- C:\Windows\System\ZwgdRpu.exe
  C:\Windows\System\ZwgdRpu.exe
  2⤵
  PID:5804
- C:\Windows\System\tbYzpBh.exe
  C:\Windows\System\tbYzpBh.exe
  2⤵
  PID:5820
- C:\Windows\System\kPPtSYl.exe
  C:\Windows\System\kPPtSYl.exe
  2⤵
  PID:5836
- C:\Windows\System\Ftrmjah.exe
  C:\Windows\System\Ftrmjah.exe
  2⤵
  PID:5852
- C:\Windows\System\rEGfyBA.exe
  C:\Windows\System\rEGfyBA.exe
  2⤵
  PID:5868
- C:\Windows\System\halWcIN.exe
  C:\Windows\System\halWcIN.exe
  2⤵
  PID:5884
- C:\Windows\System\WKcFwtP.exe
  C:\Windows\System\WKcFwtP.exe
  2⤵
  PID:5900
- C:\Windows\System\KcydNSD.exe
  C:\Windows\System\KcydNSD.exe
  2⤵
  PID:5916
- C:\Windows\System\zIVEmgD.exe
  C:\Windows\System\zIVEmgD.exe
  2⤵
  PID:5932
- C:\Windows\System\YQmlodd.exe
  C:\Windows\System\YQmlodd.exe
  2⤵
  PID:5948
- C:\Windows\System\jgDISwX.exe
  C:\Windows\System\jgDISwX.exe
  2⤵
  PID:5964
- C:\Windows\System\lyQRUpe.exe
  C:\Windows\System\lyQRUpe.exe
  2⤵
  PID:5980
- C:\Windows\System\NqXyCpQ.exe
  C:\Windows\System\NqXyCpQ.exe
  2⤵
  PID:5996
- C:\Windows\System\lleNSHl.exe
  C:\Windows\System\lleNSHl.exe
  2⤵
  PID:6012
- C:\Windows\System\OwOpyeP.exe
  C:\Windows\System\OwOpyeP.exe
  2⤵
  PID:6028
- C:\Windows\System\ByhfwML.exe
  C:\Windows\System\ByhfwML.exe
  2⤵
  PID:6044
- C:\Windows\System\mLJnEvq.exe
  C:\Windows\System\mLJnEvq.exe
  2⤵
  PID:6060
- C:\Windows\System\oVEVjOL.exe
  C:\Windows\System\oVEVjOL.exe
  2⤵
  PID:6076
- C:\Windows\System\foGFmLm.exe
  C:\Windows\System\foGFmLm.exe
  2⤵
  PID:6092
- C:\Windows\System\wdKJCMW.exe
  C:\Windows\System\wdKJCMW.exe
  2⤵
  PID:6108
- C:\Windows\System\GfkbTLS.exe
  C:\Windows\System\GfkbTLS.exe
  2⤵
  PID:6124
- C:\Windows\System\kGugttl.exe
  C:\Windows\System\kGugttl.exe
  2⤵
  PID:6140
- C:\Windows\System\OJZRsJm.exe
  C:\Windows\System\OJZRsJm.exe
  2⤵
  PID:4964
- C:\Windows\System\TBLzYpe.exe
  C:\Windows\System\TBLzYpe.exe
  2⤵
  PID:3748
- C:\Windows\System\QfYWRcr.exe
  C:\Windows\System\QfYWRcr.exe
  2⤵
  PID:4332
- C:\Windows\System\GusgveC.exe
  C:\Windows\System\GusgveC.exe
  2⤵
  PID:4080
- C:\Windows\System\lmmNhUF.exe
  C:\Windows\System\lmmNhUF.exe
  2⤵
  PID:5140
- C:\Windows\System\yccDsuW.exe
  C:\Windows\System\yccDsuW.exe
  2⤵
  PID:3372
- C:\Windows\System\ppmhgRW.exe
  C:\Windows\System\ppmhgRW.exe
  2⤵
  PID:5204
- C:\Windows\System\HYhZFHg.exe
  C:\Windows\System\HYhZFHg.exe
  2⤵
  PID:5236
- C:\Windows\System\kRjFWyq.exe
  C:\Windows\System\kRjFWyq.exe
  2⤵
  PID:5288
- C:\Windows\System\KbGYPTk.exe
  C:\Windows\System\KbGYPTk.exe
  2⤵
  PID:3580
- C:\Windows\System\RIMziSF.exe
  C:\Windows\System\RIMziSF.exe
  2⤵
  PID:5944
- C:\Windows\System\wUrYowo.exe
  C:\Windows\System\wUrYowo.exe
  2⤵
  PID:4072
- C:\Windows\System\rQsIxrv.exe
  C:\Windows\System\rQsIxrv.exe
  2⤵
  PID:5848
- C:\Windows\System\BtjSIeE.exe
  C:\Windows\System\BtjSIeE.exe
  2⤵
  PID:5816
- C:\Windows\System\ECYqtAq.exe
  C:\Windows\System\ECYqtAq.exe
  2⤵
  PID:4384
- C:\Windows\System\hHNfsaU.exe
  C:\Windows\System\hHNfsaU.exe
  2⤵
  PID:4092
- C:\Windows\System\lOWdVND.exe
  C:\Windows\System\lOWdVND.exe
  2⤵
  PID:4468
- C:\Windows\System\qruJBfk.exe
  C:\Windows\System\qruJBfk.exe
  2⤵
  PID:1596
- C:\Windows\System\UoMGCJk.exe
  C:\Windows\System\UoMGCJk.exe
  2⤵
  PID:5180
- C:\Windows\System\AkowUZT.exe
  C:\Windows\System\AkowUZT.exe
  2⤵
  PID:5232
- C:\Windows\System\XcYLYuE.exe
  C:\Windows\System\XcYLYuE.exe
  2⤵
  PID:5276
- C:\Windows\System\zcRtGQr.exe
  C:\Windows\System\zcRtGQr.exe
  2⤵
  PID:4776
- C:\Windows\System\KMtnUmG.exe
  C:\Windows\System\KMtnUmG.exe
  2⤵
  PID:5344
- C:\Windows\System\EgpFAyJ.exe
  C:\Windows\System\EgpFAyJ.exe
  2⤵
  PID:3164
- C:\Windows\System\oltZnUN.exe
  C:\Windows\System\oltZnUN.exe
  2⤵
  PID:5640
- C:\Windows\System\cCfWeal.exe
  C:\Windows\System\cCfWeal.exe
  2⤵
  PID:3616
- C:\Windows\System\qXUalGC.exe
  C:\Windows\System\qXUalGC.exe
  2⤵
  PID:5908
- C:\Windows\System\UqxLfJC.exe
  C:\Windows\System\UqxLfJC.exe
  2⤵
  PID:632
- C:\Windows\System\XrgJqmn.exe
  C:\Windows\System\XrgJqmn.exe
  2⤵
  PID:2248
- C:\Windows\System\zrLFJVD.exe
  C:\Windows\System\zrLFJVD.exe
  2⤵
  PID:4340
- C:\Windows\System\uBusNQd.exe
  C:\Windows\System\uBusNQd.exe
  2⤵
  PID:5196
- C:\Windows\System\SqLcvtW.exe
  C:\Windows\System\SqLcvtW.exe
  2⤵
  PID:3948
- C:\Windows\System\sSnKoHc.exe
  C:\Windows\System\sSnKoHc.exe
  2⤵
  PID:5540
- C:\Windows\System\SHRpLIG.exe
  C:\Windows\System\SHRpLIG.exe
  2⤵
  PID:2088
- C:\Windows\System\vxAhuWC.exe
  C:\Windows\System\vxAhuWC.exe
  2⤵
  PID:6152
- C:\Windows\System\kKeghgl.exe
  C:\Windows\System\kKeghgl.exe
  2⤵
  PID:6180
- C:\Windows\System\TngsFxR.exe
  C:\Windows\System\TngsFxR.exe
  2⤵
  PID:6200
- C:\Windows\System\HXmIFtJ.exe
  C:\Windows\System\HXmIFtJ.exe
  2⤵
  PID:6224
- C:\Windows\System\cFQsYph.exe
  C:\Windows\System\cFQsYph.exe
  2⤵
  PID:6256
- C:\Windows\System\XMbYTGh.exe
  C:\Windows\System\XMbYTGh.exe
  2⤵
  PID:6276
- C:\Windows\System\MgSoUHd.exe
  C:\Windows\System\MgSoUHd.exe
  2⤵
  PID:6300
- C:\Windows\System\DPleVHf.exe
  C:\Windows\System\DPleVHf.exe
  2⤵
  PID:6324
- C:\Windows\System\RNRbRlw.exe
  C:\Windows\System\RNRbRlw.exe
  2⤵
  PID:6388
- C:\Windows\System\kRxDjRB.exe
  C:\Windows\System\kRxDjRB.exe
  2⤵
  PID:6404
- C:\Windows\System\ayQenDT.exe
  C:\Windows\System\ayQenDT.exe
  2⤵
  PID:6420
- C:\Windows\System\QLBezFP.exe
  C:\Windows\System\QLBezFP.exe
  2⤵
  PID:6444
- C:\Windows\System\hHOabvp.exe
  C:\Windows\System\hHOabvp.exe
  2⤵
  PID:6480
- C:\Windows\System\vOyfCvy.exe
  C:\Windows\System\vOyfCvy.exe
  2⤵
  PID:6504
- C:\Windows\System\XNGRqPN.exe
  C:\Windows\System\XNGRqPN.exe
  2⤵
  PID:6528
- C:\Windows\System\pxjSPcV.exe
  C:\Windows\System\pxjSPcV.exe
  2⤵
  PID:6560
- C:\Windows\System\ZoApYip.exe
  C:\Windows\System\ZoApYip.exe
  2⤵
  PID:6584
- C:\Windows\System\tjFdUsr.exe
  C:\Windows\System\tjFdUsr.exe
  2⤵
  PID:6604
- C:\Windows\System\IYlTafD.exe
  C:\Windows\System\IYlTafD.exe
  2⤵
  PID:6624
- C:\Windows\System\dNSlLgh.exe
  C:\Windows\System\dNSlLgh.exe
  2⤵
  PID:6644
- C:\Windows\System\GgsgRGY.exe
  C:\Windows\System\GgsgRGY.exe
  2⤵
  PID:6668
- C:\Windows\System\FECPpvj.exe
  C:\Windows\System\FECPpvj.exe
  2⤵
  PID:6684
- C:\Windows\System\nrUfDeJ.exe
  C:\Windows\System\nrUfDeJ.exe
  2⤵
  PID:6708
- C:\Windows\System\TLjuyNj.exe
  C:\Windows\System\TLjuyNj.exe
  2⤵
  PID:6728
- C:\Windows\System\hwadGkQ.exe
  C:\Windows\System\hwadGkQ.exe
  2⤵
  PID:6756
- C:\Windows\System\rqAZMaI.exe
  C:\Windows\System\rqAZMaI.exe
  2⤵
  PID:6780
- C:\Windows\System\iKXmsKv.exe
  C:\Windows\System\iKXmsKv.exe
  2⤵
  PID:6816
- C:\Windows\System\XCHCgzu.exe
  C:\Windows\System\XCHCgzu.exe
  2⤵
  PID:6836
- C:\Windows\System\AUtWicv.exe
  C:\Windows\System\AUtWicv.exe
  2⤵
  PID:6856
- C:\Windows\System\bbfNHrI.exe
  C:\Windows\System\bbfNHrI.exe
  2⤵
  PID:6880
- C:\Windows\System\klKqxsh.exe
  C:\Windows\System\klKqxsh.exe
  2⤵
  PID:6896
- C:\Windows\System\KTCfZZI.exe
  C:\Windows\System\KTCfZZI.exe
  2⤵
  PID:6912
- C:\Windows\System\kSDnqGv.exe
  C:\Windows\System\kSDnqGv.exe
  2⤵
  PID:6932
- C:\Windows\System\KjBPcvg.exe
  C:\Windows\System\KjBPcvg.exe
  2⤵
  PID:6960
- C:\Windows\System\FSQhnTJ.exe
  C:\Windows\System\FSQhnTJ.exe
  2⤵
  PID:6976
- C:\Windows\System\vnBMvBI.exe
  C:\Windows\System\vnBMvBI.exe
  2⤵
  PID:6996
- C:\Windows\System\FxsdcbO.exe
  C:\Windows\System\FxsdcbO.exe
  2⤵
  PID:7016
- C:\Windows\System\yvXAyRK.exe
  C:\Windows\System\yvXAyRK.exe
  2⤵
  PID:7036
- C:\Windows\System\zJxlAbz.exe
  C:\Windows\System\zJxlAbz.exe
  2⤵
  PID:7056
- C:\Windows\System\xuPzcWQ.exe
  C:\Windows\System\xuPzcWQ.exe
  2⤵
  PID:7076
- C:\Windows\System\VvgsbaQ.exe
  C:\Windows\System\VvgsbaQ.exe
  2⤵
  PID:7104
- C:\Windows\System\tqIQCSg.exe
  C:\Windows\System\tqIQCSg.exe
  2⤵
  PID:7124
- C:\Windows\System\Nevzkax.exe
  C:\Windows\System\Nevzkax.exe
  2⤵
  PID:7148
- C:\Windows\System\OQgNDzW.exe
  C:\Windows\System\OQgNDzW.exe
  2⤵
  PID:7164
- C:\Windows\System\nLJLwap.exe
  C:\Windows\System\nLJLwap.exe
  2⤵
  PID:5860
- C:\Windows\System\TAHIfkC.exe
  C:\Windows\System\TAHIfkC.exe
  2⤵
  PID:6040
- C:\Windows\System\mIJdIGH.exe
  C:\Windows\System\mIJdIGH.exe
  2⤵
  PID:620
- C:\Windows\System\CrWhWxB.exe
  C:\Windows\System\CrWhWxB.exe
  2⤵
  PID:6268
- C:\Windows\System\EwlhKPZ.exe
  C:\Windows\System\EwlhKPZ.exe
  2⤵
  PID:6160
- C:\Windows\System\uNghaTk.exe
  C:\Windows\System\uNghaTk.exe
  2⤵
  PID:6168
- C:\Windows\System\LyRqJDV.exe
  C:\Windows\System\LyRqJDV.exe
  2⤵
  PID:6244
- C:\Windows\System\vNASziI.exe
  C:\Windows\System\vNASziI.exe
  2⤵
  PID:6472
- C:\Windows\System\qbVInIv.exe
  C:\Windows\System\qbVInIv.exe
  2⤵
  PID:4892
- C:\Windows\System\mKnsRDZ.exe
  C:\Windows\System\mKnsRDZ.exe
  2⤵
  PID:6612
- C:\Windows\System\UkORHUj.exe
  C:\Windows\System\UkORHUj.exe
  2⤵
  PID:6660
- C:\Windows\System\StlJIWV.exe
  C:\Windows\System\StlJIWV.exe
  2⤵
  PID:6700
- C:\Windows\System\lBJQrhs.exe
  C:\Windows\System\lBJQrhs.exe
  2⤵
  PID:6568
- C:\Windows\System\hPYPzhz.exe
  C:\Windows\System\hPYPzhz.exe
  2⤵
  PID:6500
- C:\Windows\System\DUOcuRr.exe
  C:\Windows\System\DUOcuRr.exe
  2⤵
  PID:2428
- C:\Windows\System\Almgfpy.exe
  C:\Windows\System\Almgfpy.exe
  2⤵
  PID:6944
- C:\Windows\System\wQIDlJo.exe
  C:\Windows\System\wQIDlJo.exe
  2⤵
  PID:6828
- C:\Windows\System\IUkUFRa.exe
  C:\Windows\System\IUkUFRa.exe
  2⤵
  PID:6412
- C:\Windows\System\vMqgbCG.exe
  C:\Windows\System\vMqgbCG.exe
  2⤵
  PID:6384
- C:\Windows\System\OsmDLoT.exe
  C:\Windows\System\OsmDLoT.exe
  2⤵
  PID:6652
- C:\Windows\System\RwmMuoO.exe
  C:\Windows\System\RwmMuoO.exe
  2⤵
  PID:6748
- C:\Windows\System\FNIgUMC.exe
  C:\Windows\System\FNIgUMC.exe
  2⤵
  PID:6968
- C:\Windows\System\GMWHPyW.exe
  C:\Windows\System\GMWHPyW.exe
  2⤵
  PID:7004
- C:\Windows\System\EkZmmnF.exe
  C:\Windows\System\EkZmmnF.exe
  2⤵
  PID:7096
- C:\Windows\System\yVtnIQo.exe
  C:\Windows\System\yVtnIQo.exe
  2⤵
  PID:7188
- C:\Windows\System\cKAtLMy.exe
  C:\Windows\System\cKAtLMy.exe
  2⤵
  PID:7208
- C:\Windows\System\WkHGRNq.exe
  C:\Windows\System\WkHGRNq.exe
  2⤵
  PID:7232
- C:\Windows\System\GgiwuRp.exe
  C:\Windows\System\GgiwuRp.exe
  2⤵
  PID:7256
- C:\Windows\System\NZpPrbc.exe
  C:\Windows\System\NZpPrbc.exe
  2⤵
  PID:7284
- C:\Windows\System\TPZpQHl.exe
  C:\Windows\System\TPZpQHl.exe
  2⤵
  PID:7308
- C:\Windows\System\KPQXRrr.exe
  C:\Windows\System\KPQXRrr.exe
  2⤵
  PID:7336
- C:\Windows\System\QSckdPt.exe
  C:\Windows\System\QSckdPt.exe
  2⤵
  PID:7356
- C:\Windows\System\hjPMEkm.exe
  C:\Windows\System\hjPMEkm.exe
  2⤵
  PID:7376
- C:\Windows\System\sMnxBXV.exe
  C:\Windows\System\sMnxBXV.exe
  2⤵
  PID:7400
- C:\Windows\System\xteCmUr.exe
  C:\Windows\System\xteCmUr.exe
  2⤵
  PID:7424
- C:\Windows\System\TcFgbTQ.exe
  C:\Windows\System\TcFgbTQ.exe
  2⤵
  PID:7444
- C:\Windows\System\WrkGCBF.exe
  C:\Windows\System\WrkGCBF.exe
  2⤵
  PID:7460
- C:\Windows\System\jKuiaxW.exe
  C:\Windows\System\jKuiaxW.exe
  2⤵
  PID:7480
- C:\Windows\System\kueNvSW.exe
  C:\Windows\System\kueNvSW.exe
  2⤵
  PID:7508
- C:\Windows\System\hlazCFh.exe
  C:\Windows\System\hlazCFh.exe
  2⤵
  PID:7532
- C:\Windows\System\xPUzcwt.exe
  C:\Windows\System\xPUzcwt.exe
  2⤵
  PID:7556
- C:\Windows\System\zJCohZa.exe
  C:\Windows\System\zJCohZa.exe
  2⤵
  PID:7580
- C:\Windows\System\WCQxLMs.exe
  C:\Windows\System\WCQxLMs.exe
  2⤵
  PID:7600
- C:\Windows\System\JchBsLk.exe
  C:\Windows\System\JchBsLk.exe
  2⤵
  PID:7620
- C:\Windows\System\vIgHpZr.exe
  C:\Windows\System\vIgHpZr.exe
  2⤵
  PID:7640
- C:\Windows\System\rbWwoYB.exe
  C:\Windows\System\rbWwoYB.exe
  2⤵
  PID:7664
- C:\Windows\System\QeDzyBC.exe
  C:\Windows\System\QeDzyBC.exe
  2⤵
  PID:7688
- C:\Windows\System\rwNYpQB.exe
  C:\Windows\System\rwNYpQB.exe
  2⤵
  PID:7716
- C:\Windows\System\XiAjFXY.exe
  C:\Windows\System\XiAjFXY.exe
  2⤵
  PID:7736
- C:\Windows\System\lSndtll.exe
  C:\Windows\System\lSndtll.exe
  2⤵
  PID:7756
- C:\Windows\System\XxytypV.exe
  C:\Windows\System\XxytypV.exe
  2⤵
  PID:7776
- C:\Windows\System\wTWejJI.exe
  C:\Windows\System\wTWejJI.exe
  2⤵
  PID:7804
- C:\Windows\System\LnjIdYK.exe
  C:\Windows\System\LnjIdYK.exe
  2⤵
  PID:7820
- C:\Windows\System\PFrkgPv.exe
  C:\Windows\System\PFrkgPv.exe
  2⤵
  PID:7844
- C:\Windows\System\PQLIxfv.exe
  C:\Windows\System\PQLIxfv.exe
  2⤵
  PID:7868
- C:\Windows\System\crdbinl.exe
  C:\Windows\System\crdbinl.exe
  2⤵
  PID:7888
- C:\Windows\System\VVJPwDp.exe
  C:\Windows\System\VVJPwDp.exe
  2⤵
  PID:7908
- C:\Windows\System\JBZztgK.exe
  C:\Windows\System\JBZztgK.exe
  2⤵
  PID:7932
- C:\Windows\System\UxOWNyN.exe
  C:\Windows\System\UxOWNyN.exe
  2⤵
  PID:7952
- C:\Windows\System\IcMhlvP.exe
  C:\Windows\System\IcMhlvP.exe
  2⤵
  PID:7972
- C:\Windows\System\gEFxNdx.exe
  C:\Windows\System\gEFxNdx.exe
  2⤵
  PID:7996
- C:\Windows\System\zdalCts.exe
  C:\Windows\System\zdalCts.exe
  2⤵
  PID:8016
- C:\Windows\System\nfppVrk.exe
  C:\Windows\System\nfppVrk.exe
  2⤵
  PID:8132
- C:\Windows\System\wePihuA.exe
  C:\Windows\System\wePihuA.exe
  2⤵
  PID:8148
- C:\Windows\System\HhEheqU.exe
  C:\Windows\System\HhEheqU.exe
  2⤵
  PID:8176
- C:\Windows\System\HjohPib.exe
  C:\Windows\System\HjohPib.exe
  2⤵
  PID:6296
- C:\Windows\System\RmSHqSj.exe
  C:\Windows\System\RmSHqSj.exe
  2⤵
  PID:7160
- C:\Windows\System\eexwUkP.exe
  C:\Windows\System\eexwUkP.exe
  2⤵
  PID:6008
- C:\Windows\System\PaDHHCZ.exe
  C:\Windows\System\PaDHHCZ.exe
  2⤵
  PID:6436
- C:\Windows\System\dzrwygt.exe
  C:\Windows\System\dzrwygt.exe
  2⤵
  PID:6924
- C:\Windows\System\jtnwKpR.exe
  C:\Windows\System\jtnwKpR.exe
  2⤵
  PID:6512
- C:\Windows\System\kbdAHHO.exe
  C:\Windows\System\kbdAHHO.exe
  2⤵
  PID:7044
- C:\Windows\System\bqYyiYr.exe
  C:\Windows\System\bqYyiYr.exe
  2⤵
  PID:7216
- C:\Windows\System\GmZLgdY.exe
  C:\Windows\System\GmZLgdY.exe
  2⤵
  PID:7368
- C:\Windows\System\dftHLYO.exe
  C:\Windows\System\dftHLYO.exe
  2⤵
  PID:940
- C:\Windows\System\zrHsfuv.exe
  C:\Windows\System\zrHsfuv.exe
  2⤵
  PID:7476
- C:\Windows\System\XuTKnFd.exe
  C:\Windows\System\XuTKnFd.exe
  2⤵
  PID:6908
- C:\Windows\System\QBqkWFA.exe
  C:\Windows\System\QBqkWFA.exe
  2⤵
  PID:6284
- C:\Windows\System\HPtTbtR.exe
  C:\Windows\System\HPtTbtR.exe
  2⤵
  PID:7660
- C:\Windows\System\HbgtQwq.exe
  C:\Windows\System\HbgtQwq.exe
  2⤵
  PID:7732
- C:\Windows\System\QkUpBQj.exe
  C:\Windows\System\QkUpBQj.exe
  2⤵
  PID:7504
- C:\Windows\System\xpAswaE.exe
  C:\Windows\System\xpAswaE.exe
  2⤵
  PID:7916
- C:\Windows\System\XjTYlCM.exe
  C:\Windows\System\XjTYlCM.exe
  2⤵
  PID:6848
- C:\Windows\System\uXkEnIa.exe
  C:\Windows\System\uXkEnIa.exe
  2⤵
  PID:7944
- C:\Windows\System\hhruYuE.exe
  C:\Windows\System\hhruYuE.exe
  2⤵
  PID:7748
- C:\Windows\System\Dtsuugv.exe
  C:\Windows\System\Dtsuugv.exe
  2⤵
  PID:7396
- C:\Windows\System\xIVOlUR.exe
  C:\Windows\System\xIVOlUR.exe
  2⤵
  PID:7420
- C:\Windows\System\TrBOmFt.exe
  C:\Windows\System\TrBOmFt.exe
  2⤵
  PID:7548
- C:\Windows\System\utYofKk.exe
  C:\Windows\System\utYofKk.exe
  2⤵
  PID:8216
- C:\Windows\System\cPsusrp.exe
  C:\Windows\System\cPsusrp.exe
  2⤵
  PID:8236
- C:\Windows\System\OYCGSSk.exe
  C:\Windows\System\OYCGSSk.exe
  2⤵
  PID:8256
- C:\Windows\System\MzjtlrB.exe
  C:\Windows\System\MzjtlrB.exe
  2⤵
  PID:8280
- C:\Windows\System\fcyMKtz.exe
  C:\Windows\System\fcyMKtz.exe
  2⤵
  PID:8296
- C:\Windows\System\wfXJoop.exe
  C:\Windows\System\wfXJoop.exe
  2⤵
  PID:8312
- C:\Windows\System\CfpbEsO.exe
  C:\Windows\System\CfpbEsO.exe
  2⤵
  PID:8336
- C:\Windows\System\AhbPPbA.exe
  C:\Windows\System\AhbPPbA.exe
  2⤵
  PID:8360
- C:\Windows\System\mvvDbYT.exe
  C:\Windows\System\mvvDbYT.exe
  2⤵
  PID:8376
- C:\Windows\System\AhBmNIf.exe
  C:\Windows\System\AhBmNIf.exe
  2⤵
  PID:8628
- C:\Windows\System\pCVRqww.exe
  C:\Windows\System\pCVRqww.exe
  2⤵
  PID:8656
- C:\Windows\System\gySpzyi.exe
  C:\Windows\System\gySpzyi.exe
  2⤵
  PID:8688
- C:\Windows\System\etLCqwI.exe
  C:\Windows\System\etLCqwI.exe
  2⤵
  PID:8708
- C:\Windows\System\yCalEKJ.exe
  C:\Windows\System\yCalEKJ.exe
  2⤵
  PID:8724
- C:\Windows\System\HHnXlKK.exe
  C:\Windows\System\HHnXlKK.exe
  2⤵
  PID:8740
- C:\Windows\System\LFUyANA.exe
  C:\Windows\System\LFUyANA.exe
  2⤵
  PID:8760
- C:\Windows\System\kLyUxiB.exe
  C:\Windows\System\kLyUxiB.exe
  2⤵
  PID:8776
- C:\Windows\System\NxzpmDL.exe
  C:\Windows\System\NxzpmDL.exe
  2⤵
  PID:8012
- C:\Windows\System\mReyWMj.exe
  C:\Windows\System\mReyWMj.exe
  2⤵
  PID:8480
- C:\Windows\System\eLYksuA.exe
  C:\Windows\System\eLYksuA.exe
  2⤵
  PID:8532
- C:\Windows\System\Qaytxnt.exe
  C:\Windows\System\Qaytxnt.exe
  2⤵
  PID:8368
- C:\Windows\System\IuPofZq.exe
  C:\Windows\System\IuPofZq.exe
  2⤵
  PID:8400
- C:\Windows\System\dMwjeZP.exe
  C:\Windows\System\dMwjeZP.exe
  2⤵
  PID:8696
- C:\Windows\System\AOGMOEx.exe
  C:\Windows\System\AOGMOEx.exe
  2⤵
  PID:8748
- C:\Windows\System\LcFZqiy.exe
  C:\Windows\System\LcFZqiy.exe
  2⤵
  PID:1632
- C:\Windows\System\CJbFgME.exe
  C:\Windows\System\CJbFgME.exe
  2⤵
  PID:3548
- C:\Windows\System\EyQBVRd.exe
  C:\Windows\System\EyQBVRd.exe
  2⤵
  PID:6904
- C:\Windows\System\hZFVCVa.exe
  C:\Windows\System\hZFVCVa.exe
  2⤵
  PID:6192
- C:\Windows\System\FgqMVen.exe
  C:\Windows\System\FgqMVen.exe
  2⤵
  PID:7592
- C:\Windows\System\FnsvUuW.exe
  C:\Windows\System\FnsvUuW.exe
  2⤵
  PID:624
- C:\Windows\System\ZcRXwHj.exe
  C:\Windows\System\ZcRXwHj.exe
  2⤵
  PID:7860
- C:\Windows\System\DMzoDwL.exe
  C:\Windows\System\DMzoDwL.exe
  2⤵
  PID:8544
- C:\Windows\System\PKXOSqF.exe
  C:\Windows\System\PKXOSqF.exe
  2⤵
  PID:8244
- C:\Windows\System\HpLuAbA.exe
  C:\Windows\System\HpLuAbA.exe
  2⤵
  PID:8276
- C:\Windows\System\WhMJxZr.exe
  C:\Windows\System\WhMJxZr.exe
  2⤵
  PID:8332
- C:\Windows\System\hNSGQDI.exe
  C:\Windows\System\hNSGQDI.exe
  2⤵
  PID:8348
- C:\Windows\System\OQRxxKR.exe
  C:\Windows\System\OQRxxKR.exe
  2⤵
  PID:8468
- C:\Windows\System\CQvXCQo.exe
  C:\Windows\System\CQvXCQo.exe
  2⤵
  PID:9008
- C:\Windows\System\lekQXIG.exe
  C:\Windows\System\lekQXIG.exe
  2⤵
  PID:8616
- C:\Windows\System\IuMgnsX.exe
  C:\Windows\System\IuMgnsX.exe
  2⤵
  PID:8668
- C:\Windows\System\AEBhHRv.exe
  C:\Windows\System\AEBhHRv.exe
  2⤵
  PID:8772
- C:\Windows\System\DxKmsVR.exe
  C:\Windows\System\DxKmsVR.exe
  2⤵
  PID:8852
- C:\Windows\System\RtSnMxD.exe
  C:\Windows\System\RtSnMxD.exe
  2⤵
  PID:9036
- C:\Windows\System\FXBuocM.exe
  C:\Windows\System\FXBuocM.exe
  2⤵
  PID:8964
- C:\Windows\System\QPoxiSG.exe
  C:\Windows\System\QPoxiSG.exe
  2⤵
  PID:9112
- C:\Windows\System\URHQpPm.exe
  C:\Windows\System\URHQpPm.exe
  2⤵
  PID:9076
- C:\Windows\System\KMselba.exe
  C:\Windows\System\KMselba.exe
  2⤵
  PID:7920
- C:\Windows\System\eShYjCc.exe
  C:\Windows\System\eShYjCc.exe
  2⤵
  PID:7304
- C:\Windows\System\taFCTWY.exe
  C:\Windows\System\taFCTWY.exe
  2⤵
  PID:5260
- C:\Windows\System\VxvqojQ.exe
  C:\Windows\System\VxvqojQ.exe
  2⤵
  PID:7120
- C:\Windows\System\jPSmyOZ.exe
  C:\Windows\System\jPSmyOZ.exe
  2⤵
  PID:8204
- C:\Windows\System\EbySjns.exe
  C:\Windows\System\EbySjns.exe
  2⤵
  PID:7900
- C:\Windows\System\ohBDsBA.exe
  C:\Windows\System\ohBDsBA.exe
  2⤵
  PID:8272
- C:\Windows\System\HURrdTh.exe
  C:\Windows\System\HURrdTh.exe
  2⤵
  PID:7268
- C:\Windows\System\yxAhFRJ.exe
  C:\Windows\System\yxAhFRJ.exe
  2⤵
  PID:7704
- C:\Windows\System\SpPvAlJ.exe
  C:\Windows\System\SpPvAlJ.exe
  2⤵
  PID:8824
- C:\Windows\System\wRfYkuH.exe
  C:\Windows\System\wRfYkuH.exe
  2⤵
  PID:8320
- C:\Windows\System\KxxcMLQ.exe
  C:\Windows\System\KxxcMLQ.exe
  2⤵
  PID:9016
- C:\Windows\System\IaSxOOu.exe
  C:\Windows\System\IaSxOOu.exe
  2⤵
  PID:9220
- C:\Windows\System\oJBghtn.exe
  C:\Windows\System\oJBghtn.exe
  2⤵
  PID:9240
- C:\Windows\System\ZwMAKZA.exe
  C:\Windows\System\ZwMAKZA.exe
  2⤵
  PID:9268
- C:\Windows\System\qqmKXOA.exe
  C:\Windows\System\qqmKXOA.exe
  2⤵
  PID:9292
- C:\Windows\System\iyTxlDW.exe
  C:\Windows\System\iyTxlDW.exe
  2⤵
  PID:9312
- C:\Windows\System\qyMjZlB.exe
  C:\Windows\System\qyMjZlB.exe
  2⤵
  PID:9332
- C:\Windows\System\uyKKtaX.exe
  C:\Windows\System\uyKKtaX.exe
  2⤵
  PID:9352
- C:\Windows\System\QjsHezG.exe
  C:\Windows\System\QjsHezG.exe
  2⤵
  PID:9372
- C:\Windows\System\utswCmW.exe
  C:\Windows\System\utswCmW.exe
  2⤵
  PID:9392
- C:\Windows\System\JZAjsTD.exe
  C:\Windows\System\JZAjsTD.exe
  2⤵
  PID:9416
- C:\Windows\System\pBrcaID.exe
  C:\Windows\System\pBrcaID.exe
  2⤵
  PID:9436
- C:\Windows\System\uyzDPQh.exe
  C:\Windows\System\uyzDPQh.exe
  2⤵
  PID:9452
- C:\Windows\System\ACubNJj.exe
  C:\Windows\System\ACubNJj.exe
  2⤵
  PID:9476
- C:\Windows\System\atDgIuq.exe
  C:\Windows\System\atDgIuq.exe
  2⤵
  PID:9492
- C:\Windows\System\IIZPeCJ.exe
  C:\Windows\System\IIZPeCJ.exe
  2⤵
  PID:9548
- C:\Windows\System\Agyvepe.exe
  C:\Windows\System\Agyvepe.exe
  2⤵
  PID:9576
- C:\Windows\System\NDhKpWf.exe
  C:\Windows\System\NDhKpWf.exe
  2⤵
  PID:9596
- C:\Windows\System\gbUBRax.exe
  C:\Windows\System\gbUBRax.exe
  2⤵
  PID:9616
- C:\Windows\System\GtiSHgA.exe
  C:\Windows\System\GtiSHgA.exe
  2⤵
  PID:9636
- C:\Windows\System\zzDiZAs.exe
  C:\Windows\System\zzDiZAs.exe
  2⤵
  PID:9656
- C:\Windows\System\mfZtlrx.exe
  C:\Windows\System\mfZtlrx.exe
  2⤵
  PID:9676
- C:\Windows\System\iSQbVzQ.exe
  C:\Windows\System\iSQbVzQ.exe
  2⤵
  PID:9692
- C:\Windows\System\JLOTuWS.exe
  C:\Windows\System\JLOTuWS.exe
  2⤵
  PID:9712
- C:\Windows\System\KrXNMWP.exe
  C:\Windows\System\KrXNMWP.exe
  2⤵
  PID:9728
- C:\Windows\System\qxqMtgR.exe
  C:\Windows\System\qxqMtgR.exe
  2⤵
  PID:9744
- C:\Windows\System\adKSEtl.exe
  C:\Windows\System\adKSEtl.exe
  2⤵
  PID:9776
- C:\Windows\System\lPvCyqR.exe
  C:\Windows\System\lPvCyqR.exe
  2⤵
  PID:9792
- C:\Windows\System\yZFaZcg.exe
  C:\Windows\System\yZFaZcg.exe
  2⤵
  PID:9820
- C:\Windows\System\CBhzuNi.exe
  C:\Windows\System\CBhzuNi.exe
  2⤵
  PID:9836
- C:\Windows\System\CdFFVvE.exe
  C:\Windows\System\CdFFVvE.exe
  2⤵
  PID:9860
- C:\Windows\System\EfBpfnz.exe
  C:\Windows\System\EfBpfnz.exe
  2⤵
  PID:9880
- C:\Windows\System\aWwdlrd.exe
  C:\Windows\System\aWwdlrd.exe
  2⤵
  PID:9896
- C:\Windows\System\yvcDYgt.exe
  C:\Windows\System\yvcDYgt.exe
  2⤵
  PID:9920
- C:\Windows\System\xTtvOmm.exe
  C:\Windows\System\xTtvOmm.exe
  2⤵
  PID:9944
- C:\Windows\System\qTqculG.exe
  C:\Windows\System\qTqculG.exe
  2⤵
  PID:9964
- C:\Windows\System\JCzvDIh.exe
  C:\Windows\System\JCzvDIh.exe
  2⤵
  PID:9988
- C:\Windows\System\KUouRAV.exe
  C:\Windows\System\KUouRAV.exe
  2⤵
  PID:10008
- C:\Windows\System\QpayojF.exe
  C:\Windows\System\QpayojF.exe
  2⤵
  PID:10032
- C:\Windows\System\WvczMvw.exe
  C:\Windows\System\WvczMvw.exe
  2⤵
  PID:10060
- C:\Windows\System\HIGYpzk.exe
  C:\Windows\System\HIGYpzk.exe
  2⤵
  PID:10080
- C:\Windows\System\BfpdcqB.exe
  C:\Windows\System\BfpdcqB.exe
  2⤵
  PID:10096
- C:\Windows\System\iwPDIBc.exe
  C:\Windows\System\iwPDIBc.exe
  2⤵
  PID:10116
- C:\Windows\System\LSCJJri.exe
  C:\Windows\System\LSCJJri.exe
  2⤵
  PID:10136
- C:\Windows\System\rxarxVY.exe
  C:\Windows\System\rxarxVY.exe
  2⤵
  PID:10164
- C:\Windows\System\dAfJWhF.exe
  C:\Windows\System\dAfJWhF.exe
  2⤵
  PID:10184
- C:\Windows\System\EOTTrEO.exe
  C:\Windows\System\EOTTrEO.exe
  2⤵
  PID:10208
- C:\Windows\System\DDoODLX.exe
  C:\Windows\System\DDoODLX.exe
  2⤵
  PID:10228
- C:\Windows\System\Opjfmhu.exe
  C:\Windows\System\Opjfmhu.exe
  2⤵
  PID:7924
- C:\Windows\System\mJEkUbv.exe
  C:\Windows\System\mJEkUbv.exe
  2⤵
  PID:7656
- C:\Windows\System\SzgNwoy.exe
  C:\Windows\System\SzgNwoy.exe
  2⤵
  PID:8912
- C:\Windows\System\BvaPROq.exe
  C:\Windows\System\BvaPROq.exe
  2⤵
  PID:9004
- C:\Windows\System\ZEOFQFj.exe
  C:\Windows\System\ZEOFQFj.exe
  2⤵
  PID:9156
- C:\Windows\System\TFSwNua.exe
  C:\Windows\System\TFSwNua.exe
  2⤵
  PID:9248
- C:\Windows\System\eSuqVgy.exe
  C:\Windows\System\eSuqVgy.exe
  2⤵
  PID:8832
- C:\Windows\System\cKUDjgU.exe
  C:\Windows\System\cKUDjgU.exe
  2⤵
  PID:9288
- C:\Windows\System\kDyQoWH.exe
  C:\Windows\System\kDyQoWH.exe
  2⤵
  PID:9360
- C:\Windows\System\zTqbEGc.exe
  C:\Windows\System\zTqbEGc.exe
  2⤵
  PID:5048
- C:\Windows\System\PyMskMn.exe
  C:\Windows\System\PyMskMn.exe
  2⤵
  PID:2856
- C:\Windows\System\gIagBiB.exe
  C:\Windows\System\gIagBiB.exe
  2⤵
  PID:9264
- C:\Windows\System\wTLMrML.exe
  C:\Windows\System\wTLMrML.exe
  2⤵
  PID:9344
- C:\Windows\System\ohHytmP.exe
  C:\Windows\System\ohHytmP.exe
  2⤵
  PID:9408
- C:\Windows\System\zhRUbZN.exe
  C:\Windows\System\zhRUbZN.exe
  2⤵
  PID:6220
- C:\Windows\System\eqzFWqS.exe
  C:\Windows\System\eqzFWqS.exe
  2⤵
  PID:9544
- C:\Windows\System\qHtkNtm.exe
  C:\Windows\System\qHtkNtm.exe
  2⤵
  PID:9872
- C:\Windows\System\OuXMykY.exe
  C:\Windows\System\OuXMykY.exe
  2⤵
  PID:10328
- C:\Windows\System\OOnlzWq.exe
  C:\Windows\System\OOnlzWq.exe
  2⤵
  PID:10352
- C:\Windows\System\ILiOewm.exe
  C:\Windows\System\ILiOewm.exe
  2⤵
  PID:10376
- C:\Windows\System\SXyTLnN.exe
  C:\Windows\System\SXyTLnN.exe
  2⤵
  PID:10404
- C:\Windows\System\DyKgLuR.exe
  C:\Windows\System\DyKgLuR.exe
  2⤵
  PID:10432
- C:\Windows\System\ntJXcrw.exe
  C:\Windows\System\ntJXcrw.exe
  2⤵
  PID:10452
- C:\Windows\System\wghSCNL.exe
  C:\Windows\System\wghSCNL.exe
  2⤵
  PID:10476
- C:\Windows\System\mZBbRfx.exe
  C:\Windows\System\mZBbRfx.exe
  2⤵
  PID:10540
- C:\Windows\System\YeUfkIE.exe
  C:\Windows\System\YeUfkIE.exe
  2⤵
  PID:10556
- C:\Windows\System\hmqglWX.exe
  C:\Windows\System\hmqglWX.exe
  2⤵
  PID:10572
- C:\Windows\System\GdMovni.exe
  C:\Windows\System\GdMovni.exe
  2⤵
  PID:10588
- C:\Windows\System\NbtSiiu.exe
  C:\Windows\System\NbtSiiu.exe
  2⤵
  PID:10632
- C:\Windows\System\urXfqbl.exe
  C:\Windows\System\urXfqbl.exe
  2⤵
  PID:10652
- C:\Windows\System\RVluEsl.exe
  C:\Windows\System\RVluEsl.exe
  2⤵
  PID:10676
- C:\Windows\System\XZpqgvO.exe
  C:\Windows\System\XZpqgvO.exe
  2⤵
  PID:10700
- C:\Windows\System\SukjZbE.exe
  C:\Windows\System\SukjZbE.exe
  2⤵
  PID:10716
- C:\Windows\System\nVYoefd.exe
  C:\Windows\System\nVYoefd.exe
  2⤵
  PID:10744
- C:\Windows\System\QiOpsiz.exe
  C:\Windows\System\QiOpsiz.exe
  2⤵
  PID:10768
- C:\Windows\System\cEWdNkv.exe
  C:\Windows\System\cEWdNkv.exe
  2⤵
  PID:10784
- C:\Windows\System\ggHppCr.exe
  C:\Windows\System\ggHppCr.exe
  2⤵
  PID:10800
- C:\Windows\System\HdLCVsK.exe
  C:\Windows\System\HdLCVsK.exe
  2⤵
  PID:10816
- C:\Windows\System\GoSZBlg.exe
  C:\Windows\System\GoSZBlg.exe
  2⤵
  PID:10832
- C:\Windows\System\XEIfeYX.exe
  C:\Windows\System\XEIfeYX.exe
  2⤵
  PID:10860
- C:\Windows\System\TUctcVM.exe
  C:\Windows\System\TUctcVM.exe
  2⤵
  PID:10884
- C:\Windows\System\sOMDCpo.exe
  C:\Windows\System\sOMDCpo.exe
  2⤵
  PID:10908
- C:\Windows\System\ltUcepZ.exe
  C:\Windows\System\ltUcepZ.exe
  2⤵
  PID:10928
- C:\Windows\System\RTJmJGQ.exe
  C:\Windows\System\RTJmJGQ.exe
  2⤵
  PID:10952
- C:\Windows\System\hcyxemx.exe
  C:\Windows\System\hcyxemx.exe
  2⤵
  PID:10972
- C:\Windows\System\VJijMKr.exe
  C:\Windows\System\VJijMKr.exe
  2⤵
  PID:10992
- C:\Windows\System\hAZckAI.exe
  C:\Windows\System\hAZckAI.exe
  2⤵
  PID:11016
- C:\Windows\System\OXbrCrM.exe
  C:\Windows\System\OXbrCrM.exe
  2⤵
  PID:11036
- C:\Windows\System\lNpUjjA.exe
  C:\Windows\System\lNpUjjA.exe
  2⤵
  PID:11052
- C:\Windows\System\RpDrpmC.exe
  C:\Windows\System\RpDrpmC.exe
  2⤵
  PID:11108
- C:\Windows\System\szpFAUA.exe
  C:\Windows\System\szpFAUA.exe
  2⤵
  PID:11128
- C:\Windows\System\KoFTFVH.exe
  C:\Windows\System\KoFTFVH.exe
  2⤵
  PID:11152
- C:\Windows\System\KRRlkAh.exe
  C:\Windows\System\KRRlkAh.exe
  2⤵
  PID:11176
- C:\Windows\System\PZOsbBC.exe
  C:\Windows\System\PZOsbBC.exe
  2⤵
  PID:11200
- C:\Windows\System\trMqclT.exe
  C:\Windows\System\trMqclT.exe
  2⤵
  PID:11232
- C:\Windows\System\zNiWFEQ.exe
  C:\Windows\System\zNiWFEQ.exe
  2⤵
  PID:11252
- C:\Windows\System\XCYqqXC.exe
  C:\Windows\System\XCYqqXC.exe
  2⤵
  PID:7364
- C:\Windows\System\VUwPKlf.exe
  C:\Windows\System\VUwPKlf.exe
  2⤵
  PID:9236
- C:\Windows\System\iCVQJvl.exe
  C:\Windows\System\iCVQJvl.exe
  2⤵
  PID:10088
- C:\Windows\System\kAbBrYu.exe
  C:\Windows\System\kAbBrYu.exe
  2⤵
  PID:10348
- C:\Windows\System\oVIlrkp.exe
  C:\Windows\System\oVIlrkp.exe
  2⤵
  PID:8352
- C:\Windows\System\kIafCzX.exe
  C:\Windows\System\kIafCzX.exe
  2⤵
  PID:9040
- C:\Windows\System\aPJJqrk.exe
  C:\Windows\System\aPJJqrk.exe
  2⤵
  PID:10420
- C:\Windows\System\GTpZfbm.exe
  C:\Windows\System\GTpZfbm.exe
  2⤵
  PID:10460
- C:\Windows\System\cZxLtNU.exe
  C:\Windows\System\cZxLtNU.exe
  2⤵
  PID:10668
- C:\Windows\System\ENDLkzH.exe
  C:\Windows\System\ENDLkzH.exe
  2⤵
  PID:11028
- C:\Windows\System\bVwbqNz.exe
  C:\Windows\System\bVwbqNz.exe
  2⤵
  PID:10904
- C:\Windows\System\hxkQmfg.exe
  C:\Windows\System\hxkQmfg.exe
  2⤵
  PID:10688
- C:\Windows\System\vQqhZCV.exe
  C:\Windows\System\vQqhZCV.exe
  2⤵
  PID:10752
- C:\Windows\System\YQUdiFc.exe
  C:\Windows\System\YQUdiFc.exe
  2⤵
  PID:10780
- C:\Windows\System\SSVhDtU.exe
  C:\Windows\System\SSVhDtU.exe
  2⤵
  PID:10876
- C:\Windows\System\BzJmjnN.exe
  C:\Windows\System\BzJmjnN.exe
  2⤵
  PID:10960
- C:\Windows\System\iLUWOqc.exe
  C:\Windows\System\iLUWOqc.exe
  2⤵
  PID:9176
- C:\Windows\System\jRvNlZv.exe
  C:\Windows\System\jRvNlZv.exe
  2⤵
  PID:11048
- C:\Windows\System\KQzyLLI.exe
  C:\Windows\System\KQzyLLI.exe
  2⤵
  PID:11216
- C:\Windows\System\rcsRgUx.exe
  C:\Windows\System\rcsRgUx.exe
  2⤵
  PID:9804
- C:\Windows\System\OPiSrfo.exe
  C:\Windows\System\OPiSrfo.exe
  2⤵
  PID:11124
- C:\Windows\System\dNmsJzP.exe
  C:\Windows\System\dNmsJzP.exe
  2⤵
  PID:11268
- C:\Windows\System\pUNlZsd.exe
  C:\Windows\System\pUNlZsd.exe
  2⤵
  PID:11308
- C:\Windows\System\xQSkLxq.exe
  C:\Windows\System\xQSkLxq.exe
  2⤵
  PID:11324
- C:\Windows\System\FEWbbTa.exe
  C:\Windows\System\FEWbbTa.exe
  2⤵
  PID:11344
- C:\Windows\System\BqnIdBq.exe
  C:\Windows\System\BqnIdBq.exe
  2⤵
  PID:11368
- C:\Windows\System\DNBNbwA.exe
  C:\Windows\System\DNBNbwA.exe
  2⤵
  PID:11388
- C:\Windows\System\JsYnrYy.exe
  C:\Windows\System\JsYnrYy.exe
  2⤵
  PID:11412
- C:\Windows\System\vZQqLKT.exe
  C:\Windows\System\vZQqLKT.exe
  2⤵
  PID:11436
- C:\Windows\System\SNlKtJH.exe
  C:\Windows\System\SNlKtJH.exe
  2⤵
  PID:11456
- C:\Windows\System\xdYPBIE.exe
  C:\Windows\System\xdYPBIE.exe
  2⤵
  PID:11484
- C:\Windows\System\TqrLHDb.exe
  C:\Windows\System\TqrLHDb.exe
  2⤵
  PID:11500
- C:\Windows\System\EypXFkO.exe
  C:\Windows\System\EypXFkO.exe
  2⤵
  PID:11524
- C:\Windows\System\GZqgiBW.exe
  C:\Windows\System\GZqgiBW.exe
  2⤵
  PID:11544
- C:\Windows\System\lJbgSXB.exe
  C:\Windows\System\lJbgSXB.exe
  2⤵
  PID:11568
- C:\Windows\System\WvhHFnL.exe
  C:\Windows\System\WvhHFnL.exe
  2⤵
  PID:11592
- C:\Windows\System\VQOSnbu.exe
  C:\Windows\System\VQOSnbu.exe
  2⤵
  PID:11620
- C:\Windows\System\jvQulWO.exe
  C:\Windows\System\jvQulWO.exe
  2⤵
  PID:11636
- C:\Windows\System\ReeKjQY.exe
  C:\Windows\System\ReeKjQY.exe
  2⤵
  PID:11656
- C:\Windows\System\vvblFfE.exe
  C:\Windows\System\vvblFfE.exe
  2⤵
  PID:11688
- C:\Windows\System\MaiPZKI.exe
  C:\Windows\System\MaiPZKI.exe
  2⤵
  PID:11756
- C:\Windows\System\FYxsjeb.exe
  C:\Windows\System\FYxsjeb.exe
  2⤵
  PID:11772
- C:\Windows\System\SUchoQD.exe
  C:\Windows\System\SUchoQD.exe
  2⤵
  PID:11788
- C:\Windows\System\qCaYYOU.exe
  C:\Windows\System\qCaYYOU.exe
  2⤵
  PID:11812
- C:\Windows\System\yadhwiX.exe
  C:\Windows\System\yadhwiX.exe
  2⤵
  PID:11828
- C:\Windows\System\ImBjfmJ.exe
  C:\Windows\System\ImBjfmJ.exe
  2⤵
  PID:11844
- C:\Windows\System\vefVEIM.exe
  C:\Windows\System\vefVEIM.exe
  2⤵
  PID:11868
- C:\Windows\System\CZEpFxH.exe
  C:\Windows\System\CZEpFxH.exe
  2⤵
  PID:11888
- C:\Windows\System\CskhEVE.exe
  C:\Windows\System\CskhEVE.exe
  2⤵
  PID:11916
- C:\Windows\System\zXBdHWb.exe
  C:\Windows\System\zXBdHWb.exe
  2⤵
  PID:11984
- C:\Windows\System\LADOVqv.exe
  C:\Windows\System\LADOVqv.exe
  2⤵
  PID:12008
- C:\Windows\System\ntnzkiQ.exe
  C:\Windows\System\ntnzkiQ.exe
  2⤵
  PID:12032
- C:\Windows\System\mhVbazX.exe
  C:\Windows\System\mhVbazX.exe
  2⤵
  PID:12048
- C:\Windows\System\AQPaTgj.exe
  C:\Windows\System\AQPaTgj.exe
  2⤵
  PID:12072
- C:\Windows\System\qZIImkc.exe
  C:\Windows\System\qZIImkc.exe
  2⤵
  PID:12096
- C:\Windows\System\azCadRO.exe
  C:\Windows\System\azCadRO.exe
  2⤵
  PID:12120
- C:\Windows\System\EvyvaAp.exe
  C:\Windows\System\EvyvaAp.exe
  2⤵
  PID:12144
- C:\Windows\System\MUzAqmC.exe
  C:\Windows\System\MUzAqmC.exe
  2⤵
  PID:10796
- C:\Windows\System\ehcbamZ.exe
  C:\Windows\System\ehcbamZ.exe
  2⤵
  PID:11212
- C:\Windows\System\SthyItz.exe
  C:\Windows\System\SthyItz.exe
  2⤵
  PID:11360
- C:\Windows\System\MZQMFyc.exe
  C:\Windows\System\MZQMFyc.exe
  2⤵
  PID:10660
- C:\Windows\System\qyhSpPY.exe
  C:\Windows\System\qyhSpPY.exe
  2⤵
  PID:2476
- C:\Windows\System\jlArXJF.exe
  C:\Windows\System\jlArXJF.exe
  2⤵
  PID:11288
- C:\Windows\System\UbfeoPI.exe
  C:\Windows\System\UbfeoPI.exe
  2⤵
  PID:11728
- C:\Windows\System\uyPgZgy.exe
  C:\Windows\System\uyPgZgy.exe
  2⤵
  PID:11836
- C:\Windows\System\jzlvMfl.exe
  C:\Windows\System\jzlvMfl.exe
  2⤵
  PID:11896
- C:\Windows\System\JLyQQCo.exe
  C:\Windows\System\JLyQQCo.exe
  2⤵
  PID:1612
- C:\Windows\System\zTMwNWs.exe
  C:\Windows\System\zTMwNWs.exe
  2⤵
  PID:456
- C:\Windows\System\bTrBInq.exe
  C:\Windows\System\bTrBInq.exe
  2⤵
  PID:12000
- C:\Windows\System\PPNQPWn.exe
  C:\Windows\System\PPNQPWn.exe
  2⤵
  PID:12232
- C:\Windows\System\YIAopkT.exe
  C:\Windows\System\YIAopkT.exe
  2⤵
  PID:12024
- C:\Windows\System\LTgKxWy.exe
  C:\Windows\System\LTgKxWy.exe
  2⤵
  PID:12056
- C:\Windows\System\dvjbFWx.exe
  C:\Windows\System\dvjbFWx.exe
  2⤵
  PID:10236
- C:\Windows\System\LiZUylM.exe
  C:\Windows\System\LiZUylM.exe
  2⤵
  PID:12136
- C:\Windows\System\YikUMSS.exe
  C:\Windows\System\YikUMSS.exe
  2⤵
  PID:12180
- C:\Windows\System\pWNxvNb.exe
  C:\Windows\System\pWNxvNb.exe
  2⤵
  PID:12252
- C:\Windows\System\GchyCVy.exe
  C:\Windows\System\GchyCVy.exe
  2⤵
  PID:11184
- C:\Windows\System\gOSWIGA.exe
  C:\Windows\System\gOSWIGA.exe
  2⤵
  PID:11400
- C:\Windows\System\sibOMAm.exe
  C:\Windows\System\sibOMAm.exe
  2⤵
  PID:11420
- C:\Windows\System\mJBfBWW.exe
  C:\Windows\System\mJBfBWW.exe
  2⤵
  PID:10824
- C:\Windows\System\DOjzFee.exe
  C:\Windows\System\DOjzFee.exe
  2⤵
  PID:11340
- C:\Windows\System\VaWFNXi.exe
  C:\Windows\System\VaWFNXi.exe
  2⤵
  PID:11852
- C:\Windows\System\UcKbymL.exe
  C:\Windows\System\UcKbymL.exe
  2⤵
  PID:11980
- C:\Windows\System\xsudIGi.exe
  C:\Windows\System\xsudIGi.exe
  2⤵
  PID:11808
- C:\Windows\System\RgkCXtS.exe
  C:\Windows\System\RgkCXtS.exe
  2⤵
  PID:12092
- C:\Windows\System\FyFpjdy.exe
  C:\Windows\System\FyFpjdy.exe
  2⤵
  PID:11684
- C:\Windows\System\IdLdbZt.exe
  C:\Windows\System\IdLdbZt.exe
  2⤵
  PID:12348
- C:\Windows\System\dPrwbvp.exe
  C:\Windows\System\dPrwbvp.exe
  2⤵
  PID:12428
- C:\Windows\System\zrTtbmJ.exe
  C:\Windows\System\zrTtbmJ.exe
  2⤵
  PID:12588
- C:\Windows\System\KbYGUsl.exe
  C:\Windows\System\KbYGUsl.exe
  2⤵
  PID:12656
- C:\Windows\System\DnvoAfn.exe
  C:\Windows\System\DnvoAfn.exe
  2⤵
  PID:12672
- C:\Windows\System\aLqsJRR.exe
  C:\Windows\System\aLqsJRR.exe
  2⤵
  PID:12692
- C:\Windows\System\mDgGFEg.exe
  C:\Windows\System\mDgGFEg.exe
  2⤵
  PID:12716
- C:\Windows\System\JvoYoqW.exe
  C:\Windows\System\JvoYoqW.exe
  2⤵
  PID:12732
- C:\Windows\System\YihuOQR.exe
  C:\Windows\System\YihuOQR.exe
  2⤵
  PID:12752
- C:\Windows\System\nhHyOff.exe
  C:\Windows\System\nhHyOff.exe
  2⤵
  PID:12768
- C:\Windows\System\EeCmzZq.exe
  C:\Windows\System\EeCmzZq.exe
  2⤵
  PID:12788
- C:\Windows\System\ubaGDsc.exe
  C:\Windows\System\ubaGDsc.exe
  2⤵
  PID:12808
- C:\Windows\System\rPZkxgq.exe
  C:\Windows\System\rPZkxgq.exe
  2⤵
  PID:12828
- C:\Windows\System\xUiDsTi.exe
  C:\Windows\System\xUiDsTi.exe
  2⤵
  PID:12844
- C:\Windows\System\eSwpUfz.exe
  C:\Windows\System\eSwpUfz.exe
  2⤵
  PID:12872
- C:\Windows\System\jFZRYpt.exe
  C:\Windows\System\jFZRYpt.exe
  2⤵
  PID:12892
- C:\Windows\System\rowIhHj.exe
  C:\Windows\System\rowIhHj.exe
  2⤵
  PID:12912
- C:\Windows\System\cKcnZdZ.exe
  C:\Windows\System\cKcnZdZ.exe
  2⤵
  PID:12932
- C:\Windows\System\txwmtdu.exe
  C:\Windows\System\txwmtdu.exe
  2⤵
  PID:12948
- C:\Windows\System\tHgJkkG.exe
  C:\Windows\System\tHgJkkG.exe
  2⤵
  PID:12964
- C:\Windows\System\IluBuFd.exe
  C:\Windows\System\IluBuFd.exe
  2⤵
  PID:12984
- C:\Windows\System\uyuHgwX.exe
  C:\Windows\System\uyuHgwX.exe
  2⤵
  PID:13004
- C:\Windows\System\iJVfiVC.exe
  C:\Windows\System\iJVfiVC.exe
  2⤵
  PID:13032
- C:\Windows\System\XJLEpsG.exe
  C:\Windows\System\XJLEpsG.exe
  2⤵
  PID:13104
- C:\Windows\System\ZhBrGfs.exe
  C:\Windows\System\ZhBrGfs.exe
  2⤵
  PID:13148
- C:\Windows\System\aTTQPZs.exe
  C:\Windows\System\aTTQPZs.exe
  2⤵
  PID:13168
- C:\Windows\System\QidkiRq.exe
  C:\Windows\System\QidkiRq.exe
  2⤵
  PID:13184
- C:\Windows\System\EhLgTtT.exe
  C:\Windows\System\EhLgTtT.exe
  2⤵
  PID:13204
- C:\Windows\System\MxKvZTT.exe
  C:\Windows\System\MxKvZTT.exe
  2⤵
  PID:13224
- C:\Windows\System\JqyjheK.exe
  C:\Windows\System\JqyjheK.exe
  2⤵
  PID:13244
- C:\Windows\System\nNmZOqh.exe
  C:\Windows\System\nNmZOqh.exe
  2⤵
  PID:13260
- C:\Windows\System\SFktnyc.exe
  C:\Windows\System\SFktnyc.exe
  2⤵
  PID:13276
- C:\Windows\System\rBJOXLk.exe
  C:\Windows\System\rBJOXLk.exe
  2⤵
  PID:13300
- C:\Windows\System\WUQnjSk.exe
  C:\Windows\System\WUQnjSk.exe
  2⤵
  PID:2228
- C:\Windows\System\JQHSWtp.exe
  C:\Windows\System\JQHSWtp.exe
  2⤵
  PID:2412
- C:\Windows\System\yfebKQX.exe
  C:\Windows\System\yfebKQX.exe
  2⤵
  PID:12284
- C:\Windows\System\oKJQhtv.exe
  C:\Windows\System\oKJQhtv.exe
  2⤵
  PID:12128
- C:\Windows\System\ADpZhSM.exe
  C:\Windows\System\ADpZhSM.exe
  2⤵
  PID:12356
- C:\Windows\System\qqRqJYX.exe
  C:\Windows\System\qqRqJYX.exe
  2⤵
  PID:12304
- C:\Windows\System\YVQbVOJ.exe
  C:\Windows\System\YVQbVOJ.exe
  2⤵
  PID:12296
- C:\Windows\System\HQiWZIv.exe
  C:\Windows\System\HQiWZIv.exe
  2⤵
  PID:12440
- C:\Windows\System\mHKQfgc.exe
  C:\Windows\System\mHKQfgc.exe
  2⤵
  PID:2148
- C:\Windows\System\dZudFmF.exe
  C:\Windows\System\dZudFmF.exe
  2⤵
  PID:12624
- C:\Windows\System\dukshQr.exe
  C:\Windows\System\dukshQr.exe
  2⤵
  PID:12504
- C:\Windows\System\nmwQDtO.exe
  C:\Windows\System\nmwQDtO.exe
  2⤵
  PID:12664
- C:\Windows\System\GGNjNdU.exe
  C:\Windows\System\GGNjNdU.exe
  2⤵
  PID:12700
- C:\Windows\System\btpSskC.exe
  C:\Windows\System\btpSskC.exe
  2⤵
  PID:12704
- C:\Windows\System\cJUFVWp.exe
  C:\Windows\System\cJUFVWp.exe
  2⤵
  PID:4840
- C:\Windows\System\UOGEPEy.exe
  C:\Windows\System\UOGEPEy.exe
  2⤵
  PID:12980
- C:\Windows\System\xUSQrci.exe
  C:\Windows\System\xUSQrci.exe
  2⤵
  PID:12800
- C:\Windows\System\GLlWKjw.exe
  C:\Windows\System\GLlWKjw.exe
  2⤵
  PID:13100
- C:\Windows\System\LftKgXw.exe
  C:\Windows\System\LftKgXw.exe
  2⤵
  PID:13088
- C:\Windows\System\DyAqoxH.exe
  C:\Windows\System\DyAqoxH.exe
  2⤵
  PID:13072
- C:\Windows\System\HpnKajd.exe
  C:\Windows\System\HpnKajd.exe
  2⤵
  PID:13164
- C:\Windows\System\KZuIiHv.exe
  C:\Windows\System\KZuIiHv.exe
  2⤵
  PID:13232
- C:\Windows\System\wDoCnKy.exe
  C:\Windows\System\wDoCnKy.exe
  2⤵
  PID:13296
- C:\Windows\System\jsSYUmo.exe
  C:\Windows\System\jsSYUmo.exe
  2⤵
  PID:12172
- C:\Windows\System\mHZDmil.exe
  C:\Windows\System\mHZDmil.exe
  2⤵
  PID:11300
- C:\Windows\System\noXxJrA.exe
  C:\Windows\System\noXxJrA.exe
  2⤵
  PID:12116
- C:\Windows\System\qvRKsEz.exe
  C:\Windows\System\qvRKsEz.exe
  2⤵
  PID:12960
- C:\Windows\System\QpwXrdf.exe
  C:\Windows\System\QpwXrdf.exe
  2⤵
  PID:12972
- C:\Windows\System\pyIsffu.exe
  C:\Windows\System\pyIsffu.exe
  2⤵
  PID:12744
- C:\Windows\System\SQkANff.exe
  C:\Windows\System\SQkANff.exe
  2⤵
  PID:4936
- C:\Windows\System\ClVQYBq.exe
  C:\Windows\System\ClVQYBq.exe
  2⤵
  PID:12532
- C:\Windows\System\vzTCrLL.exe
  C:\Windows\System\vzTCrLL.exe
  2⤵
  PID:13320
- C:\Windows\System\EPkMBWm.exe
  C:\Windows\System\EPkMBWm.exe
  2⤵
  PID:13348
- C:\Windows\System\mSmkkSH.exe
  C:\Windows\System\mSmkkSH.exe
  2⤵
  PID:13428
- C:\Windows\System\QAKQnWB.exe
  C:\Windows\System\QAKQnWB.exe
  2⤵
  PID:13472
- C:\Windows\System\ePiKkkq.exe
  C:\Windows\System\ePiKkkq.exe
  2⤵
  PID:13492
- C:\Windows\System\xOnZBrU.exe
  C:\Windows\System\xOnZBrU.exe
  2⤵
  PID:13540
- C:\Windows\System\jffSSuk.exe
  C:\Windows\System\jffSSuk.exe
  2⤵
  PID:13556
- C:\Windows\System\hbfjBzu.exe
  C:\Windows\System\hbfjBzu.exe
  2⤵
  PID:13576
- C:\Windows\System\bAadUmF.exe
  C:\Windows\System\bAadUmF.exe
  2⤵
  PID:13628
- C:\Windows\System\wablMMF.exe
  C:\Windows\System\wablMMF.exe
  2⤵
  PID:13688
- C:\Windows\System\rXpgdmz.exe
  C:\Windows\System\rXpgdmz.exe
  2⤵
  PID:13712
- C:\Windows\System\GNUhFIv.exe
  C:\Windows\System\GNUhFIv.exe
  2⤵
  PID:13748
- C:\Windows\System\OyfSnMp.exe
  C:\Windows\System\OyfSnMp.exe
  2⤵
  PID:13780
- C:\Windows\System\PlkRNMN.exe
  C:\Windows\System\PlkRNMN.exe
  2⤵
  PID:13804
- C:\Windows\System\eBMnsWB.exe
  C:\Windows\System\eBMnsWB.exe
  2⤵
  PID:13820
- C:\Windows\System\GxikWLA.exe
  C:\Windows\System\GxikWLA.exe
  2⤵
  PID:13848
- C:\Windows\System\KLgMpWR.exe
  C:\Windows\System\KLgMpWR.exe
  2⤵
  PID:13868
- C:\Windows\System\PqffVJx.exe
  C:\Windows\System\PqffVJx.exe
  2⤵
  PID:13884
- C:\Windows\System\nbUhAuZ.exe
  C:\Windows\System\nbUhAuZ.exe
  2⤵
  PID:14068
- C:\Windows\System\YsXqwHD.exe
  C:\Windows\System\YsXqwHD.exe
  2⤵
  PID:14088
- C:\Windows\System\zyGueeI.exe
  C:\Windows\System\zyGueeI.exe
  2⤵
  PID:14120
- C:\Windows\System\WHSHvgh.exe
  C:\Windows\System\WHSHvgh.exe
  2⤵
  PID:14144
- C:\Windows\System\TZBzCiR.exe
  C:\Windows\System\TZBzCiR.exe
  2⤵
  PID:14164
- C:\Windows\System\sPaUFgJ.exe
  C:\Windows\System\sPaUFgJ.exe
  2⤵
  PID:14188
- C:\Windows\System\BUSpFQx.exe
  C:\Windows\System\BUSpFQx.exe
  2⤵
  PID:14228
- C:\Windows\System\WdqXeBC.exe
  C:\Windows\System\WdqXeBC.exe
  2⤵
  PID:14316
- C:\Windows\System\WhscrIn.exe
  C:\Windows\System\WhscrIn.exe
  2⤵
  PID:12780
- C:\Windows\System\zemxDPv.exe
  C:\Windows\System\zemxDPv.exe
  2⤵
  PID:2008
- C:\Windows\System\SnTuPSD.exe
  C:\Windows\System\SnTuPSD.exe
  2⤵
  PID:1672
- C:\Windows\System\YtzRHrY.exe
  C:\Windows\System\YtzRHrY.exe
  2⤵
  PID:13012
- C:\Windows\System\CJLAMxL.exe
  C:\Windows\System\CJLAMxL.exe
  2⤵
  PID:13436
- C:\Windows\System\mkKQPAD.exe
  C:\Windows\System\mkKQPAD.exe
  2⤵
  PID:748
- C:\Windows\System\CAzAgXX.exe
  C:\Windows\System\CAzAgXX.exe
  2⤵
  PID:13252
- C:\Windows\System\ruhjRAR.exe
  C:\Windows\System\ruhjRAR.exe
  2⤵
  PID:12456
- C:\Windows\System\Kzwbogh.exe
  C:\Windows\System\Kzwbogh.exe
  2⤵
  PID:3148
- C:\Windows\System\SajrFfr.exe
  C:\Windows\System\SajrFfr.exe
  2⤵
  PID:13344
- C:\Windows\System\XKTxbfS.exe
  C:\Windows\System\XKTxbfS.exe
  2⤵
  PID:13388
- C:\Windows\System\bCZiPgm.exe
  C:\Windows\System\bCZiPgm.exe
  2⤵
  PID:13420
- C:\Windows\System\hJsTVTc.exe
  C:\Windows\System\hJsTVTc.exe
  2⤵
  PID:13488
- C:\Windows\System\uRYsTXJ.exe
  C:\Windows\System\uRYsTXJ.exe
  2⤵
  PID:13508
- C:\Windows\System\MCybKyP.exe
  C:\Windows\System\MCybKyP.exe
  2⤵
  PID:13548
- C:\Windows\System\fxTOXlS.exe
  C:\Windows\System\fxTOXlS.exe
  2⤵
  PID:13564
- C:\Windows\System\pQnPvlM.exe
  C:\Windows\System\pQnPvlM.exe
  2⤵
  PID:13616
- C:\Windows\System\INOMhYP.exe
  C:\Windows\System\INOMhYP.exe
  2⤵
  PID:13680
- C:\Windows\System\uGPWewx.exe
  C:\Windows\System\uGPWewx.exe
  2⤵
  PID:13732
- C:\Windows\System\SzWnfmV.exe
  C:\Windows\System\SzWnfmV.exe
  2⤵
  PID:13792
- C:\Windows\System\UhnDMRd.exe
  C:\Windows\System\UhnDMRd.exe
  2⤵
  PID:13756
- C:\Windows\System\IpxIBEU.exe
  C:\Windows\System\IpxIBEU.exe
  2⤵
  PID:13948
- C:\Windows\System\wdhrlHP.exe
  C:\Windows\System\wdhrlHP.exe
  2⤵
  PID:13916
- C:\Windows\System\DwvJyXb.exe
  C:\Windows\System\DwvJyXb.exe
  2⤵
  PID:13952
- C:\Windows\System\dgyZxNI.exe
  C:\Windows\System\dgyZxNI.exe
  2⤵
  PID:13988
- C:\Windows\System\qiDMhbP.exe
  C:\Windows\System\qiDMhbP.exe
  2⤵
  PID:14020
- C:\Windows\System\rlZUcVi.exe
  C:\Windows\System\rlZUcVi.exe
  2⤵
  PID:14248
- C:\Windows\System\XyOoJEQ.exe
  C:\Windows\System\XyOoJEQ.exe
  2⤵
  PID:6348
- C:\Windows\System\kwxBlDU.exe
  C:\Windows\System\kwxBlDU.exe
  2⤵
  PID:14324
- C:\Windows\System\nKzFErB.exe
  C:\Windows\System\nKzFErB.exe
  2⤵
  PID:4220
- C:\Windows\System\DwDMckU.exe
  C:\Windows\System\DwDMckU.exe
  2⤵
  PID:1488
- C:\Windows\System\GBSdcMM.exe
  C:\Windows\System\GBSdcMM.exe
  2⤵
  PID:800
- C:\Windows\System\CpzCFRe.exe
  C:\Windows\System\CpzCFRe.exe
  2⤵
  PID:4168
- C:\Windows\System\lJoUhmy.exe
  C:\Windows\System\lJoUhmy.exe
  2⤵
  PID:13440
- C:\Windows\System\wWpucxK.exe
  C:\Windows\System\wWpucxK.exe
  2⤵
  PID:12572
- C:\Windows\System\kqXlwQz.exe
  C:\Windows\System\kqXlwQz.exe
  2⤵
  PID:1912
- C:\Windows\System\mtPOfXr.exe
  C:\Windows\System\mtPOfXr.exe
  2⤵
  PID:13364
- C:\Windows\System\IaaPjLV.exe
  C:\Windows\System\IaaPjLV.exe
  2⤵
  PID:14112
- C:\Windows\System\GURaqiL.exe
  C:\Windows\System\GURaqiL.exe
  2⤵
  PID:13876
- C:\Windows\System\WjnvhJa.exe
  C:\Windows\System\WjnvhJa.exe
  2⤵
  PID:13340
- C:\Windows\System\PWKwHJs.exe
  C:\Windows\System\PWKwHJs.exe
  2⤵
  PID:14004
- C:\Windows\System\WVJlcEH.exe
  C:\Windows\System\WVJlcEH.exe
  2⤵
  PID:13524
- C:\Windows\System\mZaXQjt.exe
  C:\Windows\System\mZaXQjt.exe
  2⤵
  PID:12464
- C:\Windows\System\DreSrem.exe
  C:\Windows\System\DreSrem.exe
  2⤵
  PID:388
- C:\Windows\System\fCNgcAF.exe
  C:\Windows\System\fCNgcAF.exe
  2⤵
  PID:13924
- C:\Windows\System\OFRtKwO.exe
  C:\Windows\System\OFRtKwO.exe
  2⤵
  PID:13972
- C:\Windows\System\NCxVINY.exe
  C:\Windows\System\NCxVINY.exe
  2⤵
  PID:5764
- C:\Windows\System\SGvBpgS.exe
  C:\Windows\System\SGvBpgS.exe
  2⤵
  PID:14056
- C:\Windows\System\OBmOiRV.exe
  C:\Windows\System\OBmOiRV.exe
  2⤵
  PID:5080
- C:\Windows\System\SacOgUR.exe
  C:\Windows\System\SacOgUR.exe
  2⤵
  PID:1100
- C:\Windows\System\zDoaImf.exe
  C:\Windows\System\zDoaImf.exe
  2⤵
  PID:5064
- C:\Windows\System\reiubEn.exe
  C:\Windows\System\reiubEn.exe
  2⤵
  PID:14100
- C:\Windows\System\wqmXmAL.exe
  C:\Windows\System\wqmXmAL.exe
  2⤵
  PID:5988
- C:\Windows\System\AMKcwcS.exe
  C:\Windows\System\AMKcwcS.exe
  2⤵
  PID:14196
- C:\Windows\System\mNmsxJA.exe
  C:\Windows\System\mNmsxJA.exe
  2⤵
  PID:4328
- C:\Windows\System\EIZztRK.exe
  C:\Windows\System\EIZztRK.exe
  2⤵
  PID:4180
- C:\Windows\System\UeSDvMw.exe
  C:\Windows\System\UeSDvMw.exe
  2⤵
  PID:4648
- C:\Windows\System\dqjiIqo.exe
  C:\Windows\System\dqjiIqo.exe
  2⤵
  PID:5300
- C:\Windows\System\BhLTOof.exe
  C:\Windows\System\BhLTOof.exe
  2⤵
  PID:6188
- C:\Windows\System\GmTNSTJ.exe
  C:\Windows\System\GmTNSTJ.exe
  2⤵
  PID:4632
- C:\Windows\System\GoGPPqB.exe
  C:\Windows\System\GoGPPqB.exe
  2⤵
  PID:5184
- C:\Windows\System\htIuowJ.exe
  C:\Windows\System\htIuowJ.exe
  2⤵
  PID:3764
- C:\Windows\System\TGLtAYM.exe
  C:\Windows\System\TGLtAYM.exe
  2⤵
  PID:5312
- C:\Windows\System\QDYEzGg.exe
  C:\Windows\System\QDYEzGg.exe
  2⤵
  PID:5256
- C:\Windows\System\sSISORv.exe
  C:\Windows\System\sSISORv.exe
  2⤵
  PID:2188
- C:\Windows\System\GZUXMyY.exe
  C:\Windows\System\GZUXMyY.exe
  2⤵
  PID:13360
- C:\Windows\System\htkTNoc.exe
  C:\Windows\System\htkTNoc.exe
  2⤵
  PID:1600
- C:\Windows\System\xewYPxJ.exe
  C:\Windows\System\xewYPxJ.exe
  2⤵
  PID:2388
- C:\Windows\System\ciBDgkY.exe
  C:\Windows\System\ciBDgkY.exe
  2⤵
  PID:13936
- C:\Windows\System\iJHzxCw.exe
  C:\Windows\System\iJHzxCw.exe
  2⤵
  PID:5648
- C:\Windows\System\ldaFhhV.exe
  C:\Windows\System\ldaFhhV.exe
  2⤵
  PID:5700
- C:\Windows\System\wFqBsdm.exe
  C:\Windows\System\wFqBsdm.exe
  2⤵
  PID:5004
- C:\Windows\System\sVztSUI.exe
  C:\Windows\System\sVztSUI.exe
  2⤵
  PID:14096
- C:\Windows\System\bQWiTGd.exe
  C:\Windows\System\bQWiTGd.exe
  2⤵
  PID:4820
- C:\Windows\System\kfHhLXg.exe
  C:\Windows\System\kfHhLXg.exe
  2⤵
  PID:4828
- C:\Windows\System\LnPtpIt.exe
  C:\Windows\System\LnPtpIt.exe
  2⤵
  PID:5676
- C:\Windows\System\IbWPyrP.exe
  C:\Windows\System\IbWPyrP.exe
  2⤵
  PID:5568
- C:\Windows\System\LwQUbpp.exe
  C:\Windows\System\LwQUbpp.exe
  2⤵
  PID:13316
- C:\Windows\System\oQHSXTy.exe
  C:\Windows\System\oQHSXTy.exe
  2⤵
  PID:4628
- C:\Windows\System\AUbzoLo.exe
  C:\Windows\System\AUbzoLo.exe
  2⤵
  PID:13984
- C:\Windows\System\WmBjCfY.exe
  C:\Windows\System\WmBjCfY.exe
  2⤵
  PID:5644
- C:\Windows\System\ahkQiXP.exe
  C:\Windows\System\ahkQiXP.exe
  2⤵
  PID:6164
- C:\Windows\System\bRPOwkj.exe
  C:\Windows\System\bRPOwkj.exe
  2⤵
  PID:3652
- C:\Windows\System\Phcymcl.exe
  C:\Windows\System\Phcymcl.exe
  2⤵
  PID:5500
- C:\Windows\System\YxJbGLj.exe
  C:\Windows\System\YxJbGLj.exe
  2⤵
  PID:6312
- C:\Windows\System\MzVgxMC.exe
  C:\Windows\System\MzVgxMC.exe
  2⤵
  PID:13480
- C:\Windows\System\aszhVWB.exe
  C:\Windows\System\aszhVWB.exe
  2⤵
  PID:5280
- C:\Windows\System\ccgRUmj.exe
  C:\Windows\System\ccgRUmj.exe
  2⤵
  PID:13236
- C:\Windows\System\bQSGTLp.exe
  C:\Windows\System\bQSGTLp.exe
  2⤵
  PID:5524
- C:\Windows\System\dqplrCT.exe
  C:\Windows\System\dqplrCT.exe
  2⤵
  PID:5328
- C:\Windows\System\tOcWvqY.exe
  C:\Windows\System\tOcWvqY.exe
  2⤵
  PID:4144
- C:\Windows\System\gquxyuG.exe
  C:\Windows\System\gquxyuG.exe
  2⤵
  PID:3696
- C:\Windows\System\zlVsIzf.exe
  C:\Windows\System\zlVsIzf.exe
  2⤵
  PID:6072
- C:\Windows\System\wpIgwnR.exe
  C:\Windows\System\wpIgwnR.exe
  2⤵
  PID:6036
- C:\Windows\System\omzBSbo.exe
  C:\Windows\System\omzBSbo.exe
  2⤵
  PID:3156
- C:\Windows\System\MwnDMvd.exe
  C:\Windows\System\MwnDMvd.exe
  2⤵
  PID:14312
- C:\Windows\System\HniadgJ.exe
  C:\Windows\System\HniadgJ.exe
  2⤵
  PID:1232
- C:\Windows\System\AwBprcX.exe
  C:\Windows\System\AwBprcX.exe
  2⤵
  PID:2788
- C:\Windows\System\poPXeAZ.exe
  C:\Windows\System\poPXeAZ.exe
  2⤵
  PID:5452
- C:\Windows\System\aChvdiT.exe
  C:\Windows\System\aChvdiT.exe
  2⤵
  PID:3224
- C:\Windows\System\npWjPWa.exe
  C:\Windows\System\npWjPWa.exe
  2⤵
  PID:13644
- C:\Windows\System\FPRXFwY.exe
  C:\Windows\System\FPRXFwY.exe
  2⤵
  PID:4496
- C:\Windows\System\tOZfACK.exe
  C:\Windows\System\tOZfACK.exe
  2⤵
  PID:4488
- C:\Windows\System\SbBAShB.exe
  C:\Windows\System\SbBAShB.exe
  2⤵
  PID:5728
- C:\Windows\System\crBBYPU.exe
  C:\Windows\System\crBBYPU.exe
  2⤵
  PID:14052
- C:\Windows\System\RWUINlH.exe
  C:\Windows\System\RWUINlH.exe
  2⤵
  PID:2884
- C:\Windows\System\FCEgLKw.exe
  C:\Windows\System\FCEgLKw.exe
  2⤵
  PID:5960
- C:\Windows\System\rCjIIYd.exe
  C:\Windows\System\rCjIIYd.exe
  2⤵
  PID:5616
- C:\Windows\System\JQnAdVL.exe
  C:\Windows\System\JQnAdVL.exe
  2⤵
  PID:6552
- C:\Windows\System\dtpbvAm.exe
  C:\Windows\System\dtpbvAm.exe
  2⤵
  PID:5928
- C:\Windows\System\yZShizJ.exe
  C:\Windows\System\yZShizJ.exe
  2⤵
  PID:608
- C:\Windows\System\ulAepHZ.exe
  C:\Windows\System\ulAepHZ.exe
  2⤵
  PID:384
- C:\Windows\System\gRgKnaF.exe
  C:\Windows\System\gRgKnaF.exe
  2⤵
  PID:6864
- C:\Windows\System\uyHnxUR.exe
  C:\Windows\System\uyHnxUR.exe
  2⤵
  PID:6752
- C:\Windows\System\OMcHkzL.exe
  C:\Windows\System\OMcHkzL.exe
  2⤵
  PID:6956
- C:\Windows\System\xPcBKMu.exe
  C:\Windows\System\xPcBKMu.exe
  2⤵
  PID:228
- C:\Windows\System\oXCpjVa.exe
  C:\Windows\System\oXCpjVa.exe
  2⤵
  PID:6196
- C:\Windows\System\AFSJKFk.exe
  C:\Windows\System\AFSJKFk.exe
  2⤵
  PID:6340
- C:\Windows\System\VcjDEmL.exe
  C:\Windows\System\VcjDEmL.exe
  2⤵
  PID:7144
- C:\Windows\System\YfBlaQY.exe
  C:\Windows\System\YfBlaQY.exe
  2⤵
  PID:5924
- C:\Windows\System\OPmZyzh.exe
  C:\Windows\System\OPmZyzh.exe
  2⤵
  PID:7064
- C:\Windows\System\qcuiVMj.exe
  C:\Windows\System\qcuiVMj.exe
  2⤵
  PID:5552
- C:\Windows\System\MYzIWhh.exe
  C:\Windows\System\MYzIWhh.exe
  2⤵
  PID:448
- C:\Windows\System\mmSmwnW.exe
  C:\Windows\System\mmSmwnW.exe
  2⤵
  PID:4920
- C:\Windows\System\CGTYSRQ.exe
  C:\Windows\System\CGTYSRQ.exe
  2⤵
  PID:8512
- C:\Windows\System\WWmgvKO.exe
  C:\Windows\System\WWmgvKO.exe
  2⤵
  PID:6068
- C:\Windows\System\fNZYKhB.exe
  C:\Windows\System\fNZYKhB.exe
  2⤵
  PID:13636
- C:\Windows\System\aurLhcg.exe
  C:\Windows\System\aurLhcg.exe
  2⤵
  PID:10524
- C:\Windows\System\xhsWXJE.exe
  C:\Windows\System\xhsWXJE.exe
  2⤵
  PID:6872
- C:\Windows\System\vPAhKOg.exe
  C:\Windows\System\vPAhKOg.exe
  2⤵
  PID:6492
- C:\Windows\System\BsdloxC.exe
  C:\Windows\System\BsdloxC.exe
  2⤵
  PID:14344
- C:\Windows\System\lKMbImI.exe
  C:\Windows\System\lKMbImI.exe
  2⤵
  PID:14360
- C:\Windows\System\rymlhRR.exe
  C:\Windows\System\rymlhRR.exe
  2⤵
  PID:14380
- C:\Windows\System\GlVWYmN.exe
  C:\Windows\System\GlVWYmN.exe
  2⤵
  PID:14400
- C:\Windows\System\VjpfMsH.exe
  C:\Windows\System\VjpfMsH.exe
  2⤵
  PID:14420
- C:\Windows\System\uDssCIn.exe
  C:\Windows\System\uDssCIn.exe
  2⤵
  PID:14440
- C:\Windows\System\ADcqesr.exe
  C:\Windows\System\ADcqesr.exe
  2⤵
  PID:14456
- C:\Windows\System\WkZYtHK.exe
  C:\Windows\System\WkZYtHK.exe
  2⤵
  PID:14476
- C:\Windows\System\hzPsfkF.exe
  C:\Windows\System\hzPsfkF.exe
  2⤵
  PID:14636
- C:\Windows\System\jGSPEun.exe
  C:\Windows\System\jGSPEun.exe
  2⤵
  PID:14652
- C:\Windows\System\DZYMfQS.exe
  C:\Windows\System\DZYMfQS.exe
  2⤵
  PID:14856
- C:\Windows\System\qXNZLkH.exe
  C:\Windows\System\qXNZLkH.exe
  2⤵
  PID:14892
- C:\Windows\System\dkeOLKI.exe
  C:\Windows\System\dkeOLKI.exe
  2⤵
  PID:14920
- C:\Windows\System\WATWHxK.exe
  C:\Windows\System\WATWHxK.exe
  2⤵
  PID:14944
- C:\Windows\System\EcMXIUn.exe
  C:\Windows\System\EcMXIUn.exe
  2⤵
  PID:14964
- C:\Windows\System\aXuCieC.exe
  C:\Windows\System\aXuCieC.exe
  2⤵
  PID:14988
- C:\Windows\System\aYHFcAA.exe
  C:\Windows\System\aYHFcAA.exe
  2⤵
  PID:15008
- C:\Windows\System\lZKsoOx.exe
  C:\Windows\System\lZKsoOx.exe
  2⤵
  PID:15028
- C:\Windows\System\NZwTfWm.exe
  C:\Windows\System\NZwTfWm.exe
  2⤵
  PID:15048
- C:\Windows\System\TAKzddn.exe
  C:\Windows\System\TAKzddn.exe
  2⤵
  PID:15072
- C:\Windows\System\fZjZadG.exe
  C:\Windows\System\fZjZadG.exe
  2⤵
  PID:15104
- C:\Windows\System\RcAyncl.exe
  C:\Windows\System\RcAyncl.exe
  2⤵
  PID:15124
- C:\Windows\System\QWKzOYn.exe
  C:\Windows\System\QWKzOYn.exe
  2⤵
  PID:15148
- C:\Windows\System\UXgHvLT.exe
  C:\Windows\System\UXgHvLT.exe
  2⤵
  PID:15176
- C:\Windows\System\LvidXhe.exe
  C:\Windows\System\LvidXhe.exe
  2⤵
  PID:15200
- C:\Windows\System\yagSGBS.exe
  C:\Windows\System\yagSGBS.exe
  2⤵
  PID:13812
- C:\Windows\System\LRYRJiO.exe
  C:\Windows\System\LRYRJiO.exe
  2⤵
  PID:10520
- C:\Windows\System\XSdyeIW.exe
  C:\Windows\System\XSdyeIW.exe
  2⤵
  PID:10596
- C:\Windows\System\wYqGoTQ.exe
  C:\Windows\System\wYqGoTQ.exe
  2⤵
  PID:5608
- C:\Windows\System\nADfWeq.exe
  C:\Windows\System\nADfWeq.exe
  2⤵
  PID:4616
- C:\Windows\System\LRkqIZx.exe
  C:\Windows\System\LRkqIZx.exe
  2⤵
  PID:3444
- C:\Windows\System\RDAGecm.exe
  C:\Windows\System\RDAGecm.exe
  2⤵
  PID:6724
- C:\Windows\System\DnLtYsF.exe
  C:\Windows\System\DnLtYsF.exe
  2⤵
  PID:14376
- C:\Windows\System\hhQcDJT.exe
  C:\Windows\System\hhQcDJT.exe
  2⤵
  PID:8076
- C:\Windows\System\umCcRPW.exe
  C:\Windows\System\umCcRPW.exe
  2⤵
  PID:5744
- C:\Windows\System\NXrfEch.exe
  C:\Windows\System\NXrfEch.exe
  2⤵
  PID:11012
- C:\Windows\System\wbXyzio.exe
  C:\Windows\System\wbXyzio.exe
  2⤵
  PID:13944
- C:\Windows\System\mOSHDDa.exe
  C:\Windows\System\mOSHDDa.exe
  2⤵
  PID:6636
- C:\Windows\System\RuMyORZ.exe
  C:\Windows\System\RuMyORZ.exe
  2⤵
  PID:6208
- C:\Windows\System\WEpmKxD.exe
  C:\Windows\System\WEpmKxD.exe
  2⤵
  PID:6744
- C:\Windows\System\aekRQcn.exe
  C:\Windows\System\aekRQcn.exe
  2⤵
  PID:7072
- C:\Windows\System\qsJfmWH.exe
  C:\Windows\System\qsJfmWH.exe
  2⤵
  PID:6248
- C:\Windows\System\UelEsUk.exe
  C:\Windows\System\UelEsUk.exe
  2⤵
  PID:7712
- C:\Windows\System\iRgHExj.exe
  C:\Windows\System\iRgHExj.exe
  2⤵
  PID:5084
- C:\Windows\System\MKndgnS.exe
  C:\Windows\System\MKndgnS.exe
  2⤵
  PID:5864
- C:\Windows\System\cRUXpeE.exe
  C:\Windows\System\cRUXpeE.exe
  2⤵
  PID:6664
- C:\Windows\System\FGjoVWV.exe
  C:\Windows\System\FGjoVWV.exe
  2⤵
  PID:14388
- C:\Windows\System\iopPFAG.exe
  C:\Windows\System\iopPFAG.exe
  2⤵
  PID:6824
- C:\Windows\System\jRqqXig.exe
  C:\Windows\System\jRqqXig.exe
  2⤵
  PID:14452
- C:\Windows\System\EjiGzRB.exe
  C:\Windows\System\EjiGzRB.exe
  2⤵
  PID:14664
- C:\Windows\System\vgbNTXh.exe
  C:\Windows\System\vgbNTXh.exe
  2⤵
  PID:7540
- C:\Windows\System\qIjNquu.exe
  C:\Windows\System\qIjNquu.exe
  2⤵
  PID:14532
- C:\Windows\System\sbyMmBc.exe
  C:\Windows\System\sbyMmBc.exe
  2⤵
  PID:5468
- C:\Windows\System\ipcCLdV.exe
  C:\Windows\System\ipcCLdV.exe
  2⤵
  PID:14720
- C:\Windows\System\RtXQflu.exe
  C:\Windows\System\RtXQflu.exe
  2⤵
  PID:7200
- C:\Windows\System\LeDHMcW.exe
  C:\Windows\System\LeDHMcW.exe
  2⤵
  PID:14372
- C:\Windows\System\KFxpvgN.exe
  C:\Windows\System\KFxpvgN.exe
  2⤵
  PID:7244
- C:\Windows\System\LIjRjyq.exe
  C:\Windows\System\LIjRjyq.exe
  2⤵
  PID:14612
- C:\Windows\System\RVQkBMN.exe
  C:\Windows\System\RVQkBMN.exe
  2⤵
  PID:10336
- C:\Windows\System\oZZiaNo.exe
  C:\Windows\System\oZZiaNo.exe
  2⤵
  PID:8116
- C:\Windows\System\lnuHQxO.exe
  C:\Windows\System\lnuHQxO.exe
  2⤵
  PID:7896
- C:\Windows\System\FiUcZFc.exe
  C:\Windows\System\FiUcZFc.exe
  2⤵
  PID:15164
- C:\Windows\System\RqyoXky.exe
  C:\Windows\System\RqyoXky.exe
  2⤵
  PID:15240
- C:\Windows\System\ioDDWnM.exe
  C:\Windows\System\ioDDWnM.exe
  2⤵
  PID:10892
- C:\Windows\System\AOPExxG.exe
  C:\Windows\System\AOPExxG.exe
  2⤵
  PID:15264
- C:\Windows\System\OfNTPHt.exe
  C:\Windows\System\OfNTPHt.exe
  2⤵
  PID:8108
- C:\Windows\System\BfabHji.exe
  C:\Windows\System\BfabHji.exe
  2⤵
  PID:15256
- C:\Windows\System\YNsyRof.exe
  C:\Windows\System\YNsyRof.exe
  2⤵
  PID:11508
- C:\Windows\System\PKgcJyK.exe
  C:\Windows\System\PKgcJyK.exe
  2⤵
  PID:6704
- C:\Windows\System\lLosBZa.exe
  C:\Windows\System\lLosBZa.exe
  2⤵
  PID:14880
- C:\Windows\System\unEqJLO.exe
  C:\Windows\System\unEqJLO.exe
  2⤵
  PID:10264
- C:\Windows\System\HzgfwTw.exe
  C:\Windows\System\HzgfwTw.exe
  2⤵
  PID:11900
- C:\Windows\System\coauLUc.exe
  C:\Windows\System\coauLUc.exe
  2⤵
  PID:8536
- C:\Windows\System\vzsRSLe.exe
  C:\Windows\System\vzsRSLe.exe
  2⤵
  PID:12220
- C:\Windows\System\idVqqfK.exe
  C:\Windows\System\idVqqfK.exe
  2⤵
  PID:10968
- C:\Windows\System\lpOGXmH.exe
  C:\Windows\System\lpOGXmH.exe
  2⤵
  PID:12264
- C:\Windows\System\SyAQbmY.exe
  C:\Windows\System\SyAQbmY.exe
  2⤵
  PID:10600
- C:\Windows\System\uxsgYGE.exe
  C:\Windows\System\uxsgYGE.exe
  2⤵
  PID:10644
- C:\Windows\System\bmeniDN.exe
  C:\Windows\System\bmeniDN.exe
  2⤵
  PID:11192
- C:\Windows\System\iLIOQeM.exe
  C:\Windows\System\iLIOQeM.exe
  2⤵
  PID:1168
- C:\Windows\System\SbEyjHr.exe
  C:\Windows\System\SbEyjHr.exe
  2⤵
  PID:2680
- C:\Windows\System\FRxcRNs.exe
  C:\Windows\System\FRxcRNs.exe
  2⤵
  PID:8096
- C:\Windows\System\jSonSjW.exe
  C:\Windows\System\jSonSjW.exe
  2⤵
  PID:14484
- C:\Windows\System\YrzFnzP.exe
  C:\Windows\System\YrzFnzP.exe
  2⤵
  PID:14728
- C:\Windows\System\rOnBdGr.exe
  C:\Windows\System\rOnBdGr.exe
  2⤵
  PID:8872
- C:\Windows\System\PWavEXO.exe
  C:\Windows\System\PWavEXO.exe
  2⤵
  PID:9052
- C:\Windows\System\erKEhvv.exe
  C:\Windows\System\erKEhvv.exe
  2⤵
  PID:8908
- C:\Windows\System\vwhPxwc.exe
  C:\Windows\System\vwhPxwc.exe
  2⤵
  PID:8048
- C:\Windows\System\EfOrWZJ.exe
  C:\Windows\System\EfOrWZJ.exe
  2⤵
  PID:8584
- C:\Windows\System\AVHfiTz.exe
  C:\Windows\System\AVHfiTz.exe
  2⤵
  PID:7576
- C:\Windows\System\CsVNjKC.exe
  C:\Windows\System\CsVNjKC.exe
  2⤵
  PID:14756
- C:\Windows\System\fApVTua.exe
  C:\Windows\System\fApVTua.exe
  2⤵
  PID:8948
- C:\Windows\System\aJgfgde.exe
  C:\Windows\System\aJgfgde.exe
  2⤵
  PID:8004
- C:\Windows\System\TReSrWf.exe
  C:\Windows\System\TReSrWf.exe
  2⤵
  PID:10980
- C:\Windows\System\NRwOXNE.exe
  C:\Windows\System\NRwOXNE.exe
  2⤵
  PID:9140
- C:\Windows\System\GRZpxTG.exe
  C:\Windows\System\GRZpxTG.exe
  2⤵
  PID:4604
- C:\Windows\System\aOavnGt.exe
  C:\Windows\System\aOavnGt.exe
  2⤵
  PID:7772
- C:\Windows\System\GEcLrKr.exe
  C:\Windows\System\GEcLrKr.exe
  2⤵
  PID:9080
- C:\Windows\System\ZSArnzq.exe
  C:\Windows\System\ZSArnzq.exe
  2⤵
  PID:14332
- C:\Windows\System\KpLrRfZ.exe
  C:\Windows\System\KpLrRfZ.exe
  2⤵
  PID:7572
- C:\Windows\System\wAFpdex.exe
  C:\Windows\System\wAFpdex.exe
  2⤵
  PID:11384
- C:\Windows\System\UmcrSlT.exe
  C:\Windows\System\UmcrSlT.exe
  2⤵
  PID:12016
- C:\Windows\System\XYDGnED.exe
  C:\Windows\System\XYDGnED.exe
  2⤵
  PID:11924
- C:\Windows\System\mkMPJDl.exe
  C:\Windows\System\mkMPJDl.exe
  2⤵
  PID:14588
- C:\Windows\System\IffBHPm.exe
  C:\Windows\System\IffBHPm.exe
  2⤵
  PID:9172
- C:\Windows\System\YgmqLEc.exe
  C:\Windows\System\YgmqLEc.exe
  2⤵
  PID:6772
- C:\Windows\System\EHTnqKt.exe
  C:\Windows\System\EHTnqKt.exe
  2⤵
  PID:9108
- C:\Windows\System\VdaYaPf.exe
  C:\Windows\System\VdaYaPf.exe
  2⤵
  PID:7524
- C:\Windows\System\ZAvRpSM.exe
  C:\Windows\System\ZAvRpSM.exe
  2⤵
  PID:9160
- C:\Windows\System\iNzvBUM.exe
  C:\Windows\System\iNzvBUM.exe
  2⤵
  PID:7472
- C:\Windows\System\RXRhVuq.exe
  C:\Windows\System\RXRhVuq.exe
  2⤵
  PID:15116
- C:\Windows\System\aAOolLi.exe
  C:\Windows\System\aAOolLi.exe
  2⤵
  PID:7796
- C:\Windows\System\hzDnToA.exe
  C:\Windows\System\hzDnToA.exe
  2⤵
  PID:7852
- C:\Windows\System\ErozlCK.exe
  C:\Windows\System\ErozlCK.exe
  2⤵
  PID:7768
- C:\Windows\System\AyApQUW.exe
  C:\Windows\System\AyApQUW.exe
  2⤵
  PID:8088
- C:\Windows\System\bxVKolX.exe
  C:\Windows\System\bxVKolX.exe
  2⤵
  PID:12384
- C:\Windows\System\xbdGiGV.exe
  C:\Windows\System\xbdGiGV.exe
  2⤵
  PID:12360
- C:\Windows\System\mqiPbSy.exe
  C:\Windows\System\mqiPbSy.exe
  2⤵
  PID:12404
- C:\Windows\System\gtdGRRS.exe
  C:\Windows\System\gtdGRRS.exe
  2⤵
  PID:7544
- C:\Windows\System\oJPMVFq.exe
  C:\Windows\System\oJPMVFq.exe
  2⤵
  PID:7700
- C:\Windows\System\HHhYWVw.exe
  C:\Windows\System\HHhYWVw.exe
  2⤵
  PID:15144
- C:\Windows\System\FenqMpv.exe
  C:\Windows\System\FenqMpv.exe
  2⤵
  PID:14752
- C:\Windows\System\eTpCqCa.exe
  C:\Windows\System\eTpCqCa.exe
  2⤵
  PID:7552
- C:\Windows\System\dQIZhXV.exe
  C:\Windows\System\dQIZhXV.exe
  2⤵
  PID:10872
- C:\Windows\System\qqQubdq.exe
  C:\Windows\System\qqQubdq.exe
  2⤵
  PID:12228
- C:\Windows\System\DxaMBQP.exe
  C:\Windows\System\DxaMBQP.exe
  2⤵
  PID:8144
- C:\Windows\System\LkBvRuE.exe
  C:\Windows\System\LkBvRuE.exe
  2⤵
  PID:9148
- C:\Windows\System\MWncchV.exe
  C:\Windows\System\MWncchV.exe
  2⤵
  PID:12552
- C:\Windows\System\UueHWFO.exe
  C:\Windows\System\UueHWFO.exe
  2⤵
  PID:15080
- C:\Windows\System\HSPERAQ.exe
  C:\Windows\System\HSPERAQ.exe
  2⤵
  PID:10944
- C:\Windows\System\CeYESgO.exe
  C:\Windows\System\CeYESgO.exe
  2⤵
  PID:8652
- C:\Windows\System\KOmjlwM.exe
  C:\Windows\System\KOmjlwM.exe
  2⤵
  PID:8212
- C:\Windows\System\HWRzBGc.exe
  C:\Windows\System\HWRzBGc.exe
  2⤵
  PID:13092
- C:\Windows\System\PwcsGOW.exe
  C:\Windows\System\PwcsGOW.exe
  2⤵
  PID:13120
- C:\Windows\System\clIYJdA.exe
  C:\Windows\System\clIYJdA.exe
  2⤵
  PID:13080
- C:\Windows\System\ruWpuFq.exe
  C:\Windows\System\ruWpuFq.exe
  2⤵
  PID:6808
- C:\Windows\System\wsBZZZb.exe
  C:\Windows\System\wsBZZZb.exe
  2⤵
  PID:8608
- C:\Windows\System\rAuHdKw.exe
  C:\Windows\System\rAuHdKw.exe
  2⤵
  PID:10124
- C:\Windows\System\pNEPkqS.exe
  C:\Windows\System\pNEPkqS.exe
  2⤵
  PID:10172
- C:\Windows\System\duCzuHW.exe
  C:\Windows\System\duCzuHW.exe
  2⤵
  PID:9464
- C:\Windows\System\PMxPHNl.exe
  C:\Windows\System\PMxPHNl.exe
  2⤵
  PID:3136
- C:\Windows\System\hnurzSq.exe
  C:\Windows\System\hnurzSq.exe
  2⤵
  PID:3448
- C:\Windows\System\XMkkUgr.exe
  C:\Windows\System\XMkkUgr.exe
  2⤵
  PID:9256
- C:\Windows\System\dfnsGTy.exe
  C:\Windows\System\dfnsGTy.exe
  2⤵
  PID:9724
- C:\Windows\System\WqEDviq.exe
  C:\Windows\System\WqEDviq.exe
  2⤵
  PID:2416
- C:\Windows\System\lFNQcft.exe
  C:\Windows\System\lFNQcft.exe
  2⤵
  PID:9720
- C:\Windows\System\IkfcYtk.exe
  C:\Windows\System\IkfcYtk.exe
  2⤵
  PID:14972
- C:\Windows\System\iVIwpdO.exe
  C:\Windows\System\iVIwpdO.exe
  2⤵
  PID:11260
- C:\Windows\System\VoGpNhG.exe
  C:\Windows\System\VoGpNhG.exe
  2⤵
  PID:8200
- C:\Windows\System\khRpWQD.exe
  C:\Windows\System\khRpWQD.exe
  2⤵
  PID:8228
- C:\Windows\System\RIfMEsg.exe
  C:\Windows\System\RIfMEsg.exe
  2⤵
  PID:7840
- C:\Windows\System\uhVwUmX.exe
  C:\Windows\System\uhVwUmX.exe
  2⤵
  PID:10028
- C:\Windows\System\pTjEIhA.exe
  C:\Windows\System\pTjEIhA.exe
  2⤵
  PID:11364
- C:\Windows\System\SlHblOu.exe
  C:\Windows\System\SlHblOu.exe
  2⤵
  PID:11860
- C:\Windows\System\wfIYLkQ.exe
  C:\Windows\System\wfIYLkQ.exe
  2⤵
  PID:1152
- C:\Windows\System\MwSgSBg.exe
  C:\Windows\System\MwSgSBg.exe
  2⤵
  PID:732
- C:\Windows\System\iWgkFkd.exe
  C:\Windows\System\iWgkFkd.exe
  2⤵
  PID:13016
- C:\Windows\System\wVXTaIG.exe
  C:\Windows\System\wVXTaIG.exe
  2⤵
  PID:7568
- C:\Windows\System\cEVQAQB.exe
  C:\Windows\System\cEVQAQB.exe
  2⤵
  PID:7436
- C:\Windows\System\uhUTeQr.exe
  C:\Windows\System\uhUTeQr.exe
  2⤵
  PID:9976
- C:\Windows\System\YcJYLap.exe
  C:\Windows\System\YcJYLap.exe
  2⤵
  PID:10940
- C:\Windows\System\yuquRQf.exe
  C:\Windows\System\yuquRQf.exe
  2⤵
  PID:2264
- C:\Windows\System\gDqJpXp.exe
  C:\Windows\System\gDqJpXp.exe
  2⤵
  PID:9528
- C:\Windows\System\hjrIuZI.exe
  C:\Windows\System\hjrIuZI.exe
  2⤵
  PID:10252
- C:\Windows\System\WpdAZpO.exe
  C:\Windows\System\WpdAZpO.exe
  2⤵
  PID:8644
- C:\Windows\System\GioNYAI.exe
  C:\Windows\System\GioNYAI.exe
  2⤵
  PID:6740
- C:\Windows\System\YuqWXyF.exe
  C:\Windows\System\YuqWXyF.exe
  2⤵
  PID:9088
- C:\Windows\System\uaOojiD.exe
  C:\Windows\System\uaOojiD.exe
  2⤵
  PID:9772
- C:\Windows\System\oooIutL.exe
  C:\Windows\System\oooIutL.exe
  2⤵
  PID:1072
- C:\Windows\System\JVBofFh.exe
  C:\Windows\System\JVBofFh.exe
  2⤵
  PID:10204
- C:\Windows\System\jbiaNCK.exe
  C:\Windows\System\jbiaNCK.exe
  2⤵
  PID:6212
- C:\Windows\System\hlKDRQK.exe
  C:\Windows\System\hlKDRQK.exe
  2⤵
  PID:5420
- C:\Windows\System\jWpCdKD.exe
  C:\Windows\System\jWpCdKD.exe
  2⤵
  PID:8784
- C:\Windows\System\XxwmyLN.exe
  C:\Windows\System\XxwmyLN.exe
  2⤵
  PID:13764
- C:\Windows\System\uuklGtk.exe
  C:\Windows\System\uuklGtk.exe
  2⤵
  PID:13828
- C:\Windows\System\HivbqTM.exe
  C:\Windows\System\HivbqTM.exe
  2⤵
  PID:12636
- C:\Windows\System\oICOLXr.exe
  C:\Windows\System\oICOLXr.exe
  2⤵
  PID:15304
- C:\Windows\System\jqYljwg.exe
  C:\Windows\System\jqYljwg.exe
  2⤵
  PID:9120
- C:\Windows\System\PmVOxNM.exe
  C:\Windows\System\PmVOxNM.exe
  2⤵
  PID:7384
- C:\Windows\System\FsQfQgl.exe
  C:\Windows\System\FsQfQgl.exe
  2⤵
  PID:14500
- C:\Windows\System\MTXmazc.exe
  C:\Windows\System\MTXmazc.exe
  2⤵
  PID:5436
- C:\Windows\System\MieYlYl.exe
  C:\Windows\System\MieYlYl.exe
  2⤵
  PID:14448
- C:\Windows\System\GVVEUJI.exe
  C:\Windows\System\GVVEUJI.exe
  2⤵
  PID:9100
- C:\Windows\System\kSoLZQP.exe
  C:\Windows\System\kSoLZQP.exe
  2⤵
  PID:9520
- C:\Windows\System\VrgdWzZ.exe
  C:\Windows\System\VrgdWzZ.exe
  2⤵
  PID:9388
- C:\Windows\System\QzbGoSs.exe
  C:\Windows\System\QzbGoSs.exe
  2⤵
  PID:6396
- C:\Windows\System\Eesrrhd.exe
  C:\Windows\System\Eesrrhd.exe
  2⤵
  PID:13956
- C:\Windows\System\lzpSrbT.exe
  C:\Windows\System\lzpSrbT.exe
  2⤵
  PID:3552
- C:\Windows\System\uHlBRoC.exe
  C:\Windows\System\uHlBRoC.exe
  2⤵
  PID:12492
- C:\Windows\System\WqFBfVl.exe
  C:\Windows\System\WqFBfVl.exe
  2⤵
  PID:11064
- C:\Windows\System\stQQYbI.exe
  C:\Windows\System\stQQYbI.exe
  2⤵
  PID:12820
- C:\Windows\System\lJpOPpt.exe
  C:\Windows\System\lJpOPpt.exe
  2⤵
  PID:9064
- C:\Windows\System\dkUWWAW.exe
  C:\Windows\System\dkUWWAW.exe
  2⤵
  PID:10392
- C:\Windows\System\GTIkPyR.exe
  C:\Windows\System\GTIkPyR.exe
  2⤵
  PID:9816
- C:\Windows\System\jIgCfvx.exe
  C:\Windows\System\jIgCfvx.exe
  2⤵
  PID:10416
- C:\Windows\System\uxaQpje.exe
  C:\Windows\System\uxaQpje.exe
  2⤵
  PID:10076
- C:\Windows\System\GFHaUhV.exe
  C:\Windows\System\GFHaUhV.exe
  2⤵
  PID:10288
- C:\Windows\System\xcQJQVx.exe
  C:\Windows\System\xcQJQVx.exe
  2⤵
  PID:11068
- C:\Windows\System\ZlnmNKq.exe
  C:\Windows\System\ZlnmNKq.exe
  2⤵
  PID:10220
- C:\Windows\System\fcsslhq.exe
  C:\Windows\System\fcsslhq.exe
  2⤵
  PID:10324
- C:\Windows\System\deQzPIf.exe
  C:\Windows\System\deQzPIf.exe
  2⤵
  PID:10412
- C:\Windows\System\KPWsPdH.exe
  C:\Windows\System\KPWsPdH.exe
  2⤵
  PID:8168
- C:\Windows\System\VhEklWt.exe
  C:\Windows\System\VhEklWt.exe
  2⤵
  PID:10244
- C:\Windows\System\sdxYynl.exe
  C:\Windows\System\sdxYynl.exe
  2⤵
  PID:12236
- C:\Windows\System\guvCUWl.exe
  C:\Windows\System\guvCUWl.exe
  2⤵
  PID:13896
- C:\Windows\System\UNynvvj.exe
  C:\Windows\System\UNynvvj.exe
  2⤵
  PID:11196
- C:\Windows\System\tLoMrKz.exe
  C:\Windows\System\tLoMrKz.exe
  2⤵
  PID:14200
- C:\Windows\System\MkrfKSP.exe
  C:\Windows\System\MkrfKSP.exe
  2⤵
  PID:14280
- C:\Windows\System\AebrbUW.exe
  C:\Windows\System\AebrbUW.exe
  2⤵
  PID:12776
- C:\Windows\System\aHZIbxz.exe
  C:\Windows\System\aHZIbxz.exe
  2⤵
  PID:8864
- C:\Windows\System\pnrhfsW.exe
  C:\Windows\System\pnrhfsW.exe
  2⤵
  PID:10104
- C:\Windows\System\NBVZuPC.exe
  C:\Windows\System\NBVZuPC.exe
  2⤵
  PID:11432
- C:\Windows\System\CJvxgtE.exe
  C:\Windows\System\CJvxgtE.exe
  2⤵
  PID:10424
- C:\Windows\System\BUhMSHU.exe
  C:\Windows\System\BUhMSHU.exe
  2⤵
  PID:9828
- C:\Windows\System\uHqTvoa.exe
  C:\Windows\System\uHqTvoa.exe
  2⤵
  PID:5664
- C:\Windows\System\BejFhVh.exe
  C:\Windows\System\BejFhVh.exe
  2⤵
  PID:12316
- C:\Windows\System\sUIZyxg.exe
  C:\Windows\System\sUIZyxg.exe
  2⤵
  PID:12680
- C:\Windows\System\ibVHPtC.exe
  C:\Windows\System\ibVHPtC.exe
  2⤵
  PID:9668
- C:\Windows\System\vOjbxIo.exe
  C:\Windows\System\vOjbxIo.exe
  2⤵
  PID:14428
- C:\Windows\System\DxGuYYX.exe
  C:\Windows\System\DxGuYYX.exe
  2⤵
  PID:14516
- C:\Windows\System\TvGKEJD.exe
  C:\Windows\System\TvGKEJD.exe
  2⤵
  PID:12740
- C:\Windows\System\pxQEfEs.exe
  C:\Windows\System\pxQEfEs.exe
  2⤵
  PID:7884
- C:\Windows\System\mheBVXz.exe
  C:\Windows\System\mheBVXz.exe
  2⤵
  PID:7156
- C:\Windows\System\VBktIjf.exe
  C:\Windows\System\VBktIjf.exe
  2⤵
  PID:11628
- C:\Windows\System\Flrowhq.exe
  C:\Windows\System\Flrowhq.exe
  2⤵
  PID:9448
- C:\Windows\System\hGamHdZ.exe
  C:\Windows\System\hGamHdZ.exe
  2⤵
  PID:9812
- C:\Windows\System\rvYwNhU.exe
  C:\Windows\System\rvYwNhU.exe
  2⤵
  PID:9996
- C:\Windows\System\uPZzoKh.exe
  C:\Windows\System\uPZzoKh.exe
  2⤵
  PID:9328
- C:\Windows\System\rGGbeSb.exe
  C:\Windows\System\rGGbeSb.exe
  2⤵
  PID:11996
- C:\Windows\System\VihIPcV.exe
  C:\Windows\System\VihIPcV.exe
  2⤵
  PID:8820
- C:\Windows\System\LxZUfnY.exe
  C:\Windows\System\LxZUfnY.exe
  2⤵
  PID:4376
- C:\Windows\System\qolxoDh.exe
  C:\Windows\System\qolxoDh.exe
  2⤵
  PID:11228
- C:\Windows\System\ayEVqHa.exe
  C:\Windows\System\ayEVqHa.exe
  2⤵
  PID:11664
- C:\Windows\System\tpXIkyj.exe
  C:\Windows\System\tpXIkyj.exe
  2⤵
  PID:14876
- C:\Windows\System\OnHtjrC.exe
  C:\Windows\System\OnHtjrC.exe
  2⤵
  PID:11556
- C:\Windows\System\azZRxAv.exe
  C:\Windows\System\azZRxAv.exe
  2⤵
  PID:15336
- C:\Windows\System\UAPEEkd.exe
  C:\Windows\System\UAPEEkd.exe
  2⤵
  PID:11476
- C:\Windows\System\EUezZzy.exe
  C:\Windows\System\EUezZzy.exe
  2⤵
  PID:11188
- C:\Windows\System\treFHhK.exe
  C:\Windows\System\treFHhK.exe
  2⤵
  PID:10620
- C:\Windows\System\RsVShsw.exe
  C:\Windows\System\RsVShsw.exe
  2⤵
  PID:10312
- C:\Windows\System\NzFrrdc.exe
  C:\Windows\System\NzFrrdc.exe
  2⤵
  PID:11072
- C:\Windows\System\Qzopquy.exe
  C:\Windows\System\Qzopquy.exe
  2⤵
  PID:10368
- C:\Windows\System\GWgrjLq.exe
  C:\Windows\System\GWgrjLq.exe
  2⤵
  PID:9856
- C:\Windows\System\yZqwIUP.exe
  C:\Windows\System\yZqwIUP.exe
  2⤵
  PID:14244
- C:\Windows\System\spmmAzN.exe
  C:\Windows\System\spmmAzN.exe
  2⤵
  PID:10132
- C:\Windows\System\pMyFiAo.exe
  C:\Windows\System\pMyFiAo.exe
  2⤵
  PID:11748
- C:\Windows\System\uqoAfyf.exe
  C:\Windows\System\uqoAfyf.exe
  2⤵
  PID:11700
- C:\Windows\System\PWuKrwr.exe
  C:\Windows\System\PWuKrwr.exe
  2⤵
  PID:10492
- C:\Windows\System\xpytmIw.exe
  C:\Windows\System\xpytmIw.exe
  2⤵
  PID:9432
- C:\Windows\System\FGPZpnL.exe
  C:\Windows\System\FGPZpnL.exe
  2⤵
  PID:11720
- C:\Windows\System\TkYUiNk.exe
  C:\Windows\System\TkYUiNk.exe
  2⤵
  PID:9560
- C:\Windows\System\fnUVWyL.exe
  C:\Windows\System\fnUVWyL.exe
  2⤵
  PID:9984
- C:\Windows\System\TTHdNSa.exe
  C:\Windows\System\TTHdNSa.exe
  2⤵
  PID:12616
- C:\Windows\System\lIVzDse.exe
  C:\Windows\System\lIVzDse.exe
  2⤵
  PID:9876
- C:\Windows\System\OnahrIY.exe
  C:\Windows\System\OnahrIY.exe
  2⤵
  PID:12480
- C:\Windows\System\rbIYtPV.exe
  C:\Windows\System\rbIYtPV.exe
  2⤵
  PID:9592
- C:\Windows\System\UXWrLEE.exe
  C:\Windows\System\UXWrLEE.exe
  2⤵
  PID:6580
- C:\Windows\System\fyAaZKX.exe
  C:\Windows\System\fyAaZKX.exe
  2⤵
  PID:7744
- C:\Windows\System\sPRVagP.exe
  C:\Windows\System\sPRVagP.exe
  2⤵
  PID:9504
- C:\Windows\System\QZOCMOx.exe
  C:\Windows\System\QZOCMOx.exe
  2⤵
  PID:15220
- C:\Windows\System\CMSxcAF.exe
  C:\Windows\System\CMSxcAF.exe
  2⤵
  PID:6416
- C:\Windows\System\MnaKBqz.exe
  C:\Windows\System\MnaKBqz.exe
  2⤵
  PID:12412
- C:\Windows\System\rTlJFYG.exe
  C:\Windows\System\rTlJFYG.exe
  2⤵
  PID:12568
- C:\Windows\System\bVYADXm.exe
  C:\Windows\System\bVYADXm.exe
  2⤵
  PID:12512
- C:\Windows\System\ElRAJgo.exe
  C:\Windows\System\ElRAJgo.exe
  2⤵
  PID:12536
- C:\Windows\System\XTunyQE.exe
  C:\Windows\System\XTunyQE.exe
  2⤵
  PID:10712
- C:\Windows\System\sIeBrwf.exe
  C:\Windows\System\sIeBrwf.exe
  2⤵
  PID:432
- C:\Windows\System\YScnpzm.exe
  C:\Windows\System\YScnpzm.exe
  2⤵
  PID:11336
- C:\Windows\System\SvuqsVh.exe
  C:\Windows\System\SvuqsVh.exe
  2⤵
  PID:15372
- C:\Windows\System\XiiMOiT.exe
  C:\Windows\System\XiiMOiT.exe
  2⤵
  PID:15392
- C:\Windows\System\hlwHeyE.exe
  C:\Windows\System\hlwHeyE.exe
  2⤵
  PID:15416
- C:\Windows\System\oYoWMKv.exe
  C:\Windows\System\oYoWMKv.exe
  2⤵
  PID:15440
- C:\Windows\System\joZSmyb.exe
  C:\Windows\System\joZSmyb.exe
  2⤵
  PID:15460
- C:\Windows\System\WSkWaXW.exe
  C:\Windows\System\WSkWaXW.exe
  2⤵
  PID:15488
- C:\Windows\System\eFIblxT.exe
  C:\Windows\System\eFIblxT.exe
  2⤵
  PID:15508
- C:\Windows\System\zTYsocg.exe
  C:\Windows\System\zTYsocg.exe
  2⤵
  PID:15532
- C:\Windows\System\kxAqKvJ.exe
  C:\Windows\System\kxAqKvJ.exe
  2⤵
  PID:15556
- C:\Windows\System\XWmbUHo.exe
  C:\Windows\System\XWmbUHo.exe
  2⤵
  PID:15580
- C:\Windows\System\pjdBStR.exe
  C:\Windows\System\pjdBStR.exe
  2⤵
  PID:15608
- C:\Windows\System\ZjKroXj.exe
  C:\Windows\System\ZjKroXj.exe
  2⤵
  PID:15852
- C:\Windows\System\huDUkEu.exe
  C:\Windows\System\huDUkEu.exe
  2⤵
  PID:15876
- C:\Windows\System\xPuJePj.exe
  C:\Windows\System\xPuJePj.exe
  2⤵
  PID:15904
- C:\Windows\System\RowzZBw.exe
  C:\Windows\System\RowzZBw.exe
  2⤵
  PID:15920
- C:\Windows\System\kwBbPXD.exe
  C:\Windows\System\kwBbPXD.exe
  2⤵
  PID:15936
- C:\Windows\System\fksoxXM.exe
  C:\Windows\System\fksoxXM.exe
  2⤵
  PID:15956
- C:\Windows\System\WgXiylp.exe
  C:\Windows\System\WgXiylp.exe
  2⤵
  PID:15980
- C:\Windows\System\FYpsCem.exe
  C:\Windows\System\FYpsCem.exe
  2⤵
  PID:16004
- C:\Windows\System\VhVjNMy.exe
  C:\Windows\System\VhVjNMy.exe
  2⤵
  PID:16028
- C:\Windows\System\bvkGREQ.exe
  C:\Windows\System\bvkGREQ.exe
  2⤵
  PID:16048
- C:\Windows\System\hQqSZqn.exe
  C:\Windows\System\hQqSZqn.exe
  2⤵
  PID:16080
- C:\Windows\System\KvDLzse.exe
  C:\Windows\System\KvDLzse.exe
  2⤵
  PID:16104
- C:\Windows\System\BASlWTa.exe
  C:\Windows\System\BASlWTa.exe
  2⤵
  PID:16128
- C:\Windows\System\VqMXmUT.exe
  C:\Windows\System\VqMXmUT.exe
  2⤵
  PID:16148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c2ss0nwb.whb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AsvKhcg.exe

Filesize
2.2MB

MD5
d4553cfbe090216dc944cc83601f4821

SHA1
fb891e82e2ff431cf74bcb3cd090667bea732d05

SHA256
9aefbbf8d6d837756773249086cec4d20a44809323175b6f6f92792ab364ca65

SHA512
7454f0f2dc2e49bd77d51ef98afabf932df0e228b0943ad93c650b91fe823be248f18094fb270c184a5bb6892e7063efd9d3c2708a225206437c2ad17d9c9eeb

Download Submit
C:\Windows\System\EdeckPK.exe

Filesize
2.2MB

MD5
aa5c64a6a8b12e081aa7d399496ff78c

SHA1
29e7514952ea9f2cd3187ecff70dedfa4bc127ab

SHA256
8b7a53e718b9bd5baeaad0890232f58fea26d6104187d9be2c88ae6b141c2edc

SHA512
5b49a221eb25e6e79959a905d93fff2c86b835b211e65a72a4386599eedb6162d40b997ce561d06a7e5cb3c116c3e5cc7c211b389c8c62d7a737282c474b36d7

Download Submit
C:\Windows\System\FGVOjsh.exe

Filesize
2.2MB

MD5
b2f7a6fd954cb85182a5852612487776

SHA1
1feb483874d3c55d889cb71c0432421af4c145b1

SHA256
ee0058df6b1b8d956fa380b961d957aa26e300c2b822a0d2f152dc45d16075fd

SHA512
99003b2f00ed4c8e74364b2868bf00e15cf4f89ffeebe352287b052158868ab3a9e2cc4f5e234501585f2fe6f1a5a28a4f204a26bee1c7775a32a0f8cf486216

Download Submit
C:\Windows\System\GlkMLKa.exe

Filesize
2.2MB

MD5
87cbb7ce42f8907fcdb7507b6b4fc31a

SHA1
aebb9cf0d32a84b67feb6bf698b9dd7725b8a890

SHA256
767d85a6c34c4fe386c87119a2dc78cc20a8ce0f11abc716a9118db87296217d

SHA512
97841584f9b0cd39ca96387f7168616730407c5bd1fffed7da6e5e47ecde2ad73632dd91fe127eb2d4fd9b4e50a92074a9ae4079093fe598a71312d79348ef8f

Download Submit
C:\Windows\System\GmYbbtu.exe

Filesize
2.2MB

MD5
e6dabb68adab18a297a402ced3f88afc

SHA1
f4b9ad701ca28cb2c7d3b3d04c528d0efce15ddf

SHA256
82afb27560a4b41adddd4e7efdada7aa22df67dcec8f30b654f35a599ccdd595

SHA512
271ddd2cec20036e9b1faf476bdf1520d86f74ea978c65cd86cc4395a651b008e0adbbb64ae80dec4883d0a25b11cf4b76960ab13d5e70a06a54dfa6bc0748be

Download Submit
C:\Windows\System\JxIbIbd.exe

Filesize
2.2MB

MD5
1cfecb6e4a312cadd75be20867deef8c

SHA1
eea2e520a405d1ba0fe5a51781e6477b3d2c44b7

SHA256
85a6c0ec9c4a086e84c619962eba6d0b7ee6a33c22c99d95af2dcae29823badb

SHA512
2c372363f7f92f8604226ae2eefd6fe67dc4b2678cce508f2c7b6b38eba7fb105be93f04d704aa2793e885d2fe6c4367c7d26af1201350a676635f1c4b6cc1b5

Download Submit
C:\Windows\System\KISpuVG.exe

Filesize
2.2MB

MD5
6772a057b420369a0725210efdcf56ec

SHA1
cabd0f8b4c67c99aec49e36c2e58ec85d23ec042

SHA256
5f505f780b5741cd30cb083072a041db336cfffaaa6716fe4b781f7ac57babc4

SHA512
6d3d16584c02e88dddcbb503f3c2e7bf64ece3a7f47f90195cda58b6748fb2a5903c08a911d4b9e85117c1651037dfd2190a5d59416b89b1455e1593be5b6191

Download Submit
C:\Windows\System\LNYcpQa.exe

Filesize
2.2MB

MD5
77bb88d84fc1652ea5828dd89891d5c5

SHA1
eae8608ffbf8a5a50ee6fbb5d377490d1578ab3f

SHA256
9b846a26d3699af81b3373ee4bce6423e92d4e7fcbe334b7ce8fe47c19d4c4d7

SHA512
b94c4df6ca499e561074e2d563dd033978d118434cdd6355b2004419e5ba150194be40c118e63c0c3fe4e330e035f33c034df5a83807a2c776d86e05f208d842

Download Submit
C:\Windows\System\LNicytb.exe

Filesize
2.2MB

MD5
cd3c262cbe348915ec5c7155d74bc65a

SHA1
b7e87f0a2927a18d63789121690bbaa9e0513d71

SHA256
45695bc43ff730d4fbf3737a05930fd767f87307304877e0ef520fcc4246398c

SHA512
88cf52a36d3cde58343acc519d2b7bb8c03c075bef600fbc5f1042ca238a2881fc1ea09b73ca2a2eb033a141ac227a81f893724c16930e7ef87d1b8ca0a590b2

Download Submit
C:\Windows\System\OyUXhti.exe

Filesize
2.2MB

MD5
608ccff9b4cb70b7052642cf29711e5a

SHA1
88639ef086f4ede5801c598057cbf1ffb036a947

SHA256
c3a843e219f705288873b4c2166ac85b18e773c818932d22d68c9d80c9d274ef

SHA512
faea5a49ac26fb7f5369061fbfa90c385891ec7508f9e8af75ff2817b7f07974cd72506e0459a4b8d6f3db1848e4b3e9cbabe324c24b24022f9ef5bbb920c689

Download Submit
C:\Windows\System\SvTOgCY.exe

Filesize
2.2MB

MD5
98ba969cc37631e79ca727f4ba26cc83

SHA1
896b32d3d1db3f47ddaa3cbc30fa64c84e40f1ad

SHA256
1b619afc2aca71bcf7b12d929e27e7f2b390e04439f46412ebe8af349857202d

SHA512
4d83b75029b419f367607ef366cb1b0f1dbca4dcd697b5d7353ad06e0bd327ea459e60671bdbc2b774e255e597aecdced3961f863af4d3843a937acee7fbc569

Download Submit
C:\Windows\System\TPIbzti.exe

Filesize
2.2MB

MD5
69d081d4a325a0fd508e452fcc180875

SHA1
bfff0b5611db41f73bc0fda3a595d2b86f70e1a5

SHA256
2cfea46f1da2af2acb4d00a71f35e7212bc90c89cac7472ccb4528f91afde584

SHA512
f421dba6fd826f548e3e6dc06577bf7b8a56aa6b9db4a075be4ae3a006391003d76398fc518a8b242d4500efdd5189198c67509bfaf42807d0f606dcec01c259

Download Submit
C:\Windows\System\UPKXZQx.exe

Filesize
2.2MB

MD5
3e213c1642e1824e1b059d0e6cb7e85c

SHA1
c803573d319096650b1bccdd3a42010bec78e613

SHA256
ac15fab61276c4a474230cef4653dfcbc9a93e3dd79da326a47e219f8cec42fa

SHA512
575cf6b3e3b82abfbc031f8e22ee6c89494a6446ce051bf1d06bfcbdb93e9ce2e6900ed38ad9ae53e48ab8c0030c4cbf0b76f114c9d3f6b1378195f4bdfb43ed

Download Submit
C:\Windows\System\WOhBZSs.exe

Filesize
2.2MB

MD5
4005c7c21e78e5eab8b468a0d8bef774

SHA1
3b3c8c84c03ea81f658ed99b00036aa21a7ab2e5

SHA256
23d4f788fe46946333a3a1f2316357f4ab54a6b740147b3c81cafa63c8ca1c2e

SHA512
47b6a732b06a09c0a6068d2c7f005f0ba8fcacb82f690504837011d8857e714f350eba1ff836934c2f91df5f23e76202a7c0065d30a8bd3d4496d61ff5817e3a

Download Submit
C:\Windows\System\WlzoOhN.exe

Filesize
2.2MB

MD5
8616f9de31c80a9fef462c2416263d8f

SHA1
6fd3f34912141b04234c274e3cc82f09fd608e51

SHA256
a61eeea2826eb15b42c9f03979e19abaa2805bcbf6308b16328cf6174fb1e084

SHA512
7d52e6fa9d49e7c3f83bb1eee608869bc28aa9ed4a17726f2b2421555ed72441dd457a1f74e8a58f5e455c6e5eb9781f7b31e741c7d55e995bd7c399fdf3c11f

Download Submit
C:\Windows\System\XqxYvai.exe

Filesize
2.2MB

MD5
aef8ceed1a4e07ac2b0dd00331da2af1

SHA1
75ad975f9d4c58441d1737bf113d66211d916847

SHA256
f6d77ef2f4f8d292cb645731f54282bfc7a459400b70589472c1fa9a3565f66f

SHA512
215d732eb69acc28fbd47c8c048faf86b0aa89b95033e32a4a8c348eb3103385c7ab75bc1235198fea3a96ef2d0c889b01997f71bf76adc9e9e193801d410f92

Download Submit
C:\Windows\System\aACfpJt.exe

Filesize
2.2MB

MD5
92e5d67d7f60f85dc4c0824943a20daf

SHA1
1f26cb7573b73da1ce815e79ca88a7a824589dde

SHA256
994eff0eb22ab05b50768f534f283f3b2a5c0c2c542e24ff963f27c117d5468d

SHA512
f624521027d6bd8b4f7daadab17e582f839f0f171fce27ec39a4b217287fad204f20daa742d99df2a6d7ea8f234a076986a6a23dae49724ac0bc085b00c6ceff

Download Submit
C:\Windows\System\bjYRfsy.exe

Filesize
2.2MB

MD5
303be163fca195f60e74e1dfd63447d5

SHA1
0c862bbd21da9f708ee83447e21522b30261c689

SHA256
09311ca07cff94345ab91d28da7672657f4565ca5d94a142317fe7ff4601cca0

SHA512
28f31f9cf231fbf3aeac82f2192ffbdca3eab7323fc8cfc0df270b4b37e2859105e103ffda71765e0d93f0f3cb1cc0b24f20cc04100ca95c62dc64aeb0d22f39

Download Submit
C:\Windows\System\cEfQzyb.exe

Filesize
2.2MB

MD5
d339dd2cf8d57b0bab16720ad06e5e83

SHA1
ad96385ec9ba0733ee32332149dfc50735b976b1

SHA256
29ab6ea2df244bbc961c738198a15ddc9528185048624d6d7f9d09d6c2ced755

SHA512
8f02004780f82a1ff002cc4903f2121fb8d016fdc463d0314522b5071f5319f049b3746abac0e15db293978b21aa16b6ff02a5d592123083972bdf6862275824

Download Submit
C:\Windows\System\fKzxIjX.exe

Filesize
2.2MB

MD5
d92366881995672816ff821f3bc4f7f3

SHA1
24cfe55f9c13becdbb2df19319cbb332545e6d03

SHA256
72c2b5815a4f3e1d517c4ea9b5e7341ef078b0e1227db71c500c4abe65907509

SHA512
912e08043e87472fe576c592f974d365762a78f9bc9355d462e6187e9dd6c25e58b75074d893f681ea793194cb99775c4411c9a666165c53998973c332299b36

Download Submit
C:\Windows\System\hOLTwLq.exe

Filesize
2.2MB

MD5
2291930680e185a501608bca6458bca0

SHA1
fb7e43fb6a8f406eaa7e3eb5e6da9869ae6cf338

SHA256
783bea81d6e714246b89d30c37f8ce3015b1cac713aa31520f1c10dec26909b5

SHA512
67d46b3651ae2922a897a7e77324a76ddf8c31531115bbf2a461462e0b206530698e1ed3dd8a4dd3900d3dd5fca2662cac290942823aeabebeac22c1d4f054df

Download Submit
C:\Windows\System\iDPTeBl.exe

Filesize
2.2MB

MD5
9479f0dc5e0a3206f491642ceccef59d

SHA1
8e9dfae78cabe3e85e9d96b07578b72d8079503f

SHA256
326a1c5812a07b107be09c08d5fd8a4ffdc29db30343a8774568be6fd77f3d6f

SHA512
74608c3c7b9b8523bc83f2914bbeccf4229129f08ab3b3c0be28d6dd1b56b7ce7adaf3556dc0314634ab92ffc1c53796c06fe82312cfd30079ed9b7958b7f409

Download Submit
C:\Windows\System\kGmDqqn.exe

Filesize
2.2MB

MD5
8d542042f12cf7b0c190f251e4d0ee69

SHA1
2471e33413b341bd0ae6ce389647d23c703489a6

SHA256
44fa51ac9bceaf943f77a82f526ef8e273b3222a036acf11b336e9e4bb5ca7d9

SHA512
90afd595a3f57899064f12bbed705902ae9c8252c5f344386830d74bb903292abf8a0e41997ecb36f179392ed8759afdc27e8aae6e8de8c44b52d23ebc7d2c93

Download Submit
C:\Windows\System\lveBTel.exe

Filesize
2.2MB

MD5
98de82d21b38071b1e27c10e7cc92288

SHA1
091eeefa8820882a3090bcdaf05b71ca22736385

SHA256
ca172920d35fe05bd820ea8e939d2c6038758922ecd6411e0cb7b858267bfb86

SHA512
c2020966274e4360e27aa53b15fdaa86bc8c3ab8437616e599dbb80475af72fcd9d012fa907b9bffa528ffb895218762d09ce8503cb912de678d0ffe13bca537

Download Submit
C:\Windows\System\mXYbKah.exe

Filesize
2.2MB

MD5
39af96d625464d8a6ae92d03699052e2

SHA1
8ba69de80dc6a722e3531127a7989f3d2e751982

SHA256
90b6d994f3f119f296ef21212e2ea8bae56c9d4dcf40f819cdc4142f5b28d03e

SHA512
49abfd64108b4125038e5dc1167f9a869228688d11c26049c9bf00da686d46cc02bef33a3755506fa0a241d16aeb27882a7e5991a8672d334cfb9fd243980404

Download Submit
C:\Windows\System\oCsQOMt.exe

Filesize
2.2MB

MD5
c4e0a5667e8ee6376c58e7a78e649e4f

SHA1
bff0c7685592465d9822d6777a4d0863d60082ca

SHA256
1bf8fe58fa3630728cb05a10a4a83d9488bec91afa98fcbf6d45d4f490ee2147

SHA512
5d1dac22f556bd957eacbba5e9ccb9928e8ca3638bb4630d7d6dfcb33b396e840a6cc576b159b81199b55ca00b5074e3e148d8cae9eedc7970358a505085652e

Download Submit
C:\Windows\System\oWtGsdy.exe

Filesize
2.2MB

MD5
4dd069f26a9c21a18da089d031c250d2

SHA1
ac61a85cb40d3c1602845f6cb2acf201e7badb60

SHA256
bc04be8515f22df806298bf99f3a64f4215b0845e2aebc88123449fcd4ae8289

SHA512
98ed44c714682faadf13ea7e303376568dae019ab3d0879a119a03f45466a17bb92a10cc006d8cd92d60b2ef33f43c9beb823920c0e95fd21541d120871c3dd0

Download Submit
C:\Windows\System\qcArzgH.exe

Filesize
2.2MB

MD5
ffa8bdce53732d7553c4bc904f8dbb07

SHA1
d5f372b8a406e57513f4da38a6c15d64e876e78e

SHA256
d1cfcb08a5a815ec5a81241653b664af17cee81c0def4d4a90600890a917eb91

SHA512
e3146c7434f93b37890b87783f1014d2ba8db904fbdfa936abbdce7d13c11a73db7bd9c7d274d5c6755a6015efa07de5af3418ad477749a4e2176c3f2040d90f

Download Submit
C:\Windows\System\rjAcSHb.exe

Filesize
2.2MB

MD5
0533f3cc87574c523041a21822bd7910

SHA1
2590dcf0997250275a7de94af44260102372a1b7

SHA256
41a815c36d3fad01a834cc77d5c6973e7e6ada107642f7d0dccdb3e81a4df228

SHA512
15f7441f05941f8a94a9f2c9915f60f3b298335b79a402c592eab257cd5bdbbdd4e2c7999e579942ceb5ff34c9cda3db069991f577107315b267e6852ff18752

Download Submit
C:\Windows\System\tuMBgJb.exe

Filesize
2.2MB

MD5
e91b32c148a379544d82ad23b1e6e837

SHA1
0f695259c206dff94bcc5c767c9e67d50f72639c

SHA256
f64ed1b235ebc228a97c637412bf617b0de8aaee7837f68787ff0afab0342380

SHA512
c9103d37b48fd62c183b00b14df9fe9e3bffe5a1fe45af1160fba17b8034a242e564aa4bdd94a6c150a84d9bc34a30ad5f6fad4811484e72a9bb86a4bc4bb68f

Download Submit
C:\Windows\System\wRYxULH.exe

Filesize
2.2MB

MD5
ce90070549062020f57ef6d4100b1155

SHA1
18546ed9fe512360701e201acedeca8ea5888258

SHA256
cef1ca8bd0aefb6144dbdc848fc74ece08448f48ff80b5db4a388289407c8457

SHA512
1866292a23fe6f96a07cdb81c6450b771202a32335147eb189b45ff4f5f6274a62e36f5c497df85072858bbca53222013a187f2238238ea776d2aba2fa44c521

Download Submit
C:\Windows\System\ymxvLgE.exe

Filesize
2.2MB

MD5
e24278e6281087a76db8fdc1441868f8

SHA1
41f77307c0fbd6ca6c54c5282afcc1a19eeff410

SHA256
546b1378a1ccce770a00954952eb7c6d557c6f93840c11f29e0d1898d3abb87f

SHA512
ff24babb82184a16eb9607a1f2f3bf0142b1ea973196facfb7b5122252f921fb594be8cffde9fbed1aacd6f21754b21fcc1b8c2d0597b4e6050d78e162e84d52

Download Submit
memory/792-2068-0x00007FF7AFDA0000-0x00007FF7B0192000-memory.dmp

Filesize
3.9MB

Download
memory/792-129-0x00007FF7AFDA0000-0x00007FF7B0192000-memory.dmp

Filesize
3.9MB

Download
memory/1288-1631-0x00007FF655CC0000-0x00007FF6560B2000-memory.dmp

Filesize
3.9MB

Download
memory/1288-35-0x00007FF655CC0000-0x00007FF6560B2000-memory.dmp

Filesize
3.9MB

Download
memory/1432-99-0x00007FF760260000-0x00007FF760652000-memory.dmp

Filesize
3.9MB

Download
memory/1432-0-0x00007FF760260000-0x00007FF760652000-memory.dmp

Filesize
3.9MB

Download
memory/1432-108-0x00007FF760260000-0x00007FF760652000-memory.dmp

Filesize
3.9MB

Download
memory/1432-1-0x000001ED6C8F0000-0x000001ED6C900000-memory.dmp

Filesize
64KB

Download
memory/1732-121-0x00007FF75D8C0000-0x00007FF75DCB2000-memory.dmp

Filesize
3.9MB

Download
memory/1732-2087-0x00007FF75D8C0000-0x00007FF75DCB2000-memory.dmp

Filesize
3.9MB

Download
memory/1840-69-0x00007FF7B3FE0000-0x00007FF7B43D2000-memory.dmp

Filesize
3.9MB

Download
memory/1840-1896-0x00007FF7B3FE0000-0x00007FF7B43D2000-memory.dmp

Filesize
3.9MB

Download
memory/2352-1915-0x00007FF64F240000-0x00007FF64F632000-memory.dmp

Filesize
3.9MB

Download
memory/2352-100-0x00007FF64F240000-0x00007FF64F632000-memory.dmp

Filesize
3.9MB

Download
memory/2672-1632-0x00007FF6B6500000-0x00007FF6B68F2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-32-0x00007FF6B6500000-0x00007FF6B68F2000-memory.dmp

Filesize
3.9MB

Download
memory/3088-172-0x00007FF7A8E00000-0x00007FF7A91F2000-memory.dmp

Filesize
3.9MB

Download
memory/3088-2055-0x00007FF7A8E00000-0x00007FF7A91F2000-memory.dmp

Filesize
3.9MB

Download
memory/3132-1782-0x00007FF751360000-0x00007FF751752000-memory.dmp

Filesize
3.9MB

Download
memory/3132-162-0x00007FF751360000-0x00007FF751752000-memory.dmp

Filesize
3.9MB

Download
memory/3132-43-0x00007FF751360000-0x00007FF751752000-memory.dmp

Filesize
3.9MB

Download
memory/3160-116-0x00007FF713400000-0x00007FF7137F2000-memory.dmp

Filesize
3.9MB

Download
memory/3160-2027-0x00007FF713400000-0x00007FF7137F2000-memory.dmp

Filesize
3.9MB

Download
memory/3608-1916-0x00007FF7169B0000-0x00007FF716DA2000-memory.dmp

Filesize
3.9MB

Download
memory/3608-93-0x00007FF7169B0000-0x00007FF716DA2000-memory.dmp

Filesize
3.9MB

Download
memory/3808-1640-0x00007FF71EB40000-0x00007FF71EF32000-memory.dmp

Filesize
3.9MB

Download
memory/3808-34-0x00007FF71EB40000-0x00007FF71EF32000-memory.dmp

Filesize
3.9MB

Download
memory/3856-36-0x00007FF61CB10000-0x00007FF61CF02000-memory.dmp

Filesize
3.9MB

Download
memory/3856-1806-0x00007FF61CB10000-0x00007FF61CF02000-memory.dmp

Filesize
3.9MB

Download
memory/3856-101-0x00007FF61CB10000-0x00007FF61CF02000-memory.dmp

Filesize
3.9MB

Download
memory/3940-1891-0x00007FF7DDCD0000-0x00007FF7DE0C2000-memory.dmp

Filesize
3.9MB

Download
memory/3940-98-0x00007FF7DDCD0000-0x00007FF7DE0C2000-memory.dmp

Filesize
3.9MB

Download
memory/4088-63-0x00007FF7C3A70000-0x00007FF7C3E62000-memory.dmp

Filesize
3.9MB

Download
memory/4088-1919-0x00007FF7C3A70000-0x00007FF7C3E62000-memory.dmp

Filesize
3.9MB

Download
memory/4140-80-0x00007FF7222B0000-0x00007FF7226A2000-memory.dmp

Filesize
3.9MB

Download
memory/4140-1887-0x00007FF7222B0000-0x00007FF7226A2000-memory.dmp

Filesize
3.9MB

Download
memory/4300-171-0x00007FF755710000-0x00007FF755B02000-memory.dmp

Filesize
3.9MB

Download
memory/4396-49-0x00007FF7280B0000-0x00007FF7284A2000-memory.dmp

Filesize
3.9MB

Download
memory/4396-1864-0x00007FF7280B0000-0x00007FF7284A2000-memory.dmp

Filesize
3.9MB

Download
memory/4428-134-0x00000198FB510000-0x00000198FCB87000-memory.dmp

Filesize
22.5MB

Download
memory/4428-27-0x00000198F95D0000-0x00000198F95F2000-memory.dmp

Filesize
136KB

Download
memory/4428-31-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Filesize
10.8MB

Download
memory/4428-95-0x00007FF9872D0000-0x00007FF987D91000-memory.dmp

Filesize
10.8MB

Download
memory/4428-102-0x00000198FAD60000-0x00000198FB506000-memory.dmp

Filesize
7.6MB

Download
memory/4428-33-0x00000198F9640000-0x00000198F9650000-memory.dmp

Filesize
64KB

Download
memory/4508-167-0x00007FF6B1AD0000-0x00007FF6B1EC2000-memory.dmp

Filesize
3.9MB

Download
memory/4508-2036-0x00007FF6B1AD0000-0x00007FF6B1EC2000-memory.dmp

Filesize
3.9MB

Download
memory/4564-1854-0x00007FF768970000-0x00007FF768D62000-memory.dmp

Filesize
3.9MB

Download
memory/4564-60-0x00007FF768970000-0x00007FF768D62000-memory.dmp

Filesize
3.9MB

Download
memory/4736-1878-0x00007FF7DE410000-0x00007FF7DE802000-memory.dmp

Filesize
3.9MB

Download
memory/4736-85-0x00007FF7DE410000-0x00007FF7DE802000-memory.dmp

Filesize
3.9MB

Download
memory/5088-168-0x00007FF6C2490000-0x00007FF6C2882000-memory.dmp

Filesize
3.9MB

Download