xmrig | c520a867d4dc91bc128f68d2e8a1fd5fae195a1423746e18c916c658e332fae8

Analysis

max time kernel
60s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 06:49

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
Size

2.3MB
MD5

049be3b4038b9308902735bced88fb89
SHA1

3ca26418512c65fd14213491eb65dbceb547a050
SHA256

c520a867d4dc91bc128f68d2e8a1fd5fae195a1423746e18c916c658e332fae8
SHA512

2ecbb2ede1b6a5956029cc800377da66f3fd73cd095a5308dee12da20f1665dd3d52a3cd7da259ab080e562c13552c73b9c38390eecc9e25239e2741aadbbc80
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cQe3bcI:NAB/

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/1892-849-0x00007FF763460000-0x00007FF763852000-memory.dmp	xmrig
behavioral2/memory/4984-846-0x00007FF75E960000-0x00007FF75ED52000-memory.dmp	xmrig
behavioral2/memory/3112-750-0x00007FF6F4CA0000-0x00007FF6F5092000-memory.dmp	xmrig
behavioral2/memory/3864-643-0x00007FF6924B0000-0x00007FF6928A2000-memory.dmp	xmrig
behavioral2/memory/4412-625-0x00007FF757890000-0x00007FF757C82000-memory.dmp	xmrig
behavioral2/memory/920-587-0x00007FF68EDE0000-0x00007FF68F1D2000-memory.dmp	xmrig
behavioral2/memory/1288-451-0x00007FF644410000-0x00007FF644802000-memory.dmp	xmrig
behavioral2/memory/3636-417-0x00007FF755910000-0x00007FF755D02000-memory.dmp	xmrig
behavioral2/memory/5012-361-0x00007FF67CE50000-0x00007FF67D242000-memory.dmp	xmrig
behavioral2/memory/2188-330-0x00007FF737850000-0x00007FF737C42000-memory.dmp	xmrig
behavioral2/memory/4356-289-0x00007FF6142F0000-0x00007FF6146E2000-memory.dmp	xmrig
behavioral2/memory/4740-253-0x00007FF64CCD0000-0x00007FF64D0C2000-memory.dmp	xmrig
behavioral2/memory/3180-250-0x00007FF71A040000-0x00007FF71A432000-memory.dmp	xmrig
behavioral2/memory/4384-226-0x00007FF73AFC0000-0x00007FF73B3B2000-memory.dmp	xmrig
behavioral2/memory/532-198-0x00007FF783430000-0x00007FF783822000-memory.dmp	xmrig
behavioral2/memory/3804-166-0x00007FF643E90000-0x00007FF644282000-memory.dmp	xmrig
behavioral2/memory/1668-163-0x00007FF7476D0000-0x00007FF747AC2000-memory.dmp	xmrig
behavioral2/memory/4908-67-0x00007FF6EF4B0000-0x00007FF6EF8A2000-memory.dmp	xmrig
behavioral2/memory/2616-64-0x00007FF619310000-0x00007FF619702000-memory.dmp	xmrig
behavioral2/memory/4700-4528-0x00007FF74A6E0000-0x00007FF74AAD2000-memory.dmp	xmrig
behavioral2/memory/8-4556-0x00007FF67B990000-0x00007FF67BD82000-memory.dmp	xmrig
behavioral2/memory/3804-4571-0x00007FF643E90000-0x00007FF644282000-memory.dmp	xmrig
behavioral2/memory/1668-4581-0x00007FF7476D0000-0x00007FF747AC2000-memory.dmp	xmrig
behavioral2/memory/3112-4579-0x00007FF6F4CA0000-0x00007FF6F5092000-memory.dmp	xmrig
behavioral2/memory/4908-4567-0x00007FF6EF4B0000-0x00007FF6EF8A2000-memory.dmp	xmrig
behavioral2/memory/4884-4565-0x00007FF62B1A0000-0x00007FF62B592000-memory.dmp	xmrig
behavioral2/memory/3864-4542-0x00007FF6924B0000-0x00007FF6928A2000-memory.dmp	xmrig
behavioral2/memory/4448-4590-0x00007FF618D80000-0x00007FF619172000-memory.dmp	xmrig
behavioral2/memory/920-4675-0x00007FF68EDE0000-0x00007FF68F1D2000-memory.dmp	xmrig
behavioral2/memory/1288-4686-0x00007FF644410000-0x00007FF644802000-memory.dmp	xmrig
behavioral2/memory/2188-4689-0x00007FF737850000-0x00007FF737C42000-memory.dmp	xmrig
behavioral2/memory/4412-4670-0x00007FF757890000-0x00007FF757C82000-memory.dmp	xmrig
behavioral2/memory/3636-4637-0x00007FF755910000-0x00007FF755D02000-memory.dmp	xmrig
behavioral2/memory/5012-4634-0x00007FF67CE50000-0x00007FF67D242000-memory.dmp	xmrig
behavioral2/memory/1892-4631-0x00007FF763460000-0x00007FF763852000-memory.dmp	xmrig
behavioral2/memory/4356-4624-0x00007FF6142F0000-0x00007FF6146E2000-memory.dmp	xmrig
behavioral2/memory/3180-4605-0x00007FF71A040000-0x00007FF71A432000-memory.dmp	xmrig
behavioral2/memory/4384-4602-0x00007FF73AFC0000-0x00007FF73B3B2000-memory.dmp	xmrig
behavioral2/memory/532-4612-0x00007FF783430000-0x00007FF783822000-memory.dmp	xmrig
behavioral2/memory/4984-4599-0x00007FF75E960000-0x00007FF75ED52000-memory.dmp	xmrig
behavioral2/memory/4740-4585-0x00007FF64CCD0000-0x00007FF64D0C2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4700	dBsPHGD.exe
2924	kmSjWsk.exe
8	dzDOdOq.exe
3864	EmhFZHz.exe
2616	GLUyvoi.exe
4908	vDEczxo.exe
4884	ctwPFBX.exe
4448	zEUKBvk.exe
3112	kSjkqEU.exe
1668	knotEeF.exe
3804	dcVzNBa.exe
532	OsTvwoa.exe
4984	hhLjCCj.exe
4384	BIIoKIi.exe
3180	rqCRhoD.exe
4740	CPTJDoA.exe
4356	OVJWWQX.exe
2188	aWoEWno.exe
1892	CiGfBdI.exe
5012	GRwBrkX.exe
3636	otJkTTP.exe
1288	WezidvV.exe
920	OFQNWXD.exe
4412	kQFKaNu.exe
3984	uFDWHgv.exe
3992	FAMQIDX.exe
3164	vLBDKoY.exe
1460	zEDjfFK.exe
4684	xkQOkIJ.exe
1428	IuDNzUh.exe
3344	QOMsQtj.exe
988	NujbZSw.exe
4936	qPnFDvR.exe
4560	DuumaaM.exe
4216	DOInYYG.exe
3000	eJFmzrY.exe
4168	jbRXfPk.exe
2172	TivNEDg.exe
5036	GYIdNwU.exe
1644	bLSumDL.exe
1120	sYqLXyT.exe
2636	eSNHrtA.exe
4196	xAQNbJz.exe
4744	nvsnvIw.exe
4596	NvYQCUN.exe
2448	ZnVQvXq.exe
2356	XzzvzhZ.exe
4588	tLbqQfp.exe
3068	FcCYHEe.exe
1996	hWntIMP.exe
3436	ndqFdbh.exe
1720	htYpIjd.exe
952	gqiipoE.exe
3272	mPrfeOq.exe
4008	ZpZUnxR.exe
3016	RgkXlSu.exe
4424	AezSVgw.exe
2160	ULufQIb.exe
2700	ZndhhSF.exe
792	fJJgWrf.exe
4480	gvCvLwm.exe
5076	YIpddnt.exe
1176	KcIjHWp.exe
4532	NvoYjAh.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3056-0-0x00007FF6351E0000-0x00007FF6355D2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb7-6.dat	upx
behavioral2/files/0x0031000000023bbc-40.dat	upx
behavioral2/files/0x000a000000023bd2-143.dat	upx
behavioral2/files/0x000a000000023bcc-173.dat	upx
behavioral2/memory/1892-849-0x00007FF763460000-0x00007FF763852000-memory.dmp	upx
behavioral2/memory/4984-846-0x00007FF75E960000-0x00007FF75ED52000-memory.dmp	upx
behavioral2/memory/3112-750-0x00007FF6F4CA0000-0x00007FF6F5092000-memory.dmp	upx
behavioral2/memory/3864-643-0x00007FF6924B0000-0x00007FF6928A2000-memory.dmp	upx
behavioral2/memory/4412-625-0x00007FF757890000-0x00007FF757C82000-memory.dmp	upx
behavioral2/memory/920-587-0x00007FF68EDE0000-0x00007FF68F1D2000-memory.dmp	upx
behavioral2/memory/1288-451-0x00007FF644410000-0x00007FF644802000-memory.dmp	upx
behavioral2/memory/3636-417-0x00007FF755910000-0x00007FF755D02000-memory.dmp	upx
behavioral2/memory/5012-361-0x00007FF67CE50000-0x00007FF67D242000-memory.dmp	upx
behavioral2/memory/2188-330-0x00007FF737850000-0x00007FF737C42000-memory.dmp	upx
behavioral2/memory/4356-289-0x00007FF6142F0000-0x00007FF6146E2000-memory.dmp	upx
behavioral2/memory/4740-253-0x00007FF64CCD0000-0x00007FF64D0C2000-memory.dmp	upx
behavioral2/memory/3180-250-0x00007FF71A040000-0x00007FF71A432000-memory.dmp	upx
behavioral2/memory/4384-226-0x00007FF73AFC0000-0x00007FF73B3B2000-memory.dmp	upx
behavioral2/memory/532-198-0x00007FF783430000-0x00007FF783822000-memory.dmp	upx
behavioral2/files/0x000a000000023bd0-190.dat	upx
behavioral2/files/0x000a000000023bd8-189.dat	upx
behavioral2/files/0x000a000000023bcf-185.dat	upx
behavioral2/files/0x000a000000023bce-181.dat	upx
behavioral2/files/0x000a000000023bcb-172.dat	upx
behavioral2/memory/3804-166-0x00007FF643E90000-0x00007FF644282000-memory.dmp	upx
behavioral2/memory/1668-163-0x00007FF7476D0000-0x00007FF747AC2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd6-160.dat	upx
behavioral2/files/0x000a000000023bd1-159.dat	upx
behavioral2/files/0x000a000000023bd5-158.dat	upx
behavioral2/files/0x000a000000023bc9-154.dat	upx
behavioral2/files/0x000a000000023bc8-150.dat	upx
behavioral2/files/0x000a000000023bd4-149.dat	upx
behavioral2/files/0x000a000000023bc7-147.dat	upx
behavioral2/files/0x000a000000023bd3-146.dat	upx
behavioral2/files/0x000a000000023bcd-144.dat	upx
behavioral2/files/0x000a000000023bc6-171.dat	upx
behavioral2/files/0x000a000000023bca-168.dat	upx
behavioral2/memory/4448-136-0x00007FF618D80000-0x00007FF619172000-memory.dmp	upx
behavioral2/files/0x000a000000023bc3-126.dat	upx
behavioral2/files/0x000a000000023bc2-122.dat	upx
behavioral2/files/0x000a000000023bc1-116.dat	upx
behavioral2/files/0x000a000000023bc5-139.dat	upx
behavioral2/files/0x000a000000023bc0-108.dat	upx
behavioral2/files/0x000a000000023bc4-102.dat	upx
behavioral2/files/0x0031000000023bbd-91.dat	upx
behavioral2/memory/4884-88-0x00007FF62B1A0000-0x00007FF62B592000-memory.dmp	upx
behavioral2/files/0x000a000000023bbf-75.dat	upx
behavioral2/files/0x000a000000023bbb-70.dat	upx
behavioral2/files/0x0031000000023bbe-98.dat	upx
behavioral2/memory/4908-67-0x00007FF6EF4B0000-0x00007FF6EF8A2000-memory.dmp	upx
behavioral2/memory/2616-64-0x00007FF619310000-0x00007FF619702000-memory.dmp	upx
behavioral2/files/0x000a000000023bb8-55.dat	upx
behavioral2/memory/8-42-0x00007FF67B990000-0x00007FF67BD82000-memory.dmp	upx
behavioral2/files/0x000b000000023bb2-37.dat	upx
behavioral2/files/0x000a000000023bb9-31.dat	upx
behavioral2/files/0x000a000000023bba-30.dat	upx
behavioral2/memory/2924-23-0x00007FF6B6A80000-0x00007FF6B6E72000-memory.dmp	upx
behavioral2/memory/4700-19-0x00007FF74A6E0000-0x00007FF74AAD2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb6-13.dat	upx
behavioral2/memory/4700-4528-0x00007FF74A6E0000-0x00007FF74AAD2000-memory.dmp	upx
behavioral2/memory/8-4556-0x00007FF67B990000-0x00007FF67BD82000-memory.dmp	upx
behavioral2/memory/3804-4571-0x00007FF643E90000-0x00007FF644282000-memory.dmp	upx
behavioral2/memory/1668-4581-0x00007FF7476D0000-0x00007FF747AC2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PXIJoNs.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\DuumaaM.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\GLwNPxc.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\crYhuNE.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\TudkGof.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\asJMebc.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\biNZEht.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\LZqWEji.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\ZWqiVNt.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\kNfQxGL.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\VYiQrpd.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\BwAhulJ.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\SzrjqGn.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\URscvGS.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\eAwqARr.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\jweBQIx.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\RMgcemi.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\aqAEMjk.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\hpgLAsr.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\pYhTSmk.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\XUmYTOs.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\RIntzhD.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\tACEYAJ.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\iMkscyA.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\IfItZaB.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\CumyefL.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\XaWIQWp.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\RjapIHE.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\letVlWW.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\DcTgnWY.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\MrFvzdA.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\GGvQERi.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\zdLGMEP.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\oRHnoCi.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\MWkoEcc.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\rsoVFHV.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\opsiMCB.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\sYqLXyT.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\OEUcpPU.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\nYjKVpW.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\VdkkdqG.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\hYAORZK.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\zlUfgGK.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\kMUFbsL.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\BUtDNoo.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\xXKyfRL.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\NzjuVZc.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\vYkubht.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\BRaoGMj.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\ugFhVXt.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\KlELiCo.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\dxkRyWz.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\rhNHSDs.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\CEkNtAk.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\fDcxAyq.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\qzpmxeG.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\fLaqDae.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\ZxPCaPK.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\jQbwWvo.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\QdPpPSZ.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\dbIKBur.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\OoqWNzN.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\kMDTYEV.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
File created	C:\Windows\System\NgISpMC.exe	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3416	powershell.exe
3416	powershell.exe
3416	powershell.exe
3416	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
Token: SeDebugPrivilege	3416	powershell.exe
Token: SeLockMemoryPrivilege	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 3416	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	86
PID 3056 wrote to memory of 3416	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	86
PID 3056 wrote to memory of 2924	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	87
PID 3056 wrote to memory of 2924	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	87
PID 3056 wrote to memory of 4700	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	88
PID 3056 wrote to memory of 4700	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	88
PID 3056 wrote to memory of 3864	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	89
PID 3056 wrote to memory of 3864	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	89
PID 3056 wrote to memory of 8	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	90
PID 3056 wrote to memory of 8	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	90
PID 3056 wrote to memory of 2616	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	91
PID 3056 wrote to memory of 2616	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	91
PID 3056 wrote to memory of 4908	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	92
PID 3056 wrote to memory of 4908	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	92
PID 3056 wrote to memory of 4884	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	93
PID 3056 wrote to memory of 4884	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	93
PID 3056 wrote to memory of 4448	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	94
PID 3056 wrote to memory of 4448	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	94
PID 3056 wrote to memory of 3112	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	95
PID 3056 wrote to memory of 3112	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	95
PID 3056 wrote to memory of 1668	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	96
PID 3056 wrote to memory of 1668	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	96
PID 3056 wrote to memory of 3804	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	97
PID 3056 wrote to memory of 3804	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	97
PID 3056 wrote to memory of 532	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	98
PID 3056 wrote to memory of 532	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	98
PID 3056 wrote to memory of 4984	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	99
PID 3056 wrote to memory of 4984	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	99
PID 3056 wrote to memory of 4384	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	100
PID 3056 wrote to memory of 4384	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	100
PID 3056 wrote to memory of 3180	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	101
PID 3056 wrote to memory of 3180	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	101
PID 3056 wrote to memory of 4740	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	102
PID 3056 wrote to memory of 4740	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	102
PID 3056 wrote to memory of 4356	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	103
PID 3056 wrote to memory of 4356	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	103
PID 3056 wrote to memory of 2188	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	104
PID 3056 wrote to memory of 2188	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	104
PID 3056 wrote to memory of 1892	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	105
PID 3056 wrote to memory of 1892	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	105
PID 3056 wrote to memory of 5012	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	106
PID 3056 wrote to memory of 5012	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	106
PID 3056 wrote to memory of 3636	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	107
PID 3056 wrote to memory of 3636	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	107
PID 3056 wrote to memory of 1288	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	108
PID 3056 wrote to memory of 1288	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	108
PID 3056 wrote to memory of 920	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	109
PID 3056 wrote to memory of 920	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	109
PID 3056 wrote to memory of 4412	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	110
PID 3056 wrote to memory of 4412	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	110
PID 3056 wrote to memory of 3984	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	111
PID 3056 wrote to memory of 3984	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	111
PID 3056 wrote to memory of 3992	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	112
PID 3056 wrote to memory of 3992	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	112
PID 3056 wrote to memory of 3164	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	113
PID 3056 wrote to memory of 3164	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	113
PID 3056 wrote to memory of 1460	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	114
PID 3056 wrote to memory of 1460	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	114
PID 3056 wrote to memory of 4684	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	115
PID 3056 wrote to memory of 4684	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	115
PID 3056 wrote to memory of 1428	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	116
PID 3056 wrote to memory of 1428	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	116
PID 3056 wrote to memory of 3344	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	117
PID 3056 wrote to memory of 3344	3056	049be3b4038b9308902735bced88fb89_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\049be3b4038b9308902735bced88fb89_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\049be3b4038b9308902735bced88fb89_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3416
- C:\Windows\System\kmSjWsk.exe
  C:\Windows\System\kmSjWsk.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\dBsPHGD.exe
  C:\Windows\System\dBsPHGD.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\EmhFZHz.exe
  C:\Windows\System\EmhFZHz.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\dzDOdOq.exe
  C:\Windows\System\dzDOdOq.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\GLUyvoi.exe
  C:\Windows\System\GLUyvoi.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\vDEczxo.exe
  C:\Windows\System\vDEczxo.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\ctwPFBX.exe
  C:\Windows\System\ctwPFBX.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\zEUKBvk.exe
  C:\Windows\System\zEUKBvk.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\kSjkqEU.exe
  C:\Windows\System\kSjkqEU.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\knotEeF.exe
  C:\Windows\System\knotEeF.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\dcVzNBa.exe
  C:\Windows\System\dcVzNBa.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\OsTvwoa.exe
  C:\Windows\System\OsTvwoa.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\hhLjCCj.exe
  C:\Windows\System\hhLjCCj.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\BIIoKIi.exe
  C:\Windows\System\BIIoKIi.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\rqCRhoD.exe
  C:\Windows\System\rqCRhoD.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\CPTJDoA.exe
  C:\Windows\System\CPTJDoA.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\OVJWWQX.exe
  C:\Windows\System\OVJWWQX.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\aWoEWno.exe
  C:\Windows\System\aWoEWno.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\CiGfBdI.exe
  C:\Windows\System\CiGfBdI.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\GRwBrkX.exe
  C:\Windows\System\GRwBrkX.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\otJkTTP.exe
  C:\Windows\System\otJkTTP.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\WezidvV.exe
  C:\Windows\System\WezidvV.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\OFQNWXD.exe
  C:\Windows\System\OFQNWXD.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\kQFKaNu.exe
  C:\Windows\System\kQFKaNu.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\uFDWHgv.exe
  C:\Windows\System\uFDWHgv.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\FAMQIDX.exe
  C:\Windows\System\FAMQIDX.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\vLBDKoY.exe
  C:\Windows\System\vLBDKoY.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\zEDjfFK.exe
  C:\Windows\System\zEDjfFK.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\xkQOkIJ.exe
  C:\Windows\System\xkQOkIJ.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\IuDNzUh.exe
  C:\Windows\System\IuDNzUh.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\QOMsQtj.exe
  C:\Windows\System\QOMsQtj.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\NujbZSw.exe
  C:\Windows\System\NujbZSw.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\qPnFDvR.exe
  C:\Windows\System\qPnFDvR.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\DuumaaM.exe
  C:\Windows\System\DuumaaM.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\GYIdNwU.exe
  C:\Windows\System\GYIdNwU.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\DOInYYG.exe
  C:\Windows\System\DOInYYG.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\eJFmzrY.exe
  C:\Windows\System\eJFmzrY.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\jbRXfPk.exe
  C:\Windows\System\jbRXfPk.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\TivNEDg.exe
  C:\Windows\System\TivNEDg.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\bLSumDL.exe
  C:\Windows\System\bLSumDL.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\ndqFdbh.exe
  C:\Windows\System\ndqFdbh.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\sYqLXyT.exe
  C:\Windows\System\sYqLXyT.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\eSNHrtA.exe
  C:\Windows\System\eSNHrtA.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\xAQNbJz.exe
  C:\Windows\System\xAQNbJz.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\nvsnvIw.exe
  C:\Windows\System\nvsnvIw.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\NvYQCUN.exe
  C:\Windows\System\NvYQCUN.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\ZnVQvXq.exe
  C:\Windows\System\ZnVQvXq.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\XzzvzhZ.exe
  C:\Windows\System\XzzvzhZ.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\tLbqQfp.exe
  C:\Windows\System\tLbqQfp.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\FcCYHEe.exe
  C:\Windows\System\FcCYHEe.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\hWntIMP.exe
  C:\Windows\System\hWntIMP.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\htYpIjd.exe
  C:\Windows\System\htYpIjd.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\gqiipoE.exe
  C:\Windows\System\gqiipoE.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\mPrfeOq.exe
  C:\Windows\System\mPrfeOq.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\ZpZUnxR.exe
  C:\Windows\System\ZpZUnxR.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\RgkXlSu.exe
  C:\Windows\System\RgkXlSu.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\AezSVgw.exe
  C:\Windows\System\AezSVgw.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\ULufQIb.exe
  C:\Windows\System\ULufQIb.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\ZndhhSF.exe
  C:\Windows\System\ZndhhSF.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\fJJgWrf.exe
  C:\Windows\System\fJJgWrf.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\gvCvLwm.exe
  C:\Windows\System\gvCvLwm.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\YIpddnt.exe
  C:\Windows\System\YIpddnt.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\agxBwyk.exe
  C:\Windows\System\agxBwyk.exe
  2⤵
  PID:1716
- C:\Windows\System\KcIjHWp.exe
  C:\Windows\System\KcIjHWp.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\NvoYjAh.exe
  C:\Windows\System\NvoYjAh.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\lWqDHBM.exe
  C:\Windows\System\lWqDHBM.exe
  2⤵
  PID:4576
- C:\Windows\System\DdKEGDz.exe
  C:\Windows\System\DdKEGDz.exe
  2⤵
  PID:1764
- C:\Windows\System\XGypPAB.exe
  C:\Windows\System\XGypPAB.exe
  2⤵
  PID:4992
- C:\Windows\System\HyYSvLO.exe
  C:\Windows\System\HyYSvLO.exe
  2⤵
  PID:5096
- C:\Windows\System\DWPLFdy.exe
  C:\Windows\System\DWPLFdy.exe
  2⤵
  PID:4252
- C:\Windows\System\WVZbefj.exe
  C:\Windows\System\WVZbefj.exe
  2⤵
  PID:2532
- C:\Windows\System\ELFHWla.exe
  C:\Windows\System\ELFHWla.exe
  2⤵
  PID:5156
- C:\Windows\System\UzThPRq.exe
  C:\Windows\System\UzThPRq.exe
  2⤵
  PID:5180
- C:\Windows\System\LlsLsqY.exe
  C:\Windows\System\LlsLsqY.exe
  2⤵
  PID:5208
- C:\Windows\System\CSMNaIL.exe
  C:\Windows\System\CSMNaIL.exe
  2⤵
  PID:5224
- C:\Windows\System\iBJksQG.exe
  C:\Windows\System\iBJksQG.exe
  2⤵
  PID:5240
- C:\Windows\System\EEwGimW.exe
  C:\Windows\System\EEwGimW.exe
  2⤵
  PID:5256
- C:\Windows\System\bKtqnDQ.exe
  C:\Windows\System\bKtqnDQ.exe
  2⤵
  PID:5280
- C:\Windows\System\GAjfTIm.exe
  C:\Windows\System\GAjfTIm.exe
  2⤵
  PID:5300
- C:\Windows\System\MyfIKmt.exe
  C:\Windows\System\MyfIKmt.exe
  2⤵
  PID:5316
- C:\Windows\System\ZKRSfIc.exe
  C:\Windows\System\ZKRSfIc.exe
  2⤵
  PID:5340
- C:\Windows\System\qwynADw.exe
  C:\Windows\System\qwynADw.exe
  2⤵
  PID:5364
- C:\Windows\System\ODSLLUt.exe
  C:\Windows\System\ODSLLUt.exe
  2⤵
  PID:5384
- C:\Windows\System\rOHxTbg.exe
  C:\Windows\System\rOHxTbg.exe
  2⤵
  PID:5404
- C:\Windows\System\pOdLhRx.exe
  C:\Windows\System\pOdLhRx.exe
  2⤵
  PID:5424
- C:\Windows\System\lQBwvqf.exe
  C:\Windows\System\lQBwvqf.exe
  2⤵
  PID:5468
- C:\Windows\System\SVYFvqU.exe
  C:\Windows\System\SVYFvqU.exe
  2⤵
  PID:5488
- C:\Windows\System\FAaOCzY.exe
  C:\Windows\System\FAaOCzY.exe
  2⤵
  PID:5512
- C:\Windows\System\xDTXMaT.exe
  C:\Windows\System\xDTXMaT.exe
  2⤵
  PID:5532
- C:\Windows\System\aLhHAot.exe
  C:\Windows\System\aLhHAot.exe
  2⤵
  PID:5560
- C:\Windows\System\WaNODYZ.exe
  C:\Windows\System\WaNODYZ.exe
  2⤵
  PID:5596
- C:\Windows\System\tpwkZZw.exe
  C:\Windows\System\tpwkZZw.exe
  2⤵
  PID:5612
- C:\Windows\System\NPCcStf.exe
  C:\Windows\System\NPCcStf.exe
  2⤵
  PID:5632
- C:\Windows\System\pQzDNUE.exe
  C:\Windows\System\pQzDNUE.exe
  2⤵
  PID:5656
- C:\Windows\System\UofAaFP.exe
  C:\Windows\System\UofAaFP.exe
  2⤵
  PID:5672
- C:\Windows\System\BRaoGMj.exe
  C:\Windows\System\BRaoGMj.exe
  2⤵
  PID:5692
- C:\Windows\System\BZeJGdU.exe
  C:\Windows\System\BZeJGdU.exe
  2⤵
  PID:5736
- C:\Windows\System\FWmThIp.exe
  C:\Windows\System\FWmThIp.exe
  2⤵
  PID:5752
- C:\Windows\System\KWkERDv.exe
  C:\Windows\System\KWkERDv.exe
  2⤵
  PID:5804
- C:\Windows\System\bNJtovX.exe
  C:\Windows\System\bNJtovX.exe
  2⤵
  PID:5828
- C:\Windows\System\PIaIkax.exe
  C:\Windows\System\PIaIkax.exe
  2⤵
  PID:5892
- C:\Windows\System\FaeBXxA.exe
  C:\Windows\System\FaeBXxA.exe
  2⤵
  PID:5908
- C:\Windows\System\sZvmNdR.exe
  C:\Windows\System\sZvmNdR.exe
  2⤵
  PID:5928
- C:\Windows\System\WNpLqEl.exe
  C:\Windows\System\WNpLqEl.exe
  2⤵
  PID:5960
- C:\Windows\System\rpWUlTb.exe
  C:\Windows\System\rpWUlTb.exe
  2⤵
  PID:5976
- C:\Windows\System\jbyjIfT.exe
  C:\Windows\System\jbyjIfT.exe
  2⤵
  PID:5996
- C:\Windows\System\sYZkOpu.exe
  C:\Windows\System\sYZkOpu.exe
  2⤵
  PID:6060
- C:\Windows\System\ozBYDxE.exe
  C:\Windows\System\ozBYDxE.exe
  2⤵
  PID:6092
- C:\Windows\System\oVcSGEL.exe
  C:\Windows\System\oVcSGEL.exe
  2⤵
  PID:6116
- C:\Windows\System\rIEfrfY.exe
  C:\Windows\System\rIEfrfY.exe
  2⤵
  PID:6140
- C:\Windows\System\ZmEhcVg.exe
  C:\Windows\System\ZmEhcVg.exe
  2⤵
  PID:2284
- C:\Windows\System\xWLMcYg.exe
  C:\Windows\System\xWLMcYg.exe
  2⤵
  PID:5072
- C:\Windows\System\tYFprNw.exe
  C:\Windows\System\tYFprNw.exe
  2⤵
  PID:4292
- C:\Windows\System\jwLLYrR.exe
  C:\Windows\System\jwLLYrR.exe
  2⤵
  PID:4328
- C:\Windows\System\IWVtdRr.exe
  C:\Windows\System\IWVtdRr.exe
  2⤵
  PID:1232
- C:\Windows\System\kChYqId.exe
  C:\Windows\System\kChYqId.exe
  2⤵
  PID:4720
- C:\Windows\System\lrrLDvU.exe
  C:\Windows\System\lrrLDvU.exe
  2⤵
  PID:1496
- C:\Windows\System\OuxUOLu.exe
  C:\Windows\System\OuxUOLu.exe
  2⤵
  PID:1364
- C:\Windows\System\NEkNsXj.exe
  C:\Windows\System\NEkNsXj.exe
  2⤵
  PID:3452
- C:\Windows\System\QCnzoTH.exe
  C:\Windows\System\QCnzoTH.exe
  2⤵
  PID:5352
- C:\Windows\System\yOmIGNw.exe
  C:\Windows\System\yOmIGNw.exe
  2⤵
  PID:4612
- C:\Windows\System\VSDgNnn.exe
  C:\Windows\System\VSDgNnn.exe
  2⤵
  PID:5164
- C:\Windows\System\vNOaTrX.exe
  C:\Windows\System\vNOaTrX.exe
  2⤵
  PID:5200
- C:\Windows\System\xNoKwMR.exe
  C:\Windows\System\xNoKwMR.exe
  2⤵
  PID:5824
- C:\Windows\System\uZiVYbU.exe
  C:\Windows\System\uZiVYbU.exe
  2⤵
  PID:5252
- C:\Windows\System\waQxLXu.exe
  C:\Windows\System\waQxLXu.exe
  2⤵
  PID:5520
- C:\Windows\System\LWypADu.exe
  C:\Windows\System\LWypADu.exe
  2⤵
  PID:5604
- C:\Windows\System\bLrmCoB.exe
  C:\Windows\System\bLrmCoB.exe
  2⤵
  PID:6148
- C:\Windows\System\dGxIIIS.exe
  C:\Windows\System\dGxIIIS.exe
  2⤵
  PID:6164
- C:\Windows\System\hgtAciA.exe
  C:\Windows\System\hgtAciA.exe
  2⤵
  PID:6192
- C:\Windows\System\JxlLRFG.exe
  C:\Windows\System\JxlLRFG.exe
  2⤵
  PID:6228
- C:\Windows\System\LuYrcRZ.exe
  C:\Windows\System\LuYrcRZ.exe
  2⤵
  PID:6248
- C:\Windows\System\REajlsl.exe
  C:\Windows\System\REajlsl.exe
  2⤵
  PID:6276
- C:\Windows\System\HeaZPLd.exe
  C:\Windows\System\HeaZPLd.exe
  2⤵
  PID:6292
- C:\Windows\System\WCZOuYQ.exe
  C:\Windows\System\WCZOuYQ.exe
  2⤵
  PID:6316
- C:\Windows\System\hTececv.exe
  C:\Windows\System\hTececv.exe
  2⤵
  PID:6340
- C:\Windows\System\nyHVAqB.exe
  C:\Windows\System\nyHVAqB.exe
  2⤵
  PID:6424
- C:\Windows\System\DQFargR.exe
  C:\Windows\System\DQFargR.exe
  2⤵
  PID:6440
- C:\Windows\System\sMwQCcq.exe
  C:\Windows\System\sMwQCcq.exe
  2⤵
  PID:6456
- C:\Windows\System\ZrFsBXk.exe
  C:\Windows\System\ZrFsBXk.exe
  2⤵
  PID:6472
- C:\Windows\System\MErFnYN.exe
  C:\Windows\System\MErFnYN.exe
  2⤵
  PID:6496
- C:\Windows\System\cixTQqg.exe
  C:\Windows\System\cixTQqg.exe
  2⤵
  PID:6512
- C:\Windows\System\zoIspAr.exe
  C:\Windows\System\zoIspAr.exe
  2⤵
  PID:6528
- C:\Windows\System\SSsfQCB.exe
  C:\Windows\System\SSsfQCB.exe
  2⤵
  PID:6572
- C:\Windows\System\fwrIUbG.exe
  C:\Windows\System\fwrIUbG.exe
  2⤵
  PID:6588
- C:\Windows\System\qFBbMlb.exe
  C:\Windows\System\qFBbMlb.exe
  2⤵
  PID:6604
- C:\Windows\System\uBqrOAh.exe
  C:\Windows\System\uBqrOAh.exe
  2⤵
  PID:6620
- C:\Windows\System\DDKgKeT.exe
  C:\Windows\System\DDKgKeT.exe
  2⤵
  PID:6636
- C:\Windows\System\FHCOEBp.exe
  C:\Windows\System\FHCOEBp.exe
  2⤵
  PID:6652
- C:\Windows\System\dcRUKVu.exe
  C:\Windows\System\dcRUKVu.exe
  2⤵
  PID:6668
- C:\Windows\System\RDmvpQa.exe
  C:\Windows\System\RDmvpQa.exe
  2⤵
  PID:6684
- C:\Windows\System\OPbGYaw.exe
  C:\Windows\System\OPbGYaw.exe
  2⤵
  PID:6700
- C:\Windows\System\WDdOOTD.exe
  C:\Windows\System\WDdOOTD.exe
  2⤵
  PID:6716
- C:\Windows\System\aKryugO.exe
  C:\Windows\System\aKryugO.exe
  2⤵
  PID:6732
- C:\Windows\System\xdORpuE.exe
  C:\Windows\System\xdORpuE.exe
  2⤵
  PID:6748
- C:\Windows\System\ucrLLGf.exe
  C:\Windows\System\ucrLLGf.exe
  2⤵
  PID:6776
- C:\Windows\System\ovYnSzI.exe
  C:\Windows\System\ovYnSzI.exe
  2⤵
  PID:6872
- C:\Windows\System\ctmTjsV.exe
  C:\Windows\System\ctmTjsV.exe
  2⤵
  PID:6888
- C:\Windows\System\GbCIFVF.exe
  C:\Windows\System\GbCIFVF.exe
  2⤵
  PID:6904
- C:\Windows\System\uHeaSXB.exe
  C:\Windows\System\uHeaSXB.exe
  2⤵
  PID:6936
- C:\Windows\System\aUIkBeE.exe
  C:\Windows\System\aUIkBeE.exe
  2⤵
  PID:6968
- C:\Windows\System\ndYYJUh.exe
  C:\Windows\System\ndYYJUh.exe
  2⤵
  PID:6992
- C:\Windows\System\nvNMzPq.exe
  C:\Windows\System\nvNMzPq.exe
  2⤵
  PID:7012
- C:\Windows\System\wSRrHWe.exe
  C:\Windows\System\wSRrHWe.exe
  2⤵
  PID:7036
- C:\Windows\System\walzrgW.exe
  C:\Windows\System\walzrgW.exe
  2⤵
  PID:7052
- C:\Windows\System\RASandl.exe
  C:\Windows\System\RASandl.exe
  2⤵
  PID:7076
- C:\Windows\System\oJGORte.exe
  C:\Windows\System\oJGORte.exe
  2⤵
  PID:7096
- C:\Windows\System\letVlWW.exe
  C:\Windows\System\letVlWW.exe
  2⤵
  PID:7120
- C:\Windows\System\UfJpWwX.exe
  C:\Windows\System\UfJpWwX.exe
  2⤵
  PID:7136
- C:\Windows\System\HBTJYum.exe
  C:\Windows\System\HBTJYum.exe
  2⤵
  PID:7156
- C:\Windows\System\SxViCiH.exe
  C:\Windows\System\SxViCiH.exe
  2⤵
  PID:5680
- C:\Windows\System\BMZFswu.exe
  C:\Windows\System\BMZFswu.exe
  2⤵
  PID:2216
- C:\Windows\System\eaJGKoB.exe
  C:\Windows\System\eaJGKoB.exe
  2⤵
  PID:5744
- C:\Windows\System\vnUSopQ.exe
  C:\Windows\System\vnUSopQ.exe
  2⤵
  PID:5800
- C:\Windows\System\PTWtIzY.exe
  C:\Windows\System\PTWtIzY.exe
  2⤵
  PID:5876
- C:\Windows\System\XmwlXUZ.exe
  C:\Windows\System\XmwlXUZ.exe
  2⤵
  PID:5924
- C:\Windows\System\sXRjCXg.exe
  C:\Windows\System\sXRjCXg.exe
  2⤵
  PID:5972
- C:\Windows\System\lvlvnzg.exe
  C:\Windows\System\lvlvnzg.exe
  2⤵
  PID:6024
- C:\Windows\System\CZFiDca.exe
  C:\Windows\System\CZFiDca.exe
  2⤵
  PID:6084
- C:\Windows\System\NZBSHpG.exe
  C:\Windows\System\NZBSHpG.exe
  2⤵
  PID:6132
- C:\Windows\System\BYxcwUi.exe
  C:\Windows\System\BYxcwUi.exe
  2⤵
  PID:1180
- C:\Windows\System\HergiYr.exe
  C:\Windows\System\HergiYr.exe
  2⤵
  PID:4460
- C:\Windows\System\jdqlKZG.exe
  C:\Windows\System\jdqlKZG.exe
  2⤵
  PID:5416
- C:\Windows\System\nbDAJJH.exe
  C:\Windows\System\nbDAJJH.exe
  2⤵
  PID:4156
- C:\Windows\System\aIcNAWF.exe
  C:\Windows\System\aIcNAWF.exe
  2⤵
  PID:4520
- C:\Windows\System\iZCBgTm.exe
  C:\Windows\System\iZCBgTm.exe
  2⤵
  PID:3988
- C:\Windows\System\WwbzLVY.exe
  C:\Windows\System\WwbzLVY.exe
  2⤵
  PID:6508
- C:\Windows\System\tuHTRMM.exe
  C:\Windows\System\tuHTRMM.exe
  2⤵
  PID:5496
- C:\Windows\System\UWTYzAl.exe
  C:\Windows\System\UWTYzAl.exe
  2⤵
  PID:6156
- C:\Windows\System\PFXipCL.exe
  C:\Windows\System\PFXipCL.exe
  2⤵
  PID:6380
- C:\Windows\System\aTOcQNq.exe
  C:\Windows\System\aTOcQNq.exe
  2⤵
  PID:5868
- C:\Windows\System\AVMWqMx.exe
  C:\Windows\System\AVMWqMx.exe
  2⤵
  PID:6172
- C:\Windows\System\YmRPFHN.exe
  C:\Windows\System\YmRPFHN.exe
  2⤵
  PID:6080
- C:\Windows\System\ZtxtUNk.exe
  C:\Windows\System\ZtxtUNk.exe
  2⤵
  PID:7172
- C:\Windows\System\cAUPyxw.exe
  C:\Windows\System\cAUPyxw.exe
  2⤵
  PID:7192
- C:\Windows\System\SUGoeuy.exe
  C:\Windows\System\SUGoeuy.exe
  2⤵
  PID:7212
- C:\Windows\System\uelhZmU.exe
  C:\Windows\System\uelhZmU.exe
  2⤵
  PID:7248
- C:\Windows\System\oULlmaA.exe
  C:\Windows\System\oULlmaA.exe
  2⤵
  PID:7264
- C:\Windows\System\VZYHHVT.exe
  C:\Windows\System\VZYHHVT.exe
  2⤵
  PID:7280
- C:\Windows\System\JWUGHdM.exe
  C:\Windows\System\JWUGHdM.exe
  2⤵
  PID:7296
- C:\Windows\System\DzpYMSt.exe
  C:\Windows\System\DzpYMSt.exe
  2⤵
  PID:7312
- C:\Windows\System\vGjiMIG.exe
  C:\Windows\System\vGjiMIG.exe
  2⤵
  PID:7328
- C:\Windows\System\pZFwbad.exe
  C:\Windows\System\pZFwbad.exe
  2⤵
  PID:7348
- C:\Windows\System\FHROKOS.exe
  C:\Windows\System\FHROKOS.exe
  2⤵
  PID:7368
- C:\Windows\System\YHaWfMv.exe
  C:\Windows\System\YHaWfMv.exe
  2⤵
  PID:7384
- C:\Windows\System\LzdDtQZ.exe
  C:\Windows\System\LzdDtQZ.exe
  2⤵
  PID:7408
- C:\Windows\System\qirHcTi.exe
  C:\Windows\System\qirHcTi.exe
  2⤵
  PID:7432
- C:\Windows\System\cZCXAbw.exe
  C:\Windows\System\cZCXAbw.exe
  2⤵
  PID:7456
- C:\Windows\System\vLtdBfE.exe
  C:\Windows\System\vLtdBfE.exe
  2⤵
  PID:7476
- C:\Windows\System\muuYOEV.exe
  C:\Windows\System\muuYOEV.exe
  2⤵
  PID:7496
- C:\Windows\System\XaMEgaX.exe
  C:\Windows\System\XaMEgaX.exe
  2⤵
  PID:7520
- C:\Windows\System\RrThKZm.exe
  C:\Windows\System\RrThKZm.exe
  2⤵
  PID:7544
- C:\Windows\System\uUolSzF.exe
  C:\Windows\System\uUolSzF.exe
  2⤵
  PID:7568
- C:\Windows\System\QBkDEkS.exe
  C:\Windows\System\QBkDEkS.exe
  2⤵
  PID:7584
- C:\Windows\System\KqwMehi.exe
  C:\Windows\System\KqwMehi.exe
  2⤵
  PID:7608
- C:\Windows\System\rCKbIAP.exe
  C:\Windows\System\rCKbIAP.exe
  2⤵
  PID:7632
- C:\Windows\System\tACEYAJ.exe
  C:\Windows\System\tACEYAJ.exe
  2⤵
  PID:7656
- C:\Windows\System\jpXqPhb.exe
  C:\Windows\System\jpXqPhb.exe
  2⤵
  PID:7680
- C:\Windows\System\jvQFbhj.exe
  C:\Windows\System\jvQFbhj.exe
  2⤵
  PID:7712
- C:\Windows\System\NoaVgim.exe
  C:\Windows\System\NoaVgim.exe
  2⤵
  PID:7732
- C:\Windows\System\UyEmMzR.exe
  C:\Windows\System\UyEmMzR.exe
  2⤵
  PID:7752
- C:\Windows\System\RaIetvn.exe
  C:\Windows\System\RaIetvn.exe
  2⤵
  PID:7780
- C:\Windows\System\DsXOHYz.exe
  C:\Windows\System\DsXOHYz.exe
  2⤵
  PID:7828
- C:\Windows\System\MZvIjYu.exe
  C:\Windows\System\MZvIjYu.exe
  2⤵
  PID:7852
- C:\Windows\System\xxWGYzJ.exe
  C:\Windows\System\xxWGYzJ.exe
  2⤵
  PID:7876
- C:\Windows\System\FUuFsaw.exe
  C:\Windows\System\FUuFsaw.exe
  2⤵
  PID:7896
- C:\Windows\System\DcTgnWY.exe
  C:\Windows\System\DcTgnWY.exe
  2⤵
  PID:7916
- C:\Windows\System\AREbPci.exe
  C:\Windows\System\AREbPci.exe
  2⤵
  PID:7940
- C:\Windows\System\ywsHsuy.exe
  C:\Windows\System\ywsHsuy.exe
  2⤵
  PID:7956
- C:\Windows\System\vCNCXuf.exe
  C:\Windows\System\vCNCXuf.exe
  2⤵
  PID:7976
- C:\Windows\System\FXxdGmx.exe
  C:\Windows\System\FXxdGmx.exe
  2⤵
  PID:7992
- C:\Windows\System\nXirtSy.exe
  C:\Windows\System\nXirtSy.exe
  2⤵
  PID:8008
- C:\Windows\System\MmfxDHk.exe
  C:\Windows\System\MmfxDHk.exe
  2⤵
  PID:8028
- C:\Windows\System\LGSrqOw.exe
  C:\Windows\System\LGSrqOw.exe
  2⤵
  PID:8052
- C:\Windows\System\LSqjNoE.exe
  C:\Windows\System\LSqjNoE.exe
  2⤵
  PID:8072
- C:\Windows\System\ljBEBDh.exe
  C:\Windows\System\ljBEBDh.exe
  2⤵
  PID:8088
- C:\Windows\System\sTfbRjO.exe
  C:\Windows\System\sTfbRjO.exe
  2⤵
  PID:8108
- C:\Windows\System\crPatzV.exe
  C:\Windows\System\crPatzV.exe
  2⤵
  PID:8136
- C:\Windows\System\HxLUAUh.exe
  C:\Windows\System\HxLUAUh.exe
  2⤵
  PID:8152
- C:\Windows\System\tJLLYfG.exe
  C:\Windows\System\tJLLYfG.exe
  2⤵
  PID:8168
- C:\Windows\System\wnQURMK.exe
  C:\Windows\System\wnQURMK.exe
  2⤵
  PID:8188
- C:\Windows\System\cuwMphi.exe
  C:\Windows\System\cuwMphi.exe
  2⤵
  PID:6564
- C:\Windows\System\xvVbgBt.exe
  C:\Windows\System\xvVbgBt.exe
  2⤵
  PID:4828
- C:\Windows\System\MhsfJGI.exe
  C:\Windows\System\MhsfJGI.exe
  2⤵
  PID:6584
- C:\Windows\System\qIoyHCr.exe
  C:\Windows\System\qIoyHCr.exe
  2⤵
  PID:6628
- C:\Windows\System\TcYCLQC.exe
  C:\Windows\System\TcYCLQC.exe
  2⤵
  PID:6692
- C:\Windows\System\jPwbrqy.exe
  C:\Windows\System\jPwbrqy.exe
  2⤵
  PID:6740
- C:\Windows\System\yYApEma.exe
  C:\Windows\System\yYApEma.exe
  2⤵
  PID:6896
- C:\Windows\System\owhFiHj.exe
  C:\Windows\System\owhFiHj.exe
  2⤵
  PID:6960
- C:\Windows\System\rjOXFVY.exe
  C:\Windows\System\rjOXFVY.exe
  2⤵
  PID:6984
- C:\Windows\System\lqOlRJA.exe
  C:\Windows\System\lqOlRJA.exe
  2⤵
  PID:7060
- C:\Windows\System\vZNuLTB.exe
  C:\Windows\System\vZNuLTB.exe
  2⤵
  PID:7088
- C:\Windows\System\yCKoEvp.exe
  C:\Windows\System\yCKoEvp.exe
  2⤵
  PID:7108
- C:\Windows\System\jZhrnJO.exe
  C:\Windows\System\jZhrnJO.exe
  2⤵
  PID:4092
- C:\Windows\System\owlNNmT.exe
  C:\Windows\System\owlNNmT.exe
  2⤵
  PID:5220
- C:\Windows\System\pjRGdWz.exe
  C:\Windows\System\pjRGdWz.exe
  2⤵
  PID:7276
- C:\Windows\System\YEgkGmU.exe
  C:\Windows\System\YEgkGmU.exe
  2⤵
  PID:6128
- C:\Windows\System\VWiXJhW.exe
  C:\Windows\System\VWiXJhW.exe
  2⤵
  PID:6052
- C:\Windows\System\qqVDdmR.exe
  C:\Windows\System\qqVDdmR.exe
  2⤵
  PID:7200
- C:\Windows\System\KgPnbSY.exe
  C:\Windows\System\KgPnbSY.exe
  2⤵
  PID:7364
- C:\Windows\System\EDdnsGN.exe
  C:\Windows\System\EDdnsGN.exe
  2⤵
  PID:7504
- C:\Windows\System\LHQwwUx.exe
  C:\Windows\System\LHQwwUx.exe
  2⤵
  PID:7664
- C:\Windows\System\pGyLvte.exe
  C:\Windows\System\pGyLvte.exe
  2⤵
  PID:8204
- C:\Windows\System\eYkpLos.exe
  C:\Windows\System\eYkpLos.exe
  2⤵
  PID:8236
- C:\Windows\System\qtDthZP.exe
  C:\Windows\System\qtDthZP.exe
  2⤵
  PID:8256
- C:\Windows\System\DjWOmhu.exe
  C:\Windows\System\DjWOmhu.exe
  2⤵
  PID:8288
- C:\Windows\System\TCbUXFb.exe
  C:\Windows\System\TCbUXFb.exe
  2⤵
  PID:8308
- C:\Windows\System\kRQbDly.exe
  C:\Windows\System\kRQbDly.exe
  2⤵
  PID:8332
- C:\Windows\System\IlviNFM.exe
  C:\Windows\System\IlviNFM.exe
  2⤵
  PID:8352
- C:\Windows\System\bqnNeSe.exe
  C:\Windows\System\bqnNeSe.exe
  2⤵
  PID:8368
- C:\Windows\System\jlmJKip.exe
  C:\Windows\System\jlmJKip.exe
  2⤵
  PID:8388
- C:\Windows\System\OglHDSP.exe
  C:\Windows\System\OglHDSP.exe
  2⤵
  PID:8412
- C:\Windows\System\gEWdSRg.exe
  C:\Windows\System\gEWdSRg.exe
  2⤵
  PID:8432
- C:\Windows\System\qPzxfIq.exe
  C:\Windows\System\qPzxfIq.exe
  2⤵
  PID:8456
- C:\Windows\System\gWzyPNV.exe
  C:\Windows\System\gWzyPNV.exe
  2⤵
  PID:8480
- C:\Windows\System\OQIFFvb.exe
  C:\Windows\System\OQIFFvb.exe
  2⤵
  PID:8504
- C:\Windows\System\WAkaSKQ.exe
  C:\Windows\System\WAkaSKQ.exe
  2⤵
  PID:8528
- C:\Windows\System\hInlyOD.exe
  C:\Windows\System\hInlyOD.exe
  2⤵
  PID:8544
- C:\Windows\System\xwFkEvL.exe
  C:\Windows\System\xwFkEvL.exe
  2⤵
  PID:8568
- C:\Windows\System\YgGxCni.exe
  C:\Windows\System\YgGxCni.exe
  2⤵
  PID:8592
- C:\Windows\System\vKvZiEY.exe
  C:\Windows\System\vKvZiEY.exe
  2⤵
  PID:8612
- C:\Windows\System\konSFcC.exe
  C:\Windows\System\konSFcC.exe
  2⤵
  PID:8632
- C:\Windows\System\isQFWms.exe
  C:\Windows\System\isQFWms.exe
  2⤵
  PID:8660
- C:\Windows\System\zqfhqJz.exe
  C:\Windows\System\zqfhqJz.exe
  2⤵
  PID:8680
- C:\Windows\System\EUdaohh.exe
  C:\Windows\System\EUdaohh.exe
  2⤵
  PID:8700
- C:\Windows\System\MGBgzGC.exe
  C:\Windows\System\MGBgzGC.exe
  2⤵
  PID:8716
- C:\Windows\System\eLgjarL.exe
  C:\Windows\System\eLgjarL.exe
  2⤵
  PID:8732
- C:\Windows\System\NjySDDy.exe
  C:\Windows\System\NjySDDy.exe
  2⤵
  PID:8748
- C:\Windows\System\HgXrbgD.exe
  C:\Windows\System\HgXrbgD.exe
  2⤵
  PID:8772
- C:\Windows\System\cXyfxJa.exe
  C:\Windows\System\cXyfxJa.exe
  2⤵
  PID:8816
- C:\Windows\System\wAOBpVZ.exe
  C:\Windows\System\wAOBpVZ.exe
  2⤵
  PID:8852
- C:\Windows\System\RtmJbfG.exe
  C:\Windows\System\RtmJbfG.exe
  2⤵
  PID:8876
- C:\Windows\System\UxNXoDp.exe
  C:\Windows\System\UxNXoDp.exe
  2⤵
  PID:8900
- C:\Windows\System\vfUwcmf.exe
  C:\Windows\System\vfUwcmf.exe
  2⤵
  PID:8920
- C:\Windows\System\VbLKvix.exe
  C:\Windows\System\VbLKvix.exe
  2⤵
  PID:8936
- C:\Windows\System\WvcyYvR.exe
  C:\Windows\System\WvcyYvR.exe
  2⤵
  PID:8960
- C:\Windows\System\OLVUwze.exe
  C:\Windows\System\OLVUwze.exe
  2⤵
  PID:8980
- C:\Windows\System\LoyByYi.exe
  C:\Windows\System\LoyByYi.exe
  2⤵
  PID:9008
- C:\Windows\System\hPtKNBn.exe
  C:\Windows\System\hPtKNBn.exe
  2⤵
  PID:9036
- C:\Windows\System\XHnGGxx.exe
  C:\Windows\System\XHnGGxx.exe
  2⤵
  PID:9064
- C:\Windows\System\afmkavn.exe
  C:\Windows\System\afmkavn.exe
  2⤵
  PID:9088
- C:\Windows\System\MBtKbBM.exe
  C:\Windows\System\MBtKbBM.exe
  2⤵
  PID:9108
- C:\Windows\System\ppkaZdK.exe
  C:\Windows\System\ppkaZdK.exe
  2⤵
  PID:9128
- C:\Windows\System\fLaqDae.exe
  C:\Windows\System\fLaqDae.exe
  2⤵
  PID:9144
- C:\Windows\System\nxzrREE.exe
  C:\Windows\System\nxzrREE.exe
  2⤵
  PID:9164
- C:\Windows\System\eAwqARr.exe
  C:\Windows\System\eAwqARr.exe
  2⤵
  PID:9188
- C:\Windows\System\XyKpSby.exe
  C:\Windows\System\XyKpSby.exe
  2⤵
  PID:9204
- C:\Windows\System\ZziCXGf.exe
  C:\Windows\System\ZziCXGf.exe
  2⤵
  PID:6504
- C:\Windows\System\ztcYYug.exe
  C:\Windows\System\ztcYYug.exe
  2⤵
  PID:6260
- C:\Windows\System\RotvvoK.exe
  C:\Windows\System\RotvvoK.exe
  2⤵
  PID:5940
- C:\Windows\System\BDUcVnz.exe
  C:\Windows\System\BDUcVnz.exe
  2⤵
  PID:6104
- C:\Windows\System\pIPTqbY.exe
  C:\Windows\System\pIPTqbY.exe
  2⤵
  PID:4988
- C:\Windows\System\cqFfQML.exe
  C:\Windows\System\cqFfQML.exe
  2⤵
  PID:2464
- C:\Windows\System\wGOilBZ.exe
  C:\Windows\System\wGOilBZ.exe
  2⤵
  PID:7244
- C:\Windows\System\ofOARXf.exe
  C:\Windows\System\ofOARXf.exe
  2⤵
  PID:7260
- C:\Windows\System\cyTsBHi.exe
  C:\Windows\System\cyTsBHi.exe
  2⤵
  PID:8084
- C:\Windows\System\QnBtgMo.exe
  C:\Windows\System\QnBtgMo.exe
  2⤵
  PID:8120
- C:\Windows\System\Zsimygd.exe
  C:\Windows\System\Zsimygd.exe
  2⤵
  PID:8344
- C:\Windows\System\wUXJlTx.exe
  C:\Windows\System\wUXJlTx.exe
  2⤵
  PID:8580
- C:\Windows\System\DVMvaFF.exe
  C:\Windows\System\DVMvaFF.exe
  2⤵
  PID:6600
- C:\Windows\System\OfqjPdN.exe
  C:\Windows\System\OfqjPdN.exe
  2⤵
  PID:6612
- C:\Windows\System\BGlKlvQ.exe
  C:\Windows\System\BGlKlvQ.exe
  2⤵
  PID:7220
- C:\Windows\System\tlDAnki.exe
  C:\Windows\System\tlDAnki.exe
  2⤵
  PID:7624
- C:\Windows\System\pFLFRGg.exe
  C:\Windows\System\pFLFRGg.exe
  2⤵
  PID:7868
- C:\Windows\System\yYzRgrV.exe
  C:\Windows\System\yYzRgrV.exe
  2⤵
  PID:8228
- C:\Windows\System\cdMKbef.exe
  C:\Windows\System\cdMKbef.exe
  2⤵
  PID:8360
- C:\Windows\System\ERrhwJf.exe
  C:\Windows\System\ERrhwJf.exe
  2⤵
  PID:8400
- C:\Windows\System\vLlkBwn.exe
  C:\Windows\System\vLlkBwn.exe
  2⤵
  PID:1888
- C:\Windows\System\zFYRuZy.exe
  C:\Windows\System\zFYRuZy.exe
  2⤵
  PID:8440
- C:\Windows\System\rAWPbox.exe
  C:\Windows\System\rAWPbox.exe
  2⤵
  PID:8472
- C:\Windows\System\tCuRUKc.exe
  C:\Windows\System\tCuRUKc.exe
  2⤵
  PID:9220
- C:\Windows\System\ZACOUfa.exe
  C:\Windows\System\ZACOUfa.exe
  2⤵
  PID:9244
- C:\Windows\System\MYIUhAI.exe
  C:\Windows\System\MYIUhAI.exe
  2⤵
  PID:9264
- C:\Windows\System\uHpVDsZ.exe
  C:\Windows\System\uHpVDsZ.exe
  2⤵
  PID:9284
- C:\Windows\System\maguJpR.exe
  C:\Windows\System\maguJpR.exe
  2⤵
  PID:9376
- C:\Windows\System\cnFcvzU.exe
  C:\Windows\System\cnFcvzU.exe
  2⤵
  PID:9392
- C:\Windows\System\EDKQYAR.exe
  C:\Windows\System\EDKQYAR.exe
  2⤵
  PID:9408
- C:\Windows\System\vDmnNLb.exe
  C:\Windows\System\vDmnNLb.exe
  2⤵
  PID:9436
- C:\Windows\System\MargZnP.exe
  C:\Windows\System\MargZnP.exe
  2⤵
  PID:9452
- C:\Windows\System\wSTbRpQ.exe
  C:\Windows\System\wSTbRpQ.exe
  2⤵
  PID:9468
- C:\Windows\System\nsoKkjb.exe
  C:\Windows\System\nsoKkjb.exe
  2⤵
  PID:9484
- C:\Windows\System\gdRRZsC.exe
  C:\Windows\System\gdRRZsC.exe
  2⤵
  PID:9504
- C:\Windows\System\TqxKWoI.exe
  C:\Windows\System\TqxKWoI.exe
  2⤵
  PID:9524
- C:\Windows\System\JaTwjTj.exe
  C:\Windows\System\JaTwjTj.exe
  2⤵
  PID:9544
- C:\Windows\System\uTDdoBg.exe
  C:\Windows\System\uTDdoBg.exe
  2⤵
  PID:9568
- C:\Windows\System\miAHNoJ.exe
  C:\Windows\System\miAHNoJ.exe
  2⤵
  PID:9588
- C:\Windows\System\BqUebhh.exe
  C:\Windows\System\BqUebhh.exe
  2⤵
  PID:9612
- C:\Windows\System\iCcIpAN.exe
  C:\Windows\System\iCcIpAN.exe
  2⤵
  PID:9636
- C:\Windows\System\MOvrDAj.exe
  C:\Windows\System\MOvrDAj.exe
  2⤵
  PID:9660
- C:\Windows\System\OTGsOQm.exe
  C:\Windows\System\OTGsOQm.exe
  2⤵
  PID:9684
- C:\Windows\System\WncKAuf.exe
  C:\Windows\System\WncKAuf.exe
  2⤵
  PID:9712
- C:\Windows\System\ugFhVXt.exe
  C:\Windows\System\ugFhVXt.exe
  2⤵
  PID:9732
- C:\Windows\System\GwGufkK.exe
  C:\Windows\System\GwGufkK.exe
  2⤵
  PID:9752
- C:\Windows\System\uBXWnlI.exe
  C:\Windows\System\uBXWnlI.exe
  2⤵
  PID:9776
- C:\Windows\System\loXCVnt.exe
  C:\Windows\System\loXCVnt.exe
  2⤵
  PID:9796
- C:\Windows\System\hbQDTdA.exe
  C:\Windows\System\hbQDTdA.exe
  2⤵
  PID:9820
- C:\Windows\System\KuvQlxT.exe
  C:\Windows\System\KuvQlxT.exe
  2⤵
  PID:9844
- C:\Windows\System\iddtcRD.exe
  C:\Windows\System\iddtcRD.exe
  2⤵
  PID:9868
- C:\Windows\System\nwEeMmm.exe
  C:\Windows\System\nwEeMmm.exe
  2⤵
  PID:9892
- C:\Windows\System\qHfyZGs.exe
  C:\Windows\System\qHfyZGs.exe
  2⤵
  PID:9916
- C:\Windows\System\qexZFKN.exe
  C:\Windows\System\qexZFKN.exe
  2⤵
  PID:9932
- C:\Windows\System\vYGYHYi.exe
  C:\Windows\System\vYGYHYi.exe
  2⤵
  PID:9948
- C:\Windows\System\rXNVEbO.exe
  C:\Windows\System\rXNVEbO.exe
  2⤵
  PID:9964
- C:\Windows\System\eldTrzu.exe
  C:\Windows\System\eldTrzu.exe
  2⤵
  PID:9984
- C:\Windows\System\grqulgK.exe
  C:\Windows\System\grqulgK.exe
  2⤵
  PID:10004
- C:\Windows\System\GYSoYWj.exe
  C:\Windows\System\GYSoYWj.exe
  2⤵
  PID:10028
- C:\Windows\System\yvjVdVV.exe
  C:\Windows\System\yvjVdVV.exe
  2⤵
  PID:10052
- C:\Windows\System\eyvGdYV.exe
  C:\Windows\System\eyvGdYV.exe
  2⤵
  PID:10072
- C:\Windows\System\ANMkMBo.exe
  C:\Windows\System\ANMkMBo.exe
  2⤵
  PID:10096
- C:\Windows\System\wqBspaP.exe
  C:\Windows\System\wqBspaP.exe
  2⤵
  PID:10120
- C:\Windows\System\GEtIrvz.exe
  C:\Windows\System\GEtIrvz.exe
  2⤵
  PID:10144
- C:\Windows\System\xKTgpiv.exe
  C:\Windows\System\xKTgpiv.exe
  2⤵
  PID:10172
- C:\Windows\System\YolICcg.exe
  C:\Windows\System\YolICcg.exe
  2⤵
  PID:10192
- C:\Windows\System\hpgLAsr.exe
  C:\Windows\System\hpgLAsr.exe
  2⤵
  PID:10216
- C:\Windows\System\GhwTvgW.exe
  C:\Windows\System\GhwTvgW.exe
  2⤵
  PID:6676
- C:\Windows\System\EgGOJXZ.exe
  C:\Windows\System\EgGOJXZ.exe
  2⤵
  PID:8552
- C:\Windows\System\HpszmYf.exe
  C:\Windows\System\HpszmYf.exe
  2⤵
  PID:8624
- C:\Windows\System\NbRNeGt.exe
  C:\Windows\System\NbRNeGt.exe
  2⤵
  PID:8744
- C:\Windows\System\DwLYPOm.exe
  C:\Windows\System\DwLYPOm.exe
  2⤵
  PID:8844
- C:\Windows\System\yZPEAiB.exe
  C:\Windows\System\yZPEAiB.exe
  2⤵
  PID:8888
- C:\Windows\System\yndSdWX.exe
  C:\Windows\System\yndSdWX.exe
  2⤵
  PID:8944
- C:\Windows\System\SjNQYGW.exe
  C:\Windows\System\SjNQYGW.exe
  2⤵
  PID:8988
- C:\Windows\System\WpdACbd.exe
  C:\Windows\System\WpdACbd.exe
  2⤵
  PID:9024
- C:\Windows\System\gmwNMiW.exe
  C:\Windows\System\gmwNMiW.exe
  2⤵
  PID:8348
- C:\Windows\System\rUomhHD.exe
  C:\Windows\System\rUomhHD.exe
  2⤵
  PID:8476
- C:\Windows\System\eKIlXnx.exe
  C:\Windows\System\eKIlXnx.exe
  2⤵
  PID:9232
- C:\Windows\System\IeymyBl.exe
  C:\Windows\System\IeymyBl.exe
  2⤵
  PID:9320
- C:\Windows\System\KEqWbqM.exe
  C:\Windows\System\KEqWbqM.exe
  2⤵
  PID:9096
- C:\Windows\System\YJxlzmd.exe
  C:\Windows\System\YJxlzmd.exe
  2⤵
  PID:9136
- C:\Windows\System\YXfapQS.exe
  C:\Windows\System\YXfapQS.exe
  2⤵
  PID:9196
- C:\Windows\System\pRcDVhw.exe
  C:\Windows\System\pRcDVhw.exe
  2⤵
  PID:2900
- C:\Windows\System\tgnkRGB.exe
  C:\Windows\System\tgnkRGB.exe
  2⤵
  PID:2576
- C:\Windows\System\uGUToPh.exe
  C:\Windows\System\uGUToPh.exe
  2⤵
  PID:7184
- C:\Windows\System\fRHBuQz.exe
  C:\Windows\System\fRHBuQz.exe
  2⤵
  PID:7448
- C:\Windows\System\ceeLYlQ.exe
  C:\Windows\System\ceeLYlQ.exe
  2⤵
  PID:10280
- C:\Windows\System\YJTllZk.exe
  C:\Windows\System\YJTllZk.exe
  2⤵
  PID:10300
- C:\Windows\System\wOTarQD.exe
  C:\Windows\System\wOTarQD.exe
  2⤵
  PID:10320
- C:\Windows\System\wNCZFNh.exe
  C:\Windows\System\wNCZFNh.exe
  2⤵
  PID:10340
- C:\Windows\System\koxpjTr.exe
  C:\Windows\System\koxpjTr.exe
  2⤵
  PID:10360
- C:\Windows\System\LlOutZZ.exe
  C:\Windows\System\LlOutZZ.exe
  2⤵
  PID:10380
- C:\Windows\System\aoJdJKM.exe
  C:\Windows\System\aoJdJKM.exe
  2⤵
  PID:10404
- C:\Windows\System\rfZxhTT.exe
  C:\Windows\System\rfZxhTT.exe
  2⤵
  PID:10424
- C:\Windows\System\xigDRJL.exe
  C:\Windows\System\xigDRJL.exe
  2⤵
  PID:10444
- C:\Windows\System\oKappfv.exe
  C:\Windows\System\oKappfv.exe
  2⤵
  PID:10464
- C:\Windows\System\ccakkRs.exe
  C:\Windows\System\ccakkRs.exe
  2⤵
  PID:10484
- C:\Windows\System\dHycolN.exe
  C:\Windows\System\dHycolN.exe
  2⤵
  PID:10508
- C:\Windows\System\KfRDYQH.exe
  C:\Windows\System\KfRDYQH.exe
  2⤵
  PID:10524
- C:\Windows\System\qIlThyQ.exe
  C:\Windows\System\qIlThyQ.exe
  2⤵
  PID:10540
- C:\Windows\System\PcVjqUF.exe
  C:\Windows\System\PcVjqUF.exe
  2⤵
  PID:10556
- C:\Windows\System\LfPtYCP.exe
  C:\Windows\System\LfPtYCP.exe
  2⤵
  PID:10572
- C:\Windows\System\dvOEqJN.exe
  C:\Windows\System\dvOEqJN.exe
  2⤵
  PID:10588
- C:\Windows\System\HTAqHrR.exe
  C:\Windows\System\HTAqHrR.exe
  2⤵
  PID:10604
- C:\Windows\System\VYiQrpd.exe
  C:\Windows\System\VYiQrpd.exe
  2⤵
  PID:10636
- C:\Windows\System\ppRnoCc.exe
  C:\Windows\System\ppRnoCc.exe
  2⤵
  PID:10652
- C:\Windows\System\RReAHAt.exe
  C:\Windows\System\RReAHAt.exe
  2⤵
  PID:10668
- C:\Windows\System\MliNZsH.exe
  C:\Windows\System\MliNZsH.exe
  2⤵
  PID:10696
- C:\Windows\System\UGFXOUT.exe
  C:\Windows\System\UGFXOUT.exe
  2⤵
  PID:10724
- C:\Windows\System\hjBKVMI.exe
  C:\Windows\System\hjBKVMI.exe
  2⤵
  PID:10752
- C:\Windows\System\iMkscyA.exe
  C:\Windows\System\iMkscyA.exe
  2⤵
  PID:10768
- C:\Windows\System\TnwWHif.exe
  C:\Windows\System\TnwWHif.exe
  2⤵
  PID:10800
- C:\Windows\System\MCqSdlE.exe
  C:\Windows\System\MCqSdlE.exe
  2⤵
  PID:10824
- C:\Windows\System\zcKJNNd.exe
  C:\Windows\System\zcKJNNd.exe
  2⤵
  PID:10844
- C:\Windows\System\PXIQBJh.exe
  C:\Windows\System\PXIQBJh.exe
  2⤵
  PID:10868
- C:\Windows\System\NzECoHB.exe
  C:\Windows\System\NzECoHB.exe
  2⤵
  PID:10892
- C:\Windows\System\wmhVWxC.exe
  C:\Windows\System\wmhVWxC.exe
  2⤵
  PID:10916
- C:\Windows\System\ctIsEpm.exe
  C:\Windows\System\ctIsEpm.exe
  2⤵
  PID:10944
- C:\Windows\System\mzeBBio.exe
  C:\Windows\System\mzeBBio.exe
  2⤵
  PID:10964
- C:\Windows\System\oZdzddF.exe
  C:\Windows\System\oZdzddF.exe
  2⤵
  PID:10984
- C:\Windows\System\GPXtiYp.exe
  C:\Windows\System\GPXtiYp.exe
  2⤵
  PID:11012
- C:\Windows\System\WBnIlnQ.exe
  C:\Windows\System\WBnIlnQ.exe
  2⤵
  PID:11032
- C:\Windows\System\IOuQOuq.exe
  C:\Windows\System\IOuQOuq.exe
  2⤵
  PID:11056
- C:\Windows\System\kgVyMzb.exe
  C:\Windows\System\kgVyMzb.exe
  2⤵
  PID:11076
- C:\Windows\System\HqdBcEN.exe
  C:\Windows\System\HqdBcEN.exe
  2⤵
  PID:11100
- C:\Windows\System\bQDGVte.exe
  C:\Windows\System\bQDGVte.exe
  2⤵
  PID:11124
- C:\Windows\System\ZRBnqNv.exe
  C:\Windows\System\ZRBnqNv.exe
  2⤵
  PID:11148
- C:\Windows\System\GLwNPxc.exe
  C:\Windows\System\GLwNPxc.exe
  2⤵
  PID:11172
- C:\Windows\System\JgLXknT.exe
  C:\Windows\System\JgLXknT.exe
  2⤵
  PID:11200
- C:\Windows\System\fgqRVjd.exe
  C:\Windows\System\fgqRVjd.exe
  2⤵
  PID:11220
- C:\Windows\System\QoblVUx.exe
  C:\Windows\System\QoblVUx.exe
  2⤵
  PID:11248
- C:\Windows\System\jvvpLwp.exe
  C:\Windows\System\jvvpLwp.exe
  2⤵
  PID:10068
- C:\Windows\System\suijsHx.exe
  C:\Windows\System\suijsHx.exe
  2⤵
  PID:8860
- C:\Windows\System\WFAlikZ.exe
  C:\Windows\System\WFAlikZ.exe
  2⤵
  PID:8972
- C:\Windows\System\ShREYjT.exe
  C:\Windows\System\ShREYjT.exe
  2⤵
  PID:4708
- C:\Windows\System\aVPPWQh.exe
  C:\Windows\System\aVPPWQh.exe
  2⤵
  PID:8452
- C:\Windows\System\ImfThFY.exe
  C:\Windows\System\ImfThFY.exe
  2⤵
  PID:9256
- C:\Windows\System\ddtMnII.exe
  C:\Windows\System\ddtMnII.exe
  2⤵
  PID:11360
- C:\Windows\System\xwhpXPZ.exe
  C:\Windows\System\xwhpXPZ.exe
  2⤵
  PID:11376
- C:\Windows\System\aHBrlpm.exe
  C:\Windows\System\aHBrlpm.exe
  2⤵
  PID:11396
- C:\Windows\System\xTIDKlG.exe
  C:\Windows\System\xTIDKlG.exe
  2⤵
  PID:11412
- C:\Windows\System\PKxBfoh.exe
  C:\Windows\System\PKxBfoh.exe
  2⤵
  PID:11428
- C:\Windows\System\fICcHfY.exe
  C:\Windows\System\fICcHfY.exe
  2⤵
  PID:11444
- C:\Windows\System\NsIFJVa.exe
  C:\Windows\System\NsIFJVa.exe
  2⤵
  PID:11460
- C:\Windows\System\CtcFfPf.exe
  C:\Windows\System\CtcFfPf.exe
  2⤵
  PID:11480
- C:\Windows\System\iUZpQNT.exe
  C:\Windows\System\iUZpQNT.exe
  2⤵
  PID:11496
- C:\Windows\System\sKreOMz.exe
  C:\Windows\System\sKreOMz.exe
  2⤵
  PID:11512
- C:\Windows\System\aumkTVi.exe
  C:\Windows\System\aumkTVi.exe
  2⤵
  PID:11528
- C:\Windows\System\TZDQRqW.exe
  C:\Windows\System\TZDQRqW.exe
  2⤵
  PID:11544
- C:\Windows\System\QxWvfyE.exe
  C:\Windows\System\QxWvfyE.exe
  2⤵
  PID:11572
- C:\Windows\System\uKEtCSo.exe
  C:\Windows\System\uKEtCSo.exe
  2⤵
  PID:11588
- C:\Windows\System\VLHVazL.exe
  C:\Windows\System\VLHVazL.exe
  2⤵
  PID:11604
- C:\Windows\System\sbbhPCV.exe
  C:\Windows\System\sbbhPCV.exe
  2⤵
  PID:11620
- C:\Windows\System\XJpnaJS.exe
  C:\Windows\System\XJpnaJS.exe
  2⤵
  PID:11636
- C:\Windows\System\XgxjCRx.exe
  C:\Windows\System\XgxjCRx.exe
  2⤵
  PID:11652
- C:\Windows\System\FOIgOFt.exe
  C:\Windows\System\FOIgOFt.exe
  2⤵
  PID:11676
- C:\Windows\System\eankzof.exe
  C:\Windows\System\eankzof.exe
  2⤵
  PID:11696
- C:\Windows\System\cqOQYMl.exe
  C:\Windows\System\cqOQYMl.exe
  2⤵
  PID:11720
- C:\Windows\System\iFvzXCW.exe
  C:\Windows\System\iFvzXCW.exe
  2⤵
  PID:11744
- C:\Windows\System\noMAdQn.exe
  C:\Windows\System\noMAdQn.exe
  2⤵
  PID:11776
- C:\Windows\System\hjdCiFM.exe
  C:\Windows\System\hjdCiFM.exe
  2⤵
  PID:11796
- C:\Windows\System\QTquCeR.exe
  C:\Windows\System\QTquCeR.exe
  2⤵
  PID:11820
- C:\Windows\System\zVjTqgn.exe
  C:\Windows\System\zVjTqgn.exe
  2⤵
  PID:11848
- C:\Windows\System\DiEuCKE.exe
  C:\Windows\System\DiEuCKE.exe
  2⤵
  PID:11872
- C:\Windows\System\DEfsVMn.exe
  C:\Windows\System\DEfsVMn.exe
  2⤵
  PID:11908
- C:\Windows\System\MAfnUZf.exe
  C:\Windows\System\MAfnUZf.exe
  2⤵
  PID:11940
- C:\Windows\System\IDliwbg.exe
  C:\Windows\System\IDliwbg.exe
  2⤵
  PID:11960
- C:\Windows\System\DyvXVBh.exe
  C:\Windows\System\DyvXVBh.exe
  2⤵
  PID:11984
- C:\Windows\System\pqiauzf.exe
  C:\Windows\System\pqiauzf.exe
  2⤵
  PID:12004
- C:\Windows\System\nGcdbkq.exe
  C:\Windows\System\nGcdbkq.exe
  2⤵
  PID:12028
- C:\Windows\System\qFUQaWg.exe
  C:\Windows\System\qFUQaWg.exe
  2⤵
  PID:12044
- C:\Windows\System\tSrSLYx.exe
  C:\Windows\System\tSrSLYx.exe
  2⤵
  PID:12144
- C:\Windows\System\PizkycI.exe
  C:\Windows\System\PizkycI.exe
  2⤵
  PID:12168
- C:\Windows\System\vcEuMAc.exe
  C:\Windows\System\vcEuMAc.exe
  2⤵
  PID:12192
- C:\Windows\System\nrPvVji.exe
  C:\Windows\System\nrPvVji.exe
  2⤵
  PID:12212
- C:\Windows\System\ncYRfjo.exe
  C:\Windows\System\ncYRfjo.exe
  2⤵
  PID:12236
- C:\Windows\System\uaacGGE.exe
  C:\Windows\System\uaacGGE.exe
  2⤵
  PID:12260
- C:\Windows\System\xKuDyAU.exe
  C:\Windows\System\xKuDyAU.exe
  2⤵
  PID:12284
- C:\Windows\System\lXLReEk.exe
  C:\Windows\System\lXLReEk.exe
  2⤵
  PID:6452
- C:\Windows\System\AClrRdS.exe
  C:\Windows\System\AClrRdS.exe
  2⤵
  PID:10884
- C:\Windows\System\YIjPIPX.exe
  C:\Windows\System\YIjPIPX.exe
  2⤵
  PID:10980
- C:\Windows\System\gZXNeIU.exe
  C:\Windows\System\gZXNeIU.exe
  2⤵
  PID:10064
- C:\Windows\System\APYicfo.exe
  C:\Windows\System\APYicfo.exe
  2⤵
  PID:8884
- C:\Windows\System\NORlqyA.exe
  C:\Windows\System\NORlqyA.exe
  2⤵
  PID:9340
- C:\Windows\System\FauoBYX.exe
  C:\Windows\System\FauoBYX.exe
  2⤵
  PID:9360
- C:\Windows\System\hAKgHUh.exe
  C:\Windows\System\hAKgHUh.exe
  2⤵
  PID:9388
- C:\Windows\System\tDwFjVb.exe
  C:\Windows\System\tDwFjVb.exe
  2⤵
  PID:9444
- C:\Windows\System\fBweeQZ.exe
  C:\Windows\System\fBweeQZ.exe
  2⤵
  PID:9480
- C:\Windows\System\cZdwHMi.exe
  C:\Windows\System\cZdwHMi.exe
  2⤵
  PID:9532
- C:\Windows\System\aOzWzdw.exe
  C:\Windows\System\aOzWzdw.exe
  2⤵
  PID:9580
- C:\Windows\System\UWqHDwi.exe
  C:\Windows\System\UWqHDwi.exe
  2⤵
  PID:9628
- C:\Windows\System\iaTQhgP.exe
  C:\Windows\System\iaTQhgP.exe
  2⤵
  PID:9668
- C:\Windows\System\mLKUboJ.exe
  C:\Windows\System\mLKUboJ.exe
  2⤵
  PID:9720
- C:\Windows\System\YhkGxiA.exe
  C:\Windows\System\YhkGxiA.exe
  2⤵
  PID:9764
- C:\Windows\System\xpFCjMG.exe
  C:\Windows\System\xpFCjMG.exe
  2⤵
  PID:9812
- C:\Windows\System\OzdNmfV.exe
  C:\Windows\System\OzdNmfV.exe
  2⤵
  PID:9864
- C:\Windows\System\aIQpryH.exe
  C:\Windows\System\aIQpryH.exe
  2⤵
  PID:9908
- C:\Windows\System\sOIKsdP.exe
  C:\Windows\System\sOIKsdP.exe
  2⤵
  PID:12312
- C:\Windows\System\uBcAbeE.exe
  C:\Windows\System\uBcAbeE.exe
  2⤵
  PID:12336
- C:\Windows\System\xyVxEKB.exe
  C:\Windows\System\xyVxEKB.exe
  2⤵
  PID:12352
- C:\Windows\System\PKaZbjZ.exe
  C:\Windows\System\PKaZbjZ.exe
  2⤵
  PID:12368
- C:\Windows\System\hsXPhCr.exe
  C:\Windows\System\hsXPhCr.exe
  2⤵
  PID:12384
- C:\Windows\System\QsVFQnD.exe
  C:\Windows\System\QsVFQnD.exe
  2⤵
  PID:12400
- C:\Windows\System\bLEmdhB.exe
  C:\Windows\System\bLEmdhB.exe
  2⤵
  PID:12416
- C:\Windows\System\GjcCseC.exe
  C:\Windows\System\GjcCseC.exe
  2⤵
  PID:12432
- C:\Windows\System\rBeVmjg.exe
  C:\Windows\System\rBeVmjg.exe
  2⤵
  PID:12452
- C:\Windows\System\qBPXrWS.exe
  C:\Windows\System\qBPXrWS.exe
  2⤵
  PID:12476
- C:\Windows\System\mzBLTIF.exe
  C:\Windows\System\mzBLTIF.exe
  2⤵
  PID:12496
- C:\Windows\System\gdRNSVx.exe
  C:\Windows\System\gdRNSVx.exe
  2⤵
  PID:12516
- C:\Windows\System\uCPfrRo.exe
  C:\Windows\System\uCPfrRo.exe
  2⤵
  PID:12532
- C:\Windows\System\dmqdLzv.exe
  C:\Windows\System\dmqdLzv.exe
  2⤵
  PID:12552
- C:\Windows\System\vnaJnqG.exe
  C:\Windows\System\vnaJnqG.exe
  2⤵
  PID:12572
- C:\Windows\System\eydoKwM.exe
  C:\Windows\System\eydoKwM.exe
  2⤵
  PID:12592
- C:\Windows\System\oZhOvKs.exe
  C:\Windows\System\oZhOvKs.exe
  2⤵
  PID:12612
- C:\Windows\System\YpagHku.exe
  C:\Windows\System\YpagHku.exe
  2⤵
  PID:12636
- C:\Windows\System\InLJscP.exe
  C:\Windows\System\InLJscP.exe
  2⤵
  PID:12652
- C:\Windows\System\xEEYhaW.exe
  C:\Windows\System\xEEYhaW.exe
  2⤵
  PID:12668
- C:\Windows\System\smMrMqt.exe
  C:\Windows\System\smMrMqt.exe
  2⤵
  PID:12688
- C:\Windows\System\ZqJfNPB.exe
  C:\Windows\System\ZqJfNPB.exe
  2⤵
  PID:12712
- C:\Windows\System\EEkDETH.exe
  C:\Windows\System\EEkDETH.exe
  2⤵
  PID:12732
- C:\Windows\System\NRhrlNP.exe
  C:\Windows\System\NRhrlNP.exe
  2⤵
  PID:12756
- C:\Windows\System\ZyEPdrb.exe
  C:\Windows\System\ZyEPdrb.exe
  2⤵
  PID:12780
- C:\Windows\System\PYWvnEB.exe
  C:\Windows\System\PYWvnEB.exe
  2⤵
  PID:12804
- C:\Windows\System\zoVjyJA.exe
  C:\Windows\System\zoVjyJA.exe
  2⤵
  PID:12820
- C:\Windows\System\WicBubc.exe
  C:\Windows\System\WicBubc.exe
  2⤵
  PID:12848
- C:\Windows\System\OkZixzD.exe
  C:\Windows\System\OkZixzD.exe
  2⤵
  PID:12872
- C:\Windows\System\HAopMoF.exe
  C:\Windows\System\HAopMoF.exe
  2⤵
  PID:12888
- C:\Windows\System\ZvhDQnP.exe
  C:\Windows\System\ZvhDQnP.exe
  2⤵
  PID:12916
- C:\Windows\System\ZpUvvnW.exe
  C:\Windows\System\ZpUvvnW.exe
  2⤵
  PID:12936
- C:\Windows\System\CBgCTSQ.exe
  C:\Windows\System\CBgCTSQ.exe
  2⤵
  PID:12956
- C:\Windows\System\LPINoKe.exe
  C:\Windows\System\LPINoKe.exe
  2⤵
  PID:12976
- C:\Windows\System\papyMvq.exe
  C:\Windows\System\papyMvq.exe
  2⤵
  PID:13004
- C:\Windows\System\pfrpjvj.exe
  C:\Windows\System\pfrpjvj.exe
  2⤵
  PID:13024
- C:\Windows\System\XUldChu.exe
  C:\Windows\System\XUldChu.exe
  2⤵
  PID:13044
- C:\Windows\System\ZmWPZDg.exe
  C:\Windows\System\ZmWPZDg.exe
  2⤵
  PID:13060
- C:\Windows\System\naqDDVa.exe
  C:\Windows\System\naqDDVa.exe
  2⤵
  PID:13076
- C:\Windows\System\dTNDxbD.exe
  C:\Windows\System\dTNDxbD.exe
  2⤵
  PID:13092
- C:\Windows\System\GtErppC.exe
  C:\Windows\System\GtErppC.exe
  2⤵
  PID:13112
- C:\Windows\System\YSzKbxH.exe
  C:\Windows\System\YSzKbxH.exe
  2⤵
  PID:13132
- C:\Windows\System\xXfiDgJ.exe
  C:\Windows\System\xXfiDgJ.exe
  2⤵
  PID:13160
- C:\Windows\System\IaPPGGH.exe
  C:\Windows\System\IaPPGGH.exe
  2⤵
  PID:13192
- C:\Windows\System\KwFkLas.exe
  C:\Windows\System\KwFkLas.exe
  2⤵
  PID:13216
- C:\Windows\System\xlpFfbs.exe
  C:\Windows\System\xlpFfbs.exe
  2⤵
  PID:13240
- C:\Windows\System\INYgsRu.exe
  C:\Windows\System\INYgsRu.exe
  2⤵
  PID:13268
- C:\Windows\System\SMJEpBi.exe
  C:\Windows\System\SMJEpBi.exe
  2⤵
  PID:13292
- C:\Windows\System\tpvuGwm.exe
  C:\Windows\System\tpvuGwm.exe
  2⤵
  PID:9928
- C:\Windows\System\iKXjlOM.exe
  C:\Windows\System\iKXjlOM.exe
  2⤵
  PID:10000
- C:\Windows\System\HhkhcLx.exe
  C:\Windows\System\HhkhcLx.exe
  2⤵
  PID:10088
- C:\Windows\System\rhNHSDs.exe
  C:\Windows\System\rhNHSDs.exe
  2⤵
  PID:10112
- C:\Windows\System\JoBmRsI.exe
  C:\Windows\System\JoBmRsI.exe
  2⤵
  PID:10160
- C:\Windows\System\biNZEht.exe
  C:\Windows\System\biNZEht.exe
  2⤵
  PID:10208
- C:\Windows\System\KCYoOOd.exe
  C:\Windows\System\KCYoOOd.exe
  2⤵
  PID:8516
- C:\Windows\System\kisJDXt.exe
  C:\Windows\System\kisJDXt.exe
  2⤵
  PID:8604
- C:\Windows\System\djTJjrq.exe
  C:\Windows\System\djTJjrq.exe
  2⤵
  PID:8932
- C:\Windows\System\Yforbdk.exe
  C:\Windows\System\Yforbdk.exe
  2⤵
  PID:11476
- C:\Windows\System\Eeahnby.exe
  C:\Windows\System\Eeahnby.exe
  2⤵
  PID:10932
- C:\Windows\System\nBnJcyO.exe
  C:\Windows\System\nBnJcyO.exe
  2⤵
  PID:11684
- C:\Windows\System\GLFZKoE.exe
  C:\Windows\System\GLFZKoE.exe
  2⤵
  PID:10976
- C:\Windows\System\rPGelIc.exe
  C:\Windows\System\rPGelIc.exe
  2⤵
  PID:11816
- C:\Windows\System\ORYKQTD.exe
  C:\Windows\System\ORYKQTD.exe
  2⤵
  PID:11996
- C:\Windows\System\nwNilRz.exe
  C:\Windows\System\nwNilRz.exe
  2⤵
  PID:12024
- C:\Windows\System\enBrbTF.exe
  C:\Windows\System\enBrbTF.exe
  2⤵
  PID:9316
- C:\Windows\System\BZdNXiY.exe
  C:\Windows\System\BZdNXiY.exe
  2⤵
  PID:8300
- C:\Windows\System\OBvhPQf.exe
  C:\Windows\System\OBvhPQf.exe
  2⤵
  PID:6480
- C:\Windows\System\dNmQeJA.exe
  C:\Windows\System\dNmQeJA.exe
  2⤵
  PID:840
- C:\Windows\System\UpsAUDb.exe
  C:\Windows\System\UpsAUDb.exe
  2⤵
  PID:12204
- C:\Windows\System\MSjUhGZ.exe
  C:\Windows\System\MSjUhGZ.exe
  2⤵
  PID:12280
- C:\Windows\System\xTjdSbv.exe
  C:\Windows\System\xTjdSbv.exe
  2⤵
  PID:10864
- C:\Windows\System\BlGNSvH.exe
  C:\Windows\System\BlGNSvH.exe
  2⤵
  PID:9300
- C:\Windows\System\cEpCafi.exe
  C:\Windows\System\cEpCafi.exe
  2⤵
  PID:4364
- C:\Windows\System\puhvlAS.exe
  C:\Windows\System\puhvlAS.exe
  2⤵
  PID:9516
- C:\Windows\System\JaJDuzA.exe
  C:\Windows\System\JaJDuzA.exe
  2⤵
  PID:13324
- C:\Windows\System\XRyrbsp.exe
  C:\Windows\System\XRyrbsp.exe
  2⤵
  PID:13728
- C:\Windows\System\UEbfzul.exe
  C:\Windows\System\UEbfzul.exe
  2⤵
  PID:13744
- C:\Windows\System\XKqoZxb.exe
  C:\Windows\System\XKqoZxb.exe
  2⤵
  PID:13760
- C:\Windows\System\KyRREFr.exe
  C:\Windows\System\KyRREFr.exe
  2⤵
  PID:13780
- C:\Windows\System\UWZLmsr.exe
  C:\Windows\System\UWZLmsr.exe
  2⤵
  PID:13800
- C:\Windows\System\CtjDBzA.exe
  C:\Windows\System\CtjDBzA.exe
  2⤵
  PID:13820
- C:\Windows\System\zdLGMEP.exe
  C:\Windows\System\zdLGMEP.exe
  2⤵
  PID:13840
- C:\Windows\System\CQCGPVg.exe
  C:\Windows\System\CQCGPVg.exe
  2⤵
  PID:13864
- C:\Windows\System\fVSPsjq.exe
  C:\Windows\System\fVSPsjq.exe
  2⤵
  PID:13880
- C:\Windows\System\REuQmHw.exe
  C:\Windows\System\REuQmHw.exe
  2⤵
  PID:13896
- C:\Windows\System\GvWqPNd.exe
  C:\Windows\System\GvWqPNd.exe
  2⤵
  PID:13916
- C:\Windows\System\KJDBvhJ.exe
  C:\Windows\System\KJDBvhJ.exe
  2⤵
  PID:13936
- C:\Windows\System\xlGMulh.exe
  C:\Windows\System\xlGMulh.exe
  2⤵
  PID:13956
- C:\Windows\System\CAmRyGH.exe
  C:\Windows\System\CAmRyGH.exe
  2⤵
  PID:13972
- C:\Windows\System\PwCuLjg.exe
  C:\Windows\System\PwCuLjg.exe
  2⤵
  PID:13992
- C:\Windows\System\VnqNbAh.exe
  C:\Windows\System\VnqNbAh.exe
  2⤵
  PID:14016
- C:\Windows\System\HGwOuNu.exe
  C:\Windows\System\HGwOuNu.exe
  2⤵
  PID:14036
- C:\Windows\System\kZjvpzF.exe
  C:\Windows\System\kZjvpzF.exe
  2⤵
  PID:14056
- C:\Windows\System\yWLiBDT.exe
  C:\Windows\System\yWLiBDT.exe
  2⤵
  PID:14080
- C:\Windows\System\HqrxXCF.exe
  C:\Windows\System\HqrxXCF.exe
  2⤵
  PID:14100
- C:\Windows\System\NVMXNfz.exe
  C:\Windows\System\NVMXNfz.exe
  2⤵
  PID:14244
- C:\Windows\System\ymPxFIr.exe
  C:\Windows\System\ymPxFIr.exe
  2⤵
  PID:14264
- C:\Windows\System\XQwNeXD.exe
  C:\Windows\System\XQwNeXD.exe
  2⤵
  PID:10708
- C:\Windows\System\iOIUbHg.exe
  C:\Windows\System\iOIUbHg.exe
  2⤵
  PID:12304
- C:\Windows\System\nOHjerx.exe
  C:\Windows\System\nOHjerx.exe
  2⤵
  PID:10352
- C:\Windows\System\RUChgbq.exe
  C:\Windows\System\RUChgbq.exe
  2⤵
  PID:11424
- C:\Windows\System\vslXTOI.exe
  C:\Windows\System\vslXTOI.exe
  2⤵
  PID:12564
- C:\Windows\System\WexWbIR.exe
  C:\Windows\System\WexWbIR.exe
  2⤵
  PID:11732
- C:\Windows\System\kVAFnxg.exe
  C:\Windows\System\kVAFnxg.exe
  2⤵
  PID:3896
- C:\Windows\System\bCsjhlt.exe
  C:\Windows\System\bCsjhlt.exe
  2⤵
  PID:10080
- C:\Windows\System\LfgEImT.exe
  C:\Windows\System\LfgEImT.exe
  2⤵
  PID:8024
- C:\Windows\System\iYYIAnm.exe
  C:\Windows\System\iYYIAnm.exe
  2⤵
  PID:8380
- C:\Windows\System\LjkErVQ.exe
  C:\Windows\System\LjkErVQ.exe
  2⤵
  PID:9420
- C:\Windows\System\ZEQHxGX.exe
  C:\Windows\System\ZEQHxGX.exe
  2⤵
  PID:13368
- C:\Windows\System\flWoDXv.exe
  C:\Windows\System\flWoDXv.exe
  2⤵
  PID:13408
- C:\Windows\System\dUXtJGF.exe
  C:\Windows\System\dUXtJGF.exe
  2⤵
  PID:13436
- C:\Windows\System\vZjPzYW.exe
  C:\Windows\System\vZjPzYW.exe
  2⤵
  PID:13480
- C:\Windows\System\CVCVvFc.exe
  C:\Windows\System\CVCVvFc.exe
  2⤵
  PID:13508
- C:\Windows\System\YFSNiJY.exe
  C:\Windows\System\YFSNiJY.exe
  2⤵
  PID:2984
- C:\Windows\System\PRywGyl.exe
  C:\Windows\System\PRywGyl.exe
  2⤵
  PID:13720
- C:\Windows\System\lFuIGfw.exe
  C:\Windows\System\lFuIGfw.exe
  2⤵
  PID:4712
- C:\Windows\System\joUgBvP.exe
  C:\Windows\System\joUgBvP.exe
  2⤵
  PID:4536
- C:\Windows\System\krVmQNI.exe
  C:\Windows\System\krVmQNI.exe
  2⤵
  PID:4796
- C:\Windows\System\cbHluNU.exe
  C:\Windows\System\cbHluNU.exe
  2⤵
  PID:3516
- C:\Windows\System\NKYfjBD.exe
  C:\Windows\System\NKYfjBD.exe
  2⤵
  PID:4088
- C:\Windows\System\VbzOAtp.exe
  C:\Windows\System\VbzOAtp.exe
  2⤵
  PID:2644
- C:\Windows\System\tzlmPON.exe
  C:\Windows\System\tzlmPON.exe
  2⤵
  PID:3504
- C:\Windows\System\QcnhUJt.exe
  C:\Windows\System\QcnhUJt.exe
  2⤵
  PID:13872
- C:\Windows\System\SfJirGd.exe
  C:\Windows\System\SfJirGd.exe
  2⤵
  PID:13912
- C:\Windows\System\MrFvzdA.exe
  C:\Windows\System\MrFvzdA.exe
  2⤵
  PID:13644
- C:\Windows\System\HAomavP.exe
  C:\Windows\System\HAomavP.exe
  2⤵
  PID:10496
- C:\Windows\System\cUxSzPH.exe
  C:\Windows\System\cUxSzPH.exe
  2⤵
  PID:9604
- C:\Windows\System\BXYwlyO.exe
  C:\Windows\System\BXYwlyO.exe
  2⤵
  PID:9792
- C:\Windows\System\lYgoppP.exe
  C:\Windows\System\lYgoppP.exe
  2⤵
  PID:14032
- C:\Windows\System\acBUoGN.exe
  C:\Windows\System\acBUoGN.exe
  2⤵
  PID:14116
- C:\Windows\System\yqLihet.exe
  C:\Windows\System\yqLihet.exe
  2⤵
  PID:10332
- C:\Windows\System\uLDMtIW.exe
  C:\Windows\System\uLDMtIW.exe
  2⤵
  PID:14172
- C:\Windows\System\RMgcemi.exe
  C:\Windows\System\RMgcemi.exe
  2⤵
  PID:13756
- C:\Windows\System\MRbpuaF.exe
  C:\Windows\System\MRbpuaF.exe
  2⤵
  PID:10416
- C:\Windows\System\Ldxkpnu.exe
  C:\Windows\System\Ldxkpnu.exe
  2⤵
  PID:11492
- C:\Windows\System\GVOuiUk.exe
  C:\Windows\System\GVOuiUk.exe
  2⤵
  PID:4468
- C:\Windows\System\QdPpPSZ.exe
  C:\Windows\System\QdPpPSZ.exe
  2⤵
  PID:13648
- C:\Windows\System\nQwPERX.exe
  C:\Windows\System\nQwPERX.exe
  2⤵
  PID:11208
- C:\Windows\System\MxkoBVY.exe
  C:\Windows\System\MxkoBVY.exe
  2⤵
  PID:12984
- C:\Windows\System\ohucpEn.exe
  C:\Windows\System\ohucpEn.exe
  2⤵
  PID:2800
- C:\Windows\System\pdkKbnJ.exe
  C:\Windows\System\pdkKbnJ.exe
  2⤵
  PID:11316
- C:\Windows\System\fDYmRjx.exe
  C:\Windows\System\fDYmRjx.exe
  2⤵
  PID:11664
- C:\Windows\System\mziqIrG.exe
  C:\Windows\System\mziqIrG.exe
  2⤵
  PID:12108
- C:\Windows\System\RBQZkQI.exe
  C:\Windows\System\RBQZkQI.exe
  2⤵
  PID:13500
- C:\Windows\System\IkKIDYR.exe
  C:\Windows\System\IkKIDYR.exe
  2⤵
  PID:2008
- C:\Windows\System\CuDuOzz.exe
  C:\Windows\System\CuDuOzz.exe
  2⤵
  PID:3508
- C:\Windows\System\CocYgex.exe
  C:\Windows\System\CocYgex.exe
  2⤵
  PID:892
- C:\Windows\System\VcqUgKC.exe
  C:\Windows\System\VcqUgKC.exe
  2⤵
  PID:2872
- C:\Windows\System\PDhjjTd.exe
  C:\Windows\System\PDhjjTd.exe
  2⤵
  PID:2012
- C:\Windows\System\RvqtErv.exe
  C:\Windows\System\RvqtErv.exe
  2⤵
  PID:404
- C:\Windows\System\BQWyDZT.exe
  C:\Windows\System\BQWyDZT.exe
  2⤵
  PID:9172
- C:\Windows\System\dFnsvLN.exe
  C:\Windows\System\dFnsvLN.exe
  2⤵
  PID:14284
- C:\Windows\System\rOPnIwO.exe
  C:\Windows\System\rOPnIwO.exe
  2⤵
  PID:14332
- C:\Windows\System\vofKlsN.exe
  C:\Windows\System\vofKlsN.exe
  2⤵
  PID:4100
- C:\Windows\System\eYzBvXc.exe
  C:\Windows\System\eYzBvXc.exe
  2⤵
  PID:1064
- C:\Windows\System\tCEQFZl.exe
  C:\Windows\System\tCEQFZl.exe
  2⤵
  PID:10476
- C:\Windows\System\wSpbjks.exe
  C:\Windows\System\wSpbjks.exe
  2⤵
  PID:3568
- C:\Windows\System\vJUOROf.exe
  C:\Windows\System\vJUOROf.exe
  2⤵
  PID:9240
- C:\Windows\System\BqQzQBf.exe
  C:\Windows\System\BqQzQBf.exe
  2⤵
  PID:13056
- C:\Windows\System\RKORysW.exe
  C:\Windows\System\RKORysW.exe
  2⤵
  PID:9496
- C:\Windows\System\ttWXdPz.exe
  C:\Windows\System\ttWXdPz.exe
  2⤵
  PID:12464
- C:\Windows\System\GIfxvDG.exe
  C:\Windows\System\GIfxvDG.exe
  2⤵
  PID:11836
- C:\Windows\System\SDucAZa.exe
  C:\Windows\System\SDucAZa.exe
  2⤵
  PID:796
- C:\Windows\System\QkIgQhP.exe
  C:\Windows\System\QkIgQhP.exe
  2⤵
  PID:13532
- C:\Windows\System\cWwlbch.exe
  C:\Windows\System\cWwlbch.exe
  2⤵
  PID:12016
- C:\Windows\System\EakuxaK.exe
  C:\Windows\System\EakuxaK.exe
  2⤵
  PID:4028
- C:\Windows\System\PWVuTyL.exe
  C:\Windows\System\PWVuTyL.exe
  2⤵
  PID:14320
- C:\Windows\System\jiDPZpq.exe
  C:\Windows\System\jiDPZpq.exe
  2⤵
  PID:11044
- C:\Windows\System\AZdoyNW.exe
  C:\Windows\System\AZdoyNW.exe
  2⤵
  PID:9784
- C:\Windows\System\CFJGPHH.exe
  C:\Windows\System\CFJGPHH.exe
  2⤵
  PID:13892
- C:\Windows\System\rUEgPtc.exe
  C:\Windows\System\rUEgPtc.exe
  2⤵
  PID:10548
- C:\Windows\System\IapyELV.exe
  C:\Windows\System\IapyELV.exe
  2⤵
  PID:11420
- C:\Windows\System\megnnvL.exe
  C:\Windows\System\megnnvL.exe
  2⤵
  PID:10020
- C:\Windows\System\nGlYapb.exe
  C:\Windows\System\nGlYapb.exe
  2⤵
  PID:3640
- C:\Windows\System\KEOifKK.exe
  C:\Windows\System\KEOifKK.exe
  2⤵
  PID:4852
- C:\Windows\System\pepklBv.exe
  C:\Windows\System\pepklBv.exe
  2⤵
  PID:10584
- C:\Windows\System\YavobeE.exe
  C:\Windows\System\YavobeE.exe
  2⤵
  PID:11884
- C:\Windows\System\WBPyUVU.exe
  C:\Windows\System\WBPyUVU.exe
  2⤵
  PID:3192
- C:\Windows\System\OtbeHdA.exe
  C:\Windows\System\OtbeHdA.exe
  2⤵
  PID:13496
- C:\Windows\System\vWzGcJe.exe
  C:\Windows\System\vWzGcJe.exe
  2⤵
  PID:14196
- C:\Windows\System\dCuYoKj.exe
  C:\Windows\System\dCuYoKj.exe
  2⤵
  PID:11600
- C:\Windows\System\kctyFLo.exe
  C:\Windows\System\kctyFLo.exe
  2⤵
  PID:1312
- C:\Windows\System\WitkxLD.exe
  C:\Windows\System\WitkxLD.exe
  2⤵
  PID:13560
- C:\Windows\System\rDmByKM.exe
  C:\Windows\System\rDmByKM.exe
  2⤵
  PID:10632
- C:\Windows\System\RxjZEfq.exe
  C:\Windows\System\RxjZEfq.exe
  2⤵
  PID:14176
- C:\Windows\System\hYxGQkq.exe
  C:\Windows\System\hYxGQkq.exe
  2⤵
  PID:10356
- C:\Windows\System\eNMXrnv.exe
  C:\Windows\System\eNMXrnv.exe
  2⤵
  PID:10552
- C:\Windows\System\PrpozwR.exe
  C:\Windows\System\PrpozwR.exe
  2⤵
  PID:14136
- C:\Windows\System\YwWsoDz.exe
  C:\Windows\System\YwWsoDz.exe
  2⤵
  PID:5060
- C:\Windows\System\uafaizE.exe
  C:\Windows\System\uafaizE.exe
  2⤵
  PID:14236
- C:\Windows\System\uXjOeHR.exe
  C:\Windows\System\uXjOeHR.exe
  2⤵
  PID:14012
- C:\Windows\System\hdKekgA.exe
  C:\Windows\System\hdKekgA.exe
  2⤵
  PID:7208
- C:\Windows\System\OpWaCYv.exe
  C:\Windows\System\OpWaCYv.exe
  2⤵
  PID:14204
- C:\Windows\System\ACdjEaB.exe
  C:\Windows\System\ACdjEaB.exe
  2⤵
  PID:11040
- C:\Windows\System\QsCMRyi.exe
  C:\Windows\System\QsCMRyi.exe
  2⤵
  PID:10308
- C:\Windows\System\EMHntmE.exe
  C:\Windows\System\EMHntmE.exe
  2⤵
  PID:4688
- C:\Windows\System\yUgXWbO.exe
  C:\Windows\System\yUgXWbO.exe
  2⤵
  PID:14272
- C:\Windows\System\QVlBhLu.exe
  C:\Windows\System\QVlBhLu.exe
  2⤵
  PID:12700
- C:\Windows\System\BSwnGTD.exe
  C:\Windows\System\BSwnGTD.exe
  2⤵
  PID:2184
- C:\Windows\System\pOdaOIG.exe
  C:\Windows\System\pOdaOIG.exe
  2⤵
  PID:10420
- C:\Windows\System\QgUaMdm.exe
  C:\Windows\System\QgUaMdm.exe
  2⤵
  PID:1124
- C:\Windows\System\ThOgFmY.exe
  C:\Windows\System\ThOgFmY.exe
  2⤵
  PID:11072
- C:\Windows\System\lAHuTCF.exe
  C:\Windows\System\lAHuTCF.exe
  2⤵
  PID:4996
- C:\Windows\System\HAhNzoD.exe
  C:\Windows\System\HAhNzoD.exe
  2⤵
  PID:11840
- C:\Windows\System\uHunloK.exe
  C:\Windows\System\uHunloK.exe
  2⤵
  PID:4296
- C:\Windows\System\lHvyazR.exe
  C:\Windows\System\lHvyazR.exe
  2⤵
  PID:12764
- C:\Windows\System\XKyQXjE.exe
  C:\Windows\System\XKyQXjE.exe
  2⤵
  PID:2988
- C:\Windows\System\taxVbmp.exe
  C:\Windows\System\taxVbmp.exe
  2⤵
  PID:10316
- C:\Windows\System\SpQOdXi.exe
  C:\Windows\System\SpQOdXi.exe
  2⤵
  PID:4628
- C:\Windows\System\MFWRMNX.exe
  C:\Windows\System\MFWRMNX.exe
  2⤵
  PID:13428
- C:\Windows\System\HULfrsY.exe
  C:\Windows\System\HULfrsY.exe
  2⤵
  PID:10336
- C:\Windows\System\LUsigGT.exe
  C:\Windows\System\LUsigGT.exe
  2⤵
  PID:3156
- C:\Windows\System\TuTjWMo.exe
  C:\Windows\System\TuTjWMo.exe
  2⤵
  PID:7188
- C:\Windows\System\viynyJJ.exe
  C:\Windows\System\viynyJJ.exe
  2⤵
  PID:10436
- C:\Windows\System\EskYubu.exe
  C:\Windows\System\EskYubu.exe
  2⤵
  PID:13544
- C:\Windows\System\pcrNgqL.exe
  C:\Windows\System\pcrNgqL.exe
  2⤵
  PID:8608
- C:\Windows\System\Vpedczn.exe
  C:\Windows\System\Vpedczn.exe
  2⤵
  PID:3076
- C:\Windows\System\EpUjYwk.exe
  C:\Windows\System\EpUjYwk.exe
  2⤵
  PID:372
- C:\Windows\System\XtFxXOb.exe
  C:\Windows\System\XtFxXOb.exe
  2⤵
  PID:4512
- C:\Windows\System\KLlAdZA.exe
  C:\Windows\System\KLlAdZA.exe
  2⤵
  PID:11028
- C:\Windows\System\UcFLEYe.exe
  C:\Windows\System\UcFLEYe.exe
  2⤵
  PID:13836
- C:\Windows\System\TcMtLdX.exe
  C:\Windows\System\TcMtLdX.exe
  2⤵
  PID:3184
- C:\Windows\System\NGDpxGu.exe
  C:\Windows\System\NGDpxGu.exe
  2⤵
  PID:10836
- C:\Windows\System\XwykKuv.exe
  C:\Windows\System\XwykKuv.exe
  2⤵
  PID:10388
- C:\Windows\System\ncSnDiC.exe
  C:\Windows\System\ncSnDiC.exe
  2⤵
  PID:1256
- C:\Windows\System\PGoalAs.exe
  C:\Windows\System\PGoalAs.exe
  2⤵
  PID:736
- C:\Windows\System\TOcKtLD.exe
  C:\Windows\System\TOcKtLD.exe
  2⤵
  PID:2796
- C:\Windows\System\IzUeTca.exe
  C:\Windows\System\IzUeTca.exe
  2⤵
  PID:12928
- C:\Windows\System\eibwhDE.exe
  C:\Windows\System\eibwhDE.exe
  2⤵
  PID:8500
- C:\Windows\System\JZLwFtn.exe
  C:\Windows\System\JZLwFtn.exe
  2⤵
  PID:13888
- C:\Windows\System\nVaXByJ.exe
  C:\Windows\System\nVaXByJ.exe
  2⤵
  PID:5148
- C:\Windows\System\FkaRpup.exe
  C:\Windows\System\FkaRpup.exe
  2⤵
  PID:2688
- C:\Windows\System\UpKEnMZ.exe
  C:\Windows\System\UpKEnMZ.exe
  2⤵
  PID:4304
- C:\Windows\System\RBOhrkn.exe
  C:\Windows\System\RBOhrkn.exe
  2⤵
  PID:12228
- C:\Windows\System\npfmKgP.exe
  C:\Windows\System\npfmKgP.exe
  2⤵
  PID:3468
- C:\Windows\System\knZFuwM.exe
  C:\Windows\System\knZFuwM.exe
  2⤵
  PID:14140
- C:\Windows\System\DmQbDmG.exe
  C:\Windows\System\DmQbDmG.exe
  2⤵
  PID:11340
- C:\Windows\System\PXIJoNs.exe
  C:\Windows\System\PXIJoNs.exe
  2⤵
  PID:11756
- C:\Windows\System\ztREjUF.exe
  C:\Windows\System\ztREjUF.exe
  2⤵
  PID:5552
- C:\Windows\System\ScGDuHU.exe
  C:\Windows\System\ScGDuHU.exe
  2⤵
  PID:5652
- C:\Windows\System\lQlrfGp.exe
  C:\Windows\System\lQlrfGp.exe
  2⤵
  PID:5688
- C:\Windows\System\HiMwzdO.exe
  C:\Windows\System\HiMwzdO.exe
  2⤵
  PID:5204
- C:\Windows\System\swtwpPn.exe
  C:\Windows\System\swtwpPn.exe
  2⤵
  PID:5776
- C:\Windows\System\ESEdNST.exe
  C:\Windows\System\ESEdNST.exe
  2⤵
  PID:5116
- C:\Windows\System\LqEyQHj.exe
  C:\Windows\System\LqEyQHj.exe
  2⤵
  PID:5860
- C:\Windows\System\wPGeqEO.exe
  C:\Windows\System\wPGeqEO.exe
  2⤵
  PID:13984
- C:\Windows\System\FHmGBdI.exe
  C:\Windows\System\FHmGBdI.exe
  2⤵
  PID:9900
- C:\Windows\System\uDMLrzE.exe
  C:\Windows\System\uDMLrzE.exe
  2⤵
  PID:5944
- C:\Windows\System\zyvafDt.exe
  C:\Windows\System\zyvafDt.exe
  2⤵
  PID:1628
- C:\Windows\System\mrckSfo.exe
  C:\Windows\System\mrckSfo.exe
  2⤵
  PID:13492
- C:\Windows\System\SGgNkIw.exe
  C:\Windows\System\SGgNkIw.exe
  2⤵
  PID:6056
- C:\Windows\System\biYAZUB.exe
  C:\Windows\System\biYAZUB.exe
  2⤵
  PID:5956
- C:\Windows\System\wXwbSML.exe
  C:\Windows\System\wXwbSML.exe
  2⤵
  PID:5376
- C:\Windows\System\IzGqYyC.exe
  C:\Windows\System\IzGqYyC.exe
  2⤵
  PID:5840
- C:\Windows\System\bwBzzpu.exe
  C:\Windows\System\bwBzzpu.exe
  2⤵
  PID:4396
- C:\Windows\System\pJdBTsY.exe
  C:\Windows\System\pJdBTsY.exe
  2⤵
  PID:5772
- C:\Windows\System\oUnExoy.exe
  C:\Windows\System\oUnExoy.exe
  2⤵
  PID:4332
- C:\Windows\System\hOnNBlP.exe
  C:\Windows\System\hOnNBlP.exe
  2⤵
  PID:2004
- C:\Windows\System\JBQOKee.exe
  C:\Windows\System\JBQOKee.exe
  2⤵
  PID:4764
- C:\Windows\System\tJNKvZE.exe
  C:\Windows\System\tJNKvZE.exe
  2⤵
  PID:5716
- C:\Windows\System\CQWGmlV.exe
  C:\Windows\System\CQWGmlV.exe
  2⤵
  PID:3092
- C:\Windows\System\ZTEPXgm.exe
  C:\Windows\System\ZTEPXgm.exe
  2⤵
  PID:6188
- C:\Windows\System\cbRjGcF.exe
  C:\Windows\System\cbRjGcF.exe
  2⤵
  PID:14240
- C:\Windows\System\pPSQEas.exe
  C:\Windows\System\pPSQEas.exe
  2⤵
  PID:14252
- C:\Windows\System\jNKOiHg.exe
  C:\Windows\System\jNKOiHg.exe
  2⤵
  PID:6016
- C:\Windows\System\vaZEtRC.exe
  C:\Windows\System\vaZEtRC.exe
  2⤵
  PID:6256
- C:\Windows\System\wavXohQ.exe
  C:\Windows\System\wavXohQ.exe
  2⤵
  PID:6268
- C:\Windows\System\cCZsFIl.exe
  C:\Windows\System\cCZsFIl.exe
  2⤵
  PID:6048
- C:\Windows\System\XaDNMga.exe
  C:\Windows\System\XaDNMga.exe
  2⤵
  PID:6304
- C:\Windows\System\KmqmKQR.exe
  C:\Windows\System\KmqmKQR.exe
  2⤵
  PID:11928
- C:\Windows\System\qUTlTlh.exe
  C:\Windows\System\qUTlTlh.exe
  2⤵
  PID:5576
- C:\Windows\System\oDZoWeK.exe
  C:\Windows\System\oDZoWeK.exe
  2⤵
  PID:6376
- C:\Windows\System\aUtBUaa.exe
  C:\Windows\System\aUtBUaa.exe
  2⤵
  PID:5456
- C:\Windows\System\KKetNyT.exe
  C:\Windows\System\KKetNyT.exe
  2⤵
  PID:5312
- C:\Windows\System\jtUEBNv.exe
  C:\Windows\System\jtUEBNv.exe
  2⤵
  PID:12728
- C:\Windows\System\QZynuuQ.exe
  C:\Windows\System\QZynuuQ.exe
  2⤵
  PID:2440
- C:\Windows\System\DiRwsbh.exe
  C:\Windows\System\DiRwsbh.exe
  2⤵
  PID:6488
- C:\Windows\System\HknSvXz.exe
  C:\Windows\System\HknSvXz.exe
  2⤵
  PID:2244
- C:\Windows\System\LsCpTxP.exe
  C:\Windows\System\LsCpTxP.exe
  2⤵
  PID:2572
- C:\Windows\System\aZMVMOh.exe
  C:\Windows\System\aZMVMOh.exe
  2⤵
  PID:6404
- C:\Windows\System\tvxEmkz.exe
  C:\Windows\System\tvxEmkz.exe
  2⤵
  PID:5480
- C:\Windows\System\xWmiwPj.exe
  C:\Windows\System\xWmiwPj.exe
  2⤵
  PID:5540
- C:\Windows\System\OnWTMVE.exe
  C:\Windows\System\OnWTMVE.exe
  2⤵
  PID:1852
- C:\Windows\System\HHBnDTY.exe
  C:\Windows\System\HHBnDTY.exe
  2⤵
  PID:5288
- C:\Windows\System\UhOHhMv.exe
  C:\Windows\System\UhOHhMv.exe
  2⤵
  PID:5904
- C:\Windows\System\bYlWHFd.exe
  C:\Windows\System\bYlWHFd.exe
  2⤵
  PID:5796
- C:\Windows\System\UuXylel.exe
  C:\Windows\System\UuXylel.exe
  2⤵
  PID:5052
- C:\Windows\System\EtPqSwy.exe
  C:\Windows\System\EtPqSwy.exe
  2⤵
  PID:7032
- C:\Windows\System\dlzJMHn.exe
  C:\Windows\System\dlzJMHn.exe
  2⤵
  PID:4208
- C:\Windows\System\PAFyYEJ.exe
  C:\Windows\System\PAFyYEJ.exe
  2⤵
  PID:2568
- C:\Windows\System\ZvWfRmh.exe
  C:\Windows\System\ZvWfRmh.exe
  2⤵
  PID:6812
- C:\Windows\System\NTPtdVp.exe
  C:\Windows\System\NTPtdVp.exe
  2⤵
  PID:6420
- C:\Windows\System\peFfsTd.exe
  C:\Windows\System\peFfsTd.exe
  2⤵
  PID:13596
- C:\Windows\System\KdoYYTS.exe
  C:\Windows\System\KdoYYTS.exe
  2⤵
  PID:5448
- C:\Windows\System\nGPrzAe.exe
  C:\Windows\System\nGPrzAe.exe
  2⤵
  PID:6860
- C:\Windows\System\TPwVxZN.exe
  C:\Windows\System\TPwVxZN.exe
  2⤵
  PID:6308
- C:\Windows\System\NVRvUlS.exe
  C:\Windows\System\NVRvUlS.exe
  2⤵
  PID:5884
- C:\Windows\System\hkXjRdR.exe
  C:\Windows\System\hkXjRdR.exe
  2⤵
  PID:3300
- C:\Windows\System\VlIjfxP.exe
  C:\Windows\System\VlIjfxP.exe
  2⤵
  PID:5872
- C:\Windows\System\GXxULUL.exe
  C:\Windows\System\GXxULUL.exe
  2⤵
  PID:6208
- C:\Windows\System\hHerfEm.exe
  C:\Windows\System\hHerfEm.exe
  2⤵
  PID:4344
- C:\Windows\System\mZPntBh.exe
  C:\Windows\System\mZPntBh.exe
  2⤵
  PID:6768
- C:\Windows\System\xcnbtxT.exe
  C:\Windows\System\xcnbtxT.exe
  2⤵
  PID:6356
- C:\Windows\System\agkmOUB.exe
  C:\Windows\System\agkmOUB.exe
  2⤵
  PID:6848
- C:\Windows\System\LAWWqYR.exe
  C:\Windows\System\LAWWqYR.exe
  2⤵
  PID:8000
- C:\Windows\System\bQXQQyd.exe
  C:\Windows\System\bQXQQyd.exe
  2⤵
  PID:7792
- C:\Windows\System\UOtwfZG.exe
  C:\Windows\System\UOtwfZG.exe
  2⤵
  PID:5464
- C:\Windows\System\LmVEGvC.exe
  C:\Windows\System\LmVEGvC.exe
  2⤵
  PID:6832
- C:\Windows\System\PvvUAlJ.exe
  C:\Windows\System\PvvUAlJ.exe
  2⤵
  PID:6644
- C:\Windows\System\IniQeUd.exe
  C:\Windows\System\IniQeUd.exe
  2⤵
  PID:6180
- C:\Windows\System\XNzZieB.exe
  C:\Windows\System\XNzZieB.exe
  2⤵
  PID:7420
- C:\Windows\System\zNXxiJf.exe
  C:\Windows\System\zNXxiJf.exe
  2⤵
  PID:14216
- C:\Windows\System\pEqDgMf.exe
  C:\Windows\System\pEqDgMf.exe
  2⤵
  PID:14352
- C:\Windows\System\xutRRem.exe
  C:\Windows\System\xutRRem.exe
  2⤵
  PID:14380
- C:\Windows\System\TDOSKmV.exe
  C:\Windows\System\TDOSKmV.exe
  2⤵
  PID:14408
- C:\Windows\System\cIViyop.exe
  C:\Windows\System\cIViyop.exe
  2⤵
  PID:14436
- C:\Windows\System\pCKBCBt.exe
  C:\Windows\System\pCKBCBt.exe
  2⤵
  PID:14468
- C:\Windows\System\tCuCDfF.exe
  C:\Windows\System\tCuCDfF.exe
  2⤵
  PID:14492
- C:\Windows\System\FChPekm.exe
  C:\Windows\System\FChPekm.exe
  2⤵
  PID:14520
- C:\Windows\System\NUBqkxn.exe
  C:\Windows\System\NUBqkxn.exe
  2⤵
  PID:14536
- C:\Windows\System\UovQKRd.exe
  C:\Windows\System\UovQKRd.exe
  2⤵
  PID:14552
- C:\Windows\System\hiMTINt.exe
  C:\Windows\System\hiMTINt.exe
  2⤵
  PID:14584
- C:\Windows\System\ZlZkBhn.exe
  C:\Windows\System\ZlZkBhn.exe
  2⤵
  PID:14604
- C:\Windows\System\xgbxNQJ.exe
  C:\Windows\System\xgbxNQJ.exe
  2⤵
  PID:14624
- C:\Windows\System\ynDyIXS.exe
  C:\Windows\System\ynDyIXS.exe
  2⤵
  PID:14648
- C:\Windows\System\pcEawQC.exe
  C:\Windows\System\pcEawQC.exe
  2⤵
  PID:14676
- C:\Windows\System\BnzdnvD.exe
  C:\Windows\System\BnzdnvD.exe
  2⤵
  PID:14704
- C:\Windows\System\AXladCH.exe
  C:\Windows\System\AXladCH.exe
  2⤵
  PID:14732
- C:\Windows\System\zwUiJkd.exe
  C:\Windows\System\zwUiJkd.exe
  2⤵
  PID:14880
- C:\Windows\System\OQYstCy.exe
  C:\Windows\System\OQYstCy.exe
  2⤵
  PID:14960
- C:\Windows\System\FAeqiUf.exe
  C:\Windows\System\FAeqiUf.exe
  2⤵
  PID:14988
- C:\Windows\System\yhwDUMs.exe
  C:\Windows\System\yhwDUMs.exe
  2⤵
  PID:15016
- C:\Windows\System\aQISiWD.exe
  C:\Windows\System\aQISiWD.exe
  2⤵
  PID:15040
- C:\Windows\System\tOGqvQZ.exe
  C:\Windows\System\tOGqvQZ.exe
  2⤵
  PID:15068
- C:\Windows\System\qDaSMYF.exe
  C:\Windows\System\qDaSMYF.exe
  2⤵
  PID:15100
- C:\Windows\System\QJkeuNm.exe
  C:\Windows\System\QJkeuNm.exe
  2⤵
  PID:15148
- C:\Windows\System\FbhoFIV.exe
  C:\Windows\System\FbhoFIV.exe
  2⤵
  PID:15224
- C:\Windows\System\ZUrVzLu.exe
  C:\Windows\System\ZUrVzLu.exe
  2⤵
  PID:15244
- C:\Windows\System\ShhLbCw.exe
  C:\Windows\System\ShhLbCw.exe
  2⤵
  PID:15264
- C:\Windows\System\NpgUaZh.exe
  C:\Windows\System\NpgUaZh.exe
  2⤵
  PID:15292
- C:\Windows\System\eVSQFIb.exe
  C:\Windows\System\eVSQFIb.exe
  2⤵
  PID:15316
- C:\Windows\System\VIOBqIO.exe
  C:\Windows\System\VIOBqIO.exe
  2⤵
  PID:15352
- C:\Windows\System\CFOkhqh.exe
  C:\Windows\System\CFOkhqh.exe
  2⤵
  PID:6772
- C:\Windows\System\FmvQpxp.exe
  C:\Windows\System\FmvQpxp.exe
  2⤵
  PID:6724
- C:\Windows\System\VuqTncX.exe
  C:\Windows\System\VuqTncX.exe
  2⤵
  PID:6804
- C:\Windows\System\qusZzsn.exe
  C:\Windows\System\qusZzsn.exe
  2⤵
  PID:7360
- C:\Windows\System\MwUFkhJ.exe
  C:\Windows\System\MwUFkhJ.exe
  2⤵
  PID:7720
- C:\Windows\System\xAVdSgc.exe
  C:\Windows\System\xAVdSgc.exe
  2⤵
  PID:14416
- C:\Windows\System\zMMhMWl.exe
  C:\Windows\System\zMMhMWl.exe
  2⤵
  PID:14452
- C:\Windows\System\itvgWRb.exe
  C:\Windows\System\itvgWRb.exe
  2⤵
  PID:7620
- C:\Windows\System\IBHvnXP.exe
  C:\Windows\System\IBHvnXP.exe
  2⤵
  PID:7648
- C:\Windows\System\sBVCgEs.exe
  C:\Windows\System\sBVCgEs.exe
  2⤵
  PID:7808
- C:\Windows\System\RZaxusO.exe
  C:\Windows\System\RZaxusO.exe
  2⤵
  PID:14424
- C:\Windows\System\YSZzwUG.exe
  C:\Windows\System\YSZzwUG.exe
  2⤵
  PID:14456
- C:\Windows\System\ANiHUwp.exe
  C:\Windows\System\ANiHUwp.exe
  2⤵
  PID:14504
- C:\Windows\System\SriJqGk.exe
  C:\Windows\System\SriJqGk.exe
  2⤵
  PID:14728
- C:\Windows\System\dnARepB.exe
  C:\Windows\System\dnARepB.exe
  2⤵
  PID:5968
- C:\Windows\System\zGgQfDr.exe
  C:\Windows\System\zGgQfDr.exe
  2⤵
  PID:14744
- C:\Windows\System\NtTcNaI.exe
  C:\Windows\System\NtTcNaI.exe
  2⤵
  PID:14656
- C:\Windows\System\ITevFWp.exe
  C:\Windows\System\ITevFWp.exe
  2⤵
  PID:14700
- C:\Windows\System\XiIYmMC.exe
  C:\Windows\System\XiIYmMC.exe
  2⤵
  PID:8656
- C:\Windows\System\Wnmlkcb.exe
  C:\Windows\System\Wnmlkcb.exe
  2⤵
  PID:15092
- C:\Windows\System\nLLuTdf.exe
  C:\Windows\System\nLLuTdf.exe
  2⤵
  PID:15064
- C:\Windows\System\UUzasoW.exe
  C:\Windows\System\UUzasoW.exe
  2⤵
  PID:15176
- C:\Windows\System\RVqQZYA.exe
  C:\Windows\System\RVqQZYA.exe
  2⤵
  PID:15004
- C:\Windows\System\VGItDcw.exe
  C:\Windows\System\VGItDcw.exe
  2⤵
  PID:8804
- C:\Windows\System\YQMaOGh.exe
  C:\Windows\System\YQMaOGh.exe
  2⤵
  PID:15180
- C:\Windows\System\tgxDLaZ.exe
  C:\Windows\System\tgxDLaZ.exe
  2⤵
  PID:8872
- C:\Windows\System\KyNRYSM.exe
  C:\Windows\System\KyNRYSM.exe
  2⤵
  PID:8468
- C:\Windows\System\ylrEIAP.exe
  C:\Windows\System\ylrEIAP.exe
  2⤵
  PID:15276
- C:\Windows\System\iwkVtBi.exe
  C:\Windows\System\iwkVtBi.exe
  2⤵
  PID:15304
- C:\Windows\System\zTLTOEp.exe
  C:\Windows\System\zTLTOEp.exe
  2⤵
  PID:6760
- C:\Windows\System\NciKFie.exe
  C:\Windows\System\NciKFie.exe
  2⤵
  PID:14488
- C:\Windows\System\rLRnHaR.exe
  C:\Windows\System\rLRnHaR.exe
  2⤵
  PID:376
- C:\Windows\System\pYebxMa.exe
  C:\Windows\System\pYebxMa.exe
  2⤵
  PID:7536
- C:\Windows\System\fmyxuGU.exe
  C:\Windows\System\fmyxuGU.exe
  2⤵
  PID:14528
- C:\Windows\System\fYLALmN.exe
  C:\Windows\System\fYLALmN.exe
  2⤵
  PID:9060
- C:\Windows\System\IXIZXKf.exe
  C:\Windows\System\IXIZXKf.exe
  2⤵
  PID:8620
- C:\Windows\System\uEIdoPM.exe
  C:\Windows\System\uEIdoPM.exe
  2⤵
  PID:5296
- C:\Windows\System\KAfzWNB.exe
  C:\Windows\System\KAfzWNB.exe
  2⤵
  PID:10852
- C:\Windows\System\SwgLYcI.exe
  C:\Windows\System\SwgLYcI.exe
  2⤵
  PID:7904
- C:\Windows\System\seZbOGS.exe
  C:\Windows\System\seZbOGS.exe
  2⤵
  PID:14780
- C:\Windows\System\PuWKIXl.exe
  C:\Windows\System\PuWKIXl.exe
  2⤵
  PID:6708
- C:\Windows\System\wnwMNOT.exe
  C:\Windows\System\wnwMNOT.exe
  2⤵
  PID:14672
- C:\Windows\System\RIntzhD.exe
  C:\Windows\System\RIntzhD.exe
  2⤵
  PID:9184
- C:\Windows\System\jlYnynS.exe
  C:\Windows\System\jlYnynS.exe
  2⤵
  PID:8948
- C:\Windows\System\IxzbfPN.exe
  C:\Windows\System\IxzbfPN.exe
  2⤵
  PID:15312
- C:\Windows\System\UmTGZtj.exe
  C:\Windows\System\UmTGZtj.exe
  2⤵
  PID:7668
- C:\Windows\System\kTcesrK.exe
  C:\Windows\System\kTcesrK.exe
  2⤵
  PID:8420
- C:\Windows\System\zQCkzEN.exe
  C:\Windows\System\zQCkzEN.exe
  2⤵
  PID:14860
- C:\Windows\System\BxgPZmO.exe
  C:\Windows\System\BxgPZmO.exe
  2⤵
  PID:14868
- C:\Windows\System\tYvpXsS.exe
  C:\Windows\System\tYvpXsS.exe
  2⤵
  PID:7744
- C:\Windows\System\cOMmRMd.exe
  C:\Windows\System\cOMmRMd.exe
  2⤵
  PID:14696
- C:\Windows\System\tPyGWiO.exe
  C:\Windows\System\tPyGWiO.exe
  2⤵
  PID:15000
- C:\Windows\System\mClOCcg.exe
  C:\Windows\System\mClOCcg.exe
  2⤵
  PID:8696
- C:\Windows\System\DXVdDWE.exe
  C:\Windows\System\DXVdDWE.exe
  2⤵
  PID:7772
- C:\Windows\System\EktlAmy.exe
  C:\Windows\System\EktlAmy.exe
  2⤵
  PID:7676
- C:\Windows\System\gdBaxJU.exe
  C:\Windows\System\gdBaxJU.exe
  2⤵
  PID:5768
- C:\Windows\System\CHEpNvr.exe
  C:\Windows\System\CHEpNvr.exe
  2⤵
  PID:14940
- C:\Windows\System\fxvxaKK.exe
  C:\Windows\System\fxvxaKK.exe
  2⤵
  PID:7528
- C:\Windows\System\IZzDcAk.exe
  C:\Windows\System\IZzDcAk.exe
  2⤵
  PID:7764
- C:\Windows\System\lcxmQfv.exe
  C:\Windows\System\lcxmQfv.exe
  2⤵
  PID:7144
- C:\Windows\System\CmCaQkX.exe
  C:\Windows\System\CmCaQkX.exe
  2⤵
  PID:6112
- C:\Windows\System\yHNZTwV.exe
  C:\Windows\System\yHNZTwV.exe
  2⤵
  PID:8676
- C:\Windows\System\rcVZJMQ.exe
  C:\Windows\System\rcVZJMQ.exe
  2⤵
  PID:15120
- C:\Windows\System\TPVSvRn.exe
  C:\Windows\System\TPVSvRn.exe
  2⤵
  PID:15168
- C:\Windows\System\zDqXJHi.exe
  C:\Windows\System\zDqXJHi.exe
  2⤵
  PID:7824
- C:\Windows\System\AKxBBvj.exe
  C:\Windows\System\AKxBBvj.exe
  2⤵
  PID:5780
- C:\Windows\System\holmkim.exe
  C:\Windows\System\holmkim.exe
  2⤵
  PID:9176
- C:\Windows\System\UUTGWdW.exe
  C:\Windows\System\UUTGWdW.exe
  2⤵
  PID:5248
- C:\Windows\System\QSfEmqp.exe
  C:\Windows\System\QSfEmqp.exe
  2⤵
  PID:7492
- C:\Windows\System\QUWvdhR.exe
  C:\Windows\System\QUWvdhR.exe
  2⤵
  PID:7912
- C:\Windows\System\MCHwpWx.exe
  C:\Windows\System\MCHwpWx.exe
  2⤵
  PID:14360
- C:\Windows\System\gxmRtKL.exe
  C:\Windows\System\gxmRtKL.exe
  2⤵
  PID:9772
- C:\Windows\System\XKCkjGB.exe
  C:\Windows\System\XKCkjGB.exe
  2⤵
  PID:8180
- C:\Windows\System\ZuzoICF.exe
  C:\Windows\System\ZuzoICF.exe
  2⤵
  PID:7344
- C:\Windows\System\pJOMxlj.exe
  C:\Windows\System\pJOMxlj.exe
  2⤵
  PID:8724
- C:\Windows\System\xDevNRM.exe
  C:\Windows\System\xDevNRM.exe
  2⤵
  PID:8556
- C:\Windows\System\QbZSrjZ.exe
  C:\Windows\System\QbZSrjZ.exe
  2⤵
  PID:12864
- C:\Windows\System\TIXYJtw.exe
  C:\Windows\System\TIXYJtw.exe
  2⤵
  PID:7440
- C:\Windows\System\fQqFdcN.exe
  C:\Windows\System\fQqFdcN.exe
  2⤵
  PID:7272
- C:\Windows\System\meEDgPM.exe
  C:\Windows\System\meEDgPM.exe
  2⤵
  PID:8268
- C:\Windows\System\kCdVyfd.exe
  C:\Windows\System\kCdVyfd.exe
  2⤵
  PID:8560
- C:\Windows\System\CbxOtds.exe
  C:\Windows\System\CbxOtds.exe
  2⤵
  PID:7556
- C:\Windows\System\jYKLnaX.exe
  C:\Windows\System\jYKLnaX.exe
  2⤵
  PID:13472
- C:\Windows\System\ILziztB.exe
  C:\Windows\System\ILziztB.exe
  2⤵
  PID:14692
- C:\Windows\System\OSgngDe.exe
  C:\Windows\System\OSgngDe.exe
  2⤵
  PID:10108
- C:\Windows\System\ETNMjgS.exe
  C:\Windows\System\ETNMjgS.exe
  2⤵
  PID:8216
- C:\Windows\System\nQcIGeL.exe
  C:\Windows\System\nQcIGeL.exe
  2⤵
  PID:9116
- C:\Windows\System\ODcDxCf.exe
  C:\Windows\System\ODcDxCf.exe
  2⤵
  PID:8080
- C:\Windows\System\hDtpPHe.exe
  C:\Windows\System\hDtpPHe.exe
  2⤵
  PID:9072
- C:\Windows\System\ECFkYwB.exe
  C:\Windows\System\ECFkYwB.exe
  2⤵
  PID:9228
- C:\Windows\System\vikOeZu.exe
  C:\Windows\System\vikOeZu.exe
  2⤵
  PID:8040
- C:\Windows\System\GvJEFvu.exe
  C:\Windows\System\GvJEFvu.exe
  2⤵
  PID:8648
- C:\Windows\System\gflWgsT.exe
  C:\Windows\System\gflWgsT.exe
  2⤵
  PID:8060
- C:\Windows\System\vUbKaYL.exe
  C:\Windows\System\vUbKaYL.exe
  2⤵
  PID:11488
- C:\Windows\System\RbxEuwz.exe
  C:\Windows\System\RbxEuwz.exe
  2⤵
  PID:7356
- C:\Windows\System\MVylZhw.exe
  C:\Windows\System\MVylZhw.exe
  2⤵
  PID:7320
- C:\Windows\System\rGEccFl.exe
  C:\Windows\System\rGEccFl.exe
  2⤵
  PID:8652
- C:\Windows\System\TvEnhfc.exe
  C:\Windows\System\TvEnhfc.exe
  2⤵
  PID:10132
- C:\Windows\System\xzhoUFZ.exe
  C:\Windows\System\xzhoUFZ.exe
  2⤵
  PID:7404
- C:\Windows\System\yegZjcA.exe
  C:\Windows\System\yegZjcA.exe
  2⤵
  PID:10168
- C:\Windows\System\QJEFUZW.exe
  C:\Windows\System\QJEFUZW.exe
  2⤵
  PID:10744
- C:\Windows\System\kDSJNfF.exe
  C:\Windows\System\kDSJNfF.exe
  2⤵
  PID:2964
- C:\Windows\System\nDrpvDz.exe
  C:\Windows\System\nDrpvDz.exe
  2⤵
  PID:2308
- C:\Windows\System\JPpRqak.exe
  C:\Windows\System\JPpRqak.exe
  2⤵
  PID:10972
- C:\Windows\System\usEyHhw.exe
  C:\Windows\System\usEyHhw.exe
  2⤵
  PID:10856
- C:\Windows\System\PLNglMz.exe
  C:\Windows\System\PLNglMz.exe
  2⤵
  PID:11900
- C:\Windows\System\IrfEDkv.exe
  C:\Windows\System\IrfEDkv.exe
  2⤵
  PID:11936
- C:\Windows\System\woNdkHZ.exe
  C:\Windows\System\woNdkHZ.exe
  2⤵
  PID:10780
- C:\Windows\System\XrorOpR.exe
  C:\Windows\System\XrorOpR.exe
  2⤵
  PID:8464
- C:\Windows\System\UTJLZri.exe
  C:\Windows\System\UTJLZri.exe
  2⤵
  PID:8144
- C:\Windows\System\pOFBoUi.exe
  C:\Windows\System\pOFBoUi.exe
  2⤵
  PID:11296
- C:\Windows\System\nJFcDOz.exe
  C:\Windows\System\nJFcDOz.exe
  2⤵
  PID:8220
- C:\Windows\System\AJYGmJo.exe
  C:\Windows\System\AJYGmJo.exe
  2⤵
  PID:10580
- C:\Windows\System\qOKfTAw.exe
  C:\Windows\System\qOKfTAw.exe
  2⤵
  PID:15212
- C:\Windows\System\YdfSrfn.exe
  C:\Windows\System\YdfSrfn.exe
  2⤵
  PID:3172
- C:\Windows\System\RPawDPn.exe
  C:\Windows\System\RPawDPn.exe
  2⤵
  PID:7428
- C:\Windows\System\tXKBflf.exe
  C:\Windows\System\tXKBflf.exe
  2⤵
  PID:10504
- C:\Windows\System\CDTgLnL.exe
  C:\Windows\System\CDTgLnL.exe
  2⤵
  PID:13000
- C:\Windows\System\mfgYTtP.exe
  C:\Windows\System\mfgYTtP.exe
  2⤵
  PID:12704
- C:\Windows\System\TMOTeKw.exe
  C:\Windows\System\TMOTeKw.exe
  2⤵
  PID:12832
- C:\Windows\System\vsPpkzQ.exe
  C:\Windows\System\vsPpkzQ.exe
  2⤵
  PID:11048
- C:\Windows\System\CiZFtZt.exe
  C:\Windows\System\CiZFtZt.exe
  2⤵
  PID:10832
- C:\Windows\System\VHqAxDG.exe
  C:\Windows\System\VHqAxDG.exe
  2⤵
  PID:9280
- C:\Windows\System\XaESWfu.exe
  C:\Windows\System\XaESWfu.exe
  2⤵
  PID:14364
- C:\Windows\System\xQTuBQZ.exe
  C:\Windows\System\xQTuBQZ.exe
  2⤵
  PID:11844
- C:\Windows\System\LNozvbT.exe
  C:\Windows\System\LNozvbT.exe
  2⤵
  PID:14996
- C:\Windows\System\FBvmoRX.exe
  C:\Windows\System\FBvmoRX.exe
  2⤵
  PID:7728
- C:\Windows\System\huIsNWP.exe
  C:\Windows\System\huIsNWP.exe
  2⤵
  PID:12056
- C:\Windows\System\KHichfm.exe
  C:\Windows\System\KHichfm.exe
  2⤵
  PID:12092
- C:\Windows\System\qwnKBfI.exe
  C:\Windows\System\qwnKBfI.exe
  2⤵
  PID:6868
- C:\Windows\System\ZXNqpiP.exe
  C:\Windows\System\ZXNqpiP.exe
  2⤵
  PID:11632
- C:\Windows\System\CIRQRyc.exe
  C:\Windows\System\CIRQRyc.exe
  2⤵
  PID:11312
- C:\Windows\System\aYrSnJq.exe
  C:\Windows\System\aYrSnJq.exe
  2⤵
  PID:10292
- C:\Windows\System\TZRpbzf.exe
  C:\Windows\System\TZRpbzf.exe
  2⤵
  PID:9296
- C:\Windows\System\YVvaDRN.exe
  C:\Windows\System\YVvaDRN.exe
  2⤵
  PID:10256
- C:\Windows\System\XtAhdcJ.exe
  C:\Windows\System\XtAhdcJ.exe
  2⤵
  PID:11468
- C:\Windows\System\qtgSgxP.exe
  C:\Windows\System\qtgSgxP.exe
  2⤵
  PID:13176
- C:\Windows\System\YtGmnwX.exe
  C:\Windows\System\YtGmnwX.exe
  2⤵
  PID:10996
- C:\Windows\System\IUaFWVA.exe
  C:\Windows\System\IUaFWVA.exe
  2⤵
  PID:14772
- C:\Windows\System\jkFkRrS.exe
  C:\Windows\System\jkFkRrS.exe
  2⤵
  PID:12856
- C:\Windows\System\cBsZAuo.exe
  C:\Windows\System\cBsZAuo.exe
  2⤵
  PID:8864
- C:\Windows\System\XYhraDY.exe
  C:\Windows\System\XYhraDY.exe
  2⤵
  PID:11916
- C:\Windows\System\bVjSZOh.exe
  C:\Windows\System\bVjSZOh.exe
  2⤵
  PID:11272
- C:\Windows\System\lFsRpOD.exe
  C:\Windows\System\lFsRpOD.exe
  2⤵
  PID:12300
- C:\Windows\System\aUcbSlu.exe
  C:\Windows\System\aUcbSlu.exe
  2⤵
  PID:7776
- C:\Windows\System\EWGIjgw.exe
  C:\Windows\System\EWGIjgw.exe
  2⤵
  PID:13420
- C:\Windows\System\dZrMZkZ.exe
  C:\Windows\System\dZrMZkZ.exe
  2⤵
  PID:12472
- C:\Windows\System\DSXdUVy.exe
  C:\Windows\System\DSXdUVy.exe
  2⤵
  PID:6944
- C:\Windows\System\UNFHMFS.exe
  C:\Windows\System\UNFHMFS.exe
  2⤵
  PID:12600
- C:\Windows\System\BhefyIk.exe
  C:\Windows\System\BhefyIk.exe
  2⤵
  PID:9552
- C:\Windows\System\eBoSTrq.exe
  C:\Windows\System\eBoSTrq.exe
  2⤵
  PID:10880
- C:\Windows\System\XoMgNyi.exe
  C:\Windows\System\XoMgNyi.exe
  2⤵
  PID:8320
- C:\Windows\System\xQlwQkM.exe
  C:\Windows\System\xQlwQkM.exe
  2⤵
  PID:12088
- C:\Windows\System\GlylXex.exe
  C:\Windows\System\GlylXex.exe
  2⤵
  PID:11760
- C:\Windows\System\kgUioYV.exe
  C:\Windows\System\kgUioYV.exe
  2⤵
  PID:12604
- C:\Windows\System\qSZUZdg.exe
  C:\Windows\System\qSZUZdg.exe
  2⤵
  PID:9512
- C:\Windows\System\oendnhw.exe
  C:\Windows\System\oendnhw.exe
  2⤵
  PID:13580
- C:\Windows\System\QSyeGwT.exe
  C:\Windows\System\QSyeGwT.exe
  2⤵
  PID:11888
- C:\Windows\System\OjXKKFv.exe
  C:\Windows\System\OjXKKFv.exe
  2⤵
  PID:12460
- C:\Windows\System\qXBKffF.exe
  C:\Windows\System\qXBKffF.exe
  2⤵
  PID:8928
- C:\Windows\System\UcPWjQp.exe
  C:\Windows\System\UcPWjQp.exe
  2⤵
  PID:13148
- C:\Windows\System\KGHvQaY.exe
  C:\Windows\System\KGHvQaY.exe
  2⤵
  PID:13364
- C:\Windows\System\LvXIEUC.exe
  C:\Windows\System\LvXIEUC.exe
  2⤵
  PID:12900
- C:\Windows\System\adOwdqr.exe
  C:\Windows\System\adOwdqr.exe
  2⤵
  PID:12964
- C:\Windows\System\VujViYT.exe
  C:\Windows\System\VujViYT.exe
  2⤵
  PID:15368
- C:\Windows\System\ZdXvvvu.exe
  C:\Windows\System\ZdXvvvu.exe
  2⤵
  PID:15392
- C:\Windows\System\MTNKMgW.exe
  C:\Windows\System\MTNKMgW.exe
  2⤵
  PID:15416
- C:\Windows\System\mklptPS.exe
  C:\Windows\System\mklptPS.exe
  2⤵
  PID:15448
- C:\Windows\System\hTnHBdv.exe
  C:\Windows\System\hTnHBdv.exe
  2⤵
  PID:15476
- C:\Windows\System\dNjvbNy.exe
  C:\Windows\System\dNjvbNy.exe
  2⤵
  PID:15508
- C:\Windows\System\GScYxou.exe
  C:\Windows\System\GScYxou.exe
  2⤵
  PID:15540
- C:\Windows\System\HJSJGHx.exe
  C:\Windows\System\HJSJGHx.exe
  2⤵
  PID:15572
- C:\Windows\System\NVIklGC.exe
  C:\Windows\System\NVIklGC.exe
  2⤵
  PID:15600
- C:\Windows\System\dXrFjSb.exe
  C:\Windows\System\dXrFjSb.exe
  2⤵
  PID:15632
- C:\Windows\System\JyRvdpe.exe
  C:\Windows\System\JyRvdpe.exe
  2⤵
  PID:15656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ak4d02ko.qud.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BIIoKIi.exe

Filesize
2.3MB

MD5
04326c642a270d614fc46f4c748ec5e2

SHA1
0d4eb80ada9e9581695f340028de88228ac8173c

SHA256
021edc24e8b7d2d83bcbd11f7227f6a7408379c1ea372bc6d2783f81eea6e1fd

SHA512
54d17858ae251adcf92625de79d033b9e397b5d6322daf93e6a6144f02cdc78b21fcf822263dffa446dbd0a36533cfd1985910564ee82cf0ea66802e24ea0259

Download Submit
C:\Windows\System\CPTJDoA.exe

Filesize
2.3MB

MD5
8682ddb490d1094c1caa62912e18ffa6

SHA1
e32fb9db4c052745af19ef2a22de6e50fb58240a

SHA256
6cce9a7875326dd0b0587633f7f99968dcbcb1a0fff854f2b3226b6b7851f457

SHA512
d4364be1776d49342224c9e84e032f811a9554303c504d1ece265063ec3831cc76e9f3789fcad8f680d16ca3a32c7307539708f5560938563a2c1ebb2b797e43

Download Submit
C:\Windows\System\CiGfBdI.exe

Filesize
2.3MB

MD5
8653e45a50136cf9a48b2191962bdbf7

SHA1
f26feaab2319fe82b7a6cbf6d3e524bbde3af4ab

SHA256
3abbb138d16e74c7dac16e052b17fd93813963d68eb60c1f2dfcfb928b57653b

SHA512
7a4b33c6750243866d1e0a51f0b0c581a5acb92015bd7d9c24ec79965f3a99ddfb8d7b682310f046fe43a9815528cb8bd80b11271e335b22558589c2c72acdfb

Download Submit
C:\Windows\System\DOInYYG.exe

Filesize
2.3MB

MD5
fe06b1a1e4dd3ae6e62b304717fa27de

SHA1
c982ea6995ab56e30e666fd52600f74f7f6387d5

SHA256
1be3e94afa0178bc7cd75b20c3c8e87ba2fd34dd3b61eaf9a4a27631fc106cc8

SHA512
71842f6de63f3ac0b7cdc08471abc42f9732e43cc11e4723a72e5ab4d5206ae408da43917788eb7865496c067b9b419f516ce76a6616b0d4afd124a4608fed1c

Download Submit
C:\Windows\System\DuumaaM.exe

Filesize
2.3MB

MD5
3ffa5c7ead26883f071220d8f697a646

SHA1
7d5dfc481192a3cf359188e46785ad6149b05716

SHA256
77704eaed0f6e2b00de1e7c01c21305d3ae07609ff4272f7532eafef0cbc4d5c

SHA512
50d59b6e354eb9e760c0f6358f6c2e830533c5bf8e792546bffe30d8e36049ce23a35972ae08a6b87d068e7050e3620d7f25beb4779e6978627a61f3145b7e75

Download Submit
C:\Windows\System\EmhFZHz.exe

Filesize
2.3MB

MD5
3f460fbd89367e15fe2e19f69aee08a5

SHA1
f03e3b972efae954cb4f1057ff70f935c4a5c7db

SHA256
1e842efc906fa5e501c00fd51c4365c29c598407b882336b84f8cf40b3320659

SHA512
ce7a57cfbb6a1faa887c17e4c16dac9fb60c49869719def953da8e96308f82bbc97bc9ab053b2f4360534b88a0875dc6a186eeba8d16a1dfe8c406e2f9f0c29a

Download Submit
C:\Windows\System\FAMQIDX.exe

Filesize
2.3MB

MD5
462e614cd877473e771b88abc5a1bb9c

SHA1
fc89fa2cf61943440fe69a8dd9987b3eacb107c8

SHA256
e9ccb663e07280e35743953280a659b2c9da3192c01cab87e4c21bd33f2a0e39

SHA512
778b213f96658514e5cac31001db8703a844c04837bf1f467b3bbdc0f6b1fd3762ea379d9cfeda7ebc60b852b5513b3c9e87e663d5aa950911f68194627caf9f

Download Submit
C:\Windows\System\GLUyvoi.exe

Filesize
2.3MB

MD5
d1186ddc37490ca6e94f23d00b2f25e3

SHA1
b14b820b6fe32bf44cba979969d6dafbd414cef0

SHA256
c11dbb96e2cbf8d70d2a645c25a2ac2cb5f208b6d70ca468a79e6502cf916abc

SHA512
259a2f5792511d799c6f5a44d36d924dffa04ad28ed197320d00dd6ecc6e757338a57bf5eeab06ebb7c301e72755b739dd0a9251614090d46ee49b7e9f2905dd

Download Submit
C:\Windows\System\GRwBrkX.exe

Filesize
2.3MB

MD5
86830514d2e4a74d796c296536218f80

SHA1
9fa36305eb0047a717172fad5826198e1a946203

SHA256
8fa6717a5308d98add0e709c105671ceb932089629aaabe219f60afa15bc15f6

SHA512
bcdae185d63a2fca4aa1ad7e2905f5be10644faa13225358cc6b1576b6c0cd5d3c46f8430b6c61f95fda1412d83742c06286bd5823114ac027c4b6afa82bc539

Download Submit
C:\Windows\System\IuDNzUh.exe

Filesize
2.3MB

MD5
28b06469fb915aeb047f38e13a674355

SHA1
1e7cc52b9c2804bb2619ccd7c6164101fb20baff

SHA256
40f7b4d1a206138090548e7ccb4e1abd66cde0f50505e5222485d27f7388ca43

SHA512
63ff3245292eae2fe446903c0ef9f773ac11c74c523dba95853de330435747e0513bc698c162287445924cadd850781e1560ec23b447e907c278509da4cc99b4

Download Submit
C:\Windows\System\NujbZSw.exe

Filesize
2.3MB

MD5
894c47fbaf523f55f2105f53dfc57c17

SHA1
5c4f0d082c02eecef2eb61ab6267a5616dd5454e

SHA256
bd020d9695e5ff605d7aeda5022848b9b46dffa2dbef1e80f9e0f4cd7a9df75c

SHA512
318a66f35c816af25bb972d8d3d3cebaa5fa744de56d83456eb307c576a7bd1ac3405e13818910736d1e9a594ceac0f09ea92f334e2e178bfcb42ab4e168607c

Download Submit
C:\Windows\System\OFQNWXD.exe

Filesize
2.3MB

MD5
0b1759a7904224eb6abc20366d6618ac

SHA1
6654846a68cc905a953afe0dd50f5fd41417e249

SHA256
ae342b7db9bf6a81653f78c0b048230d7bf8a1749e19f9617ec61b5604c667ed

SHA512
0e5247655af09026d09c6863be1cf41349917cecec1d3cc45f016e349037d8f8fbb524069745fbb3ec925cb4b7489cf9a4bb745d5809f7b65cf105c7cf060189

Download Submit
C:\Windows\System\OVJWWQX.exe

Filesize
2.3MB

MD5
de6801c5fa4c05d6cf3a88d1bfdd92d6

SHA1
f0687f50794b0695272b6861a5e0108efd988568

SHA256
27d71685e56add1c71c12bdc7987ac2707d16f7019788680dd001de453a76e9a

SHA512
a80ef055fc250a68ca412dd7af5fcfde35c52e7b65f47e0db61fa3de11e314d96390fc7885db23c3fd87034bc25042c5d6ea10a849305153c0fc654accd597df

Download Submit
C:\Windows\System\OsTvwoa.exe

Filesize
2.3MB

MD5
97b713cd3628b661580d21b5f5f71496

SHA1
47ccbac2b25f9235b782f5d7cc1818ff0626eaa3

SHA256
611a2aac6ada70571cd02e9509dcc8d93bab1f965fa5835e18fd5b6374cfd40a

SHA512
aab902104dfaaef0899f4ec36f0d54930bce875722318bf58210ab9379a485f3bd32c2b2a36b9321a44f41a0879b16aa095fbe19c474c896b2fb091ca5075339

Download Submit
C:\Windows\System\QOMsQtj.exe

Filesize
2.3MB

MD5
a34e8c12ebd949ee932cc726d3bf80c7

SHA1
0c1ee344d26d59cab545d1c843189fbd9bfd402c

SHA256
69fa4c8b8a020bdd1b48194b1127fa179bfae4d8315ef2443e01712772262878

SHA512
77a57afcec55ce9574de21bed32aa8f4273b3082010ea31c9308e02cbc77698a6fc1338d5176ad9870d4995ef5dd1627e1262cee067d37ab1aac10ac9d4274cd

Download Submit
C:\Windows\System\WezidvV.exe

Filesize
2.3MB

MD5
4d92b7816958e993a496ad7b81dc241d

SHA1
c7eb3082e39511cd67962afa62026823e2b41bce

SHA256
8499eda8b74afb2e9a6f39f7afe4f4309f5041a6ae9c2d009399ee23840367a8

SHA512
36021dab78145c8ea910409313eafaa9386498c5bd5d0adbaae7338fc795fdac4c88418b63be6314b4f0bcde728de52500db2d731ffc10aadc12f925ad785d65

Download Submit
C:\Windows\System\aWoEWno.exe

Filesize
2.3MB

MD5
a844387b84b5dbacf33847cbdae90df2

SHA1
ce1633c983aefb878680c1f67e5e30f87729ca53

SHA256
266dbd2c93ea543f46a7b22acaf099c46115d621be83076f15a09ec3e83f92fd

SHA512
cadd15104cf3d40a120e9814125626994589a74c9b59e3ddae0b8e3ab6c30b3e5a18561866abaa72047ede7e1065d93887328a57e1ba6f85ac3e88034d594d21

Download Submit
C:\Windows\System\ctwPFBX.exe

Filesize
2.3MB

MD5
fe85eb0aba168d3417a39c8b157759bc

SHA1
3f39fc3584765b4294839c4854788eeba733463f

SHA256
5ced439b6553fc66515f4e878d9feea4be960e0ce95f4431534dc75086d41052

SHA512
04a294b0ba8fed3f6aa02157d7f2fc1783a930c57311cdd30e85ecec5233bb8dbfea975482cdbb3900d15b02186ad8ecaf2eb93e3f1009be57c08c6bdaa3f1fc

Download Submit
C:\Windows\System\dBsPHGD.exe

Filesize
2.3MB

MD5
b073d16c4a70b5e3e101c49e84a129b4

SHA1
f1cfc3c03cffeb24d753fbf37150d92ddfbc4606

SHA256
750cfd093d9b24ce23f1698ed5671fa8b13b47e04b370c593fa800c601c32a98

SHA512
0a3ab99aabb9fb3fb441bf6d1665c7e3f6b6d6df1e381790c1427f603ba6c28d7c8e96233b065fdb3abd8def655481fa3673769a32744a06db2997a0c7527b6a

Download Submit
C:\Windows\System\dcVzNBa.exe

Filesize
2.3MB

MD5
f571647760060f332dd425bc08f24c3f

SHA1
f1f628d95b3ad63a43d7a0783190fb32362e9011

SHA256
f5b1b256df996cf0d6914bd8be73e9ae3ac13fc5ac3b19a04470dbe28dadedf1

SHA512
7953239f3d77bef260a7a99a51fe8e80d1844320136fccc34638d4e199b67afc8cb5472b75384edc58c70308040843476514617ef7359999e5a9a5b9203612a4

Download Submit
C:\Windows\System\dzDOdOq.exe

Filesize
2.3MB

MD5
c2c9dfc11e5ca211fd87eb3853a8f9fc

SHA1
58a6c3fa9755855a40ae0e384779a318e317e902

SHA256
44dbe98ddb6eaf2e2defea2570d9acd7655f6374ea63d5aa03be5ef4a75951dd

SHA512
67acfff875e70f4affec6fa5666d82b86e73d3537f18d3d90ad97e62b6481c1a0fefb6b6a851467abe0b6cc38c51b3f01a2bba6052ebfe320d7d84f5f2871a59

Download Submit
C:\Windows\System\hhLjCCj.exe

Filesize
2.3MB

MD5
77d36b1951bf020400f253a304f11bef

SHA1
02b484f5ed1f0ec72a14d5a74d7eee0b16ea772e

SHA256
552ba38db8a741b4240e9e040395cab04145c116e62e20fec7df8671c7e1e2b9

SHA512
b209a79520972887771574022b50ea43c49689b56e12b07b8894697f8bbd1a0a171a82b015fe516054898dd6b1fb4a2cbefd8b737565d418036f1e7975f944d6

Download Submit
C:\Windows\System\kQFKaNu.exe

Filesize
2.3MB

MD5
2fd740b7794774622897b3863a69cb8d

SHA1
4aabf26038ea47ed061346928c5f6749ab8a76c0

SHA256
34f51749aa9d0b8b5b0607ae2cc80ad3c1a911ec28f21b5196cfe36dd07bcd6f

SHA512
da059e928c563b00662cedc4e12a353604ee83c4bc68db3d5f7a8c5b5c802e300d6950c2c1f6a1155f6f9afae6da11e916bd04c64598d556620357ac8b58a71e

Download Submit
C:\Windows\System\kSjkqEU.exe

Filesize
2.3MB

MD5
45479d9fc528cea01ea4354ef3432181

SHA1
ad7354dd48121e863615d7ced393295da8c75bf7

SHA256
472c92ea8a3c19724cd767b075ff89b0b82b6e8edb3c11be4e9515a01ffe98e7

SHA512
20758ff9de82eef61eb81ee0aef44b44666077286802a2de474112496a0212fa38d8bfb1ec17ad7b223f84d627602d94dab7cf9aa3328ea9e425213593fa30d6

Download Submit
C:\Windows\System\kmSjWsk.exe

Filesize
2.3MB

MD5
212148d3b8897da864d89892653efefc

SHA1
57a815c2df7d34af757e50453c3a42ede1d06d93

SHA256
0a29d57268b41bc10e983db99cb1e1fe87df4f8c3562347a50b0da88a683e172

SHA512
193f2451f2f4a8865e5e864419f2e169577241a62ae2e07e246c937947a56a445955a6cc82b3dbcf2f6e8c055a530a107f0265adc0d9a7a94db05acc71843d8b

Download Submit
C:\Windows\System\knotEeF.exe

Filesize
2.3MB

MD5
f17fb496bcdb84340a07f7dc931183ce

SHA1
1219e4e86f3246f3926e77a660f9b4710d095a47

SHA256
380a5515065731d23d01042fd7c788203251df9eb05871e03c46f0d1dfcdb740

SHA512
1d7afae4fb2843baeeccb1885dabd6d20c93d5e54b309d2afefdf9355340a9cbe73cd89186ee0f9da3ccede80f8c02628c3ee01aa51e5697e19f1a65f37a321f

Download Submit
C:\Windows\System\otJkTTP.exe

Filesize
2.3MB

MD5
7b4c8644f54dbe7fb0d8e8df8499b538

SHA1
dad6ee9247040b4ae92ff6dd37e5b2147e26db89

SHA256
9733d77071c5761b26d90d4308ca7099082ec062e9e23954bcf1733639133bdb

SHA512
fc8362929355261d2510f55df06fd9b739e972827e3a95dc8f15d6899df46f09d340af7999209ee71e640fcc7605b312da80fc7c69b721240a849c3385c44287

Download Submit
C:\Windows\System\qPnFDvR.exe

Filesize
2.3MB

MD5
42981efda420398925299d3eb2452abf

SHA1
5ea723a2e2c2e533a241a63ca3aee656e3444eaf

SHA256
9b24acaac244e8f491eb5933944b863fdd04f7b2d738f07a0424a716624c202e

SHA512
35ac7ed19a105c93b01f36d094b0df4fc96975e9980e6de75bf2e9b91b8f7adfadadbe3077d282c3904c2810eed3b55e8c6631c4d44907ebe63d86d09d997ecd

Download Submit
C:\Windows\System\rqCRhoD.exe

Filesize
2.3MB

MD5
82d3a14f6ddc1cc02886b1427576b7dc

SHA1
417608f63f62bc9ec489b8cd2d13f2574c152837

SHA256
b36a8c7cf1924e5744ca46019980cffb5e9a8610197b892dfe9b4595bfe42146

SHA512
71ba6ee23455f46f391e9bb6602f63d76f1708d67b9a5339962f292ba40d3aad762c05fba228ef02482c96dde18747c5d5691ff0ce3ba6639410d5fac570c425

Download Submit
C:\Windows\System\uFDWHgv.exe

Filesize
2.3MB

MD5
130c448f883804bffcf5f47be249c897

SHA1
564e248bb4eb3f3192458f703c0920d663707c38

SHA256
9afe293b9d3f0dc302d372e1c4e74def8700bc680b83e11dcb0d03d76c7ec577

SHA512
aa027bcda245e1aaf2edca42fa5cbeafc7a04b57783767c543146c22617b8f6aaeb45077a8bcef39fe6bce48d9bb37623e41e52115a6f2871d7a025fdee77607

Download Submit
C:\Windows\System\vDEczxo.exe

Filesize
2.3MB

MD5
3d01a5fca77aadd0d2b1cfeeaf6200c3

SHA1
4e65fd450d2daa1473195290f2c53e880d509d8d

SHA256
ed6e31acd9a47827f0a0624a73d9efe147d72e4db061a6a9a5aabd0b2364c998

SHA512
41769f5ec0fb790c83d9284defb9754dfcafa60a2592373179a02cc8a2e13d659cdd6b2533fa80a93df1aa1b77d14a98cf0d203fd6947876e7acebd8337e04c1

Download Submit
C:\Windows\System\vLBDKoY.exe

Filesize
2.3MB

MD5
9c95ac57e709ee4ea1356b9bbd4082e8

SHA1
1d31f5ddc919a8c8f0bd7d5ff0388482ed6b8245

SHA256
266748f26f70f143ce0fe6711348cfb94618594ebcf269d7bcb5995fd54dd791

SHA512
2346ff258b04d888d2324d5bd975a5dd441d114b22016fbb99fadef74518c334ad82eaee4944648b580934864a79971e541985597cfeb906cde1a906e0e66a7a

Download Submit
C:\Windows\System\xkQOkIJ.exe

Filesize
2.3MB

MD5
61fda2529e916350f2d1b1b31c68bb45

SHA1
ff35f54f0a632dbc172d87a620f393a545f51a83

SHA256
07d42c19c16b051018ca7a7b094771d3f00e73e6655a49b3b62c2b2d7115edaa

SHA512
bf1770ee3ad005a0cc885ceff1d813f75f76186391a02e4ca2b59ed1c56062300d784c37ff690ae5aa96c324b43caf688a7c34a74a86f40e77d64a1e17e2378e

Download Submit
C:\Windows\System\zEDjfFK.exe

Filesize
2.3MB

MD5
87b22750f16a4f3b6200dda27cf3e5ce

SHA1
c0f6dc9472a8e634f6b9c3c51a76644b33b56f06

SHA256
9992fd6d1cd5c5b43d6bebec7fcb4e3c7938bb203f026b33fbdf222f06452fe6

SHA512
dae6be5a0955bf4e7eed38292e0f138d532ca5b46dbd6453dfaf013ad3a754be20249b4ad0c703e648c3ff1a7b33201ba51523cc6bf36f68f7beb22dbfff1bc1

Download Submit
C:\Windows\System\zEUKBvk.exe

Filesize
2.3MB

MD5
1f469de8d2113ab1d81a441988195565

SHA1
0148efdf0202f4242ebc421912399f6424cd8e5f

SHA256
8f2e9ae1bb094dd34b3befd05cb3ff5597702b8564403d47ea65506e2bde4767

SHA512
d60f74fd086941cbd8928525479b5dc3bb4b6a293e995b0c5b8a0535bc8df9ffbb41456c2f049e4d934565f2553d837c0df68ea6de716e4e96bc99a4ad28d6e4

Download Submit
memory/8-4556-0x00007FF67B990000-0x00007FF67BD82000-memory.dmp

Filesize
3.9MB

Download
memory/8-42-0x00007FF67B990000-0x00007FF67BD82000-memory.dmp

Filesize
3.9MB

Download
memory/532-4612-0x00007FF783430000-0x00007FF783822000-memory.dmp

Filesize
3.9MB

Download
memory/532-198-0x00007FF783430000-0x00007FF783822000-memory.dmp

Filesize
3.9MB

Download
memory/920-4675-0x00007FF68EDE0000-0x00007FF68F1D2000-memory.dmp

Filesize
3.9MB

Download
memory/920-587-0x00007FF68EDE0000-0x00007FF68F1D2000-memory.dmp

Filesize
3.9MB

Download
memory/1288-4686-0x00007FF644410000-0x00007FF644802000-memory.dmp

Filesize
3.9MB

Download
memory/1288-451-0x00007FF644410000-0x00007FF644802000-memory.dmp

Filesize
3.9MB

Download
memory/1668-163-0x00007FF7476D0000-0x00007FF747AC2000-memory.dmp

Filesize
3.9MB

Download
memory/1668-4581-0x00007FF7476D0000-0x00007FF747AC2000-memory.dmp

Filesize
3.9MB

Download
memory/1892-849-0x00007FF763460000-0x00007FF763852000-memory.dmp

Filesize
3.9MB

Download
memory/1892-4631-0x00007FF763460000-0x00007FF763852000-memory.dmp

Filesize
3.9MB

Download
memory/2188-330-0x00007FF737850000-0x00007FF737C42000-memory.dmp

Filesize
3.9MB

Download
memory/2188-4689-0x00007FF737850000-0x00007FF737C42000-memory.dmp

Filesize
3.9MB

Download
memory/2616-64-0x00007FF619310000-0x00007FF619702000-memory.dmp

Filesize
3.9MB

Download
memory/2924-23-0x00007FF6B6A80000-0x00007FF6B6E72000-memory.dmp

Filesize
3.9MB

Download
memory/3056-0-0x00007FF6351E0000-0x00007FF6355D2000-memory.dmp

Filesize
3.9MB

Download
memory/3056-1-0x0000025B68F40000-0x0000025B68F50000-memory.dmp

Filesize
64KB

Download
memory/3112-750-0x00007FF6F4CA0000-0x00007FF6F5092000-memory.dmp

Filesize
3.9MB

Download
memory/3112-4579-0x00007FF6F4CA0000-0x00007FF6F5092000-memory.dmp

Filesize
3.9MB

Download
memory/3180-250-0x00007FF71A040000-0x00007FF71A432000-memory.dmp

Filesize
3.9MB

Download
memory/3180-4605-0x00007FF71A040000-0x00007FF71A432000-memory.dmp

Filesize
3.9MB

Download
memory/3416-402-0x00000198DE480000-0x00000198DE4A2000-memory.dmp

Filesize
136KB

Download
memory/3636-4637-0x00007FF755910000-0x00007FF755D02000-memory.dmp

Filesize
3.9MB

Download
memory/3636-417-0x00007FF755910000-0x00007FF755D02000-memory.dmp

Filesize
3.9MB

Download
memory/3804-4571-0x00007FF643E90000-0x00007FF644282000-memory.dmp

Filesize
3.9MB

Download
memory/3804-166-0x00007FF643E90000-0x00007FF644282000-memory.dmp

Filesize
3.9MB

Download
memory/3864-643-0x00007FF6924B0000-0x00007FF6928A2000-memory.dmp

Filesize
3.9MB

Download
memory/3864-4542-0x00007FF6924B0000-0x00007FF6928A2000-memory.dmp

Filesize
3.9MB

Download
memory/4356-4624-0x00007FF6142F0000-0x00007FF6146E2000-memory.dmp

Filesize
3.9MB

Download
memory/4356-289-0x00007FF6142F0000-0x00007FF6146E2000-memory.dmp

Filesize
3.9MB

Download
memory/4384-4602-0x00007FF73AFC0000-0x00007FF73B3B2000-memory.dmp

Filesize
3.9MB

Download
memory/4384-226-0x00007FF73AFC0000-0x00007FF73B3B2000-memory.dmp

Filesize
3.9MB

Download
memory/4412-625-0x00007FF757890000-0x00007FF757C82000-memory.dmp

Filesize
3.9MB

Download
memory/4412-4670-0x00007FF757890000-0x00007FF757C82000-memory.dmp

Filesize
3.9MB

Download
memory/4448-136-0x00007FF618D80000-0x00007FF619172000-memory.dmp

Filesize
3.9MB

Download
memory/4448-4590-0x00007FF618D80000-0x00007FF619172000-memory.dmp

Filesize
3.9MB

Download
memory/4700-19-0x00007FF74A6E0000-0x00007FF74AAD2000-memory.dmp

Filesize
3.9MB

Download
memory/4700-4528-0x00007FF74A6E0000-0x00007FF74AAD2000-memory.dmp

Filesize
3.9MB

Download
memory/4740-253-0x00007FF64CCD0000-0x00007FF64D0C2000-memory.dmp

Filesize
3.9MB

Download
memory/4740-4585-0x00007FF64CCD0000-0x00007FF64D0C2000-memory.dmp

Filesize
3.9MB

Download
memory/4884-4565-0x00007FF62B1A0000-0x00007FF62B592000-memory.dmp

Filesize
3.9MB

Download
memory/4884-88-0x00007FF62B1A0000-0x00007FF62B592000-memory.dmp

Filesize
3.9MB

Download
memory/4908-4567-0x00007FF6EF4B0000-0x00007FF6EF8A2000-memory.dmp

Filesize
3.9MB

Download
memory/4908-67-0x00007FF6EF4B0000-0x00007FF6EF8A2000-memory.dmp

Filesize
3.9MB

Download
memory/4984-846-0x00007FF75E960000-0x00007FF75ED52000-memory.dmp

Filesize
3.9MB

Download
memory/4984-4599-0x00007FF75E960000-0x00007FF75ED52000-memory.dmp

Filesize
3.9MB

Download
memory/5012-4634-0x00007FF67CE50000-0x00007FF67D242000-memory.dmp

Filesize
3.9MB

Download
memory/5012-361-0x00007FF67CE50000-0x00007FF67D242000-memory.dmp

Filesize
3.9MB

Download