xmrig | dd43da5b097ab5ba14e636da2edac9e2cdf2f0faf8b83df4f35207ca76d80d63

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28-04-2024 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
Size

1.9MB
MD5

04f1de717bbad5da61255559808ebd93
SHA1

cfa447d97fea312f1f30902aaaecf1ad6d8ac6cf
SHA256

dd43da5b097ab5ba14e636da2edac9e2cdf2f0faf8b83df4f35207ca76d80d63
SHA512

18d808636913b96aef4571a350af23eb7e56a8965a29c5d7a96782d175eb7fd12a66252da232b5e6e70fc8d85b9fb4e5fd7eaf40cf79d3f515c634e2de981610
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1uT:NAB/

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/memory/3268-72-0x00007FF780C60000-0x00007FF781052000-memory.dmp	xmrig
behavioral2/memory/3876-182-0x00007FF7A8D30000-0x00007FF7A9122000-memory.dmp	xmrig
behavioral2/memory/4600-188-0x00007FF638EE0000-0x00007FF6392D2000-memory.dmp	xmrig
behavioral2/memory/5000-194-0x00007FF6D6D30000-0x00007FF6D7122000-memory.dmp	xmrig
behavioral2/memory/3076-192-0x00007FF701A00000-0x00007FF701DF2000-memory.dmp	xmrig
behavioral2/memory/4440-190-0x00007FF67E410000-0x00007FF67E802000-memory.dmp	xmrig
behavioral2/memory/3460-185-0x00007FF797680000-0x00007FF797A72000-memory.dmp	xmrig
behavioral2/memory/4916-184-0x00007FF799150000-0x00007FF799542000-memory.dmp	xmrig
behavioral2/memory/4380-183-0x00007FF6598A0000-0x00007FF659C92000-memory.dmp	xmrig
behavioral2/memory/1172-181-0x00007FF7B1540000-0x00007FF7B1932000-memory.dmp	xmrig
behavioral2/memory/4644-180-0x00007FF6E7B20000-0x00007FF6E7F12000-memory.dmp	xmrig
behavioral2/memory/2228-179-0x00007FF607E40000-0x00007FF608232000-memory.dmp	xmrig
behavioral2/memory/2036-178-0x00007FF653F60000-0x00007FF654352000-memory.dmp	xmrig
behavioral2/memory/1204-171-0x00007FF6308B0000-0x00007FF630CA2000-memory.dmp	xmrig
behavioral2/memory/1880-153-0x00007FF7066D0000-0x00007FF706AC2000-memory.dmp	xmrig
behavioral2/memory/468-152-0x00007FF631E30000-0x00007FF632222000-memory.dmp	xmrig
behavioral2/memory/5040-139-0x00007FF7D4240000-0x00007FF7D4632000-memory.dmp	xmrig
behavioral2/memory/852-127-0x00007FF6B5570000-0x00007FF6B5962000-memory.dmp	xmrig
behavioral2/memory/3412-111-0x00007FF60B590000-0x00007FF60B982000-memory.dmp	xmrig
behavioral2/memory/2864-85-0x00007FF6C4F00000-0x00007FF6C52F2000-memory.dmp	xmrig
behavioral2/memory/3480-64-0x00007FF65E960000-0x00007FF65ED52000-memory.dmp	xmrig
behavioral2/memory/3412-4652-0x00007FF60B590000-0x00007FF60B982000-memory.dmp	xmrig
behavioral2/memory/2864-4653-0x00007FF6C4F00000-0x00007FF6C52F2000-memory.dmp	xmrig
behavioral2/memory/5040-4660-0x00007FF7D4240000-0x00007FF7D4632000-memory.dmp	xmrig
behavioral2/memory/1880-4738-0x00007FF7066D0000-0x00007FF706AC2000-memory.dmp	xmrig
behavioral2/memory/1172-4754-0x00007FF7B1540000-0x00007FF7B1932000-memory.dmp	xmrig
behavioral2/memory/468-4719-0x00007FF631E30000-0x00007FF632222000-memory.dmp	xmrig
behavioral2/memory/2036-4748-0x00007FF653F60000-0x00007FF654352000-memory.dmp	xmrig
behavioral2/memory/3076-4766-0x00007FF701A00000-0x00007FF701DF2000-memory.dmp	xmrig
behavioral2/memory/1204-4770-0x00007FF6308B0000-0x00007FF630CA2000-memory.dmp	xmrig
behavioral2/memory/4600-4834-0x00007FF638EE0000-0x00007FF6392D2000-memory.dmp	xmrig
behavioral2/memory/5000-4829-0x00007FF6D6D30000-0x00007FF6D7122000-memory.dmp	xmrig
behavioral2/memory/4380-4811-0x00007FF6598A0000-0x00007FF659C92000-memory.dmp	xmrig
behavioral2/memory/3460-4819-0x00007FF797680000-0x00007FF797A72000-memory.dmp	xmrig
behavioral2/memory/4916-4784-0x00007FF799150000-0x00007FF799542000-memory.dmp	xmrig
behavioral2/memory/4440-4773-0x00007FF67E410000-0x00007FF67E802000-memory.dmp	xmrig
behavioral2/memory/4644-4756-0x00007FF6E7B20000-0x00007FF6E7F12000-memory.dmp	xmrig
behavioral2/memory/3876-4761-0x00007FF7A8D30000-0x00007FF7A9122000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3480	hRNnmKk.exe
3268	hPBMBBC.exe
2864	aPimWKh.exe
3412	aykiQHL.exe
852	RuHWShQ.exe
5040	oxYKYfV.exe
468	OuORZsN.exe
1880	MXDbWta.exe
1204	nrfdSTg.exe
2036	RXdUJPr.exe
4440	rnvVprq.exe
2228	ShbDabO.exe
4644	uUJjcZP.exe
1172	bPQWIib.exe
3876	IqAwGXY.exe
3076	UgIqfPB.exe
4380	zgUwTLK.exe
4916	fZRsBLq.exe
3460	KVxUaCr.exe
5000	SXonFmw.exe
4600	fBHNLSS.exe
2588	ZSgkfPd.exe
4472	TNfODYQ.exe
3448	chNNFIW.exe
4376	ZwtqeBF.exe
3528	myTvwaa.exe
2088	QuUiHpB.exe
672	MnLHhRt.exe
1576	tLOYhnV.exe
4200	rzmfFHe.exe
5052	uMtfvFb.exe
3996	eVdJnvm.exe
1612	wCvqumt.exe
4324	zGyqKBy.exe
4500	YFMqqpw.exe
556	bjqnJbV.exe
4340	RvhLpny.exe
1004	VUWRLwJ.exe
5080	aDxdujZ.exe
3992	bzwlqAY.exe
804	uowNhpp.exe
4040	jjdiBkj.exe
3952	juFfKTT.exe
1436	hoCeNok.exe
632	ZhZqsWL.exe
2096	HEzeZuM.exe
4884	NrgHxoI.exe
4012	TTHsGcP.exe
1844	ufrwHhs.exe
2968	ONbNHnh.exe
1708	KFEngWq.exe
2780	ALNiTQU.exe
3236	JPoERwh.exe
2724	zuTIyJy.exe
4244	vQefbRX.exe
5044	DsfqBYQ.exe
1372	fAoiLaB.exe
4816	NJZejYy.exe
756	HETyYYd.exe
2748	HLYHDrA.exe
4828	QMFkWWJ.exe
3396	yduJCcD.exe
4620	vautsWt.exe
4460	guJlFTg.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3864-0-0x00007FF69A4C0000-0x00007FF69A8B2000-memory.dmp	upx
behavioral2/files/0x000a000000023b86-6.dat	upx
behavioral2/files/0x000d000000023b20-7.dat	upx
behavioral2/files/0x000a000000023b88-24.dat	upx
behavioral2/memory/3268-72-0x00007FF780C60000-0x00007FF781052000-memory.dmp	upx
behavioral2/files/0x000a000000023b95-107.dat	upx
behavioral2/files/0x000a000000023b9d-135.dat	upx
behavioral2/files/0x000a000000023b9c-157.dat	upx
behavioral2/files/0x000a000000023ba3-177.dat	upx
behavioral2/memory/3876-182-0x00007FF7A8D30000-0x00007FF7A9122000-memory.dmp	upx
behavioral2/memory/4600-188-0x00007FF638EE0000-0x00007FF6392D2000-memory.dmp	upx
behavioral2/memory/5000-194-0x00007FF6D6D30000-0x00007FF6D7122000-memory.dmp	upx
behavioral2/memory/3076-192-0x00007FF701A00000-0x00007FF701DF2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba1-191.dat	upx
behavioral2/memory/4440-190-0x00007FF67E410000-0x00007FF67E802000-memory.dmp	upx
behavioral2/files/0x000a000000023ba0-187.dat	upx
behavioral2/files/0x000c000000023b75-186.dat	upx
behavioral2/memory/3460-185-0x00007FF797680000-0x00007FF797A72000-memory.dmp	upx
behavioral2/memory/4916-184-0x00007FF799150000-0x00007FF799542000-memory.dmp	upx
behavioral2/memory/4380-183-0x00007FF6598A0000-0x00007FF659C92000-memory.dmp	upx
behavioral2/memory/1172-181-0x00007FF7B1540000-0x00007FF7B1932000-memory.dmp	upx
behavioral2/memory/4644-180-0x00007FF6E7B20000-0x00007FF6E7F12000-memory.dmp	upx
behavioral2/memory/2228-179-0x00007FF607E40000-0x00007FF608232000-memory.dmp	upx
behavioral2/memory/2036-178-0x00007FF653F60000-0x00007FF654352000-memory.dmp	upx
behavioral2/files/0x000a000000023ba2-176.dat	upx
behavioral2/files/0x000a000000023b9f-174.dat	upx
behavioral2/memory/1204-171-0x00007FF6308B0000-0x00007FF630CA2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9b-164.dat	upx
behavioral2/files/0x000a000000023b9e-163.dat	upx
behavioral2/files/0x000b000000023b8e-159.dat	upx
behavioral2/memory/1880-153-0x00007FF7066D0000-0x00007FF706AC2000-memory.dmp	upx
behavioral2/memory/468-152-0x00007FF631E30000-0x00007FF632222000-memory.dmp	upx
behavioral2/files/0x000a000000023b9a-147.dat	upx
behavioral2/files/0x000b000000023b8f-146.dat	upx
behavioral2/files/0x000a000000023b99-142.dat	upx
behavioral2/memory/5040-139-0x00007FF7D4240000-0x00007FF7D4632000-memory.dmp	upx
behavioral2/files/0x000a000000023b98-133.dat	upx
behavioral2/files/0x000a000000023b97-131.dat	upx
behavioral2/memory/852-127-0x00007FF6B5570000-0x00007FF6B5962000-memory.dmp	upx
behavioral2/files/0x000a000000023b96-124.dat	upx
behavioral2/memory/3412-111-0x00007FF60B590000-0x00007FF60B982000-memory.dmp	upx
behavioral2/files/0x000a000000023b94-105.dat	upx
behavioral2/files/0x000a000000023b93-103.dat	upx
behavioral2/files/0x000a000000023b92-99.dat	upx
behavioral2/files/0x000a000000023b90-95.dat	upx
behavioral2/files/0x000a000000023b91-91.dat	upx
behavioral2/memory/2864-85-0x00007FF6C4F00000-0x00007FF6C52F2000-memory.dmp	upx
behavioral2/files/0x000a000000023b8d-79.dat	upx
behavioral2/files/0x000a000000023b8b-68.dat	upx
behavioral2/files/0x000a000000023b8c-73.dat	upx
behavioral2/memory/3480-64-0x00007FF65E960000-0x00007FF65ED52000-memory.dmp	upx
behavioral2/files/0x000a000000023b8a-53.dat	upx
behavioral2/files/0x000a000000023b89-37.dat	upx
behavioral2/files/0x000a000000023b87-19.dat	upx
behavioral2/files/0x000d000000023b74-17.dat	upx
behavioral2/memory/3412-4652-0x00007FF60B590000-0x00007FF60B982000-memory.dmp	upx
behavioral2/memory/2864-4653-0x00007FF6C4F00000-0x00007FF6C52F2000-memory.dmp	upx
behavioral2/memory/5040-4660-0x00007FF7D4240000-0x00007FF7D4632000-memory.dmp	upx
behavioral2/memory/1880-4738-0x00007FF7066D0000-0x00007FF706AC2000-memory.dmp	upx
behavioral2/memory/1172-4754-0x00007FF7B1540000-0x00007FF7B1932000-memory.dmp	upx
behavioral2/memory/468-4719-0x00007FF631E30000-0x00007FF632222000-memory.dmp	upx
behavioral2/memory/2036-4748-0x00007FF653F60000-0x00007FF654352000-memory.dmp	upx
behavioral2/memory/3076-4766-0x00007FF701A00000-0x00007FF701DF2000-memory.dmp	upx
behavioral2/memory/1204-4770-0x00007FF6308B0000-0x00007FF630CA2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ODlvCnU.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\SandgLz.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\IfpeYkY.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\yiJGElw.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\RiKUUSw.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\EkNutCa.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\dwNoZXS.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\PrgukAm.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\sQKgbKb.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\KDdpEza.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\KntQjoE.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\TUiduWz.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\XKxCbfF.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\SCWgLDT.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\KFbflrC.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\ErQSygb.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\ktCTaMB.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\noVSlRC.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\hoSnIEz.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\ofEnogs.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\OneLylL.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\ZLIXuvA.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\flYvPYe.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\QARxcfw.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\CVbURhO.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\qnzRqWH.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\YLFZlif.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\ykvppHG.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\gidppZc.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\OndWtNn.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\gNwaGLP.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\bXaicGD.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\MJQUFJc.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\syUaTtA.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\RzrfmoQ.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\vZsMRnV.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\mIRqixz.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\JJwXaod.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\vaZdUlx.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\hoESEBV.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\ARvCqOm.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\GDdayIw.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\xKwaSbz.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\zAoOALa.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\fwYwPfg.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\zPCEjPs.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\lYTBTEN.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\mJdmCGs.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\OsZCfQC.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\tnTirns.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\BoWwABs.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\DxuZipz.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\cxdJsau.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\curhxQh.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\kfAcWiq.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\gItHFxb.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\lJDNfdF.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\FATsayx.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\UFEntGO.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\bdgbzNB.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\TvzhZoR.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\YckgdUz.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\GTUfNdU.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
File created	C:\Windows\System\RaVeisZ.exe	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3628	powershell.exe
3628	powershell.exe
3628	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
Token: SeDebugPrivilege	3628	powershell.exe
Token: SeLockMemoryPrivilege	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 3628	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	85
PID 3864 wrote to memory of 3628	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	85
PID 3864 wrote to memory of 3480	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	86
PID 3864 wrote to memory of 3480	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	86
PID 3864 wrote to memory of 3268	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	87
PID 3864 wrote to memory of 3268	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	87
PID 3864 wrote to memory of 2864	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	88
PID 3864 wrote to memory of 2864	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	88
PID 3864 wrote to memory of 3412	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	89
PID 3864 wrote to memory of 3412	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	89
PID 3864 wrote to memory of 852	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	90
PID 3864 wrote to memory of 852	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	90
PID 3864 wrote to memory of 5040	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	91
PID 3864 wrote to memory of 5040	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	91
PID 3864 wrote to memory of 468	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	92
PID 3864 wrote to memory of 468	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	92
PID 3864 wrote to memory of 1880	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	93
PID 3864 wrote to memory of 1880	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	93
PID 3864 wrote to memory of 1204	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	94
PID 3864 wrote to memory of 1204	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	94
PID 3864 wrote to memory of 2036	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	95
PID 3864 wrote to memory of 2036	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	95
PID 3864 wrote to memory of 2228	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	96
PID 3864 wrote to memory of 2228	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	96
PID 3864 wrote to memory of 4440	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	97
PID 3864 wrote to memory of 4440	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	97
PID 3864 wrote to memory of 4644	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	98
PID 3864 wrote to memory of 4644	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	98
PID 3864 wrote to memory of 1172	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	99
PID 3864 wrote to memory of 1172	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	99
PID 3864 wrote to memory of 3876	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	100
PID 3864 wrote to memory of 3876	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	100
PID 3864 wrote to memory of 3076	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	101
PID 3864 wrote to memory of 3076	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	101
PID 3864 wrote to memory of 4380	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	102
PID 3864 wrote to memory of 4380	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	102
PID 3864 wrote to memory of 4916	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	103
PID 3864 wrote to memory of 4916	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	103
PID 3864 wrote to memory of 3460	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	104
PID 3864 wrote to memory of 3460	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	104
PID 3864 wrote to memory of 5000	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	105
PID 3864 wrote to memory of 5000	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	105
PID 3864 wrote to memory of 4600	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	106
PID 3864 wrote to memory of 4600	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	106
PID 3864 wrote to memory of 2588	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	107
PID 3864 wrote to memory of 2588	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	107
PID 3864 wrote to memory of 4472	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	108
PID 3864 wrote to memory of 4472	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	108
PID 3864 wrote to memory of 3448	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	109
PID 3864 wrote to memory of 3448	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	109
PID 3864 wrote to memory of 4376	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	110
PID 3864 wrote to memory of 4376	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	110
PID 3864 wrote to memory of 3528	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	111
PID 3864 wrote to memory of 3528	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	111
PID 3864 wrote to memory of 2088	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	112
PID 3864 wrote to memory of 2088	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	112
PID 3864 wrote to memory of 672	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	113
PID 3864 wrote to memory of 672	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	113
PID 3864 wrote to memory of 1576	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	114
PID 3864 wrote to memory of 1576	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	114
PID 3864 wrote to memory of 4200	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	115
PID 3864 wrote to memory of 4200	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	115
PID 3864 wrote to memory of 5052	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	116
PID 3864 wrote to memory of 5052	3864	04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04f1de717bbad5da61255559808ebd93_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3628
- C:\Windows\System\hRNnmKk.exe
  C:\Windows\System\hRNnmKk.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\hPBMBBC.exe
  C:\Windows\System\hPBMBBC.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\aPimWKh.exe
  C:\Windows\System\aPimWKh.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\aykiQHL.exe
  C:\Windows\System\aykiQHL.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\RuHWShQ.exe
  C:\Windows\System\RuHWShQ.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\oxYKYfV.exe
  C:\Windows\System\oxYKYfV.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\OuORZsN.exe
  C:\Windows\System\OuORZsN.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\MXDbWta.exe
  C:\Windows\System\MXDbWta.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\nrfdSTg.exe
  C:\Windows\System\nrfdSTg.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\RXdUJPr.exe
  C:\Windows\System\RXdUJPr.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\ShbDabO.exe
  C:\Windows\System\ShbDabO.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\rnvVprq.exe
  C:\Windows\System\rnvVprq.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\uUJjcZP.exe
  C:\Windows\System\uUJjcZP.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\bPQWIib.exe
  C:\Windows\System\bPQWIib.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\IqAwGXY.exe
  C:\Windows\System\IqAwGXY.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\UgIqfPB.exe
  C:\Windows\System\UgIqfPB.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\zgUwTLK.exe
  C:\Windows\System\zgUwTLK.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\fZRsBLq.exe
  C:\Windows\System\fZRsBLq.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\KVxUaCr.exe
  C:\Windows\System\KVxUaCr.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\SXonFmw.exe
  C:\Windows\System\SXonFmw.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\fBHNLSS.exe
  C:\Windows\System\fBHNLSS.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\ZSgkfPd.exe
  C:\Windows\System\ZSgkfPd.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\TNfODYQ.exe
  C:\Windows\System\TNfODYQ.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\chNNFIW.exe
  C:\Windows\System\chNNFIW.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\ZwtqeBF.exe
  C:\Windows\System\ZwtqeBF.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\myTvwaa.exe
  C:\Windows\System\myTvwaa.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\QuUiHpB.exe
  C:\Windows\System\QuUiHpB.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\MnLHhRt.exe
  C:\Windows\System\MnLHhRt.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\tLOYhnV.exe
  C:\Windows\System\tLOYhnV.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\rzmfFHe.exe
  C:\Windows\System\rzmfFHe.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\uMtfvFb.exe
  C:\Windows\System\uMtfvFb.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\eVdJnvm.exe
  C:\Windows\System\eVdJnvm.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\wCvqumt.exe
  C:\Windows\System\wCvqumt.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\zGyqKBy.exe
  C:\Windows\System\zGyqKBy.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\YFMqqpw.exe
  C:\Windows\System\YFMqqpw.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\bjqnJbV.exe
  C:\Windows\System\bjqnJbV.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\RvhLpny.exe
  C:\Windows\System\RvhLpny.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\VUWRLwJ.exe
  C:\Windows\System\VUWRLwJ.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\aDxdujZ.exe
  C:\Windows\System\aDxdujZ.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\uowNhpp.exe
  C:\Windows\System\uowNhpp.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\bzwlqAY.exe
  C:\Windows\System\bzwlqAY.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\juFfKTT.exe
  C:\Windows\System\juFfKTT.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\jjdiBkj.exe
  C:\Windows\System\jjdiBkj.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\hoCeNok.exe
  C:\Windows\System\hoCeNok.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\ZhZqsWL.exe
  C:\Windows\System\ZhZqsWL.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\HEzeZuM.exe
  C:\Windows\System\HEzeZuM.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\NrgHxoI.exe
  C:\Windows\System\NrgHxoI.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\TTHsGcP.exe
  C:\Windows\System\TTHsGcP.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\ufrwHhs.exe
  C:\Windows\System\ufrwHhs.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\ONbNHnh.exe
  C:\Windows\System\ONbNHnh.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\KFEngWq.exe
  C:\Windows\System\KFEngWq.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\ALNiTQU.exe
  C:\Windows\System\ALNiTQU.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\JPoERwh.exe
  C:\Windows\System\JPoERwh.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\zuTIyJy.exe
  C:\Windows\System\zuTIyJy.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\vQefbRX.exe
  C:\Windows\System\vQefbRX.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\DsfqBYQ.exe
  C:\Windows\System\DsfqBYQ.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\fAoiLaB.exe
  C:\Windows\System\fAoiLaB.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\NJZejYy.exe
  C:\Windows\System\NJZejYy.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\HETyYYd.exe
  C:\Windows\System\HETyYYd.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\QMFkWWJ.exe
  C:\Windows\System\QMFkWWJ.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\yduJCcD.exe
  C:\Windows\System\yduJCcD.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\vautsWt.exe
  C:\Windows\System\vautsWt.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\HLYHDrA.exe
  C:\Windows\System\HLYHDrA.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\guJlFTg.exe
  C:\Windows\System\guJlFTg.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\psJotCR.exe
  C:\Windows\System\psJotCR.exe
  2⤵
  PID:3284
- C:\Windows\System\BsimOiR.exe
  C:\Windows\System\BsimOiR.exe
  2⤵
  PID:4128
- C:\Windows\System\UBAThCm.exe
  C:\Windows\System\UBAThCm.exe
  2⤵
  PID:1548
- C:\Windows\System\XRpzvKC.exe
  C:\Windows\System\XRpzvKC.exe
  2⤵
  PID:3724
- C:\Windows\System\CbFSTWi.exe
  C:\Windows\System\CbFSTWi.exe
  2⤵
  PID:2800
- C:\Windows\System\EIlItcb.exe
  C:\Windows\System\EIlItcb.exe
  2⤵
  PID:2352
- C:\Windows\System\ADkOFsK.exe
  C:\Windows\System\ADkOFsK.exe
  2⤵
  PID:848
- C:\Windows\System\FSpfyvi.exe
  C:\Windows\System\FSpfyvi.exe
  2⤵
  PID:4232
- C:\Windows\System\jEDGFKr.exe
  C:\Windows\System\jEDGFKr.exe
  2⤵
  PID:3584
- C:\Windows\System\JOBEjpX.exe
  C:\Windows\System\JOBEjpX.exe
  2⤵
  PID:1560
- C:\Windows\System\eUMxvsh.exe
  C:\Windows\System\eUMxvsh.exe
  2⤵
  PID:1628
- C:\Windows\System\tkpNyfE.exe
  C:\Windows\System\tkpNyfE.exe
  2⤵
  PID:1072
- C:\Windows\System\IdDPbtq.exe
  C:\Windows\System\IdDPbtq.exe
  2⤵
  PID:3752
- C:\Windows\System\DrYWBjf.exe
  C:\Windows\System\DrYWBjf.exe
  2⤵
  PID:2860
- C:\Windows\System\tUMTFDd.exe
  C:\Windows\System\tUMTFDd.exe
  2⤵
  PID:3388
- C:\Windows\System\RTElfrd.exe
  C:\Windows\System\RTElfrd.exe
  2⤵
  PID:3712
- C:\Windows\System\GkSVlQa.exe
  C:\Windows\System\GkSVlQa.exe
  2⤵
  PID:3392
- C:\Windows\System\iXmmGnh.exe
  C:\Windows\System\iXmmGnh.exe
  2⤵
  PID:728
- C:\Windows\System\SdvuzzW.exe
  C:\Windows\System\SdvuzzW.exe
  2⤵
  PID:1788
- C:\Windows\System\bWJGWXg.exe
  C:\Windows\System\bWJGWXg.exe
  2⤵
  PID:2212
- C:\Windows\System\LSQDEsC.exe
  C:\Windows\System\LSQDEsC.exe
  2⤵
  PID:1924
- C:\Windows\System\FevyblD.exe
  C:\Windows\System\FevyblD.exe
  2⤵
  PID:2452
- C:\Windows\System\WJxQECt.exe
  C:\Windows\System\WJxQECt.exe
  2⤵
  PID:4956
- C:\Windows\System\lROYJNx.exe
  C:\Windows\System\lROYJNx.exe
  2⤵
  PID:2480
- C:\Windows\System\ynkMeJP.exe
  C:\Windows\System\ynkMeJP.exe
  2⤵
  PID:4004
- C:\Windows\System\PGcqYDP.exe
  C:\Windows\System\PGcqYDP.exe
  2⤵
  PID:3648
- C:\Windows\System\SHpDRJV.exe
  C:\Windows\System\SHpDRJV.exe
  2⤵
  PID:2604
- C:\Windows\System\vbZoHzo.exe
  C:\Windows\System\vbZoHzo.exe
  2⤵
  PID:4964
- C:\Windows\System\QxTGYOH.exe
  C:\Windows\System\QxTGYOH.exe
  2⤵
  PID:4400
- C:\Windows\System\TuScuWe.exe
  C:\Windows\System\TuScuWe.exe
  2⤵
  PID:5136
- C:\Windows\System\ffFymxf.exe
  C:\Windows\System\ffFymxf.exe
  2⤵
  PID:5160
- C:\Windows\System\fsfuedx.exe
  C:\Windows\System\fsfuedx.exe
  2⤵
  PID:5236
- C:\Windows\System\UKGRHmK.exe
  C:\Windows\System\UKGRHmK.exe
  2⤵
  PID:5264
- C:\Windows\System\xeYgadj.exe
  C:\Windows\System\xeYgadj.exe
  2⤵
  PID:5284
- C:\Windows\System\gRpenND.exe
  C:\Windows\System\gRpenND.exe
  2⤵
  PID:5304
- C:\Windows\System\AnCCZUA.exe
  C:\Windows\System\AnCCZUA.exe
  2⤵
  PID:5320
- C:\Windows\System\pRaVYlD.exe
  C:\Windows\System\pRaVYlD.exe
  2⤵
  PID:5344
- C:\Windows\System\GYKRuYk.exe
  C:\Windows\System\GYKRuYk.exe
  2⤵
  PID:5360
- C:\Windows\System\PTQGiQo.exe
  C:\Windows\System\PTQGiQo.exe
  2⤵
  PID:5388
- C:\Windows\System\ZeWZvau.exe
  C:\Windows\System\ZeWZvau.exe
  2⤵
  PID:5416
- C:\Windows\System\yvlOljR.exe
  C:\Windows\System\yvlOljR.exe
  2⤵
  PID:5444
- C:\Windows\System\HCccQWX.exe
  C:\Windows\System\HCccQWX.exe
  2⤵
  PID:5464
- C:\Windows\System\TvQlvyx.exe
  C:\Windows\System\TvQlvyx.exe
  2⤵
  PID:5484
- C:\Windows\System\SEymyEJ.exe
  C:\Windows\System\SEymyEJ.exe
  2⤵
  PID:5504
- C:\Windows\System\qJDdddX.exe
  C:\Windows\System\qJDdddX.exe
  2⤵
  PID:5532
- C:\Windows\System\FAMyBlK.exe
  C:\Windows\System\FAMyBlK.exe
  2⤵
  PID:5548
- C:\Windows\System\SvETefC.exe
  C:\Windows\System\SvETefC.exe
  2⤵
  PID:5572
- C:\Windows\System\gbFgDWz.exe
  C:\Windows\System\gbFgDWz.exe
  2⤵
  PID:5588
- C:\Windows\System\eBZQsgo.exe
  C:\Windows\System\eBZQsgo.exe
  2⤵
  PID:5612
- C:\Windows\System\ftgWXOV.exe
  C:\Windows\System\ftgWXOV.exe
  2⤵
  PID:5648
- C:\Windows\System\YTLQQnb.exe
  C:\Windows\System\YTLQQnb.exe
  2⤵
  PID:5664
- C:\Windows\System\jMSjmbc.exe
  C:\Windows\System\jMSjmbc.exe
  2⤵
  PID:5688
- C:\Windows\System\xwrLzHI.exe
  C:\Windows\System\xwrLzHI.exe
  2⤵
  PID:5712
- C:\Windows\System\nlSstlo.exe
  C:\Windows\System\nlSstlo.exe
  2⤵
  PID:5736
- C:\Windows\System\kwGVEIS.exe
  C:\Windows\System\kwGVEIS.exe
  2⤵
  PID:5760
- C:\Windows\System\WmoEMQV.exe
  C:\Windows\System\WmoEMQV.exe
  2⤵
  PID:5776
- C:\Windows\System\ifBkPOK.exe
  C:\Windows\System\ifBkPOK.exe
  2⤵
  PID:5804
- C:\Windows\System\CSXevfh.exe
  C:\Windows\System\CSXevfh.exe
  2⤵
  PID:5820
- C:\Windows\System\wBfcTOk.exe
  C:\Windows\System\wBfcTOk.exe
  2⤵
  PID:5844
- C:\Windows\System\VMoFQfi.exe
  C:\Windows\System\VMoFQfi.exe
  2⤵
  PID:5868
- C:\Windows\System\SaXnIHP.exe
  C:\Windows\System\SaXnIHP.exe
  2⤵
  PID:5888
- C:\Windows\System\VNeymdM.exe
  C:\Windows\System\VNeymdM.exe
  2⤵
  PID:5916
- C:\Windows\System\oEvkzvh.exe
  C:\Windows\System\oEvkzvh.exe
  2⤵
  PID:5936
- C:\Windows\System\kxKThzm.exe
  C:\Windows\System\kxKThzm.exe
  2⤵
  PID:5956
- C:\Windows\System\GNcxnMp.exe
  C:\Windows\System\GNcxnMp.exe
  2⤵
  PID:5976
- C:\Windows\System\oCATFqj.exe
  C:\Windows\System\oCATFqj.exe
  2⤵
  PID:6008
- C:\Windows\System\WMJOhpO.exe
  C:\Windows\System\WMJOhpO.exe
  2⤵
  PID:6024
- C:\Windows\System\APpEuJh.exe
  C:\Windows\System\APpEuJh.exe
  2⤵
  PID:6052
- C:\Windows\System\vmdkeZC.exe
  C:\Windows\System\vmdkeZC.exe
  2⤵
  PID:6076
- C:\Windows\System\yOQZBLX.exe
  C:\Windows\System\yOQZBLX.exe
  2⤵
  PID:6092
- C:\Windows\System\IUhLFCT.exe
  C:\Windows\System\IUhLFCT.exe
  2⤵
  PID:6112
- C:\Windows\System\OzMiuso.exe
  C:\Windows\System\OzMiuso.exe
  2⤵
  PID:6132
- C:\Windows\System\YQmDUFe.exe
  C:\Windows\System\YQmDUFe.exe
  2⤵
  PID:4360
- C:\Windows\System\EOhGWSm.exe
  C:\Windows\System\EOhGWSm.exe
  2⤵
  PID:4896
- C:\Windows\System\ygeleNX.exe
  C:\Windows\System\ygeleNX.exe
  2⤵
  PID:5152
- C:\Windows\System\lIvRzwr.exe
  C:\Windows\System\lIvRzwr.exe
  2⤵
  PID:5228
- C:\Windows\System\icxBHAH.exe
  C:\Windows\System\icxBHAH.exe
  2⤵
  PID:5188
- C:\Windows\System\sTizJiQ.exe
  C:\Windows\System\sTizJiQ.exe
  2⤵
  PID:5332
- C:\Windows\System\kJkpzBL.exe
  C:\Windows\System\kJkpzBL.exe
  2⤵
  PID:5400
- C:\Windows\System\iLpqUHY.exe
  C:\Windows\System\iLpqUHY.exe
  2⤵
  PID:5256
- C:\Windows\System\mkPzvyi.exe
  C:\Windows\System\mkPzvyi.exe
  2⤵
  PID:5476
- C:\Windows\System\dRHBhBe.exe
  C:\Windows\System\dRHBhBe.exe
  2⤵
  PID:5496
- C:\Windows\System\OrCNeTY.exe
  C:\Windows\System\OrCNeTY.exe
  2⤵
  PID:5580
- C:\Windows\System\DsRRblE.exe
  C:\Windows\System\DsRRblE.exe
  2⤵
  PID:5672
- C:\Windows\System\nLNLuGR.exe
  C:\Windows\System\nLNLuGR.exe
  2⤵
  PID:5708
- C:\Windows\System\amVjMLB.exe
  C:\Windows\System\amVjMLB.exe
  2⤵
  PID:5748
- C:\Windows\System\OwuaoZn.exe
  C:\Windows\System\OwuaoZn.exe
  2⤵
  PID:5596
- C:\Windows\System\eTgFutf.exe
  C:\Windows\System\eTgFutf.exe
  2⤵
  PID:5436
- C:\Windows\System\sqOyeGL.exe
  C:\Windows\System\sqOyeGL.exe
  2⤵
  PID:5896
- C:\Windows\System\owgYJsi.exe
  C:\Windows\System\owgYJsi.exe
  2⤵
  PID:5924
- C:\Windows\System\jEjXVxg.exe
  C:\Windows\System\jEjXVxg.exe
  2⤵
  PID:5972
- C:\Windows\System\TCWlVFX.exe
  C:\Windows\System\TCWlVFX.exe
  2⤵
  PID:5784
- C:\Windows\System\FUMPtAb.exe
  C:\Windows\System\FUMPtAb.exe
  2⤵
  PID:6032
- C:\Windows\System\VoEuHPr.exe
  C:\Windows\System\VoEuHPr.exe
  2⤵
  PID:5964
- C:\Windows\System\UCqFcbA.exe
  C:\Windows\System\UCqFcbA.exe
  2⤵
  PID:3852
- C:\Windows\System\zjuBrCK.exe
  C:\Windows\System\zjuBrCK.exe
  2⤵
  PID:6156
- C:\Windows\System\aJTlXqn.exe
  C:\Windows\System\aJTlXqn.exe
  2⤵
  PID:6176
- C:\Windows\System\ZbDIjcC.exe
  C:\Windows\System\ZbDIjcC.exe
  2⤵
  PID:6200
- C:\Windows\System\ADXMfwY.exe
  C:\Windows\System\ADXMfwY.exe
  2⤵
  PID:6220
- C:\Windows\System\jTlVCSb.exe
  C:\Windows\System\jTlVCSb.exe
  2⤵
  PID:6244
- C:\Windows\System\qUssHKe.exe
  C:\Windows\System\qUssHKe.exe
  2⤵
  PID:6268
- C:\Windows\System\AwkBQpT.exe
  C:\Windows\System\AwkBQpT.exe
  2⤵
  PID:6288
- C:\Windows\System\SDjjVaU.exe
  C:\Windows\System\SDjjVaU.exe
  2⤵
  PID:6312
- C:\Windows\System\oCqTjjy.exe
  C:\Windows\System\oCqTjjy.exe
  2⤵
  PID:6332
- C:\Windows\System\ujFHrgi.exe
  C:\Windows\System\ujFHrgi.exe
  2⤵
  PID:6352
- C:\Windows\System\ejWPVhA.exe
  C:\Windows\System\ejWPVhA.exe
  2⤵
  PID:6372
- C:\Windows\System\fcEijsz.exe
  C:\Windows\System\fcEijsz.exe
  2⤵
  PID:6400
- C:\Windows\System\lgMSDqq.exe
  C:\Windows\System\lgMSDqq.exe
  2⤵
  PID:6424
- C:\Windows\System\hLJmpsN.exe
  C:\Windows\System\hLJmpsN.exe
  2⤵
  PID:6448
- C:\Windows\System\CgbHNkB.exe
  C:\Windows\System\CgbHNkB.exe
  2⤵
  PID:6476
- C:\Windows\System\WOnACfo.exe
  C:\Windows\System\WOnACfo.exe
  2⤵
  PID:6496
- C:\Windows\System\RIovZnY.exe
  C:\Windows\System\RIovZnY.exe
  2⤵
  PID:6520
- C:\Windows\System\ftRfQtE.exe
  C:\Windows\System\ftRfQtE.exe
  2⤵
  PID:6540
- C:\Windows\System\grycZkU.exe
  C:\Windows\System\grycZkU.exe
  2⤵
  PID:6564
- C:\Windows\System\pnSnRbm.exe
  C:\Windows\System\pnSnRbm.exe
  2⤵
  PID:6588
- C:\Windows\System\jzlktUY.exe
  C:\Windows\System\jzlktUY.exe
  2⤵
  PID:6620
- C:\Windows\System\tnyQmyy.exe
  C:\Windows\System\tnyQmyy.exe
  2⤵
  PID:6640
- C:\Windows\System\RyHkTKe.exe
  C:\Windows\System\RyHkTKe.exe
  2⤵
  PID:6664
- C:\Windows\System\jTQPETa.exe
  C:\Windows\System\jTQPETa.exe
  2⤵
  PID:6684
- C:\Windows\System\Uanskno.exe
  C:\Windows\System\Uanskno.exe
  2⤵
  PID:6708
- C:\Windows\System\LpcDrsY.exe
  C:\Windows\System\LpcDrsY.exe
  2⤵
  PID:6732
- C:\Windows\System\vEipBiU.exe
  C:\Windows\System\vEipBiU.exe
  2⤵
  PID:6756
- C:\Windows\System\RrjUgYm.exe
  C:\Windows\System\RrjUgYm.exe
  2⤵
  PID:6780
- C:\Windows\System\wCOGeGX.exe
  C:\Windows\System\wCOGeGX.exe
  2⤵
  PID:6796
- C:\Windows\System\WXZaLkx.exe
  C:\Windows\System\WXZaLkx.exe
  2⤵
  PID:6816
- C:\Windows\System\KPiYPiL.exe
  C:\Windows\System\KPiYPiL.exe
  2⤵
  PID:6844
- C:\Windows\System\nJohkzW.exe
  C:\Windows\System\nJohkzW.exe
  2⤵
  PID:6868
- C:\Windows\System\MZbjPOr.exe
  C:\Windows\System\MZbjPOr.exe
  2⤵
  PID:6884
- C:\Windows\System\ctBrNHn.exe
  C:\Windows\System\ctBrNHn.exe
  2⤵
  PID:6908
- C:\Windows\System\aqraVpc.exe
  C:\Windows\System\aqraVpc.exe
  2⤵
  PID:6932
- C:\Windows\System\EAsAHAR.exe
  C:\Windows\System\EAsAHAR.exe
  2⤵
  PID:6952
- C:\Windows\System\IkbBsWY.exe
  C:\Windows\System\IkbBsWY.exe
  2⤵
  PID:6976
- C:\Windows\System\TthxDoE.exe
  C:\Windows\System\TthxDoE.exe
  2⤵
  PID:6996
- C:\Windows\System\lHSvqSm.exe
  C:\Windows\System\lHSvqSm.exe
  2⤵
  PID:7020
- C:\Windows\System\OndcMdS.exe
  C:\Windows\System\OndcMdS.exe
  2⤵
  PID:7040
- C:\Windows\System\rlnvNIh.exe
  C:\Windows\System\rlnvNIh.exe
  2⤵
  PID:7060
- C:\Windows\System\HTLEjqW.exe
  C:\Windows\System\HTLEjqW.exe
  2⤵
  PID:7084
- C:\Windows\System\swauXaD.exe
  C:\Windows\System\swauXaD.exe
  2⤵
  PID:7108
- C:\Windows\System\iOADqwU.exe
  C:\Windows\System\iOADqwU.exe
  2⤵
  PID:7128
- C:\Windows\System\SYOtoGf.exe
  C:\Windows\System\SYOtoGf.exe
  2⤵
  PID:7156
- C:\Windows\System\LYwpdyK.exe
  C:\Windows\System\LYwpdyK.exe
  2⤵
  PID:5328
- C:\Windows\System\LaLblbV.exe
  C:\Windows\System\LaLblbV.exe
  2⤵
  PID:5432
- C:\Windows\System\ABFQtnq.exe
  C:\Windows\System\ABFQtnq.exe
  2⤵
  PID:5624
- C:\Windows\System\HMCmrGt.exe
  C:\Windows\System\HMCmrGt.exe
  2⤵
  PID:5512
- C:\Windows\System\YmvsNxy.exe
  C:\Windows\System\YmvsNxy.exe
  2⤵
  PID:5640
- C:\Windows\System\TxpDGDP.exe
  C:\Windows\System\TxpDGDP.exe
  2⤵
  PID:624
- C:\Windows\System\FBqoKDU.exe
  C:\Windows\System\FBqoKDU.exe
  2⤵
  PID:6128
- C:\Windows\System\HJIEjgl.exe
  C:\Windows\System\HJIEjgl.exe
  2⤵
  PID:6172
- C:\Windows\System\earhiaK.exe
  C:\Windows\System\earhiaK.exe
  2⤵
  PID:6216
- C:\Windows\System\pVNlIuk.exe
  C:\Windows\System\pVNlIuk.exe
  2⤵
  PID:5352
- C:\Windows\System\IXhUsBN.exe
  C:\Windows\System\IXhUsBN.exe
  2⤵
  PID:6072
- C:\Windows\System\aVDFNYE.exe
  C:\Windows\System\aVDFNYE.exe
  2⤵
  PID:6420
- C:\Windows\System\ngnxRYu.exe
  C:\Windows\System\ngnxRYu.exe
  2⤵
  PID:6468
- C:\Windows\System\ArRXrUQ.exe
  C:\Windows\System\ArRXrUQ.exe
  2⤵
  PID:5996
- C:\Windows\System\rfVAXIp.exe
  C:\Windows\System\rfVAXIp.exe
  2⤵
  PID:6560
- C:\Windows\System\xQhXOoi.exe
  C:\Windows\System\xQhXOoi.exe
  2⤵
  PID:6344
- C:\Windows\System\nAKJXtX.exe
  C:\Windows\System\nAKJXtX.exe
  2⤵
  PID:6388
- C:\Windows\System\gywMAIA.exe
  C:\Windows\System\gywMAIA.exe
  2⤵
  PID:5556
- C:\Windows\System\wYLYmeG.exe
  C:\Windows\System\wYLYmeG.exe
  2⤵
  PID:6880
- C:\Windows\System\uItqhHK.exe
  C:\Windows\System\uItqhHK.exe
  2⤵
  PID:6016
- C:\Windows\System\JDQwGwJ.exe
  C:\Windows\System\JDQwGwJ.exe
  2⤵
  PID:6988
- C:\Windows\System\WZiOqrQ.exe
  C:\Windows\System\WZiOqrQ.exe
  2⤵
  PID:7188
- C:\Windows\System\TpyZDKI.exe
  C:\Windows\System\TpyZDKI.exe
  2⤵
  PID:7208
- C:\Windows\System\zZecmln.exe
  C:\Windows\System\zZecmln.exe
  2⤵
  PID:7232
- C:\Windows\System\uEOmVbk.exe
  C:\Windows\System\uEOmVbk.exe
  2⤵
  PID:7252
- C:\Windows\System\hriJSqT.exe
  C:\Windows\System\hriJSqT.exe
  2⤵
  PID:7272
- C:\Windows\System\LzkYlKZ.exe
  C:\Windows\System\LzkYlKZ.exe
  2⤵
  PID:7300
- C:\Windows\System\yCVbIKt.exe
  C:\Windows\System\yCVbIKt.exe
  2⤵
  PID:7320
- C:\Windows\System\gFjtCFE.exe
  C:\Windows\System\gFjtCFE.exe
  2⤵
  PID:7340
- C:\Windows\System\JxaILPJ.exe
  C:\Windows\System\JxaILPJ.exe
  2⤵
  PID:7368
- C:\Windows\System\nadtoRf.exe
  C:\Windows\System\nadtoRf.exe
  2⤵
  PID:7396
- C:\Windows\System\JbpuXIE.exe
  C:\Windows\System\JbpuXIE.exe
  2⤵
  PID:7420
- C:\Windows\System\JlgJBia.exe
  C:\Windows\System\JlgJBia.exe
  2⤵
  PID:7440
- C:\Windows\System\TqmLJBw.exe
  C:\Windows\System\TqmLJBw.exe
  2⤵
  PID:7468
- C:\Windows\System\vrkllxr.exe
  C:\Windows\System\vrkllxr.exe
  2⤵
  PID:7484
- C:\Windows\System\ppcPlTh.exe
  C:\Windows\System\ppcPlTh.exe
  2⤵
  PID:7508
- C:\Windows\System\OxArnPN.exe
  C:\Windows\System\OxArnPN.exe
  2⤵
  PID:7528
- C:\Windows\System\IZgNAWG.exe
  C:\Windows\System\IZgNAWG.exe
  2⤵
  PID:7548
- C:\Windows\System\ykaQkOT.exe
  C:\Windows\System\ykaQkOT.exe
  2⤵
  PID:7568
- C:\Windows\System\MtTRjpl.exe
  C:\Windows\System\MtTRjpl.exe
  2⤵
  PID:7588
- C:\Windows\System\cabsHQG.exe
  C:\Windows\System\cabsHQG.exe
  2⤵
  PID:7612
- C:\Windows\System\VTLQpsV.exe
  C:\Windows\System\VTLQpsV.exe
  2⤵
  PID:7636
- C:\Windows\System\YdVJkIr.exe
  C:\Windows\System\YdVJkIr.exe
  2⤵
  PID:7652
- C:\Windows\System\zLGnqOn.exe
  C:\Windows\System\zLGnqOn.exe
  2⤵
  PID:7676
- C:\Windows\System\pbqZGmS.exe
  C:\Windows\System\pbqZGmS.exe
  2⤵
  PID:7696
- C:\Windows\System\Djmucnd.exe
  C:\Windows\System\Djmucnd.exe
  2⤵
  PID:7716
- C:\Windows\System\dXLjfsH.exe
  C:\Windows\System\dXLjfsH.exe
  2⤵
  PID:7740
- C:\Windows\System\FUjYXyd.exe
  C:\Windows\System\FUjYXyd.exe
  2⤵
  PID:7772
- C:\Windows\System\hWzwFZh.exe
  C:\Windows\System\hWzwFZh.exe
  2⤵
  PID:7792
- C:\Windows\System\MZIhfES.exe
  C:\Windows\System\MZIhfES.exe
  2⤵
  PID:7816
- C:\Windows\System\HYUKjIA.exe
  C:\Windows\System\HYUKjIA.exe
  2⤵
  PID:7836
- C:\Windows\System\valdaky.exe
  C:\Windows\System\valdaky.exe
  2⤵
  PID:7860
- C:\Windows\System\BdYlWbN.exe
  C:\Windows\System\BdYlWbN.exe
  2⤵
  PID:7884
- C:\Windows\System\QnvQTXL.exe
  C:\Windows\System\QnvQTXL.exe
  2⤵
  PID:7904
- C:\Windows\System\VpnMPmG.exe
  C:\Windows\System\VpnMPmG.exe
  2⤵
  PID:7928
- C:\Windows\System\BYsqiUh.exe
  C:\Windows\System\BYsqiUh.exe
  2⤵
  PID:7948
- C:\Windows\System\nWdUtOJ.exe
  C:\Windows\System\nWdUtOJ.exe
  2⤵
  PID:7976
- C:\Windows\System\CfHNBOH.exe
  C:\Windows\System\CfHNBOH.exe
  2⤵
  PID:8000
- C:\Windows\System\lKkdztd.exe
  C:\Windows\System\lKkdztd.exe
  2⤵
  PID:8020
- C:\Windows\System\bIQetEV.exe
  C:\Windows\System\bIQetEV.exe
  2⤵
  PID:8048
- C:\Windows\System\MpWGBcC.exe
  C:\Windows\System\MpWGBcC.exe
  2⤵
  PID:8072
- C:\Windows\System\zuEpqKi.exe
  C:\Windows\System\zuEpqKi.exe
  2⤵
  PID:8092
- C:\Windows\System\toPfciP.exe
  C:\Windows\System\toPfciP.exe
  2⤵
  PID:8112
- C:\Windows\System\BmRWEJb.exe
  C:\Windows\System\BmRWEJb.exe
  2⤵
  PID:8132
- C:\Windows\System\BtHrlgh.exe
  C:\Windows\System\BtHrlgh.exe
  2⤵
  PID:8152
- C:\Windows\System\nIrocgW.exe
  C:\Windows\System\nIrocgW.exe
  2⤵
  PID:8172
- C:\Windows\System\CoaDrnB.exe
  C:\Windows\System\CoaDrnB.exe
  2⤵
  PID:7008
- C:\Windows\System\XHYEDAB.exe
  C:\Windows\System\XHYEDAB.exe
  2⤵
  PID:6320
- C:\Windows\System\QrJCeew.exe
  C:\Windows\System\QrJCeew.exe
  2⤵
  PID:7048
- C:\Windows\System\OmDPcEt.exe
  C:\Windows\System\OmDPcEt.exe
  2⤵
  PID:5316
- C:\Windows\System\gkKoMVv.exe
  C:\Windows\System\gkKoMVv.exe
  2⤵
  PID:6720
- C:\Windows\System\WVeXfwu.exe
  C:\Windows\System\WVeXfwu.exe
  2⤵
  PID:6100
- C:\Windows\System\FOGpwRW.exe
  C:\Windows\System\FOGpwRW.exe
  2⤵
  PID:6776
- C:\Windows\System\BbVHfrv.exe
  C:\Windows\System\BbVHfrv.exe
  2⤵
  PID:6808
- C:\Windows\System\swjucaQ.exe
  C:\Windows\System\swjucaQ.exe
  2⤵
  PID:6260
- C:\Windows\System\SECHeiQ.exe
  C:\Windows\System\SECHeiQ.exe
  2⤵
  PID:6532
- C:\Windows\System\IxmXtbr.exe
  C:\Windows\System\IxmXtbr.exe
  2⤵
  PID:5128
- C:\Windows\System\gObVXfo.exe
  C:\Windows\System\gObVXfo.exe
  2⤵
  PID:6744
- C:\Windows\System\PHcIPnd.exe
  C:\Windows\System\PHcIPnd.exe
  2⤵
  PID:6992
- C:\Windows\System\ElLkbob.exe
  C:\Windows\System\ElLkbob.exe
  2⤵
  PID:7280
- C:\Windows\System\IZomjVN.exe
  C:\Windows\System\IZomjVN.exe
  2⤵
  PID:7076
- C:\Windows\System\JvMtIbO.exe
  C:\Windows\System\JvMtIbO.exe
  2⤵
  PID:7100
- C:\Windows\System\RxeLHaw.exe
  C:\Windows\System\RxeLHaw.exe
  2⤵
  PID:7348
- C:\Windows\System\yKJRFac.exe
  C:\Windows\System\yKJRFac.exe
  2⤵
  PID:7436
- C:\Windows\System\CwyYuGr.exe
  C:\Windows\System\CwyYuGr.exe
  2⤵
  PID:7492
- C:\Windows\System\WsdHzFk.exe
  C:\Windows\System\WsdHzFk.exe
  2⤵
  PID:7564
- C:\Windows\System\WxxYujX.exe
  C:\Windows\System\WxxYujX.exe
  2⤵
  PID:7632
- C:\Windows\System\xnLDKFg.exe
  C:\Windows\System\xnLDKFg.exe
  2⤵
  PID:6924
- C:\Windows\System\muZSQSh.exe
  C:\Windows\System\muZSQSh.exe
  2⤵
  PID:7732
- C:\Windows\System\mNhhbZE.exe
  C:\Windows\System\mNhhbZE.exe
  2⤵
  PID:6964
- C:\Windows\System\xZAZLSq.exe
  C:\Windows\System\xZAZLSq.exe
  2⤵
  PID:7788
- C:\Windows\System\IQuxfhK.exe
  C:\Windows\System\IQuxfhK.exe
  2⤵
  PID:6676
- C:\Windows\System\gnkWkYr.exe
  C:\Windows\System\gnkWkYr.exe
  2⤵
  PID:7876
- C:\Windows\System\sUeDOvI.exe
  C:\Windows\System\sUeDOvI.exe
  2⤵
  PID:7900
- C:\Windows\System\mpWenxR.exe
  C:\Windows\System\mpWenxR.exe
  2⤵
  PID:7936
- C:\Windows\System\vxZXfEa.exe
  C:\Windows\System\vxZXfEa.exe
  2⤵
  PID:7988
- C:\Windows\System\sJUTIXO.exe
  C:\Windows\System\sJUTIXO.exe
  2⤵
  PID:8204
- C:\Windows\System\PUegQPw.exe
  C:\Windows\System\PUegQPw.exe
  2⤵
  PID:8220
- C:\Windows\System\FkUOdjf.exe
  C:\Windows\System\FkUOdjf.exe
  2⤵
  PID:8248
- C:\Windows\System\ZZoemTs.exe
  C:\Windows\System\ZZoemTs.exe
  2⤵
  PID:8268
- C:\Windows\System\OQmHiCC.exe
  C:\Windows\System\OQmHiCC.exe
  2⤵
  PID:8288
- C:\Windows\System\MxrItaS.exe
  C:\Windows\System\MxrItaS.exe
  2⤵
  PID:8312
- C:\Windows\System\TCyrREj.exe
  C:\Windows\System\TCyrREj.exe
  2⤵
  PID:8340
- C:\Windows\System\MPYagcz.exe
  C:\Windows\System\MPYagcz.exe
  2⤵
  PID:8356
- C:\Windows\System\mWQdJtl.exe
  C:\Windows\System\mWQdJtl.exe
  2⤵
  PID:8384
- C:\Windows\System\OSicyTp.exe
  C:\Windows\System\OSicyTp.exe
  2⤵
  PID:8404
- C:\Windows\System\HCEzcVc.exe
  C:\Windows\System\HCEzcVc.exe
  2⤵
  PID:8420
- C:\Windows\System\tBlwpbH.exe
  C:\Windows\System\tBlwpbH.exe
  2⤵
  PID:8436
- C:\Windows\System\hzfblKJ.exe
  C:\Windows\System\hzfblKJ.exe
  2⤵
  PID:8456
- C:\Windows\System\SsOlZIt.exe
  C:\Windows\System\SsOlZIt.exe
  2⤵
  PID:8472
- C:\Windows\System\RPlIfku.exe
  C:\Windows\System\RPlIfku.exe
  2⤵
  PID:8500
- C:\Windows\System\rgCVcrQ.exe
  C:\Windows\System\rgCVcrQ.exe
  2⤵
  PID:8520
- C:\Windows\System\EaKcXRV.exe
  C:\Windows\System\EaKcXRV.exe
  2⤵
  PID:8540
- C:\Windows\System\MtETXjm.exe
  C:\Windows\System\MtETXjm.exe
  2⤵
  PID:8564
- C:\Windows\System\ZPqXizv.exe
  C:\Windows\System\ZPqXizv.exe
  2⤵
  PID:8584
- C:\Windows\System\GEjFKZo.exe
  C:\Windows\System\GEjFKZo.exe
  2⤵
  PID:8612
- C:\Windows\System\SYCqPZc.exe
  C:\Windows\System\SYCqPZc.exe
  2⤵
  PID:8640
- C:\Windows\System\KVjLmQt.exe
  C:\Windows\System\KVjLmQt.exe
  2⤵
  PID:8656
- C:\Windows\System\eYSNQPe.exe
  C:\Windows\System\eYSNQPe.exe
  2⤵
  PID:8680
- C:\Windows\System\IPLbcKB.exe
  C:\Windows\System\IPLbcKB.exe
  2⤵
  PID:8700
- C:\Windows\System\PIqtBTt.exe
  C:\Windows\System\PIqtBTt.exe
  2⤵
  PID:8720
- C:\Windows\System\NzeHNcM.exe
  C:\Windows\System\NzeHNcM.exe
  2⤵
  PID:8744
- C:\Windows\System\CMtPhmM.exe
  C:\Windows\System\CMtPhmM.exe
  2⤵
  PID:8768
- C:\Windows\System\TNQwrmf.exe
  C:\Windows\System\TNQwrmf.exe
  2⤵
  PID:8788
- C:\Windows\System\iPxrrTD.exe
  C:\Windows\System\iPxrrTD.exe
  2⤵
  PID:8808
- C:\Windows\System\RWPNKsZ.exe
  C:\Windows\System\RWPNKsZ.exe
  2⤵
  PID:8836
- C:\Windows\System\gAmpowl.exe
  C:\Windows\System\gAmpowl.exe
  2⤵
  PID:8860
- C:\Windows\System\SImmEpD.exe
  C:\Windows\System\SImmEpD.exe
  2⤵
  PID:8892
- C:\Windows\System\pfPEiUO.exe
  C:\Windows\System\pfPEiUO.exe
  2⤵
  PID:8928
- C:\Windows\System\ZNppPyB.exe
  C:\Windows\System\ZNppPyB.exe
  2⤵
  PID:8952
- C:\Windows\System\BDhuoMp.exe
  C:\Windows\System\BDhuoMp.exe
  2⤵
  PID:8976
- C:\Windows\System\HrvXdNz.exe
  C:\Windows\System\HrvXdNz.exe
  2⤵
  PID:8996
- C:\Windows\System\ZAWYHPd.exe
  C:\Windows\System\ZAWYHPd.exe
  2⤵
  PID:9016
- C:\Windows\System\jMnxIcT.exe
  C:\Windows\System\jMnxIcT.exe
  2⤵
  PID:9044
- C:\Windows\System\rZbyQDI.exe
  C:\Windows\System\rZbyQDI.exe
  2⤵
  PID:9064
- C:\Windows\System\eAyiSVQ.exe
  C:\Windows\System\eAyiSVQ.exe
  2⤵
  PID:9088
- C:\Windows\System\fTdPHsg.exe
  C:\Windows\System\fTdPHsg.exe
  2⤵
  PID:9112
- C:\Windows\System\HgiteBP.exe
  C:\Windows\System\HgiteBP.exe
  2⤵
  PID:9132
- C:\Windows\System\VxUBUhM.exe
  C:\Windows\System\VxUBUhM.exe
  2⤵
  PID:9152
- C:\Windows\System\Opyzgfm.exe
  C:\Windows\System\Opyzgfm.exe
  2⤵
  PID:9180
- C:\Windows\System\nBIODQs.exe
  C:\Windows\System\nBIODQs.exe
  2⤵
  PID:9204
- C:\Windows\System\HTuVRRX.exe
  C:\Windows\System\HTuVRRX.exe
  2⤵
  PID:7296
- C:\Windows\System\PIgWUUX.exe
  C:\Windows\System\PIgWUUX.exe
  2⤵
  PID:7336
- C:\Windows\System\JGUSoKc.exe
  C:\Windows\System\JGUSoKc.exe
  2⤵
  PID:7380
- C:\Windows\System\VswtFol.exe
  C:\Windows\System\VswtFol.exe
  2⤵
  PID:8184
- C:\Windows\System\YLpDYGA.exe
  C:\Windows\System\YLpDYGA.exe
  2⤵
  PID:7408
- C:\Windows\System\wCgCIrT.exe
  C:\Windows\System\wCgCIrT.exe
  2⤵
  PID:7516
- C:\Windows\System\oBaaOpV.exe
  C:\Windows\System\oBaaOpV.exe
  2⤵
  PID:7500
- C:\Windows\System\ZUwQoKG.exe
  C:\Windows\System\ZUwQoKG.exe
  2⤵
  PID:6792
- C:\Windows\System\qweRpWH.exe
  C:\Windows\System\qweRpWH.exe
  2⤵
  PID:6972
- C:\Windows\System\giBZycI.exe
  C:\Windows\System\giBZycI.exe
  2⤵
  PID:7124
- C:\Windows\System\xApCVTp.exe
  C:\Windows\System\xApCVTp.exe
  2⤵
  PID:7684
- C:\Windows\System\ZYBctIQ.exe
  C:\Windows\System\ZYBctIQ.exe
  2⤵
  PID:5948
- C:\Windows\System\GWUxVBJ.exe
  C:\Windows\System\GWUxVBJ.exe
  2⤵
  PID:5632
- C:\Windows\System\MCGWuAL.exe
  C:\Windows\System\MCGWuAL.exe
  2⤵
  PID:7964
- C:\Windows\System\KfDiAvO.exe
  C:\Windows\System\KfDiAvO.exe
  2⤵
  PID:7960
- C:\Windows\System\FIAENzP.exe
  C:\Windows\System\FIAENzP.exe
  2⤵
  PID:8260
- C:\Windows\System\PYSNffl.exe
  C:\Windows\System\PYSNffl.exe
  2⤵
  PID:8108
- C:\Windows\System\oFwpLQv.exe
  C:\Windows\System\oFwpLQv.exe
  2⤵
  PID:7352
- C:\Windows\System\GuzICJi.exe
  C:\Windows\System\GuzICJi.exe
  2⤵
  PID:9236
- C:\Windows\System\ONcqYHQ.exe
  C:\Windows\System\ONcqYHQ.exe
  2⤵
  PID:9256
- C:\Windows\System\MkyFTWF.exe
  C:\Windows\System\MkyFTWF.exe
  2⤵
  PID:9276
- C:\Windows\System\BcKPQub.exe
  C:\Windows\System\BcKPQub.exe
  2⤵
  PID:9300
- C:\Windows\System\RlxvhdW.exe
  C:\Windows\System\RlxvhdW.exe
  2⤵
  PID:9324
- C:\Windows\System\kmCCtWd.exe
  C:\Windows\System\kmCCtWd.exe
  2⤵
  PID:9344
- C:\Windows\System\MhbZcOR.exe
  C:\Windows\System\MhbZcOR.exe
  2⤵
  PID:9364
- C:\Windows\System\sJfIUVO.exe
  C:\Windows\System\sJfIUVO.exe
  2⤵
  PID:9388
- C:\Windows\System\hQvTdDO.exe
  C:\Windows\System\hQvTdDO.exe
  2⤵
  PID:9412
- C:\Windows\System\tAewaOn.exe
  C:\Windows\System\tAewaOn.exe
  2⤵
  PID:9444
- C:\Windows\System\ZVvwTYu.exe
  C:\Windows\System\ZVvwTYu.exe
  2⤵
  PID:9468
- C:\Windows\System\PSGOvMe.exe
  C:\Windows\System\PSGOvMe.exe
  2⤵
  PID:9488
- C:\Windows\System\acFDicv.exe
  C:\Windows\System\acFDicv.exe
  2⤵
  PID:9508
- C:\Windows\System\CHGSbPV.exe
  C:\Windows\System\CHGSbPV.exe
  2⤵
  PID:9532
- C:\Windows\System\upvewvj.exe
  C:\Windows\System\upvewvj.exe
  2⤵
  PID:9556
- C:\Windows\System\VdWfdns.exe
  C:\Windows\System\VdWfdns.exe
  2⤵
  PID:9588
- C:\Windows\System\HgwTIdX.exe
  C:\Windows\System\HgwTIdX.exe
  2⤵
  PID:9616
- C:\Windows\System\OTliwYu.exe
  C:\Windows\System\OTliwYu.exe
  2⤵
  PID:9636
- C:\Windows\System\tMjdPYD.exe
  C:\Windows\System\tMjdPYD.exe
  2⤵
  PID:9652
- C:\Windows\System\dVvUlPm.exe
  C:\Windows\System\dVvUlPm.exe
  2⤵
  PID:9668
- C:\Windows\System\JECUpaE.exe
  C:\Windows\System\JECUpaE.exe
  2⤵
  PID:9688
- C:\Windows\System\yGbIAff.exe
  C:\Windows\System\yGbIAff.exe
  2⤵
  PID:9708
- C:\Windows\System\MzflTtR.exe
  C:\Windows\System\MzflTtR.exe
  2⤵
  PID:9732
- C:\Windows\System\aLGlbTp.exe
  C:\Windows\System\aLGlbTp.exe
  2⤵
  PID:9756
- C:\Windows\System\oqNlNKb.exe
  C:\Windows\System\oqNlNKb.exe
  2⤵
  PID:9776
- C:\Windows\System\KSccTXQ.exe
  C:\Windows\System\KSccTXQ.exe
  2⤵
  PID:9804
- C:\Windows\System\ltsdAaV.exe
  C:\Windows\System\ltsdAaV.exe
  2⤵
  PID:9824
- C:\Windows\System\QhAoccc.exe
  C:\Windows\System\QhAoccc.exe
  2⤵
  PID:9844
- C:\Windows\System\KOKruEQ.exe
  C:\Windows\System\KOKruEQ.exe
  2⤵
  PID:9864
- C:\Windows\System\WDmlwkp.exe
  C:\Windows\System\WDmlwkp.exe
  2⤵
  PID:9884
- C:\Windows\System\gzePcCO.exe
  C:\Windows\System\gzePcCO.exe
  2⤵
  PID:9908
- C:\Windows\System\rRqmVoC.exe
  C:\Windows\System\rRqmVoC.exe
  2⤵
  PID:9936
- C:\Windows\System\QUpTHrB.exe
  C:\Windows\System\QUpTHrB.exe
  2⤵
  PID:9952
- C:\Windows\System\anYepIZ.exe
  C:\Windows\System\anYepIZ.exe
  2⤵
  PID:9980
- C:\Windows\System\thCCWeU.exe
  C:\Windows\System\thCCWeU.exe
  2⤵
  PID:10012
- C:\Windows\System\KRLlxeh.exe
  C:\Windows\System\KRLlxeh.exe
  2⤵
  PID:10036
- C:\Windows\System\TjWJVNw.exe
  C:\Windows\System\TjWJVNw.exe
  2⤵
  PID:10060
- C:\Windows\System\EnWGcGI.exe
  C:\Windows\System\EnWGcGI.exe
  2⤵
  PID:10080
- C:\Windows\System\ZcmFxfn.exe
  C:\Windows\System\ZcmFxfn.exe
  2⤵
  PID:10100
- C:\Windows\System\RDYqhIB.exe
  C:\Windows\System\RDYqhIB.exe
  2⤵
  PID:10120
- C:\Windows\System\IqQiVbf.exe
  C:\Windows\System\IqQiVbf.exe
  2⤵
  PID:10140
- C:\Windows\System\WVtowKa.exe
  C:\Windows\System\WVtowKa.exe
  2⤵
  PID:10168
- C:\Windows\System\nVbnFYk.exe
  C:\Windows\System\nVbnFYk.exe
  2⤵
  PID:10188
- C:\Windows\System\IQnfXso.exe
  C:\Windows\System\IQnfXso.exe
  2⤵
  PID:10212
- C:\Windows\System\lyDsPvS.exe
  C:\Windows\System\lyDsPvS.exe
  2⤵
  PID:10232
- C:\Windows\System\fplNuNa.exe
  C:\Windows\System\fplNuNa.exe
  2⤵
  PID:8468
- C:\Windows\System\CKpHAOs.exe
  C:\Windows\System\CKpHAOs.exe
  2⤵
  PID:8536
- C:\Windows\System\zCsGWgp.exe
  C:\Windows\System\zCsGWgp.exe
  2⤵
  PID:7144
- C:\Windows\System\AlHQkhl.exe
  C:\Windows\System\AlHQkhl.exe
  2⤵
  PID:8688
- C:\Windows\System\BfLaEbA.exe
  C:\Windows\System\BfLaEbA.exe
  2⤵
  PID:8764
- C:\Windows\System\IOylQbL.exe
  C:\Windows\System\IOylQbL.exe
  2⤵
  PID:6864
- C:\Windows\System\clgtBuf.exe
  C:\Windows\System\clgtBuf.exe
  2⤵
  PID:6652
- C:\Windows\System\nFgOWbh.exe
  C:\Windows\System\nFgOWbh.exe
  2⤵
  PID:8964
- C:\Windows\System\lUsoPvC.exe
  C:\Windows\System\lUsoPvC.exe
  2⤵
  PID:9024
- C:\Windows\System\FeriRxt.exe
  C:\Windows\System\FeriRxt.exe
  2⤵
  PID:7808
- C:\Windows\System\bEaXjzI.exe
  C:\Windows\System\bEaXjzI.exe
  2⤵
  PID:9172
- C:\Windows\System\WUTyopr.exe
  C:\Windows\System\WUTyopr.exe
  2⤵
  PID:8080
- C:\Windows\System\oHZYLKl.exe
  C:\Windows\System\oHZYLKl.exe
  2⤵
  PID:6636
- C:\Windows\System\TaBJZHn.exe
  C:\Windows\System\TaBJZHn.exe
  2⤵
  PID:10248
- C:\Windows\System\CHLELmK.exe
  C:\Windows\System\CHLELmK.exe
  2⤵
  PID:10268
- C:\Windows\System\TXRoKEo.exe
  C:\Windows\System\TXRoKEo.exe
  2⤵
  PID:10288
- C:\Windows\System\QUOyvcO.exe
  C:\Windows\System\QUOyvcO.exe
  2⤵
  PID:10316
- C:\Windows\System\xiwMeqq.exe
  C:\Windows\System\xiwMeqq.exe
  2⤵
  PID:10336
- C:\Windows\System\TTOjNmj.exe
  C:\Windows\System\TTOjNmj.exe
  2⤵
  PID:10360
- C:\Windows\System\fSwwCLZ.exe
  C:\Windows\System\fSwwCLZ.exe
  2⤵
  PID:10380
- C:\Windows\System\sPJcmmZ.exe
  C:\Windows\System\sPJcmmZ.exe
  2⤵
  PID:10400
- C:\Windows\System\KwYyJyG.exe
  C:\Windows\System\KwYyJyG.exe
  2⤵
  PID:10420
- C:\Windows\System\rTzRCXT.exe
  C:\Windows\System\rTzRCXT.exe
  2⤵
  PID:10444
- C:\Windows\System\sKumafa.exe
  C:\Windows\System\sKumafa.exe
  2⤵
  PID:10468
- C:\Windows\System\AzpmgfP.exe
  C:\Windows\System\AzpmgfP.exe
  2⤵
  PID:10484
- C:\Windows\System\HzXocMy.exe
  C:\Windows\System\HzXocMy.exe
  2⤵
  PID:10508
- C:\Windows\System\oCdwQiE.exe
  C:\Windows\System\oCdwQiE.exe
  2⤵
  PID:10532
- C:\Windows\System\TrZteIt.exe
  C:\Windows\System\TrZteIt.exe
  2⤵
  PID:10552
- C:\Windows\System\OPoOjtg.exe
  C:\Windows\System\OPoOjtg.exe
  2⤵
  PID:10580
- C:\Windows\System\uPCwcdv.exe
  C:\Windows\System\uPCwcdv.exe
  2⤵
  PID:10600
- C:\Windows\System\dpvcqQt.exe
  C:\Windows\System\dpvcqQt.exe
  2⤵
  PID:10624
- C:\Windows\System\romYskh.exe
  C:\Windows\System\romYskh.exe
  2⤵
  PID:10648
- C:\Windows\System\emwJCFF.exe
  C:\Windows\System\emwJCFF.exe
  2⤵
  PID:10676
- C:\Windows\System\ZIMNsKM.exe
  C:\Windows\System\ZIMNsKM.exe
  2⤵
  PID:10696
- C:\Windows\System\QHlcgBJ.exe
  C:\Windows\System\QHlcgBJ.exe
  2⤵
  PID:10716
- C:\Windows\System\sPJZUsv.exe
  C:\Windows\System\sPJZUsv.exe
  2⤵
  PID:10740
- C:\Windows\System\ohCqGGf.exe
  C:\Windows\System\ohCqGGf.exe
  2⤵
  PID:10760
- C:\Windows\System\sHZrmBo.exe
  C:\Windows\System\sHZrmBo.exe
  2⤵
  PID:10792
- C:\Windows\System\WuXlUMu.exe
  C:\Windows\System\WuXlUMu.exe
  2⤵
  PID:10816
- C:\Windows\System\LMaAxpP.exe
  C:\Windows\System\LMaAxpP.exe
  2⤵
  PID:10832
- C:\Windows\System\nLrqZjH.exe
  C:\Windows\System\nLrqZjH.exe
  2⤵
  PID:10848
- C:\Windows\System\FQtACMg.exe
  C:\Windows\System\FQtACMg.exe
  2⤵
  PID:10864
- C:\Windows\System\CUbjjCC.exe
  C:\Windows\System\CUbjjCC.exe
  2⤵
  PID:11060
- C:\Windows\System\CLKOiUF.exe
  C:\Windows\System\CLKOiUF.exe
  2⤵
  PID:11076
- C:\Windows\System\JqzNSWZ.exe
  C:\Windows\System\JqzNSWZ.exe
  2⤵
  PID:11092
- C:\Windows\System\PTcUiKz.exe
  C:\Windows\System\PTcUiKz.exe
  2⤵
  PID:11108
- C:\Windows\System\hBHqpzt.exe
  C:\Windows\System\hBHqpzt.exe
  2⤵
  PID:11132
- C:\Windows\System\JRQNPwk.exe
  C:\Windows\System\JRQNPwk.exe
  2⤵
  PID:11152
- C:\Windows\System\MThXZVX.exe
  C:\Windows\System\MThXZVX.exe
  2⤵
  PID:11168
- C:\Windows\System\ZVNAcyx.exe
  C:\Windows\System\ZVNAcyx.exe
  2⤵
  PID:11184
- C:\Windows\System\RLbwAYp.exe
  C:\Windows\System\RLbwAYp.exe
  2⤵
  PID:11200
- C:\Windows\System\Ygzgupf.exe
  C:\Windows\System\Ygzgupf.exe
  2⤵
  PID:11220
- C:\Windows\System\aPNjGTn.exe
  C:\Windows\System\aPNjGTn.exe
  2⤵
  PID:11236
- C:\Windows\System\fRlbkKz.exe
  C:\Windows\System\fRlbkKz.exe
  2⤵
  PID:11256
- C:\Windows\System\RxjBhZS.exe
  C:\Windows\System\RxjBhZS.exe
  2⤵
  PID:7824
- C:\Windows\System\eRqVjsc.exe
  C:\Windows\System\eRqVjsc.exe
  2⤵
  PID:8264
- C:\Windows\System\xyMYoaT.exe
  C:\Windows\System\xyMYoaT.exe
  2⤵
  PID:8228
- C:\Windows\System\GEzfshK.exe
  C:\Windows\System\GEzfshK.exe
  2⤵
  PID:8392
- C:\Windows\System\bOuxUvH.exe
  C:\Windows\System\bOuxUvH.exe
  2⤵
  PID:8412
- C:\Windows\System\nAqZovC.exe
  C:\Windows\System\nAqZovC.exe
  2⤵
  PID:9308
- C:\Windows\System\PxebLHN.exe
  C:\Windows\System\PxebLHN.exe
  2⤵
  PID:8552
- C:\Windows\System\YIiKsgW.exe
  C:\Windows\System\YIiKsgW.exe
  2⤵
  PID:9400
- C:\Windows\System\BjBexxp.exe
  C:\Windows\System\BjBexxp.exe
  2⤵
  PID:8608
- C:\Windows\System\olgUJGy.exe
  C:\Windows\System\olgUJGy.exe
  2⤵
  PID:8676
- C:\Windows\System\tjErHwx.exe
  C:\Windows\System\tjErHwx.exe
  2⤵
  PID:6256
- C:\Windows\System\VlpPFbF.exe
  C:\Windows\System\VlpPFbF.exe
  2⤵
  PID:9892
- C:\Windows\System\WtZsDEN.exe
  C:\Windows\System\WtZsDEN.exe
  2⤵
  PID:9920
- C:\Windows\System\snRGUUL.exe
  C:\Windows\System\snRGUUL.exe
  2⤵
  PID:9944
- C:\Windows\System\RYUNhga.exe
  C:\Windows\System\RYUNhga.exe
  2⤵
  PID:7096
- C:\Windows\System\ygxzLNr.exe
  C:\Windows\System\ygxzLNr.exe
  2⤵
  PID:7628
- C:\Windows\System\SzrlGpT.exe
  C:\Windows\System\SzrlGpT.exe
  2⤵
  PID:10164
- C:\Windows\System\ViOLqsz.exe
  C:\Windows\System\ViOLqsz.exe
  2⤵
  PID:8984
- C:\Windows\System\TSDUFdm.exe
  C:\Windows\System\TSDUFdm.exe
  2⤵
  PID:6296
- C:\Windows\System\YJggmlZ.exe
  C:\Windows\System\YJggmlZ.exe
  2⤵
  PID:7728
- C:\Windows\System\EXjhTqq.exe
  C:\Windows\System\EXjhTqq.exe
  2⤵
  PID:5704
- C:\Windows\System\dnLunNK.exe
  C:\Windows\System\dnLunNK.exe
  2⤵
  PID:10256
- C:\Windows\System\LYCiPXe.exe
  C:\Windows\System\LYCiPXe.exe
  2⤵
  PID:7360
- C:\Windows\System\WhxZKFS.exe
  C:\Windows\System\WhxZKFS.exe
  2⤵
  PID:8196
- C:\Windows\System\VijmBCV.exe
  C:\Windows\System\VijmBCV.exe
  2⤵
  PID:8304
- C:\Windows\System\IQXBFop.exe
  C:\Windows\System\IQXBFop.exe
  2⤵
  PID:8428
- C:\Windows\System\MzHsjOH.exe
  C:\Windows\System\MzHsjOH.exe
  2⤵
  PID:8488
- C:\Windows\System\aQyKSVB.exe
  C:\Windows\System\aQyKSVB.exe
  2⤵
  PID:10800
- C:\Windows\System\tllqtvt.exe
  C:\Windows\System\tllqtvt.exe
  2⤵
  PID:10812
- C:\Windows\System\StvhAiS.exe
  C:\Windows\System\StvhAiS.exe
  2⤵
  PID:10860
- C:\Windows\System\yiHDtRI.exe
  C:\Windows\System\yiHDtRI.exe
  2⤵
  PID:9500
- C:\Windows\System\CvZfrnw.exe
  C:\Windows\System\CvZfrnw.exe
  2⤵
  PID:8696
- C:\Windows\System\SSreNJR.exe
  C:\Windows\System\SSreNJR.exe
  2⤵
  PID:8804
- C:\Windows\System\XBBDcsJ.exe
  C:\Windows\System\XBBDcsJ.exe
  2⤵
  PID:8848
- C:\Windows\System\CkOPqmP.exe
  C:\Windows\System\CkOPqmP.exe
  2⤵
  PID:9124
- C:\Windows\System\CSLlCiC.exe
  C:\Windows\System\CSLlCiC.exe
  2⤵
  PID:7312
- C:\Windows\System\HXLmpRk.exe
  C:\Windows\System\HXLmpRk.exe
  2⤵
  PID:7800
- C:\Windows\System\fqmzPyk.exe
  C:\Windows\System\fqmzPyk.exe
  2⤵
  PID:9252
- C:\Windows\System\QHvCPQT.exe
  C:\Windows\System\QHvCPQT.exe
  2⤵
  PID:9396
- C:\Windows\System\skxlYYV.exe
  C:\Windows\System\skxlYYV.exe
  2⤵
  PID:11272
- C:\Windows\System\kjKXUZA.exe
  C:\Windows\System\kjKXUZA.exe
  2⤵
  PID:11300
- C:\Windows\System\gSwjlzJ.exe
  C:\Windows\System\gSwjlzJ.exe
  2⤵
  PID:11316
- C:\Windows\System\XcBQndh.exe
  C:\Windows\System\XcBQndh.exe
  2⤵
  PID:11336
- C:\Windows\System\voOqucn.exe
  C:\Windows\System\voOqucn.exe
  2⤵
  PID:11352
- C:\Windows\System\TzcTluc.exe
  C:\Windows\System\TzcTluc.exe
  2⤵
  PID:11368
- C:\Windows\System\fJUqQNT.exe
  C:\Windows\System\fJUqQNT.exe
  2⤵
  PID:11384
- C:\Windows\System\CsKcOLy.exe
  C:\Windows\System\CsKcOLy.exe
  2⤵
  PID:11400
- C:\Windows\System\VNOJFHO.exe
  C:\Windows\System\VNOJFHO.exe
  2⤵
  PID:11416
- C:\Windows\System\JyFTmWS.exe
  C:\Windows\System\JyFTmWS.exe
  2⤵
  PID:11436
- C:\Windows\System\JOynjwl.exe
  C:\Windows\System\JOynjwl.exe
  2⤵
  PID:11460
- C:\Windows\System\mXRhQzE.exe
  C:\Windows\System\mXRhQzE.exe
  2⤵
  PID:11484
- C:\Windows\System\WJuiOrW.exe
  C:\Windows\System\WJuiOrW.exe
  2⤵
  PID:11508
- C:\Windows\System\iNlbhoV.exe
  C:\Windows\System\iNlbhoV.exe
  2⤵
  PID:11532
- C:\Windows\System\hYVgyOE.exe
  C:\Windows\System\hYVgyOE.exe
  2⤵
  PID:11556
- C:\Windows\System\TMCkmAg.exe
  C:\Windows\System\TMCkmAg.exe
  2⤵
  PID:11576
- C:\Windows\System\bAbKYnC.exe
  C:\Windows\System\bAbKYnC.exe
  2⤵
  PID:11600
- C:\Windows\System\uQjcHwu.exe
  C:\Windows\System\uQjcHwu.exe
  2⤵
  PID:11616
- C:\Windows\System\MEqwBUe.exe
  C:\Windows\System\MEqwBUe.exe
  2⤵
  PID:11640
- C:\Windows\System\rePJGQW.exe
  C:\Windows\System\rePJGQW.exe
  2⤵
  PID:11660
- C:\Windows\System\vwhXZGI.exe
  C:\Windows\System\vwhXZGI.exe
  2⤵
  PID:11676
- C:\Windows\System\viINRHD.exe
  C:\Windows\System\viINRHD.exe
  2⤵
  PID:11692
- C:\Windows\System\eTMlpNJ.exe
  C:\Windows\System\eTMlpNJ.exe
  2⤵
  PID:11712
- C:\Windows\System\hlLOoFM.exe
  C:\Windows\System\hlLOoFM.exe
  2⤵
  PID:11732
- C:\Windows\System\ifvQWoD.exe
  C:\Windows\System\ifvQWoD.exe
  2⤵
  PID:11752
- C:\Windows\System\RZeYhVI.exe
  C:\Windows\System\RZeYhVI.exe
  2⤵
  PID:11780
- C:\Windows\System\tICPKWu.exe
  C:\Windows\System\tICPKWu.exe
  2⤵
  PID:11800
- C:\Windows\System\fsdKEHT.exe
  C:\Windows\System\fsdKEHT.exe
  2⤵
  PID:11820
- C:\Windows\System\zdoXdPD.exe
  C:\Windows\System\zdoXdPD.exe
  2⤵
  PID:11848
- C:\Windows\System\BeZGgPN.exe
  C:\Windows\System\BeZGgPN.exe
  2⤵
  PID:11868
- C:\Windows\System\UMuhaju.exe
  C:\Windows\System\UMuhaju.exe
  2⤵
  PID:11888
- C:\Windows\System\ZlHjbbk.exe
  C:\Windows\System\ZlHjbbk.exe
  2⤵
  PID:11912
- C:\Windows\System\vTUEads.exe
  C:\Windows\System\vTUEads.exe
  2⤵
  PID:11932
- C:\Windows\System\HRmErGC.exe
  C:\Windows\System\HRmErGC.exe
  2⤵
  PID:11952
- C:\Windows\System\jBaTMtQ.exe
  C:\Windows\System\jBaTMtQ.exe
  2⤵
  PID:11976
- C:\Windows\System\lZOuVYY.exe
  C:\Windows\System\lZOuVYY.exe
  2⤵
  PID:12000
- C:\Windows\System\TpxJcKU.exe
  C:\Windows\System\TpxJcKU.exe
  2⤵
  PID:12020
- C:\Windows\System\QxWUJvb.exe
  C:\Windows\System\QxWUJvb.exe
  2⤵
  PID:12040
- C:\Windows\System\WZmMYNq.exe
  C:\Windows\System\WZmMYNq.exe
  2⤵
  PID:12064
- C:\Windows\System\QqhnwRP.exe
  C:\Windows\System\QqhnwRP.exe
  2⤵
  PID:12088
- C:\Windows\System\xFnNeQz.exe
  C:\Windows\System\xFnNeQz.exe
  2⤵
  PID:12108
- C:\Windows\System\upVUKSE.exe
  C:\Windows\System\upVUKSE.exe
  2⤵
  PID:12132
- C:\Windows\System\ncAzRQw.exe
  C:\Windows\System\ncAzRQw.exe
  2⤵
  PID:12148
- C:\Windows\System\zwIQXwH.exe
  C:\Windows\System\zwIQXwH.exe
  2⤵
  PID:12172
- C:\Windows\System\zQzpxfg.exe
  C:\Windows\System\zQzpxfg.exe
  2⤵
  PID:12192
- C:\Windows\System\eLdUcIz.exe
  C:\Windows\System\eLdUcIz.exe
  2⤵
  PID:12216
- C:\Windows\System\lGFhhWZ.exe
  C:\Windows\System\lGFhhWZ.exe
  2⤵
  PID:12244
- C:\Windows\System\ZWvykGp.exe
  C:\Windows\System\ZWvykGp.exe
  2⤵
  PID:12264
- C:\Windows\System\WQPWeMl.exe
  C:\Windows\System\WQPWeMl.exe
  2⤵
  PID:11048
- C:\Windows\System\FBZLSXJ.exe
  C:\Windows\System\FBZLSXJ.exe
  2⤵
  PID:8716
- C:\Windows\System\YWevbvg.exe
  C:\Windows\System\YWevbvg.exe
  2⤵
  PID:9648
- C:\Windows\System\euSectY.exe
  C:\Windows\System\euSectY.exe
  2⤵
  PID:9700
- C:\Windows\System\HccOlOy.exe
  C:\Windows\System\HccOlOy.exe
  2⤵
  PID:9768
- C:\Windows\System\GtJYXge.exe
  C:\Windows\System\GtJYXge.exe
  2⤵
  PID:9820
- C:\Windows\System\uYuCzGy.exe
  C:\Windows\System\uYuCzGy.exe
  2⤵
  PID:9972
- C:\Windows\System\wSFxOeG.exe
  C:\Windows\System\wSFxOeG.exe
  2⤵
  PID:10052
- C:\Windows\System\gNYoliu.exe
  C:\Windows\System\gNYoliu.exe
  2⤵
  PID:10128
- C:\Windows\System\PbdcTbP.exe
  C:\Windows\System\PbdcTbP.exe
  2⤵
  PID:10196
- C:\Windows\System\WAnKoET.exe
  C:\Windows\System\WAnKoET.exe
  2⤵
  PID:8416
- C:\Windows\System\tHOzPhj.exe
  C:\Windows\System\tHOzPhj.exe
  2⤵
  PID:8628
- C:\Windows\System\gChoVzQ.exe
  C:\Windows\System\gChoVzQ.exe
  2⤵
  PID:8780
- C:\Windows\System\nxWxZom.exe
  C:\Windows\System\nxWxZom.exe
  2⤵
  PID:6488
- C:\Windows\System\RsRIbFs.exe
  C:\Windows\System\RsRIbFs.exe
  2⤵
  PID:9160
- C:\Windows\System\xoCUcZA.exe
  C:\Windows\System\xoCUcZA.exe
  2⤵
  PID:10308
- C:\Windows\System\DIixswf.exe
  C:\Windows\System\DIixswf.exe
  2⤵
  PID:10368
- C:\Windows\System\lNEqaEw.exe
  C:\Windows\System\lNEqaEw.exe
  2⤵
  PID:10412
- C:\Windows\System\kguUeRo.exe
  C:\Windows\System\kguUeRo.exe
  2⤵
  PID:10476
- C:\Windows\System\NtkbxVX.exe
  C:\Windows\System\NtkbxVX.exe
  2⤵
  PID:10528
- C:\Windows\System\ltZZBJC.exe
  C:\Windows\System\ltZZBJC.exe
  2⤵
  PID:10572
- C:\Windows\System\OwEcMOS.exe
  C:\Windows\System\OwEcMOS.exe
  2⤵
  PID:10616
- C:\Windows\System\sTuNLyc.exe
  C:\Windows\System\sTuNLyc.exe
  2⤵
  PID:10640
- C:\Windows\System\URIcvHU.exe
  C:\Windows\System\URIcvHU.exe
  2⤵
  PID:10692
- C:\Windows\System\vdlcsDt.exe
  C:\Windows\System\vdlcsDt.exe
  2⤵
  PID:10748
- C:\Windows\System\NpagsFM.exe
  C:\Windows\System\NpagsFM.exe
  2⤵
  PID:11068
- C:\Windows\System\OZLveqp.exe
  C:\Windows\System\OZLveqp.exe
  2⤵
  PID:11216
- C:\Windows\System\eKuLMJB.exe
  C:\Windows\System\eKuLMJB.exe
  2⤵
  PID:7832
- C:\Windows\System\CrdiMUW.exe
  C:\Windows\System\CrdiMUW.exe
  2⤵
  PID:8160
- C:\Windows\System\JojGJdE.exe
  C:\Windows\System\JojGJdE.exe
  2⤵
  PID:9428
- C:\Windows\System\jAvSOBT.exe
  C:\Windows\System\jAvSOBT.exe
  2⤵
  PID:9716
- C:\Windows\System\FKmVxaL.exe
  C:\Windows\System\FKmVxaL.exe
  2⤵
  PID:8876
- C:\Windows\System\oYNhSpm.exe
  C:\Windows\System\oYNhSpm.exe
  2⤵
  PID:9012
- C:\Windows\System\CKTtsxU.exe
  C:\Windows\System\CKTtsxU.exe
  2⤵
  PID:10244
- C:\Windows\System\ORdaGjD.exe
  C:\Windows\System\ORdaGjD.exe
  2⤵
  PID:10784
- C:\Windows\System\sgwHWPW.exe
  C:\Windows\System\sgwHWPW.exe
  2⤵
  PID:8784
- C:\Windows\System\sAuAwJI.exe
  C:\Windows\System\sAuAwJI.exe
  2⤵
  PID:12304
- C:\Windows\System\wCWknRv.exe
  C:\Windows\System\wCWknRv.exe
  2⤵
  PID:12324
- C:\Windows\System\ZJoyLVx.exe
  C:\Windows\System\ZJoyLVx.exe
  2⤵
  PID:12356
- C:\Windows\System\FrdjMiP.exe
  C:\Windows\System\FrdjMiP.exe
  2⤵
  PID:12376
- C:\Windows\System\uFQtgbQ.exe
  C:\Windows\System\uFQtgbQ.exe
  2⤵
  PID:12404
- C:\Windows\System\rgEYVja.exe
  C:\Windows\System\rgEYVja.exe
  2⤵
  PID:12428
- C:\Windows\System\XILsyUH.exe
  C:\Windows\System\XILsyUH.exe
  2⤵
  PID:12452
- C:\Windows\System\zFwhMBf.exe
  C:\Windows\System\zFwhMBf.exe
  2⤵
  PID:12476
- C:\Windows\System\TMCFjrD.exe
  C:\Windows\System\TMCFjrD.exe
  2⤵
  PID:12504
- C:\Windows\System\uPokSdd.exe
  C:\Windows\System\uPokSdd.exe
  2⤵
  PID:12528
- C:\Windows\System\fEoJMJL.exe
  C:\Windows\System\fEoJMJL.exe
  2⤵
  PID:12544
- C:\Windows\System\irVOdyZ.exe
  C:\Windows\System\irVOdyZ.exe
  2⤵
  PID:12564
- C:\Windows\System\MpEPwTO.exe
  C:\Windows\System\MpEPwTO.exe
  2⤵
  PID:12920
- C:\Windows\System\rqxzlhp.exe
  C:\Windows\System\rqxzlhp.exe
  2⤵
  PID:12936
- C:\Windows\System\xGgbYbU.exe
  C:\Windows\System\xGgbYbU.exe
  2⤵
  PID:12956
- C:\Windows\System\CpudOdP.exe
  C:\Windows\System\CpudOdP.exe
  2⤵
  PID:12972
- C:\Windows\System\JLSWYBZ.exe
  C:\Windows\System\JLSWYBZ.exe
  2⤵
  PID:13000
- C:\Windows\System\nzgyEYQ.exe
  C:\Windows\System\nzgyEYQ.exe
  2⤵
  PID:13024
- C:\Windows\System\PjOCZBl.exe
  C:\Windows\System\PjOCZBl.exe
  2⤵
  PID:11308
- C:\Windows\System\tzWmSRf.exe
  C:\Windows\System\tzWmSRf.exe
  2⤵
  PID:11396
- C:\Windows\System\WBJduOZ.exe
  C:\Windows\System\WBJduOZ.exe
  2⤵
  PID:12944
- C:\Windows\System\lrVhbhk.exe
  C:\Windows\System\lrVhbhk.exe
  2⤵
  PID:12988
- C:\Windows\System\qRaYLmo.exe
  C:\Windows\System\qRaYLmo.exe
  2⤵
  PID:12632
- C:\Windows\System\oWgoExq.exe
  C:\Windows\System\oWgoExq.exe
  2⤵
  PID:12652
- C:\Windows\System\oEbgCGK.exe
  C:\Windows\System\oEbgCGK.exe
  2⤵
  PID:13068
- C:\Windows\System\FkAMXRo.exe
  C:\Windows\System\FkAMXRo.exe
  2⤵
  PID:13092
- C:\Windows\System\CJfADNt.exe
  C:\Windows\System\CJfADNt.exe
  2⤵
  PID:13112
- C:\Windows\System\ZdlUBRU.exe
  C:\Windows\System\ZdlUBRU.exe
  2⤵
  PID:11564
- C:\Windows\System\bsoQBZD.exe
  C:\Windows\System\bsoQBZD.exe
  2⤵
  PID:11588
- C:\Windows\System\LZnZidF.exe
  C:\Windows\System\LZnZidF.exe
  2⤵
  PID:11688
- C:\Windows\System\uThAhJf.exe
  C:\Windows\System\uThAhJf.exe
  2⤵
  PID:11760
- C:\Windows\System\xufnXNs.exe
  C:\Windows\System\xufnXNs.exe
  2⤵
  PID:11808
- C:\Windows\System\LYZUSXF.exe
  C:\Windows\System\LYZUSXF.exe
  2⤵
  PID:11844
- C:\Windows\System\TJCQIme.exe
  C:\Windows\System\TJCQIme.exe
  2⤵
  PID:11960
- C:\Windows\System\aYNefnt.exe
  C:\Windows\System\aYNefnt.exe
  2⤵
  PID:12160
- C:\Windows\System\tsyePPU.exe
  C:\Windows\System\tsyePPU.exe
  2⤵
  PID:12212
- C:\Windows\System\hhjOAuW.exe
  C:\Windows\System\hhjOAuW.exe
  2⤵
  PID:12256
- C:\Windows\System\UXreVaT.exe
  C:\Windows\System\UXreVaT.exe
  2⤵
  PID:8988
- C:\Windows\System\aVZVguw.exe
  C:\Windows\System\aVZVguw.exe
  2⤵
  PID:12336
- C:\Windows\System\pMhLsaL.exe
  C:\Windows\System\pMhLsaL.exe
  2⤵
  PID:12384
- C:\Windows\System\ScsIXer.exe
  C:\Windows\System\ScsIXer.exe
  2⤵
  PID:12580
- C:\Windows\System\ZJjZSWD.exe
  C:\Windows\System\ZJjZSWD.exe
  2⤵
  PID:13144
- C:\Windows\System\DMrcWOh.exe
  C:\Windows\System\DMrcWOh.exe
  2⤵
  PID:3216
- C:\Windows\System\mZbGKVg.exe
  C:\Windows\System\mZbGKVg.exe
  2⤵
  PID:13256
- C:\Windows\System\cRzzSuf.exe
  C:\Windows\System\cRzzSuf.exe
  2⤵
  PID:13288
- C:\Windows\System\ydyOxRd.exe
  C:\Windows\System\ydyOxRd.exe
  2⤵
  PID:11268
- C:\Windows\System\IyikRZp.exe
  C:\Windows\System\IyikRZp.exe
  2⤵
  PID:11428
- C:\Windows\System\qLezeHm.exe
  C:\Windows\System\qLezeHm.exe
  2⤵
  PID:13200
- C:\Windows\System\NJcMkGR.exe
  C:\Windows\System\NJcMkGR.exe
  2⤵
  PID:12276
- C:\Windows\System\CurNcbx.exe
  C:\Windows\System\CurNcbx.exe
  2⤵
  PID:13208
- C:\Windows\System\BDzMFuv.exe
  C:\Windows\System\BDzMFuv.exe
  2⤵
  PID:11376
- C:\Windows\System\DnbbIvv.exe
  C:\Windows\System\DnbbIvv.exe
  2⤵
  PID:11444
- C:\Windows\System\JuDwzxX.exe
  C:\Windows\System\JuDwzxX.exe
  2⤵
  PID:13284
- C:\Windows\System\qjUMuXC.exe
  C:\Windows\System\qjUMuXC.exe
  2⤵
  PID:13188
- C:\Windows\System\lhmvTAd.exe
  C:\Windows\System\lhmvTAd.exe
  2⤵
  PID:9568
- C:\Windows\System\RIogzKg.exe
  C:\Windows\System\RIogzKg.exe
  2⤵
  PID:10184
- C:\Windows\System\ToyfEIA.exe
  C:\Windows\System\ToyfEIA.exe
  2⤵
  PID:9504
- C:\Windows\System\PGPXoyL.exe
  C:\Windows\System\PGPXoyL.exe
  2⤵
  PID:10516
- C:\Windows\System\lPxaGPH.exe
  C:\Windows\System\lPxaGPH.exe
  2⤵
  PID:10152
- C:\Windows\System\ZYhzJSt.exe
  C:\Windows\System\ZYhzJSt.exe
  2⤵
  PID:9224
- C:\Windows\System\rcyXTml.exe
  C:\Windows\System\rcyXTml.exe
  2⤵
  PID:13296
- C:\Windows\System\qYMBHFL.exe
  C:\Windows\System\qYMBHFL.exe
  2⤵
  PID:12512
- C:\Windows\System\EMxHNnS.exe
  C:\Windows\System\EMxHNnS.exe
  2⤵
  PID:12932
- C:\Windows\System\BcSTACh.exe
  C:\Windows\System\BcSTACh.exe
  2⤵
  PID:13036
- C:\Windows\System\MPLmnoJ.exe
  C:\Windows\System\MPLmnoJ.exe
  2⤵
  PID:11568
- C:\Windows\System\mkDhcHf.exe
  C:\Windows\System\mkDhcHf.exe
  2⤵
  PID:9744
- C:\Windows\System\vurmcYI.exe
  C:\Windows\System\vurmcYI.exe
  2⤵
  PID:11704
- C:\Windows\System\BjiUwxj.exe
  C:\Windows\System\BjiUwxj.exe
  2⤵
  PID:11496
- C:\Windows\System\tEVsVqU.exe
  C:\Windows\System\tEVsVqU.exe
  2⤵
  PID:11148
- C:\Windows\System\dTnhMVh.exe
  C:\Windows\System\dTnhMVh.exe
  2⤵
  PID:12236
- C:\Windows\System\KrXTUaH.exe
  C:\Windows\System\KrXTUaH.exe
  2⤵
  PID:12396
- C:\Windows\System\LEoLBDX.exe
  C:\Windows\System\LEoLBDX.exe
  2⤵
  PID:9340
- C:\Windows\System\kljOCFB.exe
  C:\Windows\System\kljOCFB.exe
  2⤵
  PID:12592
- C:\Windows\System\vEDLJES.exe
  C:\Windows\System\vEDLJES.exe
  2⤵
  PID:12612
- C:\Windows\System\HlROAZk.exe
  C:\Windows\System\HlROAZk.exe
  2⤵
  PID:12676
- C:\Windows\System\iYwLRrO.exe
  C:\Windows\System\iYwLRrO.exe
  2⤵
  PID:13164
- C:\Windows\System\MActTfs.exe
  C:\Windows\System\MActTfs.exe
  2⤵
  PID:13056
- C:\Windows\System\MQcJLOO.exe
  C:\Windows\System\MQcJLOO.exe
  2⤵
  PID:13120
- C:\Windows\System\NXpthJs.exe
  C:\Windows\System\NXpthJs.exe
  2⤵
  PID:7848
- C:\Windows\System\bmkAyma.exe
  C:\Windows\System\bmkAyma.exe
  2⤵
  PID:11708
- C:\Windows\System\pPiPmvs.exe
  C:\Windows\System\pPiPmvs.exe
  2⤵
  PID:11828
- C:\Windows\System\YfjPdvu.exe
  C:\Windows\System\YfjPdvu.exe
  2⤵
  PID:12228
- C:\Windows\System\GTFaYPl.exe
  C:\Windows\System\GTFaYPl.exe
  2⤵
  PID:11408
- C:\Windows\System\pHuLOuF.exe
  C:\Windows\System\pHuLOuF.exe
  2⤵
  PID:10224
- C:\Windows\System\XlbSyez.exe
  C:\Windows\System\XlbSyez.exe
  2⤵
  PID:9724
- C:\Windows\System\zWDqYGj.exe
  C:\Windows\System\zWDqYGj.exe
  2⤵
  PID:10592
- C:\Windows\System\hPNzFNJ.exe
  C:\Windows\System\hPNzFNJ.exe
  2⤵
  PID:12316
- C:\Windows\System\ghPYItA.exe
  C:\Windows\System\ghPYItA.exe
  2⤵
  PID:13328
- C:\Windows\System\ZylQouD.exe
  C:\Windows\System\ZylQouD.exe
  2⤵
  PID:13348
- C:\Windows\System\rmTLgOF.exe
  C:\Windows\System\rmTLgOF.exe
  2⤵
  PID:13372
- C:\Windows\System\RjiwLiY.exe
  C:\Windows\System\RjiwLiY.exe
  2⤵
  PID:13396
- C:\Windows\System\ifkQfPV.exe
  C:\Windows\System\ifkQfPV.exe
  2⤵
  PID:13416
- C:\Windows\System\tmDljgG.exe
  C:\Windows\System\tmDljgG.exe
  2⤵
  PID:13432
- C:\Windows\System\muiMeVt.exe
  C:\Windows\System\muiMeVt.exe
  2⤵
  PID:13456
- C:\Windows\System\WFXmFkn.exe
  C:\Windows\System\WFXmFkn.exe
  2⤵
  PID:13472
- C:\Windows\System\QWNicod.exe
  C:\Windows\System\QWNicod.exe
  2⤵
  PID:13492
- C:\Windows\System\JBeHvTu.exe
  C:\Windows\System\JBeHvTu.exe
  2⤵
  PID:13516
- C:\Windows\System\rOGaWPb.exe
  C:\Windows\System\rOGaWPb.exe
  2⤵
  PID:13536
- C:\Windows\System\ZzQxBOh.exe
  C:\Windows\System\ZzQxBOh.exe
  2⤵
  PID:13780
- C:\Windows\System\LApkwMZ.exe
  C:\Windows\System\LApkwMZ.exe
  2⤵
  PID:13812
- C:\Windows\System\EHsuGAT.exe
  C:\Windows\System\EHsuGAT.exe
  2⤵
  PID:13832
- C:\Windows\System\bEDOTEk.exe
  C:\Windows\System\bEDOTEk.exe
  2⤵
  PID:13852
- C:\Windows\System\ZHqITDX.exe
  C:\Windows\System\ZHqITDX.exe
  2⤵
  PID:13884
- C:\Windows\System\EqEDbNp.exe
  C:\Windows\System\EqEDbNp.exe
  2⤵
  PID:13912
- C:\Windows\System\GhvjVHx.exe
  C:\Windows\System\GhvjVHx.exe
  2⤵
  PID:13932
- C:\Windows\System\cUIVBZv.exe
  C:\Windows\System\cUIVBZv.exe
  2⤵
  PID:13960
- C:\Windows\System\vgjmDPD.exe
  C:\Windows\System\vgjmDPD.exe
  2⤵
  PID:13984
- C:\Windows\System\ZtCofDJ.exe
  C:\Windows\System\ZtCofDJ.exe
  2⤵
  PID:14016
- C:\Windows\System\gHiQcUe.exe
  C:\Windows\System\gHiQcUe.exe
  2⤵
  PID:14048
- C:\Windows\System\UXGVhpn.exe
  C:\Windows\System\UXGVhpn.exe
  2⤵
  PID:14072
- C:\Windows\System\rCQJhdu.exe
  C:\Windows\System\rCQJhdu.exe
  2⤵
  PID:14096
- C:\Windows\System\lkMbvRx.exe
  C:\Windows\System\lkMbvRx.exe
  2⤵
  PID:14124
- C:\Windows\System\jKHfNwT.exe
  C:\Windows\System\jKHfNwT.exe
  2⤵
  PID:14152
- C:\Windows\System\eqEvudg.exe
  C:\Windows\System\eqEvudg.exe
  2⤵
  PID:14188
- C:\Windows\System\LbTIXdw.exe
  C:\Windows\System\LbTIXdw.exe
  2⤵
  PID:14208
- C:\Windows\System\jmynxYx.exe
  C:\Windows\System\jmynxYx.exe
  2⤵
  PID:14240
- C:\Windows\System\XKBVpmZ.exe
  C:\Windows\System\XKBVpmZ.exe
  2⤵
  PID:14268
- C:\Windows\System\zoYokXf.exe
  C:\Windows\System\zoYokXf.exe
  2⤵
  PID:14292
- C:\Windows\System\yhCLUpL.exe
  C:\Windows\System\yhCLUpL.exe
  2⤵
  PID:14316
- C:\Windows\System\tZhyQmx.exe
  C:\Windows\System\tZhyQmx.exe
  2⤵
  PID:12928
- C:\Windows\System\iSgecgZ.exe
  C:\Windows\System\iSgecgZ.exe
  2⤵
  PID:12420
- C:\Windows\System\RIFZXen.exe
  C:\Windows\System\RIFZXen.exe
  2⤵
  PID:10756
- C:\Windows\System\nzWYuvp.exe
  C:\Windows\System\nzWYuvp.exe
  2⤵
  PID:11520
- C:\Windows\System\gPFlqao.exe
  C:\Windows\System\gPFlqao.exe
  2⤵
  PID:11140
- C:\Windows\System\IwMGGMv.exe
  C:\Windows\System\IwMGGMv.exe
  2⤵
  PID:13236
- C:\Windows\System\SVnsVbY.exe
  C:\Windows\System\SVnsVbY.exe
  2⤵
  PID:13324
- C:\Windows\System\sZWsGzx.exe
  C:\Windows\System\sZWsGzx.exe
  2⤵
  PID:11548
- C:\Windows\System\lcEbaCn.exe
  C:\Windows\System\lcEbaCn.exe
  2⤵
  PID:13280
- C:\Windows\System\NsyPAVt.exe
  C:\Windows\System\NsyPAVt.exe
  2⤵
  PID:3488
- C:\Windows\System\gTcpgAT.exe
  C:\Windows\System\gTcpgAT.exe
  2⤵
  PID:9684
- C:\Windows\System\BgNLwdA.exe
  C:\Windows\System\BgNLwdA.exe
  2⤵
  PID:10300
- C:\Windows\System\glQrMCh.exe
  C:\Windows\System\glQrMCh.exe
  2⤵
  PID:13760
- C:\Windows\System\jynXFUQ.exe
  C:\Windows\System\jynXFUQ.exe
  2⤵
  PID:13948
- C:\Windows\System\yqNwbZt.exe
  C:\Windows\System\yqNwbZt.exe
  2⤵
  PID:13652
- C:\Windows\System\gqfhPKw.exe
  C:\Windows\System\gqfhPKw.exe
  2⤵
  PID:8124
- C:\Windows\System\JZqEcfL.exe
  C:\Windows\System\JZqEcfL.exe
  2⤵
  PID:14024
- C:\Windows\System\NKKkAYH.exe
  C:\Windows\System\NKKkAYH.exe
  2⤵
  PID:14116
- C:\Windows\System\wEjWnoM.exe
  C:\Windows\System\wEjWnoM.exe
  2⤵
  PID:14328
- C:\Windows\System\GlEeilY.exe
  C:\Windows\System\GlEeilY.exe
  2⤵
  PID:12472
- C:\Windows\System\smUGudZ.exe
  C:\Windows\System\smUGudZ.exe
  2⤵
  PID:13976
- C:\Windows\System\XBoXZvb.exe
  C:\Windows\System\XBoXZvb.exe
  2⤵
  PID:13336
- C:\Windows\System\cYbLHDu.exe
  C:\Windows\System\cYbLHDu.exe
  2⤵
  PID:13380
- C:\Windows\System\SPGPJBN.exe
  C:\Windows\System\SPGPJBN.exe
  2⤵
  PID:13872
- C:\Windows\System\LYBHkUH.exe
  C:\Windows\System\LYBHkUH.exe
  2⤵
  PID:11796
- C:\Windows\System\oxdTCRg.exe
  C:\Windows\System\oxdTCRg.exe
  2⤵
  PID:9292
- C:\Windows\System\wVDaEUZ.exe
  C:\Windows\System\wVDaEUZ.exe
  2⤵
  PID:14132
- C:\Windows\System\Qynwzyd.exe
  C:\Windows\System\Qynwzyd.exe
  2⤵
  PID:13064
- C:\Windows\System\DULNWXx.exe
  C:\Windows\System\DULNWXx.exe
  2⤵
  PID:10432
- C:\Windows\System\nvhEOZt.exe
  C:\Windows\System\nvhEOZt.exe
  2⤵
  PID:14088
- C:\Windows\System\OPRTpRT.exe
  C:\Windows\System\OPRTpRT.exe
  2⤵
  PID:13152
- C:\Windows\System\uBbdVQd.exe
  C:\Windows\System\uBbdVQd.exe
  2⤵
  PID:14068
- C:\Windows\System\OzzkwyA.exe
  C:\Windows\System\OzzkwyA.exe
  2⤵
  PID:13560
- C:\Windows\System\bYNbBGV.exe
  C:\Windows\System\bYNbBGV.exe
  2⤵
  PID:7288
- C:\Windows\System\qVObyYP.exe
  C:\Windows\System\qVObyYP.exe
  2⤵
  PID:13588
- C:\Windows\System\YQOSxNi.exe
  C:\Windows\System\YQOSxNi.exe
  2⤵
  PID:13468
- C:\Windows\System\MeHxTWw.exe
  C:\Windows\System\MeHxTWw.exe
  2⤵
  PID:2948
- C:\Windows\System\VwwpAoz.exe
  C:\Windows\System\VwwpAoz.exe
  2⤵
  PID:4932
- C:\Windows\System\qMeOvLf.exe
  C:\Windows\System\qMeOvLf.exe
  2⤵
  PID:8376
- C:\Windows\System\AfqDidi.exe
  C:\Windows\System\AfqDidi.exe
  2⤵
  PID:2324
- C:\Windows\System\aTFWsnB.exe
  C:\Windows\System\aTFWsnB.exe
  2⤵
  PID:4504
- C:\Windows\System\HFSJSpu.exe
  C:\Windows\System\HFSJSpu.exe
  2⤵
  PID:10228
- C:\Windows\System\Lobwpxp.exe
  C:\Windows\System\Lobwpxp.exe
  2⤵
  PID:9320
- C:\Windows\System\jCXkmKu.exe
  C:\Windows\System\jCXkmKu.exe
  2⤵
  PID:13748
- C:\Windows\System\FnyDyPi.exe
  C:\Windows\System\FnyDyPi.exe
  2⤵
  PID:4888
- C:\Windows\System\kuwxdXZ.exe
  C:\Windows\System\kuwxdXZ.exe
  2⤵
  PID:13012
- C:\Windows\System\fkxFePz.exe
  C:\Windows\System\fkxFePz.exe
  2⤵
  PID:4860
- C:\Windows\System\DHehYNR.exe
  C:\Windows\System\DHehYNR.exe
  2⤵
  PID:1060
- C:\Windows\System\fzWGRpR.exe
  C:\Windows\System\fzWGRpR.exe
  2⤵
  PID:13952
- C:\Windows\System\nvSJPhJ.exe
  C:\Windows\System\nvSJPhJ.exe
  2⤵
  PID:4028
- C:\Windows\System\JfWyVJe.exe
  C:\Windows\System\JfWyVJe.exe
  2⤵
  PID:13464
- C:\Windows\System\QKtqqUJ.exe
  C:\Windows\System\QKtqqUJ.exe
  2⤵
  PID:4364
- C:\Windows\System\DbaklpX.exe
  C:\Windows\System\DbaklpX.exe
  2⤵
  PID:3968
- C:\Windows\System\ihCEfRM.exe
  C:\Windows\System\ihCEfRM.exe
  2⤵
  PID:13504
- C:\Windows\System\qiwSJGo.exe
  C:\Windows\System\qiwSJGo.exe
  2⤵
  PID:2784
- C:\Windows\System\yuqgMGY.exe
  C:\Windows\System\yuqgMGY.exe
  2⤵
  PID:3916
- C:\Windows\System\QBEetIB.exe
  C:\Windows\System\QBEetIB.exe
  2⤵
  PID:228
- C:\Windows\System\ITXFILN.exe
  C:\Windows\System\ITXFILN.exe
  2⤵
  PID:2788
- C:\Windows\System\iyNfuuI.exe
  C:\Windows\System\iyNfuuI.exe
  2⤵
  PID:4544
- C:\Windows\System\zimxDoA.exe
  C:\Windows\System\zimxDoA.exe
  2⤵
  PID:3180
- C:\Windows\System\Hskraxx.exe
  C:\Windows\System\Hskraxx.exe
  2⤵
  PID:3040
- C:\Windows\System\XnASFXT.exe
  C:\Windows\System\XnASFXT.exe
  2⤵
  PID:1052
- C:\Windows\System\GIAecoy.exe
  C:\Windows\System\GIAecoy.exe
  2⤵
  PID:3364
- C:\Windows\System\cscacGN.exe
  C:\Windows\System\cscacGN.exe
  2⤵
  PID:3192
- C:\Windows\System\jPabwQj.exe
  C:\Windows\System\jPabwQj.exe
  2⤵
  PID:9792
- C:\Windows\System\csGiHXE.exe
  C:\Windows\System\csGiHXE.exe
  2⤵
  PID:12464
- C:\Windows\System\rzVLMYH.exe
  C:\Windows\System\rzVLMYH.exe
  2⤵
  PID:2360
- C:\Windows\System\oqolGmO.exe
  C:\Windows\System\oqolGmO.exe
  2⤵
  PID:1048
- C:\Windows\System\YxrsRYT.exe
  C:\Windows\System\YxrsRYT.exe
  2⤵
  PID:2380
- C:\Windows\System\IoQwRBb.exe
  C:\Windows\System\IoQwRBb.exe
  2⤵
  PID:4480
- C:\Windows\System\DLVhcIQ.exe
  C:\Windows\System\DLVhcIQ.exe
  2⤵
  PID:116
- C:\Windows\System\FfgJVKN.exe
  C:\Windows\System\FfgJVKN.exe
  2⤵
  PID:4784
- C:\Windows\System\BLCdpyX.exe
  C:\Windows\System\BLCdpyX.exe
  2⤵
  PID:12644
- C:\Windows\System\cMhVFqO.exe
  C:\Windows\System\cMhVFqO.exe
  2⤵
  PID:400
- C:\Windows\System\UJgWeoi.exe
  C:\Windows\System\UJgWeoi.exe
  2⤵
  PID:2960
- C:\Windows\System\iSMQKWq.exe
  C:\Windows\System\iSMQKWq.exe
  2⤵
  PID:3820
- C:\Windows\System\ycaawtV.exe
  C:\Windows\System\ycaawtV.exe
  2⤵
  PID:10020
- C:\Windows\System\zTLZsMV.exe
  C:\Windows\System\zTLZsMV.exe
  2⤵
  PID:3088
- C:\Windows\System\MaWayib.exe
  C:\Windows\System\MaWayib.exe
  2⤵
  PID:4968
- C:\Windows\System\NdViKXo.exe
  C:\Windows\System\NdViKXo.exe
  2⤵
  PID:4580
- C:\Windows\System\ytVOqol.exe
  C:\Windows\System\ytVOqol.exe
  2⤵
  PID:6860
- C:\Windows\System\ifgAFoM.exe
  C:\Windows\System\ifgAFoM.exe
  2⤵
  PID:1948
- C:\Windows\System\DDJUUll.exe
  C:\Windows\System\DDJUUll.exe
  2⤵
  PID:4204
- C:\Windows\System\NwHNBBv.exe
  C:\Windows\System\NwHNBBv.exe
  2⤵
  PID:1112
- C:\Windows\System\gPubZUj.exe
  C:\Windows\System\gPubZUj.exe
  2⤵
  PID:6672
- C:\Windows\System\uGjnVYE.exe
  C:\Windows\System\uGjnVYE.exe
  2⤵
  PID:6828
- C:\Windows\System\NwXbsdy.exe
  C:\Windows\System\NwXbsdy.exe
  2⤵
  PID:2980
- C:\Windows\System\rfVCSIT.exe
  C:\Windows\System\rfVCSIT.exe
  2⤵
  PID:14036
- C:\Windows\System\UnhPaRJ.exe
  C:\Windows\System\UnhPaRJ.exe
  2⤵
  PID:628
- C:\Windows\System\vPMeVtF.exe
  C:\Windows\System\vPMeVtF.exe
  2⤵
  PID:4792
- C:\Windows\System\uPqOcgz.exe
  C:\Windows\System\uPqOcgz.exe
  2⤵
  PID:14360
- C:\Windows\System\rsxzADF.exe
  C:\Windows\System\rsxzADF.exe
  2⤵
  PID:14384
- C:\Windows\System\LlGneXJ.exe
  C:\Windows\System\LlGneXJ.exe
  2⤵
  PID:14392
- C:\Windows\System\JbweHEF.exe
  C:\Windows\System\JbweHEF.exe
  2⤵
  PID:14420
- C:\Windows\System\OgVCZDM.exe
  C:\Windows\System\OgVCZDM.exe
  2⤵
  PID:14484
- C:\Windows\System\PUMXrpi.exe
  C:\Windows\System\PUMXrpi.exe
  2⤵
  PID:14512
- C:\Windows\System\EXFHzQg.exe
  C:\Windows\System\EXFHzQg.exe
  2⤵
  PID:14540
- C:\Windows\System\VqcVUMS.exe
  C:\Windows\System\VqcVUMS.exe
  2⤵
  PID:14572
- C:\Windows\System\HsZAEyN.exe
  C:\Windows\System\HsZAEyN.exe
  2⤵
  PID:14592
- C:\Windows\System\ywdfMVe.exe
  C:\Windows\System\ywdfMVe.exe
  2⤵
  PID:14624
- C:\Windows\System\poFcmMb.exe
  C:\Windows\System\poFcmMb.exe
  2⤵
  PID:14712
- C:\Windows\System\IOQOUKU.exe
  C:\Windows\System\IOQOUKU.exe
  2⤵
  PID:14772
- C:\Windows\System\SlzAbwK.exe
  C:\Windows\System\SlzAbwK.exe
  2⤵
  PID:14796
- C:\Windows\System\TUYomaW.exe
  C:\Windows\System\TUYomaW.exe
  2⤵
  PID:14836
- C:\Windows\System\mVdRJZx.exe
  C:\Windows\System\mVdRJZx.exe
  2⤵
  PID:14852
- C:\Windows\System\AyTLJpO.exe
  C:\Windows\System\AyTLJpO.exe
  2⤵
  PID:3264
- C:\Windows\System\NtbuOFr.exe
  C:\Windows\System\NtbuOFr.exe
  2⤵
  PID:14880
- C:\Windows\System\RgBgVeu.exe
  C:\Windows\System\RgBgVeu.exe
  2⤵
  PID:15084
- C:\Windows\System\tZDKTOq.exe
  C:\Windows\System\tZDKTOq.exe
  2⤵
  PID:15112
- C:\Windows\System\bciGhzP.exe
  C:\Windows\System\bciGhzP.exe
  2⤵
  PID:15132
- C:\Windows\System\UjFEHeG.exe
  C:\Windows\System\UjFEHeG.exe
  2⤵
  PID:15144
- C:\Windows\System\SniKHQi.exe
  C:\Windows\System\SniKHQi.exe
  2⤵
  PID:15168
- C:\Windows\System\KIWnmwV.exe
  C:\Windows\System\KIWnmwV.exe
  2⤵
  PID:15208
- C:\Windows\System\nTkUDep.exe
  C:\Windows\System\nTkUDep.exe
  2⤵
  PID:15228
- C:\Windows\System\OitnfAs.exe
  C:\Windows\System\OitnfAs.exe
  2⤵
  PID:15260
- C:\Windows\System\zXUPdXl.exe
  C:\Windows\System\zXUPdXl.exe
  2⤵
  PID:15280
- C:\Windows\System\CxCWLXL.exe
  C:\Windows\System\CxCWLXL.exe
  2⤵
  PID:15312
- C:\Windows\System\MoKeNep.exe
  C:\Windows\System\MoKeNep.exe
  2⤵
  PID:13688
- C:\Windows\System\caGhQOB.exe
  C:\Windows\System\caGhQOB.exe
  2⤵
  PID:14412
- C:\Windows\System\Azcjybw.exe
  C:\Windows\System\Azcjybw.exe
  2⤵
  PID:4456
- C:\Windows\System\ssyXpkE.exe
  C:\Windows\System\ssyXpkE.exe
  2⤵
  PID:1920
- C:\Windows\System\bCjvojd.exe
  C:\Windows\System\bCjvojd.exe
  2⤵
  PID:14520
- C:\Windows\System\HOefcAO.exe
  C:\Windows\System\HOefcAO.exe
  2⤵
  PID:14548
- C:\Windows\System\qjdUvkw.exe
  C:\Windows\System\qjdUvkw.exe
  2⤵
  PID:4908
- C:\Windows\System\BXaBogA.exe
  C:\Windows\System\BXaBogA.exe
  2⤵
  PID:14580
- C:\Windows\System\OGelzze.exe
  C:\Windows\System\OGelzze.exe
  2⤵
  PID:14640
- C:\Windows\System\GFdDfGB.exe
  C:\Windows\System\GFdDfGB.exe
  2⤵
  PID:1816
- C:\Windows\System\zXJirhy.exe
  C:\Windows\System\zXJirhy.exe
  2⤵
  PID:2456
- C:\Windows\System\bxWiNas.exe
  C:\Windows\System\bxWiNas.exe
  2⤵
  PID:3484
- C:\Windows\System\jiDhKlR.exe
  C:\Windows\System\jiDhKlR.exe
  2⤵
  PID:14724
- C:\Windows\System\ITGPtbR.exe
  C:\Windows\System\ITGPtbR.exe
  2⤵
  PID:2944
- C:\Windows\System\sEuxIZX.exe
  C:\Windows\System\sEuxIZX.exe
  2⤵
  PID:14788
- C:\Windows\System\vxMJyln.exe
  C:\Windows\System\vxMJyln.exe
  2⤵
  PID:4384
- C:\Windows\System\rjMOctk.exe
  C:\Windows\System\rjMOctk.exe
  2⤵
  PID:14908
- C:\Windows\System\XkAYmAs.exe
  C:\Windows\System\XkAYmAs.exe
  2⤵
  PID:14932
- C:\Windows\System\afdBMDS.exe
  C:\Windows\System\afdBMDS.exe
  2⤵
  PID:15020
- C:\Windows\System\mdiZlsw.exe
  C:\Windows\System\mdiZlsw.exe
  2⤵
  PID:15040
- C:\Windows\System\msjEPOt.exe
  C:\Windows\System\msjEPOt.exe
  2⤵
  PID:14976
- C:\Windows\System\sLywqog.exe
  C:\Windows\System\sLywqog.exe
  2⤵
  PID:14472
- C:\Windows\System\msMvkVm.exe
  C:\Windows\System\msMvkVm.exe
  2⤵
  PID:876
- C:\Windows\System\thiSOWz.exe
  C:\Windows\System\thiSOWz.exe
  2⤵
  PID:15076
- C:\Windows\System\ifjBmGz.exe
  C:\Windows\System\ifjBmGz.exe
  2⤵
  PID:868
- C:\Windows\System\JkoJQRD.exe
  C:\Windows\System\JkoJQRD.exe
  2⤵
  PID:15100
- C:\Windows\System\QODCJCX.exe
  C:\Windows\System\QODCJCX.exe
  2⤵
  PID:2520
- C:\Windows\System\SmSAEzy.exe
  C:\Windows\System\SmSAEzy.exe
  2⤵
  PID:15120
- C:\Windows\System\IXHdfaJ.exe
  C:\Windows\System\IXHdfaJ.exe
  2⤵
  PID:2448
- C:\Windows\System\lkkpjJZ.exe
  C:\Windows\System\lkkpjJZ.exe
  2⤵
  PID:15164
- C:\Windows\System\vYyvFoP.exe
  C:\Windows\System\vYyvFoP.exe
  2⤵
  PID:15196
- C:\Windows\System\mqweiIb.exe
  C:\Windows\System\mqweiIb.exe
  2⤵
  PID:3608
- C:\Windows\System\hNTeYwv.exe
  C:\Windows\System\hNTeYwv.exe
  2⤵
  PID:15356
- C:\Windows\System\tiaweMN.exe
  C:\Windows\System\tiaweMN.exe
  2⤵
  PID:2972
- C:\Windows\System\suYDcsu.exe
  C:\Windows\System\suYDcsu.exe
  2⤵
  PID:14468
- C:\Windows\System\QdfCCqj.exe
  C:\Windows\System\QdfCCqj.exe
  2⤵
  PID:14340
- C:\Windows\System\KDGxgOS.exe
  C:\Windows\System\KDGxgOS.exe
  2⤵
  PID:14528
- C:\Windows\System\taJAgEk.exe
  C:\Windows\System\taJAgEk.exe
  2⤵
  PID:14816
- C:\Windows\System\WTzgTBU.exe
  C:\Windows\System\WTzgTBU.exe
  2⤵
  PID:14688
- C:\Windows\System\jJxQSoj.exe
  C:\Windows\System\jJxQSoj.exe
  2⤵
  PID:5492
- C:\Windows\System\QvzlEEf.exe
  C:\Windows\System\QvzlEEf.exe
  2⤵
  PID:5912
- C:\Windows\System\btsTDwi.exe
  C:\Windows\System\btsTDwi.exe
  2⤵
  PID:3324
- C:\Windows\System\BTNWsjM.exe
  C:\Windows\System\BTNWsjM.exe
  2⤵
  PID:1716
- C:\Windows\System\omvHzWv.exe
  C:\Windows\System\omvHzWv.exe
  2⤵
  PID:14900
- C:\Windows\System\SOuxfqB.exe
  C:\Windows\System\SOuxfqB.exe
  2⤵
  PID:14764
- C:\Windows\System\iUIyWgt.exe
  C:\Windows\System\iUIyWgt.exe
  2⤵
  PID:15032
- C:\Windows\System\UKLlFzE.exe
  C:\Windows\System\UKLlFzE.exe
  2⤵
  PID:14948
- C:\Windows\System\ffrDTGL.exe
  C:\Windows\System\ffrDTGL.exe
  2⤵
  PID:14916
- C:\Windows\System\HzzWImx.exe
  C:\Windows\System\HzzWImx.exe
  2⤵
  PID:6004
- C:\Windows\System\rDkBlaI.exe
  C:\Windows\System\rDkBlaI.exe
  2⤵
  PID:3632
- C:\Windows\System\CVqaLHr.exe
  C:\Windows\System\CVqaLHr.exe
  2⤵
  PID:5312
- C:\Windows\System\pBYvxcJ.exe
  C:\Windows\System\pBYvxcJ.exe
  2⤵
  PID:15224
- C:\Windows\System\IojjEDr.exe
  C:\Windows\System\IojjEDr.exe
  2⤵
  PID:2240
- C:\Windows\System\vkCGSzH.exe
  C:\Windows\System\vkCGSzH.exe
  2⤵
  PID:5836
- C:\Windows\System\zMYFhQc.exe
  C:\Windows\System\zMYFhQc.exe
  2⤵
  PID:5376
- C:\Windows\System\NhAoHUQ.exe
  C:\Windows\System\NhAoHUQ.exe
  2⤵
  PID:5184
- C:\Windows\System\leTKVry.exe
  C:\Windows\System\leTKVry.exe
  2⤵
  PID:5812
- C:\Windows\System\uocUOkB.exe
  C:\Windows\System\uocUOkB.exe
  2⤵
  PID:15332
- C:\Windows\System\lGYcWuY.exe
  C:\Windows\System\lGYcWuY.exe
  2⤵
  PID:15344
- C:\Windows\System\FDjVnfh.exe
  C:\Windows\System\FDjVnfh.exe
  2⤵
  PID:14536
- C:\Windows\System\OMAZhiw.exe
  C:\Windows\System\OMAZhiw.exe
  2⤵
  PID:5232
- C:\Windows\System\oqCMEIF.exe
  C:\Windows\System\oqCMEIF.exe
  2⤵
  PID:14632
- C:\Windows\System\xXAMRJs.exe
  C:\Windows\System\xXAMRJs.exe
  2⤵
  PID:14400
- C:\Windows\System\JqtoewZ.exe
  C:\Windows\System\JqtoewZ.exe
  2⤵
  PID:6752
- C:\Windows\System\ttQdIQz.exe
  C:\Windows\System\ttQdIQz.exe
  2⤵
  PID:6000
- C:\Windows\System\XvNAVtA.exe
  C:\Windows\System\XvNAVtA.exe
  2⤵
  PID:5520
- C:\Windows\System\DApVGbX.exe
  C:\Windows\System\DApVGbX.exe
  2⤵
  PID:6484
- C:\Windows\System\ZmiHsTK.exe
  C:\Windows\System\ZmiHsTK.exe
  2⤵
  PID:6064
- C:\Windows\System\XGgTuDT.exe
  C:\Windows\System\XGgTuDT.exe
  2⤵
  PID:6904
- C:\Windows\System\QFUbliQ.exe
  C:\Windows\System\QFUbliQ.exe
  2⤵
  PID:14956
- C:\Windows\System\EURAskQ.exe
  C:\Windows\System\EURAskQ.exe
  2⤵
  PID:5944
- C:\Windows\System\NEYDYyU.exe
  C:\Windows\System\NEYDYyU.exe
  2⤵
  PID:14940
- C:\Windows\System\SNhuccY.exe
  C:\Windows\System\SNhuccY.exe
  2⤵
  PID:15000
- C:\Windows\System\Bfkutjf.exe
  C:\Windows\System\Bfkutjf.exe
  2⤵
  PID:15004
- C:\Windows\System\lsAlFub.exe
  C:\Windows\System\lsAlFub.exe
  2⤵
  PID:15180
- C:\Windows\System\seCVkhm.exe
  C:\Windows\System\seCVkhm.exe
  2⤵
  PID:4124
- C:\Windows\System\pMyfaAd.exe
  C:\Windows\System\pMyfaAd.exe
  2⤵
  PID:7448
- C:\Windows\System\oWuKNQE.exe
  C:\Windows\System\oWuKNQE.exe
  2⤵
  PID:9376
- C:\Windows\System\EjeiWRg.exe
  C:\Windows\System\EjeiWRg.exe
  2⤵
  PID:4332
- C:\Windows\System\oicCIGR.exe
  C:\Windows\System\oicCIGR.exe
  2⤵
  PID:6556
- C:\Windows\System\uHMcWhR.exe
  C:\Windows\System\uHMcWhR.exe
  2⤵
  PID:13508
- C:\Windows\System\HsjUZBl.exe
  C:\Windows\System\HsjUZBl.exe
  2⤵
  PID:5696
- C:\Windows\System\piMgWtt.exe
  C:\Windows\System\piMgWtt.exe
  2⤵
  PID:14500
- C:\Windows\System\xXdUsOf.exe
  C:\Windows\System\xXdUsOf.exe
  2⤵
  PID:13672
- C:\Windows\System\MlRBbWC.exe
  C:\Windows\System\MlRBbWC.exe
  2⤵
  PID:7176
- C:\Windows\System\GHZrFhI.exe
  C:\Windows\System\GHZrFhI.exe
  2⤵
  PID:8068
- C:\Windows\System\eeMOhPO.exe
  C:\Windows\System\eeMOhPO.exe
  2⤵
  PID:2732
- C:\Windows\System\jufodgJ.exe
  C:\Windows\System\jufodgJ.exe
  2⤵
  PID:6772
- C:\Windows\System\EroKOBR.exe
  C:\Windows\System\EroKOBR.exe
  2⤵
  PID:5628
- C:\Windows\System\ObIoOKd.exe
  C:\Windows\System\ObIoOKd.exe
  2⤵
  PID:7992
- C:\Windows\System\qRDgvWl.exe
  C:\Windows\System\qRDgvWl.exe
  2⤵
  PID:7248
- C:\Windows\System\rYGGJAF.exe
  C:\Windows\System\rYGGJAF.exe
  2⤵
  PID:6120
- C:\Windows\System\RfYFdwJ.exe
  C:\Windows\System\RfYFdwJ.exe
  2⤵
  PID:3320
- C:\Windows\System\PqTsrth.exe
  C:\Windows\System\PqTsrth.exe
  2⤵
  PID:8100
- C:\Windows\System\wgBfYDI.exe
  C:\Windows\System\wgBfYDI.exe
  2⤵
  PID:7896
- C:\Windows\System\kzUeYFX.exe
  C:\Windows\System\kzUeYFX.exe
  2⤵
  PID:12320
- C:\Windows\System\SKlsTaV.exe
  C:\Windows\System\SKlsTaV.exe
  2⤵
  PID:13904
- C:\Windows\System\AkOkPNp.exe
  C:\Windows\System\AkOkPNp.exe
  2⤵
  PID:7292
- C:\Windows\System\eezrUWC.exe
  C:\Windows\System\eezrUWC.exe
  2⤵
  PID:5680
- C:\Windows\System\SiJYlvI.exe
  C:\Windows\System\SiJYlvI.exe
  2⤵
  PID:7080
- C:\Windows\System\jRsGZBb.exe
  C:\Windows\System\jRsGZBb.exe
  2⤵
  PID:14168
- C:\Windows\System\ZOKCPqq.exe
  C:\Windows\System\ZOKCPqq.exe
  2⤵
  PID:7016
- C:\Windows\System\QbFqRoW.exe
  C:\Windows\System\QbFqRoW.exe
  2⤵
  PID:14748
- C:\Windows\System\dHPhpao.exe
  C:\Windows\System\dHPhpao.exe
  2⤵
  PID:6628
- C:\Windows\System\coIHvUR.exe
  C:\Windows\System\coIHvUR.exe
  2⤵
  PID:6704
- C:\Windows\System\nbebttm.exe
  C:\Windows\System\nbebttm.exe
  2⤵
  PID:8872
- C:\Windows\System\FHWihms.exe
  C:\Windows\System\FHWihms.exe
  2⤵
  PID:8300
- C:\Windows\System\RwwRDkD.exe
  C:\Windows\System\RwwRDkD.exe
  2⤵
  PID:5132
- C:\Windows\System\gJphBxc.exe
  C:\Windows\System\gJphBxc.exe
  2⤵
  PID:14824
- C:\Windows\System\jwjrIvf.exe
  C:\Windows\System\jwjrIvf.exe
  2⤵
  PID:7968
- C:\Windows\System\AxxlVXP.exe
  C:\Windows\System\AxxlVXP.exe
  2⤵
  PID:9232
- C:\Windows\System\iJmPMWz.exe
  C:\Windows\System\iJmPMWz.exe
  2⤵
  PID:9316
- C:\Windows\System\hcodDxE.exe
  C:\Windows\System\hcodDxE.exe
  2⤵
  PID:15044
- C:\Windows\System\JlFdudP.exe
  C:\Windows\System\JlFdudP.exe
  2⤵
  PID:6192
- C:\Windows\System\cuSdLNK.exe
  C:\Windows\System\cuSdLNK.exe
  2⤵
  PID:7780
- C:\Windows\System\augkorD.exe
  C:\Windows\System\augkorD.exe
  2⤵
  PID:9476
- C:\Windows\System\GpwKGLf.exe
  C:\Windows\System\GpwKGLf.exe
  2⤵
  PID:5540
- C:\Windows\System\cGgZucU.exe
  C:\Windows\System\cGgZucU.exe
  2⤵
  PID:15128
- C:\Windows\System\gmwdUGM.exe
  C:\Windows\System\gmwdUGM.exe
  2⤵
  PID:9464
- C:\Windows\System\xYgRqca.exe
  C:\Windows\System\xYgRqca.exe
  2⤵
  PID:13528
- C:\Windows\System\zMwHjla.exe
  C:\Windows\System\zMwHjla.exe
  2⤵
  PID:9632
- C:\Windows\System\zrHLoft.exe
  C:\Windows\System\zrHLoft.exe
  2⤵
  PID:14616
- C:\Windows\System\bMSRSnK.exe
  C:\Windows\System\bMSRSnK.exe
  2⤵
  PID:10004
- C:\Windows\System\DMzTKBj.exe
  C:\Windows\System\DMzTKBj.exe
  2⤵
  PID:8140
- C:\Windows\System\tirLyJg.exe
  C:\Windows\System\tirLyJg.exe
  2⤵
  PID:8900
- C:\Windows\System\xFgJDfa.exe
  C:\Windows\System\xFgJDfa.exe
  2⤵
  PID:8592
- C:\Windows\System\qopMOhp.exe
  C:\Windows\System\qopMOhp.exe
  2⤵
  PID:9120
- C:\Windows\System\MkvXhfC.exe
  C:\Windows\System\MkvXhfC.exe
  2⤵
  PID:8868
- C:\Windows\System\zfhSFSL.exe
  C:\Windows\System\zfhSFSL.exe
  2⤵
  PID:10204
- C:\Windows\System\tNidJxg.exe
  C:\Windows\System\tNidJxg.exe
  2⤵
  PID:8856
- C:\Windows\System\jztTiNx.exe
  C:\Windows\System\jztTiNx.exe
  2⤵
  PID:7944
- C:\Windows\System\xHiMxzc.exe
  C:\Windows\System\xHiMxzc.exe
  2⤵
  PID:6140
- C:\Windows\System\kRzzQJn.exe
  C:\Windows\System\kRzzQJn.exe
  2⤵
  PID:7580
- C:\Windows\System\jzTeChs.exe
  C:\Windows\System\jzTeChs.exe
  2⤵
  PID:7228
- C:\Windows\System\BTOjsrg.exe
  C:\Windows\System\BTOjsrg.exe
  2⤵
  PID:8484
- C:\Windows\System\SOQFJKc.exe
  C:\Windows\System\SOQFJKc.exe
  2⤵
  PID:8624
- C:\Windows\System\svmuXKV.exe
  C:\Windows\System\svmuXKV.exe
  2⤵
  PID:8276
- C:\Windows\System\jIOuaPb.exe
  C:\Windows\System\jIOuaPb.exe
  2⤵
  PID:9520
- C:\Windows\System\NfwnfUf.exe
  C:\Windows\System\NfwnfUf.exe
  2⤵
  PID:7844
- C:\Windows\System\jHRfvUd.exe
  C:\Windows\System\jHRfvUd.exe
  2⤵
  PID:7828
- C:\Windows\System\PneXKNX.exe
  C:\Windows\System\PneXKNX.exe
  2⤵
  PID:8596
- C:\Windows\System\tSegRUK.exe
  C:\Windows\System\tSegRUK.exe
  2⤵
  PID:7200
- C:\Windows\System\eppSCAZ.exe
  C:\Windows\System\eppSCAZ.exe
  2⤵
  PID:13696
- C:\Windows\System\wGvbmDf.exe
  C:\Windows\System\wGvbmDf.exe
  2⤵
  PID:14768
- C:\Windows\System\ftmhcVN.exe
  C:\Windows\System\ftmhcVN.exe
  2⤵
  PID:6168
- C:\Windows\System\MRrOuoa.exe
  C:\Windows\System\MRrOuoa.exe
  2⤵
  PID:9968
- C:\Windows\System\NtXwGOQ.exe
  C:\Windows\System\NtXwGOQ.exe
  2⤵
  PID:8368
- C:\Windows\System\cUGVJOS.exe
  C:\Windows\System\cUGVJOS.exe
  2⤵
  PID:6384
- C:\Windows\System\mBPutWP.exe
  C:\Windows\System\mBPutWP.exe
  2⤵
  PID:224
- C:\Windows\System\zanbLOA.exe
  C:\Windows\System\zanbLOA.exe
  2⤵
  PID:7240
- C:\Windows\System\UzjlZPY.exe
  C:\Windows\System\UzjlZPY.exe
  2⤵
  PID:8800
- C:\Windows\System\VNSlHun.exe
  C:\Windows\System\VNSlHun.exe
  2⤵
  PID:3056
- C:\Windows\System\kaYijqD.exe
  C:\Windows\System\kaYijqD.exe
  2⤵
  PID:8924
- C:\Windows\System\VBqhoRc.exe
  C:\Windows\System\VBqhoRc.exe
  2⤵
  PID:9004
- C:\Windows\System\EbfdhQU.exe
  C:\Windows\System\EbfdhQU.exe
  2⤵
  PID:10984
- C:\Windows\System\PNLfjST.exe
  C:\Windows\System\PNLfjST.exe
  2⤵
  PID:10940
- C:\Windows\System\sgqKSVm.exe
  C:\Windows\System\sgqKSVm.exe
  2⤵
  PID:11028
- C:\Windows\System\QZYIngy.exe
  C:\Windows\System\QZYIngy.exe
  2⤵
  PID:1500
- C:\Windows\System\Ezuqemi.exe
  C:\Windows\System\Ezuqemi.exe
  2⤵
  PID:7052
- C:\Windows\System\knpHpoF.exe
  C:\Windows\System\knpHpoF.exe
  2⤵
  PID:10636
- C:\Windows\System\ytpAFkM.exe
  C:\Windows\System\ytpAFkM.exe
  2⤵
  PID:11036
- C:\Windows\System\exCuYbx.exe
  C:\Windows\System\exCuYbx.exe
  2⤵
  PID:7284
- C:\Windows\System\ekLqOgP.exe
  C:\Windows\System\ekLqOgP.exe
  2⤵
  PID:9788
- C:\Windows\System\jelBIcO.exe
  C:\Windows\System\jelBIcO.exe
  2⤵
  PID:8328
- C:\Windows\System\kAYcjYS.exe
  C:\Windows\System\kAYcjYS.exe
  2⤵
  PID:5636
- C:\Windows\System\pIBknkd.exe
  C:\Windows\System\pIBknkd.exe
  2⤵
  PID:9332
- C:\Windows\System\DGnRyaa.exe
  C:\Windows\System\DGnRyaa.exe
  2⤵
  PID:7244
- C:\Windows\System\AvZgBQZ.exe
  C:\Windows\System\AvZgBQZ.exe
  2⤵
  PID:10876
- C:\Windows\System\PjtOBPg.exe
  C:\Windows\System\PjtOBPg.exe
  2⤵
  PID:10612
- C:\Windows\System\gmVYJoc.exe
  C:\Windows\System\gmVYJoc.exe
  2⤵
  PID:10776
- C:\Windows\System\MwvjtaE.exe
  C:\Windows\System\MwvjtaE.exe
  2⤵
  PID:10044
- C:\Windows\System\MuXNevS.exe
  C:\Windows\System\MuXNevS.exe
  2⤵
  PID:9040
- C:\Windows\System\GNcapZw.exe
  C:\Windows\System\GNcapZw.exe
  2⤵
  PID:11776
- C:\Windows\System\TNIrzeT.exe
  C:\Windows\System\TNIrzeT.exe
  2⤵
  PID:12100
- C:\Windows\System\jHtwovN.exe
  C:\Windows\System\jHtwovN.exe
  2⤵
  PID:10956
- C:\Windows\System\NHDzTGA.exe
  C:\Windows\System\NHDzTGA.exe
  2⤵
  PID:10780
- C:\Windows\System\FgCPNfc.exe
  C:\Windows\System\FgCPNfc.exe
  2⤵
  PID:10996
- C:\Windows\System\jgzUyaD.exe
  C:\Windows\System\jgzUyaD.exe
  2⤵
  PID:12400
- C:\Windows\System\mdtvFpK.exe
  C:\Windows\System\mdtvFpK.exe
  2⤵
  PID:15420
- C:\Windows\System\XAwkmFs.exe
  C:\Windows\System\XAwkmFs.exe
  2⤵
  PID:15460
- C:\Windows\System\JtYgtkk.exe
  C:\Windows\System\JtYgtkk.exe
  2⤵
  PID:15604
- C:\Windows\System\StmvCcM.exe
  C:\Windows\System\StmvCcM.exe
  2⤵
  PID:15628
- C:\Windows\System\MtagjAm.exe
  C:\Windows\System\MtagjAm.exe
  2⤵
  PID:15660
- C:\Windows\System\ahFftSy.exe
  C:\Windows\System\ahFftSy.exe
  2⤵
  PID:15764
- C:\Windows\System\jLCztAY.exe
  C:\Windows\System\jLCztAY.exe
  2⤵
  PID:15888
- C:\Windows\System\JcoyJlG.exe
  C:\Windows\System\JcoyJlG.exe
  2⤵
  PID:15956
- C:\Windows\System\TpKDfTF.exe
  C:\Windows\System\TpKDfTF.exe
  2⤵
  PID:15984
- C:\Windows\System\lalToqM.exe
  C:\Windows\System\lalToqM.exe
  2⤵
  PID:16008
- C:\Windows\System\bqyvEvR.exe
  C:\Windows\System\bqyvEvR.exe
  2⤵
  PID:16048
- C:\Windows\System\lEGbyeo.exe
  C:\Windows\System\lEGbyeo.exe
  2⤵
  PID:16064
- C:\Windows\System\czEjnhp.exe
  C:\Windows\System\czEjnhp.exe
  2⤵
  PID:16096
- C:\Windows\System\jOTMVUq.exe
  C:\Windows\System\jOTMVUq.exe
  2⤵
  PID:16116
- C:\Windows\System\dXRMnnU.exe
  C:\Windows\System\dXRMnnU.exe
  2⤵
  PID:16340
- C:\Windows\System\bylkssw.exe
  C:\Windows\System\bylkssw.exe
  2⤵
  PID:16376
- C:\Windows\System\wKpQgYD.exe
  C:\Windows\System\wKpQgYD.exe
  2⤵
  PID:10964
- C:\Windows\System\hxjVwKk.exe
  C:\Windows\System\hxjVwKk.exe
  2⤵
  PID:5516
- C:\Windows\System\tsbydhn.exe
  C:\Windows\System\tsbydhn.exe
  2⤵
  PID:8796
- C:\Windows\System\DFaFyZv.exe
  C:\Windows\System\DFaFyZv.exe
  2⤵
  PID:10408
- C:\Windows\System\PMhUzkk.exe
  C:\Windows\System\PMhUzkk.exe
  2⤵
  PID:9380
- C:\Windows\System\dzIlPgV.exe
  C:\Windows\System\dzIlPgV.exe
  2⤵
  PID:10772
- C:\Windows\System\YqSfzfG.exe
  C:\Windows\System\YqSfzfG.exe
  2⤵
  PID:10944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rkqpcjkv.o2p.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\GXAndgY.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\IqAwGXY.exe

Filesize
1.9MB

MD5
439e6b4ca31b694fa8d947a82d7cd4b8

SHA1
58e1843c8514758a320e9c9e155c15f67eadae65

SHA256
8fc55299cb664131e7e6b80a131614d4b89b492af590c5b5bbf6c4231db21a9f

SHA512
729be1fdf3da9dfdaac23348fdc271c287d45668184972de2dd276728ff45dfc49f36049830ff74098e4c8e0fe5a35135aa362d783e8789e9b4c45d0595ccb23

Download Submit
C:\Windows\System\KVxUaCr.exe

Filesize
1.9MB

MD5
44a71b6f8497000ab70e316d093c01fe

SHA1
1d80e6b56a1718bb888a903028c731f18cef9468

SHA256
c7db43a0a6dc0b14465dabde3f2bb4c663b95ba365ceb9302fc0efe6adbbca2f

SHA512
6d9b4230702a6cc7e0b83d29b134273f848e723721528f63bb10b15bfc94472dfa60e99d27cece954a26d885dd299aea773c83aeb6c5bfe45ef297acf5999daf

Download Submit
C:\Windows\System\MXDbWta.exe

Filesize
1.9MB

MD5
76d80d2bb0eeb6b70531189136a5a8fc

SHA1
6819b1ddb378894b7dcf94298e6b4b72e306e88c

SHA256
1bbe619b597aef766a37111b3d42ead23e6d5d764059f71b3f8a39744c98ae21

SHA512
6f80bdda5520a1ae7e0035c22b8722d9a38de6ba7989a11654776a3fe0d2dadeee8861728fd299d511af375df1ed1da8ccfc63dae977f2abdd58b0cf1c5482aa

Download Submit
C:\Windows\System\MnLHhRt.exe

Filesize
1.9MB

MD5
a58bb5dfa45241ae62875c87e7734f8a

SHA1
a66e1820dc95f24440f1201fb164b1d6a6fb895b

SHA256
30960a1aef9d696cddf22bdcc3e74b2f57c7af41c853d345f0e65939ab05d5dd

SHA512
e2e8b9bf7711ad6501ed177b40341f50449ed99325759adf21a5e641747d206d59c3d322176bd9b3892f7f796d239001c900a3f86ddaf0ee5facb1c918ef6d0d

Download Submit
C:\Windows\System\OuORZsN.exe

Filesize
1.9MB

MD5
2a25beabd85b2e32a84dcd53c294e72e

SHA1
2b916a79dfa47a7198f98b63612ee03debe48bb2

SHA256
35bf5ff1a167a47acadf4b29f150c828167bb97501850e16b02dcd0677d76769

SHA512
5102728fab7bdb6e9d4d2717a67e9742c6b21c2fa3481a71c0eef27bca48b81400a834eb99817b7095cf6132123dd310fc2d4636b764a6391e3074b71c9231d7

Download Submit
C:\Windows\System\QuUiHpB.exe

Filesize
1.9MB

MD5
d26fa05f086a461c1b48f38bbf2ae5af

SHA1
6981dfc2eaf3a245ef3a380783e0f7ad6b3b419f

SHA256
35acc5fbd210609fe7a5eb007b32e1a347487f9555497e20c25d6850a24782a3

SHA512
fb2169bc3da3337054661a1d99e580e6cd081aecb5d4f6f97d00183456cfbb093c24f61704bd400e56057b106a09bba3c9432b108bc1e63ff5c7b8e696164c8f

Download Submit
C:\Windows\System\RXdUJPr.exe

Filesize
1.9MB

MD5
871513a02ddba447c51938bbfdaf6033

SHA1
a3dda8ae966380d48a8d7a0a607e1ac467695d0e

SHA256
fbcc55576a524c773571f6a02c0f0a05c29ccfd7e94d2b63e1933d8bdd17b8f7

SHA512
a5ab407ce06ad59f78e79a5601f9e9fcbff00a9c57b3530b347c00b26bdd39e06ce2fb0a890d78069914ee7b2275ed67a03576584188b2287a7b918341ee941f

Download Submit
C:\Windows\System\RuHWShQ.exe

Filesize
1.9MB

MD5
7466481994cc088053eedc76a77fa2eb

SHA1
c2be459caef6ec27abb64c10e258e5a6d5017eb6

SHA256
6e7e9aa2bb478c16175675d2d44f6e7f7b914c722c6bbb5c8d02aa12463b5d77

SHA512
3f8ed8b808911fb1b952bd06d2a67fcdb796ffb37af0bac7fc81fbd13df6add0613e43a5dcd5e78c6442e98eff03a53470362c666d4b7a0d18367fd95371b228

Download Submit
C:\Windows\System\SXonFmw.exe

Filesize
1.9MB

MD5
e077c5264ea9986a796af8fbadf32bdb

SHA1
7628f769d12f0f4074c593d0058bf443e62f2b8b

SHA256
0d3d703026828df2d71ab9c489e46bd090baa63c875af0576119ba63896a2e8e

SHA512
5d666df0f0392c3cc42f79b15f06fdf20b581327a5cea7163c8a2645c028eed84767dd4b6d25d03e658496505595a797cd80a7c571b35969ac0d552da1fd6263

Download Submit
C:\Windows\System\ShbDabO.exe

Filesize
1.9MB

MD5
13df5ef461bbccc2c115e56f8a2c0e0b

SHA1
9317b588edf6b5eb98897ec125fd28cef5583668

SHA256
a09b08a809ce94c812dbb2d4aa11bc70bc88603dcf3a8ee42e3b9b0de287b2e6

SHA512
4913f88ba94d18299746fb81470f9dfd9e7d98aa600768178190a7e9ddb2444bb72055f4cc165b961a20cbf5f5fd643c914d96bff1156c63cb3224e5d023b0a5

Download Submit
C:\Windows\System\TNfODYQ.exe

Filesize
1.9MB

MD5
dcc31389bd2fd6e6ed25e04aa7f51ced

SHA1
d2849b31ab7510e4562e8b98463aeaa184657df6

SHA256
2ee421a7616fb9169386b8a3aac4bdd4784b72abcd278ad94450538496af6204

SHA512
96934952a24f9bc10f38ba76a1de7cdc009d317e7f8b2baab31c3e8f03a5eb16b339d38cf2e3ea0ac9369d16427dabe525811013e2eba2354e60867b1913c6db

Download Submit
C:\Windows\System\UgIqfPB.exe

Filesize
1.9MB

MD5
5a5c829190013e646fb2dfc2c692079f

SHA1
224443f67ecc924ae0aa034834edbfd399790cf3

SHA256
6defea044a062fff4497d37811c053f057bcfe085da55fdc01975a0e823a1a59

SHA512
c70e22c09f2214afd01203fa0a4eb24c0eba9a4e0893ffbdef6a8d21ea1e35bee8cd87d912e73332c4ca33f40fd7800e836c21dfc1967fe0850be7c903979543

Download Submit
C:\Windows\System\ZSgkfPd.exe

Filesize
1.9MB

MD5
7a3ba2cc7ca23f5412c25c8018fa2932

SHA1
8d3a158326351b5f13df66eb703ea4df352aeb48

SHA256
1d31ef27fbe82741295cc2a08ed29031a409c6d984697c5a0a70492598739168

SHA512
18c0c05d2ed3d40dc08ad058990ab6f46b91f8433582191e79fa187b42173986e3ff6d9309c34c722e33f8a16ba5b1bc8d2cb6de0ea0f43d0234938feff19793

Download Submit
C:\Windows\System\ZwtqeBF.exe

Filesize
1.9MB

MD5
87635bada194364393f607446003e4ea

SHA1
e066aab83766a4bd125cbcbd9b97adfa01406c9b

SHA256
8eeaefaf604c8b95699ed4469399fd3fcf0652a86577da90eabbe929d3fc0e8f

SHA512
896f72903a2cd5f8cf74820c170e9cf43e2d58bfeb3ef0841db6a7bc3d9b8d50596c434a3ed1ebf155d610d0fa0d07d32d732518766a56fabb6de054b1381289

Download Submit
C:\Windows\System\aPimWKh.exe

Filesize
1.9MB

MD5
2e29671c67e23a58e6fd657c70a31477

SHA1
eab851bab99d68bae7036ab2e86a62c0148b19d5

SHA256
a2132de56595046db4d7227d7d73e78a6f17d784ced5efd96304a25b33831090

SHA512
80216caafcf064a6a309619498822d0d0fa05bff12cad48bdbf26ec906b406ff0f4100035c3ba9071462b8c07f1ca562f9a3c69a9700ff7f13c329a9989fec2e

Download Submit
C:\Windows\System\aykiQHL.exe

Filesize
1.9MB

MD5
5840d6b158758956ad4fb8a9310ae9d2

SHA1
d00515291f3381341ad3fce4368553dccebe570f

SHA256
124b00122e298d0e3be09447fa7f2924dbba4429b244c906e051094900531a96

SHA512
7831e652ee13f8ea926206920ec7a304d061d4278546b664de44126d4dc630fc0a88c36e1c8411aad096ce1d4cc8566f07608bb3d6bb95474111c6db8094cb08

Download Submit
C:\Windows\System\bPQWIib.exe

Filesize
1.9MB

MD5
20cec8763320500d1cb9180f0b992ccb

SHA1
ec397e7a0d1307b33bda027f28368b45af104a42

SHA256
88d29f4c2088501d8ea336d5fbf900c4ba70a7e340cee52ddc9cefda2c322f69

SHA512
b30127d6a9eb26d1df869708ef5c8e841d986c5719f1795eee2907d6a0343bbe933183a1180510042b61bd63b6cc5b36ce2638e81a93b0ffffc0bdda3457e0bf

Download Submit
C:\Windows\System\chNNFIW.exe

Filesize
1.9MB

MD5
070c7e02ef05bf73874651fc71cf7bcb

SHA1
e2e4d5e678275dca75fe12bd6bc55806eb12645e

SHA256
82230944faaa60db314cbae88ce550273e3513a48b0903c392498b5f8098290a

SHA512
49a48b44eba6203715e230c1e32cfc0163284b03ccb06f6fb1ff8d2e93e051ff3509ac0f3d2a1ff9daf6900bf45d698793e1ef12ebf85c8dae5fe35a41449cb2

Download Submit
C:\Windows\System\eVdJnvm.exe

Filesize
1.9MB

MD5
11cb2db8b399e2593cff729aca6199e5

SHA1
ec4f5b31cbab734d23e42c1a1987f845f9f4f76b

SHA256
457e6c9900d5f7e85da140a6b0795a1bd2373083d8b69a1e441d65490fa6e2e2

SHA512
b399ec61d7f452164f3e01860d1b2c38c53dee1fa685e8e9ba4ab564a77e23910e126eecb67ad3024850715b0dd157b263f2ed3b969ec41d0161fd6a5982e50c

Download Submit
C:\Windows\System\fBHNLSS.exe

Filesize
1.9MB

MD5
5e5dbb0f516e602911a663d300e7f03d

SHA1
0b0c01d02421e7e7e2a89d6a32cf96bb9165958a

SHA256
d4ebf4725a7c83c7d3f11e606b7678b45c79f35a5a727757a06bea156367b16a

SHA512
8064e4e8db06e90aa39a2f7466b7bd258dd6bf101028c1e2fa4dbccf8e2e77cc62aa2ecfd46a34cdf4e726e90a8d6a0b10e0fd21c09a15fead3691930579b399

Download Submit
C:\Windows\System\fZRsBLq.exe

Filesize
1.9MB

MD5
64c10bd16f49793f77fe686a93768eb9

SHA1
9fb02d792baa05fb4794672f6d581ed7cecad20e

SHA256
48b3dbc1d244364857590cad8f186b6d3166a1eb5df0dd4178e3f1898e6dd04f

SHA512
8d8d92d8f79dfe676b7a77bd5a0890ba0bd46cbc1578fa265ace8418c3fffb9d751da299f484ac42d4e1e42d6308f34b1faf8e0b2ef371fd235324d6b091cae7

Download Submit
C:\Windows\System\fmPEHKi.exe

Filesize
18B

MD5
b5af15b91ef901dbbad280bf2ec97d3f

SHA1
b8fc44effcf94c604b3a330099fdd05d70ca2290

SHA256
4b241b0358bbe69bc40fb7c8558ef0dacf7a7dd595b9974e7ee1287f6f6a57a6

SHA512
77e9e1cd7604d29efe33ea37dfc85035465c8eb4a6b1edf396f009c9427a6171460e7b24fac454a276653572360ea48634eb43a059b68dd9d91460bd58c1ddf1

Download Submit
C:\Windows\System\hPBMBBC.exe

Filesize
1.9MB

MD5
c3beedd738dd799111438cc236221331

SHA1
743c54f596e582d9ba75430c5f40d0053ce8c0f1

SHA256
afc045b1f3f95b650bf246d592409c58742ea4fcd9b809dd59854784e6256d37

SHA512
43f935e21996b79eae02c01cbc22f5104f935ebb76275e0b6c1aeccddc967dc3502b0fe72c1b66bbc142446bf36d8ec2ee9461a69f2c30b59cd30b97c8d740fd

Download Submit
C:\Windows\System\hRNnmKk.exe

Filesize
1.9MB

MD5
0bd8ab2221727bf0146bd93da5616cb2

SHA1
5f7c22303760eebb73d52ddcee939809a50074d5

SHA256
0a6a17717693e5c4f26e6e152beb57e811b6e4755fa4285596b106031987a6cb

SHA512
e1a9002a9e245f2f067237b239bd1342d8ba37e466ff304f7744da0cf81c4b7c7253e72e553d791bacbcaec805405ef30632f08a92cc290fea8c4ec0af22948a

Download Submit
C:\Windows\System\myTvwaa.exe

Filesize
1.9MB

MD5
af79b426acea855fddedb601a8c838ef

SHA1
92af2d28eebedc8b04ada7474f9ed8d480131cf8

SHA256
a63a9aedf3a62df06fe2902261ece71142bfb48ee38389152905afcfc2ae008e

SHA512
0f775c9ce13459ecae1b258ccf11533ebcc7e4a96c103caa8cd08cd64d2e3ab96fa41b99abc6e6bd6a2f472d199a59fbd4af1c5036b57247edd0e32e977e9983

Download Submit
C:\Windows\System\nrfdSTg.exe

Filesize
1.9MB

MD5
2ba29565a48bc299a0d072bc7efa1174

SHA1
e6f79966ceab51878a0bb78cf690a3930e53b046

SHA256
9f6a6301d8fe3b8b6bcaf913b83f6e31177796a2622191469298fc3e286315d9

SHA512
806b6f9d72e632e94069a34f348b6ddd9cf891d4bcb20f410bc3b0c5e0fd6bf29894fb8fe4e0f0b31f58a992b75ff5f4904372cb44abc9eea33722d5e294492e

Download Submit
C:\Windows\System\oxYKYfV.exe

Filesize
1.9MB

MD5
c1e27dc074606d8f76c59f5ea07ed72f

SHA1
efc5e72f34e02cf52150eb758c93e521ae56090b

SHA256
d07628b0fde9fdf7545f531ae6aabe880c2d7b9cb9037888741bd738f941afb2

SHA512
8267318585b987035283b9a8add6099573ebd1d8c6e57b54240c7650f9e7097ec0689414f3f1050e3e190a8ae8a30fdba67ef5904f577c3d0ba3498d34db2809

Download Submit
C:\Windows\System\rnvVprq.exe

Filesize
1.9MB

MD5
1a6e9bcb32b0b1e2889eefc16d227efd

SHA1
034d2379c5e532607c697f6d8edf468164a6b4f1

SHA256
c13bf66dd7d1aa98c5a8abe5df29ae2439d930c63b0cfad5be4d80f3acac70fe

SHA512
b662d9e0bc28ed570e7761a4af71bdd2b3955277a1d91443692c11a6892e53ba225c14ee963d42fd62727958ee02295d0b1c71e60205a9827c7a6c8a4402fc17

Download Submit
C:\Windows\System\rzmfFHe.exe

Filesize
1.9MB

MD5
9e67d34b00e2a36dbd70093fbaf58ce8

SHA1
27480e2568774f2d415a2b8a8e2ba56dfbc8cb9d

SHA256
7f2b2789c05fcddd46d91ed067fbd73d659aab973ed84db51603722845fe5d50

SHA512
39c365f2f787592af7fa789a3b6381b3a8891eda18213b3371319a53a55707fa0ec1a6fe040c61b6f6284002ab4c02f7245637b030e24c6f65b9ffa87eef05dd

Download Submit
C:\Windows\System\tLOYhnV.exe

Filesize
1.9MB

MD5
34e6426dde37220ce5e96199635f97ec

SHA1
8a1346cf4f0d2d6a9be92e73377eedde83bf98d5

SHA256
b133c9e4df172c6aaaf9f92782b1732945f0b20b408ebf9253a920b639bab0da

SHA512
868b6ba5413d5e90ab0c8c61e57d8eb323cea23404c75d72cb31b449c98aa90af5d6283c110bbd21fb8e2503d02aa3147d989ce6994351b87ad7846c499f9638

Download Submit
C:\Windows\System\uMtfvFb.exe

Filesize
1.9MB

MD5
ab369019007bf14098452dbb5cc1b671

SHA1
1c9ceb4bbe698b83da6c5823fb01f61252badc38

SHA256
fec0ae6561865b158e62e16b843b8634907aea59d3ca4a288441cb6150f23168

SHA512
a03b1639d4e5202741071fc4b1499e2db236c885520f4b56982e87d17b311abc69f1083a5cb3dd4b3bcbeda99a86232780f2a534494a7b350dfd6d71043e0ab0

Download Submit
C:\Windows\System\uUJjcZP.exe

Filesize
1.9MB

MD5
fa9f0923bba8e534896cd0b055c2c574

SHA1
35b7a769f1986e21ab0f45acd4de5c982c32eadd

SHA256
fce3eac80c34b29f845e3468bf372e30eff0c064537a87e47624b99bbf57a667

SHA512
5e73d85a29e9255ee1b83f935d8a4b5086814c31a6e94be28f83fd692d64001fe78344a4534944e7ea11a6b678f4a9785887e521e710f4d3d270d69ec62e9d1a

Download Submit
C:\Windows\System\wCvqumt.exe

Filesize
1.9MB

MD5
958ac0bffc30d2e94a0613da2caee43d

SHA1
e91b11c69caeafd13c86dba03025dffad268ddf2

SHA256
fa616c4e241937117522882c65dcdb385f880b1c8b7a27680dec9115af5a5cb5

SHA512
80d896ba6b781d7b28a08f750ac73848a5b2a119ce024698ffd78461c647be0627d9b07d1ea3a8665975c15d47c1cd547e4fda5c3d79822e06ed93a717e3c1a2

Download Submit
C:\Windows\System\zgUwTLK.exe

Filesize
1.9MB

MD5
36021e3978089cae7a01c6e607bf4b52

SHA1
ad35950522426aad7653564d3c403bf005d7e8e2

SHA256
59fa3b77633f0df424d44e2815ec6e8eae0374c7950de463fcf8810411ca925d

SHA512
8ea7ba9a64fd270835d0750d017af684a30e04ce81123fc8a8660cf92431df3bb1f337e413db3a14b7be0263bbf3c16eac556309a4b9ec330d20f152deacf2e6

Download Submit
memory/468-152-0x00007FF631E30000-0x00007FF632222000-memory.dmp

Filesize
3.9MB

Download
memory/468-4719-0x00007FF631E30000-0x00007FF632222000-memory.dmp

Filesize
3.9MB

Download
memory/852-127-0x00007FF6B5570000-0x00007FF6B5962000-memory.dmp

Filesize
3.9MB

Download
memory/1172-4754-0x00007FF7B1540000-0x00007FF7B1932000-memory.dmp

Filesize
3.9MB

Download
memory/1172-181-0x00007FF7B1540000-0x00007FF7B1932000-memory.dmp

Filesize
3.9MB

Download
memory/1204-4770-0x00007FF6308B0000-0x00007FF630CA2000-memory.dmp

Filesize
3.9MB

Download
memory/1204-171-0x00007FF6308B0000-0x00007FF630CA2000-memory.dmp

Filesize
3.9MB

Download
memory/1880-4738-0x00007FF7066D0000-0x00007FF706AC2000-memory.dmp

Filesize
3.9MB

Download
memory/1880-153-0x00007FF7066D0000-0x00007FF706AC2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-178-0x00007FF653F60000-0x00007FF654352000-memory.dmp

Filesize
3.9MB

Download
memory/2036-4748-0x00007FF653F60000-0x00007FF654352000-memory.dmp

Filesize
3.9MB

Download
memory/2228-179-0x00007FF607E40000-0x00007FF608232000-memory.dmp

Filesize
3.9MB

Download
memory/2864-4653-0x00007FF6C4F00000-0x00007FF6C52F2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-85-0x00007FF6C4F00000-0x00007FF6C52F2000-memory.dmp

Filesize
3.9MB

Download
memory/3076-4766-0x00007FF701A00000-0x00007FF701DF2000-memory.dmp

Filesize
3.9MB

Download
memory/3076-192-0x00007FF701A00000-0x00007FF701DF2000-memory.dmp

Filesize
3.9MB

Download
memory/3268-72-0x00007FF780C60000-0x00007FF781052000-memory.dmp

Filesize
3.9MB

Download
memory/3412-4652-0x00007FF60B590000-0x00007FF60B982000-memory.dmp

Filesize
3.9MB

Download
memory/3412-111-0x00007FF60B590000-0x00007FF60B982000-memory.dmp

Filesize
3.9MB

Download
memory/3460-185-0x00007FF797680000-0x00007FF797A72000-memory.dmp

Filesize
3.9MB

Download
memory/3460-4819-0x00007FF797680000-0x00007FF797A72000-memory.dmp

Filesize
3.9MB

Download
memory/3480-64-0x00007FF65E960000-0x00007FF65ED52000-memory.dmp

Filesize
3.9MB

Download
memory/3628-54-0x00007FFC93950000-0x00007FFC94411000-memory.dmp

Filesize
10.8MB

Download
memory/3628-61-0x0000020A54820000-0x0000020A54830000-memory.dmp

Filesize
64KB

Download
memory/3628-189-0x0000020A54820000-0x0000020A54830000-memory.dmp

Filesize
64KB

Download
memory/3628-113-0x0000020A547A0000-0x0000020A547C2000-memory.dmp

Filesize
136KB

Download
memory/3864-1-0x00000290C14C0000-0x00000290C14D0000-memory.dmp

Filesize
64KB

Download
memory/3864-0-0x00007FF69A4C0000-0x00007FF69A8B2000-memory.dmp

Filesize
3.9MB

Download
memory/3876-182-0x00007FF7A8D30000-0x00007FF7A9122000-memory.dmp

Filesize
3.9MB

Download
memory/3876-4761-0x00007FF7A8D30000-0x00007FF7A9122000-memory.dmp

Filesize
3.9MB

Download
memory/4380-4811-0x00007FF6598A0000-0x00007FF659C92000-memory.dmp

Filesize
3.9MB

Download
memory/4380-183-0x00007FF6598A0000-0x00007FF659C92000-memory.dmp

Filesize
3.9MB

Download
memory/4440-190-0x00007FF67E410000-0x00007FF67E802000-memory.dmp

Filesize
3.9MB

Download
memory/4440-4773-0x00007FF67E410000-0x00007FF67E802000-memory.dmp

Filesize
3.9MB

Download
memory/4600-4834-0x00007FF638EE0000-0x00007FF6392D2000-memory.dmp

Filesize
3.9MB

Download
memory/4600-188-0x00007FF638EE0000-0x00007FF6392D2000-memory.dmp

Filesize
3.9MB

Download
memory/4644-4756-0x00007FF6E7B20000-0x00007FF6E7F12000-memory.dmp

Filesize
3.9MB

Download
memory/4644-180-0x00007FF6E7B20000-0x00007FF6E7F12000-memory.dmp

Filesize
3.9MB

Download
memory/4916-184-0x00007FF799150000-0x00007FF799542000-memory.dmp

Filesize
3.9MB

Download
memory/4916-4784-0x00007FF799150000-0x00007FF799542000-memory.dmp

Filesize
3.9MB

Download
memory/5000-4829-0x00007FF6D6D30000-0x00007FF6D7122000-memory.dmp

Filesize
3.9MB

Download
memory/5000-194-0x00007FF6D6D30000-0x00007FF6D7122000-memory.dmp

Filesize
3.9MB

Download
memory/5040-4660-0x00007FF7D4240000-0x00007FF7D4632000-memory.dmp

Filesize
3.9MB

Download
memory/5040-139-0x00007FF7D4240000-0x00007FF7D4632000-memory.dmp

Filesize
3.9MB

Download