xmrig | 546bc10749dad7882ef564d900360190d1abdb37baec6d1c1827e8f9145548b5

Analysis

max time kernel
129s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 15:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
Size

1.9MB
MD5

057ea7a744ac05187370eae3be8de59e
SHA1

5770ca25e1031596b5c8844281c77dd566fa4fad
SHA256

546bc10749dad7882ef564d900360190d1abdb37baec6d1c1827e8f9145548b5
SHA512

d47157c68354d0186950416c49b478ef27eca62a0444d32a199e653294686ee32f43fd6675f307fd4c6decbd196a80f46a8a0e9f2d3b6bc2dfaa7ee7e1b1e500
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl5:NABI

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral2/memory/1888-17-0x00007FF65B710000-0x00007FF65BB02000-memory.dmp	xmrig
behavioral2/memory/1800-512-0x00007FF6E2240000-0x00007FF6E2632000-memory.dmp	xmrig
behavioral2/memory/4808-513-0x00007FF71BD70000-0x00007FF71C162000-memory.dmp	xmrig
behavioral2/memory/4188-514-0x00007FF6E77D0000-0x00007FF6E7BC2000-memory.dmp	xmrig
behavioral2/memory/3124-516-0x00007FF6C6E60000-0x00007FF6C7252000-memory.dmp	xmrig
behavioral2/memory/4812-517-0x00007FF7CF200000-0x00007FF7CF5F2000-memory.dmp	xmrig
behavioral2/memory/2380-519-0x00007FF6F8790000-0x00007FF6F8B82000-memory.dmp	xmrig
behavioral2/memory/4612-518-0x00007FF6DD130000-0x00007FF6DD522000-memory.dmp	xmrig
behavioral2/memory/1624-521-0x00007FF76E680000-0x00007FF76EA72000-memory.dmp	xmrig
behavioral2/memory/4432-522-0x00007FF7AA470000-0x00007FF7AA862000-memory.dmp	xmrig
behavioral2/memory/2440-523-0x00007FF6ABD90000-0x00007FF6AC182000-memory.dmp	xmrig
behavioral2/memory/2832-520-0x00007FF642C00000-0x00007FF642FF2000-memory.dmp	xmrig
behavioral2/memory/2296-515-0x00007FF6653C0000-0x00007FF6657B2000-memory.dmp	xmrig
behavioral2/memory/3472-62-0x00007FF6634C0000-0x00007FF6638B2000-memory.dmp	xmrig
behavioral2/memory/4936-59-0x00007FF7012E0000-0x00007FF7016D2000-memory.dmp	xmrig
behavioral2/memory/1264-55-0x00007FF726A00000-0x00007FF726DF2000-memory.dmp	xmrig
behavioral2/memory/1764-40-0x00007FF697A50000-0x00007FF697E42000-memory.dmp	xmrig
behavioral2/memory/708-23-0x00007FF734120000-0x00007FF734512000-memory.dmp	xmrig
behavioral2/memory/3868-5387-0x00007FF776600000-0x00007FF7769F2000-memory.dmp	xmrig
behavioral2/memory/4812-6478-0x00007FF7CF200000-0x00007FF7CF5F2000-memory.dmp	xmrig
behavioral2/memory/4432-6523-0x00007FF7AA470000-0x00007FF7AA862000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1888	hLptCWY.exe
708	jXIhMxc.exe
1764	UsFWDQg.exe
1264	FewgRoB.exe
3472	PTovHwE.exe
4936	mByVyWo.exe
2168	ZQHqtUL.exe
2524	rhzUGtP.exe
3868	uAgoHXv.exe
1800	ygyTZYU.exe
4808	zhAZWqi.exe
4188	HjSTkxX.exe
2296	suleDbj.exe
3124	ZeOjDMv.exe
4812	pKeRcmF.exe
4612	IPXlNsj.exe
2380	PhfQnvL.exe
2832	jwxNfgC.exe
1624	zxQyIXr.exe
4432	Lhyazhx.exe
2440	ROpgepa.exe
4176	XteiSni.exe
1760	tLyQQUi.exe
3572	UDEvaTs.exe
3992	nRKOfxR.exe
3220	WmwWTPX.exe
3232	XAuNxUH.exe
5024	TzkkDMf.exe
1244	afVMGjx.exe
1940	uvwGFjv.exe
3096	PVtoHks.exe
2712	dqclTwx.exe
4576	xjVbZVt.exe
3180	cqMYGwC.exe
4880	vCvjRlp.exe
4952	QeuzKOm.exe
4712	lHvROLN.exe
4240	eUeZygN.exe
548	sZcbcEg.exe
3076	BarLaTH.exe
3468	qZtZVDa.exe
4204	bcbSpBn.exe
4928	hRFkFvy.exe
3648	hcLMQNI.exe
4364	SeMNQMT.exe
4984	qNDuBWn.exe
1176	yyxDJZi.exe
1740	LezXcZu.exe
5056	EYzWvgP.exe
4144	EZrmeMg.exe
1724	EetdXLO.exe
4944	jAVSCeq.exe
4620	iwoGLpy.exe
4868	UWxGefG.exe
1920	nTFubyY.exe
1988	bpWsDqs.exe
4276	nLPKjxu.exe
1816	MvBtAsD.exe
3240	qcfjtYE.exe
2132	mNQPpJb.exe
1164	lFSHxNS.exe
3520	mJQtiIs.exe
4104	cIViBAn.exe
4988	DmLQIiL.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1200-0-0x00007FF758230000-0x00007FF758622000-memory.dmp	upx
behavioral2/files/0x000b000000023bb6-5.dat	upx
behavioral2/files/0x000a000000023bbb-8.dat	upx
behavioral2/files/0x000a000000023bba-9.dat	upx
behavioral2/memory/1888-17-0x00007FF65B710000-0x00007FF65BB02000-memory.dmp	upx
behavioral2/files/0x0031000000023bbd-44.dat	upx
behavioral2/files/0x000a000000023bc2-54.dat	upx
behavioral2/files/0x000a000000023bc1-56.dat	upx
behavioral2/memory/2168-61-0x00007FF7805A0000-0x00007FF780992000-memory.dmp	upx
behavioral2/files/0x000a000000023bc3-76.dat	upx
behavioral2/files/0x000a000000023bcd-125.dat	upx
behavioral2/files/0x000a000000023bcf-135.dat	upx
behavioral2/files/0x000a000000023bd1-145.dat	upx
behavioral2/files/0x000a000000023bd2-158.dat	upx
behavioral2/files/0x000a000000023bd5-173.dat	upx
behavioral2/memory/1800-512-0x00007FF6E2240000-0x00007FF6E2632000-memory.dmp	upx
behavioral2/memory/4808-513-0x00007FF71BD70000-0x00007FF71C162000-memory.dmp	upx
behavioral2/memory/4188-514-0x00007FF6E77D0000-0x00007FF6E7BC2000-memory.dmp	upx
behavioral2/memory/3124-516-0x00007FF6C6E60000-0x00007FF6C7252000-memory.dmp	upx
behavioral2/memory/4812-517-0x00007FF7CF200000-0x00007FF7CF5F2000-memory.dmp	upx
behavioral2/memory/2380-519-0x00007FF6F8790000-0x00007FF6F8B82000-memory.dmp	upx
behavioral2/memory/4612-518-0x00007FF6DD130000-0x00007FF6DD522000-memory.dmp	upx
behavioral2/memory/1624-521-0x00007FF76E680000-0x00007FF76EA72000-memory.dmp	upx
behavioral2/memory/4432-522-0x00007FF7AA470000-0x00007FF7AA862000-memory.dmp	upx
behavioral2/memory/2440-523-0x00007FF6ABD90000-0x00007FF6AC182000-memory.dmp	upx
behavioral2/memory/2832-520-0x00007FF642C00000-0x00007FF642FF2000-memory.dmp	upx
behavioral2/memory/2296-515-0x00007FF6653C0000-0x00007FF6657B2000-memory.dmp	upx
behavioral2/files/0x000a000000023bd9-185.dat	upx
behavioral2/files/0x000a000000023bd7-183.dat	upx
behavioral2/files/0x000a000000023bd8-180.dat	upx
behavioral2/files/0x000a000000023bd6-178.dat	upx
behavioral2/files/0x000a000000023bd4-168.dat	upx
behavioral2/files/0x000a000000023bd3-163.dat	upx
behavioral2/files/0x000a000000023bd0-148.dat	upx
behavioral2/files/0x000a000000023bce-138.dat	upx
behavioral2/files/0x000a000000023bcc-128.dat	upx
behavioral2/files/0x000a000000023bcb-123.dat	upx
behavioral2/files/0x000a000000023bca-118.dat	upx
behavioral2/files/0x000a000000023bc9-113.dat	upx
behavioral2/files/0x000a000000023bc8-108.dat	upx
behavioral2/files/0x000a000000023bc7-103.dat	upx
behavioral2/files/0x000a000000023bc6-98.dat	upx
behavioral2/files/0x000a000000023bc5-93.dat	upx
behavioral2/files/0x000a000000023bc4-88.dat	upx
behavioral2/files/0x000b000000023bbf-83.dat	upx
behavioral2/memory/3868-70-0x00007FF776600000-0x00007FF7769F2000-memory.dmp	upx
behavioral2/files/0x000b000000023bc0-66.dat	upx
behavioral2/memory/2524-65-0x00007FF695DF0000-0x00007FF6961E2000-memory.dmp	upx
behavioral2/memory/3472-62-0x00007FF6634C0000-0x00007FF6638B2000-memory.dmp	upx
behavioral2/memory/4936-59-0x00007FF7012E0000-0x00007FF7016D2000-memory.dmp	upx
behavioral2/memory/1264-55-0x00007FF726A00000-0x00007FF726DF2000-memory.dmp	upx
behavioral2/files/0x0031000000023bbe-50.dat	upx
behavioral2/memory/1764-40-0x00007FF697A50000-0x00007FF697E42000-memory.dmp	upx
behavioral2/files/0x0031000000023bbc-24.dat	upx
behavioral2/memory/708-23-0x00007FF734120000-0x00007FF734512000-memory.dmp	upx
behavioral2/memory/3868-5387-0x00007FF776600000-0x00007FF7769F2000-memory.dmp	upx
behavioral2/memory/4812-6478-0x00007FF7CF200000-0x00007FF7CF5F2000-memory.dmp	upx
behavioral2/memory/4432-6523-0x00007FF7AA470000-0x00007FF7AA862000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lYodsTS.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\SrnhUOL.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\VDZXucf.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\yZOLHAo.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\eKeqhQg.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\ZkFpkOT.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\aJCSLpG.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\SiwXdum.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\RsTEKsw.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\zwJPhOm.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\uSFxeoP.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\aFmJsUp.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\iblaREv.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\YoXkIUw.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\TZHaRZM.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\duzCUeY.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\YBfWpRJ.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\UZvaBni.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\MIdssoq.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\lnpMQVC.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\qFXnVPc.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\xjLtUmq.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\ICvEgiZ.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\Wzizwwk.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\KCYjLXT.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\SQnyGjf.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\vPJRdDN.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\znxCGrB.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\ckBCrma.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\PVtoHks.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\eOZYorm.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\VXdLbMu.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\FZKzOkZ.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\qNNzwOj.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\SAfikJe.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\rTmdrzn.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\JJSfCHI.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\sWEktJo.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\EVYPEph.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\ghGBPgu.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\LSDTXis.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\NyNPTqN.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\OAhxeFc.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\FooiQEY.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\AMpryOr.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\jaVsiTy.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\vrYPmsv.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\CsjrHXB.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\RSRKJXh.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\vJjwsET.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\aCyVMic.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\rCZaJAT.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\ZsLfXGc.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\XbMTuwa.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\OeaWTto.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\YogMruJ.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\oFGgiyX.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\JyzqXFK.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\qiycNSI.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\QqcbcVp.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\sNjZTwQ.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\gtugdyU.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\GUPlPrc.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
File created	C:\Windows\System\xxUTjTd.exe	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2064	powershell.exe
2064	powershell.exe
2064	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeLockMemoryPrivilege	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2064	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	85
PID 1200 wrote to memory of 2064	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	85
PID 1200 wrote to memory of 1888	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	86
PID 1200 wrote to memory of 1888	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	86
PID 1200 wrote to memory of 708	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	87
PID 1200 wrote to memory of 708	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	87
PID 1200 wrote to memory of 1764	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	88
PID 1200 wrote to memory of 1764	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	88
PID 1200 wrote to memory of 1264	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	89
PID 1200 wrote to memory of 1264	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	89
PID 1200 wrote to memory of 3472	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	90
PID 1200 wrote to memory of 3472	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	90
PID 1200 wrote to memory of 4936	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	91
PID 1200 wrote to memory of 4936	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	91
PID 1200 wrote to memory of 2168	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	92
PID 1200 wrote to memory of 2168	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	92
PID 1200 wrote to memory of 2524	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	93
PID 1200 wrote to memory of 2524	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	93
PID 1200 wrote to memory of 3868	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	94
PID 1200 wrote to memory of 3868	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	94
PID 1200 wrote to memory of 1800	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	95
PID 1200 wrote to memory of 1800	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	95
PID 1200 wrote to memory of 4808	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	96
PID 1200 wrote to memory of 4808	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	96
PID 1200 wrote to memory of 4188	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	97
PID 1200 wrote to memory of 4188	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	97
PID 1200 wrote to memory of 2296	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	98
PID 1200 wrote to memory of 2296	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	98
PID 1200 wrote to memory of 3124	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	99
PID 1200 wrote to memory of 3124	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	99
PID 1200 wrote to memory of 4812	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	100
PID 1200 wrote to memory of 4812	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	100
PID 1200 wrote to memory of 4612	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	101
PID 1200 wrote to memory of 4612	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	101
PID 1200 wrote to memory of 2380	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	102
PID 1200 wrote to memory of 2380	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	102
PID 1200 wrote to memory of 2832	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	103
PID 1200 wrote to memory of 2832	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	103
PID 1200 wrote to memory of 1624	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	104
PID 1200 wrote to memory of 1624	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	104
PID 1200 wrote to memory of 4432	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	105
PID 1200 wrote to memory of 4432	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	105
PID 1200 wrote to memory of 2440	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	106
PID 1200 wrote to memory of 2440	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	106
PID 1200 wrote to memory of 4176	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	107
PID 1200 wrote to memory of 4176	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	107
PID 1200 wrote to memory of 1760	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	108
PID 1200 wrote to memory of 1760	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	108
PID 1200 wrote to memory of 3572	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	109
PID 1200 wrote to memory of 3572	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	109
PID 1200 wrote to memory of 3992	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	110
PID 1200 wrote to memory of 3992	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	110
PID 1200 wrote to memory of 3220	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	111
PID 1200 wrote to memory of 3220	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	111
PID 1200 wrote to memory of 3232	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	112
PID 1200 wrote to memory of 3232	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	112
PID 1200 wrote to memory of 5024	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	113
PID 1200 wrote to memory of 5024	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	113
PID 1200 wrote to memory of 1244	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	114
PID 1200 wrote to memory of 1244	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	114
PID 1200 wrote to memory of 1940	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	115
PID 1200 wrote to memory of 1940	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	115
PID 1200 wrote to memory of 3096	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	116
PID 1200 wrote to memory of 3096	1200	057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\057ea7a744ac05187370eae3be8de59e_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2064
- C:\Windows\System\hLptCWY.exe
  C:\Windows\System\hLptCWY.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\jXIhMxc.exe
  C:\Windows\System\jXIhMxc.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\UsFWDQg.exe
  C:\Windows\System\UsFWDQg.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\FewgRoB.exe
  C:\Windows\System\FewgRoB.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\PTovHwE.exe
  C:\Windows\System\PTovHwE.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\mByVyWo.exe
  C:\Windows\System\mByVyWo.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\ZQHqtUL.exe
  C:\Windows\System\ZQHqtUL.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\rhzUGtP.exe
  C:\Windows\System\rhzUGtP.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\uAgoHXv.exe
  C:\Windows\System\uAgoHXv.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\ygyTZYU.exe
  C:\Windows\System\ygyTZYU.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\zhAZWqi.exe
  C:\Windows\System\zhAZWqi.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\HjSTkxX.exe
  C:\Windows\System\HjSTkxX.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\suleDbj.exe
  C:\Windows\System\suleDbj.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\ZeOjDMv.exe
  C:\Windows\System\ZeOjDMv.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\pKeRcmF.exe
  C:\Windows\System\pKeRcmF.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\IPXlNsj.exe
  C:\Windows\System\IPXlNsj.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\PhfQnvL.exe
  C:\Windows\System\PhfQnvL.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\jwxNfgC.exe
  C:\Windows\System\jwxNfgC.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\zxQyIXr.exe
  C:\Windows\System\zxQyIXr.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\Lhyazhx.exe
  C:\Windows\System\Lhyazhx.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\ROpgepa.exe
  C:\Windows\System\ROpgepa.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\XteiSni.exe
  C:\Windows\System\XteiSni.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\tLyQQUi.exe
  C:\Windows\System\tLyQQUi.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\UDEvaTs.exe
  C:\Windows\System\UDEvaTs.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\nRKOfxR.exe
  C:\Windows\System\nRKOfxR.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\WmwWTPX.exe
  C:\Windows\System\WmwWTPX.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\XAuNxUH.exe
  C:\Windows\System\XAuNxUH.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\TzkkDMf.exe
  C:\Windows\System\TzkkDMf.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\afVMGjx.exe
  C:\Windows\System\afVMGjx.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\uvwGFjv.exe
  C:\Windows\System\uvwGFjv.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\PVtoHks.exe
  C:\Windows\System\PVtoHks.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\dqclTwx.exe
  C:\Windows\System\dqclTwx.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\xjVbZVt.exe
  C:\Windows\System\xjVbZVt.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\cqMYGwC.exe
  C:\Windows\System\cqMYGwC.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\vCvjRlp.exe
  C:\Windows\System\vCvjRlp.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\QeuzKOm.exe
  C:\Windows\System\QeuzKOm.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\lHvROLN.exe
  C:\Windows\System\lHvROLN.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\eUeZygN.exe
  C:\Windows\System\eUeZygN.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\sZcbcEg.exe
  C:\Windows\System\sZcbcEg.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\BarLaTH.exe
  C:\Windows\System\BarLaTH.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\qZtZVDa.exe
  C:\Windows\System\qZtZVDa.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\bcbSpBn.exe
  C:\Windows\System\bcbSpBn.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\hRFkFvy.exe
  C:\Windows\System\hRFkFvy.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\hcLMQNI.exe
  C:\Windows\System\hcLMQNI.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\SeMNQMT.exe
  C:\Windows\System\SeMNQMT.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\qNDuBWn.exe
  C:\Windows\System\qNDuBWn.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\yyxDJZi.exe
  C:\Windows\System\yyxDJZi.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\LezXcZu.exe
  C:\Windows\System\LezXcZu.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\EYzWvgP.exe
  C:\Windows\System\EYzWvgP.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\EZrmeMg.exe
  C:\Windows\System\EZrmeMg.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\EetdXLO.exe
  C:\Windows\System\EetdXLO.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\jAVSCeq.exe
  C:\Windows\System\jAVSCeq.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\iwoGLpy.exe
  C:\Windows\System\iwoGLpy.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\UWxGefG.exe
  C:\Windows\System\UWxGefG.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\nTFubyY.exe
  C:\Windows\System\nTFubyY.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\bpWsDqs.exe
  C:\Windows\System\bpWsDqs.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\nLPKjxu.exe
  C:\Windows\System\nLPKjxu.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\MvBtAsD.exe
  C:\Windows\System\MvBtAsD.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\qcfjtYE.exe
  C:\Windows\System\qcfjtYE.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\mNQPpJb.exe
  C:\Windows\System\mNQPpJb.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\lFSHxNS.exe
  C:\Windows\System\lFSHxNS.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\mJQtiIs.exe
  C:\Windows\System\mJQtiIs.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\cIViBAn.exe
  C:\Windows\System\cIViBAn.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\DmLQIiL.exe
  C:\Windows\System\DmLQIiL.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\vZCxSNL.exe
  C:\Windows\System\vZCxSNL.exe
  2⤵
  PID:1944
- C:\Windows\System\jCijQGH.exe
  C:\Windows\System\jCijQGH.exe
  2⤵
  PID:3840
- C:\Windows\System\wtTGVqQ.exe
  C:\Windows\System\wtTGVqQ.exe
  2⤵
  PID:4368
- C:\Windows\System\sLtPllS.exe
  C:\Windows\System\sLtPllS.exe
  2⤵
  PID:3368
- C:\Windows\System\tDOtPZs.exe
  C:\Windows\System\tDOtPZs.exe
  2⤵
  PID:3684
- C:\Windows\System\AoLWseA.exe
  C:\Windows\System\AoLWseA.exe
  2⤵
  PID:2084
- C:\Windows\System\AQVUdIq.exe
  C:\Windows\System\AQVUdIq.exe
  2⤵
  PID:428
- C:\Windows\System\cNKDMxL.exe
  C:\Windows\System\cNKDMxL.exe
  2⤵
  PID:2800
- C:\Windows\System\JxvYzdz.exe
  C:\Windows\System\JxvYzdz.exe
  2⤵
  PID:2852
- C:\Windows\System\rOzUBLZ.exe
  C:\Windows\System\rOzUBLZ.exe
  2⤵
  PID:4064
- C:\Windows\System\JlIMyWC.exe
  C:\Windows\System\JlIMyWC.exe
  2⤵
  PID:2424
- C:\Windows\System\QbvgKRe.exe
  C:\Windows\System\QbvgKRe.exe
  2⤵
  PID:4636
- C:\Windows\System\kLQyMse.exe
  C:\Windows\System\kLQyMse.exe
  2⤵
  PID:4632
- C:\Windows\System\uwTWZeS.exe
  C:\Windows\System\uwTWZeS.exe
  2⤵
  PID:5144
- C:\Windows\System\qvkIzDv.exe
  C:\Windows\System\qvkIzDv.exe
  2⤵
  PID:5172
- C:\Windows\System\FvBuXfJ.exe
  C:\Windows\System\FvBuXfJ.exe
  2⤵
  PID:5200
- C:\Windows\System\gaPKTEK.exe
  C:\Windows\System\gaPKTEK.exe
  2⤵
  PID:5228
- C:\Windows\System\iSZXaCz.exe
  C:\Windows\System\iSZXaCz.exe
  2⤵
  PID:5252
- C:\Windows\System\ZKTkYXw.exe
  C:\Windows\System\ZKTkYXw.exe
  2⤵
  PID:5280
- C:\Windows\System\wbbxImf.exe
  C:\Windows\System\wbbxImf.exe
  2⤵
  PID:5308
- C:\Windows\System\TnxdJZB.exe
  C:\Windows\System\TnxdJZB.exe
  2⤵
  PID:5336
- C:\Windows\System\UMcVfth.exe
  C:\Windows\System\UMcVfth.exe
  2⤵
  PID:5364
- C:\Windows\System\YHHZdKt.exe
  C:\Windows\System\YHHZdKt.exe
  2⤵
  PID:5392
- C:\Windows\System\UYRzMfD.exe
  C:\Windows\System\UYRzMfD.exe
  2⤵
  PID:5420
- C:\Windows\System\BGwYZCU.exe
  C:\Windows\System\BGwYZCU.exe
  2⤵
  PID:5448
- C:\Windows\System\bbCtAbc.exe
  C:\Windows\System\bbCtAbc.exe
  2⤵
  PID:5476
- C:\Windows\System\tqqyyUf.exe
  C:\Windows\System\tqqyyUf.exe
  2⤵
  PID:5508
- C:\Windows\System\rjrwBjW.exe
  C:\Windows\System\rjrwBjW.exe
  2⤵
  PID:5532
- C:\Windows\System\FyOAIoX.exe
  C:\Windows\System\FyOAIoX.exe
  2⤵
  PID:5560
- C:\Windows\System\WohjYEN.exe
  C:\Windows\System\WohjYEN.exe
  2⤵
  PID:5588
- C:\Windows\System\zFuNhWg.exe
  C:\Windows\System\zFuNhWg.exe
  2⤵
  PID:5616
- C:\Windows\System\lebVIjt.exe
  C:\Windows\System\lebVIjt.exe
  2⤵
  PID:5644
- C:\Windows\System\HVYVOmo.exe
  C:\Windows\System\HVYVOmo.exe
  2⤵
  PID:5672
- C:\Windows\System\BoRgAch.exe
  C:\Windows\System\BoRgAch.exe
  2⤵
  PID:5700
- C:\Windows\System\PVhJpWV.exe
  C:\Windows\System\PVhJpWV.exe
  2⤵
  PID:5728
- C:\Windows\System\HfNzCxf.exe
  C:\Windows\System\HfNzCxf.exe
  2⤵
  PID:5756
- C:\Windows\System\PTWjhsw.exe
  C:\Windows\System\PTWjhsw.exe
  2⤵
  PID:5784
- C:\Windows\System\EnFMBWF.exe
  C:\Windows\System\EnFMBWF.exe
  2⤵
  PID:5816
- C:\Windows\System\scOhzzF.exe
  C:\Windows\System\scOhzzF.exe
  2⤵
  PID:5872
- C:\Windows\System\fDsRvpk.exe
  C:\Windows\System\fDsRvpk.exe
  2⤵
  PID:5892
- C:\Windows\System\ekswJpn.exe
  C:\Windows\System\ekswJpn.exe
  2⤵
  PID:5908
- C:\Windows\System\iqiHpJG.exe
  C:\Windows\System\iqiHpJG.exe
  2⤵
  PID:5924
- C:\Windows\System\CMzvOfI.exe
  C:\Windows\System\CMzvOfI.exe
  2⤵
  PID:5952
- C:\Windows\System\APMYolk.exe
  C:\Windows\System\APMYolk.exe
  2⤵
  PID:5980
- C:\Windows\System\fZybrTP.exe
  C:\Windows\System\fZybrTP.exe
  2⤵
  PID:6004
- C:\Windows\System\cRJQBIT.exe
  C:\Windows\System\cRJQBIT.exe
  2⤵
  PID:6032
- C:\Windows\System\vcunVPH.exe
  C:\Windows\System\vcunVPH.exe
  2⤵
  PID:6064
- C:\Windows\System\bWegGir.exe
  C:\Windows\System\bWegGir.exe
  2⤵
  PID:6092
- C:\Windows\System\xptFfnY.exe
  C:\Windows\System\xptFfnY.exe
  2⤵
  PID:6120
- C:\Windows\System\kFDSzAv.exe
  C:\Windows\System\kFDSzAv.exe
  2⤵
  PID:764
- C:\Windows\System\elUNhej.exe
  C:\Windows\System\elUNhej.exe
  2⤵
  PID:3456
- C:\Windows\System\ETliflv.exe
  C:\Windows\System\ETliflv.exe
  2⤵
  PID:4724
- C:\Windows\System\WEhPSxL.exe
  C:\Windows\System\WEhPSxL.exe
  2⤵
  PID:4180
- C:\Windows\System\gRzKRDs.exe
  C:\Windows\System\gRzKRDs.exe
  2⤵
  PID:664
- C:\Windows\System\wKjdjIJ.exe
  C:\Windows\System\wKjdjIJ.exe
  2⤵
  PID:5160
- C:\Windows\System\kYeKjNE.exe
  C:\Windows\System\kYeKjNE.exe
  2⤵
  PID:5236
- C:\Windows\System\LvJOnGT.exe
  C:\Windows\System\LvJOnGT.exe
  2⤵
  PID:5292
- C:\Windows\System\rQsohQT.exe
  C:\Windows\System\rQsohQT.exe
  2⤵
  PID:5356
- C:\Windows\System\fmsQKhC.exe
  C:\Windows\System\fmsQKhC.exe
  2⤵
  PID:5412
- C:\Windows\System\ApNCxfz.exe
  C:\Windows\System\ApNCxfz.exe
  2⤵
  PID:5488
- C:\Windows\System\FKvyDRp.exe
  C:\Windows\System\FKvyDRp.exe
  2⤵
  PID:5544
- C:\Windows\System\MBSZzJk.exe
  C:\Windows\System\MBSZzJk.exe
  2⤵
  PID:5600
- C:\Windows\System\INbnwMb.exe
  C:\Windows\System\INbnwMb.exe
  2⤵
  PID:5656
- C:\Windows\System\xqgweuR.exe
  C:\Windows\System\xqgweuR.exe
  2⤵
  PID:4436
- C:\Windows\System\JsYscQG.exe
  C:\Windows\System\JsYscQG.exe
  2⤵
  PID:5748
- C:\Windows\System\ghGBPgu.exe
  C:\Windows\System\ghGBPgu.exe
  2⤵
  PID:5824
- C:\Windows\System\NRFzLdE.exe
  C:\Windows\System\NRFzLdE.exe
  2⤵
  PID:5888
- C:\Windows\System\LCzIaaR.exe
  C:\Windows\System\LCzIaaR.exe
  2⤵
  PID:5940
- C:\Windows\System\GCbEmWm.exe
  C:\Windows\System\GCbEmWm.exe
  2⤵
  PID:6000
- C:\Windows\System\ZkFpkOT.exe
  C:\Windows\System\ZkFpkOT.exe
  2⤵
  PID:6056
- C:\Windows\System\mhAYHKw.exe
  C:\Windows\System\mhAYHKw.exe
  2⤵
  PID:2820
- C:\Windows\System\vgPbOLA.exe
  C:\Windows\System\vgPbOLA.exe
  2⤵
  PID:1640
- C:\Windows\System\PPrtaSJ.exe
  C:\Windows\System\PPrtaSJ.exe
  2⤵
  PID:1576
- C:\Windows\System\NkEqxrP.exe
  C:\Windows\System\NkEqxrP.exe
  2⤵
  PID:5136
- C:\Windows\System\QjbUaKb.exe
  C:\Windows\System\QjbUaKb.exe
  2⤵
  PID:5264
- C:\Windows\System\ZUYMNMf.exe
  C:\Windows\System\ZUYMNMf.exe
  2⤵
  PID:5384
- C:\Windows\System\ZItPlmi.exe
  C:\Windows\System\ZItPlmi.exe
  2⤵
  PID:5528
- C:\Windows\System\yGuLVED.exe
  C:\Windows\System\yGuLVED.exe
  2⤵
  PID:5628
- C:\Windows\System\raKYvqv.exe
  C:\Windows\System\raKYvqv.exe
  2⤵
  PID:5688
- C:\Windows\System\wyubRUI.exe
  C:\Windows\System\wyubRUI.exe
  2⤵
  PID:5116
- C:\Windows\System\xVLbgBv.exe
  C:\Windows\System\xVLbgBv.exe
  2⤵
  PID:1600
- C:\Windows\System\TyNtxwS.exe
  C:\Windows\System\TyNtxwS.exe
  2⤵
  PID:3932
- C:\Windows\System\rexGzxa.exe
  C:\Windows\System\rexGzxa.exe
  2⤵
  PID:5132
- C:\Windows\System\TLpufjb.exe
  C:\Windows\System\TLpufjb.exe
  2⤵
  PID:116
- C:\Windows\System\RXnSPWg.exe
  C:\Windows\System\RXnSPWg.exe
  2⤵
  PID:2844
- C:\Windows\System\svYFjbO.exe
  C:\Windows\System\svYFjbO.exe
  2⤵
  PID:5576
- C:\Windows\System\udxnjwf.exe
  C:\Windows\System\udxnjwf.exe
  2⤵
  PID:3000
- C:\Windows\System\XFdfelX.exe
  C:\Windows\System\XFdfelX.exe
  2⤵
  PID:4088
- C:\Windows\System\PVvUXiy.exe
  C:\Windows\System\PVvUXiy.exe
  2⤵
  PID:6048
- C:\Windows\System\ZUqEwUW.exe
  C:\Windows\System\ZUqEwUW.exe
  2⤵
  PID:6108
- C:\Windows\System\NQxSTSk.exe
  C:\Windows\System\NQxSTSk.exe
  2⤵
  PID:3408
- C:\Windows\System\gFgOAcW.exe
  C:\Windows\System\gFgOAcW.exe
  2⤵
  PID:5464
- C:\Windows\System\CQipQOL.exe
  C:\Windows\System\CQipQOL.exe
  2⤵
  PID:2152
- C:\Windows\System\rvOXDIu.exe
  C:\Windows\System\rvOXDIu.exe
  2⤵
  PID:1548
- C:\Windows\System\DHCjRPr.exe
  C:\Windows\System\DHCjRPr.exe
  2⤵
  PID:2936
- C:\Windows\System\mCuFBPu.exe
  C:\Windows\System\mCuFBPu.exe
  2⤵
  PID:6168
- C:\Windows\System\kQcEBGV.exe
  C:\Windows\System\kQcEBGV.exe
  2⤵
  PID:6200
- C:\Windows\System\zYloBkx.exe
  C:\Windows\System\zYloBkx.exe
  2⤵
  PID:6236
- C:\Windows\System\mPmzYQK.exe
  C:\Windows\System\mPmzYQK.exe
  2⤵
  PID:6260
- C:\Windows\System\GnmGsjK.exe
  C:\Windows\System\GnmGsjK.exe
  2⤵
  PID:6280
- C:\Windows\System\yqsWhPo.exe
  C:\Windows\System\yqsWhPo.exe
  2⤵
  PID:6296
- C:\Windows\System\RAFYuLi.exe
  C:\Windows\System\RAFYuLi.exe
  2⤵
  PID:6316
- C:\Windows\System\BLdswVs.exe
  C:\Windows\System\BLdswVs.exe
  2⤵
  PID:6364
- C:\Windows\System\TbVnKCR.exe
  C:\Windows\System\TbVnKCR.exe
  2⤵
  PID:6380
- C:\Windows\System\OBIUKej.exe
  C:\Windows\System\OBIUKej.exe
  2⤵
  PID:6416
- C:\Windows\System\LEgxddi.exe
  C:\Windows\System\LEgxddi.exe
  2⤵
  PID:6444
- C:\Windows\System\cirzZQa.exe
  C:\Windows\System\cirzZQa.exe
  2⤵
  PID:6476
- C:\Windows\System\TXtDSPH.exe
  C:\Windows\System\TXtDSPH.exe
  2⤵
  PID:6496
- C:\Windows\System\lXquCwH.exe
  C:\Windows\System\lXquCwH.exe
  2⤵
  PID:6512
- C:\Windows\System\OWYzfBS.exe
  C:\Windows\System\OWYzfBS.exe
  2⤵
  PID:6532
- C:\Windows\System\ngDEKYe.exe
  C:\Windows\System\ngDEKYe.exe
  2⤵
  PID:6564
- C:\Windows\System\QMkpUvo.exe
  C:\Windows\System\QMkpUvo.exe
  2⤵
  PID:6588
- C:\Windows\System\lwPnxNY.exe
  C:\Windows\System\lwPnxNY.exe
  2⤵
  PID:6604
- C:\Windows\System\WTuOEdF.exe
  C:\Windows\System\WTuOEdF.exe
  2⤵
  PID:6632
- C:\Windows\System\pauRvmx.exe
  C:\Windows\System\pauRvmx.exe
  2⤵
  PID:6676
- C:\Windows\System\TTxYOvb.exe
  C:\Windows\System\TTxYOvb.exe
  2⤵
  PID:6704
- C:\Windows\System\EYxRonx.exe
  C:\Windows\System\EYxRonx.exe
  2⤵
  PID:6740
- C:\Windows\System\Uhpvpmw.exe
  C:\Windows\System\Uhpvpmw.exe
  2⤵
  PID:6780
- C:\Windows\System\gGtLUhc.exe
  C:\Windows\System\gGtLUhc.exe
  2⤵
  PID:6808
- C:\Windows\System\XSqbfZV.exe
  C:\Windows\System\XSqbfZV.exe
  2⤵
  PID:6828
- C:\Windows\System\zchdpWK.exe
  C:\Windows\System\zchdpWK.exe
  2⤵
  PID:6856
- C:\Windows\System\gwRbumv.exe
  C:\Windows\System\gwRbumv.exe
  2⤵
  PID:6872
- C:\Windows\System\yPYVDcl.exe
  C:\Windows\System\yPYVDcl.exe
  2⤵
  PID:6888
- C:\Windows\System\TJlvnsx.exe
  C:\Windows\System\TJlvnsx.exe
  2⤵
  PID:6916
- C:\Windows\System\vWWBuWU.exe
  C:\Windows\System\vWWBuWU.exe
  2⤵
  PID:6968
- C:\Windows\System\SmbflAy.exe
  C:\Windows\System\SmbflAy.exe
  2⤵
  PID:6984
- C:\Windows\System\LUiblnN.exe
  C:\Windows\System\LUiblnN.exe
  2⤵
  PID:7040
- C:\Windows\System\ZCMFTvl.exe
  C:\Windows\System\ZCMFTvl.exe
  2⤵
  PID:7056
- C:\Windows\System\ucShYuP.exe
  C:\Windows\System\ucShYuP.exe
  2⤵
  PID:7084
- C:\Windows\System\EghrxPm.exe
  C:\Windows\System\EghrxPm.exe
  2⤵
  PID:7108
- C:\Windows\System\gdlDgaG.exe
  C:\Windows\System\gdlDgaG.exe
  2⤵
  PID:7124
- C:\Windows\System\WpSUYCE.exe
  C:\Windows\System\WpSUYCE.exe
  2⤵
  PID:7144
- C:\Windows\System\ctmKNhz.exe
  C:\Windows\System\ctmKNhz.exe
  2⤵
  PID:5096
- C:\Windows\System\aFfzyZc.exe
  C:\Windows\System\aFfzyZc.exe
  2⤵
  PID:3652
- C:\Windows\System\AvbjysN.exe
  C:\Windows\System\AvbjysN.exe
  2⤵
  PID:3380
- C:\Windows\System\XKfzUtC.exe
  C:\Windows\System\XKfzUtC.exe
  2⤵
  PID:5936
- C:\Windows\System\VTbpGHW.exe
  C:\Windows\System\VTbpGHW.exe
  2⤵
  PID:6272
- C:\Windows\System\IFroJwR.exe
  C:\Windows\System\IFroJwR.exe
  2⤵
  PID:6488
- C:\Windows\System\BJhHCgw.exe
  C:\Windows\System\BJhHCgw.exe
  2⤵
  PID:6504
- C:\Windows\System\FfaOFaH.exe
  C:\Windows\System\FfaOFaH.exe
  2⤵
  PID:6556
- C:\Windows\System\orBMppP.exe
  C:\Windows\System\orBMppP.exe
  2⤵
  PID:6596
- C:\Windows\System\uSFxeoP.exe
  C:\Windows\System\uSFxeoP.exe
  2⤵
  PID:6692
- C:\Windows\System\buKTdNl.exe
  C:\Windows\System\buKTdNl.exe
  2⤵
  PID:6732
- C:\Windows\System\EsZAbaD.exe
  C:\Windows\System\EsZAbaD.exe
  2⤵
  PID:6776
- C:\Windows\System\JsXtfIa.exe
  C:\Windows\System\JsXtfIa.exe
  2⤵
  PID:6800
- C:\Windows\System\WiiEQkx.exe
  C:\Windows\System\WiiEQkx.exe
  2⤵
  PID:6868
- C:\Windows\System\QxaBzQM.exe
  C:\Windows\System\QxaBzQM.exe
  2⤵
  PID:6980
- C:\Windows\System\fUMlveC.exe
  C:\Windows\System\fUMlveC.exe
  2⤵
  PID:6976
- C:\Windows\System\COpwpUQ.exe
  C:\Windows\System\COpwpUQ.exe
  2⤵
  PID:7032
- C:\Windows\System\jLUUwfS.exe
  C:\Windows\System\jLUUwfS.exe
  2⤵
  PID:7096
- C:\Windows\System\wvPAXkD.exe
  C:\Windows\System\wvPAXkD.exe
  2⤵
  PID:1120
- C:\Windows\System\OAwnPoQ.exe
  C:\Windows\System\OAwnPoQ.exe
  2⤵
  PID:6304
- C:\Windows\System\FJOCwhH.exe
  C:\Windows\System\FJOCwhH.exe
  2⤵
  PID:6372
- C:\Windows\System\NPVLZHE.exe
  C:\Windows\System\NPVLZHE.exe
  2⤵
  PID:6484
- C:\Windows\System\mIaTvZZ.exe
  C:\Windows\System\mIaTvZZ.exe
  2⤵
  PID:6684
- C:\Windows\System\MAZSZxG.exe
  C:\Windows\System\MAZSZxG.exe
  2⤵
  PID:6712
- C:\Windows\System\oWBudWG.exe
  C:\Windows\System\oWBudWG.exe
  2⤵
  PID:6960
- C:\Windows\System\CHQUNEy.exe
  C:\Windows\System\CHQUNEy.exe
  2⤵
  PID:6224
- C:\Windows\System\eOkHKvk.exe
  C:\Windows\System\eOkHKvk.exe
  2⤵
  PID:6508
- C:\Windows\System\JxvWysg.exe
  C:\Windows\System\JxvWysg.exe
  2⤵
  PID:7052
- C:\Windows\System\mpxuFWR.exe
  C:\Windows\System\mpxuFWR.exe
  2⤵
  PID:7076
- C:\Windows\System\TQTpdmB.exe
  C:\Windows\System\TQTpdmB.exe
  2⤵
  PID:6188
- C:\Windows\System\pIlOrXH.exe
  C:\Windows\System\pIlOrXH.exe
  2⤵
  PID:7188
- C:\Windows\System\EXLPXhH.exe
  C:\Windows\System\EXLPXhH.exe
  2⤵
  PID:7208
- C:\Windows\System\fTNIkys.exe
  C:\Windows\System\fTNIkys.exe
  2⤵
  PID:7252
- C:\Windows\System\xtaiUjX.exe
  C:\Windows\System\xtaiUjX.exe
  2⤵
  PID:7276
- C:\Windows\System\sgpBWHW.exe
  C:\Windows\System\sgpBWHW.exe
  2⤵
  PID:7292
- C:\Windows\System\MrElCbr.exe
  C:\Windows\System\MrElCbr.exe
  2⤵
  PID:7308
- C:\Windows\System\mrtrlOZ.exe
  C:\Windows\System\mrtrlOZ.exe
  2⤵
  PID:7328
- C:\Windows\System\tItDMrj.exe
  C:\Windows\System\tItDMrj.exe
  2⤵
  PID:7348
- C:\Windows\System\wzSeJTW.exe
  C:\Windows\System\wzSeJTW.exe
  2⤵
  PID:7376
- C:\Windows\System\dcTEBcw.exe
  C:\Windows\System\dcTEBcw.exe
  2⤵
  PID:7460
- C:\Windows\System\RgKZsKs.exe
  C:\Windows\System\RgKZsKs.exe
  2⤵
  PID:7480
- C:\Windows\System\EoLhjNX.exe
  C:\Windows\System\EoLhjNX.exe
  2⤵
  PID:7500
- C:\Windows\System\DEgsFQw.exe
  C:\Windows\System\DEgsFQw.exe
  2⤵
  PID:7544
- C:\Windows\System\MiJXuCy.exe
  C:\Windows\System\MiJXuCy.exe
  2⤵
  PID:7564
- C:\Windows\System\qUiatar.exe
  C:\Windows\System\qUiatar.exe
  2⤵
  PID:7588
- C:\Windows\System\VJbqcTp.exe
  C:\Windows\System\VJbqcTp.exe
  2⤵
  PID:7604
- C:\Windows\System\LbmicHo.exe
  C:\Windows\System\LbmicHo.exe
  2⤵
  PID:7656
- C:\Windows\System\jJWETwJ.exe
  C:\Windows\System\jJWETwJ.exe
  2⤵
  PID:7676
- C:\Windows\System\jDLKGGv.exe
  C:\Windows\System\jDLKGGv.exe
  2⤵
  PID:7700
- C:\Windows\System\bqjDfwX.exe
  C:\Windows\System\bqjDfwX.exe
  2⤵
  PID:7716
- C:\Windows\System\McYPORJ.exe
  C:\Windows\System\McYPORJ.exe
  2⤵
  PID:7736
- C:\Windows\System\wHceCXO.exe
  C:\Windows\System\wHceCXO.exe
  2⤵
  PID:7788
- C:\Windows\System\PmkjYVg.exe
  C:\Windows\System\PmkjYVg.exe
  2⤵
  PID:7816
- C:\Windows\System\zbhGOlf.exe
  C:\Windows\System\zbhGOlf.exe
  2⤵
  PID:7840
- C:\Windows\System\KTTRfnc.exe
  C:\Windows\System\KTTRfnc.exe
  2⤵
  PID:7884
- C:\Windows\System\RqfOzQe.exe
  C:\Windows\System\RqfOzQe.exe
  2⤵
  PID:7908
- C:\Windows\System\itQfIQx.exe
  C:\Windows\System\itQfIQx.exe
  2⤵
  PID:7928
- C:\Windows\System\sVKsSHT.exe
  C:\Windows\System\sVKsSHT.exe
  2⤵
  PID:7952
- C:\Windows\System\iXSsPpZ.exe
  C:\Windows\System\iXSsPpZ.exe
  2⤵
  PID:7972
- C:\Windows\System\rUDZzMc.exe
  C:\Windows\System\rUDZzMc.exe
  2⤵
  PID:8000
- C:\Windows\System\rZhcJvu.exe
  C:\Windows\System\rZhcJvu.exe
  2⤵
  PID:8020
- C:\Windows\System\QBPJIoC.exe
  C:\Windows\System\QBPJIoC.exe
  2⤵
  PID:8040
- C:\Windows\System\JbkIxPb.exe
  C:\Windows\System\JbkIxPb.exe
  2⤵
  PID:8084
- C:\Windows\System\EileAdF.exe
  C:\Windows\System\EileAdF.exe
  2⤵
  PID:8112
- C:\Windows\System\jykxwJa.exe
  C:\Windows\System\jykxwJa.exe
  2⤵
  PID:8140
- C:\Windows\System\aURiFjP.exe
  C:\Windows\System\aURiFjP.exe
  2⤵
  PID:8160
- C:\Windows\System\OvPXjZU.exe
  C:\Windows\System\OvPXjZU.exe
  2⤵
  PID:5920
- C:\Windows\System\qbZbRZQ.exe
  C:\Windows\System\qbZbRZQ.exe
  2⤵
  PID:7184
- C:\Windows\System\ersWzKW.exe
  C:\Windows\System\ersWzKW.exe
  2⤵
  PID:7288
- C:\Windows\System\ehdCsyk.exe
  C:\Windows\System\ehdCsyk.exe
  2⤵
  PID:7336
- C:\Windows\System\caBLJzl.exe
  C:\Windows\System\caBLJzl.exe
  2⤵
  PID:7420
- C:\Windows\System\BmpNrrF.exe
  C:\Windows\System\BmpNrrF.exe
  2⤵
  PID:7532
- C:\Windows\System\NeMZNuE.exe
  C:\Windows\System\NeMZNuE.exe
  2⤵
  PID:7600
- C:\Windows\System\SeMGMEu.exe
  C:\Windows\System\SeMGMEu.exe
  2⤵
  PID:7672
- C:\Windows\System\XWiIVvv.exe
  C:\Windows\System\XWiIVvv.exe
  2⤵
  PID:7732
- C:\Windows\System\KtvRxKv.exe
  C:\Windows\System\KtvRxKv.exe
  2⤵
  PID:7764
- C:\Windows\System\RcNOnHY.exe
  C:\Windows\System\RcNOnHY.exe
  2⤵
  PID:7808
- C:\Windows\System\apfmCwR.exe
  C:\Windows\System\apfmCwR.exe
  2⤵
  PID:7892
- C:\Windows\System\CcJnCQj.exe
  C:\Windows\System\CcJnCQj.exe
  2⤵
  PID:7964
- C:\Windows\System\GKQOEtg.exe
  C:\Windows\System\GKQOEtg.exe
  2⤵
  PID:8036
- C:\Windows\System\IZMlrnp.exe
  C:\Windows\System\IZMlrnp.exe
  2⤵
  PID:8008
- C:\Windows\System\vpZdCrE.exe
  C:\Windows\System\vpZdCrE.exe
  2⤵
  PID:8104
- C:\Windows\System\eHfXBYy.exe
  C:\Windows\System\eHfXBYy.exe
  2⤵
  PID:8156
- C:\Windows\System\IbxrhoK.exe
  C:\Windows\System\IbxrhoK.exe
  2⤵
  PID:7200
- C:\Windows\System\CNLaqkq.exe
  C:\Windows\System\CNLaqkq.exe
  2⤵
  PID:7372
- C:\Windows\System\TSiOlSz.exe
  C:\Windows\System\TSiOlSz.exe
  2⤵
  PID:7596
- C:\Windows\System\NQOUnGD.exe
  C:\Windows\System\NQOUnGD.exe
  2⤵
  PID:7692
- C:\Windows\System\Ekbksxg.exe
  C:\Windows\System\Ekbksxg.exe
  2⤵
  PID:7940
- C:\Windows\System\UaKeMDT.exe
  C:\Windows\System\UaKeMDT.exe
  2⤵
  PID:8032
- C:\Windows\System\yETXgKl.exe
  C:\Windows\System\yETXgKl.exe
  2⤵
  PID:7992
- C:\Windows\System\ZXumxnM.exe
  C:\Windows\System\ZXumxnM.exe
  2⤵
  PID:8152
- C:\Windows\System\aTnGaTm.exe
  C:\Windows\System\aTnGaTm.exe
  2⤵
  PID:7708
- C:\Windows\System\fXnnXAg.exe
  C:\Windows\System\fXnnXAg.exe
  2⤵
  PID:7556
- C:\Windows\System\cnYZpJG.exe
  C:\Windows\System\cnYZpJG.exe
  2⤵
  PID:7784
- C:\Windows\System\DUrAyXm.exe
  C:\Windows\System\DUrAyXm.exe
  2⤵
  PID:8216
- C:\Windows\System\OsEGcRw.exe
  C:\Windows\System\OsEGcRw.exe
  2⤵
  PID:8276
- C:\Windows\System\RFMbirZ.exe
  C:\Windows\System\RFMbirZ.exe
  2⤵
  PID:8296
- C:\Windows\System\FgnvgDS.exe
  C:\Windows\System\FgnvgDS.exe
  2⤵
  PID:8372
- C:\Windows\System\guNpeUr.exe
  C:\Windows\System\guNpeUr.exe
  2⤵
  PID:8392
- C:\Windows\System\fxSPJpJ.exe
  C:\Windows\System\fxSPJpJ.exe
  2⤵
  PID:8416
- C:\Windows\System\tmSDZJC.exe
  C:\Windows\System\tmSDZJC.exe
  2⤵
  PID:8452
- C:\Windows\System\ZfAeTqY.exe
  C:\Windows\System\ZfAeTqY.exe
  2⤵
  PID:8476
- C:\Windows\System\JQoeQWq.exe
  C:\Windows\System\JQoeQWq.exe
  2⤵
  PID:8492
- C:\Windows\System\PyuHSJH.exe
  C:\Windows\System\PyuHSJH.exe
  2⤵
  PID:8540
- C:\Windows\System\aEAkKVK.exe
  C:\Windows\System\aEAkKVK.exe
  2⤵
  PID:8572
- C:\Windows\System\mofZtUD.exe
  C:\Windows\System\mofZtUD.exe
  2⤵
  PID:8592
- C:\Windows\System\TZGuxgJ.exe
  C:\Windows\System\TZGuxgJ.exe
  2⤵
  PID:8632
- C:\Windows\System\tSwYDmI.exe
  C:\Windows\System\tSwYDmI.exe
  2⤵
  PID:8656
- C:\Windows\System\pliwaLV.exe
  C:\Windows\System\pliwaLV.exe
  2⤵
  PID:8676
- C:\Windows\System\uFCbYaZ.exe
  C:\Windows\System\uFCbYaZ.exe
  2⤵
  PID:8716
- C:\Windows\System\xbIiIBj.exe
  C:\Windows\System\xbIiIBj.exe
  2⤵
  PID:8744
- C:\Windows\System\iAEDmtm.exe
  C:\Windows\System\iAEDmtm.exe
  2⤵
  PID:8760
- C:\Windows\System\EMUQEtO.exe
  C:\Windows\System\EMUQEtO.exe
  2⤵
  PID:8780
- C:\Windows\System\mwSRCVF.exe
  C:\Windows\System\mwSRCVF.exe
  2⤵
  PID:8804
- C:\Windows\System\zenhrlR.exe
  C:\Windows\System\zenhrlR.exe
  2⤵
  PID:8820
- C:\Windows\System\WYMsdhD.exe
  C:\Windows\System\WYMsdhD.exe
  2⤵
  PID:8860
- C:\Windows\System\GWxqRfk.exe
  C:\Windows\System\GWxqRfk.exe
  2⤵
  PID:8892
- C:\Windows\System\gFYJett.exe
  C:\Windows\System\gFYJett.exe
  2⤵
  PID:8912
- C:\Windows\System\sqQibQc.exe
  C:\Windows\System\sqQibQc.exe
  2⤵
  PID:8936
- C:\Windows\System\qNlswDh.exe
  C:\Windows\System\qNlswDh.exe
  2⤵
  PID:8956
- C:\Windows\System\jTAmuLF.exe
  C:\Windows\System\jTAmuLF.exe
  2⤵
  PID:8976
- C:\Windows\System\xstuzFj.exe
  C:\Windows\System\xstuzFj.exe
  2⤵
  PID:9012
- C:\Windows\System\lkKMPSl.exe
  C:\Windows\System\lkKMPSl.exe
  2⤵
  PID:9048
- C:\Windows\System\GpgprTB.exe
  C:\Windows\System\GpgprTB.exe
  2⤵
  PID:9092
- C:\Windows\System\cvdSQbs.exe
  C:\Windows\System\cvdSQbs.exe
  2⤵
  PID:9128
- C:\Windows\System\fJzASZw.exe
  C:\Windows\System\fJzASZw.exe
  2⤵
  PID:9148
- C:\Windows\System\bZtECSa.exe
  C:\Windows\System\bZtECSa.exe
  2⤵
  PID:9164
- C:\Windows\System\KwhWaTM.exe
  C:\Windows\System\KwhWaTM.exe
  2⤵
  PID:9208
- C:\Windows\System\JfljHOZ.exe
  C:\Windows\System\JfljHOZ.exe
  2⤵
  PID:6796
- C:\Windows\System\anBEegK.exe
  C:\Windows\System\anBEegK.exe
  2⤵
  PID:8068
- C:\Windows\System\zTgqaiu.exe
  C:\Windows\System\zTgqaiu.exe
  2⤵
  PID:8328
- C:\Windows\System\FnSDKyr.exe
  C:\Windows\System\FnSDKyr.exe
  2⤵
  PID:8360
- C:\Windows\System\vdmGTNI.exe
  C:\Windows\System\vdmGTNI.exe
  2⤵
  PID:8444
- C:\Windows\System\MgllnZn.exe
  C:\Windows\System\MgllnZn.exe
  2⤵
  PID:8464
- C:\Windows\System\AKwvQTg.exe
  C:\Windows\System\AKwvQTg.exe
  2⤵
  PID:8460
- C:\Windows\System\ZzUHHvu.exe
  C:\Windows\System\ZzUHHvu.exe
  2⤵
  PID:8564
- C:\Windows\System\LEdmRXa.exe
  C:\Windows\System\LEdmRXa.exe
  2⤵
  PID:8732
- C:\Windows\System\ZYYWBrf.exe
  C:\Windows\System\ZYYWBrf.exe
  2⤵
  PID:8772
- C:\Windows\System\HICjanX.exe
  C:\Windows\System\HICjanX.exe
  2⤵
  PID:8840
- C:\Windows\System\CFEvauM.exe
  C:\Windows\System\CFEvauM.exe
  2⤵
  PID:8868
- C:\Windows\System\FeXQyVd.exe
  C:\Windows\System\FeXQyVd.exe
  2⤵
  PID:8952
- C:\Windows\System\wACRUGB.exe
  C:\Windows\System\wACRUGB.exe
  2⤵
  PID:9044
- C:\Windows\System\VxPeUFj.exe
  C:\Windows\System\VxPeUFj.exe
  2⤵
  PID:9040
- C:\Windows\System\VBEajjI.exe
  C:\Windows\System\VBEajjI.exe
  2⤵
  PID:9172
- C:\Windows\System\cqeTssy.exe
  C:\Windows\System\cqeTssy.exe
  2⤵
  PID:9188
- C:\Windows\System\mrTAPup.exe
  C:\Windows\System\mrTAPup.exe
  2⤵
  PID:8188
- C:\Windows\System\XQOksHE.exe
  C:\Windows\System\XQOksHE.exe
  2⤵
  PID:8320
- C:\Windows\System\vlVTdpg.exe
  C:\Windows\System\vlVTdpg.exe
  2⤵
  PID:8344
- C:\Windows\System\HbXpNRk.exe
  C:\Windows\System\HbXpNRk.exe
  2⤵
  PID:8484
- C:\Windows\System\ygOCgvH.exe
  C:\Windows\System\ygOCgvH.exe
  2⤵
  PID:8620
- C:\Windows\System\qCsNbnR.exe
  C:\Windows\System\qCsNbnR.exe
  2⤵
  PID:8836
- C:\Windows\System\gRhZQoB.exe
  C:\Windows\System\gRhZQoB.exe
  2⤵
  PID:8968
- C:\Windows\System\GumvExY.exe
  C:\Windows\System\GumvExY.exe
  2⤵
  PID:9056
- C:\Windows\System\VKOdIYO.exe
  C:\Windows\System\VKOdIYO.exe
  2⤵
  PID:9204
- C:\Windows\System\rAYOGmT.exe
  C:\Windows\System\rAYOGmT.exe
  2⤵
  PID:8852
- C:\Windows\System\QoJjOuZ.exe
  C:\Windows\System\QoJjOuZ.exe
  2⤵
  PID:8800
- C:\Windows\System\faRxLGe.exe
  C:\Windows\System\faRxLGe.exe
  2⤵
  PID:8948
- C:\Windows\System\gpsCZxP.exe
  C:\Windows\System\gpsCZxP.exe
  2⤵
  PID:9248
- C:\Windows\System\qvAztYw.exe
  C:\Windows\System\qvAztYw.exe
  2⤵
  PID:9272
- C:\Windows\System\YGuSnhe.exe
  C:\Windows\System\YGuSnhe.exe
  2⤵
  PID:9288
- C:\Windows\System\ZdayRAa.exe
  C:\Windows\System\ZdayRAa.exe
  2⤵
  PID:9312
- C:\Windows\System\xwgVOaT.exe
  C:\Windows\System\xwgVOaT.exe
  2⤵
  PID:9340
- C:\Windows\System\bSKuszy.exe
  C:\Windows\System\bSKuszy.exe
  2⤵
  PID:9360
- C:\Windows\System\QbuVAkx.exe
  C:\Windows\System\QbuVAkx.exe
  2⤵
  PID:9404
- C:\Windows\System\AaYmTHR.exe
  C:\Windows\System\AaYmTHR.exe
  2⤵
  PID:9428
- C:\Windows\System\feCcGuK.exe
  C:\Windows\System\feCcGuK.exe
  2⤵
  PID:9452
- C:\Windows\System\ovIOqfW.exe
  C:\Windows\System\ovIOqfW.exe
  2⤵
  PID:9476
- C:\Windows\System\QxesFda.exe
  C:\Windows\System\QxesFda.exe
  2⤵
  PID:9492
- C:\Windows\System\aAULHdk.exe
  C:\Windows\System\aAULHdk.exe
  2⤵
  PID:9560
- C:\Windows\System\zMfrEPK.exe
  C:\Windows\System\zMfrEPK.exe
  2⤵
  PID:9584
- C:\Windows\System\uIlvXOg.exe
  C:\Windows\System\uIlvXOg.exe
  2⤵
  PID:9780
- C:\Windows\System\XimSwuT.exe
  C:\Windows\System\XimSwuT.exe
  2⤵
  PID:9824
- C:\Windows\System\BHysNWt.exe
  C:\Windows\System\BHysNWt.exe
  2⤵
  PID:9844
- C:\Windows\System\dxFPcLt.exe
  C:\Windows\System\dxFPcLt.exe
  2⤵
  PID:9880
- C:\Windows\System\KGNHhRL.exe
  C:\Windows\System\KGNHhRL.exe
  2⤵
  PID:9908
- C:\Windows\System\IrOjWAB.exe
  C:\Windows\System\IrOjWAB.exe
  2⤵
  PID:9924
- C:\Windows\System\HtQKRqC.exe
  C:\Windows\System\HtQKRqC.exe
  2⤵
  PID:9952
- C:\Windows\System\lDiyXGx.exe
  C:\Windows\System\lDiyXGx.exe
  2⤵
  PID:9976
- C:\Windows\System\GVbZJPI.exe
  C:\Windows\System\GVbZJPI.exe
  2⤵
  PID:10004
- C:\Windows\System\CrPeINW.exe
  C:\Windows\System\CrPeINW.exe
  2⤵
  PID:10024
- C:\Windows\System\YaKnXcY.exe
  C:\Windows\System\YaKnXcY.exe
  2⤵
  PID:10048
- C:\Windows\System\WLhIBen.exe
  C:\Windows\System\WLhIBen.exe
  2⤵
  PID:10116
- C:\Windows\System\DkwTreN.exe
  C:\Windows\System\DkwTreN.exe
  2⤵
  PID:10168
- C:\Windows\System\IUcTXCD.exe
  C:\Windows\System\IUcTXCD.exe
  2⤵
  PID:8128
- C:\Windows\System\OcjVfPz.exe
  C:\Windows\System\OcjVfPz.exe
  2⤵
  PID:7240
- C:\Windows\System\ypkPHGN.exe
  C:\Windows\System\ypkPHGN.exe
  2⤵
  PID:9308
- C:\Windows\System\riXZQWf.exe
  C:\Windows\System\riXZQWf.exe
  2⤵
  PID:9268
- C:\Windows\System\PqrWfzO.exe
  C:\Windows\System\PqrWfzO.exe
  2⤵
  PID:9332
- C:\Windows\System\wWiNsKF.exe
  C:\Windows\System\wWiNsKF.exe
  2⤵
  PID:9240
- C:\Windows\System\DpirvQN.exe
  C:\Windows\System\DpirvQN.exe
  2⤵
  PID:9320
- C:\Windows\System\jKdVSOt.exe
  C:\Windows\System\jKdVSOt.exe
  2⤵
  PID:9376
- C:\Windows\System\HXFUGEa.exe
  C:\Windows\System\HXFUGEa.exe
  2⤵
  PID:9512
- C:\Windows\System\YCQyldN.exe
  C:\Windows\System\YCQyldN.exe
  2⤵
  PID:9460
- C:\Windows\System\qTxzsca.exe
  C:\Windows\System\qTxzsca.exe
  2⤵
  PID:9596
- C:\Windows\System\QBZTvBT.exe
  C:\Windows\System\QBZTvBT.exe
  2⤵
  PID:9488
- C:\Windows\System\XWKciAq.exe
  C:\Windows\System\XWKciAq.exe
  2⤵
  PID:9672
- C:\Windows\System\LTowsXx.exe
  C:\Windows\System\LTowsXx.exe
  2⤵
  PID:9692
- C:\Windows\System\VyYPdWY.exe
  C:\Windows\System\VyYPdWY.exe
  2⤵
  PID:9712
- C:\Windows\System\SJVjCde.exe
  C:\Windows\System\SJVjCde.exe
  2⤵
  PID:9732
- C:\Windows\System\EZsHAyC.exe
  C:\Windows\System\EZsHAyC.exe
  2⤵
  PID:9580
- C:\Windows\System\zgxbUKw.exe
  C:\Windows\System\zgxbUKw.exe
  2⤵
  PID:9852
- C:\Windows\System\kLlvasH.exe
  C:\Windows\System\kLlvasH.exe
  2⤵
  PID:9932
- C:\Windows\System\qwDAJzd.exe
  C:\Windows\System\qwDAJzd.exe
  2⤵
  PID:9944
- C:\Windows\System\zNHVLbZ.exe
  C:\Windows\System\zNHVLbZ.exe
  2⤵
  PID:9996
- C:\Windows\System\EgJlWOI.exe
  C:\Windows\System\EgJlWOI.exe
  2⤵
  PID:10184
- C:\Windows\System\LdrPZhe.exe
  C:\Windows\System\LdrPZhe.exe
  2⤵
  PID:10124
- C:\Windows\System\PKkhSLX.exe
  C:\Windows\System\PKkhSLX.exe
  2⤵
  PID:9352
- C:\Windows\System\vWMDQEL.exe
  C:\Windows\System\vWMDQEL.exe
  2⤵
  PID:9296
- C:\Windows\System\RbrBxBQ.exe
  C:\Windows\System\RbrBxBQ.exe
  2⤵
  PID:9396
- C:\Windows\System\InthsMk.exe
  C:\Windows\System\InthsMk.exe
  2⤵
  PID:9220
- C:\Windows\System\cqvgxNE.exe
  C:\Windows\System\cqvgxNE.exe
  2⤵
  PID:10044
- C:\Windows\System\UefYqcm.exe
  C:\Windows\System\UefYqcm.exe
  2⤵
  PID:9992
- C:\Windows\System\niFprqY.exe
  C:\Windows\System\niFprqY.exe
  2⤵
  PID:10020
- C:\Windows\System\nFFdIQb.exe
  C:\Windows\System\nFFdIQb.exe
  2⤵
  PID:10164
- C:\Windows\System\AcuGmiM.exe
  C:\Windows\System\AcuGmiM.exe
  2⤵
  PID:9636
- C:\Windows\System\zDkvuSc.exe
  C:\Windows\System\zDkvuSc.exe
  2⤵
  PID:8388
- C:\Windows\System\ZYFtDvK.exe
  C:\Windows\System\ZYFtDvK.exe
  2⤵
  PID:9648
- C:\Windows\System\ElydDsN.exe
  C:\Windows\System\ElydDsN.exe
  2⤵
  PID:9728
- C:\Windows\System\ViURUTM.exe
  C:\Windows\System\ViURUTM.exe
  2⤵
  PID:9760
- C:\Windows\System\UUqbCPQ.exe
  C:\Windows\System\UUqbCPQ.exe
  2⤵
  PID:10248
- C:\Windows\System\PVTxwHa.exe
  C:\Windows\System\PVTxwHa.exe
  2⤵
  PID:10264
- C:\Windows\System\wyKSpiJ.exe
  C:\Windows\System\wyKSpiJ.exe
  2⤵
  PID:10284
- C:\Windows\System\HSXWXnQ.exe
  C:\Windows\System\HSXWXnQ.exe
  2⤵
  PID:10312
- C:\Windows\System\ROpKDvc.exe
  C:\Windows\System\ROpKDvc.exe
  2⤵
  PID:10356
- C:\Windows\System\rQOgnfQ.exe
  C:\Windows\System\rQOgnfQ.exe
  2⤵
  PID:10404
- C:\Windows\System\RpOSVXf.exe
  C:\Windows\System\RpOSVXf.exe
  2⤵
  PID:10428
- C:\Windows\System\qeoCHqs.exe
  C:\Windows\System\qeoCHqs.exe
  2⤵
  PID:10448
- C:\Windows\System\SUpjKhA.exe
  C:\Windows\System\SUpjKhA.exe
  2⤵
  PID:10464
- C:\Windows\System\GwKTnJz.exe
  C:\Windows\System\GwKTnJz.exe
  2⤵
  PID:10508
- C:\Windows\System\uMOqkjs.exe
  C:\Windows\System\uMOqkjs.exe
  2⤵
  PID:10548
- C:\Windows\System\FKnesJM.exe
  C:\Windows\System\FKnesJM.exe
  2⤵
  PID:10572
- C:\Windows\System\FWSTVTj.exe
  C:\Windows\System\FWSTVTj.exe
  2⤵
  PID:10592
- C:\Windows\System\GqnWcmv.exe
  C:\Windows\System\GqnWcmv.exe
  2⤵
  PID:10608
- C:\Windows\System\PRFUgUD.exe
  C:\Windows\System\PRFUgUD.exe
  2⤵
  PID:10632
- C:\Windows\System\BwQZHzO.exe
  C:\Windows\System\BwQZHzO.exe
  2⤵
  PID:10660
- C:\Windows\System\bNPTdor.exe
  C:\Windows\System\bNPTdor.exe
  2⤵
  PID:10684
- C:\Windows\System\ICviSdk.exe
  C:\Windows\System\ICviSdk.exe
  2⤵
  PID:10700
- C:\Windows\System\BMmQUYD.exe
  C:\Windows\System\BMmQUYD.exe
  2⤵
  PID:10724
- C:\Windows\System\YkpIVKo.exe
  C:\Windows\System\YkpIVKo.exe
  2⤵
  PID:10748
- C:\Windows\System\qwVCDyr.exe
  C:\Windows\System\qwVCDyr.exe
  2⤵
  PID:10776
- C:\Windows\System\PlqwupG.exe
  C:\Windows\System\PlqwupG.exe
  2⤵
  PID:10840
- C:\Windows\System\joGcGdM.exe
  C:\Windows\System\joGcGdM.exe
  2⤵
  PID:10860
- C:\Windows\System\tygYYhm.exe
  C:\Windows\System\tygYYhm.exe
  2⤵
  PID:10880
- C:\Windows\System\kWpIiih.exe
  C:\Windows\System\kWpIiih.exe
  2⤵
  PID:10916
- C:\Windows\System\fQoXrgl.exe
  C:\Windows\System\fQoXrgl.exe
  2⤵
  PID:10932
- C:\Windows\System\NfloExB.exe
  C:\Windows\System\NfloExB.exe
  2⤵
  PID:10960
- C:\Windows\System\UiygeRa.exe
  C:\Windows\System\UiygeRa.exe
  2⤵
  PID:10992
- C:\Windows\System\BhzdYHM.exe
  C:\Windows\System\BhzdYHM.exe
  2⤵
  PID:11016
- C:\Windows\System\KwdpoxR.exe
  C:\Windows\System\KwdpoxR.exe
  2⤵
  PID:11088
- C:\Windows\System\jboagCW.exe
  C:\Windows\System\jboagCW.exe
  2⤵
  PID:11108
- C:\Windows\System\FJdtzpP.exe
  C:\Windows\System\FJdtzpP.exe
  2⤵
  PID:11136
- C:\Windows\System\WKlvrxc.exe
  C:\Windows\System\WKlvrxc.exe
  2⤵
  PID:11152
- C:\Windows\System\grfWuFY.exe
  C:\Windows\System\grfWuFY.exe
  2⤵
  PID:11176
- C:\Windows\System\YDwhJzk.exe
  C:\Windows\System\YDwhJzk.exe
  2⤵
  PID:11208
- C:\Windows\System\EafWyTh.exe
  C:\Windows\System\EafWyTh.exe
  2⤵
  PID:11236
- C:\Windows\System\NTGAzYr.exe
  C:\Windows\System\NTGAzYr.exe
  2⤵
  PID:10104
- C:\Windows\System\gFOBGcp.exe
  C:\Windows\System\gFOBGcp.exe
  2⤵
  PID:9660
- C:\Windows\System\FFhForq.exe
  C:\Windows\System\FFhForq.exe
  2⤵
  PID:10340
- C:\Windows\System\EkLBRnu.exe
  C:\Windows\System\EkLBRnu.exe
  2⤵
  PID:10392
- C:\Windows\System\CVskOvn.exe
  C:\Windows\System\CVskOvn.exe
  2⤵
  PID:10556
- C:\Windows\System\MbjseQU.exe
  C:\Windows\System\MbjseQU.exe
  2⤵
  PID:10540
- C:\Windows\System\rfqafMc.exe
  C:\Windows\System\rfqafMc.exe
  2⤵
  PID:10580
- C:\Windows\System\VndfgrK.exe
  C:\Windows\System\VndfgrK.exe
  2⤵
  PID:9136
- C:\Windows\System\rUsmvVc.exe
  C:\Windows\System\rUsmvVc.exe
  2⤵
  PID:10744
- C:\Windows\System\ggrMXWQ.exe
  C:\Windows\System\ggrMXWQ.exe
  2⤵
  PID:10720
- C:\Windows\System\iLiKKxG.exe
  C:\Windows\System\iLiKKxG.exe
  2⤵
  PID:10888
- C:\Windows\System\cIZotKX.exe
  C:\Windows\System\cIZotKX.exe
  2⤵
  PID:10848
- C:\Windows\System\uThuvOr.exe
  C:\Windows\System\uThuvOr.exe
  2⤵
  PID:10876
- C:\Windows\System\nYwwneq.exe
  C:\Windows\System\nYwwneq.exe
  2⤵
  PID:11032
- C:\Windows\System\MdceXVD.exe
  C:\Windows\System\MdceXVD.exe
  2⤵
  PID:11084
- C:\Windows\System\WiTMkWU.exe
  C:\Windows\System\WiTMkWU.exe
  2⤵
  PID:11184
- C:\Windows\System\JnKfXwQ.exe
  C:\Windows\System\JnKfXwQ.exe
  2⤵
  PID:11252
- C:\Windows\System\ACLzSIT.exe
  C:\Windows\System\ACLzSIT.exe
  2⤵
  PID:10348
- C:\Windows\System\PMXxsZr.exe
  C:\Windows\System\PMXxsZr.exe
  2⤵
  PID:10440
- C:\Windows\System\ApYdfjf.exe
  C:\Windows\System\ApYdfjf.exe
  2⤵
  PID:10528
- C:\Windows\System\veEYGvl.exe
  C:\Windows\System\veEYGvl.exe
  2⤵
  PID:10672
- C:\Windows\System\zDbEWSf.exe
  C:\Windows\System\zDbEWSf.exe
  2⤵
  PID:10696
- C:\Windows\System\dJaNzDI.exe
  C:\Windows\System\dJaNzDI.exe
  2⤵
  PID:5076
- C:\Windows\System\cdFPRFE.exe
  C:\Windows\System\cdFPRFE.exe
  2⤵
  PID:11100
- C:\Windows\System\OCUIdXm.exe
  C:\Windows\System\OCUIdXm.exe
  2⤵
  PID:11228
- C:\Windows\System\aWWOqYs.exe
  C:\Windows\System\aWWOqYs.exe
  2⤵
  PID:9972
- C:\Windows\System\KBjrPUj.exe
  C:\Windows\System\KBjrPUj.exe
  2⤵
  PID:10564
- C:\Windows\System\jWPqQUQ.exe
  C:\Windows\System\jWPqQUQ.exe
  2⤵
  PID:10824
- C:\Windows\System\FDiAlBN.exe
  C:\Windows\System\FDiAlBN.exe
  2⤵
  PID:11224
- C:\Windows\System\DzLYjzs.exe
  C:\Windows\System\DzLYjzs.exe
  2⤵
  PID:10520
- C:\Windows\System\rKLbIsc.exe
  C:\Windows\System\rKLbIsc.exe
  2⤵
  PID:10628
- C:\Windows\System\ZLpdUCA.exe
  C:\Windows\System\ZLpdUCA.exe
  2⤵
  PID:11300
- C:\Windows\System\ezxLRlo.exe
  C:\Windows\System\ezxLRlo.exe
  2⤵
  PID:11332
- C:\Windows\System\nyKzQPL.exe
  C:\Windows\System\nyKzQPL.exe
  2⤵
  PID:11352
- C:\Windows\System\MrRNycm.exe
  C:\Windows\System\MrRNycm.exe
  2⤵
  PID:11392
- C:\Windows\System\UTuQoYw.exe
  C:\Windows\System\UTuQoYw.exe
  2⤵
  PID:11408
- C:\Windows\System\SsTugPd.exe
  C:\Windows\System\SsTugPd.exe
  2⤵
  PID:11428
- C:\Windows\System\QOSWcpg.exe
  C:\Windows\System\QOSWcpg.exe
  2⤵
  PID:11460
- C:\Windows\System\XxdNyJz.exe
  C:\Windows\System\XxdNyJz.exe
  2⤵
  PID:11492
- C:\Windows\System\XTgeuHp.exe
  C:\Windows\System\XTgeuHp.exe
  2⤵
  PID:11508
- C:\Windows\System\SXHgzlz.exe
  C:\Windows\System\SXHgzlz.exe
  2⤵
  PID:11536
- C:\Windows\System\VkBddZO.exe
  C:\Windows\System\VkBddZO.exe
  2⤵
  PID:11564
- C:\Windows\System\YkCaPRj.exe
  C:\Windows\System\YkCaPRj.exe
  2⤵
  PID:11584
- C:\Windows\System\skwFMYP.exe
  C:\Windows\System\skwFMYP.exe
  2⤵
  PID:11612
- C:\Windows\System\FHytBHf.exe
  C:\Windows\System\FHytBHf.exe
  2⤵
  PID:11640
- C:\Windows\System\HaduoTx.exe
  C:\Windows\System\HaduoTx.exe
  2⤵
  PID:11660
- C:\Windows\System\PKNlLHV.exe
  C:\Windows\System\PKNlLHV.exe
  2⤵
  PID:11684
- C:\Windows\System\MasNAPd.exe
  C:\Windows\System\MasNAPd.exe
  2⤵
  PID:11712
- C:\Windows\System\wqhPTMw.exe
  C:\Windows\System\wqhPTMw.exe
  2⤵
  PID:11744
- C:\Windows\System\ZRrCSMi.exe
  C:\Windows\System\ZRrCSMi.exe
  2⤵
  PID:11760
- C:\Windows\System\BRXMKgd.exe
  C:\Windows\System\BRXMKgd.exe
  2⤵
  PID:11784
- C:\Windows\System\HIqkmuC.exe
  C:\Windows\System\HIqkmuC.exe
  2⤵
  PID:11804
- C:\Windows\System\LnljAAM.exe
  C:\Windows\System\LnljAAM.exe
  2⤵
  PID:11828
- C:\Windows\System\pXOIRnG.exe
  C:\Windows\System\pXOIRnG.exe
  2⤵
  PID:11856
- C:\Windows\System\fPETHUg.exe
  C:\Windows\System\fPETHUg.exe
  2⤵
  PID:11904
- C:\Windows\System\bSnJxlA.exe
  C:\Windows\System\bSnJxlA.exe
  2⤵
  PID:11928
- C:\Windows\System\JfztWAP.exe
  C:\Windows\System\JfztWAP.exe
  2⤵
  PID:11944
- C:\Windows\System\jzWcBzH.exe
  C:\Windows\System\jzWcBzH.exe
  2⤵
  PID:11968
- C:\Windows\System\bpFbPSW.exe
  C:\Windows\System\bpFbPSW.exe
  2⤵
  PID:12040
- C:\Windows\System\qdnrgMv.exe
  C:\Windows\System\qdnrgMv.exe
  2⤵
  PID:12064
- C:\Windows\System\uRyHGnO.exe
  C:\Windows\System\uRyHGnO.exe
  2⤵
  PID:12080
- C:\Windows\System\IcsGCCa.exe
  C:\Windows\System\IcsGCCa.exe
  2⤵
  PID:12116
- C:\Windows\System\AZUgaQz.exe
  C:\Windows\System\AZUgaQz.exe
  2⤵
  PID:12140
- C:\Windows\System\gxtnJlZ.exe
  C:\Windows\System\gxtnJlZ.exe
  2⤵
  PID:12200
- C:\Windows\System\xNYOJjG.exe
  C:\Windows\System\xNYOJjG.exe
  2⤵
  PID:12224
- C:\Windows\System\mvuwcNS.exe
  C:\Windows\System\mvuwcNS.exe
  2⤵
  PID:12264
- C:\Windows\System\MkOxiiE.exe
  C:\Windows\System\MkOxiiE.exe
  2⤵
  PID:12284
- C:\Windows\System\ZcRScpn.exe
  C:\Windows\System\ZcRScpn.exe
  2⤵
  PID:672
- C:\Windows\System\ueltSLf.exe
  C:\Windows\System\ueltSLf.exe
  2⤵
  PID:11324
- C:\Windows\System\bsyaGse.exe
  C:\Windows\System\bsyaGse.exe
  2⤵
  PID:11372
- C:\Windows\System\nUuYceG.exe
  C:\Windows\System\nUuYceG.exe
  2⤵
  PID:11456
- C:\Windows\System\GwYgSWy.exe
  C:\Windows\System\GwYgSWy.exe
  2⤵
  PID:11504
- C:\Windows\System\FktGYet.exe
  C:\Windows\System\FktGYet.exe
  2⤵
  PID:11556
- C:\Windows\System\TEYFiLv.exe
  C:\Windows\System\TEYFiLv.exe
  2⤵
  PID:11592
- C:\Windows\System\oAEAblv.exe
  C:\Windows\System\oAEAblv.exe
  2⤵
  PID:11608
- C:\Windows\System\XFLhDhr.exe
  C:\Windows\System\XFLhDhr.exe
  2⤵
  PID:11676
- C:\Windows\System\vJiovli.exe
  C:\Windows\System\vJiovli.exe
  2⤵
  PID:11852
- C:\Windows\System\qZgJGij.exe
  C:\Windows\System\qZgJGij.exe
  2⤵
  PID:11888
- C:\Windows\System\TNqtLmm.exe
  C:\Windows\System\TNqtLmm.exe
  2⤵
  PID:11940
- C:\Windows\System\qFJHVKe.exe
  C:\Windows\System\qFJHVKe.exe
  2⤵
  PID:12048
- C:\Windows\System\rdUZXPY.exe
  C:\Windows\System\rdUZXPY.exe
  2⤵
  PID:12108
- C:\Windows\System\gRJVmYS.exe
  C:\Windows\System\gRJVmYS.exe
  2⤵
  PID:12160
- C:\Windows\System\YejeZlD.exe
  C:\Windows\System\YejeZlD.exe
  2⤵
  PID:12176
- C:\Windows\System\ceRAjbk.exe
  C:\Windows\System\ceRAjbk.exe
  2⤵
  PID:9764
- C:\Windows\System\blwZFQZ.exe
  C:\Windows\System\blwZFQZ.exe
  2⤵
  PID:10308
- C:\Windows\System\rMVMKJd.exe
  C:\Windows\System\rMVMKJd.exe
  2⤵
  PID:11344
- C:\Windows\System\houwlXm.exe
  C:\Windows\System\houwlXm.exe
  2⤵
  PID:11624
- C:\Windows\System\utskMyo.exe
  C:\Windows\System\utskMyo.exe
  2⤵
  PID:11736
- C:\Windows\System\MzQPWbn.exe
  C:\Windows\System\MzQPWbn.exe
  2⤵
  PID:4536
- C:\Windows\System\hjFrEFP.exe
  C:\Windows\System\hjFrEFP.exe
  2⤵
  PID:1428
- C:\Windows\System\YHArkTA.exe
  C:\Windows\System\YHArkTA.exe
  2⤵
  PID:12036
- C:\Windows\System\MmkBywP.exe
  C:\Windows\System\MmkBywP.exe
  2⤵
  PID:12128
- C:\Windows\System\IuoNAwh.exe
  C:\Windows\System\IuoNAwh.exe
  2⤵
  PID:12072
- C:\Windows\System\LpzFfuC.exe
  C:\Windows\System\LpzFfuC.exe
  2⤵
  PID:12220
- C:\Windows\System\rRXwWoI.exe
  C:\Windows\System\rRXwWoI.exe
  2⤵
  PID:11964
- C:\Windows\System\ZgGESbc.exe
  C:\Windows\System\ZgGESbc.exe
  2⤵
  PID:11984
- C:\Windows\System\rNNOQGH.exe
  C:\Windows\System\rNNOQGH.exe
  2⤵
  PID:11308
- C:\Windows\System\YoTvlkK.exe
  C:\Windows\System\YoTvlkK.exe
  2⤵
  PID:4696
- C:\Windows\System\KjhSIsM.exe
  C:\Windows\System\KjhSIsM.exe
  2⤵
  PID:12292
- C:\Windows\System\KWNQSlv.exe
  C:\Windows\System\KWNQSlv.exe
  2⤵
  PID:12320
- C:\Windows\System\DXnZlWG.exe
  C:\Windows\System\DXnZlWG.exe
  2⤵
  PID:12356
- C:\Windows\System\KuhHnlv.exe
  C:\Windows\System\KuhHnlv.exe
  2⤵
  PID:12372
- C:\Windows\System\yZuQrwf.exe
  C:\Windows\System\yZuQrwf.exe
  2⤵
  PID:12396
- C:\Windows\System\LoUbgXY.exe
  C:\Windows\System\LoUbgXY.exe
  2⤵
  PID:12416
- C:\Windows\System\yyYzfit.exe
  C:\Windows\System\yyYzfit.exe
  2⤵
  PID:12440
- C:\Windows\System\oohAZkr.exe
  C:\Windows\System\oohAZkr.exe
  2⤵
  PID:12464
- C:\Windows\System\YUljDIy.exe
  C:\Windows\System\YUljDIy.exe
  2⤵
  PID:12492
- C:\Windows\System\WmRAPAS.exe
  C:\Windows\System\WmRAPAS.exe
  2⤵
  PID:12520
- C:\Windows\System\RcEHJwk.exe
  C:\Windows\System\RcEHJwk.exe
  2⤵
  PID:12544
- C:\Windows\System\NYbYcLd.exe
  C:\Windows\System\NYbYcLd.exe
  2⤵
  PID:12580
- C:\Windows\System\bHPqpqz.exe
  C:\Windows\System\bHPqpqz.exe
  2⤵
  PID:12596
- C:\Windows\System\lqtWvWj.exe
  C:\Windows\System\lqtWvWj.exe
  2⤵
  PID:12620
- C:\Windows\System\KVFJcpk.exe
  C:\Windows\System\KVFJcpk.exe
  2⤵
  PID:12640
- C:\Windows\System\gXaIacs.exe
  C:\Windows\System\gXaIacs.exe
  2⤵
  PID:12668
- C:\Windows\System\HwlHMeR.exe
  C:\Windows\System\HwlHMeR.exe
  2⤵
  PID:12692
- C:\Windows\System\ljYXoKB.exe
  C:\Windows\System\ljYXoKB.exe
  2⤵
  PID:12708
- C:\Windows\System\QkEKGTR.exe
  C:\Windows\System\QkEKGTR.exe
  2⤵
  PID:12772
- C:\Windows\System\uKZskKV.exe
  C:\Windows\System\uKZskKV.exe
  2⤵
  PID:12788
- C:\Windows\System\GFFrtpQ.exe
  C:\Windows\System\GFFrtpQ.exe
  2⤵
  PID:12808
- C:\Windows\System\jCfHbPz.exe
  C:\Windows\System\jCfHbPz.exe
  2⤵
  PID:12832
- C:\Windows\System\NKLrCMF.exe
  C:\Windows\System\NKLrCMF.exe
  2⤵
  PID:12856
- C:\Windows\System\PqVDVbb.exe
  C:\Windows\System\PqVDVbb.exe
  2⤵
  PID:12928
- C:\Windows\System\jdXCHgU.exe
  C:\Windows\System\jdXCHgU.exe
  2⤵
  PID:12948
- C:\Windows\System\gWmTSFk.exe
  C:\Windows\System\gWmTSFk.exe
  2⤵
  PID:12972
- C:\Windows\System\kbicwzh.exe
  C:\Windows\System\kbicwzh.exe
  2⤵
  PID:13016
- C:\Windows\System\DDKYfLj.exe
  C:\Windows\System\DDKYfLj.exe
  2⤵
  PID:13040
- C:\Windows\System\Embjmqm.exe
  C:\Windows\System\Embjmqm.exe
  2⤵
  PID:13084
- C:\Windows\System\UHsYFMq.exe
  C:\Windows\System\UHsYFMq.exe
  2⤵
  PID:13108
- C:\Windows\System\iDuXKug.exe
  C:\Windows\System\iDuXKug.exe
  2⤵
  PID:13128
- C:\Windows\System\yEBfRCT.exe
  C:\Windows\System\yEBfRCT.exe
  2⤵
  PID:13160
- C:\Windows\System\PZFnmzn.exe
  C:\Windows\System\PZFnmzn.exe
  2⤵
  PID:12436
- C:\Windows\System\ggyAUIN.exe
  C:\Windows\System\ggyAUIN.exe
  2⤵
  PID:1108
- C:\Windows\System\rwZqekT.exe
  C:\Windows\System\rwZqekT.exe
  2⤵
  PID:12592
- C:\Windows\System\xkAXXle.exe
  C:\Windows\System\xkAXXle.exe
  2⤵
  PID:12724
- C:\Windows\System\WXMVOAp.exe
  C:\Windows\System\WXMVOAp.exe
  2⤵
  PID:12700
- C:\Windows\System\ZlUdlml.exe
  C:\Windows\System\ZlUdlml.exe
  2⤵
  PID:12820
- C:\Windows\System\VShtQgJ.exe
  C:\Windows\System\VShtQgJ.exe
  2⤵
  PID:12824
- C:\Windows\System\afkEszL.exe
  C:\Windows\System\afkEszL.exe
  2⤵
  PID:12916
- C:\Windows\System\jDoAFqB.exe
  C:\Windows\System\jDoAFqB.exe
  2⤵
  PID:12984
- C:\Windows\System\ckOiyta.exe
  C:\Windows\System\ckOiyta.exe
  2⤵
  PID:13012
- C:\Windows\System\BNGekbq.exe
  C:\Windows\System\BNGekbq.exe
  2⤵
  PID:13124
- C:\Windows\System\RmYIYLN.exe
  C:\Windows\System\RmYIYLN.exe
  2⤵
  PID:13176
- C:\Windows\System\tZhuLOA.exe
  C:\Windows\System\tZhuLOA.exe
  2⤵
  PID:13204
- C:\Windows\System\bfnGyPW.exe
  C:\Windows\System\bfnGyPW.exe
  2⤵
  PID:13248
- C:\Windows\System\SVoSlWs.exe
  C:\Windows\System\SVoSlWs.exe
  2⤵
  PID:13272
- C:\Windows\System\ZWIkHvx.exe
  C:\Windows\System\ZWIkHvx.exe
  2⤵
  PID:13300
- C:\Windows\System\sqaRdDW.exe
  C:\Windows\System\sqaRdDW.exe
  2⤵
  PID:1768
- C:\Windows\System\WXdUCNt.exe
  C:\Windows\System\WXdUCNt.exe
  2⤵
  PID:12632
- C:\Windows\System\CYImUBf.exe
  C:\Windows\System\CYImUBf.exe
  2⤵
  PID:12900
- C:\Windows\System\SIiItUx.exe
  C:\Windows\System\SIiItUx.exe
  2⤵
  PID:12896
- C:\Windows\System\jlBFFGw.exe
  C:\Windows\System\jlBFFGw.exe
  2⤵
  PID:4524
- C:\Windows\System\rHDtIBf.exe
  C:\Windows\System\rHDtIBf.exe
  2⤵
  PID:4392
- C:\Windows\System\rZKQvwz.exe
  C:\Windows\System\rZKQvwz.exe
  2⤵
  PID:2688
- C:\Windows\System\scHQgjy.exe
  C:\Windows\System\scHQgjy.exe
  2⤵
  PID:5792
- C:\Windows\System\ZfYEmZa.exe
  C:\Windows\System\ZfYEmZa.exe
  2⤵
  PID:5124
- C:\Windows\System\nndCyyv.exe
  C:\Windows\System\nndCyyv.exe
  2⤵
  PID:6072
- C:\Windows\System\kszIJJF.exe
  C:\Windows\System\kszIJJF.exe
  2⤵
  PID:5032
- C:\Windows\System\gqCQzqs.exe
  C:\Windows\System\gqCQzqs.exe
  2⤵
  PID:4992
- C:\Windows\System\PaTevgn.exe
  C:\Windows\System\PaTevgn.exe
  2⤵
  PID:3280
- C:\Windows\System\zICvZCA.exe
  C:\Windows\System\zICvZCA.exe
  2⤵
  PID:3192
- C:\Windows\System\RAUmgKq.exe
  C:\Windows\System\RAUmgKq.exe
  2⤵
  PID:5624
- C:\Windows\System\uXmBpCi.exe
  C:\Windows\System\uXmBpCi.exe
  2⤵
  PID:12588
- C:\Windows\System\lATPivu.exe
  C:\Windows\System\lATPivu.exe
  2⤵
  PID:6140
- C:\Windows\System\jyRuSDD.exe
  C:\Windows\System\jyRuSDD.exe
  2⤵
  PID:12388
- C:\Windows\System\ZQEgZEZ.exe
  C:\Windows\System\ZQEgZEZ.exe
  2⤵
  PID:3512
- C:\Windows\System\jkfsEJF.exe
  C:\Windows\System\jkfsEJF.exe
  2⤵
  PID:208
- C:\Windows\System\XUeUNAp.exe
  C:\Windows\System\XUeUNAp.exe
  2⤵
  PID:4372
- C:\Windows\System\HewhknO.exe
  C:\Windows\System\HewhknO.exe
  2⤵
  PID:6400
- C:\Windows\System\lGSdqPS.exe
  C:\Windows\System\lGSdqPS.exe
  2⤵
  PID:6548
- C:\Windows\System\OUrhhFp.exe
  C:\Windows\System\OUrhhFp.exe
  2⤵
  PID:5836
- C:\Windows\System\LTfpvig.exe
  C:\Windows\System\LTfpvig.exe
  2⤵
  PID:3692
- C:\Windows\System\eDdILEK.exe
  C:\Windows\System\eDdILEK.exe
  2⤵
  PID:3432
- C:\Windows\System\UcVisIX.exe
  C:\Windows\System\UcVisIX.exe
  2⤵
  PID:4504
- C:\Windows\System\KCYjLXT.exe
  C:\Windows\System\KCYjLXT.exe
  2⤵
  PID:2008
- C:\Windows\System\YxsAtUk.exe
  C:\Windows\System\YxsAtUk.exe
  2⤵
  PID:864
- C:\Windows\System\CKwJwWU.exe
  C:\Windows\System\CKwJwWU.exe
  2⤵
  PID:12964
- C:\Windows\System\fquvVey.exe
  C:\Windows\System\fquvVey.exe
  2⤵
  PID:2428
- C:\Windows\System\bXKvNzD.exe
  C:\Windows\System\bXKvNzD.exe
  2⤵
  PID:12756
- C:\Windows\System\TDbyPUs.exe
  C:\Windows\System\TDbyPUs.exe
  2⤵
  PID:2768
- C:\Windows\System\SRfpqcr.exe
  C:\Windows\System\SRfpqcr.exe
  2⤵
  PID:6772
- C:\Windows\System\fYGShME.exe
  C:\Windows\System\fYGShME.exe
  2⤵
  PID:7552
- C:\Windows\System\YukjJvh.exe
  C:\Windows\System\YukjJvh.exe
  2⤵
  PID:1464
- C:\Windows\System\jwcHGzA.exe
  C:\Windows\System\jwcHGzA.exe
  2⤵
  PID:4424
- C:\Windows\System\gvjbYBd.exe
  C:\Windows\System\gvjbYBd.exe
  2⤵
  PID:7264
- C:\Windows\System\tUsyPKv.exe
  C:\Windows\System\tUsyPKv.exe
  2⤵
  PID:7624
- C:\Windows\System\GQCsyAg.exe
  C:\Windows\System\GQCsyAg.exe
  2⤵
  PID:3908
- C:\Windows\System\vLaHuBM.exe
  C:\Windows\System\vLaHuBM.exe
  2⤵
  PID:7936
- C:\Windows\System\ZyWZXHl.exe
  C:\Windows\System\ZyWZXHl.exe
  2⤵
  PID:4164
- C:\Windows\System\grvFzom.exe
  C:\Windows\System\grvFzom.exe
  2⤵
  PID:7000
- C:\Windows\System\MfYJaom.exe
  C:\Windows\System\MfYJaom.exe
  2⤵
  PID:4308
- C:\Windows\System\jtaANnK.exe
  C:\Windows\System\jtaANnK.exe
  2⤵
  PID:8436
- C:\Windows\System\EVgQcqp.exe
  C:\Windows\System\EVgQcqp.exe
  2⤵
  PID:7368
- C:\Windows\System\oyvEDJD.exe
  C:\Windows\System\oyvEDJD.exe
  2⤵
  PID:7476
- C:\Windows\System\YgSWgfE.exe
  C:\Windows\System\YgSWgfE.exe
  2⤵
  PID:8356
- C:\Windows\System\GARSjYw.exe
  C:\Windows\System\GARSjYw.exe
  2⤵
  PID:7392
- C:\Windows\System\OVpbwbD.exe
  C:\Windows\System\OVpbwbD.exe
  2⤵
  PID:3928
- C:\Windows\System\mJzXUum.exe
  C:\Windows\System\mJzXUum.exe
  2⤵
  PID:7516
- C:\Windows\System\sjSKrtx.exe
  C:\Windows\System\sjSKrtx.exe
  2⤵
  PID:8848
- C:\Windows\System\TdqtAPR.exe
  C:\Windows\System\TdqtAPR.exe
  2⤵
  PID:3156
- C:\Windows\System\VZEJqdP.exe
  C:\Windows\System\VZEJqdP.exe
  2⤵
  PID:7324
- C:\Windows\System\PkOCWDj.exe
  C:\Windows\System\PkOCWDj.exe
  2⤵
  PID:9036
- C:\Windows\System\YfOYwsr.exe
  C:\Windows\System\YfOYwsr.exe
  2⤵
  PID:3808
- C:\Windows\System\wbhmcMB.exe
  C:\Windows\System\wbhmcMB.exe
  2⤵
  PID:1052
- C:\Windows\System\OSosBTP.exe
  C:\Windows\System\OSosBTP.exe
  2⤵
  PID:4692
- C:\Windows\System\PuygiHO.exe
  C:\Windows\System\PuygiHO.exe
  2⤵
  PID:8704
- C:\Windows\System\NPQQtRl.exe
  C:\Windows\System\NPQQtRl.exe
  2⤵
  PID:8908
- C:\Windows\System\bMfpuHv.exe
  C:\Windows\System\bMfpuHv.exe
  2⤵
  PID:9140
- C:\Windows\System\SucrNJi.exe
  C:\Windows\System\SucrNJi.exe
  2⤵
  PID:7772
- C:\Windows\System\SgZcSaW.exe
  C:\Windows\System\SgZcSaW.exe
  2⤵
  PID:7512
- C:\Windows\System\EhxZrxT.exe
  C:\Windows\System\EhxZrxT.exe
  2⤵
  PID:2596
- C:\Windows\System\FZdksns.exe
  C:\Windows\System\FZdksns.exe
  2⤵
  PID:8
- C:\Windows\System\akLZNVz.exe
  C:\Windows\System\akLZNVz.exe
  2⤵
  PID:7960
- C:\Windows\System\cyasiAX.exe
  C:\Windows\System\cyasiAX.exe
  2⤵
  PID:3636
- C:\Windows\System\JrOMRTd.exe
  C:\Windows\System\JrOMRTd.exe
  2⤵
  PID:2412
- C:\Windows\System\EWvPaJg.exe
  C:\Windows\System\EWvPaJg.exe
  2⤵
  PID:980
- C:\Windows\System\zVcdSth.exe
  C:\Windows\System\zVcdSth.exe
  2⤵
  PID:7236
- C:\Windows\System\QMMfdmx.exe
  C:\Windows\System\QMMfdmx.exe
  2⤵
  PID:7848
- C:\Windows\System\kFrIPeb.exe
  C:\Windows\System\kFrIPeb.exe
  2⤵
  PID:6844
- C:\Windows\System\kBZKfGr.exe
  C:\Windows\System\kBZKfGr.exe
  2⤵
  PID:3376
- C:\Windows\System\jbzQCSH.exe
  C:\Windows\System\jbzQCSH.exe
  2⤵
  PID:4020
- C:\Windows\System\WthPxqf.exe
  C:\Windows\System\WthPxqf.exe
  2⤵
  PID:2516
- C:\Windows\System\cfnCQlb.exe
  C:\Windows\System\cfnCQlb.exe
  2⤵
  PID:9864
- C:\Windows\System\wbfGxSx.exe
  C:\Windows\System\wbfGxSx.exe
  2⤵
  PID:3948
- C:\Windows\System\eJdktyk.exe
  C:\Windows\System\eJdktyk.exe
  2⤵
  PID:1928
- C:\Windows\System\ybZoUKZ.exe
  C:\Windows\System\ybZoUKZ.exe
  2⤵
  PID:552
- C:\Windows\System\WtkalJJ.exe
  C:\Windows\System\WtkalJJ.exe
  2⤵
  PID:7448
- C:\Windows\System\UocbPGt.exe
  C:\Windows\System\UocbPGt.exe
  2⤵
  PID:7520
- C:\Windows\System\ccTMDMo.exe
  C:\Windows\System\ccTMDMo.exe
  2⤵
  PID:4892
- C:\Windows\System\lUiFxGT.exe
  C:\Windows\System\lUiFxGT.exe
  2⤵
  PID:9800
- C:\Windows\System\wDJkigJ.exe
  C:\Windows\System\wDJkigJ.exe
  2⤵
  PID:9232
- C:\Windows\System\QRMIrnm.exe
  C:\Windows\System\QRMIrnm.exe
  2⤵
  PID:3500
- C:\Windows\System\IKERojt.exe
  C:\Windows\System\IKERojt.exe
  2⤵
  PID:3888
- C:\Windows\System\aHdlbIz.exe
  C:\Windows\System\aHdlbIz.exe
  2⤵
  PID:4656
- C:\Windows\System\RXiVBka.exe
  C:\Windows\System\RXiVBka.exe
  2⤵
  PID:5372
- C:\Windows\System\clAltCD.exe
  C:\Windows\System\clAltCD.exe
  2⤵
  PID:8184
- C:\Windows\System\ufweJtY.exe
  C:\Windows\System\ufweJtY.exe
  2⤵
  PID:10000
- C:\Windows\System\IWiaKFv.exe
  C:\Windows\System\IWiaKFv.exe
  2⤵
  PID:8604
- C:\Windows\System\fiMexyn.exe
  C:\Windows\System\fiMexyn.exe
  2⤵
  PID:10320
- C:\Windows\System\WrNSwEH.exe
  C:\Windows\System\WrNSwEH.exe
  2⤵
  PID:1912
- C:\Windows\System\XIXnkDT.exe
  C:\Windows\System\XIXnkDT.exe
  2⤵
  PID:10344
- C:\Windows\System\EEdKCJK.exe
  C:\Windows\System\EEdKCJK.exe
  2⤵
  PID:4376
- C:\Windows\System\agYxFRQ.exe
  C:\Windows\System\agYxFRQ.exe
  2⤵
  PID:10560
- C:\Windows\System\IPDMWEg.exe
  C:\Windows\System\IPDMWEg.exe
  2⤵
  PID:10108
- C:\Windows\System\cMjLUvL.exe
  C:\Windows\System\cMjLUvL.exe
  2⤵
  PID:10332
- C:\Windows\System\ESErRsA.exe
  C:\Windows\System\ESErRsA.exe
  2⤵
  PID:8872
- C:\Windows\System\NyokYtk.exe
  C:\Windows\System\NyokYtk.exe
  2⤵
  PID:5260
- C:\Windows\System\Qzkynvy.exe
  C:\Windows\System\Qzkynvy.exe
  2⤵
  PID:3048
- C:\Windows\System\AQJbeLd.exe
  C:\Windows\System\AQJbeLd.exe
  2⤵
  PID:5612
- C:\Windows\System\YdIiVdJ.exe
  C:\Windows\System\YdIiVdJ.exe
  2⤵
  PID:2080
- C:\Windows\System\myIexdY.exe
  C:\Windows\System\myIexdY.exe
  2⤵
  PID:3068
- C:\Windows\System\nMgShFY.exe
  C:\Windows\System\nMgShFY.exe
  2⤵
  PID:8788
- C:\Windows\System\PTgYbmo.exe
  C:\Windows\System\PTgYbmo.exe
  2⤵
  PID:10136
- C:\Windows\System\XKRkKwl.exe
  C:\Windows\System\XKRkKwl.exe
  2⤵
  PID:5500
- C:\Windows\System\JPTZkpj.exe
  C:\Windows\System\JPTZkpj.exe
  2⤵
  PID:5472
- C:\Windows\System\JRrnpIP.exe
  C:\Windows\System\JRrnpIP.exe
  2⤵
  PID:5948
- C:\Windows\System\YwEZAsG.exe
  C:\Windows\System\YwEZAsG.exe
  2⤵
  PID:10260
- C:\Windows\System\niPFmyH.exe
  C:\Windows\System\niPFmyH.exe
  2⤵
  PID:10544
- C:\Windows\System\uYTuKcs.exe
  C:\Windows\System\uYTuKcs.exe
  2⤵
  PID:11132
- C:\Windows\System\sWIARaQ.exe
  C:\Windows\System\sWIARaQ.exe
  2⤵
  PID:11204
- C:\Windows\System\vvukeBO.exe
  C:\Windows\System\vvukeBO.exe
  2⤵
  PID:11096
- C:\Windows\System\MTtQOAS.exe
  C:\Windows\System\MTtQOAS.exe
  2⤵
  PID:11360
- C:\Windows\System\VoJGKJy.exe
  C:\Windows\System\VoJGKJy.exe
  2⤵
  PID:9796
- C:\Windows\System\sSSkOAG.exe
  C:\Windows\System\sSSkOAG.exe
  2⤵
  PID:10416
- C:\Windows\System\RTAdkQi.exe
  C:\Windows\System\RTAdkQi.exe
  2⤵
  PID:11544
- C:\Windows\System\PSKnFlU.exe
  C:\Windows\System\PSKnFlU.exe
  2⤵
  PID:5580
- C:\Windows\System\RkQCQMA.exe
  C:\Windows\System\RkQCQMA.exe
  2⤵
  PID:1196
- C:\Windows\System\gtQQxht.exe
  C:\Windows\System\gtQQxht.exe
  2⤵
  PID:5156
- C:\Windows\System\PzoRufI.exe
  C:\Windows\System\PzoRufI.exe
  2⤵
  PID:8608
- C:\Windows\System\CguYpWm.exe
  C:\Windows\System\CguYpWm.exe
  2⤵
  PID:5844
- C:\Windows\System\cFDsXWK.exe
  C:\Windows\System\cFDsXWK.exe
  2⤵
  PID:3580
- C:\Windows\System\vmPKbFE.exe
  C:\Windows\System\vmPKbFE.exe
  2⤵
  PID:11672
- C:\Windows\System\Mkxpgtn.exe
  C:\Windows\System\Mkxpgtn.exe
  2⤵
  PID:4564
- C:\Windows\System\pReCpvJ.exe
  C:\Windows\System\pReCpvJ.exe
  2⤵
  PID:4664
- C:\Windows\System\UxsqQXv.exe
  C:\Windows\System\UxsqQXv.exe
  2⤵
  PID:5692
- C:\Windows\System\QSnDTtr.exe
  C:\Windows\System\QSnDTtr.exe
  2⤵
  PID:4076
- C:\Windows\System\OejrkVb.exe
  C:\Windows\System\OejrkVb.exe
  2⤵
  PID:2332
- C:\Windows\System\rwBRfhQ.exe
  C:\Windows\System\rwBRfhQ.exe
  2⤵
  PID:9808
- C:\Windows\System\qBkgzGA.exe
  C:\Windows\System\qBkgzGA.exe
  2⤵
  PID:12260
- C:\Windows\System\cLkrcNN.exe
  C:\Windows\System\cLkrcNN.exe
  2⤵
  PID:4584
- C:\Windows\System\fUbvSVi.exe
  C:\Windows\System\fUbvSVi.exe
  2⤵
  PID:11376
- C:\Windows\System\CHUrSxT.exe
  C:\Windows\System\CHUrSxT.exe
  2⤵
  PID:12844
- C:\Windows\System\CQDNcog.exe
  C:\Windows\System\CQDNcog.exe
  2⤵
  PID:7204
- C:\Windows\System\UhOoJbB.exe
  C:\Windows\System\UhOoJbB.exe
  2⤵
  PID:13004
- C:\Windows\System\PETAOhf.exe
  C:\Windows\System\PETAOhf.exe
  2⤵
  PID:11348
- C:\Windows\System\DwqQIad.exe
  C:\Windows\System\DwqQIad.exe
  2⤵
  PID:11288
- C:\Windows\System\HXUgkrA.exe
  C:\Windows\System\HXUgkrA.exe
  2⤵
  PID:5584
- C:\Windows\System\DuOmUCj.exe
  C:\Windows\System\DuOmUCj.exe
  2⤵
  PID:5300
- C:\Windows\System\wBNJrRa.exe
  C:\Windows\System\wBNJrRa.exe
  2⤵
  PID:10076
- C:\Windows\System\hQaqFsF.exe
  C:\Windows\System\hQaqFsF.exe
  2⤵
  PID:12280
- C:\Windows\System\dtJwAXs.exe
  C:\Windows\System\dtJwAXs.exe
  2⤵
  PID:8812
- C:\Windows\System\BQZykSS.exe
  C:\Windows\System\BQZykSS.exe
  2⤵
  PID:11880
- C:\Windows\System\eTIveSu.exe
  C:\Windows\System\eTIveSu.exe
  2⤵
  PID:5572
- C:\Windows\System\HspbTuV.exe
  C:\Windows\System\HspbTuV.exe
  2⤵
  PID:6136
- C:\Windows\System\bIbxjjc.exe
  C:\Windows\System\bIbxjjc.exe
  2⤵
  PID:3896
- C:\Windows\System\qPKwjfT.exe
  C:\Windows\System\qPKwjfT.exe
  2⤵
  PID:2952
- C:\Windows\System\YYtnzlh.exe
  C:\Windows\System\YYtnzlh.exe
  2⤵
  PID:10336
- C:\Windows\System\QOKeKMP.exe
  C:\Windows\System\QOKeKMP.exe
  2⤵
  PID:12304
- C:\Windows\System\oTYHaKW.exe
  C:\Windows\System\oTYHaKW.exe
  2⤵
  PID:4684
- C:\Windows\System\zWqMkdJ.exe
  C:\Windows\System\zWqMkdJ.exe
  2⤵
  PID:12256
- C:\Windows\System\ddrybXz.exe
  C:\Windows\System\ddrybXz.exe
  2⤵
  PID:10600
- C:\Windows\System\vOvtTNQ.exe
  C:\Windows\System\vOvtTNQ.exe
  2⤵
  PID:10912
- C:\Windows\System\BRbzaBk.exe
  C:\Windows\System\BRbzaBk.exe
  2⤵
  PID:6348
- C:\Windows\System\WpfVGSN.exe
  C:\Windows\System\WpfVGSN.exe
  2⤵
  PID:6392
- C:\Windows\System\trKatJM.exe
  C:\Windows\System\trKatJM.exe
  2⤵
  PID:11596
- C:\Windows\System\sETsyjQ.exe
  C:\Windows\System\sETsyjQ.exe
  2⤵
  PID:6424
- C:\Windows\System\uNVgeEi.exe
  C:\Windows\System\uNVgeEi.exe
  2⤵
  PID:6908
- C:\Windows\System\sJOvoKg.exe
  C:\Windows\System\sJOvoKg.exe
  2⤵
  PID:6952
- C:\Windows\System\WBwRZUk.exe
  C:\Windows\System\WBwRZUk.exe
  2⤵
  PID:6956
- C:\Windows\System\hVxgtEi.exe
  C:\Windows\System\hVxgtEi.exe
  2⤵
  PID:9008
- C:\Windows\System\BYfyDOD.exe
  C:\Windows\System\BYfyDOD.exe
  2⤵
  PID:12384
- C:\Windows\System\IThzNoM.exe
  C:\Windows\System\IThzNoM.exe
  2⤵
  PID:6196
- C:\Windows\System\ZGMILzO.exe
  C:\Windows\System\ZGMILzO.exe
  2⤵
  PID:6180
- C:\Windows\System\RWotaWw.exe
  C:\Windows\System\RWotaWw.exe
  2⤵
  PID:6376
- C:\Windows\System\AKaJWaq.exe
  C:\Windows\System\AKaJWaq.exe
  2⤵
  PID:6344
- C:\Windows\System\JZiHWbF.exe
  C:\Windows\System\JZiHWbF.exe
  2⤵
  PID:10012
- C:\Windows\System\psHbZJX.exe
  C:\Windows\System\psHbZJX.exe
  2⤵
  PID:6528
- C:\Windows\System\HcQWdZf.exe
  C:\Windows\System\HcQWdZf.exe
  2⤵
  PID:5808
- C:\Windows\System\TwxTViQ.exe
  C:\Windows\System\TwxTViQ.exe
  2⤵
  PID:11500
- C:\Windows\System\rOlThVz.exe
  C:\Windows\System\rOlThVz.exe
  2⤵
  PID:6544
- C:\Windows\System\vXVZlaU.exe
  C:\Windows\System\vXVZlaU.exe
  2⤵
  PID:7316
- C:\Windows\System\XetkMsY.exe
  C:\Windows\System\XetkMsY.exe
  2⤵
  PID:5468
- C:\Windows\System\gAAChcx.exe
  C:\Windows\System\gAAChcx.exe
  2⤵
  PID:7116
- C:\Windows\System\KlGHWzd.exe
  C:\Windows\System\KlGHWzd.exe
  2⤵
  PID:6932
- C:\Windows\System\ngjFpzx.exe
  C:\Windows\System\ngjFpzx.exe
  2⤵
  PID:6160
- C:\Windows\System\sAUkoqC.exe
  C:\Windows\System\sAUkoqC.exe
  2⤵
  PID:7228
- C:\Windows\System\wAsoNyM.exe
  C:\Windows\System\wAsoNyM.exe
  2⤵
  PID:680
- C:\Windows\System\faJElyn.exe
  C:\Windows\System\faJElyn.exe
  2⤵
  PID:7412
- C:\Windows\System\wWMOfaR.exe
  C:\Windows\System\wWMOfaR.exe
  2⤵
  PID:6724
- C:\Windows\System\xUozRCj.exe
  C:\Windows\System\xUozRCj.exe
  2⤵
  PID:7036
- C:\Windows\System\jXEupvL.exe
  C:\Windows\System\jXEupvL.exe
  2⤵
  PID:11400
- C:\Windows\System\zDkZOwi.exe
  C:\Windows\System\zDkZOwi.exe
  2⤵
  PID:13140
- C:\Windows\System\kRkMNOd.exe
  C:\Windows\System\kRkMNOd.exe
  2⤵
  PID:7612
- C:\Windows\System\hVpAkxl.exe
  C:\Windows\System\hVpAkxl.exe
  2⤵
  PID:6600
- C:\Windows\System\cBklrgk.exe
  C:\Windows\System\cBklrgk.exe
  2⤵
  PID:6388
- C:\Windows\System\JjMZNgL.exe
  C:\Windows\System\JjMZNgL.exe
  2⤵
  PID:6024
- C:\Windows\System\xDDEqmX.exe
  C:\Windows\System\xDDEqmX.exe
  2⤵
  PID:11120
- C:\Windows\System\NcLSHBm.exe
  C:\Windows\System\NcLSHBm.exe
  2⤵
  PID:13228
- C:\Windows\System\CXMiaTg.exe
  C:\Windows\System\CXMiaTg.exe
  2⤵
  PID:6748
- C:\Windows\System\XoKrvum.exe
  C:\Windows\System\XoKrvum.exe
  2⤵
  PID:11528
- C:\Windows\System\GRWpPAI.exe
  C:\Windows\System\GRWpPAI.exe
  2⤵
  PID:7320
- C:\Windows\System\TjQlysi.exe
  C:\Windows\System\TjQlysi.exe
  2⤵
  PID:6852
- C:\Windows\System\bxdfYgJ.exe
  C:\Windows\System\bxdfYgJ.exe
  2⤵
  PID:6928
- C:\Windows\System\rCsXYQr.exe
  C:\Windows\System\rCsXYQr.exe
  2⤵
  PID:7640
- C:\Windows\System\CydeMCD.exe
  C:\Windows\System\CydeMCD.exe
  2⤵
  PID:7224
- C:\Windows\System\ecfNqRy.exe
  C:\Windows\System\ecfNqRy.exe
  2⤵
  PID:6848
- C:\Windows\System\zBRfSGp.exe
  C:\Windows\System\zBRfSGp.exe
  2⤵
  PID:7632
- C:\Windows\System\nSAtXub.exe
  C:\Windows\System\nSAtXub.exe
  2⤵
  PID:13076
- C:\Windows\System\RXFOeUz.exe
  C:\Windows\System\RXFOeUz.exe
  2⤵
  PID:8284
- C:\Windows\System\hZqZPnf.exe
  C:\Windows\System\hZqZPnf.exe
  2⤵
  PID:8244
- C:\Windows\System\YnVnWbX.exe
  C:\Windows\System\YnVnWbX.exe
  2⤵
  PID:8428
- C:\Windows\System\OvvkvTD.exe
  C:\Windows\System\OvvkvTD.exe
  2⤵
  PID:10872
- C:\Windows\System\dSLXTzT.exe
  C:\Windows\System\dSLXTzT.exe
  2⤵
  PID:7648
- C:\Windows\System\jdEOGVw.exe
  C:\Windows\System\jdEOGVw.exe
  2⤵
  PID:8408
- C:\Windows\System\ggblqZR.exe
  C:\Windows\System\ggblqZR.exe
  2⤵
  PID:6816
- C:\Windows\System\VDZXucf.exe
  C:\Windows\System\VDZXucf.exe
  2⤵
  PID:6208
- C:\Windows\System\moSBTaE.exe
  C:\Windows\System\moSBTaE.exe
  2⤵
  PID:8880
- C:\Windows\System\tXyLVgE.exe
  C:\Windows\System\tXyLVgE.exe
  2⤵
  PID:8792
- C:\Windows\System\waaOAZk.exe
  C:\Windows\System\waaOAZk.exe
  2⤵
  PID:9120
- C:\Windows\System\fHQMJcx.exe
  C:\Windows\System\fHQMJcx.exe
  2⤵
  PID:9192
- C:\Windows\System\yHBiVVB.exe
  C:\Windows\System\yHBiVVB.exe
  2⤵
  PID:7728
- C:\Windows\System\gJkRtLv.exe
  C:\Windows\System\gJkRtLv.exe
  2⤵
  PID:7140
- C:\Windows\System\XPLSywY.exe
  C:\Windows\System\XPLSywY.exe
  2⤵
  PID:8292
- C:\Windows\System\KDoLJia.exe
  C:\Windows\System\KDoLJia.exe
  2⤵
  PID:6192
- C:\Windows\System\nOjFBXX.exe
  C:\Windows\System\nOjFBXX.exe
  2⤵
  PID:8588
- C:\Windows\System\mNRApyC.exe
  C:\Windows\System\mNRApyC.exe
  2⤵
  PID:8932
- C:\Windows\System\alRalKY.exe
  C:\Windows\System\alRalKY.exe
  2⤵
  PID:5632
- C:\Windows\System\vgxaLJU.exe
  C:\Windows\System\vgxaLJU.exe
  2⤵
  PID:7724
- C:\Windows\System\ZaYjvuX.exe
  C:\Windows\System\ZaYjvuX.exe
  2⤵
  PID:6760
- C:\Windows\System\pzMmRVa.exe
  C:\Windows\System\pzMmRVa.exe
  2⤵
  PID:8204
- C:\Windows\System\HXrqFvr.exe
  C:\Windows\System\HXrqFvr.exe
  2⤵
  PID:7260
- C:\Windows\System\LlUZxOu.exe
  C:\Windows\System\LlUZxOu.exe
  2⤵
  PID:9616
- C:\Windows\System\YWJINiR.exe
  C:\Windows\System\YWJINiR.exe
  2⤵
  PID:9548
- C:\Windows\System\vbgmmdE.exe
  C:\Windows\System\vbgmmdE.exe
  2⤵
  PID:9632
- C:\Windows\System\zBzvuod.exe
  C:\Windows\System\zBzvuod.exe
  2⤵
  PID:9108
- C:\Windows\System\JzzEels.exe
  C:\Windows\System\JzzEels.exe
  2⤵
  PID:6292
- C:\Windows\System\cXJsDkp.exe
  C:\Windows\System\cXJsDkp.exe
  2⤵
  PID:8212
- C:\Windows\System\XBmNooA.exe
  C:\Windows\System\XBmNooA.exe
  2⤵
  PID:9804
- C:\Windows\System\OrmuGQX.exe
  C:\Windows\System\OrmuGQX.exe
  2⤵
  PID:10100
- C:\Windows\System\YkogXpx.exe
  C:\Windows\System\YkogXpx.exe
  2⤵
  PID:8268
- C:\Windows\System\ClXMYKP.exe
  C:\Windows\System\ClXMYKP.exe
  2⤵
  PID:9592
- C:\Windows\System\wboISGw.exe
  C:\Windows\System\wboISGw.exe
  2⤵
  PID:9748
- C:\Windows\System\nyGqegJ.exe
  C:\Windows\System\nyGqegJ.exe
  2⤵
  PID:8272
- C:\Windows\System\AEgSBbu.exe
  C:\Windows\System\AEgSBbu.exe
  2⤵
  PID:9744
- C:\Windows\System\yAALZKT.exe
  C:\Windows\System\yAALZKT.exe
  2⤵
  PID:10180
- C:\Windows\System\nmCTcLH.exe
  C:\Windows\System\nmCTcLH.exe
  2⤵
  PID:9936
- C:\Windows\System\ksoOLds.exe
  C:\Windows\System\ksoOLds.exe
  2⤵
  PID:8136
- C:\Windows\System\IHrgTTS.exe
  C:\Windows\System\IHrgTTS.exe
  2⤵
  PID:9388
- C:\Windows\System\ZQIqOrw.exe
  C:\Windows\System\ZQIqOrw.exe
  2⤵
  PID:9668
- C:\Windows\System\uzzJunZ.exe
  C:\Windows\System\uzzJunZ.exe
  2⤵
  PID:8260
- C:\Windows\System\ZBqgfjk.exe
  C:\Windows\System\ZBqgfjk.exe
  2⤵
  PID:12404
- C:\Windows\System\TJOvlNS.exe
  C:\Windows\System\TJOvlNS.exe
  2⤵
  PID:12316
- C:\Windows\System\XEBonKz.exe
  C:\Windows\System\XEBonKz.exe
  2⤵
  PID:13260
- C:\Windows\System\aYRLnUm.exe
  C:\Windows\System\aYRLnUm.exe
  2⤵
  PID:7948
- C:\Windows\System\wsDGMsj.exe
  C:\Windows\System\wsDGMsj.exe
  2⤵
  PID:6660
- C:\Windows\System\WEOrZDr.exe
  C:\Windows\System\WEOrZDr.exe
  2⤵
  PID:8508
- C:\Windows\System\GIoKFVg.exe
  C:\Windows\System\GIoKFVg.exe
  2⤵
  PID:10796
- C:\Windows\System\CoIwxhO.exe
  C:\Windows\System\CoIwxhO.exe
  2⤵
  PID:9556
- C:\Windows\System\nhfkgOk.exe
  C:\Windows\System\nhfkgOk.exe
  2⤵
  PID:10516
- C:\Windows\System\deCiupW.exe
  C:\Windows\System\deCiupW.exe
  2⤵
  PID:9572
- C:\Windows\System\bHhHmrV.exe
  C:\Windows\System\bHhHmrV.exe
  2⤵
  PID:10160
- C:\Windows\System\TxNQGoL.exe
  C:\Windows\System\TxNQGoL.exe
  2⤵
  PID:13216
- C:\Windows\System\vVYeigv.exe
  C:\Windows\System\vVYeigv.exe
  2⤵
  PID:11868
- C:\Windows\System\yqwWuZA.exe
  C:\Windows\System\yqwWuZA.exe
  2⤵
  PID:10980
- C:\Windows\System\YjFfRYh.exe
  C:\Windows\System\YjFfRYh.exe
  2⤵
  PID:9816
- C:\Windows\System\FWhbkHI.exe
  C:\Windows\System\FWhbkHI.exe
  2⤵
  PID:6620
- C:\Windows\System\lVaAfiq.exe
  C:\Windows\System\lVaAfiq.exe
  2⤵
  PID:11160
- C:\Windows\System\EHwSemD.exe
  C:\Windows\System\EHwSemD.exe
  2⤵
  PID:11216
- C:\Windows\System\ymzRPnX.exe
  C:\Windows\System\ymzRPnX.exe
  2⤵
  PID:11960
- C:\Windows\System\UExjmJB.exe
  C:\Windows\System\UExjmJB.exe
  2⤵
  PID:10296
- C:\Windows\System\ukJTVUn.exe
  C:\Windows\System\ukJTVUn.exe
  2⤵
  PID:10152
- C:\Windows\System\tobWUVe.exe
  C:\Windows\System\tobWUVe.exe
  2⤵
  PID:10812
- C:\Windows\System\BnufVOo.exe
  C:\Windows\System\BnufVOo.exe
  2⤵
  PID:10532
- C:\Windows\System\gHDKjEy.exe
  C:\Windows\System\gHDKjEy.exe
  2⤵
  PID:6864
- C:\Windows\System\IPNgRrN.exe
  C:\Windows\System\IPNgRrN.exe
  2⤵
  PID:10692
- C:\Windows\System\QAiiypw.exe
  C:\Windows\System\QAiiypw.exe
  2⤵
  PID:11080
- C:\Windows\System\fjtSIoi.exe
  C:\Windows\System\fjtSIoi.exe
  2⤵
  PID:9916
- C:\Windows\System\hlGZWtl.exe
  C:\Windows\System\hlGZWtl.exe
  2⤵
  PID:4884
- C:\Windows\System\bVVOJAT.exe
  C:\Windows\System\bVVOJAT.exe
  2⤵
  PID:11064
- C:\Windows\System\gCxvxTN.exe
  C:\Windows\System\gCxvxTN.exe
  2⤵
  PID:11488
- C:\Windows\System\VvOZStv.exe
  C:\Windows\System\VvOZStv.exe
  2⤵
  PID:8524
- C:\Windows\System\YLIhwKW.exe
  C:\Windows\System\YLIhwKW.exe
  2⤵
  PID:8664
- C:\Windows\System\IzcmWuD.exe
  C:\Windows\System\IzcmWuD.exe
  2⤵
  PID:9756
- C:\Windows\System\PHmwmgD.exe
  C:\Windows\System\PHmwmgD.exe
  2⤵
  PID:11668
- C:\Windows\System\SYKEUxJ.exe
  C:\Windows\System\SYKEUxJ.exe
  2⤵
  PID:11824
- C:\Windows\System\aXMPAga.exe
  C:\Windows\System\aXMPAga.exe
  2⤵
  PID:10620
- C:\Windows\System\enqJFMi.exe
  C:\Windows\System\enqJFMi.exe
  2⤵
  PID:9740
- C:\Windows\System\cwrxHiZ.exe
  C:\Windows\System\cwrxHiZ.exe
  2⤵
  PID:12000
- C:\Windows\System\UtDfySp.exe
  C:\Windows\System\UtDfySp.exe
  2⤵
  PID:9260
- C:\Windows\System\ZzqHhWF.exe
  C:\Windows\System\ZzqHhWF.exe
  2⤵
  PID:10768
- C:\Windows\System\JfgYPfw.exe
  C:\Windows\System\JfgYPfw.exe
  2⤵
  PID:11844
- C:\Windows\System\BBPqDFY.exe
  C:\Windows\System\BBPqDFY.exe
  2⤵
  PID:12184
- C:\Windows\System\aGoEjpQ.exe
  C:\Windows\System\aGoEjpQ.exe
  2⤵
  PID:11912
- C:\Windows\System\KgfIIpZ.exe
  C:\Windows\System\KgfIIpZ.exe
  2⤵
  PID:10132
- C:\Windows\System\MVSnSuC.exe
  C:\Windows\System\MVSnSuC.exe
  2⤵
  PID:12188
- C:\Windows\System\PgdOybV.exe
  C:\Windows\System\PgdOybV.exe
  2⤵
  PID:11276
- C:\Windows\System\GaooANf.exe
  C:\Windows\System\GaooANf.exe
  2⤵
  PID:11768
- C:\Windows\System\obECsZB.exe
  C:\Windows\System\obECsZB.exe
  2⤵
  PID:11164
- C:\Windows\System\XBqUGec.exe
  C:\Windows\System\XBqUGec.exe
  2⤵
  PID:11776
- C:\Windows\System\CEuwtAH.exe
  C:\Windows\System\CEuwtAH.exe
  2⤵
  PID:10216
- C:\Windows\System\GiMSgpu.exe
  C:\Windows\System\GiMSgpu.exe
  2⤵
  PID:10280
- C:\Windows\System\KGDhRjn.exe
  C:\Windows\System\KGDhRjn.exe
  2⤵
  PID:11368
- C:\Windows\System\exeFvlu.exe
  C:\Windows\System\exeFvlu.exe
  2⤵
  PID:11280
- C:\Windows\System\hZFBxUS.exe
  C:\Windows\System\hZFBxUS.exe
  2⤵
  PID:11740
- C:\Windows\System\ZlmhcoH.exe
  C:\Windows\System\ZlmhcoH.exe
  2⤵
  PID:11796
- C:\Windows\System\qbaDdKg.exe
  C:\Windows\System\qbaDdKg.exe
  2⤵
  PID:10904
- C:\Windows\System\IItFXyv.exe
  C:\Windows\System\IItFXyv.exe
  2⤵
  PID:12052
- C:\Windows\System\ETTLDJw.exe
  C:\Windows\System\ETTLDJw.exe
  2⤵
  PID:7496
- C:\Windows\System\UaJLjFg.exe
  C:\Windows\System\UaJLjFg.exe
  2⤵
  PID:2696
- C:\Windows\System\kWYXUIj.exe
  C:\Windows\System\kWYXUIj.exe
  2⤵
  PID:11580
- C:\Windows\System\zalcTyy.exe
  C:\Windows\System\zalcTyy.exe
  2⤵
  PID:4680
- C:\Windows\System\AgSiEkf.exe
  C:\Windows\System\AgSiEkf.exe
  2⤵
  PID:4148
- C:\Windows\System\VkQczEj.exe
  C:\Windows\System\VkQczEj.exe
  2⤵
  PID:12816
- C:\Windows\System\ZoTsmjO.exe
  C:\Windows\System\ZoTsmjO.exe
  2⤵
  PID:1228
- C:\Windows\System\fyiotJZ.exe
  C:\Windows\System\fyiotJZ.exe
  2⤵
  PID:10988
- C:\Windows\System\XZGIbOn.exe
  C:\Windows\System\XZGIbOn.exe
  2⤵
  PID:12876
- C:\Windows\System\wHCIdJN.exe
  C:\Windows\System\wHCIdJN.exe
  2⤵
  PID:13064
- C:\Windows\System\FThDgkR.exe
  C:\Windows\System\FThDgkR.exe
  2⤵
  PID:12604
- C:\Windows\System\JKCDiwG.exe
  C:\Windows\System\JKCDiwG.exe
  2⤵
  PID:11916
- C:\Windows\System\zMquMPo.exe
  C:\Windows\System\zMquMPo.exe
  2⤵
  PID:12768
- C:\Windows\System\RbGkKQY.exe
  C:\Windows\System\RbGkKQY.exe
  2⤵
  PID:12660
- C:\Windows\System\XcpbsJS.exe
  C:\Windows\System\XcpbsJS.exe
  2⤵
  PID:12368
- C:\Windows\System\IoZsMdl.exe
  C:\Windows\System\IoZsMdl.exe
  2⤵
  PID:12472
- C:\Windows\System\txEepRD.exe
  C:\Windows\System\txEepRD.exe
  2⤵
  PID:12940
- C:\Windows\System\EYPhLQR.exe
  C:\Windows\System\EYPhLQR.exe
  2⤵
  PID:1432
- C:\Windows\System\bKdSQQZ.exe
  C:\Windows\System\bKdSQQZ.exe
  2⤵
  PID:9436
- C:\Windows\System\ToZQMsy.exe
  C:\Windows\System\ToZQMsy.exe
  2⤵
  PID:4100
- C:\Windows\System\XmQmFsr.exe
  C:\Windows\System\XmQmFsr.exe
  2⤵
  PID:624
- C:\Windows\System\wJrYSRo.exe
  C:\Windows\System\wJrYSRo.exe
  2⤵
  PID:12988
- C:\Windows\System\SuHkjYM.exe
  C:\Windows\System\SuHkjYM.exe
  2⤵
  PID:12564
- C:\Windows\System\kFqNSNj.exe
  C:\Windows\System\kFqNSNj.exe
  2⤵
  PID:640
- C:\Windows\System\NEJuSDN.exe
  C:\Windows\System\NEJuSDN.exe
  2⤵
  PID:5016
- C:\Windows\System\OnFSvrC.exe
  C:\Windows\System\OnFSvrC.exe
  2⤵
  PID:12980
- C:\Windows\System\pXZhNba.exe
  C:\Windows\System\pXZhNba.exe
  2⤵
  PID:13144
- C:\Windows\System\RdmZohr.exe
  C:\Windows\System\RdmZohr.exe
  2⤵
  PID:13152
- C:\Windows\System\hFlQWwp.exe
  C:\Windows\System\hFlQWwp.exe
  2⤵
  PID:13184
- C:\Windows\System\qrugYpW.exe
  C:\Windows\System\qrugYpW.exe
  2⤵
  PID:13328
- C:\Windows\System\PdlwQIX.exe
  C:\Windows\System\PdlwQIX.exe
  2⤵
  PID:13356
- C:\Windows\System\CdztwZD.exe
  C:\Windows\System\CdztwZD.exe
  2⤵
  PID:13384
- C:\Windows\System\SWSqjGf.exe
  C:\Windows\System\SWSqjGf.exe
  2⤵
  PID:13412
- C:\Windows\System\NerzuxK.exe
  C:\Windows\System\NerzuxK.exe
  2⤵
  PID:13440
- C:\Windows\System\SFWopuv.exe
  C:\Windows\System\SFWopuv.exe
  2⤵
  PID:13468
- C:\Windows\System\LsQJmWQ.exe
  C:\Windows\System\LsQJmWQ.exe
  2⤵
  PID:13496
- C:\Windows\System\UYjCTvj.exe
  C:\Windows\System\UYjCTvj.exe
  2⤵
  PID:13524
- C:\Windows\System\msZIZEL.exe
  C:\Windows\System\msZIZEL.exe
  2⤵
  PID:13548
- C:\Windows\System\SQeGMsy.exe
  C:\Windows\System\SQeGMsy.exe
  2⤵
  PID:13580
- C:\Windows\System\yfeaksj.exe
  C:\Windows\System\yfeaksj.exe
  2⤵
  PID:13696
- C:\Windows\System\ykBGRjL.exe
  C:\Windows\System\ykBGRjL.exe
  2⤵
  PID:13712
- C:\Windows\System\eNUfRXf.exe
  C:\Windows\System\eNUfRXf.exe
  2⤵
  PID:13728
- C:\Windows\System\qQQpTGq.exe
  C:\Windows\System\qQQpTGq.exe
  2⤵
  PID:13744
- C:\Windows\System\hQaWlIy.exe
  C:\Windows\System\hQaWlIy.exe
  2⤵
  PID:13760
- C:\Windows\System\kgJkajQ.exe
  C:\Windows\System\kgJkajQ.exe
  2⤵
  PID:13780
- C:\Windows\System\WDfBeOf.exe
  C:\Windows\System\WDfBeOf.exe
  2⤵
  PID:13832
- C:\Windows\System\cqucCVi.exe
  C:\Windows\System\cqucCVi.exe
  2⤵
  PID:13848
- C:\Windows\System\XzRNykN.exe
  C:\Windows\System\XzRNykN.exe
  2⤵
  PID:13884
- C:\Windows\System\vHmVsNb.exe
  C:\Windows\System\vHmVsNb.exe
  2⤵
  PID:13924
- C:\Windows\System\DcgXtAg.exe
  C:\Windows\System\DcgXtAg.exe
  2⤵
  PID:13976
- C:\Windows\System\hgtjTVt.exe
  C:\Windows\System\hgtjTVt.exe
  2⤵
  PID:14044
- C:\Windows\System\MNBVQDv.exe
  C:\Windows\System\MNBVQDv.exe
  2⤵
  PID:14076
- C:\Windows\System\Nekwihs.exe
  C:\Windows\System\Nekwihs.exe
  2⤵
  PID:14092
- C:\Windows\System\nFJgrpm.exe
  C:\Windows\System\nFJgrpm.exe
  2⤵
  PID:14132
- C:\Windows\System\ivUjIRY.exe
  C:\Windows\System\ivUjIRY.exe
  2⤵
  PID:14148
- C:\Windows\System\pYfFpqw.exe
  C:\Windows\System\pYfFpqw.exe
  2⤵
  PID:14184
- C:\Windows\System\uWVOtno.exe
  C:\Windows\System\uWVOtno.exe
  2⤵
  PID:14216
- C:\Windows\System\fKHdbgn.exe
  C:\Windows\System\fKHdbgn.exe
  2⤵
  PID:14244
- C:\Windows\System\znvuSgY.exe
  C:\Windows\System\znvuSgY.exe
  2⤵
  PID:14272
- C:\Windows\System\bgnmOes.exe
  C:\Windows\System\bgnmOes.exe
  2⤵
  PID:14300
- C:\Windows\System\TekeiQv.exe
  C:\Windows\System\TekeiQv.exe
  2⤵
  PID:14328
- C:\Windows\System\JcTSnoH.exe
  C:\Windows\System\JcTSnoH.exe
  2⤵
  PID:13364
- C:\Windows\System\qVktEmb.exe
  C:\Windows\System\qVktEmb.exe
  2⤵
  PID:13428
- C:\Windows\System\KIDRzWt.exe
  C:\Windows\System\KIDRzWt.exe
  2⤵
  PID:13492
- C:\Windows\System\bgXyfxI.exe
  C:\Windows\System\bgXyfxI.exe
  2⤵
  PID:13560
- C:\Windows\System\KOROqXY.exe
  C:\Windows\System\KOROqXY.exe
  2⤵
  PID:13644
- C:\Windows\System\fBqqjtP.exe
  C:\Windows\System\fBqqjtP.exe
  2⤵
  PID:13704
- C:\Windows\System\ulPFBdG.exe
  C:\Windows\System\ulPFBdG.exe
  2⤵
  PID:13720
- C:\Windows\System\BvEAEfW.exe
  C:\Windows\System\BvEAEfW.exe
  2⤵
  PID:13752
- C:\Windows\System\vDyiomf.exe
  C:\Windows\System\vDyiomf.exe
  2⤵
  PID:13692
- C:\Windows\System\PRkRXvm.exe
  C:\Windows\System\PRkRXvm.exe
  2⤵
  PID:13772
- C:\Windows\System\HyJYPMX.exe
  C:\Windows\System\HyJYPMX.exe
  2⤵
  PID:13804
- C:\Windows\System\WiAHTHv.exe
  C:\Windows\System\WiAHTHv.exe
  2⤵
  PID:12664
- C:\Windows\System\WrAjYHk.exe
  C:\Windows\System\WrAjYHk.exe
  2⤵
  PID:13856
- C:\Windows\System\FpgDpEB.exe
  C:\Windows\System\FpgDpEB.exe
  2⤵
  PID:14024
- C:\Windows\System\NqjXZDb.exe
  C:\Windows\System\NqjXZDb.exe
  2⤵
  PID:14088
- C:\Windows\System\OMBgOBx.exe
  C:\Windows\System\OMBgOBx.exe
  2⤵
  PID:14156
- C:\Windows\System\uxfiGFl.exe
  C:\Windows\System\uxfiGFl.exe
  2⤵
  PID:14224
- C:\Windows\System\UqGLszk.exe
  C:\Windows\System\UqGLszk.exe
  2⤵
  PID:14288
- C:\Windows\System\KilnMNe.exe
  C:\Windows\System\KilnMNe.exe
  2⤵
  PID:13352
- C:\Windows\System\RiPoVAr.exe
  C:\Windows\System\RiPoVAr.exe
  2⤵
  PID:13512
- C:\Windows\System\Ezalicc.exe
  C:\Windows\System\Ezalicc.exe
  2⤵
  PID:3160
- C:\Windows\System\gpcFrNr.exe
  C:\Windows\System\gpcFrNr.exe
  2⤵
  PID:13608
- C:\Windows\System\PgnEvvX.exe
  C:\Windows\System\PgnEvvX.exe
  2⤵
  PID:13776
- C:\Windows\System\WyatrFv.exe
  C:\Windows\System\WyatrFv.exe
  2⤵
  PID:13864
- C:\Windows\System\dRsyukv.exe
  C:\Windows\System\dRsyukv.exe
  2⤵
  PID:13992
- C:\Windows\System\PeaDkNO.exe
  C:\Windows\System\PeaDkNO.exe
  2⤵
  PID:14144
- C:\Windows\System\kTkXtNZ.exe
  C:\Windows\System\kTkXtNZ.exe
  2⤵
  PID:14308
- C:\Windows\System\ZrKtnoN.exe
  C:\Windows\System\ZrKtnoN.exe
  2⤵
  PID:13636
- C:\Windows\System\NmYZNyc.exe
  C:\Windows\System\NmYZNyc.exe
  2⤵
  PID:6044
- C:\Windows\System\CFIrIaP.exe
  C:\Windows\System\CFIrIaP.exe
  2⤵
  PID:13740
- C:\Windows\System\DKfZesm.exe
  C:\Windows\System\DKfZesm.exe
  2⤵
  PID:13912
- C:\Windows\System\aZaBbBV.exe
  C:\Windows\System\aZaBbBV.exe
  2⤵
  PID:13624
- C:\Windows\System\yxIivZJ.exe
  C:\Windows\System\yxIivZJ.exe
  2⤵
  PID:14240
- C:\Windows\System\etjlXTc.exe
  C:\Windows\System\etjlXTc.exe
  2⤵
  PID:14340
- C:\Windows\System\hLUfZbO.exe
  C:\Windows\System\hLUfZbO.exe
  2⤵
  PID:14372
- C:\Windows\System\gBfwmik.exe
  C:\Windows\System\gBfwmik.exe
  2⤵
  PID:14400
- C:\Windows\System\jiGrDEy.exe
  C:\Windows\System\jiGrDEy.exe
  2⤵
  PID:14428
- C:\Windows\System\TfAIdta.exe
  C:\Windows\System\TfAIdta.exe
  2⤵
  PID:14456
- C:\Windows\System\GbUDgrE.exe
  C:\Windows\System\GbUDgrE.exe
  2⤵
  PID:14484
- C:\Windows\System\eFteKcV.exe
  C:\Windows\System\eFteKcV.exe
  2⤵
  PID:14512
- C:\Windows\System\JgWkwxT.exe
  C:\Windows\System\JgWkwxT.exe
  2⤵
  PID:14540
- C:\Windows\System\UeVgjgG.exe
  C:\Windows\System\UeVgjgG.exe
  2⤵
  PID:14568
- C:\Windows\System\JDuvyoj.exe
  C:\Windows\System\JDuvyoj.exe
  2⤵
  PID:14596
- C:\Windows\System\dqNHFlG.exe
  C:\Windows\System\dqNHFlG.exe
  2⤵
  PID:14624
- C:\Windows\System\tgmgjFk.exe
  C:\Windows\System\tgmgjFk.exe
  2⤵
  PID:14752
- C:\Windows\System\HwVoOWS.exe
  C:\Windows\System\HwVoOWS.exe
  2⤵
  PID:14768
- C:\Windows\System\HuPcDGd.exe
  C:\Windows\System\HuPcDGd.exe
  2⤵
  PID:14784
- C:\Windows\System\tHJWrhE.exe
  C:\Windows\System\tHJWrhE.exe
  2⤵
  PID:14800
- C:\Windows\System\eJFXJry.exe
  C:\Windows\System\eJFXJry.exe
  2⤵
  PID:14816
- C:\Windows\System\OuQANbS.exe
  C:\Windows\System\OuQANbS.exe
  2⤵
  PID:14832
- C:\Windows\System\WnJrkjz.exe
  C:\Windows\System\WnJrkjz.exe
  2⤵
  PID:14848
- C:\Windows\System\AeRuvkY.exe
  C:\Windows\System\AeRuvkY.exe
  2⤵
  PID:14864
- C:\Windows\System\AAtoFxG.exe
  C:\Windows\System\AAtoFxG.exe
  2⤵
  PID:14880
- C:\Windows\System\BnVFNDW.exe
  C:\Windows\System\BnVFNDW.exe
  2⤵
  PID:14900
- C:\Windows\System\YuhOAUs.exe
  C:\Windows\System\YuhOAUs.exe
  2⤵
  PID:14928
- C:\Windows\System\IreiyYo.exe
  C:\Windows\System\IreiyYo.exe
  2⤵
  PID:14952
- C:\Windows\System\xPtItyh.exe
  C:\Windows\System\xPtItyh.exe
  2⤵
  PID:14992
- C:\Windows\System\WUVDWjm.exe
  C:\Windows\System\WUVDWjm.exe
  2⤵
  PID:15092
- C:\Windows\System\leOWzOI.exe
  C:\Windows\System\leOWzOI.exe
  2⤵
  PID:15128
- C:\Windows\System\uVdljJM.exe
  C:\Windows\System\uVdljJM.exe
  2⤵
  PID:15164
- C:\Windows\System\wrmXgfV.exe
  C:\Windows\System\wrmXgfV.exe
  2⤵
  PID:15228
- C:\Windows\System\Saiiflt.exe
  C:\Windows\System\Saiiflt.exe
  2⤵
  PID:15244
- C:\Windows\System\jUxGaJA.exe
  C:\Windows\System\jUxGaJA.exe
  2⤵
  PID:15272
- C:\Windows\System\vCKkHxh.exe
  C:\Windows\System\vCKkHxh.exe
  2⤵
  PID:15304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eirhaudc.r5y.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\FewgRoB.exe

Filesize
1.9MB

MD5
8c1e0d301996d8ce44add8de954008ca

SHA1
b9f6be3e03a11abcb717a76212fe4e7eaab03be3

SHA256
112aae7b200f198fa826f42b8b6de77d842642488d1602ce9d036dc1dc92cfa2

SHA512
cb8bee6714d75d4a79206d136f94c0c741ee1360aa04c6f7ace4756a288898a8ed1eb2fd30c8cd5212cde15e1b4c508ab97d7a2e3797c73ec0fe4d0678c0a899

Download Submit
C:\Windows\System\HjSTkxX.exe

Filesize
1.9MB

MD5
0bc6340e6206c4304f767dec2a52d4fe

SHA1
f602b5a87cd07c2dfd3d16d0767ae9201fc38f6e

SHA256
63d741f87f18524f882c239beb20e5b7624d2d7d2ca7baae83dfa650372c42df

SHA512
8838ceaee104355e871410a58d3aee4ff2aa6f95ce43af7c1540f8dd1fa28e332f6a963f6e4c86ec10a962d44ed719fa60d7cbfe508657c3df9ee62c1eddecc6

Download Submit
C:\Windows\System\IPXlNsj.exe

Filesize
1.9MB

MD5
c05d306157b50f9dc194b9cf064b81a6

SHA1
5d832f09aa12d4912dfbb87c6e01b8a3355a92de

SHA256
3460ef5d10819a5f7eead1790b3773d93ddc6ef0fc7538e1ecfb3bbcdbb1eeab

SHA512
86729fa8701341a5287f9a6dfb2d55c8815dbacfd7800d9e6418fd8cb7701475484d26811e775e69499f4a255dfd39c060da33466e3805be96f477097b795852

Download Submit
C:\Windows\System\Lhyazhx.exe

Filesize
1.9MB

MD5
b6b6266d332eeb4d1d7fc150983eddba

SHA1
ea62323f76db58521bb769cb13852f8ba608da2e

SHA256
9d1fc0f30dcb7dcd9d93de0e242c5066a611a34f1bb2eff0ab9a05a0a78c30f9

SHA512
9c47f858b1d3fdd024accb31a3f0099e6fcfc2225b0753d8511b3475eee27084b1fdca93efbeba719935c19ef576b8b68a8c6da34c1d414a0d403c804d42ddc9

Download Submit
C:\Windows\System\PTovHwE.exe

Filesize
1.9MB

MD5
01b27ae3e477aa0b9c37d86a223aed7e

SHA1
364244759b5d8b5a7a623550bac140c918bc9c48

SHA256
1dd51ea66377d582176352ad95c027b98435a683b5358719b64aafd444da5053

SHA512
d74f2b1034256d3111059f22a87a82e1454e2bb005458d467448ebe8025002822a80b2a06588b6d0e396d93cb3aa6451f97b69e70f1d2ddfdf4967b5f91caa12

Download Submit
C:\Windows\System\PVtoHks.exe

Filesize
1.9MB

MD5
b587b0c74a313a3ccbbd8b9357ac55b4

SHA1
a76abf6b159da35ebc86d368cdae0e6a0eacde11

SHA256
4eda759699c500010300a652e3d8ef46a3e689eade5b5a3ac26b119aed629887

SHA512
0e372ad4b8f6baffc1079723f851b4c3f42248a243c80259b7dbd44b033e715cc750d7076455681baebb5253fce81f6b676698fa2c4d578774f8ceafdf058763

Download Submit
C:\Windows\System\PhfQnvL.exe

Filesize
1.9MB

MD5
22431ab3afa7f7ad9f2be1bf3b584722

SHA1
b077a0f1ad7459c3337a26294455439d84a9fcab

SHA256
b31ce421ac62c96708d2f9e2a5d19d6ffc56afcc93d5983bdf65adb4ab13dc5e

SHA512
53507ee9c5e960d403b60796f8cbe0be677b84f6a68015c72e432afd2689b581e4187e65ef756ddda51cfc242ca28b0c25125a6b331ef5976cb99ed84f7507dd

Download Submit
C:\Windows\System\ROpgepa.exe

Filesize
1.9MB

MD5
5619612e813271f9888002f580577dc9

SHA1
81b025be1a9c2b256a8d1616303e27701350fcef

SHA256
009a59457363f6b84aab140b20210dbc23161d2987445105e4dc5cee2ab65e5a

SHA512
3ca4bfb2d5eb1b0375c9eb6a68fab2ff1b10369eb8d3fb734719d4a1e352c636097c96e52e4ee7a2913ed960c1bdb91c2ee7a76948883c09103a0240f21aeba0

Download Submit
C:\Windows\System\TzkkDMf.exe

Filesize
1.9MB

MD5
57e7efd585a3ab71533bf07ad1fda8a6

SHA1
a5ff3ca694f7beeb9f836ce4c2e03c1f41beff07

SHA256
d9746c8ec1258f78e10503732f37a53487b826da7f6a13b11d1d5df9cbbb8560

SHA512
e8ec132ad93d8aad352f9166e237534b353ad68911eb63dab1d3a98f3fc347789062f2bd723699654fddf664ab48803f8752a32e842ad9bc56e8c58dc5b41aa9

Download Submit
C:\Windows\System\UDEvaTs.exe

Filesize
1.9MB

MD5
c6e7203fa890e0806fa7e702fb001dd4

SHA1
9826e02304a06fd9fd25d5d8a39c9f1437fc9880

SHA256
d3ade48d2ee4df02bc944ec4418c3e8d13691f12b0eb54c5c05391684eb6fd55

SHA512
75a27c0878e432dbc21f63dfa904af9bbcb3b2da71c07f7f9cf20d560e55323a8d23260e2ce8a174b2f39a46e2eaa9b3aaef8660ba6aef94b9493090da827c6b

Download Submit
C:\Windows\System\UsFWDQg.exe

Filesize
1.9MB

MD5
59be04ff5132bef18650dfd32fd0b38a

SHA1
816385ea0cbcd54b862785e0492ff735946aabc8

SHA256
2b3642578426adb68ea4439081bec1fcf0b4f62708f1bf6a0ebf3de97fe7749d

SHA512
5ba4cad7819e2bf62954f6b5eabcbf9b060ec626ea9fbaf9efece56eb7857918d2ff2c602dd7bcfcad1ebc14c0f743624c5d2c88b77efab56bb844eccf65a6b8

Download Submit
C:\Windows\System\WmwWTPX.exe

Filesize
1.9MB

MD5
b1625270fdc6c57b0bd3fc95ce91cb67

SHA1
0987eb06b913bf66568abb750b906efab6c48f5c

SHA256
15282be51830fb2f8a80a7c2dd5900119238345526c44ca90872f3c198a88d5e

SHA512
bab6954265326c091cf30045ba2b715f7cde35a650a7a3283cbb0482eb355769df2e7cbcb028ba3e7ab08c317f0e77eeef976f1992d22d22b236d9277147a27b

Download Submit
C:\Windows\System\XAuNxUH.exe

Filesize
1.9MB

MD5
f9c409a5cb5ccca3951c06a00874d205

SHA1
9094b3890201e4ce9154b886cbfcc69b1ad50cf9

SHA256
4d71a29bb41824c62a7a982adcf4e0b5cc9053c80cbecdca945c450eb0fb8aa3

SHA512
3042b62a2ffcd2da3eef8cce4fc0943fb9310966b151f390b961c40bcc1853d2964b099c040aad567e53f30b78e6d01906c942d9c95601f9a1eacaa074fbe96d

Download Submit
C:\Windows\System\XteiSni.exe

Filesize
1.9MB

MD5
6a71b822f164ff26dc017a9b88213d1c

SHA1
536a71c21b8f3a8f6604b29150e6600c9251bbe9

SHA256
c65e3d34f2ff4d7e8a965694c2ad04121e3b1d775ff111ed416f848e9eda50cc

SHA512
4f19bb48d92f6c343122c51b7501b75ec023a652e1a342a125baebbb88e1e2991ed24be519cb448d2d15bc1f37f2e2f7296b323ce821ef9abbab0403eec31073

Download Submit
C:\Windows\System\ZQHqtUL.exe

Filesize
1.9MB

MD5
ea2bc121a9bba82e1d189b1d1888e48e

SHA1
058d11b7763758384bd6a49e1aa4a66a356251c0

SHA256
9e8d0303d5b9146037b2d2df5f462787982bf322e85548873ec8d1eb033fae5d

SHA512
fc503638f55196c1f24c93ebb3ae6f8f2f0fc414027115e49c72c037a7eaca0da2dfdafc25e7e25f1726ad5d083276cb4ca39de1f27b6bb2229ad6b613f5d2c7

Download Submit
C:\Windows\System\ZeOjDMv.exe

Filesize
1.9MB

MD5
267a53e6b4a8a61d42042350e3bf87ca

SHA1
b55854897dece4ea19deb861c2524980fedfcec3

SHA256
57287f23e642d93aa8d3eaeab6e3fcb481500ffc31dbd87b522890d7b798a0b9

SHA512
3c0225c38a51739db001fba15314c5fb73b313a4acb7d782cb780f3531edc00c2ebded2560dee5af69ac4c23d5afff44e755a6fe5304d048079216afee4ef986

Download Submit
C:\Windows\System\afVMGjx.exe

Filesize
1.9MB

MD5
d78446beac40c83f26da82af4cc4e0e9

SHA1
b8de627d2b8938bcb4d3ac36f08b30d79787b70e

SHA256
6a4ec854efa80f23625cddcaa92f6616a98437f5a3ea8562c6b5dc02eb56b9f8

SHA512
24f60245a9e6d14e00fb2793e7aa60c8e3b0f52edffebcd0bfdeae4a3c229a45807925c3d78dd92afe8960b1b30fb187409c9d8dab050eb108579921981cd506

Download Submit
C:\Windows\System\dqclTwx.exe

Filesize
1.9MB

MD5
201988933fc03b5c836dbbe7833c3ff5

SHA1
995fc8c9549f3fae509678003217a8d52ba25fbb

SHA256
4ef62c130fe275363c59f0dfa1a2237cf29c964d245d921d7ed3b73463c647d8

SHA512
0a616cec4a8f1b27268235183ad92208f890fcb65f4cb36e4c0d13c972d25624d2a6d026304ac54ff0894a9c56b55e43a2eb3873248e091b48255764351c4ae5

Download Submit
C:\Windows\System\hLptCWY.exe

Filesize
1.9MB

MD5
96a34c0fc1683883ae75c476a074e211

SHA1
ed6f4922d813015f3d9fa9682e510385744cabfb

SHA256
5eea457ef00df6ba0088e3f7b8a2b6e59e567bfad0342902231439a435e3f8b2

SHA512
9ee874ce039b3a403a8b13ec68ed46e6bb16ffac25fe3db79111662c45b4552affb9fc2081422bff3d15387179e0b57040af3a266bd27e835b6529718ff6b76b

Download Submit
C:\Windows\System\jXIhMxc.exe

Filesize
1.9MB

MD5
165c97246c2662b6855df18d41433cbd

SHA1
cedc512ff34b21b99c1f30c5033910e196af3dad

SHA256
82809468f11e554532d8436917f4bd587a4b47b53b16460fa3bb3b6c6d2186ea

SHA512
075468dfdf0f1e670ea95d57420070f9d314335cc7d0f022a9758d291841d854e9c316e7cee9cb3107bc5c2da3ab8d9ce4e8fe13dcce7e4150771354fa01bd9e

Download Submit
C:\Windows\System\jwxNfgC.exe

Filesize
1.9MB

MD5
d6ce1ec79b2554445b85b8d8f62b75ef

SHA1
8f38f351eeeba6724cba1b29b1f53dc8047d0530

SHA256
ceb307c322e87610519a7cb6c13ee57a9b1c135d0321f53f5dbb7ff1e56ba8af

SHA512
3c1028978b8f0052a6118c44053c726a203a8a23a1efe786bd1c683cf751e3ca8a01589c23887b7e24561b66756dc6c6726206c40b62de1d6a20e7581ec50e29

Download Submit
C:\Windows\System\mByVyWo.exe

Filesize
1.9MB

MD5
172f965d6a0a58d65be333372f306507

SHA1
928beefe39657191d75cb89cf91e150dbe036ed1

SHA256
4fa0734475df254fb8e8f66ffdf16f9fe123339625367778c716514725fa2996

SHA512
af54a37711e77e9dfe7bb2be0e972fb61af2d4359ec50a142280ad3859c65bb4f8c5e51c09dc8dcdde5f02e70604817adf743f87f1ee5f9f676a61dcd493b485

Download Submit
C:\Windows\System\nRKOfxR.exe

Filesize
1.9MB

MD5
796e45550de3c7a85b49829709619e11

SHA1
a907ee2cbe1d37ede1d327a8f2ab601184f0dd3d

SHA256
d93ff3408d399ec5dd50d0c596162bf052bb7a43b70d390416f64b0dc8924b33

SHA512
d64bf74d74d4af2a16f1a358cea5a24269a0bc34c2543bcceb44ea91cc211638a22e3f6a2f7de399203b1abcea9a61951d87463b44f712d1ee58e8c976845251

Download Submit
C:\Windows\System\pKeRcmF.exe

Filesize
1.9MB

MD5
3cc9b154cd56fbe70685044ed613fcc3

SHA1
3a88ce07ae81a822369b6b84083cc35ff1ee55df

SHA256
d2e7269110f643bf455542cc94ba294c160b06a56e332853576964b87fbf96dc

SHA512
47df310c6558a990fb5d21d9eb170ee4ddd30a488004cacab72a27344c5d4e98a1031b70b868162f62b7ef520c4c2ae1f61d9fc62b3962a7932fa2e7bd3b51f0

Download Submit
C:\Windows\System\rhzUGtP.exe

Filesize
1.9MB

MD5
0a0066dd255220e7c04467260eaf60c8

SHA1
bdd1774c5713a8acd347a7be168abf530ae1090d

SHA256
954d51b3d7f6fe6d3df8b06c406994d87f82df67916c751c2baf197e55d31705

SHA512
b1d22de467ddc7a5631b8783784a01f6f29af4b745959049604f19bb59edd4b49e456eb8ec1eb42818b0834dc0819744073c214c3cdbb557a48c0eff53bec96d

Download Submit
C:\Windows\System\suleDbj.exe

Filesize
1.9MB

MD5
5ebeae4e8f7ef1badbdf373408c0cf75

SHA1
fe0e4489ff2aa628ad0681ad91a183d490786a2e

SHA256
d0ce0fe400e170b8568db2da1ea0d2938be5e23537d9f4f4892b408505cacd1b

SHA512
bfb99aa7c6268e8602488ef9359714b224981b172dd804608322623b3b2045b70b92f80195ba425ac338b9930d5adee19d5e94b95486f49c671176da88fb4e60

Download Submit
C:\Windows\System\tLyQQUi.exe

Filesize
1.9MB

MD5
97629c2a8a31d55f0a5d2c39686879e7

SHA1
aaa30939b22ee01e26ddd15cd76a5093f3f18260

SHA256
07a4304cd6f8d0bc0888751969a464097db20100efc945cd27bdd3d5b705f8f2

SHA512
7409594051f0a9c8698f6b56683f26fbf91f24050f48e76863f5670bf67efc1fcd45531bfd32b7eea582b4f046aef9e638bd6c9a8ecd3b37dda06d6efbae5781

Download Submit
C:\Windows\System\uAgoHXv.exe

Filesize
1.9MB

MD5
17fd4675a9a2017749702397c7e18397

SHA1
cd17a96ac2542dd76f487d582061257915dfc724

SHA256
d89a056e1f966e029e458d7b10f85b3a907f404d484c40cf2f4732a6cd19c1a0

SHA512
18f6251e6031bc9d888aa732eee26b8868f44c22666c938f92a9d3207b11aee98984e257b50a0a89c2047da26a139811327181be5ffc3dc50c9cfee204515a59

Download Submit
C:\Windows\System\uvwGFjv.exe

Filesize
1.9MB

MD5
80eb4254171a9456d355d847d95470f7

SHA1
b0b0bffa98b7687093e6d11004575c4472cd6d95

SHA256
e6bd11de51867e9c729a09f0925bf24a51225093e46195283865c5ab50ba2348

SHA512
645c37357f52db9ed2f63b9db3ebaccf24fcca72b51a7d18f070aff6893493795187c93723fead0c65d3d61ce0d16b38916f29bf4bda79900aea794199d8fd22

Download Submit
C:\Windows\System\vqyNpKi.exe

Filesize
18B

MD5
245dee33bd0829fb0a14fffbb01cddca

SHA1
3098465efbb0ab58d084dea73fb53b7464aa2124

SHA256
42ab9954ae85f062ea70b5a38d7cb35251b9594624f80f499a57a579cabb5d86

SHA512
4a249b410305275b4e8f1049bfb6debe0c906ca24cdd1c084f91263bd1208ad51b8937135ff9506b71885993cc7bafe2c69d5ba8bf11fa3ad12e247f4d803429

Download Submit
C:\Windows\System\xjVbZVt.exe

Filesize
1.9MB

MD5
e315315a46829eb3d2ce20d3a9b516a2

SHA1
ac35c43c701c10387e7e5dc8bbd760711f6acc52

SHA256
5cdd852b7a3abe192b92b5908b8ae5ca750c142a206bcbd7ae745c07c6b4b005

SHA512
741682ca707096b8c500ef761c9f10634bccbb3dab25e3a703e308719be6af12493ee14773d318f7fa2e8227bc1785379a815ea5ae19c8553eac5032394e2cb0

Download Submit
C:\Windows\System\ygyTZYU.exe

Filesize
1.9MB

MD5
185d3a8e5b35af3445ee6c03d4984845

SHA1
b1293f67e8e6de943830f54d13f4bbe67a51c7ca

SHA256
3f4299df5eff917d5f718003641d39da2cae96d44028f71526528ea47fb9214d

SHA512
38ed10f1cd55378a1d8b2685add888b3a3f6fad768bb71e5682a6d785185876b462225ff79af65920aa4b4344dcfdbfb2218706723fa10ec3157671198b37230

Download Submit
C:\Windows\System\zhAZWqi.exe

Filesize
1.9MB

MD5
8bc8bf43d5b819320afe6e299d6dd39f

SHA1
d15bfa6498ffd81f026110938dd60bd27f976333

SHA256
f1076763ca360c8b4a694c3c010a53a4ef4f41cb222d91f8183848807c162a02

SHA512
99bd57c53ed0291d8ebd54e9a0ee877bc0d389fd53d3950d0f1d31086f5a7e5bb3f81a756e861f8ed4898999fa93c50485757235a215d9b92dc0212c815323d3

Download Submit
C:\Windows\System\zxQyIXr.exe

Filesize
1.9MB

MD5
4f2e7b5d913f7179b3dcb30eea590660

SHA1
6b28b4ef09757e1ddbeb47304b4bf53b04d991a0

SHA256
236fddeda6ba40dfe0def5a1757d19d8670a448051e4108cabf3f6d48accc07e

SHA512
30f206c3c3cbfafccad08a47923059f3924860a4d717712cd6dadbd9e4185f8abfd31429ba2979615a0e6b54f992d348df5220ef3d26e89dc0cd835726bff3d1

Download Submit
memory/708-23-0x00007FF734120000-0x00007FF734512000-memory.dmp

Filesize
3.9MB

Download
memory/1200-0-0x00007FF758230000-0x00007FF758622000-memory.dmp

Filesize
3.9MB

Download
memory/1200-1-0x0000029B36F40000-0x0000029B36F50000-memory.dmp

Filesize
64KB

Download
memory/1264-55-0x00007FF726A00000-0x00007FF726DF2000-memory.dmp

Filesize
3.9MB

Download
memory/1624-521-0x00007FF76E680000-0x00007FF76EA72000-memory.dmp

Filesize
3.9MB

Download
memory/1764-40-0x00007FF697A50000-0x00007FF697E42000-memory.dmp

Filesize
3.9MB

Download
memory/1800-512-0x00007FF6E2240000-0x00007FF6E2632000-memory.dmp

Filesize
3.9MB

Download
memory/1888-17-0x00007FF65B710000-0x00007FF65BB02000-memory.dmp

Filesize
3.9MB

Download
memory/2064-27-0x0000022C9A6C0000-0x0000022C9A6D0000-memory.dmp

Filesize
64KB

Download
memory/2064-26-0x0000022C9A6C0000-0x0000022C9A6D0000-memory.dmp

Filesize
64KB

Download
memory/2064-45-0x0000022C9AA20000-0x0000022C9AA42000-memory.dmp

Filesize
136KB

Download
memory/2064-15-0x00007FFFD1E50000-0x00007FFFD2911000-memory.dmp

Filesize
10.8MB

Download
memory/2168-61-0x00007FF7805A0000-0x00007FF780992000-memory.dmp

Filesize
3.9MB

Download
memory/2296-515-0x00007FF6653C0000-0x00007FF6657B2000-memory.dmp

Filesize
3.9MB

Download
memory/2380-519-0x00007FF6F8790000-0x00007FF6F8B82000-memory.dmp

Filesize
3.9MB

Download
memory/2440-523-0x00007FF6ABD90000-0x00007FF6AC182000-memory.dmp

Filesize
3.9MB

Download
memory/2524-65-0x00007FF695DF0000-0x00007FF6961E2000-memory.dmp

Filesize
3.9MB

Download
memory/2832-520-0x00007FF642C00000-0x00007FF642FF2000-memory.dmp

Filesize
3.9MB

Download
memory/3124-516-0x00007FF6C6E60000-0x00007FF6C7252000-memory.dmp

Filesize
3.9MB

Download
memory/3472-62-0x00007FF6634C0000-0x00007FF6638B2000-memory.dmp

Filesize
3.9MB

Download
memory/3868-5387-0x00007FF776600000-0x00007FF7769F2000-memory.dmp

Filesize
3.9MB

Download
memory/3868-70-0x00007FF776600000-0x00007FF7769F2000-memory.dmp

Filesize
3.9MB

Download
memory/4188-514-0x00007FF6E77D0000-0x00007FF6E7BC2000-memory.dmp

Filesize
3.9MB

Download
memory/4432-522-0x00007FF7AA470000-0x00007FF7AA862000-memory.dmp

Filesize
3.9MB

Download
memory/4432-6523-0x00007FF7AA470000-0x00007FF7AA862000-memory.dmp

Filesize
3.9MB

Download
memory/4612-518-0x00007FF6DD130000-0x00007FF6DD522000-memory.dmp

Filesize
3.9MB

Download
memory/4808-513-0x00007FF71BD70000-0x00007FF71C162000-memory.dmp

Filesize
3.9MB

Download
memory/4812-517-0x00007FF7CF200000-0x00007FF7CF5F2000-memory.dmp

Filesize
3.9MB

Download
memory/4812-6478-0x00007FF7CF200000-0x00007FF7CF5F2000-memory.dmp

Filesize
3.9MB

Download
memory/4936-59-0x00007FF7012E0000-0x00007FF7016D2000-memory.dmp

Filesize
3.9MB

Download