xmrig | 6f138b13c465933f9959e1af0c7f8d24ad11c3cffbaff2554e90f40ac425f5f7

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
Size

1.9MB
MD5

05b6058cd308310de641e24b99a8a59f
SHA1

f9303c13862be370b5d2aa912ff7c16434c4ae7d
SHA256

6f138b13c465933f9959e1af0c7f8d24ad11c3cffbaff2554e90f40ac425f5f7
SHA512

862193061ebc0eca7722cdae711e42ade558f1f73c77e7e43abea1dab7cdeb08e76dc4547d03778459ea5fcbf57fc021f1564b0e8bace4fdd0bb6e6596632bf7
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Uf:NABu

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral2/memory/4984-28-0x00007FF7063E0000-0x00007FF7067D2000-memory.dmp	xmrig
behavioral2/memory/1528-191-0x00007FF68DC40000-0x00007FF68E032000-memory.dmp	xmrig
behavioral2/memory/4620-218-0x00007FF6F74B0000-0x00007FF6F78A2000-memory.dmp	xmrig
behavioral2/memory/3172-223-0x00007FF64C800000-0x00007FF64CBF2000-memory.dmp	xmrig
behavioral2/memory/4256-232-0x00007FF752200000-0x00007FF7525F2000-memory.dmp	xmrig
behavioral2/memory/4656-248-0x00007FF7DA090000-0x00007FF7DA482000-memory.dmp	xmrig
behavioral2/memory/3996-257-0x00007FF669C00000-0x00007FF669FF2000-memory.dmp	xmrig
behavioral2/memory/2372-260-0x00007FF6B7790000-0x00007FF6B7B82000-memory.dmp	xmrig
behavioral2/memory/2756-259-0x00007FF683FF0000-0x00007FF6843E2000-memory.dmp	xmrig
behavioral2/memory/2996-258-0x00007FF685B60000-0x00007FF685F52000-memory.dmp	xmrig
behavioral2/memory/4084-256-0x00007FF6417A0000-0x00007FF641B92000-memory.dmp	xmrig
behavioral2/memory/960-255-0x00007FF6AF4E0000-0x00007FF6AF8D2000-memory.dmp	xmrig
behavioral2/memory/2196-251-0x00007FF773880000-0x00007FF773C72000-memory.dmp	xmrig
behavioral2/memory/3152-247-0x00007FF786AA0000-0x00007FF786E92000-memory.dmp	xmrig
behavioral2/memory/3756-244-0x00007FF662C90000-0x00007FF663082000-memory.dmp	xmrig
behavioral2/memory/1532-215-0x00007FF617680000-0x00007FF617A72000-memory.dmp	xmrig
behavioral2/memory/1720-156-0x00007FF788610000-0x00007FF788A02000-memory.dmp	xmrig
behavioral2/memory/3220-154-0x00007FF7B32E0000-0x00007FF7B36D2000-memory.dmp	xmrig
behavioral2/memory/4648-121-0x00007FF7372A0000-0x00007FF737692000-memory.dmp	xmrig
behavioral2/memory/2984-93-0x00007FF7E46E0000-0x00007FF7E4AD2000-memory.dmp	xmrig
behavioral2/memory/892-4346-0x00007FF69EB80000-0x00007FF69EF72000-memory.dmp	xmrig
behavioral2/memory/2112-4386-0x00007FF6E32A0000-0x00007FF6E3692000-memory.dmp	xmrig
behavioral2/memory/4648-4456-0x00007FF7372A0000-0x00007FF737692000-memory.dmp	xmrig
behavioral2/memory/1528-4528-0x00007FF68DC40000-0x00007FF68E032000-memory.dmp	xmrig
behavioral2/memory/1532-4524-0x00007FF617680000-0x00007FF617A72000-memory.dmp	xmrig
behavioral2/memory/2096-4523-0x00007FF76D860000-0x00007FF76DC52000-memory.dmp	xmrig
behavioral2/memory/3996-4515-0x00007FF669C00000-0x00007FF669FF2000-memory.dmp	xmrig
behavioral2/memory/2996-4558-0x00007FF685B60000-0x00007FF685F52000-memory.dmp	xmrig
behavioral2/memory/3172-4555-0x00007FF64C800000-0x00007FF64CBF2000-memory.dmp	xmrig
behavioral2/memory/2372-4570-0x00007FF6B7790000-0x00007FF6B7B82000-memory.dmp	xmrig
behavioral2/memory/3152-4581-0x00007FF786AA0000-0x00007FF786E92000-memory.dmp	xmrig
behavioral2/memory/2196-4567-0x00007FF773880000-0x00007FF773C72000-memory.dmp	xmrig
behavioral2/memory/4656-4562-0x00007FF7DA090000-0x00007FF7DA482000-memory.dmp	xmrig
behavioral2/memory/4620-4552-0x00007FF6F74B0000-0x00007FF6F78A2000-memory.dmp	xmrig
behavioral2/memory/1720-4545-0x00007FF788610000-0x00007FF788A02000-memory.dmp	xmrig
behavioral2/memory/2756-4554-0x00007FF683FF0000-0x00007FF6843E2000-memory.dmp	xmrig
behavioral2/memory/3756-4548-0x00007FF662C90000-0x00007FF663082000-memory.dmp	xmrig
behavioral2/memory/2984-4460-0x00007FF7E46E0000-0x00007FF7E4AD2000-memory.dmp	xmrig
behavioral2/memory/3220-4458-0x00007FF7B32E0000-0x00007FF7B36D2000-memory.dmp	xmrig
behavioral2/memory/2180-4410-0x00007FF69FB70000-0x00007FF69FF62000-memory.dmp	xmrig
behavioral2/memory/960-4395-0x00007FF6AF4E0000-0x00007FF6AF8D2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4720	sGhflbT.exe
4984	rCUFryC.exe
892	KEpdzbB.exe
960	bfOlTjL.exe
2096	WcaphKb.exe
2180	FXJjFAT.exe
2984	CXoicOn.exe
4084	bXadRZy.exe
4648	iaqYXVC.exe
3220	dBfPGiL.exe
1720	gxetePm.exe
1528	nZCaFvc.exe
1532	ecIHoZx.exe
3996	uapzUdU.exe
4620	fnlCRYT.exe
3172	cYRPILA.exe
2996	IEuqIDg.exe
2756	kgQUziq.exe
4256	mEWOYUe.exe
3756	IeAkrph.exe
3152	YpStabU.exe
4656	bwqLzKD.exe
2196	IFMfnrm.exe
2372	JSwCmbL.exe
4564	qyErZXM.exe
4740	NksFVSa.exe
5048	YVKzYxY.exe
4296	BPCxGvA.exe
1988	dMQgkhY.exe
640	lhoBulb.exe
4352	DGNBfXv.exe
4052	lKCeahJ.exe
4896	xUVLhCo.exe
940	HuibiIz.exe
1712	fuoylCN.exe
4928	GfoRxNQ.exe
224	Cylfwuc.exe
3408	ASMnLQK.exe
4412	GIGTCTQ.exe
3644	cllZDXb.exe
2204	pOpSiAK.exe
2424	ABaGiVR.exe
1652	REBZqvM.exe
4128	YKjUeCO.exe
388	bkecvEr.exe
1044	gnmZmEv.exe
4764	DICjKNh.exe
2084	DSaPWEY.exe
4284	DYAEVCX.exe
652	yqYnZUX.exe
1508	eUdyyWp.exe
2920	MTzYaQY.exe
556	sMdtLCr.exe
2552	qrcQRrx.exe
4460	TLzZmEi.exe
4108	eCdHqBU.exe
1852	HuhByOs.exe
3248	HrgZgpU.exe
3096	TXmMHRO.exe
2684	fXhRGyL.exe
4792	wiyLIbE.exe
1760	ekkMKHW.exe
4384	jplTShf.exe
444	lWsDLGK.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2112-0-0x00007FF6E32A0000-0x00007FF6E3692000-memory.dmp	upx
behavioral2/files/0x000a000000023b8a-10.dat	upx
behavioral2/files/0x000a000000023b8c-24.dat	upx
behavioral2/memory/4984-28-0x00007FF7063E0000-0x00007FF7067D2000-memory.dmp	upx
behavioral2/files/0x000a000000023b94-54.dat	upx
behavioral2/files/0x000a000000023b97-83.dat	upx
behavioral2/files/0x000a000000023b98-84.dat	upx
behavioral2/files/0x000a000000023b95-108.dat	upx
behavioral2/files/0x000a000000023ba9-165.dat	upx
behavioral2/memory/1528-191-0x00007FF68DC40000-0x00007FF68E032000-memory.dmp	upx
behavioral2/memory/4620-218-0x00007FF6F74B0000-0x00007FF6F78A2000-memory.dmp	upx
behavioral2/memory/3172-223-0x00007FF64C800000-0x00007FF64CBF2000-memory.dmp	upx
behavioral2/memory/4256-232-0x00007FF752200000-0x00007FF7525F2000-memory.dmp	upx
behavioral2/memory/4656-248-0x00007FF7DA090000-0x00007FF7DA482000-memory.dmp	upx
behavioral2/memory/3996-257-0x00007FF669C00000-0x00007FF669FF2000-memory.dmp	upx
behavioral2/memory/2372-260-0x00007FF6B7790000-0x00007FF6B7B82000-memory.dmp	upx
behavioral2/memory/2756-259-0x00007FF683FF0000-0x00007FF6843E2000-memory.dmp	upx
behavioral2/memory/2996-258-0x00007FF685B60000-0x00007FF685F52000-memory.dmp	upx
behavioral2/memory/4084-256-0x00007FF6417A0000-0x00007FF641B92000-memory.dmp	upx
behavioral2/memory/960-255-0x00007FF6AF4E0000-0x00007FF6AF8D2000-memory.dmp	upx
behavioral2/memory/2196-251-0x00007FF773880000-0x00007FF773C72000-memory.dmp	upx
behavioral2/memory/3152-247-0x00007FF786AA0000-0x00007FF786E92000-memory.dmp	upx
behavioral2/memory/3756-244-0x00007FF662C90000-0x00007FF663082000-memory.dmp	upx
behavioral2/memory/1532-215-0x00007FF617680000-0x00007FF617A72000-memory.dmp	upx
behavioral2/files/0x000b000000023b87-185.dat	upx
behavioral2/files/0x000a000000023ba7-184.dat	upx
behavioral2/files/0x000a000000023ba6-176.dat	upx
behavioral2/files/0x000a000000023bab-173.dat	upx
behavioral2/files/0x000a000000023baa-172.dat	upx
behavioral2/files/0x000a000000023ba8-164.dat	upx
behavioral2/files/0x000a000000023ba2-160.dat	upx
behavioral2/files/0x000a000000023b9a-158.dat	upx
behavioral2/memory/1720-156-0x00007FF788610000-0x00007FF788A02000-memory.dmp	upx
behavioral2/memory/3220-154-0x00007FF7B32E0000-0x00007FF7B36D2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba5-149.dat	upx
behavioral2/files/0x000a000000023ba0-145.dat	upx
behavioral2/files/0x000a000000023b9f-144.dat	upx
behavioral2/files/0x000a000000023ba4-141.dat	upx
behavioral2/files/0x000a000000023b9e-168.dat	upx
behavioral2/files/0x000a000000023ba3-132.dat	upx
behavioral2/files/0x000a000000023b9d-129.dat	upx
behavioral2/files/0x000a000000023b99-142.dat	upx
behavioral2/memory/4648-121-0x00007FF7372A0000-0x00007FF737692000-memory.dmp	upx
behavioral2/files/0x000a000000023b96-112.dat	upx
behavioral2/files/0x000a000000023b9c-101.dat	upx
behavioral2/files/0x000a000000023b9b-98.dat	upx
behavioral2/files/0x000a000000023b93-96.dat	upx
behavioral2/files/0x000a000000023ba1-127.dat	upx
behavioral2/files/0x000a000000023b92-78.dat	upx
behavioral2/files/0x000a000000023b91-74.dat	upx
behavioral2/files/0x000a000000023b90-72.dat	upx
behavioral2/memory/2984-93-0x00007FF7E46E0000-0x00007FF7E4AD2000-memory.dmp	upx
behavioral2/files/0x000a000000023b8d-64.dat	upx
behavioral2/memory/2180-60-0x00007FF69FB70000-0x00007FF69FF62000-memory.dmp	upx
behavioral2/files/0x000a000000023b8f-51.dat	upx
behavioral2/files/0x000a000000023b8e-65.dat	upx
behavioral2/memory/2096-52-0x00007FF76D860000-0x00007FF76DC52000-memory.dmp	upx
behavioral2/files/0x000a000000023b8b-35.dat	upx
behavioral2/memory/892-33-0x00007FF69EB80000-0x00007FF69EF72000-memory.dmp	upx
behavioral2/files/0x000b000000023b86-21.dat	upx
behavioral2/memory/4720-8-0x00007FF69C5A0000-0x00007FF69C992000-memory.dmp	upx
behavioral2/memory/892-4346-0x00007FF69EB80000-0x00007FF69EF72000-memory.dmp	upx
behavioral2/memory/2112-4386-0x00007FF6E32A0000-0x00007FF6E3692000-memory.dmp	upx
behavioral2/memory/4648-4456-0x00007FF7372A0000-0x00007FF737692000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bMyJHMM.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\qxZuHUh.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\rPxDtIy.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\pdoDwux.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\yrzqmri.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\ayecgoQ.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\HHZcTyH.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\ccKGyYl.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\BZFhiNT.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\jDGCjXJ.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\sxeuVTW.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\MxtMmfQ.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\NKzNVjJ.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\DgRwhXN.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\JePsmlF.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\cUmgliM.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\UMtmeNF.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\qrLjEnR.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\UCIurkm.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\SSsrLuA.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\hjhoUpg.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\DSRqldF.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\bcGTten.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\bcjNXYC.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\SruxOlx.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\wzzFlSF.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\ysTZYbU.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\VaJaDlO.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\JpQNUjh.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\azLmxYv.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\NALxOAq.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\DpTTQBV.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\wPIWlVc.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\bplcNRB.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\eiIjdks.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\ZmqWhUr.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\xAYHoFG.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\tRPoEBk.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\apGclVr.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\KcYplsR.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\bImmiyr.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\DvuutpL.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\TOmlJzQ.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\qEAShtD.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\GmdbZdu.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\mHahxIU.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\BGlBhCU.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\TTFsOxY.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\nPPcSjN.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\gpBOAzP.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\KJNSrfN.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\msUyEmY.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\LmAwUXH.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\FYUmAgb.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\lcMOIpQ.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\qHwRMVQ.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\yEYHqqd.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\CHeKmXL.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\dClNcIB.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\IVFZxCH.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\dahENRO.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\nasrEtl.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\tzDpaKV.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
File created	C:\Windows\System\PZnwpxm.exe	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2480	powershell.exe
2480	powershell.exe
2480	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
Token: SeDebugPrivilege	2480	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2480	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	85
PID 2112 wrote to memory of 2480	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	85
PID 2112 wrote to memory of 4720	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	86
PID 2112 wrote to memory of 4720	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	86
PID 2112 wrote to memory of 4984	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	87
PID 2112 wrote to memory of 4984	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	87
PID 2112 wrote to memory of 892	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	88
PID 2112 wrote to memory of 892	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	88
PID 2112 wrote to memory of 960	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	89
PID 2112 wrote to memory of 960	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	89
PID 2112 wrote to memory of 2096	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	90
PID 2112 wrote to memory of 2096	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	90
PID 2112 wrote to memory of 2180	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	91
PID 2112 wrote to memory of 2180	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	91
PID 2112 wrote to memory of 2984	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	92
PID 2112 wrote to memory of 2984	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	92
PID 2112 wrote to memory of 4084	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	93
PID 2112 wrote to memory of 4084	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	93
PID 2112 wrote to memory of 4648	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	94
PID 2112 wrote to memory of 4648	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	94
PID 2112 wrote to memory of 3220	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	95
PID 2112 wrote to memory of 3220	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	95
PID 2112 wrote to memory of 1720	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	96
PID 2112 wrote to memory of 1720	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	96
PID 2112 wrote to memory of 1528	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	97
PID 2112 wrote to memory of 1528	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	97
PID 2112 wrote to memory of 1532	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	98
PID 2112 wrote to memory of 1532	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	98
PID 2112 wrote to memory of 3996	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	99
PID 2112 wrote to memory of 3996	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	99
PID 2112 wrote to memory of 4620	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	100
PID 2112 wrote to memory of 4620	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	100
PID 2112 wrote to memory of 3172	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	101
PID 2112 wrote to memory of 3172	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	101
PID 2112 wrote to memory of 2996	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	102
PID 2112 wrote to memory of 2996	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	102
PID 2112 wrote to memory of 2372	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	103
PID 2112 wrote to memory of 2372	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	103
PID 2112 wrote to memory of 2756	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	104
PID 2112 wrote to memory of 2756	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	104
PID 2112 wrote to memory of 4256	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	105
PID 2112 wrote to memory of 4256	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	105
PID 2112 wrote to memory of 3756	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	106
PID 2112 wrote to memory of 3756	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	106
PID 2112 wrote to memory of 3152	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	107
PID 2112 wrote to memory of 3152	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	107
PID 2112 wrote to memory of 4656	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	108
PID 2112 wrote to memory of 4656	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	108
PID 2112 wrote to memory of 2196	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	109
PID 2112 wrote to memory of 2196	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	109
PID 2112 wrote to memory of 4564	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	110
PID 2112 wrote to memory of 4564	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	110
PID 2112 wrote to memory of 4740	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	111
PID 2112 wrote to memory of 4740	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	111
PID 2112 wrote to memory of 5048	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	112
PID 2112 wrote to memory of 5048	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	112
PID 2112 wrote to memory of 4296	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	113
PID 2112 wrote to memory of 4296	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	113
PID 2112 wrote to memory of 1988	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	114
PID 2112 wrote to memory of 1988	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	114
PID 2112 wrote to memory of 640	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	115
PID 2112 wrote to memory of 640	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	115
PID 2112 wrote to memory of 1712	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	116
PID 2112 wrote to memory of 1712	2112	05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05b6058cd308310de641e24b99a8a59f_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2480
- C:\Windows\System\sGhflbT.exe
  C:\Windows\System\sGhflbT.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\rCUFryC.exe
  C:\Windows\System\rCUFryC.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\KEpdzbB.exe
  C:\Windows\System\KEpdzbB.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\bfOlTjL.exe
  C:\Windows\System\bfOlTjL.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\WcaphKb.exe
  C:\Windows\System\WcaphKb.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\FXJjFAT.exe
  C:\Windows\System\FXJjFAT.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\CXoicOn.exe
  C:\Windows\System\CXoicOn.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\bXadRZy.exe
  C:\Windows\System\bXadRZy.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\iaqYXVC.exe
  C:\Windows\System\iaqYXVC.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\dBfPGiL.exe
  C:\Windows\System\dBfPGiL.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\gxetePm.exe
  C:\Windows\System\gxetePm.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\nZCaFvc.exe
  C:\Windows\System\nZCaFvc.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\ecIHoZx.exe
  C:\Windows\System\ecIHoZx.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\uapzUdU.exe
  C:\Windows\System\uapzUdU.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\fnlCRYT.exe
  C:\Windows\System\fnlCRYT.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\cYRPILA.exe
  C:\Windows\System\cYRPILA.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\IEuqIDg.exe
  C:\Windows\System\IEuqIDg.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\JSwCmbL.exe
  C:\Windows\System\JSwCmbL.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\kgQUziq.exe
  C:\Windows\System\kgQUziq.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\mEWOYUe.exe
  C:\Windows\System\mEWOYUe.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\IeAkrph.exe
  C:\Windows\System\IeAkrph.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\YpStabU.exe
  C:\Windows\System\YpStabU.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\bwqLzKD.exe
  C:\Windows\System\bwqLzKD.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\IFMfnrm.exe
  C:\Windows\System\IFMfnrm.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\qyErZXM.exe
  C:\Windows\System\qyErZXM.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\NksFVSa.exe
  C:\Windows\System\NksFVSa.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\YVKzYxY.exe
  C:\Windows\System\YVKzYxY.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\BPCxGvA.exe
  C:\Windows\System\BPCxGvA.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\dMQgkhY.exe
  C:\Windows\System\dMQgkhY.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\lhoBulb.exe
  C:\Windows\System\lhoBulb.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\fuoylCN.exe
  C:\Windows\System\fuoylCN.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\DGNBfXv.exe
  C:\Windows\System\DGNBfXv.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\lKCeahJ.exe
  C:\Windows\System\lKCeahJ.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\xUVLhCo.exe
  C:\Windows\System\xUVLhCo.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\HuibiIz.exe
  C:\Windows\System\HuibiIz.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\GfoRxNQ.exe
  C:\Windows\System\GfoRxNQ.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\Cylfwuc.exe
  C:\Windows\System\Cylfwuc.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\ASMnLQK.exe
  C:\Windows\System\ASMnLQK.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\GIGTCTQ.exe
  C:\Windows\System\GIGTCTQ.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\cllZDXb.exe
  C:\Windows\System\cllZDXb.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\pOpSiAK.exe
  C:\Windows\System\pOpSiAK.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\ABaGiVR.exe
  C:\Windows\System\ABaGiVR.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\REBZqvM.exe
  C:\Windows\System\REBZqvM.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\YKjUeCO.exe
  C:\Windows\System\YKjUeCO.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\MTzYaQY.exe
  C:\Windows\System\MTzYaQY.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\bkecvEr.exe
  C:\Windows\System\bkecvEr.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\gnmZmEv.exe
  C:\Windows\System\gnmZmEv.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\DICjKNh.exe
  C:\Windows\System\DICjKNh.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\DSaPWEY.exe
  C:\Windows\System\DSaPWEY.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\DYAEVCX.exe
  C:\Windows\System\DYAEVCX.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\yqYnZUX.exe
  C:\Windows\System\yqYnZUX.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\eUdyyWp.exe
  C:\Windows\System\eUdyyWp.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\sMdtLCr.exe
  C:\Windows\System\sMdtLCr.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\qrcQRrx.exe
  C:\Windows\System\qrcQRrx.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\TLzZmEi.exe
  C:\Windows\System\TLzZmEi.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\eCdHqBU.exe
  C:\Windows\System\eCdHqBU.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\HuhByOs.exe
  C:\Windows\System\HuhByOs.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\HrgZgpU.exe
  C:\Windows\System\HrgZgpU.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\TXmMHRO.exe
  C:\Windows\System\TXmMHRO.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\fXhRGyL.exe
  C:\Windows\System\fXhRGyL.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\wiyLIbE.exe
  C:\Windows\System\wiyLIbE.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\ekkMKHW.exe
  C:\Windows\System\ekkMKHW.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\jplTShf.exe
  C:\Windows\System\jplTShf.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\lWsDLGK.exe
  C:\Windows\System\lWsDLGK.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\AAfzICN.exe
  C:\Windows\System\AAfzICN.exe
  2⤵
  PID:4964
- C:\Windows\System\oHNUnxj.exe
  C:\Windows\System\oHNUnxj.exe
  2⤵
  PID:4596
- C:\Windows\System\BHVnWNK.exe
  C:\Windows\System\BHVnWNK.exe
  2⤵
  PID:2780
- C:\Windows\System\xvPXIne.exe
  C:\Windows\System\xvPXIne.exe
  2⤵
  PID:2792
- C:\Windows\System\jCUXXZk.exe
  C:\Windows\System\jCUXXZk.exe
  2⤵
  PID:752
- C:\Windows\System\KozGopC.exe
  C:\Windows\System\KozGopC.exe
  2⤵
  PID:3664
- C:\Windows\System\pYKlZuB.exe
  C:\Windows\System\pYKlZuB.exe
  2⤵
  PID:5096
- C:\Windows\System\qkPiWEO.exe
  C:\Windows\System\qkPiWEO.exe
  2⤵
  PID:1348
- C:\Windows\System\wjAAarM.exe
  C:\Windows\System\wjAAarM.exe
  2⤵
  PID:3760
- C:\Windows\System\uhfsGwg.exe
  C:\Windows\System\uhfsGwg.exe
  2⤵
  PID:3008
- C:\Windows\System\VAlvIOd.exe
  C:\Windows\System\VAlvIOd.exe
  2⤵
  PID:4244
- C:\Windows\System\zReLrkR.exe
  C:\Windows\System\zReLrkR.exe
  2⤵
  PID:3332
- C:\Windows\System\oNwkUnj.exe
  C:\Windows\System\oNwkUnj.exe
  2⤵
  PID:1872
- C:\Windows\System\chWdgcC.exe
  C:\Windows\System\chWdgcC.exe
  2⤵
  PID:4388
- C:\Windows\System\mgdPDFe.exe
  C:\Windows\System\mgdPDFe.exe
  2⤵
  PID:4464
- C:\Windows\System\svDeaAg.exe
  C:\Windows\System\svDeaAg.exe
  2⤵
  PID:3168
- C:\Windows\System\YKEhSjB.exe
  C:\Windows\System\YKEhSjB.exe
  2⤵
  PID:3416
- C:\Windows\System\xnQgqHa.exe
  C:\Windows\System\xnQgqHa.exe
  2⤵
  PID:2872
- C:\Windows\System\XRFfZsP.exe
  C:\Windows\System\XRFfZsP.exe
  2⤵
  PID:2652
- C:\Windows\System\SltadKl.exe
  C:\Windows\System\SltadKl.exe
  2⤵
  PID:576
- C:\Windows\System\CDddBDO.exe
  C:\Windows\System\CDddBDO.exe
  2⤵
  PID:3768
- C:\Windows\System\uOYfDJT.exe
  C:\Windows\System\uOYfDJT.exe
  2⤵
  PID:5016
- C:\Windows\System\XSQOQHs.exe
  C:\Windows\System\XSQOQHs.exe
  2⤵
  PID:3148
- C:\Windows\System\NGwzpzj.exe
  C:\Windows\System\NGwzpzj.exe
  2⤵
  PID:4520
- C:\Windows\System\RcvMjfZ.exe
  C:\Windows\System\RcvMjfZ.exe
  2⤵
  PID:1964
- C:\Windows\System\lZITruF.exe
  C:\Windows\System\lZITruF.exe
  2⤵
  PID:2992
- C:\Windows\System\URBpsCW.exe
  C:\Windows\System\URBpsCW.exe
  2⤵
  PID:3976
- C:\Windows\System\iEshFtV.exe
  C:\Windows\System\iEshFtV.exe
  2⤵
  PID:1056
- C:\Windows\System\WNEumob.exe
  C:\Windows\System\WNEumob.exe
  2⤵
  PID:4312
- C:\Windows\System\MBXcaOV.exe
  C:\Windows\System\MBXcaOV.exe
  2⤵
  PID:380
- C:\Windows\System\OIwuBHS.exe
  C:\Windows\System\OIwuBHS.exe
  2⤵
  PID:1524
- C:\Windows\System\MYMWWwE.exe
  C:\Windows\System\MYMWWwE.exe
  2⤵
  PID:792
- C:\Windows\System\TaDXgHr.exe
  C:\Windows\System\TaDXgHr.exe
  2⤵
  PID:2972
- C:\Windows\System\RsiLQZr.exe
  C:\Windows\System\RsiLQZr.exe
  2⤵
  PID:1684
- C:\Windows\System\wjOGJqt.exe
  C:\Windows\System\wjOGJqt.exe
  2⤵
  PID:1940
- C:\Windows\System\ilUocUC.exe
  C:\Windows\System\ilUocUC.exe
  2⤵
  PID:4988
- C:\Windows\System\bppVgCI.exe
  C:\Windows\System\bppVgCI.exe
  2⤵
  PID:5128
- C:\Windows\System\vCpfVdt.exe
  C:\Windows\System\vCpfVdt.exe
  2⤵
  PID:5152
- C:\Windows\System\VpkwYzy.exe
  C:\Windows\System\VpkwYzy.exe
  2⤵
  PID:5168
- C:\Windows\System\ikGTwys.exe
  C:\Windows\System\ikGTwys.exe
  2⤵
  PID:5192
- C:\Windows\System\LLDFZrs.exe
  C:\Windows\System\LLDFZrs.exe
  2⤵
  PID:5216
- C:\Windows\System\aJzabNA.exe
  C:\Windows\System\aJzabNA.exe
  2⤵
  PID:5236
- C:\Windows\System\bgxGSIO.exe
  C:\Windows\System\bgxGSIO.exe
  2⤵
  PID:5256
- C:\Windows\System\HhgWGkd.exe
  C:\Windows\System\HhgWGkd.exe
  2⤵
  PID:5284
- C:\Windows\System\xffnyun.exe
  C:\Windows\System\xffnyun.exe
  2⤵
  PID:5308
- C:\Windows\System\VzvFhUf.exe
  C:\Windows\System\VzvFhUf.exe
  2⤵
  PID:5324
- C:\Windows\System\xrkufEx.exe
  C:\Windows\System\xrkufEx.exe
  2⤵
  PID:5348
- C:\Windows\System\bkedrIn.exe
  C:\Windows\System\bkedrIn.exe
  2⤵
  PID:5392
- C:\Windows\System\CaLnrjV.exe
  C:\Windows\System\CaLnrjV.exe
  2⤵
  PID:5420
- C:\Windows\System\CQDctWD.exe
  C:\Windows\System\CQDctWD.exe
  2⤵
  PID:5440
- C:\Windows\System\oWVQXlx.exe
  C:\Windows\System\oWVQXlx.exe
  2⤵
  PID:5460
- C:\Windows\System\kvLyqYJ.exe
  C:\Windows\System\kvLyqYJ.exe
  2⤵
  PID:5484
- C:\Windows\System\avzxbaT.exe
  C:\Windows\System\avzxbaT.exe
  2⤵
  PID:5508
- C:\Windows\System\meNiRIf.exe
  C:\Windows\System\meNiRIf.exe
  2⤵
  PID:5544
- C:\Windows\System\vlqSgOx.exe
  C:\Windows\System\vlqSgOx.exe
  2⤵
  PID:5564
- C:\Windows\System\eKVRQwi.exe
  C:\Windows\System\eKVRQwi.exe
  2⤵
  PID:5584
- C:\Windows\System\unkUNGT.exe
  C:\Windows\System\unkUNGT.exe
  2⤵
  PID:5608
- C:\Windows\System\ktNKYLt.exe
  C:\Windows\System\ktNKYLt.exe
  2⤵
  PID:5628
- C:\Windows\System\gQGKSMq.exe
  C:\Windows\System\gQGKSMq.exe
  2⤵
  PID:5644
- C:\Windows\System\UsXYSFa.exe
  C:\Windows\System\UsXYSFa.exe
  2⤵
  PID:5668
- C:\Windows\System\LullleJ.exe
  C:\Windows\System\LullleJ.exe
  2⤵
  PID:5684
- C:\Windows\System\JcfJzwd.exe
  C:\Windows\System\JcfJzwd.exe
  2⤵
  PID:5708
- C:\Windows\System\gZrTetn.exe
  C:\Windows\System\gZrTetn.exe
  2⤵
  PID:5732
- C:\Windows\System\zdyrwZF.exe
  C:\Windows\System\zdyrwZF.exe
  2⤵
  PID:5748
- C:\Windows\System\NeaoeUH.exe
  C:\Windows\System\NeaoeUH.exe
  2⤵
  PID:5780
- C:\Windows\System\YxFxWUC.exe
  C:\Windows\System\YxFxWUC.exe
  2⤵
  PID:5800
- C:\Windows\System\hfJENHt.exe
  C:\Windows\System\hfJENHt.exe
  2⤵
  PID:5824
- C:\Windows\System\TGJymZc.exe
  C:\Windows\System\TGJymZc.exe
  2⤵
  PID:5844
- C:\Windows\System\JeyYQXj.exe
  C:\Windows\System\JeyYQXj.exe
  2⤵
  PID:5876
- C:\Windows\System\LCqBoUB.exe
  C:\Windows\System\LCqBoUB.exe
  2⤵
  PID:5892
- C:\Windows\System\MQIIAfJ.exe
  C:\Windows\System\MQIIAfJ.exe
  2⤵
  PID:5912
- C:\Windows\System\HmQdXWX.exe
  C:\Windows\System\HmQdXWX.exe
  2⤵
  PID:5936
- C:\Windows\System\anLuTvw.exe
  C:\Windows\System\anLuTvw.exe
  2⤵
  PID:5960
- C:\Windows\System\EOesaip.exe
  C:\Windows\System\EOesaip.exe
  2⤵
  PID:5984
- C:\Windows\System\pRPTXUW.exe
  C:\Windows\System\pRPTXUW.exe
  2⤵
  PID:6004
- C:\Windows\System\CEYvdGq.exe
  C:\Windows\System\CEYvdGq.exe
  2⤵
  PID:6024
- C:\Windows\System\TkcIlZD.exe
  C:\Windows\System\TkcIlZD.exe
  2⤵
  PID:6048
- C:\Windows\System\qUZIPZi.exe
  C:\Windows\System\qUZIPZi.exe
  2⤵
  PID:6064
- C:\Windows\System\lWpVvvf.exe
  C:\Windows\System\lWpVvvf.exe
  2⤵
  PID:6092
- C:\Windows\System\BcskBFp.exe
  C:\Windows\System\BcskBFp.exe
  2⤵
  PID:6112
- C:\Windows\System\UwgVfEV.exe
  C:\Windows\System\UwgVfEV.exe
  2⤵
  PID:836
- C:\Windows\System\DiPBHnm.exe
  C:\Windows\System\DiPBHnm.exe
  2⤵
  PID:2688
- C:\Windows\System\sENmzNt.exe
  C:\Windows\System\sENmzNt.exe
  2⤵
  PID:5140
- C:\Windows\System\KOeScmk.exe
  C:\Windows\System\KOeScmk.exe
  2⤵
  PID:4468
- C:\Windows\System\hSYValN.exe
  C:\Windows\System\hSYValN.exe
  2⤵
  PID:5252
- C:\Windows\System\rcEtOAM.exe
  C:\Windows\System\rcEtOAM.exe
  2⤵
  PID:5332
- C:\Windows\System\zboZWSE.exe
  C:\Windows\System\zboZWSE.exe
  2⤵
  PID:4628
- C:\Windows\System\xFIuviF.exe
  C:\Windows\System\xFIuviF.exe
  2⤵
  PID:5428
- C:\Windows\System\URAZMYV.exe
  C:\Windows\System\URAZMYV.exe
  2⤵
  PID:5476
- C:\Windows\System\bcLjJaU.exe
  C:\Windows\System\bcLjJaU.exe
  2⤵
  PID:5388
- C:\Windows\System\vcznhDc.exe
  C:\Windows\System\vcznhDc.exe
  2⤵
  PID:5272
- C:\Windows\System\uouWRBR.exe
  C:\Windows\System\uouWRBR.exe
  2⤵
  PID:5768
- C:\Windows\System\QZChzqU.exe
  C:\Windows\System\QZChzqU.exe
  2⤵
  PID:5560
- C:\Windows\System\IVmfgoW.exe
  C:\Windows\System\IVmfgoW.exe
  2⤵
  PID:5908
- C:\Windows\System\llpKQGC.exe
  C:\Windows\System\llpKQGC.exe
  2⤵
  PID:6016
- C:\Windows\System\HMIGBph.exe
  C:\Windows\System\HMIGBph.exe
  2⤵
  PID:6132
- C:\Windows\System\xdJwNvw.exe
  C:\Windows\System\xdJwNvw.exe
  2⤵
  PID:6152
- C:\Windows\System\sVJigYe.exe
  C:\Windows\System\sVJigYe.exe
  2⤵
  PID:6180
- C:\Windows\System\kCxkAoA.exe
  C:\Windows\System\kCxkAoA.exe
  2⤵
  PID:6196
- C:\Windows\System\KSpPGNM.exe
  C:\Windows\System\KSpPGNM.exe
  2⤵
  PID:6228
- C:\Windows\System\rFsBPel.exe
  C:\Windows\System\rFsBPel.exe
  2⤵
  PID:6248
- C:\Windows\System\DxrqdCH.exe
  C:\Windows\System\DxrqdCH.exe
  2⤵
  PID:6272
- C:\Windows\System\hhTxEqo.exe
  C:\Windows\System\hhTxEqo.exe
  2⤵
  PID:6292
- C:\Windows\System\mReMVQh.exe
  C:\Windows\System\mReMVQh.exe
  2⤵
  PID:6316
- C:\Windows\System\dnrJroP.exe
  C:\Windows\System\dnrJroP.exe
  2⤵
  PID:6332
- C:\Windows\System\dwkiJJb.exe
  C:\Windows\System\dwkiJJb.exe
  2⤵
  PID:6360
- C:\Windows\System\DtlmnkF.exe
  C:\Windows\System\DtlmnkF.exe
  2⤵
  PID:6380
- C:\Windows\System\TBOxkHY.exe
  C:\Windows\System\TBOxkHY.exe
  2⤵
  PID:6404
- C:\Windows\System\YpWQLPH.exe
  C:\Windows\System\YpWQLPH.exe
  2⤵
  PID:6420
- C:\Windows\System\vSWaxmp.exe
  C:\Windows\System\vSWaxmp.exe
  2⤵
  PID:6448
- C:\Windows\System\aejEuRa.exe
  C:\Windows\System\aejEuRa.exe
  2⤵
  PID:6464
- C:\Windows\System\aNhSAuT.exe
  C:\Windows\System\aNhSAuT.exe
  2⤵
  PID:6488
- C:\Windows\System\oyJTKjp.exe
  C:\Windows\System\oyJTKjp.exe
  2⤵
  PID:6504
- C:\Windows\System\EuymKBT.exe
  C:\Windows\System\EuymKBT.exe
  2⤵
  PID:6528
- C:\Windows\System\oMQkNKr.exe
  C:\Windows\System\oMQkNKr.exe
  2⤵
  PID:6556
- C:\Windows\System\CeqmZPv.exe
  C:\Windows\System\CeqmZPv.exe
  2⤵
  PID:6576
- C:\Windows\System\nSMomVZ.exe
  C:\Windows\System\nSMomVZ.exe
  2⤵
  PID:6600
- C:\Windows\System\lODJbOF.exe
  C:\Windows\System\lODJbOF.exe
  2⤵
  PID:6620
- C:\Windows\System\LSGzLum.exe
  C:\Windows\System\LSGzLum.exe
  2⤵
  PID:6644
- C:\Windows\System\ZbsmWTR.exe
  C:\Windows\System\ZbsmWTR.exe
  2⤵
  PID:6660
- C:\Windows\System\BsRQypd.exe
  C:\Windows\System\BsRQypd.exe
  2⤵
  PID:6684
- C:\Windows\System\XtaSYFf.exe
  C:\Windows\System\XtaSYFf.exe
  2⤵
  PID:6708
- C:\Windows\System\MDKXFqP.exe
  C:\Windows\System\MDKXFqP.exe
  2⤵
  PID:6732
- C:\Windows\System\sgCXotA.exe
  C:\Windows\System\sgCXotA.exe
  2⤵
  PID:6752
- C:\Windows\System\JxHGvYq.exe
  C:\Windows\System\JxHGvYq.exe
  2⤵
  PID:6768
- C:\Windows\System\osbKeTH.exe
  C:\Windows\System\osbKeTH.exe
  2⤵
  PID:6792
- C:\Windows\System\FoCwwrr.exe
  C:\Windows\System\FoCwwrr.exe
  2⤵
  PID:6812
- C:\Windows\System\LSSXJAt.exe
  C:\Windows\System\LSSXJAt.exe
  2⤵
  PID:6840
- C:\Windows\System\lTSOmmX.exe
  C:\Windows\System\lTSOmmX.exe
  2⤵
  PID:6856
- C:\Windows\System\iFIxObm.exe
  C:\Windows\System\iFIxObm.exe
  2⤵
  PID:6884
- C:\Windows\System\cRjvIls.exe
  C:\Windows\System\cRjvIls.exe
  2⤵
  PID:6904
- C:\Windows\System\FlgCHwR.exe
  C:\Windows\System\FlgCHwR.exe
  2⤵
  PID:6924
- C:\Windows\System\xrPoeMm.exe
  C:\Windows\System\xrPoeMm.exe
  2⤵
  PID:6944
- C:\Windows\System\tHHGrED.exe
  C:\Windows\System\tHHGrED.exe
  2⤵
  PID:6968
- C:\Windows\System\otILZiE.exe
  C:\Windows\System\otILZiE.exe
  2⤵
  PID:6984
- C:\Windows\System\CqInNXa.exe
  C:\Windows\System\CqInNXa.exe
  2⤵
  PID:7012
- C:\Windows\System\QnXXSBs.exe
  C:\Windows\System\QnXXSBs.exe
  2⤵
  PID:7032
- C:\Windows\System\BZlLCob.exe
  C:\Windows\System\BZlLCob.exe
  2⤵
  PID:7052
- C:\Windows\System\yEUOqXr.exe
  C:\Windows\System\yEUOqXr.exe
  2⤵
  PID:7088
- C:\Windows\System\GfnRUua.exe
  C:\Windows\System\GfnRUua.exe
  2⤵
  PID:7108
- C:\Windows\System\ZFCjlmc.exe
  C:\Windows\System\ZFCjlmc.exe
  2⤵
  PID:7124
- C:\Windows\System\sXcfwMS.exe
  C:\Windows\System\sXcfwMS.exe
  2⤵
  PID:7152
- C:\Windows\System\YXurpTI.exe
  C:\Windows\System\YXurpTI.exe
  2⤵
  PID:5592
- C:\Windows\System\BvZkkxX.exe
  C:\Windows\System\BvZkkxX.exe
  2⤵
  PID:5640
- C:\Windows\System\pNsyJrA.exe
  C:\Windows\System\pNsyJrA.exe
  2⤵
  PID:5700
- C:\Windows\System\HHZcTyH.exe
  C:\Windows\System\HHZcTyH.exe
  2⤵
  PID:5976
- C:\Windows\System\UpsDpRU.exe
  C:\Windows\System\UpsDpRU.exe
  2⤵
  PID:6020
- C:\Windows\System\jjrDlIu.exe
  C:\Windows\System\jjrDlIu.exe
  2⤵
  PID:6072
- C:\Windows\System\HXjjEXV.exe
  C:\Windows\System\HXjjEXV.exe
  2⤵
  PID:5796
- C:\Windows\System\khglolZ.exe
  C:\Windows\System\khglolZ.exe
  2⤵
  PID:5820
- C:\Windows\System\HltFDqv.exe
  C:\Windows\System\HltFDqv.exe
  2⤵
  PID:6168
- C:\Windows\System\fNLMJIN.exe
  C:\Windows\System\fNLMJIN.exe
  2⤵
  PID:3872
- C:\Windows\System\zadfuXB.exe
  C:\Windows\System\zadfuXB.exe
  2⤵
  PID:5228
- C:\Windows\System\EgJezWJ.exe
  C:\Windows\System\EgJezWJ.exe
  2⤵
  PID:5304
- C:\Windows\System\QUrHGDY.exe
  C:\Windows\System\QUrHGDY.exe
  2⤵
  PID:5452
- C:\Windows\System\XMacwmN.exe
  C:\Windows\System\XMacwmN.exe
  2⤵
  PID:6304
- C:\Windows\System\BqTsYMS.exe
  C:\Windows\System\BqTsYMS.exe
  2⤵
  PID:6348
- C:\Windows\System\nVbahUF.exe
  C:\Windows\System\nVbahUF.exe
  2⤵
  PID:5620
- C:\Windows\System\BSWURvZ.exe
  C:\Windows\System\BSWURvZ.exe
  2⤵
  PID:6432
- C:\Windows\System\YqSBMJb.exe
  C:\Windows\System\YqSBMJb.exe
  2⤵
  PID:6520
- C:\Windows\System\MUoikVs.exe
  C:\Windows\System\MUoikVs.exe
  2⤵
  PID:6568
- C:\Windows\System\FUovQaH.exe
  C:\Windows\System\FUovQaH.exe
  2⤵
  PID:6204
- C:\Windows\System\SDHsvlA.exe
  C:\Windows\System\SDHsvlA.exe
  2⤵
  PID:6700
- C:\Windows\System\jubreXB.exe
  C:\Windows\System\jubreXB.exe
  2⤵
  PID:6284
- C:\Windows\System\wfDUjtz.exe
  C:\Windows\System\wfDUjtz.exe
  2⤵
  PID:6832
- C:\Windows\System\msSbPeJ.exe
  C:\Windows\System\msSbPeJ.exe
  2⤵
  PID:6900
- C:\Windows\System\kSjjKKB.exe
  C:\Windows\System\kSjjKKB.exe
  2⤵
  PID:6976
- C:\Windows\System\dECjuxY.exe
  C:\Windows\System\dECjuxY.exe
  2⤵
  PID:7004
- C:\Windows\System\rXstzyI.exe
  C:\Windows\System\rXstzyI.exe
  2⤵
  PID:7176
- C:\Windows\System\PcsfrYc.exe
  C:\Windows\System\PcsfrYc.exe
  2⤵
  PID:7204
- C:\Windows\System\VpkRscp.exe
  C:\Windows\System\VpkRscp.exe
  2⤵
  PID:7224
- C:\Windows\System\qjxBwcR.exe
  C:\Windows\System\qjxBwcR.exe
  2⤵
  PID:7248
- C:\Windows\System\hckgbEg.exe
  C:\Windows\System\hckgbEg.exe
  2⤵
  PID:7268
- C:\Windows\System\CkeojZb.exe
  C:\Windows\System\CkeojZb.exe
  2⤵
  PID:7288
- C:\Windows\System\ARPmcka.exe
  C:\Windows\System\ARPmcka.exe
  2⤵
  PID:7316
- C:\Windows\System\mojGZtA.exe
  C:\Windows\System\mojGZtA.exe
  2⤵
  PID:7336
- C:\Windows\System\mxFgwZn.exe
  C:\Windows\System\mxFgwZn.exe
  2⤵
  PID:7360
- C:\Windows\System\ThHnPNV.exe
  C:\Windows\System\ThHnPNV.exe
  2⤵
  PID:7376
- C:\Windows\System\fTHOfme.exe
  C:\Windows\System\fTHOfme.exe
  2⤵
  PID:7404
- C:\Windows\System\QwibBvJ.exe
  C:\Windows\System\QwibBvJ.exe
  2⤵
  PID:7436
- C:\Windows\System\aENiWlf.exe
  C:\Windows\System\aENiWlf.exe
  2⤵
  PID:7452
- C:\Windows\System\FoDFMqF.exe
  C:\Windows\System\FoDFMqF.exe
  2⤵
  PID:7472
- C:\Windows\System\kzcGBXj.exe
  C:\Windows\System\kzcGBXj.exe
  2⤵
  PID:7488
- C:\Windows\System\KiiJVpt.exe
  C:\Windows\System\KiiJVpt.exe
  2⤵
  PID:7512
- C:\Windows\System\gBrQqFV.exe
  C:\Windows\System\gBrQqFV.exe
  2⤵
  PID:7532
- C:\Windows\System\lCVAQue.exe
  C:\Windows\System\lCVAQue.exe
  2⤵
  PID:7560
- C:\Windows\System\uMYWkUS.exe
  C:\Windows\System\uMYWkUS.exe
  2⤵
  PID:7576
- C:\Windows\System\pPbnfPt.exe
  C:\Windows\System\pPbnfPt.exe
  2⤵
  PID:7604
- C:\Windows\System\gMsqkiU.exe
  C:\Windows\System\gMsqkiU.exe
  2⤵
  PID:7620
- C:\Windows\System\cPMEYYl.exe
  C:\Windows\System\cPMEYYl.exe
  2⤵
  PID:7644
- C:\Windows\System\znmJLum.exe
  C:\Windows\System\znmJLum.exe
  2⤵
  PID:7672
- C:\Windows\System\FZSReSe.exe
  C:\Windows\System\FZSReSe.exe
  2⤵
  PID:7692
- C:\Windows\System\RAkUYvb.exe
  C:\Windows\System\RAkUYvb.exe
  2⤵
  PID:7716
- C:\Windows\System\qfKcWRH.exe
  C:\Windows\System\qfKcWRH.exe
  2⤵
  PID:7736
- C:\Windows\System\xxNhjyd.exe
  C:\Windows\System\xxNhjyd.exe
  2⤵
  PID:7756
- C:\Windows\System\THRmiGu.exe
  C:\Windows\System\THRmiGu.exe
  2⤵
  PID:7784
- C:\Windows\System\IqDyIBH.exe
  C:\Windows\System\IqDyIBH.exe
  2⤵
  PID:7804
- C:\Windows\System\TLUqVWo.exe
  C:\Windows\System\TLUqVWo.exe
  2⤵
  PID:7828
- C:\Windows\System\rNwYIPv.exe
  C:\Windows\System\rNwYIPv.exe
  2⤵
  PID:7848
- C:\Windows\System\DfTQixR.exe
  C:\Windows\System\DfTQixR.exe
  2⤵
  PID:7868
- C:\Windows\System\mLBOTMC.exe
  C:\Windows\System\mLBOTMC.exe
  2⤵
  PID:7892
- C:\Windows\System\QKisOxX.exe
  C:\Windows\System\QKisOxX.exe
  2⤵
  PID:7916
- C:\Windows\System\RgcoVFO.exe
  C:\Windows\System\RgcoVFO.exe
  2⤵
  PID:7940
- C:\Windows\System\NiyndfF.exe
  C:\Windows\System\NiyndfF.exe
  2⤵
  PID:7960
- C:\Windows\System\tzsIBDF.exe
  C:\Windows\System\tzsIBDF.exe
  2⤵
  PID:7984
- C:\Windows\System\DSsDzQS.exe
  C:\Windows\System\DSsDzQS.exe
  2⤵
  PID:8004
- C:\Windows\System\wApZCVb.exe
  C:\Windows\System\wApZCVb.exe
  2⤵
  PID:8024
- C:\Windows\System\vvwjTRu.exe
  C:\Windows\System\vvwjTRu.exe
  2⤵
  PID:8044
- C:\Windows\System\VuufukC.exe
  C:\Windows\System\VuufukC.exe
  2⤵
  PID:8068
- C:\Windows\System\mRuDsxu.exe
  C:\Windows\System\mRuDsxu.exe
  2⤵
  PID:8088
- C:\Windows\System\ZzamztE.exe
  C:\Windows\System\ZzamztE.exe
  2⤵
  PID:8108
- C:\Windows\System\fnyQcQT.exe
  C:\Windows\System\fnyQcQT.exe
  2⤵
  PID:8128
- C:\Windows\System\QFhMCki.exe
  C:\Windows\System\QFhMCki.exe
  2⤵
  PID:8152
- C:\Windows\System\mhidrIB.exe
  C:\Windows\System\mhidrIB.exe
  2⤵
  PID:8172
- C:\Windows\System\sZHliMW.exe
  C:\Windows\System\sZHliMW.exe
  2⤵
  PID:6148
- C:\Windows\System\uPYIkzO.exe
  C:\Windows\System\uPYIkzO.exe
  2⤵
  PID:7160
- C:\Windows\System\vfkijIH.exe
  C:\Windows\System\vfkijIH.exe
  2⤵
  PID:5680
- C:\Windows\System\eGmIFhH.exe
  C:\Windows\System\eGmIFhH.exe
  2⤵
  PID:6640
- C:\Windows\System\LlPVuDJ.exe
  C:\Windows\System\LlPVuDJ.exe
  2⤵
  PID:6104
- C:\Windows\System\XjzKVhs.exe
  C:\Windows\System\XjzKVhs.exe
  2⤵
  PID:5208
- C:\Windows\System\XwQReWJ.exe
  C:\Windows\System\XwQReWJ.exe
  2⤵
  PID:6784
- C:\Windows\System\ugMTQGQ.exe
  C:\Windows\System\ugMTQGQ.exe
  2⤵
  PID:6808
- C:\Windows\System\YzVpgFU.exe
  C:\Windows\System\YzVpgFU.exe
  2⤵
  PID:6548
- C:\Windows\System\PSbznBP.exe
  C:\Windows\System\PSbznBP.exe
  2⤵
  PID:6896
- C:\Windows\System\WbAMJMj.exe
  C:\Windows\System\WbAMJMj.exe
  2⤵
  PID:7048
- C:\Windows\System\sJuvgEw.exe
  C:\Windows\System\sJuvgEw.exe
  2⤵
  PID:7044
- C:\Windows\System\OmsgGOu.exe
  C:\Windows\System\OmsgGOu.exe
  2⤵
  PID:7100
- C:\Windows\System\nOOnMzc.exe
  C:\Windows\System\nOOnMzc.exe
  2⤵
  PID:7304
- C:\Windows\System\kfwhPAT.exe
  C:\Windows\System\kfwhPAT.exe
  2⤵
  PID:6100
- C:\Windows\System\yCOcbnh.exe
  C:\Windows\System\yCOcbnh.exe
  2⤵
  PID:7368
- C:\Windows\System\MpYOLLt.exe
  C:\Windows\System\MpYOLLt.exe
  2⤵
  PID:6216
- C:\Windows\System\VcQBEOg.exe
  C:\Windows\System\VcQBEOg.exe
  2⤵
  PID:7468
- C:\Windows\System\OTaGZPU.exe
  C:\Windows\System\OTaGZPU.exe
  2⤵
  PID:6328
- C:\Windows\System\TdnQtjC.exe
  C:\Windows\System\TdnQtjC.exe
  2⤵
  PID:7612
- C:\Windows\System\KtZuxwy.exe
  C:\Windows\System\KtZuxwy.exe
  2⤵
  PID:7664
- C:\Windows\System\yyiKLWd.exe
  C:\Windows\System\yyiKLWd.exe
  2⤵
  PID:6920
- C:\Windows\System\QRVrEhf.exe
  C:\Windows\System\QRVrEhf.exe
  2⤵
  PID:8196
- C:\Windows\System\kTTaTaX.exe
  C:\Windows\System\kTTaTaX.exe
  2⤵
  PID:8220
- C:\Windows\System\xLwZrUB.exe
  C:\Windows\System\xLwZrUB.exe
  2⤵
  PID:8244
- C:\Windows\System\BFwYvCy.exe
  C:\Windows\System\BFwYvCy.exe
  2⤵
  PID:8264
- C:\Windows\System\JQtqXkZ.exe
  C:\Windows\System\JQtqXkZ.exe
  2⤵
  PID:8288
- C:\Windows\System\YGQbMUM.exe
  C:\Windows\System\YGQbMUM.exe
  2⤵
  PID:8308
- C:\Windows\System\HMtHpWv.exe
  C:\Windows\System\HMtHpWv.exe
  2⤵
  PID:8332
- C:\Windows\System\rPnhnup.exe
  C:\Windows\System\rPnhnup.exe
  2⤵
  PID:8356
- C:\Windows\System\nrcyyUH.exe
  C:\Windows\System\nrcyyUH.exe
  2⤵
  PID:8380
- C:\Windows\System\kLfdHbo.exe
  C:\Windows\System\kLfdHbo.exe
  2⤵
  PID:8396
- C:\Windows\System\EIGoNqj.exe
  C:\Windows\System\EIGoNqj.exe
  2⤵
  PID:8424
- C:\Windows\System\lTceHAy.exe
  C:\Windows\System\lTceHAy.exe
  2⤵
  PID:8448
- C:\Windows\System\zyLVwea.exe
  C:\Windows\System\zyLVwea.exe
  2⤵
  PID:8472
- C:\Windows\System\MNIeIHS.exe
  C:\Windows\System\MNIeIHS.exe
  2⤵
  PID:8492
- C:\Windows\System\GOOYSih.exe
  C:\Windows\System\GOOYSih.exe
  2⤵
  PID:8516
- C:\Windows\System\mzMcJvx.exe
  C:\Windows\System\mzMcJvx.exe
  2⤵
  PID:8536
- C:\Windows\System\WeAUakc.exe
  C:\Windows\System\WeAUakc.exe
  2⤵
  PID:8560
- C:\Windows\System\zePLcCV.exe
  C:\Windows\System\zePLcCV.exe
  2⤵
  PID:8580
- C:\Windows\System\IBoEBnk.exe
  C:\Windows\System\IBoEBnk.exe
  2⤵
  PID:8600
- C:\Windows\System\eNhCvUM.exe
  C:\Windows\System\eNhCvUM.exe
  2⤵
  PID:8624
- C:\Windows\System\GhKLccJ.exe
  C:\Windows\System\GhKLccJ.exe
  2⤵
  PID:8644
- C:\Windows\System\QuENBnS.exe
  C:\Windows\System\QuENBnS.exe
  2⤵
  PID:8664
- C:\Windows\System\cqdZWHf.exe
  C:\Windows\System\cqdZWHf.exe
  2⤵
  PID:8688
- C:\Windows\System\ipifjAd.exe
  C:\Windows\System\ipifjAd.exe
  2⤵
  PID:8712
- C:\Windows\System\RGCvROt.exe
  C:\Windows\System\RGCvROt.exe
  2⤵
  PID:8740
- C:\Windows\System\IobMoqc.exe
  C:\Windows\System\IobMoqc.exe
  2⤵
  PID:8760
- C:\Windows\System\vceRClM.exe
  C:\Windows\System\vceRClM.exe
  2⤵
  PID:8780
- C:\Windows\System\XqNPnWy.exe
  C:\Windows\System\XqNPnWy.exe
  2⤵
  PID:8812
- C:\Windows\System\VWnRWdw.exe
  C:\Windows\System\VWnRWdw.exe
  2⤵
  PID:8836
- C:\Windows\System\dEjUuGL.exe
  C:\Windows\System\dEjUuGL.exe
  2⤵
  PID:8852
- C:\Windows\System\DOflsGK.exe
  C:\Windows\System\DOflsGK.exe
  2⤵
  PID:8872
- C:\Windows\System\ZkDxpfr.exe
  C:\Windows\System\ZkDxpfr.exe
  2⤵
  PID:8896
- C:\Windows\System\YLVcaHM.exe
  C:\Windows\System\YLVcaHM.exe
  2⤵
  PID:8924
- C:\Windows\System\JfGwxFQ.exe
  C:\Windows\System\JfGwxFQ.exe
  2⤵
  PID:8944
- C:\Windows\System\fklloYu.exe
  C:\Windows\System\fklloYu.exe
  2⤵
  PID:8964
- C:\Windows\System\PkrYXBX.exe
  C:\Windows\System\PkrYXBX.exe
  2⤵
  PID:8988
- C:\Windows\System\ymxFtGo.exe
  C:\Windows\System\ymxFtGo.exe
  2⤵
  PID:9004
- C:\Windows\System\SBuUlQF.exe
  C:\Windows\System\SBuUlQF.exe
  2⤵
  PID:9024
- C:\Windows\System\dmMUFlF.exe
  C:\Windows\System\dmMUFlF.exe
  2⤵
  PID:9044
- C:\Windows\System\oniWuxD.exe
  C:\Windows\System\oniWuxD.exe
  2⤵
  PID:9064
- C:\Windows\System\OdyIAFt.exe
  C:\Windows\System\OdyIAFt.exe
  2⤵
  PID:9080
- C:\Windows\System\MRNFlcT.exe
  C:\Windows\System\MRNFlcT.exe
  2⤵
  PID:9104
- C:\Windows\System\dKKfbIT.exe
  C:\Windows\System\dKKfbIT.exe
  2⤵
  PID:9128
- C:\Windows\System\ECxjiIT.exe
  C:\Windows\System\ECxjiIT.exe
  2⤵
  PID:9156
- C:\Windows\System\qjYlBuR.exe
  C:\Windows\System\qjYlBuR.exe
  2⤵
  PID:9176
- C:\Windows\System\DSrpzUK.exe
  C:\Windows\System\DSrpzUK.exe
  2⤵
  PID:9192
- C:\Windows\System\sgeCLib.exe
  C:\Windows\System\sgeCLib.exe
  2⤵
  PID:6936
- C:\Windows\System\ACKNkmy.exe
  C:\Windows\System\ACKNkmy.exe
  2⤵
  PID:7912
- C:\Windows\System\UtPoAYV.exe
  C:\Windows\System\UtPoAYV.exe
  2⤵
  PID:7980
- C:\Windows\System\qbbQQpa.exe
  C:\Windows\System\qbbQQpa.exe
  2⤵
  PID:7132
- C:\Windows\System\vTlodsp.exe
  C:\Windows\System\vTlodsp.exe
  2⤵
  PID:5636
- C:\Windows\System\tHgbOdU.exe
  C:\Windows\System\tHgbOdU.exe
  2⤵
  PID:7256
- C:\Windows\System\RuFLtxZ.exe
  C:\Windows\System\RuFLtxZ.exe
  2⤵
  PID:5468
- C:\Windows\System\ZnLNvlT.exe
  C:\Windows\System\ZnLNvlT.exe
  2⤵
  PID:7280
- C:\Windows\System\IGIdtPk.exe
  C:\Windows\System\IGIdtPk.exe
  2⤵
  PID:5924
- C:\Windows\System\waOpkFr.exe
  C:\Windows\System\waOpkFr.exe
  2⤵
  PID:6256
- C:\Windows\System\GcRSbzX.exe
  C:\Windows\System\GcRSbzX.exe
  2⤵
  PID:6060
- C:\Windows\System\isbiiBR.exe
  C:\Windows\System\isbiiBR.exe
  2⤵
  PID:6496
- C:\Windows\System\wRLZJGE.exe
  C:\Windows\System\wRLZJGE.exe
  2⤵
  PID:7652
- C:\Windows\System\gqaaRzZ.exe
  C:\Windows\System\gqaaRzZ.exe
  2⤵
  PID:7416
- C:\Windows\System\kqdzyYT.exe
  C:\Windows\System\kqdzyYT.exe
  2⤵
  PID:7544
- C:\Windows\System\pkFLIam.exe
  C:\Windows\System\pkFLIam.exe
  2⤵
  PID:6188
- C:\Windows\System\ZEGOqHJ.exe
  C:\Windows\System\ZEGOqHJ.exe
  2⤵
  PID:6588
- C:\Windows\System\KIjXret.exe
  C:\Windows\System\KIjXret.exe
  2⤵
  PID:6652
- C:\Windows\System\BMSIlFu.exe
  C:\Windows\System\BMSIlFu.exe
  2⤵
  PID:8228
- C:\Windows\System\bollFtP.exe
  C:\Windows\System\bollFtP.exe
  2⤵
  PID:8296
- C:\Windows\System\ilylAyn.exe
  C:\Windows\System\ilylAyn.exe
  2⤵
  PID:8340
- C:\Windows\System\OMVwsYZ.exe
  C:\Windows\System\OMVwsYZ.exe
  2⤵
  PID:8436
- C:\Windows\System\MCmkJSG.exe
  C:\Windows\System\MCmkJSG.exe
  2⤵
  PID:8480
- C:\Windows\System\EpchtaQ.exe
  C:\Windows\System\EpchtaQ.exe
  2⤵
  PID:9240
- C:\Windows\System\qyaiXmB.exe
  C:\Windows\System\qyaiXmB.exe
  2⤵
  PID:9264
- C:\Windows\System\xwqDEhF.exe
  C:\Windows\System\xwqDEhF.exe
  2⤵
  PID:9668
- C:\Windows\System\HzHhCqU.exe
  C:\Windows\System\HzHhCqU.exe
  2⤵
  PID:9708
- C:\Windows\System\QBFSfuv.exe
  C:\Windows\System\QBFSfuv.exe
  2⤵
  PID:9736
- C:\Windows\System\VcOkrby.exe
  C:\Windows\System\VcOkrby.exe
  2⤵
  PID:9756
- C:\Windows\System\alEHeJF.exe
  C:\Windows\System\alEHeJF.exe
  2⤵
  PID:9780
- C:\Windows\System\LGHuMBZ.exe
  C:\Windows\System\LGHuMBZ.exe
  2⤵
  PID:9800
- C:\Windows\System\GNONZQk.exe
  C:\Windows\System\GNONZQk.exe
  2⤵
  PID:9820
- C:\Windows\System\cmWAuXO.exe
  C:\Windows\System\cmWAuXO.exe
  2⤵
  PID:9844
- C:\Windows\System\WGrJdJF.exe
  C:\Windows\System\WGrJdJF.exe
  2⤵
  PID:9864
- C:\Windows\System\OtvJjxB.exe
  C:\Windows\System\OtvJjxB.exe
  2⤵
  PID:9880
- C:\Windows\System\DxiKuyt.exe
  C:\Windows\System\DxiKuyt.exe
  2⤵
  PID:9900
- C:\Windows\System\OLyGVxl.exe
  C:\Windows\System\OLyGVxl.exe
  2⤵
  PID:9924
- C:\Windows\System\sHTppVv.exe
  C:\Windows\System\sHTppVv.exe
  2⤵
  PID:9948
- C:\Windows\System\zpWyTMn.exe
  C:\Windows\System\zpWyTMn.exe
  2⤵
  PID:9968
- C:\Windows\System\UjQNuwh.exe
  C:\Windows\System\UjQNuwh.exe
  2⤵
  PID:9988
- C:\Windows\System\BVVcBLq.exe
  C:\Windows\System\BVVcBLq.exe
  2⤵
  PID:10016
- C:\Windows\System\cOJYqVI.exe
  C:\Windows\System\cOJYqVI.exe
  2⤵
  PID:10040
- C:\Windows\System\fUxqfLA.exe
  C:\Windows\System\fUxqfLA.exe
  2⤵
  PID:10056
- C:\Windows\System\ODfaRwv.exe
  C:\Windows\System\ODfaRwv.exe
  2⤵
  PID:10072
- C:\Windows\System\SnpTxBt.exe
  C:\Windows\System\SnpTxBt.exe
  2⤵
  PID:10092
- C:\Windows\System\knKtVer.exe
  C:\Windows\System\knKtVer.exe
  2⤵
  PID:10108
- C:\Windows\System\TdbNIsd.exe
  C:\Windows\System\TdbNIsd.exe
  2⤵
  PID:10132
- C:\Windows\System\sgCeurF.exe
  C:\Windows\System\sgCeurF.exe
  2⤵
  PID:10152
- C:\Windows\System\HFCgvvz.exe
  C:\Windows\System\HFCgvvz.exe
  2⤵
  PID:10176
- C:\Windows\System\VGFByLE.exe
  C:\Windows\System\VGFByLE.exe
  2⤵
  PID:10196
- C:\Windows\System\cwFrzPI.exe
  C:\Windows\System\cwFrzPI.exe
  2⤵
  PID:10220
- C:\Windows\System\UhJSIJV.exe
  C:\Windows\System\UhJSIJV.exe
  2⤵
  PID:7948
- C:\Windows\System\DMaVwtY.exe
  C:\Windows\System\DMaVwtY.exe
  2⤵
  PID:7172
- C:\Windows\System\hXVoekE.exe
  C:\Windows\System\hXVoekE.exe
  2⤵
  PID:8036
- C:\Windows\System\DOxcdiF.exe
  C:\Windows\System\DOxcdiF.exe
  2⤵
  PID:8636
- C:\Windows\System\RuFTmem.exe
  C:\Windows\System\RuFTmem.exe
  2⤵
  PID:8080
- C:\Windows\System\yQElrgf.exe
  C:\Windows\System\yQElrgf.exe
  2⤵
  PID:8124
- C:\Windows\System\IevlJkv.exe
  C:\Windows\System\IevlJkv.exe
  2⤵
  PID:8184
- C:\Windows\System\KuaKGJg.exe
  C:\Windows\System\KuaKGJg.exe
  2⤵
  PID:7332
- C:\Windows\System\CRVaZeF.exe
  C:\Windows\System\CRVaZeF.exe
  2⤵
  PID:6676
- C:\Windows\System\NmSACNg.exe
  C:\Windows\System\NmSACNg.exe
  2⤵
  PID:7584
- C:\Windows\System\VAldlGG.exe
  C:\Windows\System\VAldlGG.exe
  2⤵
  PID:7496
- C:\Windows\System\CLYJSuV.exe
  C:\Windows\System\CLYJSuV.exe
  2⤵
  PID:7700
- C:\Windows\System\pjecVCO.exe
  C:\Windows\System\pjecVCO.exe
  2⤵
  PID:7712
- C:\Windows\System\PpZKRtG.exe
  C:\Windows\System\PpZKRtG.exe
  2⤵
  PID:8304
- C:\Windows\System\xBNABcf.exe
  C:\Windows\System\xBNABcf.exe
  2⤵
  PID:7864
- C:\Windows\System\PnOGNJz.exe
  C:\Windows\System\PnOGNJz.exe
  2⤵
  PID:7996
- C:\Windows\System\pNPxbOI.exe
  C:\Windows\System\pNPxbOI.exe
  2⤵
  PID:9232
- C:\Windows\System\XySTYxK.exe
  C:\Windows\System\XySTYxK.exe
  2⤵
  PID:8100
- C:\Windows\System\VxXVSIS.exe
  C:\Windows\System\VxXVSIS.exe
  2⤵
  PID:8848
- C:\Windows\System\sQfHqXT.exe
  C:\Windows\System\sQfHqXT.exe
  2⤵
  PID:5664
- C:\Windows\System\kDrvUnj.exe
  C:\Windows\System\kDrvUnj.exe
  2⤵
  PID:9256
- C:\Windows\System\AwAWRDU.exe
  C:\Windows\System\AwAWRDU.exe
  2⤵
  PID:8844
- C:\Windows\System\AODuyke.exe
  C:\Windows\System\AODuyke.exe
  2⤵
  PID:8956
- C:\Windows\System\mjRUXFh.exe
  C:\Windows\System\mjRUXFh.exe
  2⤵
  PID:9140
- C:\Windows\System\mWqUKBk.exe
  C:\Windows\System\mWqUKBk.exe
  2⤵
  PID:7236
- C:\Windows\System\HcahWrn.exe
  C:\Windows\System\HcahWrn.exe
  2⤵
  PID:5852
- C:\Windows\System\YOGJLwE.exe
  C:\Windows\System\YOGJLwE.exe
  2⤵
  PID:9152
- C:\Windows\System\nRxJQsC.exe
  C:\Windows\System\nRxJQsC.exe
  2⤵
  PID:6744
- C:\Windows\System\uJOxOZK.exe
  C:\Windows\System\uJOxOZK.exe
  2⤵
  PID:5744
- C:\Windows\System\poysLqE.exe
  C:\Windows\System\poysLqE.exe
  2⤵
  PID:9480
- C:\Windows\System\aZmwSXI.exe
  C:\Windows\System\aZmwSXI.exe
  2⤵
  PID:10256
- C:\Windows\System\YgZUNxX.exe
  C:\Windows\System\YgZUNxX.exe
  2⤵
  PID:10280
- C:\Windows\System\ZWstCxS.exe
  C:\Windows\System\ZWstCxS.exe
  2⤵
  PID:10300
- C:\Windows\System\IbOtAyB.exe
  C:\Windows\System\IbOtAyB.exe
  2⤵
  PID:10324
- C:\Windows\System\yQAwpBd.exe
  C:\Windows\System\yQAwpBd.exe
  2⤵
  PID:10364
- C:\Windows\System\zwRrNwT.exe
  C:\Windows\System\zwRrNwT.exe
  2⤵
  PID:10384
- C:\Windows\System\iVPCKoi.exe
  C:\Windows\System\iVPCKoi.exe
  2⤵
  PID:10404
- C:\Windows\System\PSigZtU.exe
  C:\Windows\System\PSigZtU.exe
  2⤵
  PID:10996
- C:\Windows\System\sOxmabg.exe
  C:\Windows\System\sOxmabg.exe
  2⤵
  PID:11024
- C:\Windows\System\gqkqeoO.exe
  C:\Windows\System\gqkqeoO.exe
  2⤵
  PID:11044
- C:\Windows\System\kGrXyLE.exe
  C:\Windows\System\kGrXyLE.exe
  2⤵
  PID:11076
- C:\Windows\System\aUzQvxM.exe
  C:\Windows\System\aUzQvxM.exe
  2⤵
  PID:11096
- C:\Windows\System\lFkqoDg.exe
  C:\Windows\System\lFkqoDg.exe
  2⤵
  PID:11116
- C:\Windows\System\GhgVdeD.exe
  C:\Windows\System\GhgVdeD.exe
  2⤵
  PID:11136
- C:\Windows\System\mgrARgu.exe
  C:\Windows\System\mgrARgu.exe
  2⤵
  PID:11160
- C:\Windows\System\RgaDNQI.exe
  C:\Windows\System\RgaDNQI.exe
  2⤵
  PID:11180
- C:\Windows\System\PEbvnUr.exe
  C:\Windows\System\PEbvnUr.exe
  2⤵
  PID:11212
- C:\Windows\System\cyFlpWP.exe
  C:\Windows\System\cyFlpWP.exe
  2⤵
  PID:11236
- C:\Windows\System\CXbOKEj.exe
  C:\Windows\System\CXbOKEj.exe
  2⤵
  PID:8352
- C:\Windows\System\HxGGTdp.exe
  C:\Windows\System\HxGGTdp.exe
  2⤵
  PID:8460
- C:\Windows\System\BCgLiSX.exe
  C:\Windows\System\BCgLiSX.exe
  2⤵
  PID:9312
- C:\Windows\System\gNvqbdo.exe
  C:\Windows\System\gNvqbdo.exe
  2⤵
  PID:8868
- C:\Windows\System\uOkvKZu.exe
  C:\Windows\System\uOkvKZu.exe
  2⤵
  PID:8060
- C:\Windows\System\lqMuVHe.exe
  C:\Windows\System\lqMuVHe.exe
  2⤵
  PID:8656
- C:\Windows\System\TMprHmV.exe
  C:\Windows\System\TMprHmV.exe
  2⤵
  PID:9956
- C:\Windows\System\MsCQyTF.exe
  C:\Windows\System\MsCQyTF.exe
  2⤵
  PID:3928
- C:\Windows\System\wHYBJzu.exe
  C:\Windows\System\wHYBJzu.exe
  2⤵
  PID:10084
- C:\Windows\System\GqVtrHJ.exe
  C:\Windows\System\GqVtrHJ.exe
  2⤵
  PID:10148
- C:\Windows\System\wuaejfa.exe
  C:\Windows\System\wuaejfa.exe
  2⤵
  PID:8596
- C:\Windows\System\GIHZTAt.exe
  C:\Windows\System\GIHZTAt.exe
  2⤵
  PID:8880
- C:\Windows\System\CKpnDjk.exe
  C:\Windows\System\CKpnDjk.exe
  2⤵
  PID:7212
- C:\Windows\System\ZyzKqwl.exe
  C:\Windows\System\ZyzKqwl.exe
  2⤵
  PID:7596
- C:\Windows\System\lHtRymw.exe
  C:\Windows\System\lHtRymw.exe
  2⤵
  PID:8148
- C:\Windows\System\ugEMYHZ.exe
  C:\Windows\System\ugEMYHZ.exe
  2⤵
  PID:5496
- C:\Windows\System\biYMmWy.exe
  C:\Windows\System\biYMmWy.exe
  2⤵
  PID:10268
- C:\Windows\System\ufIFHwB.exe
  C:\Windows\System\ufIFHwB.exe
  2⤵
  PID:10440
- C:\Windows\System\tYGLKLH.exe
  C:\Windows\System\tYGLKLH.exe
  2⤵
  PID:8136
- C:\Windows\System\ECqXAcg.exe
  C:\Windows\System\ECqXAcg.exe
  2⤵
  PID:9680
- C:\Windows\System\ylAVXUk.exe
  C:\Windows\System\ylAVXUk.exe
  2⤵
  PID:9796
- C:\Windows\System\eXAsKIa.exe
  C:\Windows\System\eXAsKIa.exe
  2⤵
  PID:9856
- C:\Windows\System\NOVMzEp.exe
  C:\Windows\System\NOVMzEp.exe
  2⤵
  PID:9908
- C:\Windows\System\VFJLktQ.exe
  C:\Windows\System\VFJLktQ.exe
  2⤵
  PID:9996
- C:\Windows\System\EMeIPZT.exe
  C:\Windows\System\EMeIPZT.exe
  2⤵
  PID:10184
- C:\Windows\System\KGjfHoz.exe
  C:\Windows\System\KGjfHoz.exe
  2⤵
  PID:10232
- C:\Windows\System\vmYVobe.exe
  C:\Windows\System\vmYVobe.exe
  2⤵
  PID:6300
- C:\Windows\System\NmitNMZ.exe
  C:\Windows\System\NmitNMZ.exe
  2⤵
  PID:8696
- C:\Windows\System\WOtRYkn.exe
  C:\Windows\System\WOtRYkn.exe
  2⤵
  PID:6264
- C:\Windows\System\dzisKAO.exe
  C:\Windows\System\dzisKAO.exe
  2⤵
  PID:8936
- C:\Windows\System\SHCoAsP.exe
  C:\Windows\System\SHCoAsP.exe
  2⤵
  PID:11268
- C:\Windows\System\YaETPtV.exe
  C:\Windows\System\YaETPtV.exe
  2⤵
  PID:11292
- C:\Windows\System\JPEHUMI.exe
  C:\Windows\System\JPEHUMI.exe
  2⤵
  PID:11312
- C:\Windows\System\jGVnZMO.exe
  C:\Windows\System\jGVnZMO.exe
  2⤵
  PID:11332
- C:\Windows\System\qBaHJzJ.exe
  C:\Windows\System\qBaHJzJ.exe
  2⤵
  PID:11352
- C:\Windows\System\PiuHmTn.exe
  C:\Windows\System\PiuHmTn.exe
  2⤵
  PID:11388
- C:\Windows\System\awSOATQ.exe
  C:\Windows\System\awSOATQ.exe
  2⤵
  PID:11412
- C:\Windows\System\XvCJQro.exe
  C:\Windows\System\XvCJQro.exe
  2⤵
  PID:11428
- C:\Windows\System\Bhtlahf.exe
  C:\Windows\System\Bhtlahf.exe
  2⤵
  PID:11444
- C:\Windows\System\MLEyXjM.exe
  C:\Windows\System\MLEyXjM.exe
  2⤵
  PID:11460
- C:\Windows\System\CnhLZvO.exe
  C:\Windows\System\CnhLZvO.exe
  2⤵
  PID:11476
- C:\Windows\System\LmfCoFU.exe
  C:\Windows\System\LmfCoFU.exe
  2⤵
  PID:11492
- C:\Windows\System\rnqTxcP.exe
  C:\Windows\System\rnqTxcP.exe
  2⤵
  PID:11508
- C:\Windows\System\FXGklEY.exe
  C:\Windows\System\FXGklEY.exe
  2⤵
  PID:11524
- C:\Windows\System\UjfFtHD.exe
  C:\Windows\System\UjfFtHD.exe
  2⤵
  PID:11540
- C:\Windows\System\IOFZcFt.exe
  C:\Windows\System\IOFZcFt.exe
  2⤵
  PID:11556
- C:\Windows\System\OfiOeXa.exe
  C:\Windows\System\OfiOeXa.exe
  2⤵
  PID:11588
- C:\Windows\System\CKYbmho.exe
  C:\Windows\System\CKYbmho.exe
  2⤵
  PID:11608
- C:\Windows\System\kPJRkzM.exe
  C:\Windows\System\kPJRkzM.exe
  2⤵
  PID:11632
- C:\Windows\System\ywGKOPp.exe
  C:\Windows\System\ywGKOPp.exe
  2⤵
  PID:11652
- C:\Windows\System\TNeuLiO.exe
  C:\Windows\System\TNeuLiO.exe
  2⤵
  PID:11668
- C:\Windows\System\GelfnFC.exe
  C:\Windows\System\GelfnFC.exe
  2⤵
  PID:11692
- C:\Windows\System\qXNBTGY.exe
  C:\Windows\System\qXNBTGY.exe
  2⤵
  PID:11716
- C:\Windows\System\VcyFIks.exe
  C:\Windows\System\VcyFIks.exe
  2⤵
  PID:11732
- C:\Windows\System\nvWePeC.exe
  C:\Windows\System\nvWePeC.exe
  2⤵
  PID:11760
- C:\Windows\System\MeFLymp.exe
  C:\Windows\System\MeFLymp.exe
  2⤵
  PID:11780
- C:\Windows\System\csHZLpl.exe
  C:\Windows\System\csHZLpl.exe
  2⤵
  PID:11808
- C:\Windows\System\zDFRBYp.exe
  C:\Windows\System\zDFRBYp.exe
  2⤵
  PID:11824
- C:\Windows\System\aribLQd.exe
  C:\Windows\System\aribLQd.exe
  2⤵
  PID:11848
- C:\Windows\System\ypTHBwQ.exe
  C:\Windows\System\ypTHBwQ.exe
  2⤵
  PID:11872
- C:\Windows\System\nDPlGMa.exe
  C:\Windows\System\nDPlGMa.exe
  2⤵
  PID:11892
- C:\Windows\System\rHFhYxr.exe
  C:\Windows\System\rHFhYxr.exe
  2⤵
  PID:11916
- C:\Windows\System\hOENkEt.exe
  C:\Windows\System\hOENkEt.exe
  2⤵
  PID:11936
- C:\Windows\System\gUvvDnG.exe
  C:\Windows\System\gUvvDnG.exe
  2⤵
  PID:11952
- C:\Windows\System\ShYeQvF.exe
  C:\Windows\System\ShYeQvF.exe
  2⤵
  PID:11980
- C:\Windows\System\tarWYzd.exe
  C:\Windows\System\tarWYzd.exe
  2⤵
  PID:12008
- C:\Windows\System\ATdQkPR.exe
  C:\Windows\System\ATdQkPR.exe
  2⤵
  PID:12024
- C:\Windows\System\ZZdvGkE.exe
  C:\Windows\System\ZZdvGkE.exe
  2⤵
  PID:12048
- C:\Windows\System\PCboCyz.exe
  C:\Windows\System\PCboCyz.exe
  2⤵
  PID:12076
- C:\Windows\System\KQuOEfr.exe
  C:\Windows\System\KQuOEfr.exe
  2⤵
  PID:12100
- C:\Windows\System\mJBxauq.exe
  C:\Windows\System\mJBxauq.exe
  2⤵
  PID:12124
- C:\Windows\System\vBnNcHC.exe
  C:\Windows\System\vBnNcHC.exe
  2⤵
  PID:12148
- C:\Windows\System\uGOQOTD.exe
  C:\Windows\System\uGOQOTD.exe
  2⤵
  PID:12176
- C:\Windows\System\SNewHiA.exe
  C:\Windows\System\SNewHiA.exe
  2⤵
  PID:12196
- C:\Windows\System\uWqZpCe.exe
  C:\Windows\System\uWqZpCe.exe
  2⤵
  PID:12220
- C:\Windows\System\dyRedah.exe
  C:\Windows\System\dyRedah.exe
  2⤵
  PID:12244
- C:\Windows\System\xFzbzns.exe
  C:\Windows\System\xFzbzns.exe
  2⤵
  PID:12264
- C:\Windows\System\AoAqFFU.exe
  C:\Windows\System\AoAqFFU.exe
  2⤵
  PID:9492
- C:\Windows\System\BEFdEWQ.exe
  C:\Windows\System\BEFdEWQ.exe
  2⤵
  PID:10264
- C:\Windows\System\jYecZPz.exe
  C:\Windows\System\jYecZPz.exe
  2⤵
  PID:9536
- C:\Windows\System\afZexEl.exe
  C:\Windows\System\afZexEl.exe
  2⤵
  PID:9580
- C:\Windows\System\GyHncgd.exe
  C:\Windows\System\GyHncgd.exe
  2⤵
  PID:11012
- C:\Windows\System\rraMheH.exe
  C:\Windows\System\rraMheH.exe
  2⤵
  PID:11132
- C:\Windows\System\ROAbaLH.exe
  C:\Windows\System\ROAbaLH.exe
  2⤵
  PID:11228
- C:\Windows\System\JCpKFyq.exe
  C:\Windows\System\JCpKFyq.exe
  2⤵
  PID:10596
- C:\Windows\System\kDziwmf.exe
  C:\Windows\System\kDziwmf.exe
  2⤵
  PID:9748
- C:\Windows\System\eIkwPSD.exe
  C:\Windows\System\eIkwPSD.exe
  2⤵
  PID:10012
- C:\Windows\System\lKMWeZe.exe
  C:\Windows\System\lKMWeZe.exe
  2⤵
  PID:10168
- C:\Windows\System\GkFDjaf.exe
  C:\Windows\System\GkFDjaf.exe
  2⤵
  PID:8104
- C:\Windows\System\jZeqGxi.exe
  C:\Windows\System\jZeqGxi.exe
  2⤵
  PID:10780
- C:\Windows\System\bbGwXUQ.exe
  C:\Windows\System\bbGwXUQ.exe
  2⤵
  PID:9604
- C:\Windows\System\hhSOyDE.exe
  C:\Windows\System\hhSOyDE.exe
  2⤵
  PID:10576
- C:\Windows\System\tnXySmR.exe
  C:\Windows\System\tnXySmR.exe
  2⤵
  PID:9792
- C:\Windows\System\ofrBrmk.exe
  C:\Windows\System\ofrBrmk.exe
  2⤵
  PID:9896
- C:\Windows\System\DBLhuhO.exe
  C:\Windows\System\DBLhuhO.exe
  2⤵
  PID:7796
- C:\Windows\System\bDZThCs.exe
  C:\Windows\System\bDZThCs.exe
  2⤵
  PID:8488
- C:\Windows\System\JZfaLED.exe
  C:\Windows\System\JZfaLED.exe
  2⤵
  PID:6612
- C:\Windows\System\OVYrsBd.exe
  C:\Windows\System\OVYrsBd.exe
  2⤵
  PID:8912
- C:\Windows\System\mvIDJCN.exe
  C:\Windows\System\mvIDJCN.exe
  2⤵
  PID:8824
- C:\Windows\System\mrDkTMf.exe
  C:\Windows\System\mrDkTMf.exe
  2⤵
  PID:11288
- C:\Windows\System\RPRtcgG.exe
  C:\Windows\System\RPRtcgG.exe
  2⤵
  PID:12304
- C:\Windows\System\DQAionW.exe
  C:\Windows\System\DQAionW.exe
  2⤵
  PID:12324
- C:\Windows\System\KfZAsXX.exe
  C:\Windows\System\KfZAsXX.exe
  2⤵
  PID:12340
- C:\Windows\System\ktKuXFI.exe
  C:\Windows\System\ktKuXFI.exe
  2⤵
  PID:12360
- C:\Windows\System\yAaThjP.exe
  C:\Windows\System\yAaThjP.exe
  2⤵
  PID:12376
- C:\Windows\System\PxsjJlt.exe
  C:\Windows\System\PxsjJlt.exe
  2⤵
  PID:12392
- C:\Windows\System\AWFgXPP.exe
  C:\Windows\System\AWFgXPP.exe
  2⤵
  PID:12408
- C:\Windows\System\UJtrTXE.exe
  C:\Windows\System\UJtrTXE.exe
  2⤵
  PID:12428
- C:\Windows\System\VzCkrce.exe
  C:\Windows\System\VzCkrce.exe
  2⤵
  PID:12444
- C:\Windows\System\lFkVxPq.exe
  C:\Windows\System\lFkVxPq.exe
  2⤵
  PID:12464
- C:\Windows\System\SfGVhnr.exe
  C:\Windows\System\SfGVhnr.exe
  2⤵
  PID:12480
- C:\Windows\System\qOiwbcr.exe
  C:\Windows\System\qOiwbcr.exe
  2⤵
  PID:12500
- C:\Windows\System\DTaeBmt.exe
  C:\Windows\System\DTaeBmt.exe
  2⤵
  PID:12516
- C:\Windows\System\sRIjSSR.exe
  C:\Windows\System\sRIjSSR.exe
  2⤵
  PID:12532
- C:\Windows\System\qBoiFmY.exe
  C:\Windows\System\qBoiFmY.exe
  2⤵
  PID:12552
- C:\Windows\System\VrRHjrs.exe
  C:\Windows\System\VrRHjrs.exe
  2⤵
  PID:12580
- C:\Windows\System\giqLJLT.exe
  C:\Windows\System\giqLJLT.exe
  2⤵
  PID:12604
- C:\Windows\System\jHEsPOp.exe
  C:\Windows\System\jHEsPOp.exe
  2⤵
  PID:12620
- C:\Windows\System\aHEqyvD.exe
  C:\Windows\System\aHEqyvD.exe
  2⤵
  PID:12640
- C:\Windows\System\pXNlrot.exe
  C:\Windows\System\pXNlrot.exe
  2⤵
  PID:12660
- C:\Windows\System\xowsnhZ.exe
  C:\Windows\System\xowsnhZ.exe
  2⤵
  PID:12680
- C:\Windows\System\QjUuGSy.exe
  C:\Windows\System\QjUuGSy.exe
  2⤵
  PID:12704
- C:\Windows\System\emEnaMP.exe
  C:\Windows\System\emEnaMP.exe
  2⤵
  PID:12724
- C:\Windows\System\GofbIsh.exe
  C:\Windows\System\GofbIsh.exe
  2⤵
  PID:12744
- C:\Windows\System\kBLQKDf.exe
  C:\Windows\System\kBLQKDf.exe
  2⤵
  PID:12764
- C:\Windows\System\IQDejdz.exe
  C:\Windows\System\IQDejdz.exe
  2⤵
  PID:12784
- C:\Windows\System\Ssqkmue.exe
  C:\Windows\System\Ssqkmue.exe
  2⤵
  PID:12812
- C:\Windows\System\mgjEVLK.exe
  C:\Windows\System\mgjEVLK.exe
  2⤵
  PID:12832
- C:\Windows\System\KPXLAAq.exe
  C:\Windows\System\KPXLAAq.exe
  2⤵
  PID:12852
- C:\Windows\System\LLZLuyf.exe
  C:\Windows\System\LLZLuyf.exe
  2⤵
  PID:12876
- C:\Windows\System\dqwHBXU.exe
  C:\Windows\System\dqwHBXU.exe
  2⤵
  PID:12896
- C:\Windows\System\GsokeAL.exe
  C:\Windows\System\GsokeAL.exe
  2⤵
  PID:12920
- C:\Windows\System\JABUmyu.exe
  C:\Windows\System\JABUmyu.exe
  2⤵
  PID:12940
- C:\Windows\System\WjHZwKW.exe
  C:\Windows\System\WjHZwKW.exe
  2⤵
  PID:12960
- C:\Windows\System\JBcNIDG.exe
  C:\Windows\System\JBcNIDG.exe
  2⤵
  PID:12992
- C:\Windows\System\BwSASyU.exe
  C:\Windows\System\BwSASyU.exe
  2⤵
  PID:13016
- C:\Windows\System\JlJQauo.exe
  C:\Windows\System\JlJQauo.exe
  2⤵
  PID:13044
- C:\Windows\System\nHxrdTC.exe
  C:\Windows\System\nHxrdTC.exe
  2⤵
  PID:13060
- C:\Windows\System\qfMfjmP.exe
  C:\Windows\System\qfMfjmP.exe
  2⤵
  PID:13080
- C:\Windows\System\kIYoMtf.exe
  C:\Windows\System\kIYoMtf.exe
  2⤵
  PID:13108
- C:\Windows\System\fWEBEap.exe
  C:\Windows\System\fWEBEap.exe
  2⤵
  PID:13132
- C:\Windows\System\XNIBptA.exe
  C:\Windows\System\XNIBptA.exe
  2⤵
  PID:13156
- C:\Windows\System\lxWKkjG.exe
  C:\Windows\System\lxWKkjG.exe
  2⤵
  PID:13176
- C:\Windows\System\CnPCmWH.exe
  C:\Windows\System\CnPCmWH.exe
  2⤵
  PID:13196
- C:\Windows\System\ZkgJbFo.exe
  C:\Windows\System\ZkgJbFo.exe
  2⤵
  PID:13220
- C:\Windows\System\GtLtTNx.exe
  C:\Windows\System\GtLtTNx.exe
  2⤵
  PID:13244
- C:\Windows\System\InNclUU.exe
  C:\Windows\System\InNclUU.exe
  2⤵
  PID:13268
- C:\Windows\System\CVYvVMN.exe
  C:\Windows\System\CVYvVMN.exe
  2⤵
  PID:13292
- C:\Windows\System\CsWFiXS.exe
  C:\Windows\System\CsWFiXS.exe
  2⤵
  PID:6992
- C:\Windows\System\ohNjjot.exe
  C:\Windows\System\ohNjjot.exe
  2⤵
  PID:10248
- C:\Windows\System\tLgAzfZ.exe
  C:\Windows\System\tLgAzfZ.exe
  2⤵
  PID:11964
- C:\Windows\System\MExbvwB.exe
  C:\Windows\System\MExbvwB.exe
  2⤵
  PID:10164
- C:\Windows\System\hxwEjZt.exe
  C:\Windows\System\hxwEjZt.exe
  2⤵
  PID:8800
- C:\Windows\System\SKUypSV.exe
  C:\Windows\System\SKUypSV.exe
  2⤵
  PID:12888
- C:\Windows\System\vbzGNuF.exe
  C:\Windows\System\vbzGNuF.exe
  2⤵
  PID:8732
- C:\Windows\System\Mhwbilb.exe
  C:\Windows\System\Mhwbilb.exe
  2⤵
  PID:12460
- C:\Windows\System\owEMSMf.exe
  C:\Windows\System\owEMSMf.exe
  2⤵
  PID:11036
- C:\Windows\System\SEOarhE.exe
  C:\Windows\System\SEOarhE.exe
  2⤵
  PID:11680
- C:\Windows\System\UuBhcaN.exe
  C:\Windows\System\UuBhcaN.exe
  2⤵
  PID:11456
- C:\Windows\System\XITmTfp.exe
  C:\Windows\System\XITmTfp.exe
  2⤵
  PID:11904
- C:\Windows\System\DDaYdyR.exe
  C:\Windows\System\DDaYdyR.exe
  2⤵
  PID:13264
- C:\Windows\System\BuamyZR.exe
  C:\Windows\System\BuamyZR.exe
  2⤵
  PID:11516
- C:\Windows\System\rDoUiSS.exe
  C:\Windows\System\rDoUiSS.exe
  2⤵
  PID:11032
- C:\Windows\System\sCDizxN.exe
  C:\Windows\System\sCDizxN.exe
  2⤵
  PID:7900
- C:\Windows\System\kQPavTn.exe
  C:\Windows\System\kQPavTn.exe
  2⤵
  PID:12348
- C:\Windows\System\hSuMUPk.exe
  C:\Windows\System\hSuMUPk.exe
  2⤵
  PID:7628
- C:\Windows\System\XTscccr.exe
  C:\Windows\System\XTscccr.exe
  2⤵
  PID:11468
- C:\Windows\System\PKuBmXm.exe
  C:\Windows\System\PKuBmXm.exe
  2⤵
  PID:13212
- C:\Windows\System\BxWKpBX.exe
  C:\Windows\System\BxWKpBX.exe
  2⤵
  PID:13236
- C:\Windows\System\AYBkXGu.exe
  C:\Windows\System\AYBkXGu.exe
  2⤵
  PID:13208
- C:\Windows\System\bZWywQh.exe
  C:\Windows\System\bZWywQh.exe
  2⤵
  PID:10308
- C:\Windows\System\OxEUsYj.exe
  C:\Windows\System\OxEUsYj.exe
  2⤵
  PID:11348
- C:\Windows\System\edOjDeZ.exe
  C:\Windows\System\edOjDeZ.exe
  2⤵
  PID:11320
- C:\Windows\System\fZZPsyw.exe
  C:\Windows\System\fZZPsyw.exe
  2⤵
  PID:10104
- C:\Windows\System\CDtIGMh.exe
  C:\Windows\System\CDtIGMh.exe
  2⤵
  PID:12712
- C:\Windows\System\kOGGRmc.exe
  C:\Windows\System\kOGGRmc.exe
  2⤵
  PID:12524
- C:\Windows\System\fvFmQHa.exe
  C:\Windows\System\fvFmQHa.exe
  2⤵
  PID:12868
- C:\Windows\System\pZHxdZn.exe
  C:\Windows\System\pZHxdZn.exe
  2⤵
  PID:12600
- C:\Windows\System\ohwMTAD.exe
  C:\Windows\System\ohwMTAD.exe
  2⤵
  PID:12236
- C:\Windows\System\dUAqwOC.exe
  C:\Windows\System\dUAqwOC.exe
  2⤵
  PID:11088
- C:\Windows\System\gBOCBFd.exe
  C:\Windows\System\gBOCBFd.exe
  2⤵
  PID:7684
- C:\Windows\System\YyDoQFI.exe
  C:\Windows\System\YyDoQFI.exe
  2⤵
  PID:12672
- C:\Windows\System\OtKzNMJ.exe
  C:\Windows\System\OtKzNMJ.exe
  2⤵
  PID:7080
- C:\Windows\System\IWNYBYc.exe
  C:\Windows\System\IWNYBYc.exe
  2⤵
  PID:13164
- C:\Windows\System\hAAevmt.exe
  C:\Windows\System\hAAevmt.exe
  2⤵
  PID:6340
- C:\Windows\System\grteWCy.exe
  C:\Windows\System\grteWCy.exe
  2⤵
  PID:13052
- C:\Windows\System\IVAeZtm.exe
  C:\Windows\System\IVAeZtm.exe
  2⤵
  PID:11396
- C:\Windows\System\ctLmTBn.exe
  C:\Windows\System\ctLmTBn.exe
  2⤵
  PID:11280
- C:\Windows\System\lroflcs.exe
  C:\Windows\System\lroflcs.exe
  2⤵
  PID:11368
- C:\Windows\System\qeHTgwJ.exe
  C:\Windows\System\qeHTgwJ.exe
  2⤵
  PID:2120
- C:\Windows\System\UiOqotV.exe
  C:\Windows\System\UiOqotV.exe
  2⤵
  PID:12404
- C:\Windows\System\OxWzSto.exe
  C:\Windows\System\OxWzSto.exe
  2⤵
  PID:11536
- C:\Windows\System\nwBWTxt.exe
  C:\Windows\System\nwBWTxt.exe
  2⤵
  PID:11188
- C:\Windows\System\TnYugyi.exe
  C:\Windows\System\TnYugyi.exe
  2⤵
  PID:12384
- C:\Windows\System\KPPFjOc.exe
  C:\Windows\System\KPPFjOc.exe
  2⤵
  PID:7328
- C:\Windows\System\JhFHRDD.exe
  C:\Windows\System\JhFHRDD.exe
  2⤵
  PID:8660
- C:\Windows\System\ZodcvSY.exe
  C:\Windows\System\ZodcvSY.exe
  2⤵
  PID:13428
- C:\Windows\System\ZPqtItY.exe
  C:\Windows\System\ZPqtItY.exe
  2⤵
  PID:13472
- C:\Windows\System\yivgkwS.exe
  C:\Windows\System\yivgkwS.exe
  2⤵
  PID:13496
- C:\Windows\System\GLhBXSo.exe
  C:\Windows\System\GLhBXSo.exe
  2⤵
  PID:13520
- C:\Windows\System\OebHPlv.exe
  C:\Windows\System\OebHPlv.exe
  2⤵
  PID:13636
- C:\Windows\System\ZisQNdH.exe
  C:\Windows\System\ZisQNdH.exe
  2⤵
  PID:13692
- C:\Windows\System\MSycnQI.exe
  C:\Windows\System\MSycnQI.exe
  2⤵
  PID:14012
- C:\Windows\System\hdJxMDj.exe
  C:\Windows\System\hdJxMDj.exe
  2⤵
  PID:14036
- C:\Windows\System\OCYmTuq.exe
  C:\Windows\System\OCYmTuq.exe
  2⤵
  PID:14056
- C:\Windows\System\RKkYOBz.exe
  C:\Windows\System\RKkYOBz.exe
  2⤵
  PID:14092
- C:\Windows\System\cwroYDj.exe
  C:\Windows\System\cwroYDj.exe
  2⤵
  PID:14120
- C:\Windows\System\hGQSwne.exe
  C:\Windows\System\hGQSwne.exe
  2⤵
  PID:14144
- C:\Windows\System\YkdlaLw.exe
  C:\Windows\System\YkdlaLw.exe
  2⤵
  PID:14160
- C:\Windows\System\eRWeMzG.exe
  C:\Windows\System\eRWeMzG.exe
  2⤵
  PID:14200
- C:\Windows\System\czwKKMR.exe
  C:\Windows\System\czwKKMR.exe
  2⤵
  PID:14248
- C:\Windows\System\blWIHYq.exe
  C:\Windows\System\blWIHYq.exe
  2⤵
  PID:14264
- C:\Windows\System\BloqCtq.exe
  C:\Windows\System\BloqCtq.exe
  2⤵
  PID:14280
- C:\Windows\System\rAnfCnM.exe
  C:\Windows\System\rAnfCnM.exe
  2⤵
  PID:14300
- C:\Windows\System\vFgUoEK.exe
  C:\Windows\System\vFgUoEK.exe
  2⤵
  PID:14324
- C:\Windows\System\SuvsfVu.exe
  C:\Windows\System\SuvsfVu.exe
  2⤵
  PID:1804
- C:\Windows\System\jCIvdLX.exe
  C:\Windows\System\jCIvdLX.exe
  2⤵
  PID:13452
- C:\Windows\System\RefRXxd.exe
  C:\Windows\System\RefRXxd.exe
  2⤵
  PID:13408
- C:\Windows\System\ZcSCVSQ.exe
  C:\Windows\System\ZcSCVSQ.exe
  2⤵
  PID:1420
- C:\Windows\System\qTGiebL.exe
  C:\Windows\System\qTGiebL.exe
  2⤵
  PID:13620
- C:\Windows\System\WuIiVVd.exe
  C:\Windows\System\WuIiVVd.exe
  2⤵
  PID:13712
- C:\Windows\System\ituvykC.exe
  C:\Windows\System\ituvykC.exe
  2⤵
  PID:13344
- C:\Windows\System\CFDxAgC.exe
  C:\Windows\System\CFDxAgC.exe
  2⤵
  PID:4936
- C:\Windows\System\PbezAks.exe
  C:\Windows\System\PbezAks.exe
  2⤵
  PID:1072
- C:\Windows\System\PyUqQNI.exe
  C:\Windows\System\PyUqQNI.exe
  2⤵
  PID:13760
- C:\Windows\System\lqtkCsd.exe
  C:\Windows\System\lqtkCsd.exe
  2⤵
  PID:13996
- C:\Windows\System\eBuaDTl.exe
  C:\Windows\System\eBuaDTl.exe
  2⤵
  PID:14232
- C:\Windows\System\aaKgmHa.exe
  C:\Windows\System\aaKgmHa.exe
  2⤵
  PID:14112
- C:\Windows\System\exrQrAD.exe
  C:\Windows\System\exrQrAD.exe
  2⤵
  PID:1880
- C:\Windows\System\syGSKwg.exe
  C:\Windows\System\syGSKwg.exe
  2⤵
  PID:10356
- C:\Windows\System\OEwuDmm.exe
  C:\Windows\System\OEwuDmm.exe
  2⤵
  PID:13828
- C:\Windows\System\BowlGiy.exe
  C:\Windows\System\BowlGiy.exe
  2⤵
  PID:13888
- C:\Windows\System\YvtyYOq.exe
  C:\Windows\System\YvtyYOq.exe
  2⤵
  PID:14048
- C:\Windows\System\uUFqCSG.exe
  C:\Windows\System\uUFqCSG.exe
  2⤵
  PID:13612
- C:\Windows\System\dkXtuVe.exe
  C:\Windows\System\dkXtuVe.exe
  2⤵
  PID:11792
- C:\Windows\System\meDCPIS.exe
  C:\Windows\System\meDCPIS.exe
  2⤵
  PID:3980
- C:\Windows\System\MJuCwfj.exe
  C:\Windows\System\MJuCwfj.exe
  2⤵
  PID:14216
- C:\Windows\System\kOFoxaP.exe
  C:\Windows\System\kOFoxaP.exe
  2⤵
  PID:12760
- C:\Windows\System\WBTVqrd.exe
  C:\Windows\System\WBTVqrd.exe
  2⤵
  PID:12284
- C:\Windows\System\xEZLVRg.exe
  C:\Windows\System\xEZLVRg.exe
  2⤵
  PID:11500
- C:\Windows\System\uvSHEOi.exe
  C:\Windows\System\uvSHEOi.exe
  2⤵
  PID:7772
- C:\Windows\System\vONBYej.exe
  C:\Windows\System\vONBYej.exe
  2⤵
  PID:4960
- C:\Windows\System\RAOeMOV.exe
  C:\Windows\System\RAOeMOV.exe
  2⤵
  PID:3308
- C:\Windows\System\IIbytOk.exe
  C:\Windows\System\IIbytOk.exe
  2⤵
  PID:1540
- C:\Windows\System\BtEpFGG.exe
  C:\Windows\System\BtEpFGG.exe
  2⤵
  PID:4924
- C:\Windows\System\mVBlynj.exe
  C:\Windows\System\mVBlynj.exe
  2⤵
  PID:13584
- C:\Windows\System\NSyhjsG.exe
  C:\Windows\System\NSyhjsG.exe
  2⤵
  PID:13732
- C:\Windows\System\jjjkOgm.exe
  C:\Windows\System\jjjkOgm.exe
  2⤵
  PID:13816
- C:\Windows\System\PzKufLl.exe
  C:\Windows\System\PzKufLl.exe
  2⤵
  PID:2396
- C:\Windows\System\iqBIQCe.exe
  C:\Windows\System\iqBIQCe.exe
  2⤵
  PID:560
- C:\Windows\System\GMufXnR.exe
  C:\Windows\System\GMufXnR.exe
  2⤵
  PID:2292
- C:\Windows\System\kxiWcna.exe
  C:\Windows\System\kxiWcna.exe
  2⤵
  PID:5008
- C:\Windows\System\dtrAfnc.exe
  C:\Windows\System\dtrAfnc.exe
  2⤵
  PID:13956
- C:\Windows\System\AFFepyy.exe
  C:\Windows\System\AFFepyy.exe
  2⤵
  PID:13892
- C:\Windows\System\WRnXzgK.exe
  C:\Windows\System\WRnXzgK.exe
  2⤵
  PID:1620
- C:\Windows\System\MekBOFV.exe
  C:\Windows\System\MekBOFV.exe
  2⤵
  PID:3328
- C:\Windows\System\OUYeppJ.exe
  C:\Windows\System\OUYeppJ.exe
  2⤵
  PID:9920
- C:\Windows\System\bLAcfBd.exe
  C:\Windows\System\bLAcfBd.exe
  2⤵
  PID:3444
- C:\Windows\System\XFlzjSj.exe
  C:\Windows\System\XFlzjSj.exe
  2⤵
  PID:13796
- C:\Windows\System\nmaoSyG.exe
  C:\Windows\System\nmaoSyG.exe
  2⤵
  PID:14312
- C:\Windows\System\bSQtsHi.exe
  C:\Windows\System\bSQtsHi.exe
  2⤵
  PID:3940
- C:\Windows\System\hcqRKOJ.exe
  C:\Windows\System\hcqRKOJ.exe
  2⤵
  PID:5020
- C:\Windows\System\WozqkyM.exe
  C:\Windows\System\WozqkyM.exe
  2⤵
  PID:4880
- C:\Windows\System\FvAaXEZ.exe
  C:\Windows\System\FvAaXEZ.exe
  2⤵
  PID:8
- C:\Windows\System\FpwfNUr.exe
  C:\Windows\System\FpwfNUr.exe
  2⤵
  PID:6668
- C:\Windows\System\MWlxaBS.exe
  C:\Windows\System\MWlxaBS.exe
  2⤵
  PID:3836
- C:\Windows\System\mfAuGbc.exe
  C:\Windows\System\mfAuGbc.exe
  2⤵
  PID:4224
- C:\Windows\System\TttKjiq.exe
  C:\Windows\System\TttKjiq.exe
  2⤵
  PID:14212
- C:\Windows\System\FeJEEZE.exe
  C:\Windows\System\FeJEEZE.exe
  2⤵
  PID:1976
- C:\Windows\System\RvIkWyX.exe
  C:\Windows\System\RvIkWyX.exe
  2⤵
  PID:5080
- C:\Windows\System\gFSMIej.exe
  C:\Windows\System\gFSMIej.exe
  2⤵
  PID:1232
- C:\Windows\System\EzISNMw.exe
  C:\Windows\System\EzISNMw.exe
  2⤵
  PID:14024
- C:\Windows\System\CWQIDfN.exe
  C:\Windows\System\CWQIDfN.exe
  2⤵
  PID:436
- C:\Windows\System\EKpNHgk.exe
  C:\Windows\System\EKpNHgk.exe
  2⤵
  PID:13352
- C:\Windows\System\BaiYOdt.exe
  C:\Windows\System\BaiYOdt.exe
  2⤵
  PID:1860
- C:\Windows\System\NnuJZoe.exe
  C:\Windows\System\NnuJZoe.exe
  2⤵
  PID:3428
- C:\Windows\System\oGtnofu.exe
  C:\Windows\System\oGtnofu.exe
  2⤵
  PID:1216
- C:\Windows\System\bVaFJbe.exe
  C:\Windows\System\bVaFJbe.exe
  2⤵
  PID:4132
- C:\Windows\System\rbnCfhi.exe
  C:\Windows\System\rbnCfhi.exe
  2⤵
  PID:13416
- C:\Windows\System\kLAXlJP.exe
  C:\Windows\System\kLAXlJP.exe
  2⤵
  PID:4344
- C:\Windows\System\OHXgnjs.exe
  C:\Windows\System\OHXgnjs.exe
  2⤵
  PID:4260
- C:\Windows\System\YUIqjWY.exe
  C:\Windows\System\YUIqjWY.exe
  2⤵
  PID:2760
- C:\Windows\System\BCknIzb.exe
  C:\Windows\System\BCknIzb.exe
  2⤵
  PID:13856
- C:\Windows\System\rKLdmQW.exe
  C:\Windows\System\rKLdmQW.exe
  2⤵
  PID:13952
- C:\Windows\System\QMhCTsg.exe
  C:\Windows\System\QMhCTsg.exe
  2⤵
  PID:14332
- C:\Windows\System\BeEvpVt.exe
  C:\Windows\System\BeEvpVt.exe
  2⤵
  PID:12828
- C:\Windows\System\fSFjvau.exe
  C:\Windows\System\fSFjvau.exe
  2⤵
  PID:5404
- C:\Windows\System\XXtidyW.exe
  C:\Windows\System\XXtidyW.exe
  2⤵
  PID:2168
- C:\Windows\System\nZFLOVu.exe
  C:\Windows\System\nZFLOVu.exe
  2⤵
  PID:7216
- C:\Windows\System\MNKmAhf.exe
  C:\Windows\System\MNKmAhf.exe
  2⤵
  PID:7396
- C:\Windows\System\axTmZRW.exe
  C:\Windows\System\axTmZRW.exe
  2⤵
  PID:7556
- C:\Windows\System\dRIoJMu.exe
  C:\Windows\System\dRIoJMu.exe
  2⤵
  PID:4560
- C:\Windows\System\dCdIBfW.exe
  C:\Windows\System\dCdIBfW.exe
  2⤵
  PID:10204
- C:\Windows\System\qyxXvKO.exe
  C:\Windows\System\qyxXvKO.exe
  2⤵
  PID:11660
- C:\Windows\System\GKtgXrT.exe
  C:\Windows\System\GKtgXrT.exe
  2⤵
  PID:13412
- C:\Windows\System\ghEHnrv.exe
  C:\Windows\System\ghEHnrv.exe
  2⤵
  PID:12032
- C:\Windows\System\ZxPAsmB.exe
  C:\Windows\System\ZxPAsmB.exe
  2⤵
  PID:11740
- C:\Windows\System\xIcdMRd.exe
  C:\Windows\System\xIcdMRd.exe
  2⤵
  PID:1484
- C:\Windows\System\FUpwwGc.exe
  C:\Windows\System\FUpwwGc.exe
  2⤵
  PID:2584
- C:\Windows\System\fhKIWmo.exe
  C:\Windows\System\fhKIWmo.exe
  2⤵
  PID:1432
- C:\Windows\System\xSTydLG.exe
  C:\Windows\System\xSTydLG.exe
  2⤵
  PID:5112
- C:\Windows\System\ejxdEuJ.exe
  C:\Windows\System\ejxdEuJ.exe
  2⤵
  PID:320
- C:\Windows\System\cXUmMLq.exe
  C:\Windows\System\cXUmMLq.exe
  2⤵
  PID:2340
- C:\Windows\System\IfVxdyQ.exe
  C:\Windows\System\IfVxdyQ.exe
  2⤵
  PID:4796
- C:\Windows\System\QBKPcKq.exe
  C:\Windows\System\QBKPcKq.exe
  2⤵
  PID:6672
- C:\Windows\System\zMnGEwO.exe
  C:\Windows\System\zMnGEwO.exe
  2⤵
  PID:1800
- C:\Windows\System\EafYHSy.exe
  C:\Windows\System\EafYHSy.exe
  2⤵
  PID:7192
- C:\Windows\System\zPrlywZ.exe
  C:\Windows\System\zPrlywZ.exe
  2⤵
  PID:7708
- C:\Windows\System\UEtNFyN.exe
  C:\Windows\System\UEtNFyN.exe
  2⤵
  PID:8140
- C:\Windows\System\knymZpv.exe
  C:\Windows\System\knymZpv.exe
  2⤵
  PID:5616
- C:\Windows\System\qkNalvm.exe
  C:\Windows\System\qkNalvm.exe
  2⤵
  PID:7420
- C:\Windows\System\cqRnIMp.exe
  C:\Windows\System\cqRnIMp.exe
  2⤵
  PID:7076
- C:\Windows\System\fudFihd.exe
  C:\Windows\System\fudFihd.exe
  2⤵
  PID:2960
- C:\Windows\System\LCkjCLI.exe
  C:\Windows\System\LCkjCLI.exe
  2⤵
  PID:4660
- C:\Windows\System\alYWcCi.exe
  C:\Windows\System\alYWcCi.exe
  2⤵
  PID:2248
- C:\Windows\System\gZzCsMM.exe
  C:\Windows\System\gZzCsMM.exe
  2⤵
  PID:3240
- C:\Windows\System\ieLmtfK.exe
  C:\Windows\System\ieLmtfK.exe
  2⤵
  PID:14316
- C:\Windows\System\ZPbJHzA.exe
  C:\Windows\System\ZPbJHzA.exe
  2⤵
  PID:14256
- C:\Windows\System\BGKzoMn.exe
  C:\Windows\System\BGKzoMn.exe
  2⤵
  PID:2692
- C:\Windows\System\bhIdwKB.exe
  C:\Windows\System\bhIdwKB.exe
  2⤵
  PID:4556
- C:\Windows\System\AczQWmk.exe
  C:\Windows\System\AczQWmk.exe
  2⤵
  PID:13372
- C:\Windows\System\ctZfjfY.exe
  C:\Windows\System\ctZfjfY.exe
  2⤵
  PID:1780
- C:\Windows\System\TPmdFrS.exe
  C:\Windows\System\TPmdFrS.exe
  2⤵
  PID:1636
- C:\Windows\System\hjTGDZG.exe
  C:\Windows\System\hjTGDZG.exe
  2⤵
  PID:13784
- C:\Windows\System\yMaLUTG.exe
  C:\Windows\System\yMaLUTG.exe
  2⤵
  PID:2116
- C:\Windows\System\MGCcPqo.exe
  C:\Windows\System\MGCcPqo.exe
  2⤵
  PID:5244
- C:\Windows\System\OnNZLAS.exe
  C:\Windows\System\OnNZLAS.exe
  2⤵
  PID:5336
- C:\Windows\System\JUkiYfk.exe
  C:\Windows\System\JUkiYfk.exe
  2⤵
  PID:5552
- C:\Windows\System\NPnCNqr.exe
  C:\Windows\System\NPnCNqr.exe
  2⤵
  PID:7312
- C:\Windows\System\rgCJtKU.exe
  C:\Windows\System\rgCJtKU.exe
  2⤵
  PID:5944
- C:\Windows\System\VIxuuuD.exe
  C:\Windows\System\VIxuuuD.exe
  2⤵
  PID:7424
- C:\Windows\System\YRgpoMj.exe
  C:\Windows\System\YRgpoMj.exe
  2⤵
  PID:7768
- C:\Windows\System\lFjFSuX.exe
  C:\Windows\System\lFjFSuX.exe
  2⤵
  PID:5136
- C:\Windows\System\wWHCDuw.exe
  C:\Windows\System\wWHCDuw.exe
  2⤵
  PID:6996
- C:\Windows\System\jTxJvuj.exe
  C:\Windows\System\jTxJvuj.exe
  2⤵
  PID:14044
- C:\Windows\System\UsgtKia.exe
  C:\Windows\System\UsgtKia.exe
  2⤵
  PID:5036
- C:\Windows\System\sJGARjr.exe
  C:\Windows\System\sJGARjr.exe
  2⤵
  PID:5248
- C:\Windows\System\ZgpnBYr.exe
  C:\Windows\System\ZgpnBYr.exe
  2⤵
  PID:5540
- C:\Windows\System\PIcUXuV.exe
  C:\Windows\System\PIcUXuV.exe
  2⤵
  PID:5656
- C:\Windows\System\YmDuaGW.exe
  C:\Windows\System\YmDuaGW.exe
  2⤵
  PID:4820
- C:\Windows\System\hROGriY.exe
  C:\Windows\System\hROGriY.exe
  2⤵
  PID:6824
- C:\Windows\System\grRzRHD.exe
  C:\Windows\System\grRzRHD.exe
  2⤵
  PID:14084
- C:\Windows\System\WRTVeFO.exe
  C:\Windows\System\WRTVeFO.exe
  2⤵
  PID:11640
- C:\Windows\System\qLjVPaI.exe
  C:\Windows\System\qLjVPaI.exe
  2⤵
  PID:7068
- C:\Windows\System\TagEQKu.exe
  C:\Windows\System\TagEQKu.exe
  2⤵
  PID:5100
- C:\Windows\System\ELwQYTo.exe
  C:\Windows\System\ELwQYTo.exe
  2⤵
  PID:5088
- C:\Windows\System\ZOrwNLm.exe
  C:\Windows\System\ZOrwNLm.exe
  2⤵
  PID:64
- C:\Windows\System\AkZByRO.exe
  C:\Windows\System\AkZByRO.exe
  2⤵
  PID:13484
- C:\Windows\System\CFaHbsU.exe
  C:\Windows\System\CFaHbsU.exe
  2⤵
  PID:2288
- C:\Windows\System\kvCyUps.exe
  C:\Windows\System\kvCyUps.exe
  2⤵
  PID:5180
- C:\Windows\System\DXgtCkE.exe
  C:\Windows\System\DXgtCkE.exe
  2⤵
  PID:7632
- C:\Windows\System\aYAQcYn.exe
  C:\Windows\System\aYAQcYn.exe
  2⤵
  PID:13404
- C:\Windows\System\SFzyhMB.exe
  C:\Windows\System\SFzyhMB.exe
  2⤵
  PID:6800
- C:\Windows\System\ldZqCIy.exe
  C:\Windows\System\ldZqCIy.exe
  2⤵
  PID:8064
- C:\Windows\System\mwGQdfr.exe
  C:\Windows\System\mwGQdfr.exe
  2⤵
  PID:5124
- C:\Windows\System\VPmnXLt.exe
  C:\Windows\System\VPmnXLt.exe
  2⤵
  PID:6540
- C:\Windows\System\CzAQriu.exe
  C:\Windows\System\CzAQriu.exe
  2⤵
  PID:6956
- C:\Windows\System\MUdNIho.exe
  C:\Windows\System\MUdNIho.exe
  2⤵
  PID:6916
- C:\Windows\System\vyDgtoY.exe
  C:\Windows\System\vyDgtoY.exe
  2⤵
  PID:13644
- C:\Windows\System\fCsygDA.exe
  C:\Windows\System\fCsygDA.exe
  2⤵
  PID:2364
- C:\Windows\System\noBVmzV.exe
  C:\Windows\System\noBVmzV.exe
  2⤵
  PID:5792
- C:\Windows\System\VRoWlKp.exe
  C:\Windows\System\VRoWlKp.exe
  2⤵
  PID:6776
- C:\Windows\System\DPnhwkj.exe
  C:\Windows\System\DPnhwkj.exe
  2⤵
  PID:8252
- C:\Windows\System\ySpmFoG.exe
  C:\Windows\System\ySpmFoG.exe
  2⤵
  PID:4372
- C:\Windows\System\gDrIAfR.exe
  C:\Windows\System\gDrIAfR.exe
  2⤵
  PID:3860
- C:\Windows\System\hRUNQKh.exe
  C:\Windows\System\hRUNQKh.exe
  2⤵
  PID:9316
- C:\Windows\System\wWgyGVJ.exe
  C:\Windows\System\wWgyGVJ.exe
  2⤵
  PID:9328
- C:\Windows\System\NCfFqcn.exe
  C:\Windows\System\NCfFqcn.exe
  2⤵
  PID:4736
- C:\Windows\System\OunGhZY.exe
  C:\Windows\System\OunGhZY.exe
  2⤵
  PID:13780
- C:\Windows\System\rJkUWfX.exe
  C:\Windows\System\rJkUWfX.exe
  2⤵
  PID:9420
- C:\Windows\System\CswiRLq.exe
  C:\Windows\System\CswiRLq.exe
  2⤵
  PID:9168
- C:\Windows\System\JqYqlAN.exe
  C:\Windows\System\JqYqlAN.exe
  2⤵
  PID:9496
- C:\Windows\System\bKNClGv.exe
  C:\Windows\System\bKNClGv.exe
  2⤵
  PID:7040
- C:\Windows\System\cXhukcK.exe
  C:\Windows\System\cXhukcK.exe
  2⤵
  PID:9588
- C:\Windows\System\wTYNoIU.exe
  C:\Windows\System\wTYNoIU.exe
  2⤵
  PID:9656
- C:\Windows\System\fFBGLuo.exe
  C:\Windows\System\fFBGLuo.exe
  2⤵
  PID:9664
- C:\Windows\System\nOQekHp.exe
  C:\Windows\System\nOQekHp.exe
  2⤵
  PID:13980
- C:\Windows\System\bIhaSTk.exe
  C:\Windows\System\bIhaSTk.exe
  2⤵
  PID:8808
- C:\Windows\System\PTCBlzy.exe
  C:\Windows\System\PTCBlzy.exe
  2⤵
  PID:7968
- C:\Windows\System\HaCnhOR.exe
  C:\Windows\System\HaCnhOR.exe
  2⤵
  PID:9532
- C:\Windows\System\OjNSgTO.exe
  C:\Windows\System\OjNSgTO.exe
  2⤵
  PID:13596
- C:\Windows\System\kJGUhXs.exe
  C:\Windows\System\kJGUhXs.exe
  2⤵
  PID:9552
- C:\Windows\System\PWRzzez.exe
  C:\Windows\System\PWRzzez.exe
  2⤵
  PID:10464
- C:\Windows\System\vNxlJJt.exe
  C:\Windows\System\vNxlJJt.exe
  2⤵
  PID:4828
- C:\Windows\System\nRciRSh.exe
  C:\Windows\System\nRciRSh.exe
  2⤵
  PID:9832
- C:\Windows\System\aBswiRZ.exe
  C:\Windows\System\aBswiRZ.exe
  2⤵
  PID:10728
- C:\Windows\System\ulDvNNR.exe
  C:\Windows\System\ulDvNNR.exe
  2⤵
  PID:9416
- C:\Windows\System\jBnKEor.exe
  C:\Windows\System\jBnKEor.exe
  2⤵
  PID:8052
- C:\Windows\System\GsraMOc.exe
  C:\Windows\System\GsraMOc.exe
  2⤵
  PID:10752
- C:\Windows\System\yniUpSU.exe
  C:\Windows\System\yniUpSU.exe
  2⤵
  PID:6572
- C:\Windows\System\cnpZHPp.exe
  C:\Windows\System\cnpZHPp.exe
  2⤵
  PID:10852
- C:\Windows\System\RfpUTBU.exe
  C:\Windows\System\RfpUTBU.exe
  2⤵
  PID:7844
- C:\Windows\System\EGhEJYA.exe
  C:\Windows\System\EGhEJYA.exe
  2⤵
  PID:10724
- C:\Windows\System\WPmAarx.exe
  C:\Windows\System\WPmAarx.exe
  2⤵
  PID:8528
- C:\Windows\System\MfodPBT.exe
  C:\Windows\System\MfodPBT.exe
  2⤵
  PID:8700
- C:\Windows\System\JHiDmhF.exe
  C:\Windows\System\JHiDmhF.exe
  2⤵
  PID:9720
- C:\Windows\System\FjRyDww.exe
  C:\Windows\System\FjRyDww.exe
  2⤵
  PID:1436
- C:\Windows\System\RONOSZQ.exe
  C:\Windows\System\RONOSZQ.exe
  2⤵
  PID:10976
- C:\Windows\System\GppKyAi.exe
  C:\Windows\System\GppKyAi.exe
  2⤵
  PID:10360
- C:\Windows\System\JmemzMx.exe
  C:\Windows\System\JmemzMx.exe
  2⤵
  PID:10380
- C:\Windows\System\NEpMBhs.exe
  C:\Windows\System\NEpMBhs.exe
  2⤵
  PID:11040
- C:\Windows\System\WSgUWcP.exe
  C:\Windows\System\WSgUWcP.exe
  2⤵
  PID:2456
- C:\Windows\System\cwrasWt.exe
  C:\Windows\System\cwrasWt.exe
  2⤵
  PID:9632
- C:\Windows\System\jpoiWvO.exe
  C:\Windows\System\jpoiWvO.exe
  2⤵
  PID:9428
- C:\Windows\System\fRaYfaS.exe
  C:\Windows\System\fRaYfaS.exe
  2⤵
  PID:5952
- C:\Windows\System\hTdipWo.exe
  C:\Windows\System\hTdipWo.exe
  2⤵
  PID:8348
- C:\Windows\System\RpArngO.exe
  C:\Windows\System\RpArngO.exe
  2⤵
  PID:9684
- C:\Windows\System\ibRLEiO.exe
  C:\Windows\System\ibRLEiO.exe
  2⤵
  PID:10712
- C:\Windows\System\OWMLblT.exe
  C:\Windows\System\OWMLblT.exe
  2⤵
  PID:10880
- C:\Windows\System\EEFwIzA.exe
  C:\Windows\System\EEFwIzA.exe
  2⤵
  PID:7824
- C:\Windows\System\mApJEwQ.exe
  C:\Windows\System\mApJEwQ.exe
  2⤵
  PID:11380
- C:\Windows\System\BSevKnf.exe
  C:\Windows\System\BSevKnf.exe
  2⤵
  PID:10960
- C:\Windows\System\TTtiome.exe
  C:\Windows\System\TTtiome.exe
  2⤵
  PID:11676
- C:\Windows\System\tXgWKYD.exe
  C:\Windows\System\tXgWKYD.exe
  2⤵
  PID:6552
- C:\Windows\System\TqviyzQ.exe
  C:\Windows\System\TqviyzQ.exe
  2⤵
  PID:996
- C:\Windows\System\BaAteHj.exe
  C:\Windows\System\BaAteHj.exe
  2⤵
  PID:5104
- C:\Windows\System\WYzhTfW.exe
  C:\Windows\System\WYzhTfW.exe
  2⤵
  PID:8032
- C:\Windows\System\sGilyEu.exe
  C:\Windows\System\sGilyEu.exe
  2⤵
  PID:9516
- C:\Windows\System\LkOlwsC.exe
  C:\Windows\System\LkOlwsC.exe
  2⤵
  PID:12172
- C:\Windows\System\nNaWRAf.exe
  C:\Windows\System\nNaWRAf.exe
  2⤵
  PID:10344
- C:\Windows\System\RmdoaZM.exe
  C:\Windows\System\RmdoaZM.exe
  2⤵
  PID:10616
- C:\Windows\System\iZmknOl.exe
  C:\Windows\System\iZmknOl.exe
  2⤵
  PID:10680
- C:\Windows\System\dzQPodq.exe
  C:\Windows\System\dzQPodq.exe
  2⤵
  PID:4972
- C:\Windows\System\waDnZii.exe
  C:\Windows\System\waDnZii.exe
  2⤵
  PID:9500
- C:\Windows\System\infpDus.exe
  C:\Windows\System\infpDus.exe
  2⤵
  PID:11056
- C:\Windows\System\XqkWZfL.exe
  C:\Windows\System\XqkWZfL.exe
  2⤵
  PID:12752
- C:\Windows\System\SpvvOjo.exe
  C:\Windows\System\SpvvOjo.exe
  2⤵
  PID:11836
- C:\Windows\System\RSRFGrQ.exe
  C:\Windows\System\RSRFGrQ.exe
  2⤵
  PID:11960
- C:\Windows\System\xOqoXLx.exe
  C:\Windows\System\xOqoXLx.exe
  2⤵
  PID:11976
- C:\Windows\System\wyliRLV.exe
  C:\Windows\System\wyliRLV.exe
  2⤵
  PID:8300
- C:\Windows\System\RonNByd.exe
  C:\Windows\System\RonNByd.exe
  2⤵
  PID:13140
- C:\Windows\System\IrksOOK.exe
  C:\Windows\System\IrksOOK.exe
  2⤵
  PID:7344
- C:\Windows\System\pGleEqp.exe
  C:\Windows\System\pGleEqp.exe
  2⤵
  PID:13288
- C:\Windows\System\GMlBtpu.exe
  C:\Windows\System\GMlBtpu.exe
  2⤵
  PID:9716
- C:\Windows\System\tamRYhO.exe
  C:\Windows\System\tamRYhO.exe
  2⤵
  PID:9304
- C:\Windows\System\QoVpmWT.exe
  C:\Windows\System\QoVpmWT.exe
  2⤵
  PID:10888
- C:\Windows\System\owUKGGO.exe
  C:\Windows\System\owUKGGO.exe
  2⤵
  PID:11620
- C:\Windows\System\dfZcslp.exe
  C:\Windows\System\dfZcslp.exe
  2⤵
  PID:10936
- C:\Windows\System\ljzqbdq.exe
  C:\Windows\System\ljzqbdq.exe
  2⤵
  PID:9384
- C:\Windows\System\nFQEKfx.exe
  C:\Windows\System\nFQEKfx.exe
  2⤵
  PID:12692
- C:\Windows\System\OiIbVUw.exe
  C:\Windows\System\OiIbVUw.exe
  2⤵
  PID:11168
- C:\Windows\System\xACYFDl.exe
  C:\Windows\System\xACYFDl.exe
  2⤵
  PID:9116
- C:\Windows\System\pNVBFWF.exe
  C:\Windows\System\pNVBFWF.exe
  2⤵
  PID:13144
- C:\Windows\System\fySxQaS.exe
  C:\Windows\System\fySxQaS.exe
  2⤵
  PID:10548
- C:\Windows\System\gBaZXPG.exe
  C:\Windows\System\gBaZXPG.exe
  2⤵
  PID:13540
- C:\Windows\System\LKTcdxe.exe
  C:\Windows\System\LKTcdxe.exe
  2⤵
  PID:9816
- C:\Windows\System\HAIyrRY.exe
  C:\Windows\System\HAIyrRY.exe
  2⤵
  PID:7196
- C:\Windows\System\JvtEqAy.exe
  C:\Windows\System\JvtEqAy.exe
  2⤵
  PID:4524
- C:\Windows\System\aJiKnrJ.exe
  C:\Windows\System\aJiKnrJ.exe
  2⤵
  PID:12512
- C:\Windows\System\uPrroDs.exe
  C:\Windows\System\uPrroDs.exe
  2⤵
  PID:11384
- C:\Windows\System\QvCgrUf.exe
  C:\Windows\System\QvCgrUf.exe
  2⤵
  PID:8752
- C:\Windows\System\JqbKnKD.exe
  C:\Windows\System\JqbKnKD.exe
  2⤵
  PID:12292
- C:\Windows\System\jJPDfZW.exe
  C:\Windows\System\jJPDfZW.exe
  2⤵
  PID:8500
- C:\Windows\System\kQoSBcq.exe
  C:\Windows\System\kQoSBcq.exe
  2⤵
  PID:6872
- C:\Windows\System\YRbTVVS.exe
  C:\Windows\System\YRbTVVS.exe
  2⤵
  PID:9984
- C:\Windows\System\jvacyqU.exe
  C:\Windows\System\jvacyqU.exe
  2⤵
  PID:6704
- C:\Windows\System\WVUgLHl.exe
  C:\Windows\System\WVUgLHl.exe
  2⤵
  PID:6476
- C:\Windows\System\nHBdPUg.exe
  C:\Windows\System\nHBdPUg.exe
  2⤵
  PID:7412
- C:\Windows\System\yihhali.exe
  C:\Windows\System\yihhali.exe
  2⤵
  PID:10620
- C:\Windows\System\DNcWiHa.exe
  C:\Windows\System\DNcWiHa.exe
  2⤵
  PID:3728
- C:\Windows\System\PuixQaz.exe
  C:\Windows\System\PuixQaz.exe
  2⤵
  PID:13028
- C:\Windows\System\KZMIedf.exe
  C:\Windows\System\KZMIedf.exe
  2⤵
  PID:12452
- C:\Windows\System\mlUDtdb.exe
  C:\Windows\System\mlUDtdb.exe
  2⤵
  PID:10820
- C:\Windows\System\vOfGnmJ.exe
  C:\Windows\System\vOfGnmJ.exe
  2⤵
  PID:12088
- C:\Windows\System\iihhjAJ.exe
  C:\Windows\System\iihhjAJ.exe
  2⤵
  PID:4504
- C:\Windows\System\mhOIjEA.exe
  C:\Windows\System\mhOIjEA.exe
  2⤵
  PID:9488
- C:\Windows\System\IXsdmQk.exe
  C:\Windows\System\IXsdmQk.exe
  2⤵
  PID:9772
- C:\Windows\System\yfqDxua.exe
  C:\Windows\System\yfqDxua.exe
  2⤵
  PID:11724
- C:\Windows\System\LflJMmO.exe
  C:\Windows\System\LflJMmO.exe
  2⤵
  PID:12332
- C:\Windows\System\qLaNagt.exe
  C:\Windows\System\qLaNagt.exe
  2⤵
  PID:11580
- C:\Windows\System\HOlIYiD.exe
  C:\Windows\System\HOlIYiD.exe
  2⤵
  PID:6952
- C:\Windows\System\TApdFRd.exe
  C:\Windows\System\TApdFRd.exe
  2⤵
  PID:10532
- C:\Windows\System\taUaNCr.exe
  C:\Windows\System\taUaNCr.exe
  2⤵
  PID:12808
- C:\Windows\System\ZDgjLne.exe
  C:\Windows\System\ZDgjLne.exe
  2⤵
  PID:12528
- C:\Windows\System\UhdwoYl.exe
  C:\Windows\System\UhdwoYl.exe
  2⤵
  PID:1992
- C:\Windows\System\XsdpoNn.exe
  C:\Windows\System\XsdpoNn.exe
  2⤵
  PID:12968
- C:\Windows\System\iGjxZjd.exe
  C:\Windows\System\iGjxZjd.exe
  2⤵
  PID:12472
- C:\Windows\System\KqUypxN.exe
  C:\Windows\System\KqUypxN.exe
  2⤵
  PID:8164
- C:\Windows\System\GHtaeBK.exe
  C:\Windows\System\GHtaeBK.exe
  2⤵
  PID:13128
- C:\Windows\System\GPQlHdI.exe
  C:\Windows\System\GPQlHdI.exe
  2⤵
  PID:11932
- C:\Windows\System\IKTVgDZ.exe
  C:\Windows\System\IKTVgDZ.exe
  2⤵
  PID:10272
- C:\Windows\System\GRqcbkb.exe
  C:\Windows\System\GRqcbkb.exe
  2⤵
  PID:9148
- C:\Windows\System\zDrbxWj.exe
  C:\Windows\System\zDrbxWj.exe
  2⤵
  PID:9544
- C:\Windows\System\pCPIxmk.exe
  C:\Windows\System\pCPIxmk.exe
  2⤵
  PID:12388
- C:\Windows\System\lKQLmEP.exe
  C:\Windows\System\lKQLmEP.exe
  2⤵
  PID:12824
- C:\Windows\System\QKMYEtR.exe
  C:\Windows\System\QKMYEtR.exe
  2⤵
  PID:9052
- C:\Windows\System\mhgVQRt.exe
  C:\Windows\System\mhgVQRt.exe
  2⤵
  PID:10972
- C:\Windows\System\bmBfahy.exe
  C:\Windows\System\bmBfahy.exe
  2⤵
  PID:8976
- C:\Windows\System\ExPDGTW.exe
  C:\Windows\System\ExPDGTW.exe
  2⤵
  PID:10316
- C:\Windows\System\iZyVarf.exe
  C:\Windows\System\iZyVarf.exe
  2⤵
  PID:12356
- C:\Windows\System\gQsRKAh.exe
  C:\Windows\System\gQsRKAh.exe
  2⤵
  PID:5068
- C:\Windows\System\JGWsFwY.exe
  C:\Windows\System\JGWsFwY.exe
  2⤵
  PID:10500
- C:\Windows\System\sfUmHaO.exe
  C:\Windows\System\sfUmHaO.exe
  2⤵
  PID:11244
- C:\Windows\System\bTSTpuI.exe
  C:\Windows\System\bTSTpuI.exe
  2⤵
  PID:9432
- C:\Windows\System\pPyLArJ.exe
  C:\Windows\System\pPyLArJ.exe
  2⤵
  PID:7924
- C:\Windows\System\FmVlabz.exe
  C:\Windows\System\FmVlabz.exe
  2⤵
  PID:7432
- C:\Windows\System\IzzfJcF.exe
  C:\Windows\System\IzzfJcF.exe
  2⤵
  PID:6852
- C:\Windows\System\DIVkcmR.exe
  C:\Windows\System\DIVkcmR.exe
  2⤵
  PID:7880
- C:\Windows\System\TvKgiOo.exe
  C:\Windows\System\TvKgiOo.exe
  2⤵
  PID:8272
- C:\Windows\System\TyzIuGU.exe
  C:\Windows\System\TyzIuGU.exe
  2⤵
  PID:13680
- C:\Windows\System\jhTkKaP.exe
  C:\Windows\System\jhTkKaP.exe
  2⤵
  PID:7732
- C:\Windows\System\eXXezPL.exe
  C:\Windows\System\eXXezPL.exe
  2⤵
  PID:10432
- C:\Windows\System\PNxuDVZ.exe
  C:\Windows\System\PNxuDVZ.exe
  2⤵
  PID:8420
- C:\Windows\System\uXelNcm.exe
  C:\Windows\System\uXelNcm.exe
  2⤵
  PID:10536
- C:\Windows\System\FlJYHWq.exe
  C:\Windows\System\FlJYHWq.exe
  2⤵
  PID:4760
- C:\Windows\System\KOZMZOw.exe
  C:\Windows\System\KOZMZOw.exe
  2⤵
  PID:13972
- C:\Windows\System\mmtGqao.exe
  C:\Windows\System\mmtGqao.exe
  2⤵
  PID:10516
- C:\Windows\System\aJbnOAZ.exe
  C:\Windows\System\aJbnOAZ.exe
  2⤵
  PID:13232
- C:\Windows\System\lhiCCXT.exe
  C:\Windows\System\lhiCCXT.exe
  2⤵
  PID:9020
- C:\Windows\System\GrtxoJQ.exe
  C:\Windows\System\GrtxoJQ.exe
  2⤵
  PID:2560
- C:\Windows\System\lLtLnem.exe
  C:\Windows\System\lLtLnem.exe
  2⤵
  PID:13420
- C:\Windows\System\UKctMOn.exe
  C:\Windows\System\UKctMOn.exe
  2⤵
  PID:13508
- C:\Windows\System\ddRaaKo.exe
  C:\Windows\System\ddRaaKo.exe
  2⤵
  PID:11144
- C:\Windows\System\cjYRjJQ.exe
  C:\Windows\System\cjYRjJQ.exe
  2⤵
  PID:13348
- C:\Windows\System\fQGvrxY.exe
  C:\Windows\System\fQGvrxY.exe
  2⤵
  PID:11284
- C:\Windows\System\nvlooVO.exe
  C:\Windows\System\nvlooVO.exe
  2⤵
  PID:11772
- C:\Windows\System\DECnLoa.exe
  C:\Windows\System\DECnLoa.exe
  2⤵
  PID:8916
- C:\Windows\System\qhHcDAM.exe
  C:\Windows\System\qhHcDAM.exe
  2⤵
  PID:12780
- C:\Windows\System\GMtcKbD.exe
  C:\Windows\System\GMtcKbD.exe
  2⤵
  PID:11616
- C:\Windows\System\gIqXZfm.exe
  C:\Windows\System\gIqXZfm.exe
  2⤵
  PID:10032
- C:\Windows\System\cjlfLoh.exe
  C:\Windows\System\cjlfLoh.exe
  2⤵
  PID:11972
- C:\Windows\System\lZzxDMY.exe
  C:\Windows\System\lZzxDMY.exe
  2⤵
  PID:7484
- C:\Windows\System\cYGeLGw.exe
  C:\Windows\System\cYGeLGw.exe
  2⤵
  PID:12240
- C:\Windows\System\cDIawfn.exe
  C:\Windows\System\cDIawfn.exe
  2⤵
  PID:10544
- C:\Windows\System\XfanKDe.exe
  C:\Windows\System\XfanKDe.exe
  2⤵
  PID:9644
- C:\Windows\System\jAYhlby.exe
  C:\Windows\System\jAYhlby.exe
  2⤵
  PID:3680
- C:\Windows\System\xfqhrtk.exe
  C:\Windows\System\xfqhrtk.exe
  2⤵
  PID:10920
- C:\Windows\System\vrrFLnK.exe
  C:\Windows\System\vrrFLnK.exe
  2⤵
  PID:10944
- C:\Windows\System\gcDCfxd.exe
  C:\Windows\System\gcDCfxd.exe
  2⤵
  PID:12820
- C:\Windows\System\MysaggW.exe
  C:\Windows\System\MysaggW.exe
  2⤵
  PID:10244
- C:\Windows\System\VGWJjza.exe
  C:\Windows\System\VGWJjza.exe
  2⤵
  PID:8776
- C:\Windows\System\ExhAefV.exe
  C:\Windows\System\ExhAefV.exe
  2⤵
  PID:7388
- C:\Windows\System\tmvFlGf.exe
  C:\Windows\System\tmvFlGf.exe
  2⤵
  PID:9540
- C:\Windows\System\zSElWrQ.exe
  C:\Windows\System\zSElWrQ.exe
  2⤵
  PID:11816
- C:\Windows\System\GEIACQt.exe
  C:\Windows\System\GEIACQt.exe
  2⤵
  PID:9640
- C:\Windows\System\HrRcWsx.exe
  C:\Windows\System\HrRcWsx.exe
  2⤵
  PID:12056
- C:\Windows\System\VBCiUNL.exe
  C:\Windows\System\VBCiUNL.exe
  2⤵
  PID:11548
- C:\Windows\System\YAbEnWR.exe
  C:\Windows\System\YAbEnWR.exe
  2⤵
  PID:9700
- C:\Windows\System\xmWbvlB.exe
  C:\Windows\System\xmWbvlB.exe
  2⤵
  PID:12272
- C:\Windows\System\ZdFzJWm.exe
  C:\Windows\System\ZdFzJWm.exe
  2⤵
  PID:11532
- C:\Windows\System\seNZLFZ.exe
  C:\Windows\System\seNZLFZ.exe
  2⤵
  PID:13488
- C:\Windows\System\HQsoiTi.exe
  C:\Windows\System\HQsoiTi.exe
  2⤵
  PID:13336
- C:\Windows\System\TNCBiKh.exe
  C:\Windows\System\TNCBiKh.exe
  2⤵
  PID:11844
- C:\Windows\System\xsrnZnj.exe
  C:\Windows\System\xsrnZnj.exe
  2⤵
  PID:4568
- C:\Windows\System\hQVViUc.exe
  C:\Windows\System\hQVViUc.exe
  2⤵
  PID:12540
- C:\Windows\System\VuplQjS.exe
  C:\Windows\System\VuplQjS.exe
  2⤵
  PID:12300
- C:\Windows\System\ImqCchU.exe
  C:\Windows\System\ImqCchU.exe
  2⤵
  PID:7548
- C:\Windows\System\urpskut.exe
  C:\Windows\System\urpskut.exe
  2⤵
  PID:12000
- C:\Windows\System\YTrAOeL.exe
  C:\Windows\System\YTrAOeL.exe
  2⤵
  PID:9524
- C:\Windows\System\eGkRvtk.exe
  C:\Windows\System\eGkRvtk.exe
  2⤵
  PID:10336
- C:\Windows\System\GFDVvVF.exe
  C:\Windows\System\GFDVvVF.exe
  2⤵
  PID:10524
- C:\Windows\System\xJPBrMS.exe
  C:\Windows\System\xJPBrMS.exe
  2⤵
  PID:13320
- C:\Windows\System\ubZhzBw.exe
  C:\Windows\System\ubZhzBw.exe
  2⤵
  PID:10584
- C:\Windows\System\cyoOrbn.exe
  C:\Windows\System\cyoOrbn.exe
  2⤵
  PID:13752
- C:\Windows\System\fxSgxfR.exe
  C:\Windows\System\fxSgxfR.exe
  2⤵
  PID:12628
- C:\Windows\System\RFAEDvw.exe
  C:\Windows\System\RFAEDvw.exe
  2⤵
  PID:11488
- C:\Windows\System\VlOcqVc.exe
  C:\Windows\System\VlOcqVc.exe
  2⤵
  PID:10128
- C:\Windows\System\GPhSvDe.exe
  C:\Windows\System\GPhSvDe.exe
  2⤵
  PID:10872
- C:\Windows\System\ufwvPjU.exe
  C:\Windows\System\ufwvPjU.exe
  2⤵
  PID:7776
- C:\Windows\System\ReYxbIo.exe
  C:\Windows\System\ReYxbIo.exe
  2⤵
  PID:12164
- C:\Windows\System\gufxsAY.exe
  C:\Windows\System\gufxsAY.exe
  2⤵
  PID:13088
- C:\Windows\System\WqYynsi.exe
  C:\Windows\System\WqYynsi.exe
  2⤵
  PID:6608
- C:\Windows\System\acioaUd.exe
  C:\Windows\System\acioaUd.exe
  2⤵
  PID:7000
- C:\Windows\System\GkjDEjt.exe
  C:\Windows\System\GkjDEjt.exe
  2⤵
  PID:12956
- C:\Windows\System\MDUpfVo.exe
  C:\Windows\System\MDUpfVo.exe
  2⤵
  PID:10704
- C:\Windows\System\vOmEkPw.exe
  C:\Windows\System\vOmEkPw.exe
  2⤵
  PID:8548
- C:\Windows\System\ogCtCEe.exe
  C:\Windows\System\ogCtCEe.exe
  2⤵
  PID:13668
- C:\Windows\System\zzvMcRV.exe
  C:\Windows\System\zzvMcRV.exe
  2⤵
  PID:11224
- C:\Windows\System\hcsHUBz.exe
  C:\Windows\System\hcsHUBz.exe
  2⤵
  PID:14352
- C:\Windows\System\UVcThVn.exe
  C:\Windows\System\UVcThVn.exe
  2⤵
  PID:14380
- C:\Windows\System\gKfTyEN.exe
  C:\Windows\System\gKfTyEN.exe
  2⤵
  PID:14408
- C:\Windows\System\OhiOePw.exe
  C:\Windows\System\OhiOePw.exe
  2⤵
  PID:14436
- C:\Windows\System\kGZKySt.exe
  C:\Windows\System\kGZKySt.exe
  2⤵
  PID:14464
- C:\Windows\System\lngqYKE.exe
  C:\Windows\System\lngqYKE.exe
  2⤵
  PID:14492
- C:\Windows\System\ZsqDjgO.exe
  C:\Windows\System\ZsqDjgO.exe
  2⤵
  PID:14520
- C:\Windows\System\yjTkpMW.exe
  C:\Windows\System\yjTkpMW.exe
  2⤵
  PID:14548
- C:\Windows\System\QRRqsqO.exe
  C:\Windows\System\QRRqsqO.exe
  2⤵
  PID:14576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0ioxdusy.0ub.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AoAPLHM.exe

Filesize
18B

MD5
5db3df0964e5c695675f39e99d1f288b

SHA1
84b597ea47f1f6b13b223cbb576a55e47a79cfaa

SHA256
15f5f6f9d4846d3bfaf7f8740e9c849aebfecfea6fc86fee82eb18d6ec03fd9f

SHA512
f71b3480e977c4ca4affaaec3f3bd31e3598fdd986ea7bafee42b5d6a8676e69449256bbab19fc0cc61412a454871e6b79cebb0c5e3610b9e98c4f089888aa18

Download Submit
C:\Windows\System\BPCxGvA.exe

Filesize
1.9MB

MD5
02e1c70ad85f1317894eb0a2ae98d568

SHA1
84a66da666af4c2d314c19195d9d65b158d71514

SHA256
486f079e2cbaf6833eb453bbf47897cf8433476abb3c693d127c28b7f218f8b0

SHA512
bab94ea13bedc101f5a474b71d2c339929e7055a05a212d1c2946f54669301b86c798741167cc01603cb1b74dc1dd7c45ea54325eacd4fb3e12785dbbcf255c1

Download Submit
C:\Windows\System\CXoicOn.exe

Filesize
1.9MB

MD5
f0bccccc0fa7348bb9d11439092ea172

SHA1
e6a3b1ef076e36b73812a05a7f8d2731c425d06a

SHA256
a954c95c65797a74996ce707efa3b1778f70e55ca4980a20eb6ef7f16898e1a9

SHA512
ebf53502ddbce5c3f2828c1b18a46183fef1f8af1282242da789f2f38db8e570da6ef7e16cd45481a44e9b0afccb37b491297df6e748d043ef8dc9f9c0904426

Download Submit
C:\Windows\System\DGNBfXv.exe

Filesize
1.9MB

MD5
a43af6e9f88e76dbffa71d7438c8b54a

SHA1
cfc82160df20fc133c1fd6dafd4376b43787c229

SHA256
ab619e6eb70e4d9ef53e10e51d10a0c035ffdecb3811d9742e8a4503f931a924

SHA512
dda14503d93e4780e6bab3d3508fa9566ff837fbe6e56b3880e28841deb3f8425e1e0fe456658074b1eb70b05a4141f5205b8c3e896cfe2c63bc145689c41469

Download Submit
C:\Windows\System\FXJjFAT.exe

Filesize
1.9MB

MD5
9c2983f7886fc18e746663b7a88ef7d1

SHA1
b8c3859cbe761a0345e455d7a71f620e61874169

SHA256
ef49333a05567036d1e194a250fbba0acf06af9f8d38b2771e04afac9158a953

SHA512
9c1888f7ad0157af74ade9ea356fe73805e05237479880031ca101ae773506c31ced02e2251e12f59a60ecf0fbad7e7aab44bdb1cde42c3cd75ab85aff4eac8f

Download Submit
C:\Windows\System\GfoRxNQ.exe

Filesize
1.9MB

MD5
c1cc7ff80df4c56017ef15b131eac110

SHA1
cc1556a201a3061a1243a4e50acaa76ce1f1e6df

SHA256
2607c36c6cf10a888c09a22040853740c81442e3948ece23454a08bc40ae0dad

SHA512
9727851782ffa83f529bc7a58965f9f672839fb779e108f38d08fafaaa0ec2ec223e26d64e07d35b29546316311757558d6fdb3d6e07370eb5633df26144def5

Download Submit
C:\Windows\System\HuibiIz.exe

Filesize
1.9MB

MD5
137d5e49834db39ce24452600e5e4e2b

SHA1
8a7e5e4dff6476ac2092d47c2de96c314d4b055f

SHA256
0bdc6109bf309dce8757ce19d30ab763fe5401c6a17cb8077347bb01549d5876

SHA512
a123f2d9a31e1af3879e4c0a2dc52af00999e8bb24a1a38fcb2803fc912bbc54c315266c97e91ba2b4e4d15107ca856e70f8bd7bf74f7008ef1689141f775936

Download Submit
C:\Windows\System\IEuqIDg.exe

Filesize
1.9MB

MD5
da10aabff21cc2957b92d85b7f2e1b3d

SHA1
adefb42b80f0c5165730d56e0a6ba58e95e38d8c

SHA256
f46148d5d019808e783844b303b2ab70487c5adaa4a541dcf7c4a82e6c1525d6

SHA512
8d8c7769a150621cef7a62bfd51ef385e211483e0c613e3e05ee45d6c22c64de4e2fd5251bf8cb69733234cb42acefbab0edf1f0ab663f27651eefb9803ef5e7

Download Submit
C:\Windows\System\IFMfnrm.exe

Filesize
1.9MB

MD5
e9ceb008d8fb5a0be7d9701adf077acc

SHA1
aaf80a1674e9f8d9dc860645a22c4f4ea2247abc

SHA256
27881f2b72af3ed1deb1fde59c8047e8bb569e1990662c07cd6e44ddda283f90

SHA512
6c91bbb29410d202a147f513d155067aee48d5d5141be67077c14c982912052da62c7251da1db3cc940adf1f8984ebfccf43b18f72bc6d5c405199e282b24b71

Download Submit
C:\Windows\System\IeAkrph.exe

Filesize
1.9MB

MD5
3050b3980abb1e852fd3b832faf44068

SHA1
064f0549a279fdb3704da4a9e4986487c4e243da

SHA256
104d585d4236e371030460e42711654f671088eed1547747e3db1de974497301

SHA512
cba0025b340a9c1a47d9de8a0243e7c48bf76d5fa40f743b9d5275ab42f2289b35118bb91d0b00f60e5f161c09f06bc3cda619b900d4b13d160281106024728b

Download Submit
C:\Windows\System\JSwCmbL.exe

Filesize
1.9MB

MD5
75a000c26d993cc25a0979ed0c5bc103

SHA1
e518c45ff4a294038d3928b680ad3c587c8b6e51

SHA256
6e5391a52df87483e4d56f32c2e6fb8b8829640f46303d88e78dd4ad5993611c

SHA512
56269ce74456c1cc79a05e7bb56436a1e96d20b86a6a05e61767239658f3e5cef9fa2b6d6e1ec16b5fbda289bbaceaca1ae4af5d91c0c87af841c3453f097cba

Download Submit
C:\Windows\System\KEpdzbB.exe

Filesize
1.9MB

MD5
b3a942eec87bb42a30b0b5d27619f26d

SHA1
9a147c8cb4134fb0459ad214a4d8eb56369320ee

SHA256
8d2f27c37601fc807ed0fe9e94787b63283124edaa93383b2cdb5227d723e464

SHA512
6c6d55f6f8f9aff0e3867ed7fef3a1167460e02755dad0510dd61bb1ffa6591bb3c476158e17f4cfe211ecc94e9d846d74b6194fac979e8263fa191cdafa66a0

Download Submit
C:\Windows\System\NksFVSa.exe

Filesize
1.9MB

MD5
a233d59f6b20c9badb81fc655b25a657

SHA1
12e93a261e129e37d4e0e6e1d3a013555ccca9cc

SHA256
97e4aff22cfb45dc34489ba4ef4de2bee00c84adaf99c0b279da9b69690cb36e

SHA512
b1d0724a8845853313b07f59976f2322f43aac853361f81a6dc44190c9ed2937b344eff45f5093a4c64989816e384fe0560ae656612120fa4f93019e79b96376

Download Submit
C:\Windows\System\WcaphKb.exe

Filesize
1.9MB

MD5
e590faf860fa5f332e462715d2bbaa81

SHA1
4297650808004320404bcee33816f292b02cc917

SHA256
0ed93b180ef1c1598591beaaca271256e9a1fccdc0efd7bfa54533d1f21933d6

SHA512
1717e8c6e3394ff1f82f95a719f88905b18c445727d3534d45a86938d02d2c60d3a295a17acfa5b42889920e6331b8228b394afa2097e7677b63198ddd2d7f01

Download Submit
C:\Windows\System\YVKzYxY.exe

Filesize
1.9MB

MD5
73c96808dca8393bdd0dbf8170e06644

SHA1
12dae17deb73faedb317181fd6dfc94549699daf

SHA256
044b0732586d1e71942deca71226cacc6c7fe5486b9fcc36e6025f60f0662b2a

SHA512
a05a40d39e7c604d60a2f40d3a24c7105cf14c06885125818cf374fdf7e1c22f44886e197e282935516721cf1a879be3fed460de7fcc3b1c05d74a177f01e6ad

Download Submit
C:\Windows\System\YpStabU.exe

Filesize
1.9MB

MD5
5257947fd3f608dc65e6a7da2d0306b3

SHA1
805916c8732aea233b9dcf8a635f52f1243b3004

SHA256
49ac48032af6dbd8d9abc3732492344652c3f7939420a66fefc10c6a25bc44c9

SHA512
fd74067fc7fb4168cf57858eb06c484e8fbaac824e0b1bc5f35f3af68f42bd05049a13b46040d43910a6948ce5fdc0f07179bcca5c903ebe9ed13c54adb65041

Download Submit
C:\Windows\System\bScgyxp.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\System\bXadRZy.exe

Filesize
1.9MB

MD5
8bc2d6bcfacb33132e21eb72b81dc9f7

SHA1
1a8cd064a5b4fce33df02682e72025fceac9e399

SHA256
35f00153e331d39cfea5016f778634300e8cf2ba29f51f9b5929e9d072a444be

SHA512
055a908dca026f971d989400b2d6969a6428bed0a9c42e37c7ba5502c2b45db95aa4e8f8602bb2abd95c0a2c14811492cf66f02e9eba0a80fc9587e34936b014

Download Submit
C:\Windows\System\bfOlTjL.exe

Filesize
1.9MB

MD5
6565b40a1b9d9585c620ecfbd6cab10b

SHA1
d2d36c05b2d5a8b4410f53d2f9feec4f3768a0ea

SHA256
0bcef7199282cd80e6125c65432483ceb715b02ca883e354a5e2824c30adb836

SHA512
9cecaf805b884d2e49eeba592c9dcf199bf49b0b520da7bfdc901ffac169c333348c50b5bccbebc67070ce58b9860a81e0d78d1807a37c90ab6d0ad242bf227e

Download Submit
C:\Windows\System\bwqLzKD.exe

Filesize
1.9MB

MD5
06bc65ae3905a380644014f5edbbc158

SHA1
ae42dd7291eb88b38b25f2e390051750b2ee0557

SHA256
b215d95dd70155f46bd01f847e7e65e5897cd419e4463d1ed68c4dc9ad4ff686

SHA512
746bad36fea032b559ea5c87f550e30e46c7a959a5a891b8faddbd0f2d8c2a27412f4afdd22238608f8a6c49772a15c52dfd1154b56fae75ac961bcc4cd9585b

Download Submit
C:\Windows\System\cYRPILA.exe

Filesize
1.9MB

MD5
aa3817c9aa5d3e0bf831ec8d7f5cfb5f

SHA1
90c44fdbe9e3b82f100703ba01415b5c0f58dccd

SHA256
39579613786fb029c052d789e220fc48568ab1100bb33816fd9cda377e09be68

SHA512
03dce425432eada1956167bcef3856e33c4fa69086612844c8a78b1e093adad19ca2367350d60230abf8ebdef57d1bff345bb7dccecb14634725ad75d282b03b

Download Submit
C:\Windows\System\dBfPGiL.exe

Filesize
1.9MB

MD5
edebb7cda677a273d66b2e13e83a6dee

SHA1
81065a1b255b16de2e18e5633615e1c519dc9e46

SHA256
80d7cf614d272b82998f21bf00fe94e1242dc193bac19c255ce8b036aa99e0fa

SHA512
3a23db25882abeeb87c5cc1d1d8695bf718942bbb602305fb36cb803a232bd5bb2a51e505589981e7fe78b2085cc576e589ff2ee09ce5ec1b3df9600f2467019

Download Submit
C:\Windows\System\dMQgkhY.exe

Filesize
1.9MB

MD5
fdec15b601e85b34eef3c7e177a25266

SHA1
e1752fdfdb20261c9befff49187390c649f045ca

SHA256
942125f426718b182efff7e1d69c211b4dcba6a8a5068946ef0d2077b2c75750

SHA512
5af08243ae992768b59593db209fd488ff4aeb2d4e390eb5fa0485ed9755078cc20d4639e3f655c6a0e745ddb800ead8f6b879dbd351c9bcc58ae44ce99b75f2

Download Submit
C:\Windows\System\ecIHoZx.exe

Filesize
1.9MB

MD5
1939232010f9f595c89f22b25420e709

SHA1
82a7ceef9be181658a671ee96901b426528936bf

SHA256
2c794faef118fa3945dbec2017dc47552ad2434e42868fba45bd7998f32816d8

SHA512
d19b72547ee91ffb3b3aaa603145ebb2815af162de262fb286b74f1673e197dc5f063efdd5b8a2e9b4cc79ba88bb1c5e859e016508ab63d52f7d2f195ca54c34

Download Submit
C:\Windows\System\fnlCRYT.exe

Filesize
1.9MB

MD5
c6676ec87b79204847a7abec32fd264a

SHA1
a4a89a3e21715baad174badd067f8de9d55ed174

SHA256
faa13e5fc2887de1a65f8bbeb58575e9c35060a9df3668af156c3c3ca8e3e82f

SHA512
06165af77db0a1afd494fa5dde39ea910f660ba71e3948708cca1e83eafe8172dc560da9abba70fe979d67e1593b6537c0bfa7b64b8026da27b22ead8632d65b

Download Submit
C:\Windows\System\fuoylCN.exe

Filesize
1.9MB

MD5
5124465d0648d34c7936a726e7dc130d

SHA1
afe73dc9d26bddd1f7d025cfb1e9f74ba37e31cc

SHA256
072da76f36ea975c7bed69f9299dae9c25574fbdcd29cd9d9c847982a95503aa

SHA512
ba0918ea03bb100d5191d7138929e8e69378b8a368d8b397028c8a881af68a3f42f835ad777fdb235f46ac346845ab83b5ba153c1079b911c3eb1f0445896f07

Download Submit
C:\Windows\System\gxetePm.exe

Filesize
1.9MB

MD5
e40b9caafcea1fe91a727d2738d95e18

SHA1
f0e49f9f200b366e39b5979f22e36acf0c4c938e

SHA256
ea8c62fe373270eb228e5b7c387bcb4c07b68dce11d414924865e9e78a289148

SHA512
5381c26fa282dfc8e7c03182709505cd68def16edf87e9107c53171b33d1c7b1d49531a25af285baa1b737031d6fbed7e570db549f83f8d694495c035afd7137

Download Submit
C:\Windows\System\iaqYXVC.exe

Filesize
1.9MB

MD5
8da64c7f9686734f86ebf8bce4f034e5

SHA1
8ebec115100815e3b330e16c8953f896521f0b0d

SHA256
302c8159230a32048b84775c91b21f330c973f344c24789c1b37a913d6ed8aa2

SHA512
630f8578fb28c90560ff16d50a22d0053326872dee2ff7c1cb6d5fecc9b2251d4927a7ba84a08e289af2c08d09b39da605bdeb81626ffee5140b7cd9ace067bd

Download Submit
C:\Windows\System\kgQUziq.exe

Filesize
1.9MB

MD5
008a4c892347d46fae60baf6bbb36bc8

SHA1
deb24676c21fd013a1d4462d5295920fc8f75b48

SHA256
c7a06237bf8e399a9aad7635030bff44231b710fb7d1948f526ce5f3a4d3f3f8

SHA512
d398fae5588dbacd279a87da133f4ae6697eb468ac2790fcccdd8484247d41d9b0c4d0f4c86325e0129d0b261d2a83fe634ac61a694819d87103cb32415c4111

Download Submit
C:\Windows\System\lKCeahJ.exe

Filesize
1.9MB

MD5
623227699813998378e42d3839a9062c

SHA1
c6b4639f711aa6cc506d073c3f6e138e00fe5a70

SHA256
8a817b7e4c40c3f3614004555ac2a834e52809e1cda176c44d3921e0bb0ee2ed

SHA512
c7a52040be044047599d2af74c689d7f573b597c71cc39573a4c5889b798584da8e3fb96e0c88f5467b9de9237546d40ef68733bed79fd51d644f1b7d461ad4b

Download Submit
C:\Windows\System\lhoBulb.exe

Filesize
1.9MB

MD5
c2a1a1ce860331393c53149b4ed75930

SHA1
d3758af2f90b38248b321fc7b3ce83f2f37e95a8

SHA256
d915acf6c048750dbccad399f52226dc5018b1a6ffb81e03d9ce36e16d7563fb

SHA512
607ece7e72972da9bd7695d8a61755d3ace04eac8f4d3551e204ed6491f024e16bc622131bc10cc8d44cbce358a0335040f8b472c4fdde8753a0f5ca458a1c56

Download Submit
C:\Windows\System\mEWOYUe.exe

Filesize
1.9MB

MD5
d8bc9f62b5539464d954f91d68ef7ad3

SHA1
eab28d1243decca91b2d5909a852111a45354f19

SHA256
8b5e016b25f391eaf2104f0e772f33e997ab0a63fd61480ed913b9fdc1f68c7b

SHA512
5203994a77854d13cc4f8ba810ca4baf6ae1b32c3b6ec5dcac521e693a43c4bfd7f7eb753516df24436dd810c3184db73051a1ad16b4ae446a0dc8a68efd1ac6

Download Submit
C:\Windows\System\nZCaFvc.exe

Filesize
1.9MB

MD5
4d2447d4935c91f2feabd5c6e78c2034

SHA1
daf642a781ec0296bcbacea56e1fc0790a0bc463

SHA256
8be161c0965883e695e5e19a6f11186da094c1331b22d8cf848562d3411e0ee8

SHA512
6cbbfb42c2d414c5ad58b5d71c0f90a222c6ee965cff7b4059dbbe7b052b86b0cdc79448cf93ccb93df582186c049ea8430793b60af5a93bbaf4b800430c49f7

Download Submit
C:\Windows\System\qyErZXM.exe

Filesize
1.9MB

MD5
124adfb8b4093c79533cb2b3abdeee87

SHA1
979376a37508d77e8dd8a1bf57bc709febe3a57b

SHA256
9199cc0f36e4c2a9d59b39cecd804a4126352b6a844f75680f443903b7062447

SHA512
c3f16e33d745571b254f7342957d642b8c3eead2ba8dc9a5657d22132dbaa06cbf890a9a9c5cf6437806c4f63d926b542b37c034b3ce9ab5b4719a134103c7b4

Download Submit
C:\Windows\System\rCUFryC.exe

Filesize
1.9MB

MD5
25e55d7f864d6c003579fc895bbbc521

SHA1
e9d966dc83af9784cd813b393d4623427aaf5ed6

SHA256
29f7050127f711ab8169f5d3ee5cc6ae1ce5c9d3c48809d1ebe9ed0d956f3f45

SHA512
a5458a13c2a0ec81a883fd49c7806e77f58409e623f9f5c4d5fc30687a32558324fb85cb3fc2c63227cd19c03c4a657a0f32dc09ad7db1ec43b775d0320f19f2

Download Submit
C:\Windows\System\sGhflbT.exe

Filesize
1.9MB

MD5
8159ba30e745fcbba757feb1672dd39e

SHA1
3dc5cd63a492549fd658ff2873520c0d6f9e7875

SHA256
48f701bde3819e41cf7bab46798155e291d66cd3ddecc00e29bcf4536b278c4e

SHA512
7916b652c781a653a57641277492bbff00b2b818f2143b448cf50cac4dbd94fa855edd3372c55cddb4992cbc813b44ef853620d90faf73322ed559e3652aea7e

Download Submit
C:\Windows\System\uapzUdU.exe

Filesize
1.9MB

MD5
91889bdaf68b945c7155beb274c249e2

SHA1
d48faca6f14b5958dee2388560281c3f89dda655

SHA256
31666df1201297ed36648bde33c117c337bf04f639772f9f7362a261783b5450

SHA512
08f9bbe7ec1c9c308e1b97439945b206e4366639bcbd20f3489fee02266a3fed2cb3fe9337221e0e4e01a0b7aa4016442786e581e3d999ffbfbd72fe3407dfbd

Download Submit
C:\Windows\System\xUVLhCo.exe

Filesize
1.9MB

MD5
0b3b9f6ecd5938bf61f41a5b48f47719

SHA1
75dc412e8c37b683cec76bf8e3fdc559c748c8be

SHA256
059d9ebe9da5e174b3128ed2275c7fce78be40ec3ead8484bf4a59cf616e8e36

SHA512
9c60a8e4535634cb2bf897192ed8741eac76c6da14b8d7e5a36be3db1ed485c553184c8e85ffc4e4d302069e6c5bca48a0419b50edfcaa8666787721f26fb1b5

Download Submit
memory/892-33-0x00007FF69EB80000-0x00007FF69EF72000-memory.dmp

Filesize
3.9MB

Download
memory/892-4346-0x00007FF69EB80000-0x00007FF69EF72000-memory.dmp

Filesize
3.9MB

Download
memory/960-4395-0x00007FF6AF4E0000-0x00007FF6AF8D2000-memory.dmp

Filesize
3.9MB

Download
memory/960-255-0x00007FF6AF4E0000-0x00007FF6AF8D2000-memory.dmp

Filesize
3.9MB

Download
memory/1528-4528-0x00007FF68DC40000-0x00007FF68E032000-memory.dmp

Filesize
3.9MB

Download
memory/1528-191-0x00007FF68DC40000-0x00007FF68E032000-memory.dmp

Filesize
3.9MB

Download
memory/1532-215-0x00007FF617680000-0x00007FF617A72000-memory.dmp

Filesize
3.9MB

Download
memory/1532-4524-0x00007FF617680000-0x00007FF617A72000-memory.dmp

Filesize
3.9MB

Download
memory/1720-156-0x00007FF788610000-0x00007FF788A02000-memory.dmp

Filesize
3.9MB

Download
memory/1720-4545-0x00007FF788610000-0x00007FF788A02000-memory.dmp

Filesize
3.9MB

Download
memory/2096-52-0x00007FF76D860000-0x00007FF76DC52000-memory.dmp

Filesize
3.9MB

Download
memory/2096-4523-0x00007FF76D860000-0x00007FF76DC52000-memory.dmp

Filesize
3.9MB

Download
memory/2112-1-0x0000026F0E890000-0x0000026F0E8A0000-memory.dmp

Filesize
64KB

Download
memory/2112-0-0x00007FF6E32A0000-0x00007FF6E3692000-memory.dmp

Filesize
3.9MB

Download
memory/2112-4386-0x00007FF6E32A0000-0x00007FF6E3692000-memory.dmp

Filesize
3.9MB

Download
memory/2180-4410-0x00007FF69FB70000-0x00007FF69FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2180-60-0x00007FF69FB70000-0x00007FF69FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2196-251-0x00007FF773880000-0x00007FF773C72000-memory.dmp

Filesize
3.9MB

Download
memory/2196-4567-0x00007FF773880000-0x00007FF773C72000-memory.dmp

Filesize
3.9MB

Download
memory/2372-260-0x00007FF6B7790000-0x00007FF6B7B82000-memory.dmp

Filesize
3.9MB

Download
memory/2372-4570-0x00007FF6B7790000-0x00007FF6B7B82000-memory.dmp

Filesize
3.9MB

Download
memory/2480-270-0x00000291DC340000-0x00000291DC362000-memory.dmp

Filesize
136KB

Download
memory/2756-259-0x00007FF683FF0000-0x00007FF6843E2000-memory.dmp

Filesize
3.9MB

Download
memory/2756-4554-0x00007FF683FF0000-0x00007FF6843E2000-memory.dmp

Filesize
3.9MB

Download
memory/2984-93-0x00007FF7E46E0000-0x00007FF7E4AD2000-memory.dmp

Filesize
3.9MB

Download
memory/2984-4460-0x00007FF7E46E0000-0x00007FF7E4AD2000-memory.dmp

Filesize
3.9MB

Download
memory/2996-4558-0x00007FF685B60000-0x00007FF685F52000-memory.dmp

Filesize
3.9MB

Download
memory/2996-258-0x00007FF685B60000-0x00007FF685F52000-memory.dmp

Filesize
3.9MB

Download
memory/3152-247-0x00007FF786AA0000-0x00007FF786E92000-memory.dmp

Filesize
3.9MB

Download
memory/3152-4581-0x00007FF786AA0000-0x00007FF786E92000-memory.dmp

Filesize
3.9MB

Download
memory/3172-223-0x00007FF64C800000-0x00007FF64CBF2000-memory.dmp

Filesize
3.9MB

Download
memory/3172-4555-0x00007FF64C800000-0x00007FF64CBF2000-memory.dmp

Filesize
3.9MB

Download
memory/3220-154-0x00007FF7B32E0000-0x00007FF7B36D2000-memory.dmp

Filesize
3.9MB

Download
memory/3220-4458-0x00007FF7B32E0000-0x00007FF7B36D2000-memory.dmp

Filesize
3.9MB

Download
memory/3756-4548-0x00007FF662C90000-0x00007FF663082000-memory.dmp

Filesize
3.9MB

Download
memory/3756-244-0x00007FF662C90000-0x00007FF663082000-memory.dmp

Filesize
3.9MB

Download
memory/3996-4515-0x00007FF669C00000-0x00007FF669FF2000-memory.dmp

Filesize
3.9MB

Download
memory/3996-257-0x00007FF669C00000-0x00007FF669FF2000-memory.dmp

Filesize
3.9MB

Download
memory/4084-256-0x00007FF6417A0000-0x00007FF641B92000-memory.dmp

Filesize
3.9MB

Download
memory/4256-232-0x00007FF752200000-0x00007FF7525F2000-memory.dmp

Filesize
3.9MB

Download
memory/4620-4552-0x00007FF6F74B0000-0x00007FF6F78A2000-memory.dmp

Filesize
3.9MB

Download
memory/4620-218-0x00007FF6F74B0000-0x00007FF6F78A2000-memory.dmp

Filesize
3.9MB

Download
memory/4648-4456-0x00007FF7372A0000-0x00007FF737692000-memory.dmp

Filesize
3.9MB

Download
memory/4648-121-0x00007FF7372A0000-0x00007FF737692000-memory.dmp

Filesize
3.9MB

Download
memory/4656-4562-0x00007FF7DA090000-0x00007FF7DA482000-memory.dmp

Filesize
3.9MB

Download
memory/4656-248-0x00007FF7DA090000-0x00007FF7DA482000-memory.dmp

Filesize
3.9MB

Download
memory/4720-8-0x00007FF69C5A0000-0x00007FF69C992000-memory.dmp

Filesize
3.9MB

Download
memory/4984-28-0x00007FF7063E0000-0x00007FF7067D2000-memory.dmp

Filesize
3.9MB

Download