xmrig | 15404c23f9ba620a8ba8d5fb1720e15b10463f29dd017f880639310cd911360b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 03:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
Size

1.7MB
MD5

06bf77cc23847b6390e771aae689a8ba
SHA1

dfc879cfefeb22ddfc446c1b62b07a5253ec6ee1
SHA256

15404c23f9ba620a8ba8d5fb1720e15b10463f29dd017f880639310cd911360b
SHA512

9932025eba815d1ff23daa3c8856e41e8776bdc453969262b342259b1f36411755532b8e7bf8e1e061d0008fe02adf8c1de27f9aa1f08c52336f7e38bfa00d56
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflD5:NABo

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 28 IoCs

miner

resource	yara_rule
behavioral2/memory/2040-70-0x00007FF771FF0000-0x00007FF7723E2000-memory.dmp	xmrig
behavioral2/memory/1180-77-0x00007FF7BB1B0000-0x00007FF7BB5A2000-memory.dmp	xmrig
behavioral2/memory/796-67-0x00007FF797860000-0x00007FF797C52000-memory.dmp	xmrig
behavioral2/memory/4456-65-0x00007FF7B9340000-0x00007FF7B9732000-memory.dmp	xmrig
behavioral2/memory/4372-54-0x00007FF7E5700000-0x00007FF7E5AF2000-memory.dmp	xmrig
behavioral2/memory/2456-134-0x00007FF6EFA20000-0x00007FF6EFE12000-memory.dmp	xmrig
behavioral2/memory/4820-139-0x00007FF6D0D20000-0x00007FF6D1112000-memory.dmp	xmrig
behavioral2/memory/2568-143-0x00007FF71D830000-0x00007FF71DC22000-memory.dmp	xmrig
behavioral2/memory/2068-146-0x00007FF714B30000-0x00007FF714F22000-memory.dmp	xmrig
behavioral2/memory/3124-142-0x00007FF673090000-0x00007FF673482000-memory.dmp	xmrig
behavioral2/memory/2244-140-0x00007FF748CA0000-0x00007FF749092000-memory.dmp	xmrig
behavioral2/memory/552-133-0x00007FF736AC0000-0x00007FF736EB2000-memory.dmp	xmrig
behavioral2/memory/1740-129-0x00007FF650AA0000-0x00007FF650E92000-memory.dmp	xmrig
behavioral2/memory/1828-113-0x00007FF7D2C90000-0x00007FF7D3082000-memory.dmp	xmrig
behavioral2/memory/4944-97-0x00007FF7B0C80000-0x00007FF7B1072000-memory.dmp	xmrig
behavioral2/memory/4500-88-0x00007FF68A780000-0x00007FF68AB72000-memory.dmp	xmrig
behavioral2/memory/4220-84-0x00007FF7C0EE0000-0x00007FF7C12D2000-memory.dmp	xmrig
behavioral2/memory/4560-81-0x00007FF69B300000-0x00007FF69B6F2000-memory.dmp	xmrig
behavioral2/memory/4472-3869-0x00007FF6E9450000-0x00007FF6E9842000-memory.dmp	xmrig
behavioral2/memory/552-3874-0x00007FF736AC0000-0x00007FF736EB2000-memory.dmp	xmrig
behavioral2/memory/4456-5272-0x00007FF7B9340000-0x00007FF7B9732000-memory.dmp	xmrig
behavioral2/memory/796-5280-0x00007FF797860000-0x00007FF797C52000-memory.dmp	xmrig
behavioral2/memory/2040-5327-0x00007FF771FF0000-0x00007FF7723E2000-memory.dmp	xmrig
behavioral2/memory/1180-5337-0x00007FF7BB1B0000-0x00007FF7BB5A2000-memory.dmp	xmrig
behavioral2/memory/4944-5347-0x00007FF7B0C80000-0x00007FF7B1072000-memory.dmp	xmrig
behavioral2/memory/1828-5351-0x00007FF7D2C90000-0x00007FF7D3082000-memory.dmp	xmrig
behavioral2/memory/4220-5349-0x00007FF7C0EE0000-0x00007FF7C12D2000-memory.dmp	xmrig
behavioral2/memory/3124-6286-0x00007FF673090000-0x00007FF673482000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4456	gaIAOxi.exe
796	sfrZYLY.exe
2888	UgXigKl.exe
5000	IucjmsW.exe
4372	UzitKXj.exe
2040	GrsemBp.exe
1180	WGFaEgL.exe
4500	VnDJdYM.exe
4560	eEkIIqz.exe
4220	MESKrYo.exe
4944	lAmxRnL.exe
1828	tuxDVCC.exe
2456	VSTNgjs.exe
4820	oXuwfrE.exe
2244	abUSMOu.exe
4472	KdFWKul.exe
3124	yGmeEeF.exe
1740	cWGlvGC.exe
2568	YcNeILg.exe
552	WEVmUXk.exe
2068	FVgpwqe.exe
2156	MoiRSoq.exe
4940	SifddoO.exe
4332	AYiAtHE.exe
3732	qMTVxEk.exe
1872	VZToZPb.exe
3104	QzqaEYl.exe
4592	jHhuNBj.exe
3084	LyjQWQv.exe
868	AlkbsBF.exe
4408	fTvWRwv.exe
1972	uQyJGlh.exe
1920	FqiHEHQ.exe
3244	Kfkbreg.exe
4404	CZVErBQ.exe
4024	hIagwfs.exe
1044	GJVUiKk.exe
536	MXrbDPK.exe
4296	isigtpM.exe
4288	HFeWXfI.exe
5080	ZjrcoMA.exe
3920	aFfvkhQ.exe
4196	ABcHsIw.exe
5056	jXELWpA.exe
3096	chUpjkR.exe
3304	goUENyh.exe
2192	RjTLcBc.exe
4436	AXwUmBA.exe
4984	CnhyXpK.exe
3088	qIWrwrU.exe
2356	UkPsStS.exe
1296	zkQCnRe.exe
4016	GmUFtcc.exe
1280	mJMDUrD.exe
4976	ODgjXpG.exe
2848	CzUVlZa.exe
4272	IpMWfhz.exe
3436	PEFVSYk.exe
3580	JHyPcjK.exe
648	PWKYZau.exe
3704	HeLHPDu.exe
3428	MzjGbwp.exe
1800	WoJRiAU.exe
744	RKUYQjt.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4348-0-0x00007FF7654F0000-0x00007FF7658E2000-memory.dmp	upx
behavioral2/files/0x000d000000023b23-5.dat	upx
behavioral2/files/0x000a000000023b8f-9.dat	upx
behavioral2/files/0x000b000000023b8b-23.dat	upx
behavioral2/files/0x000a000000023b92-42.dat	upx
behavioral2/files/0x000a000000023b95-49.dat	upx
behavioral2/files/0x000b000000023b94-59.dat	upx
behavioral2/files/0x000a000000023b96-71.dat	upx
behavioral2/memory/2040-70-0x00007FF771FF0000-0x00007FF7723E2000-memory.dmp	upx
behavioral2/memory/1180-77-0x00007FF7BB1B0000-0x00007FF7BB5A2000-memory.dmp	upx
behavioral2/files/0x000a000000023b97-73.dat	upx
behavioral2/memory/796-67-0x00007FF797860000-0x00007FF797C52000-memory.dmp	upx
behavioral2/memory/4456-65-0x00007FF7B9340000-0x00007FF7B9732000-memory.dmp	upx
behavioral2/files/0x000a000000023b98-69.dat	upx
behavioral2/memory/4372-54-0x00007FF7E5700000-0x00007FF7E5AF2000-memory.dmp	upx
behavioral2/memory/5000-46-0x00007FF6B1400000-0x00007FF6B17F2000-memory.dmp	upx
behavioral2/files/0x000a000000023b90-41.dat	upx
behavioral2/memory/2888-39-0x00007FF64FEB0000-0x00007FF6502A2000-memory.dmp	upx
behavioral2/files/0x000a000000023b91-35.dat	upx
behavioral2/files/0x000a000000023b99-85.dat	upx
behavioral2/files/0x000a000000023b9b-99.dat	upx
behavioral2/files/0x000a000000023b9e-116.dat	upx
behavioral2/files/0x000a000000023b9f-120.dat	upx
behavioral2/memory/2456-134-0x00007FF6EFA20000-0x00007FF6EFE12000-memory.dmp	upx
behavioral2/memory/4820-139-0x00007FF6D0D20000-0x00007FF6D1112000-memory.dmp	upx
behavioral2/memory/2568-143-0x00007FF71D830000-0x00007FF71DC22000-memory.dmp	upx
behavioral2/memory/2068-146-0x00007FF714B30000-0x00007FF714F22000-memory.dmp	upx
behavioral2/files/0x000a000000023ba1-144.dat	upx
behavioral2/memory/3124-142-0x00007FF673090000-0x00007FF673482000-memory.dmp	upx
behavioral2/memory/2244-140-0x00007FF748CA0000-0x00007FF749092000-memory.dmp	upx
behavioral2/files/0x000a000000023ba0-135.dat	upx
behavioral2/files/0x000a000000023ba6-167.dat	upx
behavioral2/files/0x000a000000023bac-197.dat	upx
behavioral2/files/0x000a000000023baa-193.dat	upx
behavioral2/files/0x000a000000023bab-192.dat	upx
behavioral2/files/0x000a000000023ba9-188.dat	upx
behavioral2/files/0x000a000000023ba8-183.dat	upx
behavioral2/files/0x000a000000023ba7-178.dat	upx
behavioral2/files/0x000a000000023ba5-168.dat	upx
behavioral2/files/0x000a000000023ba4-163.dat	upx
behavioral2/files/0x000a000000023ba3-157.dat	upx
behavioral2/files/0x000a000000023ba2-153.dat	upx
behavioral2/memory/552-133-0x00007FF736AC0000-0x00007FF736EB2000-memory.dmp	upx
behavioral2/memory/1740-129-0x00007FF650AA0000-0x00007FF650E92000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-125.dat	upx
behavioral2/memory/4472-122-0x00007FF6E9450000-0x00007FF6E9842000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-115.dat	upx
behavioral2/files/0x000b000000023b8c-114.dat	upx
behavioral2/memory/1828-113-0x00007FF7D2C90000-0x00007FF7D3082000-memory.dmp	upx
behavioral2/memory/4944-97-0x00007FF7B0C80000-0x00007FF7B1072000-memory.dmp	upx
behavioral2/files/0x000a000000023b9a-94.dat	upx
behavioral2/memory/4500-88-0x00007FF68A780000-0x00007FF68AB72000-memory.dmp	upx
behavioral2/files/0x000b000000023b93-86.dat	upx
behavioral2/memory/4220-84-0x00007FF7C0EE0000-0x00007FF7C12D2000-memory.dmp	upx
behavioral2/memory/4560-81-0x00007FF69B300000-0x00007FF69B6F2000-memory.dmp	upx
behavioral2/memory/4472-3869-0x00007FF6E9450000-0x00007FF6E9842000-memory.dmp	upx
behavioral2/memory/552-3874-0x00007FF736AC0000-0x00007FF736EB2000-memory.dmp	upx
behavioral2/memory/4456-5272-0x00007FF7B9340000-0x00007FF7B9732000-memory.dmp	upx
behavioral2/memory/796-5280-0x00007FF797860000-0x00007FF797C52000-memory.dmp	upx
behavioral2/memory/2040-5327-0x00007FF771FF0000-0x00007FF7723E2000-memory.dmp	upx
behavioral2/memory/1180-5337-0x00007FF7BB1B0000-0x00007FF7BB5A2000-memory.dmp	upx
behavioral2/memory/4944-5347-0x00007FF7B0C80000-0x00007FF7B1072000-memory.dmp	upx
behavioral2/memory/1828-5351-0x00007FF7D2C90000-0x00007FF7D3082000-memory.dmp	upx
behavioral2/memory/4220-5349-0x00007FF7C0EE0000-0x00007FF7C12D2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NLusAhw.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\fNIfCAV.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\nBcRoyV.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\HfpnwvA.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\sDjoVMD.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\NYYtKkj.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\crRImji.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\CTyLaAw.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\IlawEtB.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\DyAESOX.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\JOvuNbA.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\GumYufg.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\cvQTvuR.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\NhtBoPt.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\jKtAaJi.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\QaUXves.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\WOpeAmo.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\vdfOAsM.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\eySvBxz.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\JXnZfyK.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\dmbcbai.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\OdRMLdz.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\OjtOpCf.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\oDwxpmo.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\wSCPwwl.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\HUOptlR.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\qmnfjdf.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\cIiZZyo.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\WwOIHmE.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\PwCwVGm.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\ZAUAuUW.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\OeSxdnb.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\zLgbDUL.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\VLGtFWi.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\mBHYqzq.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\fYWXiQJ.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\aorTAyl.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\MOjFIdJ.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\igfBmnv.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\UXQRKsj.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\pIiMdki.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\YrTuFFc.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\GhAOIQd.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\tTLNvmN.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\MaawCJI.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\dMogLGn.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\tewkXSs.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\JsxqrxI.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\QABAsFS.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\HyenHWV.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\anSFOlc.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\yMLuWip.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\EBTZDoe.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\FNBfwSz.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\mWKidWL.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\VJtXRZE.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\CXxHwKY.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\YCLDapc.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\nVUAWSb.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\UZVAEpK.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\wZQVrtL.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\sLzJWIw.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\dxqPWQj.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
File created	C:\Windows\System\eeQsDfA.exe	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	powershell.exe
Token: SeLockMemoryPrivilege	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 1844	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	84
PID 4348 wrote to memory of 1844	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	84
PID 4348 wrote to memory of 4456	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	85
PID 4348 wrote to memory of 4456	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	85
PID 4348 wrote to memory of 796	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	86
PID 4348 wrote to memory of 796	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	86
PID 4348 wrote to memory of 2888	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	87
PID 4348 wrote to memory of 2888	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	87
PID 4348 wrote to memory of 5000	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	88
PID 4348 wrote to memory of 5000	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	88
PID 4348 wrote to memory of 4372	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	89
PID 4348 wrote to memory of 4372	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	89
PID 4348 wrote to memory of 2040	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	90
PID 4348 wrote to memory of 2040	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	90
PID 4348 wrote to memory of 1180	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	91
PID 4348 wrote to memory of 1180	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	91
PID 4348 wrote to memory of 4500	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	92
PID 4348 wrote to memory of 4500	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	92
PID 4348 wrote to memory of 4560	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	93
PID 4348 wrote to memory of 4560	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	93
PID 4348 wrote to memory of 4220	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	94
PID 4348 wrote to memory of 4220	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	94
PID 4348 wrote to memory of 4944	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	95
PID 4348 wrote to memory of 4944	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	95
PID 4348 wrote to memory of 1828	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	96
PID 4348 wrote to memory of 1828	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	96
PID 4348 wrote to memory of 2456	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	97
PID 4348 wrote to memory of 2456	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	97
PID 4348 wrote to memory of 4820	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	98
PID 4348 wrote to memory of 4820	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	98
PID 4348 wrote to memory of 2244	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	99
PID 4348 wrote to memory of 2244	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	99
PID 4348 wrote to memory of 4472	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	100
PID 4348 wrote to memory of 4472	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	100
PID 4348 wrote to memory of 3124	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	101
PID 4348 wrote to memory of 3124	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	101
PID 4348 wrote to memory of 1740	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	102
PID 4348 wrote to memory of 1740	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	102
PID 4348 wrote to memory of 2568	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	103
PID 4348 wrote to memory of 2568	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	103
PID 4348 wrote to memory of 552	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	104
PID 4348 wrote to memory of 552	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	104
PID 4348 wrote to memory of 2068	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	105
PID 4348 wrote to memory of 2068	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	105
PID 4348 wrote to memory of 2156	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	106
PID 4348 wrote to memory of 2156	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	106
PID 4348 wrote to memory of 4940	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	107
PID 4348 wrote to memory of 4940	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	107
PID 4348 wrote to memory of 4332	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	108
PID 4348 wrote to memory of 4332	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	108
PID 4348 wrote to memory of 3732	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	109
PID 4348 wrote to memory of 3732	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	109
PID 4348 wrote to memory of 1872	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	110
PID 4348 wrote to memory of 1872	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	110
PID 4348 wrote to memory of 3104	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	111
PID 4348 wrote to memory of 3104	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	111
PID 4348 wrote to memory of 4592	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	112
PID 4348 wrote to memory of 4592	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	112
PID 4348 wrote to memory of 3084	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	113
PID 4348 wrote to memory of 3084	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	113
PID 4348 wrote to memory of 868	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	114
PID 4348 wrote to memory of 868	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	114
PID 4348 wrote to memory of 4408	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	115
PID 4348 wrote to memory of 4408	4348	06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06bf77cc23847b6390e771aae689a8ba_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1844
- C:\Windows\System\gaIAOxi.exe
  C:\Windows\System\gaIAOxi.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\sfrZYLY.exe
  C:\Windows\System\sfrZYLY.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\UgXigKl.exe
  C:\Windows\System\UgXigKl.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\IucjmsW.exe
  C:\Windows\System\IucjmsW.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\UzitKXj.exe
  C:\Windows\System\UzitKXj.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\GrsemBp.exe
  C:\Windows\System\GrsemBp.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\WGFaEgL.exe
  C:\Windows\System\WGFaEgL.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\VnDJdYM.exe
  C:\Windows\System\VnDJdYM.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\eEkIIqz.exe
  C:\Windows\System\eEkIIqz.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\MESKrYo.exe
  C:\Windows\System\MESKrYo.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\lAmxRnL.exe
  C:\Windows\System\lAmxRnL.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\tuxDVCC.exe
  C:\Windows\System\tuxDVCC.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\VSTNgjs.exe
  C:\Windows\System\VSTNgjs.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\oXuwfrE.exe
  C:\Windows\System\oXuwfrE.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\abUSMOu.exe
  C:\Windows\System\abUSMOu.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\KdFWKul.exe
  C:\Windows\System\KdFWKul.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\yGmeEeF.exe
  C:\Windows\System\yGmeEeF.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\cWGlvGC.exe
  C:\Windows\System\cWGlvGC.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\YcNeILg.exe
  C:\Windows\System\YcNeILg.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\WEVmUXk.exe
  C:\Windows\System\WEVmUXk.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\FVgpwqe.exe
  C:\Windows\System\FVgpwqe.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\MoiRSoq.exe
  C:\Windows\System\MoiRSoq.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\SifddoO.exe
  C:\Windows\System\SifddoO.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\AYiAtHE.exe
  C:\Windows\System\AYiAtHE.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\qMTVxEk.exe
  C:\Windows\System\qMTVxEk.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\VZToZPb.exe
  C:\Windows\System\VZToZPb.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\QzqaEYl.exe
  C:\Windows\System\QzqaEYl.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\jHhuNBj.exe
  C:\Windows\System\jHhuNBj.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\LyjQWQv.exe
  C:\Windows\System\LyjQWQv.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\AlkbsBF.exe
  C:\Windows\System\AlkbsBF.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\fTvWRwv.exe
  C:\Windows\System\fTvWRwv.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\uQyJGlh.exe
  C:\Windows\System\uQyJGlh.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\FqiHEHQ.exe
  C:\Windows\System\FqiHEHQ.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\Kfkbreg.exe
  C:\Windows\System\Kfkbreg.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\CZVErBQ.exe
  C:\Windows\System\CZVErBQ.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\hIagwfs.exe
  C:\Windows\System\hIagwfs.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\GJVUiKk.exe
  C:\Windows\System\GJVUiKk.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\MXrbDPK.exe
  C:\Windows\System\MXrbDPK.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\isigtpM.exe
  C:\Windows\System\isigtpM.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\HFeWXfI.exe
  C:\Windows\System\HFeWXfI.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\ZjrcoMA.exe
  C:\Windows\System\ZjrcoMA.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\aFfvkhQ.exe
  C:\Windows\System\aFfvkhQ.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\ABcHsIw.exe
  C:\Windows\System\ABcHsIw.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\jXELWpA.exe
  C:\Windows\System\jXELWpA.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\chUpjkR.exe
  C:\Windows\System\chUpjkR.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\goUENyh.exe
  C:\Windows\System\goUENyh.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\RjTLcBc.exe
  C:\Windows\System\RjTLcBc.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\AXwUmBA.exe
  C:\Windows\System\AXwUmBA.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\CnhyXpK.exe
  C:\Windows\System\CnhyXpK.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\qIWrwrU.exe
  C:\Windows\System\qIWrwrU.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\UkPsStS.exe
  C:\Windows\System\UkPsStS.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\zkQCnRe.exe
  C:\Windows\System\zkQCnRe.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\GmUFtcc.exe
  C:\Windows\System\GmUFtcc.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\mJMDUrD.exe
  C:\Windows\System\mJMDUrD.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\ODgjXpG.exe
  C:\Windows\System\ODgjXpG.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\CzUVlZa.exe
  C:\Windows\System\CzUVlZa.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\IpMWfhz.exe
  C:\Windows\System\IpMWfhz.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\PEFVSYk.exe
  C:\Windows\System\PEFVSYk.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\JHyPcjK.exe
  C:\Windows\System\JHyPcjK.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\PWKYZau.exe
  C:\Windows\System\PWKYZau.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\HeLHPDu.exe
  C:\Windows\System\HeLHPDu.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\MzjGbwp.exe
  C:\Windows\System\MzjGbwp.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\WoJRiAU.exe
  C:\Windows\System\WoJRiAU.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\RKUYQjt.exe
  C:\Windows\System\RKUYQjt.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\KhGhZSI.exe
  C:\Windows\System\KhGhZSI.exe
  2⤵
  PID:2632
- C:\Windows\System\qXQCDTg.exe
  C:\Windows\System\qXQCDTg.exe
  2⤵
  PID:2148
- C:\Windows\System\WHKRDEZ.exe
  C:\Windows\System\WHKRDEZ.exe
  2⤵
  PID:1620
- C:\Windows\System\VaRhvTp.exe
  C:\Windows\System\VaRhvTp.exe
  2⤵
  PID:4920
- C:\Windows\System\sKBHJQV.exe
  C:\Windows\System\sKBHJQV.exe
  2⤵
  PID:3076
- C:\Windows\System\ZWPfvMv.exe
  C:\Windows\System\ZWPfvMv.exe
  2⤵
  PID:3652
- C:\Windows\System\MUSRIEm.exe
  C:\Windows\System\MUSRIEm.exe
  2⤵
  PID:3512
- C:\Windows\System\dNFlEms.exe
  C:\Windows\System\dNFlEms.exe
  2⤵
  PID:1176
- C:\Windows\System\KATETot.exe
  C:\Windows\System\KATETot.exe
  2⤵
  PID:4224
- C:\Windows\System\ViHgjxz.exe
  C:\Windows\System\ViHgjxz.exe
  2⤵
  PID:904
- C:\Windows\System\zupjssx.exe
  C:\Windows\System\zupjssx.exe
  2⤵
  PID:4756
- C:\Windows\System\sgyGVUg.exe
  C:\Windows\System\sgyGVUg.exe
  2⤵
  PID:1696
- C:\Windows\System\jbwJeyk.exe
  C:\Windows\System\jbwJeyk.exe
  2⤵
  PID:2324
- C:\Windows\System\EucPGiZ.exe
  C:\Windows\System\EucPGiZ.exe
  2⤵
  PID:3416
- C:\Windows\System\LpsiZCP.exe
  C:\Windows\System\LpsiZCP.exe
  2⤵
  PID:380
- C:\Windows\System\brsiIxm.exe
  C:\Windows\System\brsiIxm.exe
  2⤵
  PID:4380
- C:\Windows\System\IFharov.exe
  C:\Windows\System\IFharov.exe
  2⤵
  PID:4324
- C:\Windows\System\FMLvkzl.exe
  C:\Windows\System\FMLvkzl.exe
  2⤵
  PID:4448
- C:\Windows\System\gvukLJH.exe
  C:\Windows\System\gvukLJH.exe
  2⤵
  PID:4672
- C:\Windows\System\uOVPXCw.exe
  C:\Windows\System\uOVPXCw.exe
  2⤵
  PID:5140
- C:\Windows\System\PlFmIrV.exe
  C:\Windows\System\PlFmIrV.exe
  2⤵
  PID:5168
- C:\Windows\System\tXeOeAU.exe
  C:\Windows\System\tXeOeAU.exe
  2⤵
  PID:5220
- C:\Windows\System\GOrdJPq.exe
  C:\Windows\System\GOrdJPq.exe
  2⤵
  PID:5248
- C:\Windows\System\fHIFKnO.exe
  C:\Windows\System\fHIFKnO.exe
  2⤵
  PID:5264
- C:\Windows\System\MxoWMpj.exe
  C:\Windows\System\MxoWMpj.exe
  2⤵
  PID:5292
- C:\Windows\System\PalwAMV.exe
  C:\Windows\System\PalwAMV.exe
  2⤵
  PID:5320
- C:\Windows\System\uEKRKgm.exe
  C:\Windows\System\uEKRKgm.exe
  2⤵
  PID:5344
- C:\Windows\System\oPQOxhS.exe
  C:\Windows\System\oPQOxhS.exe
  2⤵
  PID:5372
- C:\Windows\System\MZAcDJh.exe
  C:\Windows\System\MZAcDJh.exe
  2⤵
  PID:5392
- C:\Windows\System\nCRfgnX.exe
  C:\Windows\System\nCRfgnX.exe
  2⤵
  PID:5420
- C:\Windows\System\adkStNQ.exe
  C:\Windows\System\adkStNQ.exe
  2⤵
  PID:5448
- C:\Windows\System\OfUGBqK.exe
  C:\Windows\System\OfUGBqK.exe
  2⤵
  PID:5476
- C:\Windows\System\KgRmdBU.exe
  C:\Windows\System\KgRmdBU.exe
  2⤵
  PID:5504
- C:\Windows\System\McfcQMS.exe
  C:\Windows\System\McfcQMS.exe
  2⤵
  PID:5532
- C:\Windows\System\FVuGwIW.exe
  C:\Windows\System\FVuGwIW.exe
  2⤵
  PID:5560
- C:\Windows\System\dDwppvc.exe
  C:\Windows\System\dDwppvc.exe
  2⤵
  PID:5588
- C:\Windows\System\wzPEZem.exe
  C:\Windows\System\wzPEZem.exe
  2⤵
  PID:5616
- C:\Windows\System\blzOhzK.exe
  C:\Windows\System\blzOhzK.exe
  2⤵
  PID:5644
- C:\Windows\System\pkKUUga.exe
  C:\Windows\System\pkKUUga.exe
  2⤵
  PID:5672
- C:\Windows\System\jsBNZwf.exe
  C:\Windows\System\jsBNZwf.exe
  2⤵
  PID:5700
- C:\Windows\System\bNEnyJp.exe
  C:\Windows\System\bNEnyJp.exe
  2⤵
  PID:5728
- C:\Windows\System\vKLrYXE.exe
  C:\Windows\System\vKLrYXE.exe
  2⤵
  PID:5756
- C:\Windows\System\gKzasEq.exe
  C:\Windows\System\gKzasEq.exe
  2⤵
  PID:5784
- C:\Windows\System\PHQSRae.exe
  C:\Windows\System\PHQSRae.exe
  2⤵
  PID:5812
- C:\Windows\System\HnTkfRz.exe
  C:\Windows\System\HnTkfRz.exe
  2⤵
  PID:6040
- C:\Windows\System\GdJnzIR.exe
  C:\Windows\System\GdJnzIR.exe
  2⤵
  PID:6080
- C:\Windows\System\XVzmClC.exe
  C:\Windows\System\XVzmClC.exe
  2⤵
  PID:6112
- C:\Windows\System\wFPGUgF.exe
  C:\Windows\System\wFPGUgF.exe
  2⤵
  PID:3448
- C:\Windows\System\gChhHwS.exe
  C:\Windows\System\gChhHwS.exe
  2⤵
  PID:3312
- C:\Windows\System\oDNwDXZ.exe
  C:\Windows\System\oDNwDXZ.exe
  2⤵
  PID:5152
- C:\Windows\System\dIaJTUQ.exe
  C:\Windows\System\dIaJTUQ.exe
  2⤵
  PID:5184
- C:\Windows\System\jqddvgM.exe
  C:\Windows\System\jqddvgM.exe
  2⤵
  PID:5232
- C:\Windows\System\PVCoRZE.exe
  C:\Windows\System\PVCoRZE.exe
  2⤵
  PID:5284
- C:\Windows\System\qgNXRYa.exe
  C:\Windows\System\qgNXRYa.exe
  2⤵
  PID:5404
- C:\Windows\System\TWigCqZ.exe
  C:\Windows\System\TWigCqZ.exe
  2⤵
  PID:5440
- C:\Windows\System\bbrRBHf.exe
  C:\Windows\System\bbrRBHf.exe
  2⤵
  PID:5516
- C:\Windows\System\zoDnmUB.exe
  C:\Windows\System\zoDnmUB.exe
  2⤵
  PID:5600
- C:\Windows\System\sHaWZwj.exe
  C:\Windows\System\sHaWZwj.exe
  2⤵
  PID:5632
- C:\Windows\System\OSKonTg.exe
  C:\Windows\System\OSKonTg.exe
  2⤵
  PID:2500
- C:\Windows\System\KwMsgph.exe
  C:\Windows\System\KwMsgph.exe
  2⤵
  PID:1928
- C:\Windows\System\iOuWWia.exe
  C:\Windows\System\iOuWWia.exe
  2⤵
  PID:4044
- C:\Windows\System\JRaCqNi.exe
  C:\Windows\System\JRaCqNi.exe
  2⤵
  PID:1536
- C:\Windows\System\lfDrLGf.exe
  C:\Windows\System\lfDrLGf.exe
  2⤵
  PID:4952
- C:\Windows\System\EMCazEg.exe
  C:\Windows\System\EMCazEg.exe
  2⤵
  PID:5836
- C:\Windows\System\jqRSHIG.exe
  C:\Windows\System\jqRSHIG.exe
  2⤵
  PID:5856
- C:\Windows\System\ZqNqKqF.exe
  C:\Windows\System\ZqNqKqF.exe
  2⤵
  PID:5876
- C:\Windows\System\bMJDSup.exe
  C:\Windows\System\bMJDSup.exe
  2⤵
  PID:5900
- C:\Windows\System\CJDMaLq.exe
  C:\Windows\System\CJDMaLq.exe
  2⤵
  PID:5920
- C:\Windows\System\yHbzZgw.exe
  C:\Windows\System\yHbzZgw.exe
  2⤵
  PID:5956
- C:\Windows\System\NpTISBg.exe
  C:\Windows\System\NpTISBg.exe
  2⤵
  PID:5980
- C:\Windows\System\VSZBtuR.exe
  C:\Windows\System\VSZBtuR.exe
  2⤵
  PID:6016
- C:\Windows\System\HZejAMV.exe
  C:\Windows\System\HZejAMV.exe
  2⤵
  PID:5984
- C:\Windows\System\OnifoYu.exe
  C:\Windows\System\OnifoYu.exe
  2⤵
  PID:5800
- C:\Windows\System\oSXJnyn.exe
  C:\Windows\System\oSXJnyn.exe
  2⤵
  PID:6072
- C:\Windows\System\HJbsfJz.exe
  C:\Windows\System\HJbsfJz.exe
  2⤵
  PID:6108
- C:\Windows\System\eWcJrwx.exe
  C:\Windows\System\eWcJrwx.exe
  2⤵
  PID:940
- C:\Windows\System\eGcrlYM.exe
  C:\Windows\System\eGcrlYM.exe
  2⤵
  PID:3744
- C:\Windows\System\pxzmAzl.exe
  C:\Windows\System\pxzmAzl.exe
  2⤵
  PID:5128
- C:\Windows\System\VCNKsHX.exe
  C:\Windows\System\VCNKsHX.exe
  2⤵
  PID:5240
- C:\Windows\System\mIaVKpf.exe
  C:\Windows\System\mIaVKpf.exe
  2⤵
  PID:5636
- C:\Windows\System\LACMwTt.exe
  C:\Windows\System\LACMwTt.exe
  2⤵
  PID:5712
- C:\Windows\System\AsQAyVE.exe
  C:\Windows\System\AsQAyVE.exe
  2⤵
  PID:5844
- C:\Windows\System\ODHQaOI.exe
  C:\Windows\System\ODHQaOI.exe
  2⤵
  PID:5884
- C:\Windows\System\OMXoPSU.exe
  C:\Windows\System\OMXoPSU.exe
  2⤵
  PID:5992
- C:\Windows\System\XOyGdZd.exe
  C:\Windows\System\XOyGdZd.exe
  2⤵
  PID:5972
- C:\Windows\System\GPLIpWN.exe
  C:\Windows\System\GPLIpWN.exe
  2⤵
  PID:6060
- C:\Windows\System\hejOjbd.exe
  C:\Windows\System\hejOjbd.exe
  2⤵
  PID:6132
- C:\Windows\System\pElIonN.exe
  C:\Windows\System\pElIonN.exe
  2⤵
  PID:5308
- C:\Windows\System\mSOzRvV.exe
  C:\Windows\System\mSOzRvV.exe
  2⤵
  PID:5852
- C:\Windows\System\rUWvjAl.exe
  C:\Windows\System\rUWvjAl.exe
  2⤵
  PID:6028
- C:\Windows\System\uSVnlXs.exe
  C:\Windows\System\uSVnlXs.exe
  2⤵
  PID:5872
- C:\Windows\System\lSdKjvr.exe
  C:\Windows\System\lSdKjvr.exe
  2⤵
  PID:6020
- C:\Windows\System\Alkiwdz.exe
  C:\Windows\System\Alkiwdz.exe
  2⤵
  PID:5608
- C:\Windows\System\uPrIGHb.exe
  C:\Windows\System\uPrIGHb.exe
  2⤵
  PID:6152
- C:\Windows\System\csqHkoE.exe
  C:\Windows\System\csqHkoE.exe
  2⤵
  PID:6176
- C:\Windows\System\vIdYcaB.exe
  C:\Windows\System\vIdYcaB.exe
  2⤵
  PID:6192
- C:\Windows\System\shplfUX.exe
  C:\Windows\System\shplfUX.exe
  2⤵
  PID:6228
- C:\Windows\System\ZkdwGZq.exe
  C:\Windows\System\ZkdwGZq.exe
  2⤵
  PID:6248
- C:\Windows\System\byffFwF.exe
  C:\Windows\System\byffFwF.exe
  2⤵
  PID:6268
- C:\Windows\System\CafWmYn.exe
  C:\Windows\System\CafWmYn.exe
  2⤵
  PID:6284
- C:\Windows\System\hGdBQHC.exe
  C:\Windows\System\hGdBQHC.exe
  2⤵
  PID:6304
- C:\Windows\System\bYniZQx.exe
  C:\Windows\System\bYniZQx.exe
  2⤵
  PID:6328
- C:\Windows\System\xArUQBM.exe
  C:\Windows\System\xArUQBM.exe
  2⤵
  PID:6348
- C:\Windows\System\PcYHzDu.exe
  C:\Windows\System\PcYHzDu.exe
  2⤵
  PID:6392
- C:\Windows\System\FZqYeAe.exe
  C:\Windows\System\FZqYeAe.exe
  2⤵
  PID:6416
- C:\Windows\System\ZwjJUYo.exe
  C:\Windows\System\ZwjJUYo.exe
  2⤵
  PID:6432
- C:\Windows\System\DIsEfhx.exe
  C:\Windows\System\DIsEfhx.exe
  2⤵
  PID:6488
- C:\Windows\System\cLsuuIa.exe
  C:\Windows\System\cLsuuIa.exe
  2⤵
  PID:6564
- C:\Windows\System\cecNURO.exe
  C:\Windows\System\cecNURO.exe
  2⤵
  PID:6584
- C:\Windows\System\FhPCkMg.exe
  C:\Windows\System\FhPCkMg.exe
  2⤵
  PID:6612
- C:\Windows\System\VyocCsg.exe
  C:\Windows\System\VyocCsg.exe
  2⤵
  PID:6632
- C:\Windows\System\eIdqCHH.exe
  C:\Windows\System\eIdqCHH.exe
  2⤵
  PID:6656
- C:\Windows\System\rIWMZdl.exe
  C:\Windows\System\rIWMZdl.exe
  2⤵
  PID:6680
- C:\Windows\System\lTzEPuH.exe
  C:\Windows\System\lTzEPuH.exe
  2⤵
  PID:6704
- C:\Windows\System\IsVBQDr.exe
  C:\Windows\System\IsVBQDr.exe
  2⤵
  PID:6768
- C:\Windows\System\zsfUgVl.exe
  C:\Windows\System\zsfUgVl.exe
  2⤵
  PID:6800
- C:\Windows\System\TJGVuKR.exe
  C:\Windows\System\TJGVuKR.exe
  2⤵
  PID:6820
- C:\Windows\System\vPPftLV.exe
  C:\Windows\System\vPPftLV.exe
  2⤵
  PID:6840
- C:\Windows\System\RXxBrys.exe
  C:\Windows\System\RXxBrys.exe
  2⤵
  PID:6880
- C:\Windows\System\VZhLxlF.exe
  C:\Windows\System\VZhLxlF.exe
  2⤵
  PID:6924
- C:\Windows\System\XXvAOdy.exe
  C:\Windows\System\XXvAOdy.exe
  2⤵
  PID:6948
- C:\Windows\System\XAXeNEX.exe
  C:\Windows\System\XAXeNEX.exe
  2⤵
  PID:6968
- C:\Windows\System\tbAXpGu.exe
  C:\Windows\System\tbAXpGu.exe
  2⤵
  PID:6984
- C:\Windows\System\wirdmiy.exe
  C:\Windows\System\wirdmiy.exe
  2⤵
  PID:7028
- C:\Windows\System\yDzMIko.exe
  C:\Windows\System\yDzMIko.exe
  2⤵
  PID:7052
- C:\Windows\System\ekmTPwG.exe
  C:\Windows\System\ekmTPwG.exe
  2⤵
  PID:7072
- C:\Windows\System\glpaDSw.exe
  C:\Windows\System\glpaDSw.exe
  2⤵
  PID:7124
- C:\Windows\System\UgeOOIP.exe
  C:\Windows\System\UgeOOIP.exe
  2⤵
  PID:7148
- C:\Windows\System\lIprOMD.exe
  C:\Windows\System\lIprOMD.exe
  2⤵
  PID:2920
- C:\Windows\System\LiNNShT.exe
  C:\Windows\System\LiNNShT.exe
  2⤵
  PID:6164
- C:\Windows\System\BqDDlPS.exe
  C:\Windows\System\BqDDlPS.exe
  2⤵
  PID:6236
- C:\Windows\System\nsPjTGj.exe
  C:\Windows\System\nsPjTGj.exe
  2⤵
  PID:6276
- C:\Windows\System\eRAuItU.exe
  C:\Windows\System\eRAuItU.exe
  2⤵
  PID:6340
- C:\Windows\System\JLYDfsU.exe
  C:\Windows\System\JLYDfsU.exe
  2⤵
  PID:6424
- C:\Windows\System\LkUZBCu.exe
  C:\Windows\System\LkUZBCu.exe
  2⤵
  PID:6516
- C:\Windows\System\jSCdoKX.exe
  C:\Windows\System\jSCdoKX.exe
  2⤵
  PID:6592
- C:\Windows\System\dtfwftu.exe
  C:\Windows\System\dtfwftu.exe
  2⤵
  PID:6624
- C:\Windows\System\doKFIjk.exe
  C:\Windows\System\doKFIjk.exe
  2⤵
  PID:6604
- C:\Windows\System\pqkjbJz.exe
  C:\Windows\System\pqkjbJz.exe
  2⤵
  PID:6688
- C:\Windows\System\BjglbpB.exe
  C:\Windows\System\BjglbpB.exe
  2⤵
  PID:6776
- C:\Windows\System\AXPjYfq.exe
  C:\Windows\System\AXPjYfq.exe
  2⤵
  PID:6908
- C:\Windows\System\yrIOniU.exe
  C:\Windows\System\yrIOniU.exe
  2⤵
  PID:6976
- C:\Windows\System\TPaABqq.exe
  C:\Windows\System\TPaABqq.exe
  2⤵
  PID:6980
- C:\Windows\System\HSjfgIi.exe
  C:\Windows\System\HSjfgIi.exe
  2⤵
  PID:7000
- C:\Windows\System\yCjCrhZ.exe
  C:\Windows\System\yCjCrhZ.exe
  2⤵
  PID:7100
- C:\Windows\System\xJzTnKg.exe
  C:\Windows\System\xJzTnKg.exe
  2⤵
  PID:7140
- C:\Windows\System\XovcpnW.exe
  C:\Windows\System\XovcpnW.exe
  2⤵
  PID:6184
- C:\Windows\System\OitxSzr.exe
  C:\Windows\System\OitxSzr.exe
  2⤵
  PID:6256
- C:\Windows\System\aBOtFyG.exe
  C:\Windows\System\aBOtFyG.exe
  2⤵
  PID:6556
- C:\Windows\System\rWtqxWF.exe
  C:\Windows\System\rWtqxWF.exe
  2⤵
  PID:6664
- C:\Windows\System\tOVYHBH.exe
  C:\Windows\System\tOVYHBH.exe
  2⤵
  PID:6748
- C:\Windows\System\QGASyPm.exe
  C:\Windows\System\QGASyPm.exe
  2⤵
  PID:6964
- C:\Windows\System\MLcUJDW.exe
  C:\Windows\System\MLcUJDW.exe
  2⤵
  PID:7068
- C:\Windows\System\NAiAWIh.exe
  C:\Windows\System\NAiAWIh.exe
  2⤵
  PID:6404
- C:\Windows\System\kVzUfqH.exe
  C:\Windows\System\kVzUfqH.exe
  2⤵
  PID:6296
- C:\Windows\System\VaijQuc.exe
  C:\Windows\System\VaijQuc.exe
  2⤵
  PID:6036
- C:\Windows\System\FDnAEaH.exe
  C:\Windows\System\FDnAEaH.exe
  2⤵
  PID:7160
- C:\Windows\System\dDdJScL.exe
  C:\Windows\System\dDdJScL.exe
  2⤵
  PID:6648
- C:\Windows\System\PldIpgb.exe
  C:\Windows\System\PldIpgb.exe
  2⤵
  PID:7180
- C:\Windows\System\zzZqEid.exe
  C:\Windows\System\zzZqEid.exe
  2⤵
  PID:7208
- C:\Windows\System\eKKNMxF.exe
  C:\Windows\System\eKKNMxF.exe
  2⤵
  PID:7228
- C:\Windows\System\UMXCvuS.exe
  C:\Windows\System\UMXCvuS.exe
  2⤵
  PID:7276
- C:\Windows\System\LhnbaGF.exe
  C:\Windows\System\LhnbaGF.exe
  2⤵
  PID:7316
- C:\Windows\System\TdnMEzO.exe
  C:\Windows\System\TdnMEzO.exe
  2⤵
  PID:7344
- C:\Windows\System\QYOeQKD.exe
  C:\Windows\System\QYOeQKD.exe
  2⤵
  PID:7376
- C:\Windows\System\Dqlizjj.exe
  C:\Windows\System\Dqlizjj.exe
  2⤵
  PID:7400
- C:\Windows\System\QLdQnrx.exe
  C:\Windows\System\QLdQnrx.exe
  2⤵
  PID:7432
- C:\Windows\System\UKdQtnz.exe
  C:\Windows\System\UKdQtnz.exe
  2⤵
  PID:7456
- C:\Windows\System\TapkoYa.exe
  C:\Windows\System\TapkoYa.exe
  2⤵
  PID:7496
- C:\Windows\System\VUimBUm.exe
  C:\Windows\System\VUimBUm.exe
  2⤵
  PID:7556
- C:\Windows\System\gIlYWhq.exe
  C:\Windows\System\gIlYWhq.exe
  2⤵
  PID:7580
- C:\Windows\System\dWOClki.exe
  C:\Windows\System\dWOClki.exe
  2⤵
  PID:7604
- C:\Windows\System\jjJBRNm.exe
  C:\Windows\System\jjJBRNm.exe
  2⤵
  PID:7628
- C:\Windows\System\RBKfaCr.exe
  C:\Windows\System\RBKfaCr.exe
  2⤵
  PID:7644
- C:\Windows\System\nTzMoEU.exe
  C:\Windows\System\nTzMoEU.exe
  2⤵
  PID:7700
- C:\Windows\System\HFBNFWf.exe
  C:\Windows\System\HFBNFWf.exe
  2⤵
  PID:7732
- C:\Windows\System\qygMpvn.exe
  C:\Windows\System\qygMpvn.exe
  2⤵
  PID:7752
- C:\Windows\System\nVEXaRe.exe
  C:\Windows\System\nVEXaRe.exe
  2⤵
  PID:7772
- C:\Windows\System\BXeMJeY.exe
  C:\Windows\System\BXeMJeY.exe
  2⤵
  PID:7796
- C:\Windows\System\vGSYsAR.exe
  C:\Windows\System\vGSYsAR.exe
  2⤵
  PID:7812
- C:\Windows\System\UWWZWnr.exe
  C:\Windows\System\UWWZWnr.exe
  2⤵
  PID:7856
- C:\Windows\System\YuqLrcT.exe
  C:\Windows\System\YuqLrcT.exe
  2⤵
  PID:7896
- C:\Windows\System\epyGGfW.exe
  C:\Windows\System\epyGGfW.exe
  2⤵
  PID:7916
- C:\Windows\System\GwzBVSE.exe
  C:\Windows\System\GwzBVSE.exe
  2⤵
  PID:7944
- C:\Windows\System\HNlWFAb.exe
  C:\Windows\System\HNlWFAb.exe
  2⤵
  PID:7960
- C:\Windows\System\UrqJUIX.exe
  C:\Windows\System\UrqJUIX.exe
  2⤵
  PID:7980
- C:\Windows\System\zleNIRi.exe
  C:\Windows\System\zleNIRi.exe
  2⤵
  PID:8004
- C:\Windows\System\XfbqqYG.exe
  C:\Windows\System\XfbqqYG.exe
  2⤵
  PID:8032
- C:\Windows\System\FlcRPKy.exe
  C:\Windows\System\FlcRPKy.exe
  2⤵
  PID:8056
- C:\Windows\System\nukcfIR.exe
  C:\Windows\System\nukcfIR.exe
  2⤵
  PID:8132
- C:\Windows\System\fStGBfY.exe
  C:\Windows\System\fStGBfY.exe
  2⤵
  PID:8156
- C:\Windows\System\zRWBZzA.exe
  C:\Windows\System\zRWBZzA.exe
  2⤵
  PID:8176
- C:\Windows\System\XVieAWi.exe
  C:\Windows\System\XVieAWi.exe
  2⤵
  PID:6628
- C:\Windows\System\PnHGFkH.exe
  C:\Windows\System\PnHGFkH.exe
  2⤵
  PID:7016
- C:\Windows\System\KWwywXN.exe
  C:\Windows\System\KWwywXN.exe
  2⤵
  PID:7284
- C:\Windows\System\QaLjflD.exe
  C:\Windows\System\QaLjflD.exe
  2⤵
  PID:7372
- C:\Windows\System\ERVcQMl.exe
  C:\Windows\System\ERVcQMl.exe
  2⤵
  PID:7412
- C:\Windows\System\RsqxSQA.exe
  C:\Windows\System\RsqxSQA.exe
  2⤵
  PID:7528
- C:\Windows\System\dNZCXjf.exe
  C:\Windows\System\dNZCXjf.exe
  2⤵
  PID:7564
- C:\Windows\System\lNRIInX.exe
  C:\Windows\System\lNRIInX.exe
  2⤵
  PID:7652
- C:\Windows\System\yHJhAMC.exe
  C:\Windows\System\yHJhAMC.exe
  2⤵
  PID:7672
- C:\Windows\System\ZrtIcYq.exe
  C:\Windows\System\ZrtIcYq.exe
  2⤵
  PID:7768
- C:\Windows\System\ghowCFU.exe
  C:\Windows\System\ghowCFU.exe
  2⤵
  PID:7832
- C:\Windows\System\AcYtdLt.exe
  C:\Windows\System\AcYtdLt.exe
  2⤵
  PID:7880
- C:\Windows\System\hFSnrtg.exe
  C:\Windows\System\hFSnrtg.exe
  2⤵
  PID:7952
- C:\Windows\System\EBlPRTq.exe
  C:\Windows\System\EBlPRTq.exe
  2⤵
  PID:7968
- C:\Windows\System\dEdpozw.exe
  C:\Windows\System\dEdpozw.exe
  2⤵
  PID:8028
- C:\Windows\System\KibsvGi.exe
  C:\Windows\System\KibsvGi.exe
  2⤵
  PID:8100
- C:\Windows\System\ckukcgJ.exe
  C:\Windows\System\ckukcgJ.exe
  2⤵
  PID:8168
- C:\Windows\System\pEddFGu.exe
  C:\Windows\System\pEddFGu.exe
  2⤵
  PID:7088
- C:\Windows\System\pMqFYgh.exe
  C:\Windows\System\pMqFYgh.exe
  2⤵
  PID:7256
- C:\Windows\System\CfZEnaY.exe
  C:\Windows\System\CfZEnaY.exe
  2⤵
  PID:7452
- C:\Windows\System\TJByyep.exe
  C:\Windows\System\TJByyep.exe
  2⤵
  PID:7576
- C:\Windows\System\jNFJgch.exe
  C:\Windows\System\jNFJgch.exe
  2⤵
  PID:7684
- C:\Windows\System\hlMyphF.exe
  C:\Windows\System\hlMyphF.exe
  2⤵
  PID:7804
- C:\Windows\System\qfIbsaY.exe
  C:\Windows\System\qfIbsaY.exe
  2⤵
  PID:7308
- C:\Windows\System\mjRPfUy.exe
  C:\Windows\System\mjRPfUy.exe
  2⤵
  PID:7792
- C:\Windows\System\NORkKXq.exe
  C:\Windows\System\NORkKXq.exe
  2⤵
  PID:7596
- C:\Windows\System\dGQjaJD.exe
  C:\Windows\System\dGQjaJD.exe
  2⤵
  PID:8124
- C:\Windows\System\KlVRPns.exe
  C:\Windows\System\KlVRPns.exe
  2⤵
  PID:7788
- C:\Windows\System\hSyTlFg.exe
  C:\Windows\System\hSyTlFg.exe
  2⤵
  PID:8204
- C:\Windows\System\gPVWILq.exe
  C:\Windows\System\gPVWILq.exe
  2⤵
  PID:8224
- C:\Windows\System\aPVmjjZ.exe
  C:\Windows\System\aPVmjjZ.exe
  2⤵
  PID:8256
- C:\Windows\System\RbMmrFi.exe
  C:\Windows\System\RbMmrFi.exe
  2⤵
  PID:8280
- C:\Windows\System\cTMaaDa.exe
  C:\Windows\System\cTMaaDa.exe
  2⤵
  PID:8300
- C:\Windows\System\dTvWdLY.exe
  C:\Windows\System\dTvWdLY.exe
  2⤵
  PID:8324
- C:\Windows\System\BSFdYlq.exe
  C:\Windows\System\BSFdYlq.exe
  2⤵
  PID:8344
- C:\Windows\System\gPwKIUQ.exe
  C:\Windows\System\gPwKIUQ.exe
  2⤵
  PID:8368
- C:\Windows\System\iatxfOg.exe
  C:\Windows\System\iatxfOg.exe
  2⤵
  PID:8388
- C:\Windows\System\bvUbLQk.exe
  C:\Windows\System\bvUbLQk.exe
  2⤵
  PID:8408
- C:\Windows\System\UHAZgLq.exe
  C:\Windows\System\UHAZgLq.exe
  2⤵
  PID:8428
- C:\Windows\System\fWyvvqB.exe
  C:\Windows\System\fWyvvqB.exe
  2⤵
  PID:8448
- C:\Windows\System\dmpiAel.exe
  C:\Windows\System\dmpiAel.exe
  2⤵
  PID:8500
- C:\Windows\System\gyEGtJp.exe
  C:\Windows\System\gyEGtJp.exe
  2⤵
  PID:8516
- C:\Windows\System\vqhDmsL.exe
  C:\Windows\System\vqhDmsL.exe
  2⤵
  PID:8544
- C:\Windows\System\epxaDGl.exe
  C:\Windows\System\epxaDGl.exe
  2⤵
  PID:8588
- C:\Windows\System\JCBgOhA.exe
  C:\Windows\System\JCBgOhA.exe
  2⤵
  PID:8608
- C:\Windows\System\EVqnzNI.exe
  C:\Windows\System\EVqnzNI.exe
  2⤵
  PID:8656
- C:\Windows\System\VHaEAds.exe
  C:\Windows\System\VHaEAds.exe
  2⤵
  PID:8708
- C:\Windows\System\JAxDnYr.exe
  C:\Windows\System\JAxDnYr.exe
  2⤵
  PID:8740
- C:\Windows\System\RkblHng.exe
  C:\Windows\System\RkblHng.exe
  2⤵
  PID:8760
- C:\Windows\System\wlUYSPG.exe
  C:\Windows\System\wlUYSPG.exe
  2⤵
  PID:8800
- C:\Windows\System\RHKRWUZ.exe
  C:\Windows\System\RHKRWUZ.exe
  2⤵
  PID:8832
- C:\Windows\System\DXeYqgZ.exe
  C:\Windows\System\DXeYqgZ.exe
  2⤵
  PID:8872
- C:\Windows\System\AWIcvUu.exe
  C:\Windows\System\AWIcvUu.exe
  2⤵
  PID:8888
- C:\Windows\System\xxaQWuX.exe
  C:\Windows\System\xxaQWuX.exe
  2⤵
  PID:8936
- C:\Windows\System\kCXNQdX.exe
  C:\Windows\System\kCXNQdX.exe
  2⤵
  PID:8960
- C:\Windows\System\JdTApjl.exe
  C:\Windows\System\JdTApjl.exe
  2⤵
  PID:8976
- C:\Windows\System\YvMJSIv.exe
  C:\Windows\System\YvMJSIv.exe
  2⤵
  PID:9024
- C:\Windows\System\nPRKXzK.exe
  C:\Windows\System\nPRKXzK.exe
  2⤵
  PID:9048
- C:\Windows\System\SFuaGrv.exe
  C:\Windows\System\SFuaGrv.exe
  2⤵
  PID:9072
- C:\Windows\System\GHkQoQa.exe
  C:\Windows\System\GHkQoQa.exe
  2⤵
  PID:9120
- C:\Windows\System\WBEYWgd.exe
  C:\Windows\System\WBEYWgd.exe
  2⤵
  PID:9148
- C:\Windows\System\wXejICo.exe
  C:\Windows\System\wXejICo.exe
  2⤵
  PID:9168
- C:\Windows\System\CfCSJio.exe
  C:\Windows\System\CfCSJio.exe
  2⤵
  PID:9196
- C:\Windows\System\kAICxjt.exe
  C:\Windows\System\kAICxjt.exe
  2⤵
  PID:8040
- C:\Windows\System\JdhtwRB.exe
  C:\Windows\System\JdhtwRB.exe
  2⤵
  PID:8196
- C:\Windows\System\ZbJWVKf.exe
  C:\Windows\System\ZbJWVKf.exe
  2⤵
  PID:8268
- C:\Windows\System\trNAAfp.exe
  C:\Windows\System\trNAAfp.exe
  2⤵
  PID:8380
- C:\Windows\System\xkNUcbz.exe
  C:\Windows\System\xkNUcbz.exe
  2⤵
  PID:8416
- C:\Windows\System\lXMsrsM.exe
  C:\Windows\System\lXMsrsM.exe
  2⤵
  PID:8456
- C:\Windows\System\VmeBnVa.exe
  C:\Windows\System\VmeBnVa.exe
  2⤵
  PID:8508
- C:\Windows\System\eOOXTyO.exe
  C:\Windows\System\eOOXTyO.exe
  2⤵
  PID:8604
- C:\Windows\System\xtcfEon.exe
  C:\Windows\System\xtcfEon.exe
  2⤵
  PID:8768
- C:\Windows\System\ulnbMRI.exe
  C:\Windows\System\ulnbMRI.exe
  2⤵
  PID:8748
- C:\Windows\System\ajGpoYp.exe
  C:\Windows\System\ajGpoYp.exe
  2⤵
  PID:8828
- C:\Windows\System\KeXkmEW.exe
  C:\Windows\System\KeXkmEW.exe
  2⤵
  PID:8880
- C:\Windows\System\XJdOaQz.exe
  C:\Windows\System\XJdOaQz.exe
  2⤵
  PID:8924
- C:\Windows\System\PIXUqWc.exe
  C:\Windows\System\PIXUqWc.exe
  2⤵
  PID:9184
- C:\Windows\System\xOAgdhb.exe
  C:\Windows\System\xOAgdhb.exe
  2⤵
  PID:8312
- C:\Windows\System\LwhwtOt.exe
  C:\Windows\System\LwhwtOt.exe
  2⤵
  PID:8252
- C:\Windows\System\LjbHJof.exe
  C:\Windows\System\LjbHJof.exe
  2⤵
  PID:8400
- C:\Windows\System\jyqfbYz.exe
  C:\Windows\System\jyqfbYz.exe
  2⤵
  PID:8444
- C:\Windows\System\HZfqGvx.exe
  C:\Windows\System\HZfqGvx.exe
  2⤵
  PID:8928
- C:\Windows\System\GAUGUoR.exe
  C:\Windows\System\GAUGUoR.exe
  2⤵
  PID:8232
- C:\Windows\System\iMuzOzF.exe
  C:\Windows\System\iMuzOzF.exe
  2⤵
  PID:9236
- C:\Windows\System\pnHiyrZ.exe
  C:\Windows\System\pnHiyrZ.exe
  2⤵
  PID:9296
- C:\Windows\System\RPqptrP.exe
  C:\Windows\System\RPqptrP.exe
  2⤵
  PID:9312
- C:\Windows\System\xYIMiXF.exe
  C:\Windows\System\xYIMiXF.exe
  2⤵
  PID:9328
- C:\Windows\System\ecaejRH.exe
  C:\Windows\System\ecaejRH.exe
  2⤵
  PID:9344
- C:\Windows\System\AHWlqnt.exe
  C:\Windows\System\AHWlqnt.exe
  2⤵
  PID:9364
- C:\Windows\System\zJLzhyp.exe
  C:\Windows\System\zJLzhyp.exe
  2⤵
  PID:9400
- C:\Windows\System\fhkxRoZ.exe
  C:\Windows\System\fhkxRoZ.exe
  2⤵
  PID:9424
- C:\Windows\System\zLFvACr.exe
  C:\Windows\System\zLFvACr.exe
  2⤵
  PID:9476
- C:\Windows\System\vfzCWte.exe
  C:\Windows\System\vfzCWte.exe
  2⤵
  PID:9512
- C:\Windows\System\QfShJDE.exe
  C:\Windows\System\QfShJDE.exe
  2⤵
  PID:9536
- C:\Windows\System\hQehsmm.exe
  C:\Windows\System\hQehsmm.exe
  2⤵
  PID:9556
- C:\Windows\System\hMilugp.exe
  C:\Windows\System\hMilugp.exe
  2⤵
  PID:9596
- C:\Windows\System\iEnLHLP.exe
  C:\Windows\System\iEnLHLP.exe
  2⤵
  PID:9632
- C:\Windows\System\wHuJLbr.exe
  C:\Windows\System\wHuJLbr.exe
  2⤵
  PID:9652
- C:\Windows\System\pErmlTY.exe
  C:\Windows\System\pErmlTY.exe
  2⤵
  PID:9712
- C:\Windows\System\pBSZKOY.exe
  C:\Windows\System\pBSZKOY.exe
  2⤵
  PID:9736
- C:\Windows\System\lDQmnhD.exe
  C:\Windows\System\lDQmnhD.exe
  2⤵
  PID:9756
- C:\Windows\System\TooFKnI.exe
  C:\Windows\System\TooFKnI.exe
  2⤵
  PID:9780
- C:\Windows\System\AlEPnBp.exe
  C:\Windows\System\AlEPnBp.exe
  2⤵
  PID:9804
- C:\Windows\System\MHKwVtZ.exe
  C:\Windows\System\MHKwVtZ.exe
  2⤵
  PID:9844
- C:\Windows\System\rCfIruf.exe
  C:\Windows\System\rCfIruf.exe
  2⤵
  PID:9896
- C:\Windows\System\IGlwOZB.exe
  C:\Windows\System\IGlwOZB.exe
  2⤵
  PID:9916
- C:\Windows\System\kJEhukO.exe
  C:\Windows\System\kJEhukO.exe
  2⤵
  PID:9940
- C:\Windows\System\vIVIKpT.exe
  C:\Windows\System\vIVIKpT.exe
  2⤵
  PID:9960
- C:\Windows\System\YbItbEe.exe
  C:\Windows\System\YbItbEe.exe
  2⤵
  PID:9984
- C:\Windows\System\XZTBeWl.exe
  C:\Windows\System\XZTBeWl.exe
  2⤵
  PID:10004
- C:\Windows\System\LrvhDsP.exe
  C:\Windows\System\LrvhDsP.exe
  2⤵
  PID:10032
- C:\Windows\System\lEgfNCR.exe
  C:\Windows\System\lEgfNCR.exe
  2⤵
  PID:10060
- C:\Windows\System\UxXCsgY.exe
  C:\Windows\System\UxXCsgY.exe
  2⤵
  PID:10096
- C:\Windows\System\qXHYKpX.exe
  C:\Windows\System\qXHYKpX.exe
  2⤵
  PID:10132
- C:\Windows\System\rMiYAew.exe
  C:\Windows\System\rMiYAew.exe
  2⤵
  PID:10156
- C:\Windows\System\HnMGGtP.exe
  C:\Windows\System\HnMGGtP.exe
  2⤵
  PID:10172
- C:\Windows\System\GOqpEgW.exe
  C:\Windows\System\GOqpEgW.exe
  2⤵
  PID:10208
- C:\Windows\System\eHnOIOD.exe
  C:\Windows\System\eHnOIOD.exe
  2⤵
  PID:8360
- C:\Windows\System\STBQPxL.exe
  C:\Windows\System\STBQPxL.exe
  2⤵
  PID:8584
- C:\Windows\System\yUjvtgK.exe
  C:\Windows\System\yUjvtgK.exe
  2⤵
  PID:7888
- C:\Windows\System\chDUVai.exe
  C:\Windows\System\chDUVai.exe
  2⤵
  PID:8996
- C:\Windows\System\gVLyzZB.exe
  C:\Windows\System\gVLyzZB.exe
  2⤵
  PID:8524
- C:\Windows\System\EfKRFWZ.exe
  C:\Windows\System\EfKRFWZ.exe
  2⤵
  PID:9284
- C:\Windows\System\FUmCgaJ.exe
  C:\Windows\System\FUmCgaJ.exe
  2⤵
  PID:9272
- C:\Windows\System\hLPallO.exe
  C:\Windows\System\hLPallO.exe
  2⤵
  PID:9320
- C:\Windows\System\uNSlbxZ.exe
  C:\Windows\System\uNSlbxZ.exe
  2⤵
  PID:9396
- C:\Windows\System\BUkrjPj.exe
  C:\Windows\System\BUkrjPj.exe
  2⤵
  PID:9504
- C:\Windows\System\TcKiYCs.exe
  C:\Windows\System\TcKiYCs.exe
  2⤵
  PID:9568
- C:\Windows\System\fCdgNWT.exe
  C:\Windows\System\fCdgNWT.exe
  2⤵
  PID:9604
- C:\Windows\System\BTyhhkV.exe
  C:\Windows\System\BTyhhkV.exe
  2⤵
  PID:9616
- C:\Windows\System\LOcQnvy.exe
  C:\Windows\System\LOcQnvy.exe
  2⤵
  PID:9744
- C:\Windows\System\OZfFPiN.exe
  C:\Windows\System\OZfFPiN.exe
  2⤵
  PID:9776
- C:\Windows\System\jGzXbTj.exe
  C:\Windows\System\jGzXbTj.exe
  2⤵
  PID:9852
- C:\Windows\System\xrexzZo.exe
  C:\Windows\System\xrexzZo.exe
  2⤵
  PID:9932
- C:\Windows\System\szxVsfd.exe
  C:\Windows\System\szxVsfd.exe
  2⤵
  PID:9956
- C:\Windows\System\QLZQlJd.exe
  C:\Windows\System\QLZQlJd.exe
  2⤵
  PID:9980
- C:\Windows\System\urEFFHG.exe
  C:\Windows\System\urEFFHG.exe
  2⤵
  PID:10056
- C:\Windows\System\yWDoJnW.exe
  C:\Windows\System\yWDoJnW.exe
  2⤵
  PID:10200
- C:\Windows\System\rAivGLu.exe
  C:\Windows\System\rAivGLu.exe
  2⤵
  PID:8484
- C:\Windows\System\mpUQEmw.exe
  C:\Windows\System\mpUQEmw.exe
  2⤵
  PID:9304
- C:\Windows\System\TCYNNXZ.exe
  C:\Windows\System\TCYNNXZ.exe
  2⤵
  PID:9468
- C:\Windows\System\aMACzJf.exe
  C:\Windows\System\aMACzJf.exe
  2⤵
  PID:9532
- C:\Windows\System\VUmrlmy.exe
  C:\Windows\System\VUmrlmy.exe
  2⤵
  PID:9624
- C:\Windows\System\bWKsYGF.exe
  C:\Windows\System\bWKsYGF.exe
  2⤵
  PID:9836
- C:\Windows\System\aDnrJfR.exe
  C:\Windows\System\aDnrJfR.exe
  2⤵
  PID:9796
- C:\Windows\System\mDARIzE.exe
  C:\Windows\System\mDARIzE.exe
  2⤵
  PID:9936
- C:\Windows\System\srltLEq.exe
  C:\Windows\System\srltLEq.exe
  2⤵
  PID:9232
- C:\Windows\System\WdAqvCK.exe
  C:\Windows\System\WdAqvCK.exe
  2⤵
  PID:9384
- C:\Windows\System\WnRlrPm.exe
  C:\Windows\System\WnRlrPm.exe
  2⤵
  PID:9828
- C:\Windows\System\CxHNsbk.exe
  C:\Windows\System\CxHNsbk.exe
  2⤵
  PID:9996
- C:\Windows\System\NmBkExJ.exe
  C:\Windows\System\NmBkExJ.exe
  2⤵
  PID:10168
- C:\Windows\System\wErjBzD.exe
  C:\Windows\System\wErjBzD.exe
  2⤵
  PID:9788
- C:\Windows\System\vSUFEoE.exe
  C:\Windows\System\vSUFEoE.exe
  2⤵
  PID:10252
- C:\Windows\System\fBJAhBp.exe
  C:\Windows\System\fBJAhBp.exe
  2⤵
  PID:10288
- C:\Windows\System\khPhHCX.exe
  C:\Windows\System\khPhHCX.exe
  2⤵
  PID:10348
- C:\Windows\System\YZCiDre.exe
  C:\Windows\System\YZCiDre.exe
  2⤵
  PID:10368
- C:\Windows\System\jezXjsx.exe
  C:\Windows\System\jezXjsx.exe
  2⤵
  PID:10388
- C:\Windows\System\vOtMzSN.exe
  C:\Windows\System\vOtMzSN.exe
  2⤵
  PID:10416
- C:\Windows\System\VtJAfUS.exe
  C:\Windows\System\VtJAfUS.exe
  2⤵
  PID:10436
- C:\Windows\System\nccWizY.exe
  C:\Windows\System\nccWizY.exe
  2⤵
  PID:10456
- C:\Windows\System\EYfhmVH.exe
  C:\Windows\System\EYfhmVH.exe
  2⤵
  PID:10472
- C:\Windows\System\tUdbQPr.exe
  C:\Windows\System\tUdbQPr.exe
  2⤵
  PID:10516
- C:\Windows\System\HgQWjNk.exe
  C:\Windows\System\HgQWjNk.exe
  2⤵
  PID:10548
- C:\Windows\System\TONlLaU.exe
  C:\Windows\System\TONlLaU.exe
  2⤵
  PID:10592
- C:\Windows\System\eVeGnMf.exe
  C:\Windows\System\eVeGnMf.exe
  2⤵
  PID:10612
- C:\Windows\System\vNZHenr.exe
  C:\Windows\System\vNZHenr.exe
  2⤵
  PID:10636
- C:\Windows\System\cgtukEr.exe
  C:\Windows\System\cgtukEr.exe
  2⤵
  PID:10656
- C:\Windows\System\gWNhzbJ.exe
  C:\Windows\System\gWNhzbJ.exe
  2⤵
  PID:10680
- C:\Windows\System\yZhyrrQ.exe
  C:\Windows\System\yZhyrrQ.exe
  2⤵
  PID:10740
- C:\Windows\System\nbFxigK.exe
  C:\Windows\System\nbFxigK.exe
  2⤵
  PID:10760
- C:\Windows\System\TOepune.exe
  C:\Windows\System\TOepune.exe
  2⤵
  PID:10780
- C:\Windows\System\YOmGwqQ.exe
  C:\Windows\System\YOmGwqQ.exe
  2⤵
  PID:10804
- C:\Windows\System\RBvJYnh.exe
  C:\Windows\System\RBvJYnh.exe
  2⤵
  PID:10820
- C:\Windows\System\jgOnvpJ.exe
  C:\Windows\System\jgOnvpJ.exe
  2⤵
  PID:10840
- C:\Windows\System\tjQCzhN.exe
  C:\Windows\System\tjQCzhN.exe
  2⤵
  PID:10872
- C:\Windows\System\wurqkwz.exe
  C:\Windows\System\wurqkwz.exe
  2⤵
  PID:10912
- C:\Windows\System\fmNgSLn.exe
  C:\Windows\System\fmNgSLn.exe
  2⤵
  PID:10956
- C:\Windows\System\bqxXufp.exe
  C:\Windows\System\bqxXufp.exe
  2⤵
  PID:10992
- C:\Windows\System\WktvNoP.exe
  C:\Windows\System\WktvNoP.exe
  2⤵
  PID:11016
- C:\Windows\System\fkerAFJ.exe
  C:\Windows\System\fkerAFJ.exe
  2⤵
  PID:11032
- C:\Windows\System\KJXVlXf.exe
  C:\Windows\System\KJXVlXf.exe
  2⤵
  PID:11064
- C:\Windows\System\XVexArK.exe
  C:\Windows\System\XVexArK.exe
  2⤵
  PID:11096
- C:\Windows\System\sDNIVHe.exe
  C:\Windows\System\sDNIVHe.exe
  2⤵
  PID:11120
- C:\Windows\System\dcyYekN.exe
  C:\Windows\System\dcyYekN.exe
  2⤵
  PID:11148
- C:\Windows\System\gmckWVs.exe
  C:\Windows\System\gmckWVs.exe
  2⤵
  PID:11172
- C:\Windows\System\jNURPUl.exe
  C:\Windows\System\jNURPUl.exe
  2⤵
  PID:11192
- C:\Windows\System\cuFDYvs.exe
  C:\Windows\System\cuFDYvs.exe
  2⤵
  PID:11216
- C:\Windows\System\wgmZOlC.exe
  C:\Windows\System\wgmZOlC.exe
  2⤵
  PID:11232
- C:\Windows\System\OPVagmk.exe
  C:\Windows\System\OPVagmk.exe
  2⤵
  PID:11248
- C:\Windows\System\vazFxae.exe
  C:\Windows\System\vazFxae.exe
  2⤵
  PID:9548
- C:\Windows\System\AhDojNJ.exe
  C:\Windows\System\AhDojNJ.exe
  2⤵
  PID:10308
- C:\Windows\System\cDjwMwE.exe
  C:\Windows\System\cDjwMwE.exe
  2⤵
  PID:10384
- C:\Windows\System\BupEtMg.exe
  C:\Windows\System\BupEtMg.exe
  2⤵
  PID:10488
- C:\Windows\System\YCSepOb.exe
  C:\Windows\System\YCSepOb.exe
  2⤵
  PID:10528
- C:\Windows\System\qLDrbHs.exe
  C:\Windows\System\qLDrbHs.exe
  2⤵
  PID:10576
- C:\Windows\System\cLLvFrO.exe
  C:\Windows\System\cLLvFrO.exe
  2⤵
  PID:10664
- C:\Windows\System\vPIsrFg.exe
  C:\Windows\System\vPIsrFg.exe
  2⤵
  PID:10788
- C:\Windows\System\drolMZh.exe
  C:\Windows\System\drolMZh.exe
  2⤵
  PID:10888
- C:\Windows\System\XnFkhNT.exe
  C:\Windows\System\XnFkhNT.exe
  2⤵
  PID:10952
- C:\Windows\System\RfiQRlw.exe
  C:\Windows\System\RfiQRlw.exe
  2⤵
  PID:10948
- C:\Windows\System\XUhEdLf.exe
  C:\Windows\System\XUhEdLf.exe
  2⤵
  PID:11004
- C:\Windows\System\YmXeaLr.exe
  C:\Windows\System\YmXeaLr.exe
  2⤵
  PID:11060
- C:\Windows\System\prAtKSK.exe
  C:\Windows\System\prAtKSK.exe
  2⤵
  PID:11088
- C:\Windows\System\RlwStRN.exe
  C:\Windows\System\RlwStRN.exe
  2⤵
  PID:11168
- C:\Windows\System\OkAgAsH.exe
  C:\Windows\System\OkAgAsH.exe
  2⤵
  PID:11208
- C:\Windows\System\cIhNjKL.exe
  C:\Windows\System\cIhNjKL.exe
  2⤵
  PID:10428
- C:\Windows\System\QjtKjbJ.exe
  C:\Windows\System\QjtKjbJ.exe
  2⤵
  PID:10444
- C:\Windows\System\xPHZmPk.exe
  C:\Windows\System\xPHZmPk.exe
  2⤵
  PID:10604
- C:\Windows\System\GgtjwSG.exe
  C:\Windows\System\GgtjwSG.exe
  2⤵
  PID:10828
- C:\Windows\System\cXMDGuJ.exe
  C:\Windows\System\cXMDGuJ.exe
  2⤵
  PID:10812
- C:\Windows\System\VPVGvHM.exe
  C:\Windows\System\VPVGvHM.exe
  2⤵
  PID:10940
- C:\Windows\System\PpHmWKZ.exe
  C:\Windows\System\PpHmWKZ.exe
  2⤵
  PID:11240
- C:\Windows\System\lYROESA.exe
  C:\Windows\System\lYROESA.exe
  2⤵
  PID:11052
- C:\Windows\System\TeOGNmx.exe
  C:\Windows\System\TeOGNmx.exe
  2⤵
  PID:11112
- C:\Windows\System\BonwRWv.exe
  C:\Windows\System\BonwRWv.exe
  2⤵
  PID:11048
- C:\Windows\System\AVTkHCY.exe
  C:\Windows\System\AVTkHCY.exe
  2⤵
  PID:11284
- C:\Windows\System\BhQNImi.exe
  C:\Windows\System\BhQNImi.exe
  2⤵
  PID:11312
- C:\Windows\System\RklYYzd.exe
  C:\Windows\System\RklYYzd.exe
  2⤵
  PID:11360
- C:\Windows\System\fHSpiDn.exe
  C:\Windows\System\fHSpiDn.exe
  2⤵
  PID:11376
- C:\Windows\System\VjMNUNz.exe
  C:\Windows\System\VjMNUNz.exe
  2⤵
  PID:11392
- C:\Windows\System\NurfhXC.exe
  C:\Windows\System\NurfhXC.exe
  2⤵
  PID:11412
- C:\Windows\System\XFkvQhd.exe
  C:\Windows\System\XFkvQhd.exe
  2⤵
  PID:11432
- C:\Windows\System\AlBoRPm.exe
  C:\Windows\System\AlBoRPm.exe
  2⤵
  PID:11452
- C:\Windows\System\DZcquVB.exe
  C:\Windows\System\DZcquVB.exe
  2⤵
  PID:11504
- C:\Windows\System\evszHAR.exe
  C:\Windows\System\evszHAR.exe
  2⤵
  PID:11532
- C:\Windows\System\xwmUGeE.exe
  C:\Windows\System\xwmUGeE.exe
  2⤵
  PID:11560
- C:\Windows\System\jqYIkCI.exe
  C:\Windows\System\jqYIkCI.exe
  2⤵
  PID:11592
- C:\Windows\System\QHOxGsj.exe
  C:\Windows\System\QHOxGsj.exe
  2⤵
  PID:11620
- C:\Windows\System\KpYhzWd.exe
  C:\Windows\System\KpYhzWd.exe
  2⤵
  PID:11644
- C:\Windows\System\bCzShcx.exe
  C:\Windows\System\bCzShcx.exe
  2⤵
  PID:11660
- C:\Windows\System\YqERLxt.exe
  C:\Windows\System\YqERLxt.exe
  2⤵
  PID:11708
- C:\Windows\System\myLYiBe.exe
  C:\Windows\System\myLYiBe.exe
  2⤵
  PID:11740
- C:\Windows\System\EkNuGtN.exe
  C:\Windows\System\EkNuGtN.exe
  2⤵
  PID:11756
- C:\Windows\System\MKgRrzA.exe
  C:\Windows\System\MKgRrzA.exe
  2⤵
  PID:11776
- C:\Windows\System\gITAedH.exe
  C:\Windows\System\gITAedH.exe
  2⤵
  PID:11824
- C:\Windows\System\NXJQbAg.exe
  C:\Windows\System\NXJQbAg.exe
  2⤵
  PID:11840
- C:\Windows\System\xYQXFuO.exe
  C:\Windows\System\xYQXFuO.exe
  2⤵
  PID:11884
- C:\Windows\System\eKhyKBk.exe
  C:\Windows\System\eKhyKBk.exe
  2⤵
  PID:11908
- C:\Windows\System\YuvMuYq.exe
  C:\Windows\System\YuvMuYq.exe
  2⤵
  PID:11924
- C:\Windows\System\plkIjhz.exe
  C:\Windows\System\plkIjhz.exe
  2⤵
  PID:11948
- C:\Windows\System\SXDvrAC.exe
  C:\Windows\System\SXDvrAC.exe
  2⤵
  PID:11964
- C:\Windows\System\GizUOsR.exe
  C:\Windows\System\GizUOsR.exe
  2⤵
  PID:12020
- C:\Windows\System\cYrHftE.exe
  C:\Windows\System\cYrHftE.exe
  2⤵
  PID:12048
- C:\Windows\System\AwWyopi.exe
  C:\Windows\System\AwWyopi.exe
  2⤵
  PID:12064
- C:\Windows\System\clLbOLS.exe
  C:\Windows\System\clLbOLS.exe
  2⤵
  PID:12100
- C:\Windows\System\tONMaWA.exe
  C:\Windows\System\tONMaWA.exe
  2⤵
  PID:12136
- C:\Windows\System\KPqkISZ.exe
  C:\Windows\System\KPqkISZ.exe
  2⤵
  PID:12164
- C:\Windows\System\SyMXqYY.exe
  C:\Windows\System\SyMXqYY.exe
  2⤵
  PID:12196
- C:\Windows\System\tTGIRPV.exe
  C:\Windows\System\tTGIRPV.exe
  2⤵
  PID:12216
- C:\Windows\System\FykGiGm.exe
  C:\Windows\System\FykGiGm.exe
  2⤵
  PID:12236
- C:\Windows\System\dffrvpg.exe
  C:\Windows\System\dffrvpg.exe
  2⤵
  PID:12280
- C:\Windows\System\gLvVGuD.exe
  C:\Windows\System\gLvVGuD.exe
  2⤵
  PID:10712
- C:\Windows\System\VEGNQKL.exe
  C:\Windows\System\VEGNQKL.exe
  2⤵
  PID:11308
- C:\Windows\System\VeQRcYm.exe
  C:\Windows\System\VeQRcYm.exe
  2⤵
  PID:11404
- C:\Windows\System\sxHaFtB.exe
  C:\Windows\System\sxHaFtB.exe
  2⤵
  PID:11448
- C:\Windows\System\fKjqMyJ.exe
  C:\Windows\System\fKjqMyJ.exe
  2⤵
  PID:11496
- C:\Windows\System\jxvNIAt.exe
  C:\Windows\System\jxvNIAt.exe
  2⤵
  PID:11572
- C:\Windows\System\oStWlzL.exe
  C:\Windows\System\oStWlzL.exe
  2⤵
  PID:11692
- C:\Windows\System\ndctvGD.exe
  C:\Windows\System\ndctvGD.exe
  2⤵
  PID:11700
- C:\Windows\System\dUQmVZf.exe
  C:\Windows\System\dUQmVZf.exe
  2⤵
  PID:11804
- C:\Windows\System\auFZbby.exe
  C:\Windows\System\auFZbby.exe
  2⤵
  PID:11892
- C:\Windows\System\WgvfQQN.exe
  C:\Windows\System\WgvfQQN.exe
  2⤵
  PID:11904
- C:\Windows\System\ZbScbZg.exe
  C:\Windows\System\ZbScbZg.exe
  2⤵
  PID:11944
- C:\Windows\System\vEuqWpI.exe
  C:\Windows\System\vEuqWpI.exe
  2⤵
  PID:11956
- C:\Windows\System\ntbYWRH.exe
  C:\Windows\System\ntbYWRH.exe
  2⤵
  PID:12060
- C:\Windows\System\ELxTjmm.exe
  C:\Windows\System\ELxTjmm.exe
  2⤵
  PID:12124
- C:\Windows\System\BIIRecv.exe
  C:\Windows\System\BIIRecv.exe
  2⤵
  PID:12212
- C:\Windows\System\gNJNHvJ.exe
  C:\Windows\System\gNJNHvJ.exe
  2⤵
  PID:10452
- C:\Windows\System\TBXmftG.exe
  C:\Windows\System\TBXmftG.exe
  2⤵
  PID:10316
- C:\Windows\System\mVHAhFZ.exe
  C:\Windows\System\mVHAhFZ.exe
  2⤵
  PID:11548
- C:\Windows\System\OuYTSWY.exe
  C:\Windows\System\OuYTSWY.exe
  2⤵
  PID:11668
- C:\Windows\System\gloHthA.exe
  C:\Windows\System\gloHthA.exe
  2⤵
  PID:11816
- C:\Windows\System\ZgkICEG.exe
  C:\Windows\System\ZgkICEG.exe
  2⤵
  PID:11960
- C:\Windows\System\MsjDMpX.exe
  C:\Windows\System\MsjDMpX.exe
  2⤵
  PID:12116
- C:\Windows\System\IZRCvSH.exe
  C:\Windows\System\IZRCvSH.exe
  2⤵
  PID:12188
- C:\Windows\System\vMnjTsP.exe
  C:\Windows\System\vMnjTsP.exe
  2⤵
  PID:11472
- C:\Windows\System\GjVtVVb.exe
  C:\Windows\System\GjVtVVb.exe
  2⤵
  PID:12076
- C:\Windows\System\VPibICN.exe
  C:\Windows\System\VPibICN.exe
  2⤵
  PID:12300
- C:\Windows\System\xaGAkox.exe
  C:\Windows\System\xaGAkox.exe
  2⤵
  PID:12328
- C:\Windows\System\rsfraXy.exe
  C:\Windows\System\rsfraXy.exe
  2⤵
  PID:12356
- C:\Windows\System\ocsafaq.exe
  C:\Windows\System\ocsafaq.exe
  2⤵
  PID:12372
- C:\Windows\System\GYZTwlz.exe
  C:\Windows\System\GYZTwlz.exe
  2⤵
  PID:12424
- C:\Windows\System\ULXStsE.exe
  C:\Windows\System\ULXStsE.exe
  2⤵
  PID:12456
- C:\Windows\System\LtrdHYA.exe
  C:\Windows\System\LtrdHYA.exe
  2⤵
  PID:12480
- C:\Windows\System\hwKlOZP.exe
  C:\Windows\System\hwKlOZP.exe
  2⤵
  PID:12504
- C:\Windows\System\GDUkCvs.exe
  C:\Windows\System\GDUkCvs.exe
  2⤵
  PID:12548
- C:\Windows\System\gRFgoAc.exe
  C:\Windows\System\gRFgoAc.exe
  2⤵
  PID:12576
- C:\Windows\System\xDQQKXi.exe
  C:\Windows\System\xDQQKXi.exe
  2⤵
  PID:12616
- C:\Windows\System\ATTWShf.exe
  C:\Windows\System\ATTWShf.exe
  2⤵
  PID:12640
- C:\Windows\System\edTrdNf.exe
  C:\Windows\System\edTrdNf.exe
  2⤵
  PID:12660
- C:\Windows\System\aFPRinO.exe
  C:\Windows\System\aFPRinO.exe
  2⤵
  PID:12680
- C:\Windows\System\GofeuLh.exe
  C:\Windows\System\GofeuLh.exe
  2⤵
  PID:12724
- C:\Windows\System\gWwLror.exe
  C:\Windows\System\gWwLror.exe
  2⤵
  PID:12744
- C:\Windows\System\kqiCaoD.exe
  C:\Windows\System\kqiCaoD.exe
  2⤵
  PID:12772
- C:\Windows\System\oHrhQQN.exe
  C:\Windows\System\oHrhQQN.exe
  2⤵
  PID:12788
- C:\Windows\System\loddsvN.exe
  C:\Windows\System\loddsvN.exe
  2⤵
  PID:12808
- C:\Windows\System\baeGqWo.exe
  C:\Windows\System\baeGqWo.exe
  2⤵
  PID:12836
- C:\Windows\System\nSnLImz.exe
  C:\Windows\System\nSnLImz.exe
  2⤵
  PID:12856
- C:\Windows\System\YkDBuHB.exe
  C:\Windows\System\YkDBuHB.exe
  2⤵
  PID:12872
- C:\Windows\System\uVgsZMj.exe
  C:\Windows\System\uVgsZMj.exe
  2⤵
  PID:12892
- C:\Windows\System\fGVkqko.exe
  C:\Windows\System\fGVkqko.exe
  2⤵
  PID:13040
- C:\Windows\System\CZqlbLm.exe
  C:\Windows\System\CZqlbLm.exe
  2⤵
  PID:13068
- C:\Windows\System\GdXKnkH.exe
  C:\Windows\System\GdXKnkH.exe
  2⤵
  PID:13100
- C:\Windows\System\PmkQGmM.exe
  C:\Windows\System\PmkQGmM.exe
  2⤵
  PID:13116
- C:\Windows\System\ObnCuGI.exe
  C:\Windows\System\ObnCuGI.exe
  2⤵
  PID:13132
- C:\Windows\System\fFfQqBJ.exe
  C:\Windows\System\fFfQqBJ.exe
  2⤵
  PID:13152
- C:\Windows\System\sbMfRme.exe
  C:\Windows\System\sbMfRme.exe
  2⤵
  PID:13168
- C:\Windows\System\RrnlKoG.exe
  C:\Windows\System\RrnlKoG.exe
  2⤵
  PID:13224
- C:\Windows\System\orCMLqa.exe
  C:\Windows\System\orCMLqa.exe
  2⤵
  PID:13280
- C:\Windows\System\KrmAPnG.exe
  C:\Windows\System\KrmAPnG.exe
  2⤵
  PID:13300
- C:\Windows\System\puAhiLq.exe
  C:\Windows\System\puAhiLq.exe
  2⤵
  PID:11368
- C:\Windows\System\ydFeLMt.exe
  C:\Windows\System\ydFeLMt.exe
  2⤵
  PID:12040
- C:\Windows\System\CXxCyFV.exe
  C:\Windows\System\CXxCyFV.exe
  2⤵
  PID:12364
- C:\Windows\System\ARrKCMp.exe
  C:\Windows\System\ARrKCMp.exe
  2⤵
  PID:12404
- C:\Windows\System\BVEamWS.exe
  C:\Windows\System\BVEamWS.exe
  2⤵
  PID:12476
- C:\Windows\System\DfIuoYr.exe
  C:\Windows\System\DfIuoYr.exe
  2⤵
  PID:12532
- C:\Windows\System\Wvunnrz.exe
  C:\Windows\System\Wvunnrz.exe
  2⤵
  PID:12600
- C:\Windows\System\ferJSpx.exe
  C:\Windows\System\ferJSpx.exe
  2⤵
  PID:12672
- C:\Windows\System\XxMFdWC.exe
  C:\Windows\System\XxMFdWC.exe
  2⤵
  PID:12740
- C:\Windows\System\xIKOzoj.exe
  C:\Windows\System\xIKOzoj.exe
  2⤵
  PID:12768
- C:\Windows\System\uEGqguk.exe
  C:\Windows\System\uEGqguk.exe
  2⤵
  PID:12804
- C:\Windows\System\HcAsBgM.exe
  C:\Windows\System\HcAsBgM.exe
  2⤵
  PID:12868
- C:\Windows\System\DKgAsIa.exe
  C:\Windows\System\DKgAsIa.exe
  2⤵
  PID:12448
- C:\Windows\System\krDkRqW.exe
  C:\Windows\System\krDkRqW.exe
  2⤵
  PID:12388
- C:\Windows\System\aIQVsbR.exe
  C:\Windows\System\aIQVsbR.exe
  2⤵
  PID:12800
- C:\Windows\System\LzrLeeG.exe
  C:\Windows\System\LzrLeeG.exe
  2⤵
  PID:12940
- C:\Windows\System\szSReMp.exe
  C:\Windows\System\szSReMp.exe
  2⤵
  PID:13164
- C:\Windows\System\NkWINjG.exe
  C:\Windows\System\NkWINjG.exe
  2⤵
  PID:13248
- C:\Windows\System\dsUQAEc.exe
  C:\Windows\System\dsUQAEc.exe
  2⤵
  PID:13292
- C:\Windows\System\VuzoSHI.exe
  C:\Windows\System\VuzoSHI.exe
  2⤵
  PID:12292
- C:\Windows\System\KQMkkQp.exe
  C:\Windows\System\KQMkkQp.exe
  2⤵
  PID:12348
- C:\Windows\System\TAkpnkh.exe
  C:\Windows\System\TAkpnkh.exe
  2⤵
  PID:12592
- C:\Windows\System\IqFnSID.exe
  C:\Windows\System\IqFnSID.exe
  2⤵
  PID:12760
- C:\Windows\System\ZUQaKOb.exe
  C:\Windows\System\ZUQaKOb.exe
  2⤵
  PID:12796
- C:\Windows\System\pdwYWYj.exe
  C:\Windows\System\pdwYWYj.exe
  2⤵
  PID:13008
- C:\Windows\System\eLCMwxU.exe
  C:\Windows\System\eLCMwxU.exe
  2⤵
  PID:13020
- C:\Windows\System\fpTIUvo.exe
  C:\Windows\System\fpTIUvo.exe
  2⤵
  PID:13084
- C:\Windows\System\UbbtuhO.exe
  C:\Windows\System\UbbtuhO.exe
  2⤵
  PID:13092
- C:\Windows\System\ekooaDA.exe
  C:\Windows\System\ekooaDA.exe
  2⤵
  PID:2504
- C:\Windows\System\RZPczwH.exe
  C:\Windows\System\RZPczwH.exe
  2⤵
  PID:4800
- C:\Windows\System\OMlWVRI.exe
  C:\Windows\System\OMlWVRI.exe
  2⤵
  PID:9160
- C:\Windows\System\qxmfJyI.exe
  C:\Windows\System\qxmfJyI.exe
  2⤵
  PID:3564
- C:\Windows\System\MnsTHMx.exe
  C:\Windows\System\MnsTHMx.exe
  2⤵
  PID:4972
- C:\Windows\System\jmiVGvx.exe
  C:\Windows\System\jmiVGvx.exe
  2⤵
  PID:13296
- C:\Windows\System\qHUeCPk.exe
  C:\Windows\System\qHUeCPk.exe
  2⤵
  PID:3800
- C:\Windows\System\UYeKZfa.exe
  C:\Windows\System\UYeKZfa.exe
  2⤵
  PID:12572
- C:\Windows\System\SDAluFC.exe
  C:\Windows\System\SDAluFC.exe
  2⤵
  PID:4996
- C:\Windows\System\QHvLMfB.exe
  C:\Windows\System\QHvLMfB.exe
  2⤵
  PID:12716
- C:\Windows\System\CQzhkxK.exe
  C:\Windows\System\CQzhkxK.exe
  2⤵
  PID:4076
- C:\Windows\System\qhUukGG.exe
  C:\Windows\System\qhUukGG.exe
  2⤵
  PID:1116
- C:\Windows\System\BkHMdPG.exe
  C:\Windows\System\BkHMdPG.exe
  2⤵
  PID:1224
- C:\Windows\System\OEtdQno.exe
  C:\Windows\System\OEtdQno.exe
  2⤵
  PID:9144
- C:\Windows\System\RKHrwqO.exe
  C:\Windows\System\RKHrwqO.exe
  2⤵
  PID:4668
- C:\Windows\System\EySouXj.exe
  C:\Windows\System\EySouXj.exe
  2⤵
  PID:444
- C:\Windows\System\iREvXud.exe
  C:\Windows\System\iREvXud.exe
  2⤵
  PID:13144
- C:\Windows\System\LfXkPOM.exe
  C:\Windows\System\LfXkPOM.exe
  2⤵
  PID:11800
- C:\Windows\System\bQHnMty.exe
  C:\Windows\System\bQHnMty.exe
  2⤵
  PID:5484
- C:\Windows\System\XtcTwht.exe
  C:\Windows\System\XtcTwht.exe
  2⤵
  PID:6088
- C:\Windows\System\NQiZQds.exe
  C:\Windows\System\NQiZQds.exe
  2⤵
  PID:1072
- C:\Windows\System\RPvKcpg.exe
  C:\Windows\System\RPvKcpg.exe
  2⤵
  PID:5124
- C:\Windows\System\pnKVqer.exe
  C:\Windows\System\pnKVqer.exe
  2⤵
  PID:4216
- C:\Windows\System\oDIEdxu.exe
  C:\Windows\System\oDIEdxu.exe
  2⤵
  PID:5336
- C:\Windows\System\XGDBFKV.exe
  C:\Windows\System\XGDBFKV.exe
  2⤵
  PID:2056
- C:\Windows\System\ZJbVkca.exe
  C:\Windows\System\ZJbVkca.exe
  2⤵
  PID:2120
- C:\Windows\System\zbHIvmU.exe
  C:\Windows\System\zbHIvmU.exe
  2⤵
  PID:6640
- C:\Windows\System\mOTktTb.exe
  C:\Windows\System\mOTktTb.exe
  2⤵
  PID:3348
- C:\Windows\System\tpkIRIw.exe
  C:\Windows\System\tpkIRIw.exe
  2⤵
  PID:1788
- C:\Windows\System\hrqvcsD.exe
  C:\Windows\System\hrqvcsD.exe
  2⤵
  PID:1388
- C:\Windows\System\KXgrNlB.exe
  C:\Windows\System\KXgrNlB.exe
  2⤵
  PID:6932
- C:\Windows\System\STKgteC.exe
  C:\Windows\System\STKgteC.exe
  2⤵
  PID:3300
- C:\Windows\System\jzGUpUR.exe
  C:\Windows\System\jzGUpUR.exe
  2⤵
  PID:2296
- C:\Windows\System\UfRXzdy.exe
  C:\Windows\System\UfRXzdy.exe
  2⤵
  PID:9136
- C:\Windows\System\tpyvSCt.exe
  C:\Windows\System\tpyvSCt.exe
  2⤵
  PID:4428
- C:\Windows\System\zEpASsp.exe
  C:\Windows\System\zEpASsp.exe
  2⤵
  PID:7552
- C:\Windows\System\CHTBjuN.exe
  C:\Windows\System\CHTBjuN.exe
  2⤵
  PID:8044
- C:\Windows\System\bgdYYrl.exe
  C:\Windows\System\bgdYYrl.exe
  2⤵
  PID:7116
- C:\Windows\System\ItWyymi.exe
  C:\Windows\System\ItWyymi.exe
  2⤵
  PID:8808
- C:\Windows\System\dRJyKFh.exe
  C:\Windows\System\dRJyKFh.exe
  2⤵
  PID:6300
- C:\Windows\System\AwEdTDV.exe
  C:\Windows\System\AwEdTDV.exe
  2⤵
  PID:6668
- C:\Windows\System\HUfxAWw.exe
  C:\Windows\System\HUfxAWw.exe
  2⤵
  PID:7720
- C:\Windows\System\IEIpiiU.exe
  C:\Windows\System\IEIpiiU.exe
  2⤵
  PID:8756
- C:\Windows\System\dlYLnnR.exe
  C:\Windows\System\dlYLnnR.exe
  2⤵
  PID:6572
- C:\Windows\System\mBJZldG.exe
  C:\Windows\System\mBJZldG.exe
  2⤵
  PID:3720
- C:\Windows\System\GXPxGko.exe
  C:\Windows\System\GXPxGko.exe
  2⤵
  PID:1272
- C:\Windows\System\ukMFaEl.exe
  C:\Windows\System\ukMFaEl.exe
  2⤵
  PID:6292
- C:\Windows\System\NLsffkA.exe
  C:\Windows\System\NLsffkA.exe
  2⤵
  PID:8932
- C:\Windows\System\CphxvQf.exe
  C:\Windows\System\CphxvQf.exe
  2⤵
  PID:7892
- C:\Windows\System\eDxwPHT.exe
  C:\Windows\System\eDxwPHT.exe
  2⤵
  PID:8952
- C:\Windows\System\sKwNiGD.exe
  C:\Windows\System\sKwNiGD.exe
  2⤵
  PID:1848
- C:\Windows\System\uqtsZNk.exe
  C:\Windows\System\uqtsZNk.exe
  2⤵
  PID:8092
- C:\Windows\System\dhEdhXK.exe
  C:\Windows\System\dhEdhXK.exe
  2⤵
  PID:8436
- C:\Windows\System\nyuuJvT.exe
  C:\Windows\System\nyuuJvT.exe
  2⤵
  PID:3064
- C:\Windows\System\zQSbzNq.exe
  C:\Windows\System\zQSbzNq.exe
  2⤵
  PID:10140
- C:\Windows\System\tSFmXfe.exe
  C:\Windows\System\tSFmXfe.exe
  2⤵
  PID:8700
- C:\Windows\System\SkbsnLo.exe
  C:\Windows\System\SkbsnLo.exe
  2⤵
  PID:988
- C:\Windows\System\hstKsFP.exe
  C:\Windows\System\hstKsFP.exe
  2⤵
  PID:9668
- C:\Windows\System\iLJRmVE.exe
  C:\Windows\System\iLJRmVE.exe
  2⤵
  PID:7760
- C:\Windows\System\otuLHur.exe
  C:\Windows\System\otuLHur.exe
  2⤵
  PID:8816
- C:\Windows\System\kLBmFEj.exe
  C:\Windows\System\kLBmFEj.exe
  2⤵
  PID:6480
- C:\Windows\System\SCHbAiw.exe
  C:\Windows\System\SCHbAiw.exe
  2⤵
  PID:8920
- C:\Windows\System\MzMXOMb.exe
  C:\Windows\System\MzMXOMb.exe
  2⤵
  PID:4848
- C:\Windows\System\xNJqFXP.exe
  C:\Windows\System\xNJqFXP.exe
  2⤵
  PID:4580
- C:\Windows\System\nxtMAVf.exe
  C:\Windows\System\nxtMAVf.exe
  2⤵
  PID:1892
- C:\Windows\System\KUqlKrC.exe
  C:\Windows\System\KUqlKrC.exe
  2⤵
  PID:8112
- C:\Windows\System\XVisMby.exe
  C:\Windows\System\XVisMby.exe
  2⤵
  PID:4300
- C:\Windows\System\IQHSOEV.exe
  C:\Windows\System\IQHSOEV.exe
  2⤵
  PID:6360
- C:\Windows\System\oVLKHYK.exe
  C:\Windows\System\oVLKHYK.exe
  2⤵
  PID:7472
- C:\Windows\System\pUYPbQc.exe
  C:\Windows\System\pUYPbQc.exe
  2⤵
  PID:9608
- C:\Windows\System\vfpvbev.exe
  C:\Windows\System\vfpvbev.exe
  2⤵
  PID:9484
- C:\Windows\System\pYRpTWT.exe
  C:\Windows\System\pYRpTWT.exe
  2⤵
  PID:736
- C:\Windows\System\mUNNfLl.exe
  C:\Windows\System\mUNNfLl.exe
  2⤵
  PID:1452
- C:\Windows\System\CwnmmhC.exe
  C:\Windows\System\CwnmmhC.exe
  2⤵
  PID:4384
- C:\Windows\System\uxJMVPo.exe
  C:\Windows\System\uxJMVPo.exe
  2⤵
  PID:10296
- C:\Windows\System\axjHsfE.exe
  C:\Windows\System\axjHsfE.exe
  2⤵
  PID:7144
- C:\Windows\System\uxMkAJJ.exe
  C:\Windows\System\uxMkAJJ.exe
  2⤵
  PID:2836
- C:\Windows\System\NLSPvmV.exe
  C:\Windows\System\NLSPvmV.exe
  2⤵
  PID:2720
- C:\Windows\System\uVYEImJ.exe
  C:\Windows\System\uVYEImJ.exe
  2⤵
  PID:7872
- C:\Windows\System\JdtOCRJ.exe
  C:\Windows\System\JdtOCRJ.exe
  2⤵
  PID:10696
- C:\Windows\System\UGtbKRY.exe
  C:\Windows\System\UGtbKRY.exe
  2⤵
  PID:9000
- C:\Windows\System\cknJcNu.exe
  C:\Windows\System\cknJcNu.exe
  2⤵
  PID:9336
- C:\Windows\System\CMWbRQg.exe
  C:\Windows\System\CMWbRQg.exe
  2⤵
  PID:4360
- C:\Windows\System\HzDcRKn.exe
  C:\Windows\System\HzDcRKn.exe
  2⤵
  PID:1664
- C:\Windows\System\DjEQISS.exe
  C:\Windows\System\DjEQISS.exe
  2⤵
  PID:1572
- C:\Windows\System\TARNqoF.exe
  C:\Windows\System\TARNqoF.exe
  2⤵
  PID:2752
- C:\Windows\System\JsWwSXG.exe
  C:\Windows\System\JsWwSXG.exe
  2⤵
  PID:6092
- C:\Windows\System\AruAryD.exe
  C:\Windows\System\AruAryD.exe
  2⤵
  PID:8640
- C:\Windows\System\jEEBkSA.exe
  C:\Windows\System\jEEBkSA.exe
  2⤵
  PID:10148
- C:\Windows\System\RgkhbdU.exe
  C:\Windows\System\RgkhbdU.exe
  2⤵
  PID:5004
- C:\Windows\System\EnYxUYn.exe
  C:\Windows\System\EnYxUYn.exe
  2⤵
  PID:9948
- C:\Windows\System\fHiLrvI.exe
  C:\Windows\System\fHiLrvI.exe
  2⤵
  PID:1432
- C:\Windows\System\SBMINUZ.exe
  C:\Windows\System\SBMINUZ.exe
  2⤵
  PID:4168
- C:\Windows\System\CnICjcB.exe
  C:\Windows\System\CnICjcB.exe
  2⤵
  PID:10324
- C:\Windows\System\Vlvsrhv.exe
  C:\Windows\System\Vlvsrhv.exe
  2⤵
  PID:11696
- C:\Windows\System\ZwZfplu.exe
  C:\Windows\System\ZwZfplu.exe
  2⤵
  PID:11808
- C:\Windows\System\WWmhwOq.exe
  C:\Windows\System\WWmhwOq.exe
  2⤵
  PID:4628
- C:\Windows\System\fUJOWGO.exe
  C:\Windows\System\fUJOWGO.exe
  2⤵
  PID:4768
- C:\Windows\System\WqJhKZj.exe
  C:\Windows\System\WqJhKZj.exe
  2⤵
  PID:6752
- C:\Windows\System\iNPKmHq.exe
  C:\Windows\System\iNPKmHq.exe
  2⤵
  PID:10700
- C:\Windows\System\hJAcxoB.exe
  C:\Windows\System\hJAcxoB.exe
  2⤵
  PID:11244
- C:\Windows\System\ooAmcyy.exe
  C:\Windows\System\ooAmcyy.exe
  2⤵
  PID:9132
- C:\Windows\System\NYOgrek.exe
  C:\Windows\System\NYOgrek.exe
  2⤵
  PID:4852
- C:\Windows\System\ELquLQy.exe
  C:\Windows\System\ELquLQy.exe
  2⤵
  PID:7260
- C:\Windows\System\xLomoLR.exe
  C:\Windows\System\xLomoLR.exe
  2⤵
  PID:5196
- C:\Windows\System\KRRamNn.exe
  C:\Windows\System\KRRamNn.exe
  2⤵
  PID:10356
- C:\Windows\System\BdRHZQo.exe
  C:\Windows\System\BdRHZQo.exe
  2⤵
  PID:5176
- C:\Windows\System\fmuOLZT.exe
  C:\Windows\System\fmuOLZT.exe
  2⤵
  PID:11080
- C:\Windows\System\tBElzAF.exe
  C:\Windows\System\tBElzAF.exe
  2⤵
  PID:9252
- C:\Windows\System\vLkvxdW.exe
  C:\Windows\System\vLkvxdW.exe
  2⤵
  PID:5412
- C:\Windows\System\xpRnxNu.exe
  C:\Windows\System\xpRnxNu.exe
  2⤵
  PID:7840
- C:\Windows\System\dEDSJbx.exe
  C:\Windows\System\dEDSJbx.exe
  2⤵
  PID:816
- C:\Windows\System\oWIgSJC.exe
  C:\Windows\System\oWIgSJC.exe
  2⤵
  PID:6120
- C:\Windows\System\JslaVFB.exe
  C:\Windows\System\JslaVFB.exe
  2⤵
  PID:5356
- C:\Windows\System\vNzSjsf.exe
  C:\Windows\System\vNzSjsf.exe
  2⤵
  PID:1316
- C:\Windows\System\KmZYOgB.exe
  C:\Windows\System\KmZYOgB.exe
  2⤵
  PID:3796
- C:\Windows\System\gfSZybY.exe
  C:\Windows\System\gfSZybY.exe
  2⤵
  PID:880
- C:\Windows\System\sdwweIS.exe
  C:\Windows\System\sdwweIS.exe
  2⤵
  PID:7104
- C:\Windows\System\Lhsctne.exe
  C:\Windows\System\Lhsctne.exe
  2⤵
  PID:4276
- C:\Windows\System\UecJrsN.exe
  C:\Windows\System\UecJrsN.exe
  2⤵
  PID:6412
- C:\Windows\System\mKbGzVc.exe
  C:\Windows\System\mKbGzVc.exe
  2⤵
  PID:4144
- C:\Windows\System\SlCwVoZ.exe
  C:\Windows\System\SlCwVoZ.exe
  2⤵
  PID:2892
- C:\Windows\System\bTPELJB.exe
  C:\Windows\System\bTPELJB.exe
  2⤵
  PID:1684
- C:\Windows\System\keqDNjp.exe
  C:\Windows\System\keqDNjp.exe
  2⤵
  PID:3524
- C:\Windows\System\uVekOmK.exe
  C:\Windows\System\uVekOmK.exe
  2⤵
  PID:2932
- C:\Windows\System\kJHPNKg.exe
  C:\Windows\System\kJHPNKg.exe
  2⤵
  PID:12468
- C:\Windows\System\eArJSEP.exe
  C:\Windows\System\eArJSEP.exe
  2⤵
  PID:9436
- C:\Windows\System\gSWDevZ.exe
  C:\Windows\System\gSWDevZ.exe
  2⤵
  PID:11116
- C:\Windows\System\SmetbKx.exe
  C:\Windows\System\SmetbKx.exe
  2⤵
  PID:11484
- C:\Windows\System\KeAgVoT.exe
  C:\Windows\System\KeAgVoT.exe
  2⤵
  PID:4084
- C:\Windows\System\cpaWbsu.exe
  C:\Windows\System\cpaWbsu.exe
  2⤵
  PID:3608
- C:\Windows\System\lqWKIix.exe
  C:\Windows\System\lqWKIix.exe
  2⤵
  PID:1392
- C:\Windows\System\fxeIQbA.exe
  C:\Windows\System\fxeIQbA.exe
  2⤵
  PID:4832
- C:\Windows\System\QQrsIxO.exe
  C:\Windows\System\QQrsIxO.exe
  2⤵
  PID:4148
- C:\Windows\System\HWrdpeS.exe
  C:\Windows\System\HWrdpeS.exe
  2⤵
  PID:5928
- C:\Windows\System\rvUTzEV.exe
  C:\Windows\System\rvUTzEV.exe
  2⤵
  PID:5896
- C:\Windows\System\BvrmjJD.exe
  C:\Windows\System\BvrmjJD.exe
  2⤵
  PID:5528
- C:\Windows\System\INTHpvH.exe
  C:\Windows\System\INTHpvH.exe
  2⤵
  PID:9060
- C:\Windows\System\kGLSEma.exe
  C:\Windows\System\kGLSEma.exe
  2⤵
  PID:5944
- C:\Windows\System\JHAffIJ.exe
  C:\Windows\System\JHAffIJ.exe
  2⤵
  PID:6904
- C:\Windows\System\gYarOIi.exe
  C:\Windows\System\gYarOIi.exe
  2⤵
  PID:6000
- C:\Windows\System\NeBJPOv.exe
  C:\Windows\System\NeBJPOv.exe
  2⤵
  PID:12568
- C:\Windows\System\OqWEjUt.exe
  C:\Windows\System\OqWEjUt.exe
  2⤵
  PID:10880
- C:\Windows\System\ewIPXNz.exe
  C:\Windows\System\ewIPXNz.exe
  2⤵
  PID:12256
- C:\Windows\System\fUEEGDt.exe
  C:\Windows\System\fUEEGDt.exe
  2⤵
  PID:12264
- C:\Windows\System\GopZcoJ.exe
  C:\Windows\System\GopZcoJ.exe
  2⤵
  PID:12624
- C:\Windows\System\CTiWYaD.exe
  C:\Windows\System\CTiWYaD.exe
  2⤵
  PID:7660
- C:\Windows\System\mOvuKtZ.exe
  C:\Windows\System\mOvuKtZ.exe
  2⤵
  PID:12912
- C:\Windows\System\NQtJSEV.exe
  C:\Windows\System\NQtJSEV.exe
  2⤵
  PID:5360
- C:\Windows\System\YFvlaFk.exe
  C:\Windows\System\YFvlaFk.exe
  2⤵
  PID:13272
- C:\Windows\System\EaPLwhK.exe
  C:\Windows\System\EaPLwhK.exe
  2⤵
  PID:9372
- C:\Windows\System\oKoNGCZ.exe
  C:\Windows\System\oKoNGCZ.exe
  2⤵
  PID:13128
- C:\Windows\System\vFyonAT.exe
  C:\Windows\System\vFyonAT.exe
  2⤵
  PID:2524
- C:\Windows\System\XWOhJfb.exe
  C:\Windows\System\XWOhJfb.exe
  2⤵
  PID:5132
- C:\Windows\System\PpmCDTU.exe
  C:\Windows\System\PpmCDTU.exe
  2⤵
  PID:13276
- C:\Windows\System\kwyDBjp.exe
  C:\Windows\System\kwyDBjp.exe
  2⤵
  PID:6012
- C:\Windows\System\osimeCg.exe
  C:\Windows\System\osimeCg.exe
  2⤵
  PID:12720
- C:\Windows\System\QMtyLXK.exe
  C:\Windows\System\QMtyLXK.exe
  2⤵
  PID:9416
- C:\Windows\System\TwaNtlp.exe
  C:\Windows\System\TwaNtlp.exe
  2⤵
  PID:5496
- C:\Windows\System\rNOFIRp.exe
  C:\Windows\System\rNOFIRp.exe
  2⤵
  PID:5572
- C:\Windows\System\MYUiidJ.exe
  C:\Windows\System\MYUiidJ.exe
  2⤵
  PID:6452
- C:\Windows\System\nDhOaOR.exe
  C:\Windows\System\nDhOaOR.exe
  2⤵
  PID:12864
- C:\Windows\System\PNaXMOv.exe
  C:\Windows\System\PNaXMOv.exe
  2⤵
  PID:6512
- C:\Windows\System\yOVHArV.exe
  C:\Windows\System\yOVHArV.exe
  2⤵
  PID:11276
- C:\Windows\System\LwYTvid.exe
  C:\Windows\System\LwYTvid.exe
  2⤵
  PID:6540
- C:\Windows\System\QGRJoxa.exe
  C:\Windows\System\QGRJoxa.exe
  2⤵
  PID:10600
- C:\Windows\System\GxOJSec.exe
  C:\Windows\System\GxOJSec.exe
  2⤵
  PID:5936
- C:\Windows\System\Nswhahp.exe
  C:\Windows\System\Nswhahp.exe
  2⤵
  PID:6356
- C:\Windows\System\UuHrBOM.exe
  C:\Windows\System\UuHrBOM.exe
  2⤵
  PID:11200
- C:\Windows\System\NVRRjCA.exe
  C:\Windows\System\NVRRjCA.exe
  2⤵
  PID:6816
- C:\Windows\System\bzaGvBN.exe
  C:\Windows\System\bzaGvBN.exe
  2⤵
  PID:5668
- C:\Windows\System\ccKIRqK.exe
  C:\Windows\System\ccKIRqK.exe
  2⤵
  PID:6944
- C:\Windows\System\AxXopVH.exe
  C:\Windows\System\AxXopVH.exe
  2⤵
  PID:12536
- C:\Windows\System\TcOdfJe.exe
  C:\Windows\System\TcOdfJe.exe
  2⤵
  PID:3540
- C:\Windows\System\bguYieg.exe
  C:\Windows\System\bguYieg.exe
  2⤵
  PID:5764
- C:\Windows\System\QzZptid.exe
  C:\Windows\System\QzZptid.exe
  2⤵
  PID:1560
- C:\Windows\System\VhfOycQ.exe
  C:\Windows\System\VhfOycQ.exe
  2⤵
  PID:1508
- C:\Windows\System\gWDJyqD.exe
  C:\Windows\System\gWDJyqD.exe
  2⤵
  PID:7664
- C:\Windows\System\sNKUkGb.exe
  C:\Windows\System\sNKUkGb.exe
  2⤵
  PID:7360
- C:\Windows\System\qDRiufO.exe
  C:\Windows\System\qDRiufO.exe
  2⤵
  PID:7504
- C:\Windows\System\aHQVOFG.exe
  C:\Windows\System\aHQVOFG.exe
  2⤵
  PID:12708
- C:\Windows\System\tmjlshS.exe
  C:\Windows\System\tmjlshS.exe
  2⤵
  PID:4548
- C:\Windows\System\yjVYduR.exe
  C:\Windows\System\yjVYduR.exe
  2⤵
  PID:7988
- C:\Windows\System\zfAKzCV.exe
  C:\Windows\System\zfAKzCV.exe
  2⤵
  PID:6796
- C:\Windows\System\GKMVBCY.exe
  C:\Windows\System\GKMVBCY.exe
  2⤵
  PID:8108
- C:\Windows\System\WmPplHU.exe
  C:\Windows\System\WmPplHU.exe
  2⤵
  PID:7288
- C:\Windows\System\GaXPmfc.exe
  C:\Windows\System\GaXPmfc.exe
  2⤵
  PID:12208
- C:\Windows\System\DSkFExT.exe
  C:\Windows\System\DSkFExT.exe
  2⤵
  PID:11612
- C:\Windows\System\pzPBrfd.exe
  C:\Windows\System\pzPBrfd.exe
  2⤵
  PID:8692
- C:\Windows\System\zJVIUMa.exe
  C:\Windows\System\zJVIUMa.exe
  2⤵
  PID:12900
- C:\Windows\System\xyftWXv.exe
  C:\Windows\System\xyftWXv.exe
  2⤵
  PID:1344
- C:\Windows\System\VFcyiiQ.exe
  C:\Windows\System\VFcyiiQ.exe
  2⤵
  PID:10152
- C:\Windows\System\UantASG.exe
  C:\Windows\System\UantASG.exe
  2⤵
  PID:8020
- C:\Windows\System\lWaQUcV.exe
  C:\Windows\System\lWaQUcV.exe
  2⤵
  PID:5888
- C:\Windows\System\prYboMb.exe
  C:\Windows\System\prYboMb.exe
  2⤵
  PID:5160
- C:\Windows\System\qWMzlXt.exe
  C:\Windows\System\qWMzlXt.exe
  2⤵
  PID:2440
- C:\Windows\System\JEXGHFQ.exe
  C:\Windows\System\JEXGHFQ.exe
  2⤵
  PID:6388
- C:\Windows\System\xevQyQw.exe
  C:\Windows\System\xevQyQw.exe
  2⤵
  PID:8236
- C:\Windows\System\wzQigSZ.exe
  C:\Windows\System\wzQigSZ.exe
  2⤵
  PID:6244
- C:\Windows\System\KKozhbb.exe
  C:\Windows\System\KKozhbb.exe
  2⤵
  PID:8276
- C:\Windows\System\PozJrlo.exe
  C:\Windows\System\PozJrlo.exe
  2⤵
  PID:8468
- C:\Windows\System\ygrJQhd.exe
  C:\Windows\System\ygrJQhd.exe
  2⤵
  PID:6596
- C:\Windows\System\KdRcPSt.exe
  C:\Windows\System\KdRcPSt.exe
  2⤵
  PID:1556
- C:\Windows\System\UrpcVse.exe
  C:\Windows\System\UrpcVse.exe
  2⤵
  PID:8788
- C:\Windows\System\RwoNZKp.exe
  C:\Windows\System\RwoNZKp.exe
  2⤵
  PID:8688
- C:\Windows\System\tZTjUSy.exe
  C:\Windows\System\tZTjUSy.exe
  2⤵
  PID:6828
- C:\Windows\System\snpWFgL.exe
  C:\Windows\System\snpWFgL.exe
  2⤵
  PID:11688
- C:\Windows\System\XtBnLhU.exe
  C:\Windows\System\XtBnLhU.exe
  2⤵
  PID:5940
- C:\Windows\System\WotRpJm.exe
  C:\Windows\System\WotRpJm.exe
  2⤵
  PID:12384
- C:\Windows\System\lYLHvez.exe
  C:\Windows\System\lYLHvez.exe
  2⤵
  PID:9108
- C:\Windows\System\MTjMegA.exe
  C:\Windows\System\MTjMegA.exe
  2⤵
  PID:12696
- C:\Windows\System\srBrAqZ.exe
  C:\Windows\System\srBrAqZ.exe
  2⤵
  PID:2432
- C:\Windows\System\URyTvyu.exe
  C:\Windows\System\URyTvyu.exe
  2⤵
  PID:6736
- C:\Windows\System\ZRmGZZa.exe
  C:\Windows\System\ZRmGZZa.exe
  2⤵
  PID:12176
- C:\Windows\System\xizjvwI.exe
  C:\Windows\System\xizjvwI.exe
  2⤵
  PID:8956
- C:\Windows\System\zIACxdX.exe
  C:\Windows\System\zIACxdX.exe
  2⤵
  PID:7236
- C:\Windows\System\oMcCDQD.exe
  C:\Windows\System\oMcCDQD.exe
  2⤵
  PID:12824
- C:\Windows\System\YtJBEHQ.exe
  C:\Windows\System\YtJBEHQ.exe
  2⤵
  PID:4292
- C:\Windows\System\CkRvcWB.exe
  C:\Windows\System\CkRvcWB.exe
  2⤵
  PID:9492
- C:\Windows\System\BDoxWwr.exe
  C:\Windows\System\BDoxWwr.exe
  2⤵
  PID:9496
- C:\Windows\System\iILvarM.exe
  C:\Windows\System\iILvarM.exe
  2⤵
  PID:1568
- C:\Windows\System\UWjoUjc.exe
  C:\Windows\System\UWjoUjc.exe
  2⤵
  PID:9724
- C:\Windows\System\AKVhJNs.exe
  C:\Windows\System\AKVhJNs.exe
  2⤵
  PID:4988
- C:\Windows\System\qykains.exe
  C:\Windows\System\qykains.exe
  2⤵
  PID:7996
- C:\Windows\System\iUjDnKc.exe
  C:\Windows\System\iUjDnKc.exe
  2⤵
  PID:9572
- C:\Windows\System\DuoZLSp.exe
  C:\Windows\System\DuoZLSp.exe
  2⤵
  PID:9580
- C:\Windows\System\jCcTFXm.exe
  C:\Windows\System\jCcTFXm.exe
  2⤵
  PID:9880
- C:\Windows\System\rTKiOxF.exe
  C:\Windows\System\rTKiOxF.exe
  2⤵
  PID:9824
- C:\Windows\System\kfHCPpF.exe
  C:\Windows\System\kfHCPpF.exe
  2⤵
  PID:6720
- C:\Windows\System\PjShaki.exe
  C:\Windows\System\PjShaki.exe
  2⤵
  PID:10116
- C:\Windows\System\hAURMBA.exe
  C:\Windows\System\hAURMBA.exe
  2⤵
  PID:6712
- C:\Windows\System\LOpRQQF.exe
  C:\Windows\System\LOpRQQF.exe
  2⤵
  PID:5968
- C:\Windows\System\aFCrDNp.exe
  C:\Windows\System\aFCrDNp.exe
  2⤵
  PID:1792
- C:\Windows\System\sUgAPOS.exe
  C:\Windows\System\sUgAPOS.exe
  2⤵
  PID:10016
- C:\Windows\System\SnwPMNq.exe
  C:\Windows\System\SnwPMNq.exe
  2⤵
  PID:8732
- C:\Windows\System\gzkIHiA.exe
  C:\Windows\System\gzkIHiA.exe
  2⤵
  PID:12180
- C:\Windows\System\fEhVXzQ.exe
  C:\Windows\System\fEhVXzQ.exe
  2⤵
  PID:11588
- C:\Windows\System\gtAiyLt.exe
  C:\Windows\System\gtAiyLt.exe
  2⤵
  PID:9452
- C:\Windows\System\QuTyZAy.exe
  C:\Windows\System\QuTyZAy.exe
  2⤵
  PID:7012
- C:\Windows\System\iOemWIk.exe
  C:\Windows\System\iOemWIk.exe
  2⤵
  PID:8084
- C:\Windows\System\nMJckbL.exe
  C:\Windows\System\nMJckbL.exe
  2⤵
  PID:9672
- C:\Windows\System\AhhigcW.exe
  C:\Windows\System\AhhigcW.exe
  2⤵
  PID:10028
- C:\Windows\System\htcpugP.exe
  C:\Windows\System\htcpugP.exe
  2⤵
  PID:9732
- C:\Windows\System\wNSslBS.exe
  C:\Windows\System\wNSslBS.exe
  2⤵
  PID:9208
- C:\Windows\System\xULYQVq.exe
  C:\Windows\System\xULYQVq.exe
  2⤵
  PID:8840
- C:\Windows\System\NmouChi.exe
  C:\Windows\System\NmouChi.exe
  2⤵
  PID:9440
- C:\Windows\System\JrCqnlh.exe
  C:\Windows\System\JrCqnlh.exe
  2⤵
  PID:7268
- C:\Windows\System\xItLRnC.exe
  C:\Windows\System\xItLRnC.exe
  2⤵
  PID:9764
- C:\Windows\System\kCdaraN.exe
  C:\Windows\System\kCdaraN.exe
  2⤵
  PID:1464
- C:\Windows\System\AhspQAF.exe
  C:\Windows\System\AhspQAF.exe
  2⤵
  PID:10676
- C:\Windows\System\KfAmNgZ.exe
  C:\Windows\System\KfAmNgZ.exe
  2⤵
  PID:10272
- C:\Windows\System\hXqWXtP.exe
  C:\Windows\System\hXqWXtP.exe
  2⤵
  PID:10312
- C:\Windows\System\lqdZhYp.exe
  C:\Windows\System\lqdZhYp.exe
  2⤵
  PID:8652
- C:\Windows\System\HHiszGE.exe
  C:\Windows\System\HHiszGE.exe
  2⤵
  PID:10732
- C:\Windows\System\mFUuXIG.exe
  C:\Windows\System\mFUuXIG.exe
  2⤵
  PID:10536
- C:\Windows\System\sgShpfn.exe
  C:\Windows\System\sgShpfn.exe
  2⤵
  PID:10728
- C:\Windows\System\pZfmpwz.exe
  C:\Windows\System\pZfmpwz.exe
  2⤵
  PID:7972
- C:\Windows\System\rnWlszq.exe
  C:\Windows\System\rnWlszq.exe
  2⤵
  PID:10860
- C:\Windows\System\UswbVCt.exe
  C:\Windows\System\UswbVCt.exe
  2⤵
  PID:5456
- C:\Windows\System\HffLDyg.exe
  C:\Windows\System\HffLDyg.exe
  2⤵
  PID:9864
- C:\Windows\System\qhsnhmn.exe
  C:\Windows\System\qhsnhmn.exe
  2⤵
  PID:8144
- C:\Windows\System\zztdPLm.exe
  C:\Windows\System\zztdPLm.exe
  2⤵
  PID:10052
- C:\Windows\System\lgqdwNu.exe
  C:\Windows\System\lgqdwNu.exe
  2⤵
  PID:11972
- C:\Windows\System\PAqbGie.exe
  C:\Windows\System\PAqbGie.exe
  2⤵
  PID:2776
- C:\Windows\System\tgBTLLu.exe
  C:\Windows\System\tgBTLLu.exe
  2⤵
  PID:8248
- C:\Windows\System\VhAmpjC.exe
  C:\Windows\System\VhAmpjC.exe
  2⤵
  PID:10128
- C:\Windows\System\yDuTRkC.exe
  C:\Windows\System\yDuTRkC.exe
  2⤵
  PID:10276
- C:\Windows\System\yMabRnW.exe
  C:\Windows\System\yMabRnW.exe
  2⤵
  PID:10344
- C:\Windows\System\qJvFKkE.exe
  C:\Windows\System\qJvFKkE.exe
  2⤵
  PID:11136
- C:\Windows\System\zcVOVSF.exe
  C:\Windows\System\zcVOVSF.exe
  2⤵
  PID:10752
- C:\Windows\System\smgdqTg.exe
  C:\Windows\System\smgdqTg.exe
  2⤵
  PID:7708
- C:\Windows\System\RGlujmH.exe
  C:\Windows\System\RGlujmH.exe
  2⤵
  PID:10500
- C:\Windows\System\XOJzvkn.exe
  C:\Windows\System\XOJzvkn.exe
  2⤵
  PID:7392
- C:\Windows\System\ftJnkEY.exe
  C:\Windows\System\ftJnkEY.exe
  2⤵
  PID:11268
- C:\Windows\System\LvWNsXq.exe
  C:\Windows\System\LvWNsXq.exe
  2⤵
  PID:11460
- C:\Windows\System\KJTGcFR.exe
  C:\Windows\System\KJTGcFR.exe
  2⤵
  PID:8540
- C:\Windows\System\CbgTafC.exe
  C:\Windows\System\CbgTafC.exe
  2⤵
  PID:11520
- C:\Windows\System\QBQfvyM.exe
  C:\Windows\System\QBQfvyM.exe
  2⤵
  PID:8780
- C:\Windows\System\SIMFcpe.exe
  C:\Windows\System\SIMFcpe.exe
  2⤵
  PID:10228
- C:\Windows\System\oxyTHuK.exe
  C:\Windows\System\oxyTHuK.exe
  2⤵
  PID:2880
- C:\Windows\System\GlQIaOc.exe
  C:\Windows\System\GlQIaOc.exe
  2⤵
  PID:11992
- C:\Windows\System\iIgPkOL.exe
  C:\Windows\System\iIgPkOL.exe
  2⤵
  PID:8184
- C:\Windows\System\XCugsaf.exe
  C:\Windows\System\XCugsaf.exe
  2⤵
  PID:10884
- C:\Windows\System\NbvZIMh.exe
  C:\Windows\System\NbvZIMh.exe
  2⤵
  PID:11228
- C:\Windows\System\vuZGQjW.exe
  C:\Windows\System\vuZGQjW.exe
  2⤵
  PID:9008
- C:\Windows\System\NevbVsG.exe
  C:\Windows\System\NevbVsG.exe
  2⤵
  PID:10364
- C:\Windows\System\qSIoDMm.exe
  C:\Windows\System\qSIoDMm.exe
  2⤵
  PID:10340
- C:\Windows\System\dmtzbCk.exe
  C:\Windows\System\dmtzbCk.exe
  2⤵
  PID:9696
- C:\Windows\System\dHYrYUY.exe
  C:\Windows\System\dHYrYUY.exe
  2⤵
  PID:10652
- C:\Windows\System\jxMWGsz.exe
  C:\Windows\System\jxMWGsz.exe
  2⤵
  PID:11748
- C:\Windows\System\AvWkaRe.exe
  C:\Windows\System\AvWkaRe.exe
  2⤵
  PID:9888
- C:\Windows\System\konyViH.exe
  C:\Windows\System\konyViH.exe
  2⤵
  PID:11056
- C:\Windows\System\isLYZwv.exe
  C:\Windows\System\isLYZwv.exe
  2⤵
  PID:11428
- C:\Windows\System\IEeuTFH.exe
  C:\Windows\System\IEeuTFH.exe
  2⤵
  PID:6408
- C:\Windows\System\ocmLvfj.exe
  C:\Windows\System\ocmLvfj.exe
  2⤵
  PID:11012
- C:\Windows\System\KUpJBdW.exe
  C:\Windows\System\KUpJBdW.exe
  2⤵
  PID:12400
- C:\Windows\System\pvDAour.exe
  C:\Windows\System\pvDAour.exe
  2⤵
  PID:9660
- C:\Windows\System\ilbqUVa.exe
  C:\Windows\System\ilbqUVa.exe
  2⤵
  PID:11720
- C:\Windows\System\WyXwExn.exe
  C:\Windows\System\WyXwExn.exe
  2⤵
  PID:6376
- C:\Windows\System\ArhqaRd.exe
  C:\Windows\System\ArhqaRd.exe
  2⤵
  PID:10040
- C:\Windows\System\mUUBDYw.exe
  C:\Windows\System\mUUBDYw.exe
  2⤵
  PID:10800
- C:\Windows\System\ShZbdjx.exe
  C:\Windows\System\ShZbdjx.exe
  2⤵
  PID:9224
- C:\Windows\System\oFAqXJu.exe
  C:\Windows\System\oFAqXJu.exe
  2⤵
  PID:9612
- C:\Windows\System\lIpjYIO.exe
  C:\Windows\System\lIpjYIO.exe
  2⤵
  PID:12112
- C:\Windows\System\KGetleb.exe
  C:\Windows\System\KGetleb.exe
  2⤵
  PID:8352
- C:\Windows\System\kUgGDlA.exe
  C:\Windows\System\kUgGDlA.exe
  2⤵
  PID:3528
- C:\Windows\System\WAZTcsn.exe
  C:\Windows\System\WAZTcsn.exe
  2⤵
  PID:13180
- C:\Windows\System\mwHEGOR.exe
  C:\Windows\System\mwHEGOR.exe
  2⤵
  PID:11008
- C:\Windows\System\LGDxnLZ.exe
  C:\Windows\System\LGDxnLZ.exe
  2⤵
  PID:2340
- C:\Windows\System\OOrAkza.exe
  C:\Windows\System\OOrAkza.exe
  2⤵
  PID:12444
- C:\Windows\System\wrHHHCr.exe
  C:\Windows\System\wrHHHCr.exe
  2⤵
  PID:12420
- C:\Windows\System\YZgNPsH.exe
  C:\Windows\System\YZgNPsH.exe
  2⤵
  PID:12496
- C:\Windows\System\TSpmQea.exe
  C:\Windows\System\TSpmQea.exe
  2⤵
  PID:12628
- C:\Windows\System\ZphcJhY.exe
  C:\Windows\System\ZphcJhY.exe
  2⤵
  PID:8620
- C:\Windows\System\LmxdivD.exe
  C:\Windows\System\LmxdivD.exe
  2⤵
  PID:12784
- C:\Windows\System\DBlBcZx.exe
  C:\Windows\System\DBlBcZx.exe
  2⤵
  PID:5148
- C:\Windows\System\vqnjeXF.exe
  C:\Windows\System\vqnjeXF.exe
  2⤵
  PID:12916
- C:\Windows\System\ZZixyyb.exe
  C:\Windows\System\ZZixyyb.exe
  2⤵
  PID:12976
- C:\Windows\System\AFNKiEf.exe
  C:\Windows\System\AFNKiEf.exe
  2⤵
  PID:13176
- C:\Windows\System\piuBkJv.exe
  C:\Windows\System\piuBkJv.exe
  2⤵
  PID:12588
- C:\Windows\System\vkeTxHV.exe
  C:\Windows\System\vkeTxHV.exe
  2⤵
  PID:11676
- C:\Windows\System\ldeJShd.exe
  C:\Windows\System\ldeJShd.exe
  2⤵
  PID:8724
- C:\Windows\System\kEWsWQz.exe
  C:\Windows\System\kEWsWQz.exe
  2⤵
  PID:12880
- C:\Windows\System\wJSJoxh.exe
  C:\Windows\System\wJSJoxh.exe
  2⤵
  PID:12884
- C:\Windows\System\LCWhnjh.exe
  C:\Windows\System\LCWhnjh.exe
  2⤵
  PID:13324
- C:\Windows\System\fvLdYcN.exe
  C:\Windows\System\fvLdYcN.exe
  2⤵
  PID:13340
- C:\Windows\System\ujcLCjD.exe
  C:\Windows\System\ujcLCjD.exe
  2⤵
  PID:13356
- C:\Windows\System\dqHTrvF.exe
  C:\Windows\System\dqHTrvF.exe
  2⤵
  PID:13372
- C:\Windows\System\GQdZuuw.exe
  C:\Windows\System\GQdZuuw.exe
  2⤵
  PID:13432
- C:\Windows\System\TWuMLHq.exe
  C:\Windows\System\TWuMLHq.exe
  2⤵
  PID:13452
- C:\Windows\System\zUBqjYT.exe
  C:\Windows\System\zUBqjYT.exe
  2⤵
  PID:13468
- C:\Windows\System\LPwFPKA.exe
  C:\Windows\System\LPwFPKA.exe
  2⤵
  PID:13496
- C:\Windows\System\fzWolAR.exe
  C:\Windows\System\fzWolAR.exe
  2⤵
  PID:13536
- C:\Windows\System\eOJZJEB.exe
  C:\Windows\System\eOJZJEB.exe
  2⤵
  PID:13580
- C:\Windows\System\Qpgaktk.exe
  C:\Windows\System\Qpgaktk.exe
  2⤵
  PID:13636
- C:\Windows\System\xtIOSES.exe
  C:\Windows\System\xtIOSES.exe
  2⤵
  PID:13664
- C:\Windows\System\ZbXQcsq.exe
  C:\Windows\System\ZbXQcsq.exe
  2⤵
  PID:13708
- C:\Windows\System\pbQmKlz.exe
  C:\Windows\System\pbQmKlz.exe
  2⤵
  PID:13756
- C:\Windows\System\bZFvGDl.exe
  C:\Windows\System\bZFvGDl.exe
  2⤵
  PID:13788
- C:\Windows\System\YljDKEO.exe
  C:\Windows\System\YljDKEO.exe
  2⤵
  PID:13820
- C:\Windows\System\cdWNOHU.exe
  C:\Windows\System\cdWNOHU.exe
  2⤵
  PID:13860
- C:\Windows\System\wkBYpov.exe
  C:\Windows\System\wkBYpov.exe
  2⤵
  PID:13892
- C:\Windows\System\vTCpbWW.exe
  C:\Windows\System\vTCpbWW.exe
  2⤵
  PID:13908
- C:\Windows\System\uRPAxcN.exe
  C:\Windows\System\uRPAxcN.exe
  2⤵
  PID:13924
- C:\Windows\System\mewLexq.exe
  C:\Windows\System\mewLexq.exe
  2⤵
  PID:13964
- C:\Windows\System\PlUGddF.exe
  C:\Windows\System\PlUGddF.exe
  2⤵
  PID:14008
- C:\Windows\System\ufeBozd.exe
  C:\Windows\System\ufeBozd.exe
  2⤵
  PID:14040
- C:\Windows\System\gvuyYzh.exe
  C:\Windows\System\gvuyYzh.exe
  2⤵
  PID:14064
- C:\Windows\System\ftbrTWO.exe
  C:\Windows\System\ftbrTWO.exe
  2⤵
  PID:14100
- C:\Windows\System\MSmKhKO.exe
  C:\Windows\System\MSmKhKO.exe
  2⤵
  PID:14116
- C:\Windows\System\zbgdnKW.exe
  C:\Windows\System\zbgdnKW.exe
  2⤵
  PID:14152
- C:\Windows\System\nCAxoro.exe
  C:\Windows\System\nCAxoro.exe
  2⤵
  PID:14180
- C:\Windows\System\SlYghgU.exe
  C:\Windows\System\SlYghgU.exe
  2⤵
  PID:14200
- C:\Windows\System\nZcJbaM.exe
  C:\Windows\System\nZcJbaM.exe
  2⤵
  PID:14236
- C:\Windows\System\XmysWwf.exe
  C:\Windows\System\XmysWwf.exe
  2⤵
  PID:14264
- C:\Windows\System\QnARWGX.exe
  C:\Windows\System\QnARWGX.exe
  2⤵
  PID:14284
- C:\Windows\System\eyTYoCA.exe
  C:\Windows\System\eyTYoCA.exe
  2⤵
  PID:14312
- C:\Windows\System\jTgWTmc.exe
  C:\Windows\System\jTgWTmc.exe
  2⤵
  PID:5432
- C:\Windows\System\CFUsoJp.exe
  C:\Windows\System\CFUsoJp.exe
  2⤵
  PID:13336
- C:\Windows\System\jpEVxGv.exe
  C:\Windows\System\jpEVxGv.exe
  2⤵
  PID:12908
- C:\Windows\System\zLHMNDa.exe
  C:\Windows\System\zLHMNDa.exe
  2⤵
  PID:13420
- C:\Windows\System\kbjBzQV.exe
  C:\Windows\System\kbjBzQV.exe
  2⤵
  PID:13252
- C:\Windows\System\YtahDbY.exe
  C:\Windows\System\YtahDbY.exe
  2⤵
  PID:13380
- C:\Windows\System\gwczSPV.exe
  C:\Windows\System\gwczSPV.exe
  2⤵
  PID:13476
- C:\Windows\System\ptEHAgn.exe
  C:\Windows\System\ptEHAgn.exe
  2⤵
  PID:13488
- C:\Windows\System\WxBkbHy.exe
  C:\Windows\System\WxBkbHy.exe
  2⤵
  PID:13508
- C:\Windows\System\QxeRutN.exe
  C:\Windows\System\QxeRutN.exe
  2⤵
  PID:13628
- C:\Windows\System\ypbhJpK.exe
  C:\Windows\System\ypbhJpK.exe
  2⤵
  PID:13612
- C:\Windows\System\QLqPnbj.exe
  C:\Windows\System\QLqPnbj.exe
  2⤵
  PID:13732
- C:\Windows\System\UhrbIqw.exe
  C:\Windows\System\UhrbIqw.exe
  2⤵
  PID:13816
- C:\Windows\System\WfhBJYE.exe
  C:\Windows\System\WfhBJYE.exe
  2⤵
  PID:13904
- C:\Windows\System\HIgvQmS.exe
  C:\Windows\System\HIgvQmS.exe
  2⤵
  PID:13948
- C:\Windows\System\lJbAUZj.exe
  C:\Windows\System\lJbAUZj.exe
  2⤵
  PID:14032
- C:\Windows\System\lINlBOQ.exe
  C:\Windows\System\lINlBOQ.exe
  2⤵
  PID:14096
- C:\Windows\System\yJdaISc.exe
  C:\Windows\System\yJdaISc.exe
  2⤵
  PID:14164
- C:\Windows\System\ShWuZzU.exe
  C:\Windows\System\ShWuZzU.exe
  2⤵
  PID:14224
- C:\Windows\System\jYcHNEE.exe
  C:\Windows\System\jYcHNEE.exe
  2⤵
  PID:14280
- C:\Windows\System\CiEVQZB.exe
  C:\Windows\System\CiEVQZB.exe
  2⤵
  PID:4132
- C:\Windows\System\rgIYsTu.exe
  C:\Windows\System\rgIYsTu.exe
  2⤵
  PID:2212
- C:\Windows\System\spRSHgf.exe
  C:\Windows\System\spRSHgf.exe
  2⤵
  PID:13412
- C:\Windows\System\qHqkbyH.exe
  C:\Windows\System\qHqkbyH.exe
  2⤵
  PID:13048
- C:\Windows\System\gDougOX.exe
  C:\Windows\System\gDougOX.exe
  2⤵
  PID:13428
- C:\Windows\System\ZXjUmQD.exe
  C:\Windows\System\ZXjUmQD.exe
  2⤵
  PID:13704
- C:\Windows\System\nfIwTsf.exe
  C:\Windows\System\nfIwTsf.exe
  2⤵
  PID:13920
- C:\Windows\System\qWnLOjY.exe
  C:\Windows\System\qWnLOjY.exe
  2⤵
  PID:14072
- C:\Windows\System\ioKjlif.exe
  C:\Windows\System\ioKjlif.exe
  2⤵
  PID:14196
- C:\Windows\System\yzIhisO.exe
  C:\Windows\System\yzIhisO.exe
  2⤵
  PID:14296
- C:\Windows\System\YtSQyfd.exe
  C:\Windows\System\YtSQyfd.exe
  2⤵
  PID:13000
- C:\Windows\System\QBJmwip.exe
  C:\Windows\System\QBJmwip.exe
  2⤵
  PID:13400
- C:\Windows\System\QHyxtSo.exe
  C:\Windows\System\QHyxtSo.exe
  2⤵
  PID:13884
- C:\Windows\System\yvnzWpR.exe
  C:\Windows\System\yvnzWpR.exe
  2⤵
  PID:14244
- C:\Windows\System\YKfQINV.exe
  C:\Windows\System\YKfQINV.exe
  2⤵
  PID:13404
- C:\Windows\System\wytEhpf.exe
  C:\Windows\System\wytEhpf.exe
  2⤵
  PID:14112
- C:\Windows\System\pwANvHw.exe
  C:\Windows\System\pwANvHw.exe
  2⤵
  PID:14000
- C:\Windows\System\ZBDpkkF.exe
  C:\Windows\System\ZBDpkkF.exe
  2⤵
  PID:14348
- C:\Windows\System\VWrMfHZ.exe
  C:\Windows\System\VWrMfHZ.exe
  2⤵
  PID:14376
- C:\Windows\System\TTehxwd.exe
  C:\Windows\System\TTehxwd.exe
  2⤵
  PID:14404
- C:\Windows\System\LToQqHm.exe
  C:\Windows\System\LToQqHm.exe
  2⤵
  PID:14432
- C:\Windows\System\IWQmIPy.exe
  C:\Windows\System\IWQmIPy.exe
  2⤵
  PID:14448
- C:\Windows\System\jUtxIHN.exe
  C:\Windows\System\jUtxIHN.exe
  2⤵
  PID:14464
- C:\Windows\System\FYEuJRY.exe
  C:\Windows\System\FYEuJRY.exe
  2⤵
  PID:14480
- C:\Windows\System\qOAqaNZ.exe
  C:\Windows\System\qOAqaNZ.exe
  2⤵
  PID:14496
- C:\Windows\System\OLxZHcE.exe
  C:\Windows\System\OLxZHcE.exe
  2⤵
  PID:14516
- C:\Windows\System\pJfHplT.exe
  C:\Windows\System\pJfHplT.exe
  2⤵
  PID:14560
- C:\Windows\System\ZtkpHyR.exe
  C:\Windows\System\ZtkpHyR.exe
  2⤵
  PID:14604
- C:\Windows\System\CuUqeIr.exe
  C:\Windows\System\CuUqeIr.exe
  2⤵
  PID:14640
- C:\Windows\System\HnYvLeM.exe
  C:\Windows\System\HnYvLeM.exe
  2⤵
  PID:14680
- C:\Windows\System\WkGVmjp.exe
  C:\Windows\System\WkGVmjp.exe
  2⤵
  PID:14712
- C:\Windows\System\DzGxkpU.exe
  C:\Windows\System\DzGxkpU.exe
  2⤵
  PID:14732
- C:\Windows\System\vOgodOS.exe
  C:\Windows\System\vOgodOS.exe
  2⤵
  PID:14816
- C:\Windows\System\irkenaA.exe
  C:\Windows\System\irkenaA.exe
  2⤵
  PID:14876
- C:\Windows\System\rBqCqmH.exe
  C:\Windows\System\rBqCqmH.exe
  2⤵
  PID:14892
- C:\Windows\System\XsWmAAe.exe
  C:\Windows\System\XsWmAAe.exe
  2⤵
  PID:14908
- C:\Windows\System\AQfJRpu.exe
  C:\Windows\System\AQfJRpu.exe
  2⤵
  PID:14924
- C:\Windows\System\chkgUXt.exe
  C:\Windows\System\chkgUXt.exe
  2⤵
  PID:14940
- C:\Windows\System\GQuyxcZ.exe
  C:\Windows\System\GQuyxcZ.exe
  2⤵
  PID:14956
- C:\Windows\System\EWflpEt.exe
  C:\Windows\System\EWflpEt.exe
  2⤵
  PID:14972
- C:\Windows\System\mHwihuU.exe
  C:\Windows\System\mHwihuU.exe
  2⤵
  PID:15004
- C:\Windows\System\sBAdGxM.exe
  C:\Windows\System\sBAdGxM.exe
  2⤵
  PID:15028
- C:\Windows\System\MrWmFSa.exe
  C:\Windows\System\MrWmFSa.exe
  2⤵
  PID:15044
- C:\Windows\System\baktBjT.exe
  C:\Windows\System\baktBjT.exe
  2⤵
  PID:15060
- C:\Windows\System\PatWgpm.exe
  C:\Windows\System\PatWgpm.exe
  2⤵
  PID:15076
- C:\Windows\System\IsQTjSZ.exe
  C:\Windows\System\IsQTjSZ.exe
  2⤵
  PID:15096
- C:\Windows\System\pVBiOER.exe
  C:\Windows\System\pVBiOER.exe
  2⤵
  PID:15128
- C:\Windows\System\lfGBOZZ.exe
  C:\Windows\System\lfGBOZZ.exe
  2⤵
  PID:15156
- C:\Windows\System\FSELkNz.exe
  C:\Windows\System\FSELkNz.exe
  2⤵
  PID:15200
- C:\Windows\System\DzXaaia.exe
  C:\Windows\System\DzXaaia.exe
  2⤵
  PID:15244
- C:\Windows\System\zSzxwwf.exe
  C:\Windows\System\zSzxwwf.exe
  2⤵
  PID:15284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_loaz2h1c.jr0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AYiAtHE.exe

Filesize
1.7MB

MD5
0adaf95584a0b1261eba00e751caeb22

SHA1
bf62c693ad72510c3da6757faa9d545c4896b859

SHA256
df776735466aa990e263f9f30a815ba127725ed669b4c913834b6639170eb443

SHA512
10d5352df3ca39272fd9697292625e5db990693544647dddf32a88120d45a258474846ea80e6be96c852337e33bcedfed398365fe058e009217810ee56daa861

Download Submit
C:\Windows\System\AlkbsBF.exe

Filesize
1.7MB

MD5
0c22c446b49cb72ce2dc0aea31d1e120

SHA1
0b40df8f38668cdc53fefef4123bf2c7f3d1c15b

SHA256
2f6823da1844cd037cc0ffd67ba74c2e71cd14bf10425e67cc9b5bb2b7084bb2

SHA512
c9810eac75f0af661a6830d0c93e693bf972d193ba497e009b7ad67056f70512339dc53038d20db34e66cf053e522ce039582f255268e1dad8aef09bba9efc04

Download Submit
C:\Windows\System\FVgpwqe.exe

Filesize
1.7MB

MD5
d2efb23a13ab647c727fb08ecd47ab9f

SHA1
16406bafcafaf6893272bf01154bee449aea253e

SHA256
0075689c9672d1cd75652a7b14d9131d2983bb82a52cee62a5915efbfdcfb260

SHA512
5044979961f1d39c7a3d376615ed29e87da40435d721efa2401d743f604d7b145f014e0d5403ade27332e78c82d1b7b2dd5a66999e0fa1cd36a5cf4fe037d8d7

Download Submit
C:\Windows\System\FqiHEHQ.exe

Filesize
1.7MB

MD5
319357059a951e62fa9a29c850ae5944

SHA1
481f0f4d04c0d33d0d3a73e2a248b7875a331e50

SHA256
1ea6a55da50957dde283360245cba6b62caf2dc2a6e437a4b6b216d6ae251088

SHA512
2507782cfbb3c4187b8f351d071bc3b95310d9cfe821b234bc6e3b8c15b565e85db351efd7ea857dc2a5e6ceb6c0acd13907b12bf4af7bb9512a2799644ea004

Download Submit
C:\Windows\System\GrsemBp.exe

Filesize
1.7MB

MD5
b8643e8c2088732f40a6f4c5c9329cbe

SHA1
c9a688c3ebb62c05107097c8fe3e07b8ad5964d8

SHA256
ce95c7bb108563d593a99b942cc5a1afb9918032f3d7063e72bfc3dc64cc3fc2

SHA512
04e4cd49ba85b1d1ee2a740e8d21db7c0a6af650316e986e604dc7248f92342acefc79b44a10a4707d1eea122012fb3db95475463dc1e1320fb036ef28f5fb59

Download Submit
C:\Windows\System\IucjmsW.exe

Filesize
1.7MB

MD5
4cfe99ac6e27788d13f3d04b2ed7187d

SHA1
67838530b4f8eff10f1e0af55ac369830c04d795

SHA256
98296c152adb3d395e77e84a3a42089d1add9d01ab8038c13cf49804f2b049ac

SHA512
99b3fa343d4653519d30c11d02ca57b29aebc094662ea7f6c6de278806c06b66d1d0ad604c559a1caaa74e9a53eb26e0d435d0347d9b5d27004ab9c9e82ba2c5

Download Submit
C:\Windows\System\KdFWKul.exe

Filesize
1.7MB

MD5
dff743caab3e0e409c19dadefc2753da

SHA1
667e6b2a593218d5856ee0c74573602200473fbc

SHA256
002e976a7e4c6cd5dd9f2df61a6b0547e36104ff4ca57e62d6b9d670dbf4b152

SHA512
2fe48f2939ad360fee4a285546898e270443f2ccf134337e1a0dbe17966a965ceff4f7908e512d411f1f89ed22e818e4878416b4e5875eb89385c63a0e681921

Download Submit
C:\Windows\System\LyjQWQv.exe

Filesize
1.7MB

MD5
044c1078a5b5470ff6eb5c379cabb98b

SHA1
162793b93cab47e1fcbccf18b75fcc7b9f2a5d5e

SHA256
40b13144251b1775b676ee99ba227885a6fd4a0a4b8747360d79c6b2120cf0f2

SHA512
484996575a436baba791d3ed833346acd9328722b672eb50d485fa7780f5c345ba861a556b976218c195c75979f9d0e5804298fda9f12d46cbb11c808c6f06b8

Download Submit
C:\Windows\System\MESKrYo.exe

Filesize
1.7MB

MD5
8747437a8b7e57aaca70b0abdea82a54

SHA1
a1a26093ca15b5a0ff6c50da4f1318115b652047

SHA256
c37d6708123d092a0dc679f5ac7f5c6066df371d74ab551961616f931dc7fc9e

SHA512
b72645472656a35da779745f8c29893bc6f9758025c314ea4ddbaaa3204492f990fd424c1227a34ff48456367fa54022846b671e6bec700df21df9e53eda8b05

Download Submit
C:\Windows\System\MoiRSoq.exe

Filesize
1.7MB

MD5
b05621e140379ae2447ceb7092214659

SHA1
704f7738936648340a899112fa8e7a9c8a26da9a

SHA256
d8299cf97f527cea1e9f1a82956c685f836660da30d28ccfdbb2d7cfc6c1c93e

SHA512
3059d2f4e4af468006bc72a2da17b09adfbc042e65066a5708992be93861822046d9d049d5d279d17c35535a9fa62a0c30b37cb351943dd40fc4f7859b254269

Download Submit
C:\Windows\System\QzqaEYl.exe

Filesize
1.7MB

MD5
cdd08e1ae29aa06b2b1a026272d6652f

SHA1
dab51c1d8b2ecf1a91ae0d362cd80a21e18f9de4

SHA256
df06380f95395741ec65f79812c41c2421893a60f6baa2ae374cb8591ce74edd

SHA512
cba842095af3bbeb9afed87dd3c9b3a3e0db294235e3fd2eeb73a5da4dd905e094e1ae28060391a0ef2bf48e6a96004ae9c1397103b77051c3d03f51c3054a64

Download Submit
C:\Windows\System\SifddoO.exe

Filesize
1.7MB

MD5
e02368d7cd9d8d3001fa772bf0814a95

SHA1
1e0dbbd831d53b80f8df55ea2ba85f3347502ab6

SHA256
df36882507e9d03bb504a8c43c4c193b8c7912d7f55c4586cb1c3aafd986838a

SHA512
0900e6abe27b6010a9677e91a48b7803ffd163608fb09ceec81531ed5c2d5b71a88895677dcb826f88e7ce0efb766a3c9e6b3bce254c30f7084733f0cc41a72b

Download Submit
C:\Windows\System\UgXigKl.exe

Filesize
1.7MB

MD5
2dde0c9d977579b42d3112f047421ee3

SHA1
7ff75a7a54777755f3de4b558c044bf6bae306ff

SHA256
2591a912fb55ee658a1e37c832efb0269ffb3a04e3f9e10f1d2631a3ec22bac8

SHA512
9ff951752363330f0eed684cc0f33f43ebd141da6079c54fe03a5372993cfd9d3407942aae9ab3f55d3cf794b2ba8927a8911d571177a3b340193063b08d51c8

Download Submit
C:\Windows\System\UzitKXj.exe

Filesize
1.7MB

MD5
d58f052b60007aec686464c9c98e90af

SHA1
0f245bbc9dbab31f4e02408adf3089b6a541a95a

SHA256
10733c4dee1b16d5d462f43bc96720ff0ac8b4eedcb19e4fa054c52e75bbcc0e

SHA512
348903cd9e202089232370323dcb392f13cc586cf439a480cce602a0c91700747af4a65e157082810e4856d88961258fb0990a55ed9888db1f7345297aef9410

Download Submit
C:\Windows\System\VSTNgjs.exe

Filesize
1.7MB

MD5
566dbcc9917eafd4509194c3cb0a0001

SHA1
0fa66122ad6c090ac59169e3a4f78ddbb84cec20

SHA256
841522b63d3c76c78c018e696e3dee808dd69ba59ad55e461766b1e49b2c1366

SHA512
90860f84252a625f286e3e294d71e0c00bc0a7ec31e867355bb3a49cf1ca120d50a72b0564e01d32fff0268f9753cda53e6acdfb5f7540ba9a26897a585a8ea5

Download Submit
C:\Windows\System\VZToZPb.exe

Filesize
1.7MB

MD5
7c106cd7206931813f4890377db913c7

SHA1
41f56215f64b9c7f3b4a1c35c18be4b9fe549c55

SHA256
2921f2015ddebad5740888f8aa5b7621f75fb71d7329fdb91cb559215bf2ea15

SHA512
e469d10e0e6bfb427710fa22c6df6bbbc0a29cc142162f26dbc94a6a5c05391a3e3fe45fad51ff5f44e2d5cae54413335410ca5409f098ef60fae4ce60fd363a

Download Submit
C:\Windows\System\VnDJdYM.exe

Filesize
1.7MB

MD5
c790e042379f1940b4fa3f85f100e81d

SHA1
fe10a383dd808d1f99d3056ed9d44f49239a9b6c

SHA256
e63146e735cd7d8968493b537a42b7548830f87f5d77a94f3c2c4a882e92ca2c

SHA512
45b49b91476e96826bfcd3319889c8c2e773e5c66d48cdc014337bd1892022f00a4aa2bc9c001b3e1a894c7ef53f6bda860412c57508c0a4b3f2caabca826a52

Download Submit
C:\Windows\System\WEVmUXk.exe

Filesize
1.7MB

MD5
bb73230219c6d3850ee29e7440e74fbe

SHA1
d3cf77642eec4f09249aaffc38c5b8ac5fefd31d

SHA256
1fead9bfef92b7c948c8bc121bb287da89c3041f7a1d1b04eb46a790365c0bb0

SHA512
ccb0c04fc46d5a0af4a2e34f8d958aafca6a7568bf2f1c39470308bb0d70758601a4178c2faf6291fba74f5d47bd5f4d04ebcdd88cc98d7681153f191ca4623a

Download Submit
C:\Windows\System\WGFaEgL.exe

Filesize
1.7MB

MD5
dbdad17057df8da0558f2118125938a9

SHA1
ec34a53b82920206e3c830d8ee5155117985e9ed

SHA256
b9bebb65f89597815d37a63d7ed3d52245400eb18a3d5ca9dcc07c19ea832c4d

SHA512
b270254d968959f59e363d178c8eb826770af12f3feb63e760edd74980cf620df521f38df94cefa9b672b27acd07b9520c145cd7209007bf915280aeb487b352

Download Submit
C:\Windows\System\WQgRdCO.exe

Filesize
18B

MD5
69949a16428cf7e91e16ecdbbbab0f02

SHA1
1bc1b083758681dcffdfa5fa5685d6e92b962d88

SHA256
2be943b1ef11e32fd01cd1d56d41e85e87f5cb46820e52d7de606f63654bf5da

SHA512
d5ffad16f872bbff18949218ec79dceedbbc88a99af414a13b6c7d08a90c4285a65335c6cfe31a1901e5a91add08957302ef854059054f89c6e4b91731c6b7a4

Download Submit
C:\Windows\System\YcNeILg.exe

Filesize
1.7MB

MD5
9a4cb9d529653d218d5c6d9299a5734d

SHA1
7bad56f69a9cd75538a9a0ad3db9ba0afc083d53

SHA256
a9ec030b2dac89ae7d88e7e557834ab6721ebdac82eb2d6ac88264eebdad6168

SHA512
31f0f100be2375a6855b60696aa56c6cc2ba874e43d983febd292279c9dcb20423d9418c89d1899948dde11c670f591b10e144eea162be24ab6d77e7986ccda2

Download Submit
C:\Windows\System\abUSMOu.exe

Filesize
1.7MB

MD5
f2bc53d1f115033388064e2c0ee6a960

SHA1
fee6c8e947a80e15540e4bb84d877928533e39d9

SHA256
f7e2a70498ff481e922d68932d55acdb9464b751b977979992eb5d38adfa75b0

SHA512
b840140838a52f73ac8c87ce0cac93573e701d722431bd1372853e78691c7bfd2c5f91ea7b824567709922c406934b0089722062e01eedd84f7d15b926ed1377

Download Submit
C:\Windows\System\cWGlvGC.exe

Filesize
1.7MB

MD5
b049234128107f12d52316b39b992379

SHA1
ee1be42014acee99e47043f900f26c24e5935f72

SHA256
57a9b6e6ff499a8e5d301ec044defa5c5b3fa981f3ade6c02745c4df4ea1e448

SHA512
be311a58c676b8507b91218c9e8a583434535fcdab4c4637916b7d79f2c571835d96041cea811b3337955e3a5e1f4df8b9e48285d8888086d9a2da335dcddf74

Download Submit
C:\Windows\System\eEkIIqz.exe

Filesize
1.7MB

MD5
ef21a24ebd1fe1aaf1624a3a69053e48

SHA1
c161f89fc13162982c23536cdf037b05cbfc4230

SHA256
b29d709eb09c553a63074956bdd36bd44e2dcdb981804e3a9691611834b07558

SHA512
c7543ab31ed91d48d344e53ca2048f414cc55abb6fcb705f61d27ecc237b2f069bc9f493df9266fe8f95affcb3e48fad3a77e90955752a37df5fe6381365ca77

Download Submit
C:\Windows\System\fTvWRwv.exe

Filesize
1.7MB

MD5
efd222e64a0db545217f44af4dd50ec6

SHA1
da5a17cbd2e701798ef06f6f2f98e23a00e63044

SHA256
57246d612d96902c36aa1ca0b8f30a95c3d73d7fc88671580f61badc2f2985c9

SHA512
3dffb310c95fe0f02547ea2979f298eef9551a4833200180cdd2852eaa8e7a3a3d91e9b8ab166022a6fd60e51cc31643850cb7fd43d3f98498fd666c30d35cf1

Download Submit
C:\Windows\System\gaIAOxi.exe

Filesize
1.7MB

MD5
9204d8b54ff7924ac1d2d3b53b431713

SHA1
162d93edce3f660f976363f988af8a3166365920

SHA256
f3b0bc7c4603cad1a17edeb16eebeba4cca54fb2eab6c9e44e6339b522c630e9

SHA512
6aab23e4ceb410561813476cc7dae13aa2c0dae001679e821be075299940ec896a1813df284dccb2dca3d627544ed9a3b1995738b4eb12b39bb1fef2dcb9c1a4

Download Submit
C:\Windows\System\jHhuNBj.exe

Filesize
1.7MB

MD5
1ffa110cedb3688d39cff9f1004f6ea1

SHA1
37818e9149e212e85a0cff37f6781d6a6072d9f7

SHA256
efa398cfb8e0a23860196014311e616d2e7d275efd2cc8ddb0ac78237092b718

SHA512
f8fc0bd7750025b91bf0fbaf6c2d12584c374094188c87b58899a5c7f3da976b51b1a18a815ae97a229adf678ed83aee0ffe6367be9f98d5cde3c9c8b732e91f

Download Submit
C:\Windows\System\lAmxRnL.exe

Filesize
1.7MB

MD5
7b5cd47430fe74237376a3d38556ff95

SHA1
66e68622ef97a94daa1866306d8c2ea9c63fc449

SHA256
47bb7981932cd1a8b0738fc263ce97612c4061b86e4dc0ae15dd1d5f9b53a65e

SHA512
ccb8de4ebe5ffe2451178aa6c75cc9e2670a051789fe1555995fafaca61a2d35b1a76a8f1fc192b2e1102ebc9747ec31b05e659d5c59d42bf76c842343f0e6ea

Download Submit
C:\Windows\System\oXuwfrE.exe

Filesize
1.7MB

MD5
86f7de23512cf9f864892e6b00acde4a

SHA1
09a2aa7bae470d4cba7b5f8ec5a965d90da27b74

SHA256
f9a774c611712a37da73f4ed3266a0448dee2f40ce74e796bcf68cf0a7e9ae2a

SHA512
318bf4bef061983dce2e65fe2e875f5b87d7d31b99b0a34bfe49df3eaf2ecc9ea9e56bc58324f48c8f5790c4fdfccc952ec48a0d1ed463f11ddae3f52e0cce1f

Download Submit
C:\Windows\System\qMTVxEk.exe

Filesize
1.7MB

MD5
b1eaadcb7c8184898f6590282f22849a

SHA1
6b2607ffc21302156f4e5503947f83765943358c

SHA256
4da6c985adc7c8a534a4215114bb7dac3ea2a8a014f6b88fcdd60938babe16d3

SHA512
23f51ac3caddbf0ee1056386a685917179900efc758f9398dd1f15c66509f0ad40cd2d63a931ca73caa021e044bda0aa95d30fb066ec83102f5c79aed9e12d7f

Download Submit
C:\Windows\System\sfrZYLY.exe

Filesize
1.7MB

MD5
08ed3cd93a98ab92a3f04a7ccdecb58e

SHA1
5dc813249d7d596f981984b2f195006a504ebde7

SHA256
a456a0c51fa2373a7fbfb7b1e23ffd4f6d8d80ad2b1e134856626d6995e57d20

SHA512
82f9507b92575c460f4ca96105da44e2306f2c06a93a93e7184974237a98d2c35f66bd59f01a3ecb0762d3e79f701c91b751baef919e3d762f9ee2b114b7bf43

Download Submit
C:\Windows\System\tuxDVCC.exe

Filesize
1.7MB

MD5
a94f59b832a026513c18982505204791

SHA1
df89e03a2df89d3d714bb76b75ba00f4e829b4bd

SHA256
e6957df0464c6a0d47e873e0cc54bf5e4b0b09c69f673c76dd19f1b282eb73c1

SHA512
ed79d986db22256fb1ebc29d047f14e02ead775e0a7dffa0446d012a71cb8450272e8bcaf928e46c16719573ff0ed3ee315c41c0ac12a161df5251c57b5cc150

Download Submit
C:\Windows\System\uQyJGlh.exe

Filesize
1.7MB

MD5
26c359de56afcfc3aef31ec93077aa46

SHA1
81f0e7225f3c379f75a4c2d62d456864767f43a3

SHA256
af4226d4793fcc0f4918d20c294d2e4ae06418454181e436a0a7b06bf5b85d6a

SHA512
19f1a1999bdef5527e5c48ee75575f3ff58eded0c2ef6e83d26105e252e25d0952ae0e4f1f1374633c641e03ad5d6acab240dee61486d02cbfc604f9654fea61

Download Submit
C:\Windows\System\yGmeEeF.exe

Filesize
1.7MB

MD5
f20e25ad8439ff22be0b2cbe5afaa062

SHA1
9f75ab05288655dd3615a198780d45bec3943c21

SHA256
25b6596ae92c62c67b198476c3e948d2f26a5297f757e7d93cdab421a12938ea

SHA512
9c8989c7bd035c411a3cff825d89ac38ee48dba7e2fd255ab493a1a3cac28ff46f5760089251dc9f1b76af96760591d6cbb72f21ab1fe4297ccaa27328fa8191

Download Submit
memory/552-133-0x00007FF736AC0000-0x00007FF736EB2000-memory.dmp

Filesize
3.9MB

Download
memory/552-3874-0x00007FF736AC0000-0x00007FF736EB2000-memory.dmp

Filesize
3.9MB

Download
memory/796-5280-0x00007FF797860000-0x00007FF797C52000-memory.dmp

Filesize
3.9MB

Download
memory/796-67-0x00007FF797860000-0x00007FF797C52000-memory.dmp

Filesize
3.9MB

Download
memory/1180-5337-0x00007FF7BB1B0000-0x00007FF7BB5A2000-memory.dmp

Filesize
3.9MB

Download
memory/1180-77-0x00007FF7BB1B0000-0x00007FF7BB5A2000-memory.dmp

Filesize
3.9MB

Download
memory/1740-129-0x00007FF650AA0000-0x00007FF650E92000-memory.dmp

Filesize
3.9MB

Download
memory/1828-113-0x00007FF7D2C90000-0x00007FF7D3082000-memory.dmp

Filesize
3.9MB

Download
memory/1828-5351-0x00007FF7D2C90000-0x00007FF7D3082000-memory.dmp

Filesize
3.9MB

Download
memory/1844-16-0x000001A3D94E0000-0x000001A3D94F0000-memory.dmp

Filesize
64KB

Download
memory/1844-14-0x00007FF9DFDE0000-0x00007FF9E08A1000-memory.dmp

Filesize
10.8MB

Download
memory/1844-15-0x000001A3D94E0000-0x000001A3D94F0000-memory.dmp

Filesize
64KB

Download
memory/1844-36-0x000001A3D97A0000-0x000001A3D97C2000-memory.dmp

Filesize
136KB

Download
memory/2040-5327-0x00007FF771FF0000-0x00007FF7723E2000-memory.dmp

Filesize
3.9MB

Download
memory/2040-70-0x00007FF771FF0000-0x00007FF7723E2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-146-0x00007FF714B30000-0x00007FF714F22000-memory.dmp

Filesize
3.9MB

Download
memory/2244-140-0x00007FF748CA0000-0x00007FF749092000-memory.dmp

Filesize
3.9MB

Download
memory/2456-134-0x00007FF6EFA20000-0x00007FF6EFE12000-memory.dmp

Filesize
3.9MB

Download
memory/2568-143-0x00007FF71D830000-0x00007FF71DC22000-memory.dmp

Filesize
3.9MB

Download
memory/2888-39-0x00007FF64FEB0000-0x00007FF6502A2000-memory.dmp

Filesize
3.9MB

Download
memory/3124-6286-0x00007FF673090000-0x00007FF673482000-memory.dmp

Filesize
3.9MB

Download
memory/3124-142-0x00007FF673090000-0x00007FF673482000-memory.dmp

Filesize
3.9MB

Download
memory/4220-5349-0x00007FF7C0EE0000-0x00007FF7C12D2000-memory.dmp

Filesize
3.9MB

Download
memory/4220-84-0x00007FF7C0EE0000-0x00007FF7C12D2000-memory.dmp

Filesize
3.9MB

Download
memory/4348-0-0x00007FF7654F0000-0x00007FF7658E2000-memory.dmp

Filesize
3.9MB

Download
memory/4348-1-0x0000019C4B750000-0x0000019C4B760000-memory.dmp

Filesize
64KB

Download
memory/4372-54-0x00007FF7E5700000-0x00007FF7E5AF2000-memory.dmp

Filesize
3.9MB

Download
memory/4456-65-0x00007FF7B9340000-0x00007FF7B9732000-memory.dmp

Filesize
3.9MB

Download
memory/4456-5272-0x00007FF7B9340000-0x00007FF7B9732000-memory.dmp

Filesize
3.9MB

Download
memory/4472-3869-0x00007FF6E9450000-0x00007FF6E9842000-memory.dmp

Filesize
3.9MB

Download
memory/4472-122-0x00007FF6E9450000-0x00007FF6E9842000-memory.dmp

Filesize
3.9MB

Download
memory/4500-88-0x00007FF68A780000-0x00007FF68AB72000-memory.dmp

Filesize
3.9MB

Download
memory/4560-81-0x00007FF69B300000-0x00007FF69B6F2000-memory.dmp

Filesize
3.9MB

Download
memory/4820-139-0x00007FF6D0D20000-0x00007FF6D1112000-memory.dmp

Filesize
3.9MB

Download
memory/4944-5347-0x00007FF7B0C80000-0x00007FF7B1072000-memory.dmp

Filesize
3.9MB

Download
memory/4944-97-0x00007FF7B0C80000-0x00007FF7B1072000-memory.dmp

Filesize
3.9MB

Download
memory/5000-46-0x00007FF6B1400000-0x00007FF6B17F2000-memory.dmp

Filesize
3.9MB

Download