xmrig | cce64d8b646052a5b123c85f76caf1d37e159116ccb07059587b91725270476a

Analysis

max time kernel
144s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
Size

1.8MB
MD5

07e87990c5330e8c0e6c28387386f277
SHA1

393f60b6f4b214188dd7e8ba7d529db387b80e67
SHA256

cce64d8b646052a5b123c85f76caf1d37e159116ccb07059587b91725270476a
SHA512

886cef0b5d8eb2737f373cc27a278b2b6903d03f6709da9a887d14619f08ce175a98157cbc6a2ac53b7686b2bee8bbc910342f61d8404adcfa4ebcd5720d9130
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlj:NABa

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 28 IoCs

miner

resource	yara_rule
behavioral2/memory/2620-117-0x00007FF74C450000-0x00007FF74C842000-memory.dmp	xmrig
behavioral2/memory/4824-85-0x00007FF7A0BC0000-0x00007FF7A0FB2000-memory.dmp	xmrig
behavioral2/memory/2276-76-0x00007FF68AC40000-0x00007FF68B032000-memory.dmp	xmrig
behavioral2/memory/4500-237-0x00007FF65E510000-0x00007FF65E902000-memory.dmp	xmrig
behavioral2/memory/4492-226-0x00007FF6770D0000-0x00007FF6774C2000-memory.dmp	xmrig
behavioral2/memory/4864-600-0x00007FF768370000-0x00007FF768762000-memory.dmp	xmrig
behavioral2/memory/4280-786-0x00007FF790220000-0x00007FF790612000-memory.dmp	xmrig
behavioral2/memory/4996-701-0x00007FF60A510000-0x00007FF60A902000-memory.dmp	xmrig
behavioral2/memory/3188-2539-0x00007FF639B70000-0x00007FF639F62000-memory.dmp	xmrig
behavioral2/memory/4428-1044-0x00007FF618500000-0x00007FF6188F2000-memory.dmp	xmrig
behavioral2/memory/4452-434-0x00007FF6A7360000-0x00007FF6A7752000-memory.dmp	xmrig
behavioral2/memory/4804-413-0x00007FF7065F0000-0x00007FF7069E2000-memory.dmp	xmrig
behavioral2/memory/4716-410-0x00007FF672720000-0x00007FF672B12000-memory.dmp	xmrig
behavioral2/memory/1600-366-0x00007FF7FD4E0000-0x00007FF7FD8D2000-memory.dmp	xmrig
behavioral2/memory/2276-5717-0x00007FF68AC40000-0x00007FF68B032000-memory.dmp	xmrig
behavioral2/memory/2620-5722-0x00007FF74C450000-0x00007FF74C842000-memory.dmp	xmrig
behavioral2/memory/4864-5753-0x00007FF768370000-0x00007FF768762000-memory.dmp	xmrig
behavioral2/memory/3624-5769-0x00007FF6E4790000-0x00007FF6E4B82000-memory.dmp	xmrig
behavioral2/memory/4428-5765-0x00007FF618500000-0x00007FF6188F2000-memory.dmp	xmrig
behavioral2/memory/1600-5752-0x00007FF7FD4E0000-0x00007FF7FD8D2000-memory.dmp	xmrig
behavioral2/memory/4452-5749-0x00007FF6A7360000-0x00007FF6A7752000-memory.dmp	xmrig
behavioral2/memory/4492-5739-0x00007FF6770D0000-0x00007FF6774C2000-memory.dmp	xmrig
behavioral2/memory/4804-5737-0x00007FF7065F0000-0x00007FF7069E2000-memory.dmp	xmrig
behavioral2/memory/4280-5736-0x00007FF790220000-0x00007FF790612000-memory.dmp	xmrig
behavioral2/memory/4500-5732-0x00007FF65E510000-0x00007FF65E902000-memory.dmp	xmrig
behavioral2/memory/4716-5728-0x00007FF672720000-0x00007FF672B12000-memory.dmp	xmrig
behavioral2/memory/3188-5772-0x00007FF639B70000-0x00007FF639F62000-memory.dmp	xmrig
behavioral2/memory/4996-5799-0x00007FF60A510000-0x00007FF60A902000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2324	SCSprBN.exe
2276	lPjntwb.exe
4824	RfCyBYd.exe
2620	HuoIGHS.exe
3624	rnWUZjH.exe
4492	FRfyNbi.exe
4500	TCUgPCF.exe
1600	KVJxMoC.exe
4716	zSPCluH.exe
4804	kRnvwNj.exe
2220	zdYqNGj.exe
4452	mcqlmnu.exe
4864	EolombI.exe
4996	lFZaHdj.exe
4280	ZtbbfpB.exe
4428	PIlLueC.exe
3456	plBkUCl.exe
3316	PZSurru.exe
3188	uOFUMPt.exe
3056	zqkfwAK.exe
1576	qPpuZOX.exe
1476	ufoVZCu.exe
4812	ianOeRf.exe
2356	MqQthPJ.exe
1484	wCcUbxp.exe
5072	gowYKqb.exe
5076	tVdrfly.exe
1952	bqLAHQG.exe
2964	GQNKYAi.exe
4632	Ykplsiq.exe
2036	pwUyYlZ.exe
2972	rPduTRs.exe
628	SueOCch.exe
3676	epmdyBg.exe
3824	KHAHKWM.exe
4288	WiYWsnC.exe
4884	kfsiUws.exe
1360	ZYJnLGL.exe
1180	fmglAOf.exe
432	JgWPiIM.exe
2372	WZzkqzZ.exe
1976	PfnSnys.exe
4828	sdJEplB.exe
1612	MMTVAwB.exe
4456	bTqPcfN.exe
2988	CzpnnkX.exe
4148	rKKOCHs.exe
984	LspGcYq.exe
4432	uuLHDCU.exe
4268	ikXTNUv.exe
3508	EmbWdys.exe
3772	HeNTRaL.exe
2020	NAOdqrJ.exe
4832	tWnMvxR.exe
1724	cBVXAsC.exe
4984	Eqreqcy.exe
2040	yvYVnjc.exe
3796	wyzFpJk.exe
4408	nUUBtGL.exe
4364	FfLrfGk.exe
876	HxYdTzH.exe
396	KmUwjCO.exe
1296	VPzinuK.exe
3956	txlXzoU.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4880-0-0x00007FF724870000-0x00007FF724C62000-memory.dmp	upx
behavioral2/files/0x000a000000023b73-11.dat	upx
behavioral2/files/0x000a000000023b77-55.dat	upx
behavioral2/files/0x000a000000023b7c-81.dat	upx
behavioral2/files/0x000a000000023b8a-109.dat	upx
behavioral2/files/0x000a000000023b8d-140.dat	upx
behavioral2/files/0x000a000000023b8c-138.dat	upx
behavioral2/files/0x000a000000023b95-192.dat	upx
behavioral2/files/0x000a000000023b7e-131.dat	upx
behavioral2/files/0x000a000000023b8b-130.dat	upx
behavioral2/files/0x000a000000023b7d-123.dat	upx
behavioral2/files/0x000a000000023b83-120.dat	upx
behavioral2/memory/2620-117-0x00007FF74C450000-0x00007FF74C842000-memory.dmp	upx
behavioral2/files/0x000a000000023b89-113.dat	upx
behavioral2/files/0x000a000000023b87-111.dat	upx
behavioral2/files/0x000a000000023b85-110.dat	upx
behavioral2/files/0x000a000000023b88-107.dat	upx
behavioral2/files/0x000a000000023b86-105.dat	upx
behavioral2/files/0x000a000000023b7b-100.dat	upx
behavioral2/files/0x000a000000023b7a-96.dat	upx
behavioral2/files/0x000a000000023b84-93.dat	upx
behavioral2/files/0x000a000000023b79-135.dat	upx
behavioral2/files/0x000a000000023b78-88.dat	upx
behavioral2/memory/4824-85-0x00007FF7A0BC0000-0x00007FF7A0FB2000-memory.dmp	upx
behavioral2/files/0x000a000000023b82-80.dat	upx
behavioral2/memory/2276-76-0x00007FF68AC40000-0x00007FF68B032000-memory.dmp	upx
behavioral2/files/0x000a000000023b80-71.dat	upx
behavioral2/files/0x000a000000023b81-70.dat	upx
behavioral2/files/0x000a000000023b7f-66.dat	upx
behavioral2/files/0x000a000000023b76-21.dat	upx
behavioral2/files/0x000b000000023b6f-20.dat	upx
behavioral2/files/0x000a000000023b74-19.dat	upx
behavioral2/files/0x000a000000023b75-31.dat	upx
behavioral2/files/0x000a000000023b94-186.dat	upx
behavioral2/files/0x000a000000023b96-201.dat	upx
behavioral2/memory/4500-237-0x00007FF65E510000-0x00007FF65E902000-memory.dmp	upx
behavioral2/memory/4492-226-0x00007FF6770D0000-0x00007FF6774C2000-memory.dmp	upx
behavioral2/memory/4864-600-0x00007FF768370000-0x00007FF768762000-memory.dmp	upx
behavioral2/memory/4280-786-0x00007FF790220000-0x00007FF790612000-memory.dmp	upx
behavioral2/memory/4996-701-0x00007FF60A510000-0x00007FF60A902000-memory.dmp	upx
behavioral2/memory/3188-2539-0x00007FF639B70000-0x00007FF639F62000-memory.dmp	upx
behavioral2/memory/4428-1044-0x00007FF618500000-0x00007FF6188F2000-memory.dmp	upx
behavioral2/memory/4452-434-0x00007FF6A7360000-0x00007FF6A7752000-memory.dmp	upx
behavioral2/memory/4804-413-0x00007FF7065F0000-0x00007FF7069E2000-memory.dmp	upx
behavioral2/memory/4716-410-0x00007FF672720000-0x00007FF672B12000-memory.dmp	upx
behavioral2/memory/1600-366-0x00007FF7FD4E0000-0x00007FF7FD8D2000-memory.dmp	upx
behavioral2/memory/3624-187-0x00007FF6E4790000-0x00007FF6E4B82000-memory.dmp	upx
behavioral2/files/0x000a000000023b93-181.dat	upx
behavioral2/files/0x000a000000023b92-180.dat	upx
behavioral2/files/0x000a000000023b91-178.dat	upx
behavioral2/files/0x000a000000023b8f-171.dat	upx
behavioral2/files/0x000a000000023b8e-142.dat	upx
behavioral2/memory/2276-5717-0x00007FF68AC40000-0x00007FF68B032000-memory.dmp	upx
behavioral2/memory/2620-5722-0x00007FF74C450000-0x00007FF74C842000-memory.dmp	upx
behavioral2/memory/4864-5753-0x00007FF768370000-0x00007FF768762000-memory.dmp	upx
behavioral2/memory/3624-5769-0x00007FF6E4790000-0x00007FF6E4B82000-memory.dmp	upx
behavioral2/memory/4428-5765-0x00007FF618500000-0x00007FF6188F2000-memory.dmp	upx
behavioral2/memory/1600-5752-0x00007FF7FD4E0000-0x00007FF7FD8D2000-memory.dmp	upx
behavioral2/memory/4452-5749-0x00007FF6A7360000-0x00007FF6A7752000-memory.dmp	upx
behavioral2/memory/4492-5739-0x00007FF6770D0000-0x00007FF6774C2000-memory.dmp	upx
behavioral2/memory/4804-5737-0x00007FF7065F0000-0x00007FF7069E2000-memory.dmp	upx
behavioral2/memory/4280-5736-0x00007FF790220000-0x00007FF790612000-memory.dmp	upx
behavioral2/memory/4500-5732-0x00007FF65E510000-0x00007FF65E902000-memory.dmp	upx
behavioral2/memory/4716-5728-0x00007FF672720000-0x00007FF672B12000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LyuhojU.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\QKxJoNt.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\EXpeTxB.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\rPcNQnF.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\luluvdc.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\fiZkRPI.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\oGUPFEX.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\nPkzTEH.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\bfgrPSq.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\ePXlfhX.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\hzyISnu.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\jxuWtdm.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\DkAmCyP.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\Uzbefrt.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\FjtXraq.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\ayEfiqb.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\lsoRFAw.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\BspPbqt.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\PlDYhYK.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\FJqLXbQ.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\mFoCYOe.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\dGupacy.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\LkelYoN.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\DLNVEjE.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\dFYWWyI.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\EvtdaTo.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\yRTswoE.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\WPaQEkl.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\YnyLKYd.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\mVCZaav.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\mwfCDdy.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\JCIDsAp.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\xXDrXMy.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\iZmGWcv.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\cahvKGU.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\fliQIXP.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\BkHtgJN.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\dVzypQQ.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\YhOfyRE.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\RxqlgeM.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\Xxzxuxb.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\QzFwPLr.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\Wvlltoo.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\tEYiKgF.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\tsAcgtn.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\rlZAifC.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\ceQdxaA.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\aHKYfyK.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\RLqWuYk.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\qiYAVOY.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\mQGMzaH.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\WDSyQGf.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\AVXzqJF.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\yjNxFzd.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\uAcHVEa.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\qSmbkis.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\EPlbqnk.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\WOdykEv.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\ElPOzhH.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\tCYuTcw.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\PzPIrCK.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\uqjZcgd.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\iqtsxLW.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
File created	C:\Windows\System\QTefhhk.exe	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
780	powershell.exe
780	powershell.exe
780	powershell.exe
780	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
Token: SeDebugPrivilege	780	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 780	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	84
PID 4880 wrote to memory of 780	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	84
PID 4880 wrote to memory of 2276	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	85
PID 4880 wrote to memory of 2276	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	85
PID 4880 wrote to memory of 2324	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	86
PID 4880 wrote to memory of 2324	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	86
PID 4880 wrote to memory of 3624	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	87
PID 4880 wrote to memory of 3624	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	87
PID 4880 wrote to memory of 4824	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	88
PID 4880 wrote to memory of 4824	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	88
PID 4880 wrote to memory of 2620	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	89
PID 4880 wrote to memory of 2620	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	89
PID 4880 wrote to memory of 4492	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	90
PID 4880 wrote to memory of 4492	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	90
PID 4880 wrote to memory of 4500	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	91
PID 4880 wrote to memory of 4500	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	91
PID 4880 wrote to memory of 1600	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	92
PID 4880 wrote to memory of 1600	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	92
PID 4880 wrote to memory of 4716	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	93
PID 4880 wrote to memory of 4716	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	93
PID 4880 wrote to memory of 4804	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	94
PID 4880 wrote to memory of 4804	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	94
PID 4880 wrote to memory of 2220	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	95
PID 4880 wrote to memory of 2220	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	95
PID 4880 wrote to memory of 4452	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	96
PID 4880 wrote to memory of 4452	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	96
PID 4880 wrote to memory of 4864	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	97
PID 4880 wrote to memory of 4864	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	97
PID 4880 wrote to memory of 4996	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	98
PID 4880 wrote to memory of 4996	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	98
PID 4880 wrote to memory of 4280	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	99
PID 4880 wrote to memory of 4280	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	99
PID 4880 wrote to memory of 4428	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	100
PID 4880 wrote to memory of 4428	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	100
PID 4880 wrote to memory of 3456	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	101
PID 4880 wrote to memory of 3456	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	101
PID 4880 wrote to memory of 1484	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	102
PID 4880 wrote to memory of 1484	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	102
PID 4880 wrote to memory of 3316	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	103
PID 4880 wrote to memory of 3316	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	103
PID 4880 wrote to memory of 3188	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	104
PID 4880 wrote to memory of 3188	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	104
PID 4880 wrote to memory of 3056	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	105
PID 4880 wrote to memory of 3056	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	105
PID 4880 wrote to memory of 1576	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	106
PID 4880 wrote to memory of 1576	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	106
PID 4880 wrote to memory of 1476	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	107
PID 4880 wrote to memory of 1476	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	107
PID 4880 wrote to memory of 4812	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	108
PID 4880 wrote to memory of 4812	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	108
PID 4880 wrote to memory of 2356	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	109
PID 4880 wrote to memory of 2356	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	109
PID 4880 wrote to memory of 5072	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	110
PID 4880 wrote to memory of 5072	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	110
PID 4880 wrote to memory of 5076	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	111
PID 4880 wrote to memory of 5076	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	111
PID 4880 wrote to memory of 1952	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	112
PID 4880 wrote to memory of 1952	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	112
PID 4880 wrote to memory of 2964	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	113
PID 4880 wrote to memory of 2964	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	113
PID 4880 wrote to memory of 4632	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	114
PID 4880 wrote to memory of 4632	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	114
PID 4880 wrote to memory of 4456	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	115
PID 4880 wrote to memory of 4456	4880	07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07e87990c5330e8c0e6c28387386f277_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:780
- C:\Windows\System\lPjntwb.exe
  C:\Windows\System\lPjntwb.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\SCSprBN.exe
  C:\Windows\System\SCSprBN.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\rnWUZjH.exe
  C:\Windows\System\rnWUZjH.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\RfCyBYd.exe
  C:\Windows\System\RfCyBYd.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\HuoIGHS.exe
  C:\Windows\System\HuoIGHS.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\FRfyNbi.exe
  C:\Windows\System\FRfyNbi.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\TCUgPCF.exe
  C:\Windows\System\TCUgPCF.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\KVJxMoC.exe
  C:\Windows\System\KVJxMoC.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\zSPCluH.exe
  C:\Windows\System\zSPCluH.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\kRnvwNj.exe
  C:\Windows\System\kRnvwNj.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\zdYqNGj.exe
  C:\Windows\System\zdYqNGj.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\mcqlmnu.exe
  C:\Windows\System\mcqlmnu.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\EolombI.exe
  C:\Windows\System\EolombI.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\lFZaHdj.exe
  C:\Windows\System\lFZaHdj.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\ZtbbfpB.exe
  C:\Windows\System\ZtbbfpB.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\PIlLueC.exe
  C:\Windows\System\PIlLueC.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\plBkUCl.exe
  C:\Windows\System\plBkUCl.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\wCcUbxp.exe
  C:\Windows\System\wCcUbxp.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\PZSurru.exe
  C:\Windows\System\PZSurru.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\uOFUMPt.exe
  C:\Windows\System\uOFUMPt.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\zqkfwAK.exe
  C:\Windows\System\zqkfwAK.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\qPpuZOX.exe
  C:\Windows\System\qPpuZOX.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\ufoVZCu.exe
  C:\Windows\System\ufoVZCu.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\ianOeRf.exe
  C:\Windows\System\ianOeRf.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\MqQthPJ.exe
  C:\Windows\System\MqQthPJ.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\gowYKqb.exe
  C:\Windows\System\gowYKqb.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\tVdrfly.exe
  C:\Windows\System\tVdrfly.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\bqLAHQG.exe
  C:\Windows\System\bqLAHQG.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\GQNKYAi.exe
  C:\Windows\System\GQNKYAi.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\Ykplsiq.exe
  C:\Windows\System\Ykplsiq.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\bTqPcfN.exe
  C:\Windows\System\bTqPcfN.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\pwUyYlZ.exe
  C:\Windows\System\pwUyYlZ.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\rPduTRs.exe
  C:\Windows\System\rPduTRs.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\SueOCch.exe
  C:\Windows\System\SueOCch.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\epmdyBg.exe
  C:\Windows\System\epmdyBg.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\KHAHKWM.exe
  C:\Windows\System\KHAHKWM.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\WiYWsnC.exe
  C:\Windows\System\WiYWsnC.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\kfsiUws.exe
  C:\Windows\System\kfsiUws.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\cBVXAsC.exe
  C:\Windows\System\cBVXAsC.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\ZYJnLGL.exe
  C:\Windows\System\ZYJnLGL.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\fmglAOf.exe
  C:\Windows\System\fmglAOf.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\JgWPiIM.exe
  C:\Windows\System\JgWPiIM.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\WZzkqzZ.exe
  C:\Windows\System\WZzkqzZ.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\PfnSnys.exe
  C:\Windows\System\PfnSnys.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\sdJEplB.exe
  C:\Windows\System\sdJEplB.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\MMTVAwB.exe
  C:\Windows\System\MMTVAwB.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\CzpnnkX.exe
  C:\Windows\System\CzpnnkX.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\rKKOCHs.exe
  C:\Windows\System\rKKOCHs.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\LspGcYq.exe
  C:\Windows\System\LspGcYq.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\uuLHDCU.exe
  C:\Windows\System\uuLHDCU.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\ikXTNUv.exe
  C:\Windows\System\ikXTNUv.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\EmbWdys.exe
  C:\Windows\System\EmbWdys.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\HeNTRaL.exe
  C:\Windows\System\HeNTRaL.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\NAOdqrJ.exe
  C:\Windows\System\NAOdqrJ.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\tWnMvxR.exe
  C:\Windows\System\tWnMvxR.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\Eqreqcy.exe
  C:\Windows\System\Eqreqcy.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\yvYVnjc.exe
  C:\Windows\System\yvYVnjc.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\wyzFpJk.exe
  C:\Windows\System\wyzFpJk.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\nUUBtGL.exe
  C:\Windows\System\nUUBtGL.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\FfLrfGk.exe
  C:\Windows\System\FfLrfGk.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\HxYdTzH.exe
  C:\Windows\System\HxYdTzH.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\KmUwjCO.exe
  C:\Windows\System\KmUwjCO.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\VPzinuK.exe
  C:\Windows\System\VPzinuK.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\txlXzoU.exe
  C:\Windows\System\txlXzoU.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\fORFTMd.exe
  C:\Windows\System\fORFTMd.exe
  2⤵
  PID:1264
- C:\Windows\System\skiRAjt.exe
  C:\Windows\System\skiRAjt.exe
  2⤵
  PID:4808
- C:\Windows\System\vZGxiTd.exe
  C:\Windows\System\vZGxiTd.exe
  2⤵
  PID:2456
- C:\Windows\System\IbdnCEv.exe
  C:\Windows\System\IbdnCEv.exe
  2⤵
  PID:4048
- C:\Windows\System\amgRPjN.exe
  C:\Windows\System\amgRPjN.exe
  2⤵
  PID:368
- C:\Windows\System\pRJhoCW.exe
  C:\Windows\System\pRJhoCW.exe
  2⤵
  PID:976
- C:\Windows\System\xyUkqOm.exe
  C:\Windows\System\xyUkqOm.exe
  2⤵
  PID:2196
- C:\Windows\System\BTnxeaF.exe
  C:\Windows\System\BTnxeaF.exe
  2⤵
  PID:1020
- C:\Windows\System\rmIUyxj.exe
  C:\Windows\System\rmIUyxj.exe
  2⤵
  PID:640
- C:\Windows\System\CeVWvbW.exe
  C:\Windows\System\CeVWvbW.exe
  2⤵
  PID:748
- C:\Windows\System\WCoShia.exe
  C:\Windows\System\WCoShia.exe
  2⤵
  PID:4676
- C:\Windows\System\AcxixZM.exe
  C:\Windows\System\AcxixZM.exe
  2⤵
  PID:4820
- C:\Windows\System\NTpabqC.exe
  C:\Windows\System\NTpabqC.exe
  2⤵
  PID:3060
- C:\Windows\System\KmlQpSR.exe
  C:\Windows\System\KmlQpSR.exe
  2⤵
  PID:3652
- C:\Windows\System\rWDdnDK.exe
  C:\Windows\System\rWDdnDK.exe
  2⤵
  PID:60
- C:\Windows\System\OviwCen.exe
  C:\Windows\System\OviwCen.exe
  2⤵
  PID:4800
- C:\Windows\System\twvywFb.exe
  C:\Windows\System\twvywFb.exe
  2⤵
  PID:4056
- C:\Windows\System\BWMHgYe.exe
  C:\Windows\System\BWMHgYe.exe
  2⤵
  PID:2684
- C:\Windows\System\tflXgvi.exe
  C:\Windows\System\tflXgvi.exe
  2⤵
  PID:4712
- C:\Windows\System\CgugrAB.exe
  C:\Windows\System\CgugrAB.exe
  2⤵
  PID:3140
- C:\Windows\System\BVPxMNd.exe
  C:\Windows\System\BVPxMNd.exe
  2⤵
  PID:2448
- C:\Windows\System\ArjiPcM.exe
  C:\Windows\System\ArjiPcM.exe
  2⤵
  PID:3504
- C:\Windows\System\DoRHMWM.exe
  C:\Windows\System\DoRHMWM.exe
  2⤵
  PID:4112
- C:\Windows\System\IjaxgcO.exe
  C:\Windows\System\IjaxgcO.exe
  2⤵
  PID:2340
- C:\Windows\System\kniQnKn.exe
  C:\Windows\System\kniQnKn.exe
  2⤵
  PID:736
- C:\Windows\System\WQcLSiY.exe
  C:\Windows\System\WQcLSiY.exe
  2⤵
  PID:4708
- C:\Windows\System\gFfeHDG.exe
  C:\Windows\System\gFfeHDG.exe
  2⤵
  PID:1444
- C:\Windows\System\lTTKuCK.exe
  C:\Windows\System\lTTKuCK.exe
  2⤵
  PID:3532
- C:\Windows\System\dNUfkQh.exe
  C:\Windows\System\dNUfkQh.exe
  2⤵
  PID:700
- C:\Windows\System\kmKtCrl.exe
  C:\Windows\System\kmKtCrl.exe
  2⤵
  PID:3664
- C:\Windows\System\bbWxILL.exe
  C:\Windows\System\bbWxILL.exe
  2⤵
  PID:5116
- C:\Windows\System\eodBnuq.exe
  C:\Windows\System\eodBnuq.exe
  2⤵
  PID:3952
- C:\Windows\System\hsBLggA.exe
  C:\Windows\System\hsBLggA.exe
  2⤵
  PID:4904
- C:\Windows\System\UDdekWZ.exe
  C:\Windows\System\UDdekWZ.exe
  2⤵
  PID:2748
- C:\Windows\System\PHNekOR.exe
  C:\Windows\System\PHNekOR.exe
  2⤵
  PID:3204
- C:\Windows\System\MFBTgAF.exe
  C:\Windows\System\MFBTgAF.exe
  2⤵
  PID:5136
- C:\Windows\System\QsZwUde.exe
  C:\Windows\System\QsZwUde.exe
  2⤵
  PID:5164
- C:\Windows\System\MBhYPir.exe
  C:\Windows\System\MBhYPir.exe
  2⤵
  PID:5184
- C:\Windows\System\iSlYpGQ.exe
  C:\Windows\System\iSlYpGQ.exe
  2⤵
  PID:5200
- C:\Windows\System\tWHnucJ.exe
  C:\Windows\System\tWHnucJ.exe
  2⤵
  PID:5224
- C:\Windows\System\hLdfQjs.exe
  C:\Windows\System\hLdfQjs.exe
  2⤵
  PID:5240
- C:\Windows\System\matwgQx.exe
  C:\Windows\System\matwgQx.exe
  2⤵
  PID:5260
- C:\Windows\System\DHchKVN.exe
  C:\Windows\System\DHchKVN.exe
  2⤵
  PID:5280
- C:\Windows\System\GMGoAJv.exe
  C:\Windows\System\GMGoAJv.exe
  2⤵
  PID:5300
- C:\Windows\System\VyMarsz.exe
  C:\Windows\System\VyMarsz.exe
  2⤵
  PID:5316
- C:\Windows\System\GwrQdqc.exe
  C:\Windows\System\GwrQdqc.exe
  2⤵
  PID:5336
- C:\Windows\System\HRHkElX.exe
  C:\Windows\System\HRHkElX.exe
  2⤵
  PID:5352
- C:\Windows\System\cqjgJRz.exe
  C:\Windows\System\cqjgJRz.exe
  2⤵
  PID:5380
- C:\Windows\System\LtVPlSq.exe
  C:\Windows\System\LtVPlSq.exe
  2⤵
  PID:5400
- C:\Windows\System\neKalxR.exe
  C:\Windows\System\neKalxR.exe
  2⤵
  PID:5424
- C:\Windows\System\EOQgkMj.exe
  C:\Windows\System\EOQgkMj.exe
  2⤵
  PID:5452
- C:\Windows\System\faaIcZM.exe
  C:\Windows\System\faaIcZM.exe
  2⤵
  PID:5468
- C:\Windows\System\vmuzwIX.exe
  C:\Windows\System\vmuzwIX.exe
  2⤵
  PID:5556
- C:\Windows\System\zKuLoIQ.exe
  C:\Windows\System\zKuLoIQ.exe
  2⤵
  PID:5572
- C:\Windows\System\LrEGkio.exe
  C:\Windows\System\LrEGkio.exe
  2⤵
  PID:5600
- C:\Windows\System\yaplwkh.exe
  C:\Windows\System\yaplwkh.exe
  2⤵
  PID:5656
- C:\Windows\System\fpGlwvL.exe
  C:\Windows\System\fpGlwvL.exe
  2⤵
  PID:5700
- C:\Windows\System\FvIKQvv.exe
  C:\Windows\System\FvIKQvv.exe
  2⤵
  PID:5720
- C:\Windows\System\AZSmJeB.exe
  C:\Windows\System\AZSmJeB.exe
  2⤵
  PID:5744
- C:\Windows\System\IsnyFFk.exe
  C:\Windows\System\IsnyFFk.exe
  2⤵
  PID:5768
- C:\Windows\System\IBrlpXW.exe
  C:\Windows\System\IBrlpXW.exe
  2⤵
  PID:5784
- C:\Windows\System\YvJoPQf.exe
  C:\Windows\System\YvJoPQf.exe
  2⤵
  PID:5808
- C:\Windows\System\waZjfeb.exe
  C:\Windows\System\waZjfeb.exe
  2⤵
  PID:5824
- C:\Windows\System\oXyLYaj.exe
  C:\Windows\System\oXyLYaj.exe
  2⤵
  PID:5840
- C:\Windows\System\ABPcZaM.exe
  C:\Windows\System\ABPcZaM.exe
  2⤵
  PID:5856
- C:\Windows\System\SYPwvlZ.exe
  C:\Windows\System\SYPwvlZ.exe
  2⤵
  PID:5876
- C:\Windows\System\luTxYQC.exe
  C:\Windows\System\luTxYQC.exe
  2⤵
  PID:5892
- C:\Windows\System\RuciIer.exe
  C:\Windows\System\RuciIer.exe
  2⤵
  PID:5916
- C:\Windows\System\bxNIXrf.exe
  C:\Windows\System\bxNIXrf.exe
  2⤵
  PID:5932
- C:\Windows\System\kwDiDoD.exe
  C:\Windows\System\kwDiDoD.exe
  2⤵
  PID:5960
- C:\Windows\System\gXsxlBM.exe
  C:\Windows\System\gXsxlBM.exe
  2⤵
  PID:5976
- C:\Windows\System\pswkGRf.exe
  C:\Windows\System\pswkGRf.exe
  2⤵
  PID:5992
- C:\Windows\System\dvRuFLe.exe
  C:\Windows\System\dvRuFLe.exe
  2⤵
  PID:6012
- C:\Windows\System\FxitpJB.exe
  C:\Windows\System\FxitpJB.exe
  2⤵
  PID:6028
- C:\Windows\System\ZAyQUWv.exe
  C:\Windows\System\ZAyQUWv.exe
  2⤵
  PID:6044
- C:\Windows\System\BVYclOA.exe
  C:\Windows\System\BVYclOA.exe
  2⤵
  PID:6060
- C:\Windows\System\KrqrqZU.exe
  C:\Windows\System\KrqrqZU.exe
  2⤵
  PID:6088
- C:\Windows\System\liJMjhQ.exe
  C:\Windows\System\liJMjhQ.exe
  2⤵
  PID:6104
- C:\Windows\System\yOUAZDq.exe
  C:\Windows\System\yOUAZDq.exe
  2⤵
  PID:6128
- C:\Windows\System\qsZjYqz.exe
  C:\Windows\System\qsZjYqz.exe
  2⤵
  PID:3724
- C:\Windows\System\JvpNain.exe
  C:\Windows\System\JvpNain.exe
  2⤵
  PID:1744
- C:\Windows\System\ydOxyXq.exe
  C:\Windows\System\ydOxyXq.exe
  2⤵
  PID:4108
- C:\Windows\System\HEJIlKi.exe
  C:\Windows\System\HEJIlKi.exe
  2⤵
  PID:5232
- C:\Windows\System\spjNSSD.exe
  C:\Windows\System\spjNSSD.exe
  2⤵
  PID:5412
- C:\Windows\System\kRgPjRD.exe
  C:\Windows\System\kRgPjRD.exe
  2⤵
  PID:2708
- C:\Windows\System\GHKbBIO.exe
  C:\Windows\System\GHKbBIO.exe
  2⤵
  PID:5128
- C:\Windows\System\GiulLoM.exe
  C:\Windows\System\GiulLoM.exe
  2⤵
  PID:5848
- C:\Windows\System\DyvqEwh.exe
  C:\Windows\System\DyvqEwh.exe
  2⤵
  PID:4256
- C:\Windows\System\SxYgBLe.exe
  C:\Windows\System\SxYgBLe.exe
  2⤵
  PID:1072
- C:\Windows\System\NHyGErB.exe
  C:\Windows\System\NHyGErB.exe
  2⤵
  PID:1732
- C:\Windows\System\rEysbOp.exe
  C:\Windows\System\rEysbOp.exe
  2⤵
  PID:5012
- C:\Windows\System\SJDximT.exe
  C:\Windows\System\SJDximT.exe
  2⤵
  PID:3984
- C:\Windows\System\eYCTbwo.exe
  C:\Windows\System\eYCTbwo.exe
  2⤵
  PID:4988
- C:\Windows\System\UfvSJZu.exe
  C:\Windows\System\UfvSJZu.exe
  2⤵
  PID:1608
- C:\Windows\System\eMvUZBH.exe
  C:\Windows\System\eMvUZBH.exe
  2⤵
  PID:3168
- C:\Windows\System\kqvKUmH.exe
  C:\Windows\System\kqvKUmH.exe
  2⤵
  PID:4216
- C:\Windows\System\wwUcfKq.exe
  C:\Windows\System\wwUcfKq.exe
  2⤵
  PID:2556
- C:\Windows\System\iCVBFgU.exe
  C:\Windows\System\iCVBFgU.exe
  2⤵
  PID:6148
- C:\Windows\System\NiZtMCO.exe
  C:\Windows\System\NiZtMCO.exe
  2⤵
  PID:6168
- C:\Windows\System\YKWkelo.exe
  C:\Windows\System\YKWkelo.exe
  2⤵
  PID:6188
- C:\Windows\System\rgUpIwm.exe
  C:\Windows\System\rgUpIwm.exe
  2⤵
  PID:6208
- C:\Windows\System\hnxHSWf.exe
  C:\Windows\System\hnxHSWf.exe
  2⤵
  PID:6232
- C:\Windows\System\Hfhhqpn.exe
  C:\Windows\System\Hfhhqpn.exe
  2⤵
  PID:6248
- C:\Windows\System\VFmZrvn.exe
  C:\Windows\System\VFmZrvn.exe
  2⤵
  PID:6272
- C:\Windows\System\VrBeJdf.exe
  C:\Windows\System\VrBeJdf.exe
  2⤵
  PID:6296
- C:\Windows\System\fGPxxAq.exe
  C:\Windows\System\fGPxxAq.exe
  2⤵
  PID:6316
- C:\Windows\System\EPnhYvx.exe
  C:\Windows\System\EPnhYvx.exe
  2⤵
  PID:6336
- C:\Windows\System\EgBuevk.exe
  C:\Windows\System\EgBuevk.exe
  2⤵
  PID:6360
- C:\Windows\System\aKMXbfl.exe
  C:\Windows\System\aKMXbfl.exe
  2⤵
  PID:6380
- C:\Windows\System\PpDwqvp.exe
  C:\Windows\System\PpDwqvp.exe
  2⤵
  PID:6400
- C:\Windows\System\usWFGcS.exe
  C:\Windows\System\usWFGcS.exe
  2⤵
  PID:6424
- C:\Windows\System\WMrpvQV.exe
  C:\Windows\System\WMrpvQV.exe
  2⤵
  PID:6440
- C:\Windows\System\KudZOOt.exe
  C:\Windows\System\KudZOOt.exe
  2⤵
  PID:6464
- C:\Windows\System\xQfENcq.exe
  C:\Windows\System\xQfENcq.exe
  2⤵
  PID:6496
- C:\Windows\System\TGXsaTv.exe
  C:\Windows\System\TGXsaTv.exe
  2⤵
  PID:6520
- C:\Windows\System\wJtvnbt.exe
  C:\Windows\System\wJtvnbt.exe
  2⤵
  PID:6536
- C:\Windows\System\YLIBCGz.exe
  C:\Windows\System\YLIBCGz.exe
  2⤵
  PID:6560
- C:\Windows\System\MkmnDnF.exe
  C:\Windows\System\MkmnDnF.exe
  2⤵
  PID:6584
- C:\Windows\System\oFskeBF.exe
  C:\Windows\System\oFskeBF.exe
  2⤵
  PID:6604
- C:\Windows\System\qEkOWAM.exe
  C:\Windows\System\qEkOWAM.exe
  2⤵
  PID:6628
- C:\Windows\System\fTDxoFn.exe
  C:\Windows\System\fTDxoFn.exe
  2⤵
  PID:6648
- C:\Windows\System\KXiKCFa.exe
  C:\Windows\System\KXiKCFa.exe
  2⤵
  PID:6668
- C:\Windows\System\itOmwOP.exe
  C:\Windows\System\itOmwOP.exe
  2⤵
  PID:6692
- C:\Windows\System\SaXVbCf.exe
  C:\Windows\System\SaXVbCf.exe
  2⤵
  PID:6712
- C:\Windows\System\YbTVxHk.exe
  C:\Windows\System\YbTVxHk.exe
  2⤵
  PID:6732
- C:\Windows\System\QlStJMZ.exe
  C:\Windows\System\QlStJMZ.exe
  2⤵
  PID:6756
- C:\Windows\System\GZbJsfe.exe
  C:\Windows\System\GZbJsfe.exe
  2⤵
  PID:6772
- C:\Windows\System\MitapRG.exe
  C:\Windows\System\MitapRG.exe
  2⤵
  PID:6796
- C:\Windows\System\TMZgTLg.exe
  C:\Windows\System\TMZgTLg.exe
  2⤵
  PID:6812
- C:\Windows\System\BCubNTA.exe
  C:\Windows\System\BCubNTA.exe
  2⤵
  PID:6836
- C:\Windows\System\XILQiRP.exe
  C:\Windows\System\XILQiRP.exe
  2⤵
  PID:6860
- C:\Windows\System\RGDyeOs.exe
  C:\Windows\System\RGDyeOs.exe
  2⤵
  PID:6876
- C:\Windows\System\YCprSvh.exe
  C:\Windows\System\YCprSvh.exe
  2⤵
  PID:6892
- C:\Windows\System\REVUvfj.exe
  C:\Windows\System\REVUvfj.exe
  2⤵
  PID:6916
- C:\Windows\System\fQEoNmR.exe
  C:\Windows\System\fQEoNmR.exe
  2⤵
  PID:6932
- C:\Windows\System\ViZWhTg.exe
  C:\Windows\System\ViZWhTg.exe
  2⤵
  PID:6956
- C:\Windows\System\LAJysad.exe
  C:\Windows\System\LAJysad.exe
  2⤵
  PID:6976
- C:\Windows\System\sOkLRsw.exe
  C:\Windows\System\sOkLRsw.exe
  2⤵
  PID:6996
- C:\Windows\System\dZqqpnZ.exe
  C:\Windows\System\dZqqpnZ.exe
  2⤵
  PID:7012
- C:\Windows\System\hebTZkS.exe
  C:\Windows\System\hebTZkS.exe
  2⤵
  PID:7040
- C:\Windows\System\QadoIky.exe
  C:\Windows\System\QadoIky.exe
  2⤵
  PID:7060
- C:\Windows\System\MfNUnDe.exe
  C:\Windows\System\MfNUnDe.exe
  2⤵
  PID:7092
- C:\Windows\System\tHUwjgD.exe
  C:\Windows\System\tHUwjgD.exe
  2⤵
  PID:7108
- C:\Windows\System\qTdedWk.exe
  C:\Windows\System\qTdedWk.exe
  2⤵
  PID:7128
- C:\Windows\System\WCKJXVg.exe
  C:\Windows\System\WCKJXVg.exe
  2⤵
  PID:7148
- C:\Windows\System\EeNyAGH.exe
  C:\Windows\System\EeNyAGH.exe
  2⤵
  PID:5160
- C:\Windows\System\KjGkIia.exe
  C:\Windows\System\KjGkIia.exe
  2⤵
  PID:5220
- C:\Windows\System\ATLvhrf.exe
  C:\Windows\System\ATLvhrf.exe
  2⤵
  PID:5256
- C:\Windows\System\jwbLNlU.exe
  C:\Windows\System\jwbLNlU.exe
  2⤵
  PID:5288
- C:\Windows\System\VWnxVNi.exe
  C:\Windows\System\VWnxVNi.exe
  2⤵
  PID:5332
- C:\Windows\System\YkiIfNS.exe
  C:\Windows\System\YkiIfNS.exe
  2⤵
  PID:5364
- C:\Windows\System\qLRjSPf.exe
  C:\Windows\System\qLRjSPf.exe
  2⤵
  PID:5888
- C:\Windows\System\vfFVJqf.exe
  C:\Windows\System\vfFVJqf.exe
  2⤵
  PID:5408
- C:\Windows\System\QsRHBji.exe
  C:\Windows\System\QsRHBji.exe
  2⤵
  PID:5480
- C:\Windows\System\zMLuhwl.exe
  C:\Windows\System\zMLuhwl.exe
  2⤵
  PID:5596
- C:\Windows\System\hLfKroT.exe
  C:\Windows\System\hLfKroT.exe
  2⤵
  PID:5708
- C:\Windows\System\nFFaMwK.exe
  C:\Windows\System\nFFaMwK.exe
  2⤵
  PID:5736
- C:\Windows\System\SRnTFOJ.exe
  C:\Windows\System\SRnTFOJ.exe
  2⤵
  PID:5776
- C:\Windows\System\DJfQeyM.exe
  C:\Windows\System\DJfQeyM.exe
  2⤵
  PID:2232
- C:\Windows\System\CvuDfmb.exe
  C:\Windows\System\CvuDfmb.exe
  2⤵
  PID:6200
- C:\Windows\System\feczOum.exe
  C:\Windows\System\feczOum.exe
  2⤵
  PID:6280
- C:\Windows\System\CHyDAGQ.exe
  C:\Windows\System\CHyDAGQ.exe
  2⤵
  PID:6420
- C:\Windows\System\zwzsSPn.exe
  C:\Windows\System\zwzsSPn.exe
  2⤵
  PID:6472
- C:\Windows\System\YkDehUg.exe
  C:\Windows\System\YkDehUg.exe
  2⤵
  PID:7180
- C:\Windows\System\miUtmuW.exe
  C:\Windows\System\miUtmuW.exe
  2⤵
  PID:7204
- C:\Windows\System\ixhkTJK.exe
  C:\Windows\System\ixhkTJK.exe
  2⤵
  PID:7228
- C:\Windows\System\bYkAErE.exe
  C:\Windows\System\bYkAErE.exe
  2⤵
  PID:7248
- C:\Windows\System\lfCbgKI.exe
  C:\Windows\System\lfCbgKI.exe
  2⤵
  PID:7268
- C:\Windows\System\LsNeWGk.exe
  C:\Windows\System\LsNeWGk.exe
  2⤵
  PID:7292
- C:\Windows\System\BMhgpAy.exe
  C:\Windows\System\BMhgpAy.exe
  2⤵
  PID:7316
- C:\Windows\System\PJzEUZg.exe
  C:\Windows\System\PJzEUZg.exe
  2⤵
  PID:7344
- C:\Windows\System\JpQaJuy.exe
  C:\Windows\System\JpQaJuy.exe
  2⤵
  PID:7364
- C:\Windows\System\pfBSDaq.exe
  C:\Windows\System\pfBSDaq.exe
  2⤵
  PID:7388
- C:\Windows\System\nJCxzdH.exe
  C:\Windows\System\nJCxzdH.exe
  2⤵
  PID:7412
- C:\Windows\System\krMMJNG.exe
  C:\Windows\System\krMMJNG.exe
  2⤵
  PID:7432
- C:\Windows\System\RAQefGz.exe
  C:\Windows\System\RAQefGz.exe
  2⤵
  PID:7452
- C:\Windows\System\zXsIhIl.exe
  C:\Windows\System\zXsIhIl.exe
  2⤵
  PID:7476
- C:\Windows\System\MHVtAPu.exe
  C:\Windows\System\MHVtAPu.exe
  2⤵
  PID:7496
- C:\Windows\System\WAvfqXj.exe
  C:\Windows\System\WAvfqXj.exe
  2⤵
  PID:7516
- C:\Windows\System\kxHgbCD.exe
  C:\Windows\System\kxHgbCD.exe
  2⤵
  PID:7536
- C:\Windows\System\ebDbbZG.exe
  C:\Windows\System\ebDbbZG.exe
  2⤵
  PID:7552
- C:\Windows\System\XSWYewk.exe
  C:\Windows\System\XSWYewk.exe
  2⤵
  PID:7580
- C:\Windows\System\HMUxQLn.exe
  C:\Windows\System\HMUxQLn.exe
  2⤵
  PID:7596
- C:\Windows\System\dQZrdzG.exe
  C:\Windows\System\dQZrdzG.exe
  2⤵
  PID:7612
- C:\Windows\System\pNcjWZt.exe
  C:\Windows\System\pNcjWZt.exe
  2⤵
  PID:7628
- C:\Windows\System\MlydSAo.exe
  C:\Windows\System\MlydSAo.exe
  2⤵
  PID:7648
- C:\Windows\System\MiQBJHM.exe
  C:\Windows\System\MiQBJHM.exe
  2⤵
  PID:7668
- C:\Windows\System\LoXuhFr.exe
  C:\Windows\System\LoXuhFr.exe
  2⤵
  PID:7692
- C:\Windows\System\WHxLYXy.exe
  C:\Windows\System\WHxLYXy.exe
  2⤵
  PID:7708
- C:\Windows\System\AbGcWKo.exe
  C:\Windows\System\AbGcWKo.exe
  2⤵
  PID:7732
- C:\Windows\System\yMZQyOi.exe
  C:\Windows\System\yMZQyOi.exe
  2⤵
  PID:7756
- C:\Windows\System\hYCMIzs.exe
  C:\Windows\System\hYCMIzs.exe
  2⤵
  PID:7792
- C:\Windows\System\FbCdCWX.exe
  C:\Windows\System\FbCdCWX.exe
  2⤵
  PID:7812
- C:\Windows\System\lmqNdlz.exe
  C:\Windows\System\lmqNdlz.exe
  2⤵
  PID:7832
- C:\Windows\System\pBryJBD.exe
  C:\Windows\System\pBryJBD.exe
  2⤵
  PID:7856
- C:\Windows\System\glBaKMn.exe
  C:\Windows\System\glBaKMn.exe
  2⤵
  PID:7880
- C:\Windows\System\meCkrwS.exe
  C:\Windows\System\meCkrwS.exe
  2⤵
  PID:7896
- C:\Windows\System\BkLzYsg.exe
  C:\Windows\System\BkLzYsg.exe
  2⤵
  PID:7916
- C:\Windows\System\ghLDdRq.exe
  C:\Windows\System\ghLDdRq.exe
  2⤵
  PID:7936
- C:\Windows\System\qHhIHGC.exe
  C:\Windows\System\qHhIHGC.exe
  2⤵
  PID:7952
- C:\Windows\System\KxhfXQH.exe
  C:\Windows\System\KxhfXQH.exe
  2⤵
  PID:7972
- C:\Windows\System\QFrUcOa.exe
  C:\Windows\System\QFrUcOa.exe
  2⤵
  PID:7996
- C:\Windows\System\BJPPRLK.exe
  C:\Windows\System\BJPPRLK.exe
  2⤵
  PID:8012
- C:\Windows\System\znijmhR.exe
  C:\Windows\System\znijmhR.exe
  2⤵
  PID:8032
- C:\Windows\System\nixbYzT.exe
  C:\Windows\System\nixbYzT.exe
  2⤵
  PID:8048
- C:\Windows\System\NYIWzKR.exe
  C:\Windows\System\NYIWzKR.exe
  2⤵
  PID:8072
- C:\Windows\System\KUAlucK.exe
  C:\Windows\System\KUAlucK.exe
  2⤵
  PID:8092
- C:\Windows\System\XsDMBDE.exe
  C:\Windows\System\XsDMBDE.exe
  2⤵
  PID:8112
- C:\Windows\System\DhTbyjX.exe
  C:\Windows\System\DhTbyjX.exe
  2⤵
  PID:8128
- C:\Windows\System\jcmvUun.exe
  C:\Windows\System\jcmvUun.exe
  2⤵
  PID:8156
- C:\Windows\System\GgtHdGt.exe
  C:\Windows\System\GgtHdGt.exe
  2⤵
  PID:8180
- C:\Windows\System\UpHCBqx.exe
  C:\Windows\System\UpHCBqx.exe
  2⤵
  PID:6556
- C:\Windows\System\bAIOJNF.exe
  C:\Windows\System\bAIOJNF.exe
  2⤵
  PID:6636
- C:\Windows\System\sTtUEVf.exe
  C:\Windows\System\sTtUEVf.exe
  2⤵
  PID:6724
- C:\Windows\System\FHKxADl.exe
  C:\Windows\System\FHKxADl.exe
  2⤵
  PID:6828
- C:\Windows\System\ueFcTLN.exe
  C:\Windows\System\ueFcTLN.exe
  2⤵
  PID:6940
- C:\Windows\System\LRqPYMq.exe
  C:\Windows\System\LRqPYMq.exe
  2⤵
  PID:6076
- C:\Windows\System\dSmEVQu.exe
  C:\Windows\System\dSmEVQu.exe
  2⤵
  PID:2264
- C:\Windows\System\cbyyleQ.exe
  C:\Windows\System\cbyyleQ.exe
  2⤵
  PID:6268
- C:\Windows\System\fFibUhb.exe
  C:\Windows\System\fFibUhb.exe
  2⤵
  PID:6308
- C:\Windows\System\hgagUck.exe
  C:\Windows\System\hgagUck.exe
  2⤵
  PID:6184
- C:\Windows\System\iPvrVZG.exe
  C:\Windows\System\iPvrVZG.exe
  2⤵
  PID:6460
- C:\Windows\System\fyvuIIg.exe
  C:\Windows\System\fyvuIIg.exe
  2⤵
  PID:6456
- C:\Windows\System\hujuuLL.exe
  C:\Windows\System\hujuuLL.exe
  2⤵
  PID:5984
- C:\Windows\System\wzTmxXn.exe
  C:\Windows\System\wzTmxXn.exe
  2⤵
  PID:7276
- C:\Windows\System\STmcekS.exe
  C:\Windows\System\STmcekS.exe
  2⤵
  PID:6704
- C:\Windows\System\ufbizkz.exe
  C:\Windows\System\ufbizkz.exe
  2⤵
  PID:6684
- C:\Windows\System\RuXmoSq.exe
  C:\Windows\System\RuXmoSq.exe
  2⤵
  PID:4772
- C:\Windows\System\SKSwjkV.exe
  C:\Windows\System\SKSwjkV.exe
  2⤵
  PID:7408
- C:\Windows\System\ZjsNUlu.exe
  C:\Windows\System\ZjsNUlu.exe
  2⤵
  PID:7464
- C:\Windows\System\ytHsvDP.exe
  C:\Windows\System\ytHsvDP.exe
  2⤵
  PID:6052
- C:\Windows\System\XjJQjcF.exe
  C:\Windows\System\XjJQjcF.exe
  2⤵
  PID:6096
- C:\Windows\System\ktdwUVC.exe
  C:\Windows\System\ktdwUVC.exe
  2⤵
  PID:6140
- C:\Windows\System\npmqnVu.exe
  C:\Windows\System\npmqnVu.exe
  2⤵
  PID:7072
- C:\Windows\System\ZllSIMj.exe
  C:\Windows\System\ZllSIMj.exe
  2⤵
  PID:4144
- C:\Windows\System\dqCLwYn.exe
  C:\Windows\System\dqCLwYn.exe
  2⤵
  PID:7744
- C:\Windows\System\kfwFoNr.exe
  C:\Windows\System\kfwFoNr.exe
  2⤵
  PID:8196
- C:\Windows\System\lmFMeKT.exe
  C:\Windows\System\lmFMeKT.exe
  2⤵
  PID:8216
- C:\Windows\System\UyhYAgv.exe
  C:\Windows\System\UyhYAgv.exe
  2⤵
  PID:8240
- C:\Windows\System\ATyZaJJ.exe
  C:\Windows\System\ATyZaJJ.exe
  2⤵
  PID:8256
- C:\Windows\System\DYzDvAi.exe
  C:\Windows\System\DYzDvAi.exe
  2⤵
  PID:8280
- C:\Windows\System\nlVpdqV.exe
  C:\Windows\System\nlVpdqV.exe
  2⤵
  PID:8304
- C:\Windows\System\CoVaRvq.exe
  C:\Windows\System\CoVaRvq.exe
  2⤵
  PID:8324
- C:\Windows\System\zlddAkr.exe
  C:\Windows\System\zlddAkr.exe
  2⤵
  PID:8344
- C:\Windows\System\EBocOPN.exe
  C:\Windows\System\EBocOPN.exe
  2⤵
  PID:8368
- C:\Windows\System\ZMNNnfM.exe
  C:\Windows\System\ZMNNnfM.exe
  2⤵
  PID:8388
- C:\Windows\System\Besiran.exe
  C:\Windows\System\Besiran.exe
  2⤵
  PID:8412
- C:\Windows\System\OWcSgTM.exe
  C:\Windows\System\OWcSgTM.exe
  2⤵
  PID:8432
- C:\Windows\System\SHZeUnR.exe
  C:\Windows\System\SHZeUnR.exe
  2⤵
  PID:8456
- C:\Windows\System\LtYzlOa.exe
  C:\Windows\System\LtYzlOa.exe
  2⤵
  PID:8472
- C:\Windows\System\rKMbdjd.exe
  C:\Windows\System\rKMbdjd.exe
  2⤵
  PID:8496
- C:\Windows\System\WyGEdmM.exe
  C:\Windows\System\WyGEdmM.exe
  2⤵
  PID:8516
- C:\Windows\System\cxkVpXI.exe
  C:\Windows\System\cxkVpXI.exe
  2⤵
  PID:8536
- C:\Windows\System\FVeAJOt.exe
  C:\Windows\System\FVeAJOt.exe
  2⤵
  PID:8560
- C:\Windows\System\NXfEBwo.exe
  C:\Windows\System\NXfEBwo.exe
  2⤵
  PID:8584
- C:\Windows\System\uUwWdCZ.exe
  C:\Windows\System\uUwWdCZ.exe
  2⤵
  PID:8604
- C:\Windows\System\dGrXOXT.exe
  C:\Windows\System\dGrXOXT.exe
  2⤵
  PID:8628
- C:\Windows\System\NBxZxDK.exe
  C:\Windows\System\NBxZxDK.exe
  2⤵
  PID:8648
- C:\Windows\System\BXODoCD.exe
  C:\Windows\System\BXODoCD.exe
  2⤵
  PID:8672
- C:\Windows\System\dZHghRc.exe
  C:\Windows\System\dZHghRc.exe
  2⤵
  PID:8692
- C:\Windows\System\MncFHAn.exe
  C:\Windows\System\MncFHAn.exe
  2⤵
  PID:8712
- C:\Windows\System\HoYDRMz.exe
  C:\Windows\System\HoYDRMz.exe
  2⤵
  PID:8732
- C:\Windows\System\kTVbeuW.exe
  C:\Windows\System\kTVbeuW.exe
  2⤵
  PID:8756
- C:\Windows\System\zySgbVa.exe
  C:\Windows\System\zySgbVa.exe
  2⤵
  PID:8772
- C:\Windows\System\tmlJPIG.exe
  C:\Windows\System\tmlJPIG.exe
  2⤵
  PID:8796
- C:\Windows\System\ZDIQutE.exe
  C:\Windows\System\ZDIQutE.exe
  2⤵
  PID:8816
- C:\Windows\System\ziKvgoX.exe
  C:\Windows\System\ziKvgoX.exe
  2⤵
  PID:8836
- C:\Windows\System\bMYQzMu.exe
  C:\Windows\System\bMYQzMu.exe
  2⤵
  PID:8852
- C:\Windows\System\ipLxfuP.exe
  C:\Windows\System\ipLxfuP.exe
  2⤵
  PID:8876
- C:\Windows\System\UVbdHYZ.exe
  C:\Windows\System\UVbdHYZ.exe
  2⤵
  PID:8900
- C:\Windows\System\WBHLuGy.exe
  C:\Windows\System\WBHLuGy.exe
  2⤵
  PID:8920
- C:\Windows\System\UkydHcj.exe
  C:\Windows\System\UkydHcj.exe
  2⤵
  PID:8936
- C:\Windows\System\eowBtGD.exe
  C:\Windows\System\eowBtGD.exe
  2⤵
  PID:8956
- C:\Windows\System\TVBSTtq.exe
  C:\Windows\System\TVBSTtq.exe
  2⤵
  PID:8980
- C:\Windows\System\joSpmGw.exe
  C:\Windows\System\joSpmGw.exe
  2⤵
  PID:9004
- C:\Windows\System\FeXGGOQ.exe
  C:\Windows\System\FeXGGOQ.exe
  2⤵
  PID:9020
- C:\Windows\System\APGxLqa.exe
  C:\Windows\System\APGxLqa.exe
  2⤵
  PID:9040
- C:\Windows\System\lfywZkS.exe
  C:\Windows\System\lfywZkS.exe
  2⤵
  PID:9060
- C:\Windows\System\EJOjdsi.exe
  C:\Windows\System\EJOjdsi.exe
  2⤵
  PID:9084
- C:\Windows\System\LvirHDz.exe
  C:\Windows\System\LvirHDz.exe
  2⤵
  PID:9104
- C:\Windows\System\VDSndfu.exe
  C:\Windows\System\VDSndfu.exe
  2⤵
  PID:9124
- C:\Windows\System\uTtcrsR.exe
  C:\Windows\System\uTtcrsR.exe
  2⤵
  PID:9148
- C:\Windows\System\RoWqVZy.exe
  C:\Windows\System\RoWqVZy.exe
  2⤵
  PID:9172
- C:\Windows\System\LbZuhTK.exe
  C:\Windows\System\LbZuhTK.exe
  2⤵
  PID:9196
- C:\Windows\System\vKgVDtK.exe
  C:\Windows\System\vKgVDtK.exe
  2⤵
  PID:4164
- C:\Windows\System\Jxbjaaw.exe
  C:\Windows\System\Jxbjaaw.exe
  2⤵
  PID:4104
- C:\Windows\System\WLuNHhI.exe
  C:\Windows\System\WLuNHhI.exe
  2⤵
  PID:3324
- C:\Windows\System\lfKNLIm.exe
  C:\Windows\System\lfKNLIm.exe
  2⤵
  PID:4424
- C:\Windows\System\ksBDeXi.exe
  C:\Windows\System\ksBDeXi.exe
  2⤵
  PID:1948
- C:\Windows\System\PojkWXZ.exe
  C:\Windows\System\PojkWXZ.exe
  2⤵
  PID:6160
- C:\Windows\System\SJQHfVH.exe
  C:\Windows\System\SJQHfVH.exe
  2⤵
  PID:7824
- C:\Windows\System\ykCWsxR.exe
  C:\Windows\System\ykCWsxR.exe
  2⤵
  PID:6332
- C:\Windows\System\DgVjuPE.exe
  C:\Windows\System\DgVjuPE.exe
  2⤵
  PID:7868
- C:\Windows\System\rBHglQr.exe
  C:\Windows\System\rBHglQr.exe
  2⤵
  PID:6516
- C:\Windows\System\zGCNzJv.exe
  C:\Windows\System\zGCNzJv.exe
  2⤵
  PID:6688
- C:\Windows\System\MVgMAzu.exe
  C:\Windows\System\MVgMAzu.exe
  2⤵
  PID:6804
- C:\Windows\System\QWELqFG.exe
  C:\Windows\System\QWELqFG.exe
  2⤵
  PID:6848
- C:\Windows\System\uXoEslW.exe
  C:\Windows\System\uXoEslW.exe
  2⤵
  PID:6888
- C:\Windows\System\JntEKLl.exe
  C:\Windows\System\JntEKLl.exe
  2⤵
  PID:9228
- C:\Windows\System\PcsosMN.exe
  C:\Windows\System\PcsosMN.exe
  2⤵
  PID:9248
- C:\Windows\System\nNNrZUs.exe
  C:\Windows\System\nNNrZUs.exe
  2⤵
  PID:9268
- C:\Windows\System\CXwvxoU.exe
  C:\Windows\System\CXwvxoU.exe
  2⤵
  PID:9292
- C:\Windows\System\LZGxEhm.exe
  C:\Windows\System\LZGxEhm.exe
  2⤵
  PID:9316
- C:\Windows\System\fbfQobm.exe
  C:\Windows\System\fbfQobm.exe
  2⤵
  PID:9336
- C:\Windows\System\RaCAXfG.exe
  C:\Windows\System\RaCAXfG.exe
  2⤵
  PID:9356
- C:\Windows\System\jlWgFSl.exe
  C:\Windows\System\jlWgFSl.exe
  2⤵
  PID:9372
- C:\Windows\System\HrVkfrM.exe
  C:\Windows\System\HrVkfrM.exe
  2⤵
  PID:9392
- C:\Windows\System\ARmMFIV.exe
  C:\Windows\System\ARmMFIV.exe
  2⤵
  PID:9408
- C:\Windows\System\jsTxoaY.exe
  C:\Windows\System\jsTxoaY.exe
  2⤵
  PID:9432
- C:\Windows\System\hykMzkm.exe
  C:\Windows\System\hykMzkm.exe
  2⤵
  PID:9456
- C:\Windows\System\uoEcnsN.exe
  C:\Windows\System\uoEcnsN.exe
  2⤵
  PID:9472
- C:\Windows\System\jKUxpbO.exe
  C:\Windows\System\jKUxpbO.exe
  2⤵
  PID:9496
- C:\Windows\System\lxJuTLe.exe
  C:\Windows\System\lxJuTLe.exe
  2⤵
  PID:9520
- C:\Windows\System\qLglvps.exe
  C:\Windows\System\qLglvps.exe
  2⤵
  PID:9544
- C:\Windows\System\jMJksQJ.exe
  C:\Windows\System\jMJksQJ.exe
  2⤵
  PID:9560
- C:\Windows\System\oIVkhqE.exe
  C:\Windows\System\oIVkhqE.exe
  2⤵
  PID:9580
- C:\Windows\System\vCeqhwR.exe
  C:\Windows\System\vCeqhwR.exe
  2⤵
  PID:9600
- C:\Windows\System\mraQUYA.exe
  C:\Windows\System\mraQUYA.exe
  2⤵
  PID:9624
- C:\Windows\System\jKENXfo.exe
  C:\Windows\System\jKENXfo.exe
  2⤵
  PID:9672
- C:\Windows\System\sWniuMr.exe
  C:\Windows\System\sWniuMr.exe
  2⤵
  PID:9696
- C:\Windows\System\ghfKrJJ.exe
  C:\Windows\System\ghfKrJJ.exe
  2⤵
  PID:9720
- C:\Windows\System\KFRRuOc.exe
  C:\Windows\System\KFRRuOc.exe
  2⤵
  PID:9740
- C:\Windows\System\JwOAxfv.exe
  C:\Windows\System\JwOAxfv.exe
  2⤵
  PID:9764
- C:\Windows\System\dpxzWPu.exe
  C:\Windows\System\dpxzWPu.exe
  2⤵
  PID:9788
- C:\Windows\System\PywFKtY.exe
  C:\Windows\System\PywFKtY.exe
  2⤵
  PID:9812
- C:\Windows\System\sddETaj.exe
  C:\Windows\System\sddETaj.exe
  2⤵
  PID:9832
- C:\Windows\System\OQkJYdb.exe
  C:\Windows\System\OQkJYdb.exe
  2⤵
  PID:9852
- C:\Windows\System\SzksCMT.exe
  C:\Windows\System\SzksCMT.exe
  2⤵
  PID:9872
- C:\Windows\System\ePEwUKe.exe
  C:\Windows\System\ePEwUKe.exe
  2⤵
  PID:9900
- C:\Windows\System\CerrSzd.exe
  C:\Windows\System\CerrSzd.exe
  2⤵
  PID:9924
- C:\Windows\System\Ytvehhv.exe
  C:\Windows\System\Ytvehhv.exe
  2⤵
  PID:9940
- C:\Windows\System\LVNjqtB.exe
  C:\Windows\System\LVNjqtB.exe
  2⤵
  PID:9964
- C:\Windows\System\WuLzNyI.exe
  C:\Windows\System\WuLzNyI.exe
  2⤵
  PID:9984
- C:\Windows\System\CWVJpEs.exe
  C:\Windows\System\CWVJpEs.exe
  2⤵
  PID:10004
- C:\Windows\System\ECynuKY.exe
  C:\Windows\System\ECynuKY.exe
  2⤵
  PID:10032
- C:\Windows\System\WpMdEAS.exe
  C:\Windows\System\WpMdEAS.exe
  2⤵
  PID:10052
- C:\Windows\System\AgUBxnl.exe
  C:\Windows\System\AgUBxnl.exe
  2⤵
  PID:10072
- C:\Windows\System\rBRpQEd.exe
  C:\Windows\System\rBRpQEd.exe
  2⤵
  PID:10096
- C:\Windows\System\QhBaMGv.exe
  C:\Windows\System\QhBaMGv.exe
  2⤵
  PID:10120
- C:\Windows\System\ixLfsZo.exe
  C:\Windows\System\ixLfsZo.exe
  2⤵
  PID:10144
- C:\Windows\System\xgJfNTT.exe
  C:\Windows\System\xgJfNTT.exe
  2⤵
  PID:10172
- C:\Windows\System\hbDyGUj.exe
  C:\Windows\System\hbDyGUj.exe
  2⤵
  PID:10188
- C:\Windows\System\OHFenWA.exe
  C:\Windows\System\OHFenWA.exe
  2⤵
  PID:10208
- C:\Windows\System\knhxSbp.exe
  C:\Windows\System\knhxSbp.exe
  2⤵
  PID:10232
- C:\Windows\System\OxODisp.exe
  C:\Windows\System\OxODisp.exe
  2⤵
  PID:7524
- C:\Windows\System\vPZSoRV.exe
  C:\Windows\System\vPZSoRV.exe
  2⤵
  PID:6748
- C:\Windows\System\bbMZPol.exe
  C:\Windows\System\bbMZPol.exe
  2⤵
  PID:6908
- C:\Windows\System\yycOMra.exe
  C:\Windows\System\yycOMra.exe
  2⤵
  PID:2008
- C:\Windows\System\uxYikhn.exe
  C:\Windows\System\uxYikhn.exe
  2⤵
  PID:7036
- C:\Windows\System\LfHsjWH.exe
  C:\Windows\System\LfHsjWH.exe
  2⤵
  PID:6256
- C:\Windows\System\TIpgKHj.exe
  C:\Windows\System\TIpgKHj.exe
  2⤵
  PID:7084
- C:\Windows\System\JWrPykW.exe
  C:\Windows\System\JWrPykW.exe
  2⤵
  PID:6568
- C:\Windows\System\yFUtKRL.exe
  C:\Windows\System\yFUtKRL.exe
  2⤵
  PID:7144
- C:\Windows\System\UgyIddj.exe
  C:\Windows\System\UgyIddj.exe
  2⤵
  PID:7660
- C:\Windows\System\WxjTGeG.exe
  C:\Windows\System\WxjTGeG.exe
  2⤵
  PID:6008
- C:\Windows\System\VWuMxbW.exe
  C:\Windows\System\VWuMxbW.exe
  2⤵
  PID:5296
- C:\Windows\System\xJCcAGG.exe
  C:\Windows\System\xJCcAGG.exe
  2⤵
  PID:7024
- C:\Windows\System\HrSUglm.exe
  C:\Windows\System\HrSUglm.exe
  2⤵
  PID:5236
- C:\Windows\System\OwAHfxJ.exe
  C:\Windows\System\OwAHfxJ.exe
  2⤵
  PID:8356
- C:\Windows\System\DVOXISi.exe
  C:\Windows\System\DVOXISi.exe
  2⤵
  PID:6100
- C:\Windows\System\njnWxsn.exe
  C:\Windows\System\njnWxsn.exe
  2⤵
  PID:5592
- C:\Windows\System\CwbsEaJ.exe
  C:\Windows\System\CwbsEaJ.exe
  2⤵
  PID:8552
- C:\Windows\System\JAWFapH.exe
  C:\Windows\System\JAWFapH.exe
  2⤵
  PID:10248
- C:\Windows\System\AVNTACc.exe
  C:\Windows\System\AVNTACc.exe
  2⤵
  PID:10268
- C:\Windows\System\DZEpYYs.exe
  C:\Windows\System\DZEpYYs.exe
  2⤵
  PID:10292
- C:\Windows\System\pkSgoRH.exe
  C:\Windows\System\pkSgoRH.exe
  2⤵
  PID:10312
- C:\Windows\System\tkXHskX.exe
  C:\Windows\System\tkXHskX.exe
  2⤵
  PID:10336
- C:\Windows\System\AWxWwyv.exe
  C:\Windows\System\AWxWwyv.exe
  2⤵
  PID:10360
- C:\Windows\System\mHYzzvz.exe
  C:\Windows\System\mHYzzvz.exe
  2⤵
  PID:10384
- C:\Windows\System\HjNSwVg.exe
  C:\Windows\System\HjNSwVg.exe
  2⤵
  PID:10408
- C:\Windows\System\QfecPvj.exe
  C:\Windows\System\QfecPvj.exe
  2⤵
  PID:10432
- C:\Windows\System\gVUwLmF.exe
  C:\Windows\System\gVUwLmF.exe
  2⤵
  PID:10452
- C:\Windows\System\qWXglcu.exe
  C:\Windows\System\qWXglcu.exe
  2⤵
  PID:10476
- C:\Windows\System\IVmwdLt.exe
  C:\Windows\System\IVmwdLt.exe
  2⤵
  PID:10492
- C:\Windows\System\xjLDzPE.exe
  C:\Windows\System\xjLDzPE.exe
  2⤵
  PID:10516
- C:\Windows\System\cxKXFrb.exe
  C:\Windows\System\cxKXFrb.exe
  2⤵
  PID:10540
- C:\Windows\System\jvBzaWJ.exe
  C:\Windows\System\jvBzaWJ.exe
  2⤵
  PID:10568
- C:\Windows\System\lzZBbIN.exe
  C:\Windows\System\lzZBbIN.exe
  2⤵
  PID:10592
- C:\Windows\System\bknMxZh.exe
  C:\Windows\System\bknMxZh.exe
  2⤵
  PID:10612
- C:\Windows\System\cDfwuXp.exe
  C:\Windows\System\cDfwuXp.exe
  2⤵
  PID:10636
- C:\Windows\System\agJiwEu.exe
  C:\Windows\System\agJiwEu.exe
  2⤵
  PID:10660
- C:\Windows\System\BRhasQl.exe
  C:\Windows\System\BRhasQl.exe
  2⤵
  PID:10680
- C:\Windows\System\khtfTNR.exe
  C:\Windows\System\khtfTNR.exe
  2⤵
  PID:10700
- C:\Windows\System\LqxpArD.exe
  C:\Windows\System\LqxpArD.exe
  2⤵
  PID:10720
- C:\Windows\System\mRznMrI.exe
  C:\Windows\System\mRznMrI.exe
  2⤵
  PID:10740
- C:\Windows\System\UUGEjEi.exe
  C:\Windows\System\UUGEjEi.exe
  2⤵
  PID:10768
- C:\Windows\System\hDbbVMi.exe
  C:\Windows\System\hDbbVMi.exe
  2⤵
  PID:10792
- C:\Windows\System\XNCYXIm.exe
  C:\Windows\System\XNCYXIm.exe
  2⤵
  PID:10812
- C:\Windows\System\PQqczKM.exe
  C:\Windows\System\PQqczKM.exe
  2⤵
  PID:10832
- C:\Windows\System\UFZOuOZ.exe
  C:\Windows\System\UFZOuOZ.exe
  2⤵
  PID:10852
- C:\Windows\System\vuugzmi.exe
  C:\Windows\System\vuugzmi.exe
  2⤵
  PID:10880
- C:\Windows\System\gmhGLPL.exe
  C:\Windows\System\gmhGLPL.exe
  2⤵
  PID:10900
- C:\Windows\System\mQiFCaB.exe
  C:\Windows\System\mQiFCaB.exe
  2⤵
  PID:10928
- C:\Windows\System\kwoJNyG.exe
  C:\Windows\System\kwoJNyG.exe
  2⤵
  PID:10948
- C:\Windows\System\fvBEdhj.exe
  C:\Windows\System\fvBEdhj.exe
  2⤵
  PID:10972
- C:\Windows\System\NXXyskF.exe
  C:\Windows\System\NXXyskF.exe
  2⤵
  PID:10992
- C:\Windows\System\bpwIRVM.exe
  C:\Windows\System\bpwIRVM.exe
  2⤵
  PID:11016
- C:\Windows\System\bXfGbZQ.exe
  C:\Windows\System\bXfGbZQ.exe
  2⤵
  PID:11036
- C:\Windows\System\KjVfLlY.exe
  C:\Windows\System\KjVfLlY.exe
  2⤵
  PID:11056
- C:\Windows\System\BFeJDZV.exe
  C:\Windows\System\BFeJDZV.exe
  2⤵
  PID:11084
- C:\Windows\System\gDIyFrB.exe
  C:\Windows\System\gDIyFrB.exe
  2⤵
  PID:11104
- C:\Windows\System\cKrvIYA.exe
  C:\Windows\System\cKrvIYA.exe
  2⤵
  PID:11124
- C:\Windows\System\pBhbmmx.exe
  C:\Windows\System\pBhbmmx.exe
  2⤵
  PID:11144
- C:\Windows\System\NvuqmHa.exe
  C:\Windows\System\NvuqmHa.exe
  2⤵
  PID:11180
- C:\Windows\System\LjeUwXf.exe
  C:\Windows\System\LjeUwXf.exe
  2⤵
  PID:11204
- C:\Windows\System\fnPQEKZ.exe
  C:\Windows\System\fnPQEKZ.exe
  2⤵
  PID:11224
- C:\Windows\System\fmICOTg.exe
  C:\Windows\System\fmICOTg.exe
  2⤵
  PID:11240
- C:\Windows\System\axeTvbq.exe
  C:\Windows\System\axeTvbq.exe
  2⤵
  PID:11260
- C:\Windows\System\tnydrsE.exe
  C:\Windows\System\tnydrsE.exe
  2⤵
  PID:8660
- C:\Windows\System\VUPYkaE.exe
  C:\Windows\System\VUPYkaE.exe
  2⤵
  PID:8740
- C:\Windows\System\GUPXPfm.exe
  C:\Windows\System\GUPXPfm.exe
  2⤵
  PID:8788
- C:\Windows\System\owqOTOc.exe
  C:\Windows\System\owqOTOc.exe
  2⤵
  PID:7176
- C:\Windows\System\ufCVkqE.exe
  C:\Windows\System\ufCVkqE.exe
  2⤵
  PID:7964
- C:\Windows\System\ghmrZTl.exe
  C:\Windows\System\ghmrZTl.exe
  2⤵
  PID:8948
- C:\Windows\System\iJThiQD.exe
  C:\Windows\System\iJThiQD.exe
  2⤵
  PID:7220
- C:\Windows\System\RvNwwlU.exe
  C:\Windows\System\RvNwwlU.exe
  2⤵
  PID:9068
- C:\Windows\System\HPZochN.exe
  C:\Windows\System\HPZochN.exe
  2⤵
  PID:9156
- C:\Windows\System\aNGnPwN.exe
  C:\Windows\System\aNGnPwN.exe
  2⤵
  PID:4920
- C:\Windows\System\LzrGbzZ.exe
  C:\Windows\System\LzrGbzZ.exe
  2⤵
  PID:8080
- C:\Windows\System\fkhraOl.exe
  C:\Windows\System\fkhraOl.exe
  2⤵
  PID:7800
- C:\Windows\System\OnJFkwk.exe
  C:\Windows\System\OnJFkwk.exe
  2⤵
  PID:8100
- C:\Windows\System\GqANuEX.exe
  C:\Windows\System\GqANuEX.exe
  2⤵
  PID:9244
- C:\Windows\System\NJFSIcg.exe
  C:\Windows\System\NJFSIcg.exe
  2⤵
  PID:7484
- C:\Windows\System\iHdBnSi.exe
  C:\Windows\System\iHdBnSi.exe
  2⤵
  PID:6612
- C:\Windows\System\MlaLBiS.exe
  C:\Windows\System\MlaLBiS.exe
  2⤵
  PID:11272
- C:\Windows\System\qbFQeLc.exe
  C:\Windows\System\qbFQeLc.exe
  2⤵
  PID:11296
- C:\Windows\System\RKZoNAV.exe
  C:\Windows\System\RKZoNAV.exe
  2⤵
  PID:11316
- C:\Windows\System\jWiYaaZ.exe
  C:\Windows\System\jWiYaaZ.exe
  2⤵
  PID:11340
- C:\Windows\System\oLgFVTP.exe
  C:\Windows\System\oLgFVTP.exe
  2⤵
  PID:11360
- C:\Windows\System\bVMdYoE.exe
  C:\Windows\System\bVMdYoE.exe
  2⤵
  PID:11384
- C:\Windows\System\ygoiRde.exe
  C:\Windows\System\ygoiRde.exe
  2⤵
  PID:11408
- C:\Windows\System\FOEOLVw.exe
  C:\Windows\System\FOEOLVw.exe
  2⤵
  PID:11424
- C:\Windows\System\yhVenOV.exe
  C:\Windows\System\yhVenOV.exe
  2⤵
  PID:11444
- C:\Windows\System\IoWMtlW.exe
  C:\Windows\System\IoWMtlW.exe
  2⤵
  PID:11460
- C:\Windows\System\CWNAqjV.exe
  C:\Windows\System\CWNAqjV.exe
  2⤵
  PID:11484
- C:\Windows\System\GZspVyC.exe
  C:\Windows\System\GZspVyC.exe
  2⤵
  PID:11504
- C:\Windows\System\yXuyITc.exe
  C:\Windows\System\yXuyITc.exe
  2⤵
  PID:11524
- C:\Windows\System\aDcavdi.exe
  C:\Windows\System\aDcavdi.exe
  2⤵
  PID:11540
- C:\Windows\System\TxxkUlF.exe
  C:\Windows\System\TxxkUlF.exe
  2⤵
  PID:11556
- C:\Windows\System\feNwDLI.exe
  C:\Windows\System\feNwDLI.exe
  2⤵
  PID:11572
- C:\Windows\System\YREFWrK.exe
  C:\Windows\System\YREFWrK.exe
  2⤵
  PID:11588
- C:\Windows\System\iVLxmHe.exe
  C:\Windows\System\iVLxmHe.exe
  2⤵
  PID:11604
- C:\Windows\System\YGkUBaV.exe
  C:\Windows\System\YGkUBaV.exe
  2⤵
  PID:11620
- C:\Windows\System\zlxBPLj.exe
  C:\Windows\System\zlxBPLj.exe
  2⤵
  PID:11664
- C:\Windows\System\SRBpNNj.exe
  C:\Windows\System\SRBpNNj.exe
  2⤵
  PID:11684
- C:\Windows\System\nPglMDn.exe
  C:\Windows\System\nPglMDn.exe
  2⤵
  PID:11728
- C:\Windows\System\zYtjnBY.exe
  C:\Windows\System\zYtjnBY.exe
  2⤵
  PID:11756
- C:\Windows\System\mwQQeOo.exe
  C:\Windows\System\mwQQeOo.exe
  2⤵
  PID:11772
- C:\Windows\System\KAbsKGt.exe
  C:\Windows\System\KAbsKGt.exe
  2⤵
  PID:11796
- C:\Windows\System\uNxPtPf.exe
  C:\Windows\System\uNxPtPf.exe
  2⤵
  PID:11820
- C:\Windows\System\KwjGLxh.exe
  C:\Windows\System\KwjGLxh.exe
  2⤵
  PID:11840
- C:\Windows\System\cymVoCL.exe
  C:\Windows\System\cymVoCL.exe
  2⤵
  PID:11860
- C:\Windows\System\fkGaDaQ.exe
  C:\Windows\System\fkGaDaQ.exe
  2⤵
  PID:11888
- C:\Windows\System\eWZSVMI.exe
  C:\Windows\System\eWZSVMI.exe
  2⤵
  PID:11908
- C:\Windows\System\LrrXqSu.exe
  C:\Windows\System\LrrXqSu.exe
  2⤵
  PID:11928
- C:\Windows\System\InjQvOH.exe
  C:\Windows\System\InjQvOH.exe
  2⤵
  PID:11948
- C:\Windows\System\AFhCsUU.exe
  C:\Windows\System\AFhCsUU.exe
  2⤵
  PID:11972
- C:\Windows\System\zIaGzxb.exe
  C:\Windows\System\zIaGzxb.exe
  2⤵
  PID:12000
- C:\Windows\System\GGoVTyW.exe
  C:\Windows\System\GGoVTyW.exe
  2⤵
  PID:12016
- C:\Windows\System\aMEfoxD.exe
  C:\Windows\System\aMEfoxD.exe
  2⤵
  PID:12044
- C:\Windows\System\MbzMAZr.exe
  C:\Windows\System\MbzMAZr.exe
  2⤵
  PID:12064
- C:\Windows\System\CwdlldB.exe
  C:\Windows\System\CwdlldB.exe
  2⤵
  PID:12084
- C:\Windows\System\xdftMNd.exe
  C:\Windows\System\xdftMNd.exe
  2⤵
  PID:12108
- C:\Windows\System\AinDCao.exe
  C:\Windows\System\AinDCao.exe
  2⤵
  PID:12128
- C:\Windows\System\LzsAmZr.exe
  C:\Windows\System\LzsAmZr.exe
  2⤵
  PID:12148
- C:\Windows\System\BNWYzEm.exe
  C:\Windows\System\BNWYzEm.exe
  2⤵
  PID:12172
- C:\Windows\System\YauWKCz.exe
  C:\Windows\System\YauWKCz.exe
  2⤵
  PID:12196
- C:\Windows\System\rZgdROK.exe
  C:\Windows\System\rZgdROK.exe
  2⤵
  PID:12212
- C:\Windows\System\NlJMDof.exe
  C:\Windows\System\NlJMDof.exe
  2⤵
  PID:12236
- C:\Windows\System\UQrsmTV.exe
  C:\Windows\System\UQrsmTV.exe
  2⤵
  PID:12252
- C:\Windows\System\OBjvNOK.exe
  C:\Windows\System\OBjvNOK.exe
  2⤵
  PID:12272
- C:\Windows\System\JskPzYi.exe
  C:\Windows\System\JskPzYi.exe
  2⤵
  PID:6676
- C:\Windows\System\fSJMyaR.exe
  C:\Windows\System\fSJMyaR.exe
  2⤵
  PID:9404
- C:\Windows\System\sPmhKPW.exe
  C:\Windows\System\sPmhKPW.exe
  2⤵
  PID:9468
- C:\Windows\System\pjpcemw.exe
  C:\Windows\System\pjpcemw.exe
  2⤵
  PID:6972
- C:\Windows\System\sXUEGLD.exe
  C:\Windows\System\sXUEGLD.exe
  2⤵
  PID:7592
- C:\Windows\System\GPFIXyQ.exe
  C:\Windows\System\GPFIXyQ.exe
  2⤵
  PID:9784
- C:\Windows\System\jrcOoDr.exe
  C:\Windows\System\jrcOoDr.exe
  2⤵
  PID:6292
- C:\Windows\System\JfePLjw.exe
  C:\Windows\System\JfePLjw.exe
  2⤵
  PID:5972
- C:\Windows\System\XeRZFmf.exe
  C:\Windows\System\XeRZFmf.exe
  2⤵
  PID:7664
- C:\Windows\System\DBbcWcA.exe
  C:\Windows\System\DBbcWcA.exe
  2⤵
  PID:10080
- C:\Windows\System\ctIAPqK.exe
  C:\Windows\System\ctIAPqK.exe
  2⤵
  PID:10108
- C:\Windows\System\YbhwXkQ.exe
  C:\Windows\System\YbhwXkQ.exe
  2⤵
  PID:10184
- C:\Windows\System\DKvuMEJ.exe
  C:\Windows\System\DKvuMEJ.exe
  2⤵
  PID:6124
- C:\Windows\System\pYthMbO.exe
  C:\Windows\System\pYthMbO.exe
  2⤵
  PID:7684
- C:\Windows\System\Ekanahh.exe
  C:\Windows\System\Ekanahh.exe
  2⤵
  PID:8236
- C:\Windows\System\ebHnhgS.exe
  C:\Windows\System\ebHnhgS.exe
  2⤵
  PID:8292
- C:\Windows\System\eDGzEZi.exe
  C:\Windows\System\eDGzEZi.exe
  2⤵
  PID:7804
- C:\Windows\System\DaANChL.exe
  C:\Windows\System\DaANChL.exe
  2⤵
  PID:6024
- C:\Windows\System\jsvjvYj.exe
  C:\Windows\System\jsvjvYj.exe
  2⤵
  PID:12292
- C:\Windows\System\brmvPHf.exe
  C:\Windows\System\brmvPHf.exe
  2⤵
  PID:12312
- C:\Windows\System\lorJjAg.exe
  C:\Windows\System\lorJjAg.exe
  2⤵
  PID:12336
- C:\Windows\System\tbdAGbb.exe
  C:\Windows\System\tbdAGbb.exe
  2⤵
  PID:12356
- C:\Windows\System\AXqAVli.exe
  C:\Windows\System\AXqAVli.exe
  2⤵
  PID:12388
- C:\Windows\System\RXcmHdy.exe
  C:\Windows\System\RXcmHdy.exe
  2⤵
  PID:12412
- C:\Windows\System\KdtqEgw.exe
  C:\Windows\System\KdtqEgw.exe
  2⤵
  PID:12432
- C:\Windows\System\sOHqRDF.exe
  C:\Windows\System\sOHqRDF.exe
  2⤵
  PID:12460
- C:\Windows\System\WmUsFcU.exe
  C:\Windows\System\WmUsFcU.exe
  2⤵
  PID:12480
- C:\Windows\System\ZShbLXy.exe
  C:\Windows\System\ZShbLXy.exe
  2⤵
  PID:12496
- C:\Windows\System\jKxjIBY.exe
  C:\Windows\System\jKxjIBY.exe
  2⤵
  PID:12516
- C:\Windows\System\TFRgeGu.exe
  C:\Windows\System\TFRgeGu.exe
  2⤵
  PID:12544
- C:\Windows\System\eeqwpYh.exe
  C:\Windows\System\eeqwpYh.exe
  2⤵
  PID:12564
- C:\Windows\System\UMsiBZI.exe
  C:\Windows\System\UMsiBZI.exe
  2⤵
  PID:12592
- C:\Windows\System\uMSowEM.exe
  C:\Windows\System\uMSowEM.exe
  2⤵
  PID:12612
- C:\Windows\System\ngjIDZE.exe
  C:\Windows\System\ngjIDZE.exe
  2⤵
  PID:12632
- C:\Windows\System\rKYjHqW.exe
  C:\Windows\System\rKYjHqW.exe
  2⤵
  PID:12656
- C:\Windows\System\FaOnjPA.exe
  C:\Windows\System\FaOnjPA.exe
  2⤵
  PID:12676
- C:\Windows\System\ZkrMhNr.exe
  C:\Windows\System\ZkrMhNr.exe
  2⤵
  PID:12704
- C:\Windows\System\SEHrRSH.exe
  C:\Windows\System\SEHrRSH.exe
  2⤵
  PID:12724
- C:\Windows\System\DtCGBrS.exe
  C:\Windows\System\DtCGBrS.exe
  2⤵
  PID:12744
- C:\Windows\System\cwlzMPU.exe
  C:\Windows\System\cwlzMPU.exe
  2⤵
  PID:12764
- C:\Windows\System\dQAmyhE.exe
  C:\Windows\System\dQAmyhE.exe
  2⤵
  PID:12792
- C:\Windows\System\VoWPsfL.exe
  C:\Windows\System\VoWPsfL.exe
  2⤵
  PID:12816
- C:\Windows\System\FISAneM.exe
  C:\Windows\System\FISAneM.exe
  2⤵
  PID:12840
- C:\Windows\System\gLUAwvL.exe
  C:\Windows\System\gLUAwvL.exe
  2⤵
  PID:12860
- C:\Windows\System\YKfjyjC.exe
  C:\Windows\System\YKfjyjC.exe
  2⤵
  PID:12884
- C:\Windows\System\MBTcSTb.exe
  C:\Windows\System\MBTcSTb.exe
  2⤵
  PID:12908
- C:\Windows\System\TCFyFgS.exe
  C:\Windows\System\TCFyFgS.exe
  2⤵
  PID:12928
- C:\Windows\System\VREodrg.exe
  C:\Windows\System\VREodrg.exe
  2⤵
  PID:12952
- C:\Windows\System\Qeiduma.exe
  C:\Windows\System\Qeiduma.exe
  2⤵
  PID:12972
- C:\Windows\System\lTjdngG.exe
  C:\Windows\System\lTjdngG.exe
  2⤵
  PID:12996
- C:\Windows\System\OWprjkX.exe
  C:\Windows\System\OWprjkX.exe
  2⤵
  PID:13020
- C:\Windows\System\hkSyxvq.exe
  C:\Windows\System\hkSyxvq.exe
  2⤵
  PID:13040
- C:\Windows\System\piYZAQv.exe
  C:\Windows\System\piYZAQv.exe
  2⤵
  PID:13060
- C:\Windows\System\hezfyFu.exe
  C:\Windows\System\hezfyFu.exe
  2⤵
  PID:13084
- C:\Windows\System\gtuMcMw.exe
  C:\Windows\System\gtuMcMw.exe
  2⤵
  PID:13104
- C:\Windows\System\kKloqcM.exe
  C:\Windows\System\kKloqcM.exe
  2⤵
  PID:13124
- C:\Windows\System\IGVtynK.exe
  C:\Windows\System\IGVtynK.exe
  2⤵
  PID:13152
- C:\Windows\System\srPOTZZ.exe
  C:\Windows\System\srPOTZZ.exe
  2⤵
  PID:13176
- C:\Windows\System\PzHwkHg.exe
  C:\Windows\System\PzHwkHg.exe
  2⤵
  PID:13200
- C:\Windows\System\fCmxFOA.exe
  C:\Windows\System\fCmxFOA.exe
  2⤵
  PID:13220
- C:\Windows\System\bnquoPo.exe
  C:\Windows\System\bnquoPo.exe
  2⤵
  PID:13240
- C:\Windows\System\cEqPodu.exe
  C:\Windows\System\cEqPodu.exe
  2⤵
  PID:13260
- C:\Windows\System\MdKJlRD.exe
  C:\Windows\System\MdKJlRD.exe
  2⤵
  PID:13284
- C:\Windows\System\MfphNXd.exe
  C:\Windows\System\MfphNXd.exe
  2⤵
  PID:13308
- C:\Windows\System\gmQvNMW.exe
  C:\Windows\System\gmQvNMW.exe
  2⤵
  PID:8384
- C:\Windows\System\AYwvJag.exe
  C:\Windows\System\AYwvJag.exe
  2⤵
  PID:8596
- C:\Windows\System\bpLmHEh.exe
  C:\Windows\System\bpLmHEh.exe
  2⤵
  PID:10300
- C:\Windows\System\NofIYNJ.exe
  C:\Windows\System\NofIYNJ.exe
  2⤵
  PID:10328
- C:\Windows\System\vlBjaWM.exe
  C:\Windows\System\vlBjaWM.exe
  2⤵
  PID:7912
- C:\Windows\System\TUOGUno.exe
  C:\Windows\System\TUOGUno.exe
  2⤵
  PID:8768
- C:\Windows\System\YKOnfcQ.exe
  C:\Windows\System\YKOnfcQ.exe
  2⤵
  PID:10548
- C:\Windows\System\awHOsog.exe
  C:\Windows\System\awHOsog.exe
  2⤵
  PID:8832
- C:\Windows\System\tLaUtgF.exe
  C:\Windows\System\tLaUtgF.exe
  2⤵
  PID:8896
- C:\Windows\System\BbgpJEO.exe
  C:\Windows\System\BbgpJEO.exe
  2⤵
  PID:8976
- C:\Windows\System\EXXVWdb.exe
  C:\Windows\System\EXXVWdb.exe
  2⤵
  PID:10712
- C:\Windows\System\GNRRtNq.exe
  C:\Windows\System\GNRRtNq.exe
  2⤵
  PID:10784
- C:\Windows\System\SlJrbAv.exe
  C:\Windows\System\SlJrbAv.exe
  2⤵
  PID:9100
- C:\Windows\System\UvrEtuX.exe
  C:\Windows\System\UvrEtuX.exe
  2⤵
  PID:10896
- C:\Windows\System\EjLuGYl.exe
  C:\Windows\System\EjLuGYl.exe
  2⤵
  PID:10944
- C:\Windows\System\thMoHHk.exe
  C:\Windows\System\thMoHHk.exe
  2⤵
  PID:9144
- C:\Windows\System\SZsLUQZ.exe
  C:\Windows\System\SZsLUQZ.exe
  2⤵
  PID:9212
- C:\Windows\System\eIhdHKZ.exe
  C:\Windows\System\eIhdHKZ.exe
  2⤵
  PID:4516
- C:\Windows\System\wrolCtp.exe
  C:\Windows\System\wrolCtp.exe
  2⤵
  PID:11120
- C:\Windows\System\sgtzXRX.exe
  C:\Windows\System\sgtzXRX.exe
  2⤵
  PID:11456
- C:\Windows\System\KlgfKka.exe
  C:\Windows\System\KlgfKka.exe
  2⤵
  PID:11616
- C:\Windows\System\pLpmGvh.exe
  C:\Windows\System\pLpmGvh.exe
  2⤵
  PID:8300
- C:\Windows\System\xUJdaqc.exe
  C:\Windows\System\xUJdaqc.exe
  2⤵
  PID:13048
- C:\Windows\System\CpZFxQF.exe
  C:\Windows\System\CpZFxQF.exe
  2⤵
  PID:10808
- C:\Windows\System\VmTKkrw.exe
  C:\Windows\System\VmTKkrw.exe
  2⤵
  PID:6284
- C:\Windows\System\skyJRHZ.exe
  C:\Windows\System\skyJRHZ.exe
  2⤵
  PID:6388
- C:\Windows\System\wFMqrJP.exe
  C:\Windows\System\wFMqrJP.exe
  2⤵
  PID:11080
- C:\Windows\System\TFbDCwb.exe
  C:\Windows\System\TFbDCwb.exe
  2⤵
  PID:8088
- C:\Windows\System\fjWXGbi.exe
  C:\Windows\System\fjWXGbi.exe
  2⤵
  PID:9440
- C:\Windows\System\YacgFGW.exe
  C:\Windows\System\YacgFGW.exe
  2⤵
  PID:9704
- C:\Windows\System\aicyMKq.exe
  C:\Windows\System\aicyMKq.exe
  2⤵
  PID:9848
- C:\Windows\System\CqawMbT.exe
  C:\Windows\System\CqawMbT.exe
  2⤵
  PID:9980
- C:\Windows\System\BxGABSq.exe
  C:\Windows\System\BxGABSq.exe
  2⤵
  PID:10024
- C:\Windows\System\fGflrPg.exe
  C:\Windows\System\fGflrPg.exe
  2⤵
  PID:10136
- C:\Windows\System\JAOPkcd.exe
  C:\Windows\System\JAOPkcd.exe
  2⤵
  PID:6180
- C:\Windows\System\dRdtgKp.exe
  C:\Windows\System\dRdtgKp.exe
  2⤵
  PID:11004
- C:\Windows\System\fyMFiCf.exe
  C:\Windows\System\fyMFiCf.exe
  2⤵
  PID:8872
- C:\Windows\System\RvhBgaB.exe
  C:\Windows\System\RvhBgaB.exe
  2⤵
  PID:2116
- C:\Windows\System\zXwwCQc.exe
  C:\Windows\System\zXwwCQc.exe
  2⤵
  PID:7504
- C:\Windows\System\DHXOpwT.exe
  C:\Windows\System\DHXOpwT.exe
  2⤵
  PID:11308
- C:\Windows\System\zJZXZQS.exe
  C:\Windows\System\zJZXZQS.exe
  2⤵
  PID:11436
- C:\Windows\System\WwoxDVN.exe
  C:\Windows\System\WwoxDVN.exe
  2⤵
  PID:13412
- C:\Windows\System\jWbtlDH.exe
  C:\Windows\System\jWbtlDH.exe
  2⤵
  PID:9452
- C:\Windows\System\iHPOKuw.exe
  C:\Windows\System\iHPOKuw.exe
  2⤵
  PID:12208
- C:\Windows\System\WXgXnXQ.exe
  C:\Windows\System\WXgXnXQ.exe
  2⤵
  PID:12124
- C:\Windows\System\uTGSqcg.exe
  C:\Windows\System\uTGSqcg.exe
  2⤵
  PID:12076
- C:\Windows\System\BExABwg.exe
  C:\Windows\System\BExABwg.exe
  2⤵
  PID:12608
- C:\Windows\System\CXyltAM.exe
  C:\Windows\System\CXyltAM.exe
  2⤵
  PID:12672
- C:\Windows\System\tXpMIYP.exe
  C:\Windows\System\tXpMIYP.exe
  2⤵
  PID:13904
- C:\Windows\System\GOBVFYj.exe
  C:\Windows\System\GOBVFYj.exe
  2⤵
  PID:14032
- C:\Windows\System\hqHPhgT.exe
  C:\Windows\System\hqHPhgT.exe
  2⤵
  PID:13676
- C:\Windows\System\kNLGyTe.exe
  C:\Windows\System\kNLGyTe.exe
  2⤵
  PID:8452
- C:\Windows\System\qKlLKrj.exe
  C:\Windows\System\qKlLKrj.exe
  2⤵
  PID:4304
- C:\Windows\System\gEcfGjO.exe
  C:\Windows\System\gEcfGjO.exe
  2⤵
  PID:10444
- C:\Windows\System\DsjwqlG.exe
  C:\Windows\System\DsjwqlG.exe
  2⤵
  PID:12960
- C:\Windows\System\AalBuao.exe
  C:\Windows\System\AalBuao.exe
  2⤵
  PID:10068
- C:\Windows\System\HdtKmgd.exe
  C:\Windows\System\HdtKmgd.exe
  2⤵
  PID:7528
- C:\Windows\System\QAkVLLA.exe
  C:\Windows\System\QAkVLLA.exe
  2⤵
  PID:9568
- C:\Windows\System\nOSmBzU.exe
  C:\Windows\System\nOSmBzU.exe
  2⤵
  PID:13492
- C:\Windows\System\IwUbVkU.exe
  C:\Windows\System\IwUbVkU.exe
  2⤵
  PID:9000
- C:\Windows\System\VTkIghH.exe
  C:\Windows\System\VTkIghH.exe
  2⤵
  PID:8804
- C:\Windows\System\OzpLsad.exe
  C:\Windows\System\OzpLsad.exe
  2⤵
  PID:9328
- C:\Windows\System\YgDacfP.exe
  C:\Windows\System\YgDacfP.exe
  2⤵
  PID:9656
- C:\Windows\System\VBbCOpn.exe
  C:\Windows\System\VBbCOpn.exe
  2⤵
  PID:8860
- C:\Windows\System\eVpdJdn.exe
  C:\Windows\System\eVpdJdn.exe
  2⤵
  PID:12424
- C:\Windows\System\YeWcDYu.exe
  C:\Windows\System\YeWcDYu.exe
  2⤵
  PID:9756
- C:\Windows\System\UOpwCIE.exe
  C:\Windows\System\UOpwCIE.exe
  2⤵
  PID:13096
- C:\Windows\System\AslBTye.exe
  C:\Windows\System\AslBTye.exe
  2⤵
  PID:10780
- C:\Windows\System\KRqZhaa.exe
  C:\Windows\System\KRqZhaa.exe
  2⤵
  PID:10820
- C:\Windows\System\MvWmoGW.exe
  C:\Windows\System\MvWmoGW.exe
  2⤵
  PID:13548
- C:\Windows\System\VJLaVYx.exe
  C:\Windows\System\VJLaVYx.exe
  2⤵
  PID:13460
- C:\Windows\System\iUMyVlS.exe
  C:\Windows\System\iUMyVlS.exe
  2⤵
  PID:12092
- C:\Windows\System\ePbEEzH.exe
  C:\Windows\System\ePbEEzH.exe
  2⤵
  PID:5008
- C:\Windows\System\UHxZXUv.exe
  C:\Windows\System\UHxZXUv.exe
  2⤵
  PID:10508
- C:\Windows\System\IiogpWW.exe
  C:\Windows\System\IiogpWW.exe
  2⤵
  PID:10560
- C:\Windows\System\GtOrOZy.exe
  C:\Windows\System\GtOrOZy.exe
  2⤵
  PID:8848
- C:\Windows\System\peIMmrH.exe
  C:\Windows\System\peIMmrH.exe
  2⤵
  PID:8704
- C:\Windows\System\uBelWxK.exe
  C:\Windows\System\uBelWxK.exe
  2⤵
  PID:9140
- C:\Windows\System\lKKDJQN.exe
  C:\Windows\System\lKKDJQN.exe
  2⤵
  PID:9240
- C:\Windows\System\eCNwvge.exe
  C:\Windows\System\eCNwvge.exe
  2⤵
  PID:10888
- C:\Windows\System\uwHuLnc.exe
  C:\Windows\System\uwHuLnc.exe
  2⤵
  PID:9800
- C:\Windows\System\SNpMscc.exe
  C:\Windows\System\SNpMscc.exe
  2⤵
  PID:9636
- C:\Windows\System\mBqUVpz.exe
  C:\Windows\System\mBqUVpz.exe
  2⤵
  PID:14104
- C:\Windows\System\FncSbIt.exe
  C:\Windows\System\FncSbIt.exe
  2⤵
  PID:9716
- C:\Windows\System\UuoJeuj.exe
  C:\Windows\System\UuoJeuj.exe
  2⤵
  PID:12364
- C:\Windows\System\yijkmdk.exe
  C:\Windows\System\yijkmdk.exe
  2⤵
  PID:10044
- C:\Windows\System\IdblCqQ.exe
  C:\Windows\System\IdblCqQ.exe
  2⤵
  PID:8140
- C:\Windows\System\ICilsOH.exe
  C:\Windows\System\ICilsOH.exe
  2⤵
  PID:12652
- C:\Windows\System\WMnzrln.exe
  C:\Windows\System\WMnzrln.exe
  2⤵
  PID:10264
- C:\Windows\System\QblZZct.exe
  C:\Windows\System\QblZZct.exe
  2⤵
  PID:10908
- C:\Windows\System\OvBtjZn.exe
  C:\Windows\System\OvBtjZn.exe
  2⤵
  PID:14088
- C:\Windows\System\qBPigYO.exe
  C:\Windows\System\qBPigYO.exe
  2⤵
  PID:9488
- C:\Windows\System\YsKUlyS.exe
  C:\Windows\System\YsKUlyS.exe
  2⤵
  PID:9796
- C:\Windows\System\RIjzvFa.exe
  C:\Windows\System\RIjzvFa.exe
  2⤵
  PID:12304
- C:\Windows\System\nznsnkQ.exe
  C:\Windows\System\nznsnkQ.exe
  2⤵
  PID:11652
- C:\Windows\System\KgIACkR.exe
  C:\Windows\System\KgIACkR.exe
  2⤵
  PID:9780
- C:\Windows\System\ITTERyj.exe
  C:\Windows\System\ITTERyj.exe
  2⤵
  PID:10912
- C:\Windows\System\ffIkzjX.exe
  C:\Windows\System\ffIkzjX.exe
  2⤵
  PID:14156
- C:\Windows\System\yAXvTCi.exe
  C:\Windows\System\yAXvTCi.exe
  2⤵
  PID:11096
- C:\Windows\System\XbQHnrv.exe
  C:\Windows\System\XbQHnrv.exe
  2⤵
  PID:8528
- C:\Windows\System\KAjJbKt.exe
  C:\Windows\System\KAjJbKt.exe
  2⤵
  PID:13196
- C:\Windows\System\cqZuffs.exe
  C:\Windows\System\cqZuffs.exe
  2⤵
  PID:9692
- C:\Windows\System\UXkXFwH.exe
  C:\Windows\System\UXkXFwH.exe
  2⤵
  PID:14168
- C:\Windows\System\rrMOFMe.exe
  C:\Windows\System\rrMOFMe.exe
  2⤵
  PID:14244
- C:\Windows\System\NWPcxti.exe
  C:\Windows\System\NWPcxti.exe
  2⤵
  PID:12372
- C:\Windows\System\XguASNj.exe
  C:\Windows\System\XguASNj.exe
  2⤵
  PID:11172
- C:\Windows\System\gwbmknj.exe
  C:\Windows\System\gwbmknj.exe
  2⤵
  PID:7892
- C:\Windows\System\GRiofZD.exe
  C:\Windows\System\GRiofZD.exe
  2⤵
  PID:9276
- C:\Windows\System\tsbykxT.exe
  C:\Windows\System\tsbykxT.exe
  2⤵
  PID:8656
- C:\Windows\System\HDoRZSL.exe
  C:\Windows\System\HDoRZSL.exe
  2⤵
  PID:6552
- C:\Windows\System\qTBQuBi.exe
  C:\Windows\System\qTBQuBi.exe
  2⤵
  PID:7244
- C:\Windows\System\TJfgFUL.exe
  C:\Windows\System\TJfgFUL.exe
  2⤵
  PID:7704
- C:\Windows\System\GhaQPPh.exe
  C:\Windows\System\GhaQPPh.exe
  2⤵
  PID:13372
- C:\Windows\System\VHncPEo.exe
  C:\Windows\System\VHncPEo.exe
  2⤵
  PID:4068
- C:\Windows\System\DrKKdRt.exe
  C:\Windows\System\DrKKdRt.exe
  2⤵
  PID:12644
- C:\Windows\System\xTQdDCJ.exe
  C:\Windows\System\xTQdDCJ.exe
  2⤵
  PID:14200
- C:\Windows\System\sGDWzKk.exe
  C:\Windows\System\sGDWzKk.exe
  2⤵
  PID:10644
- C:\Windows\System\ZeHmawD.exe
  C:\Windows\System\ZeHmawD.exe
  2⤵
  PID:14128
- C:\Windows\System\EEHhHbD.exe
  C:\Windows\System\EEHhHbD.exe
  2⤵
  PID:5144
- C:\Windows\System\GrRUoTA.exe
  C:\Windows\System\GrRUoTA.exe
  2⤵
  PID:8828
- C:\Windows\System\YzBuPLr.exe
  C:\Windows\System\YzBuPLr.exe
  2⤵
  PID:8172
- C:\Windows\System\LSptNaz.exe
  C:\Windows\System\LSptNaz.exe
  2⤵
  PID:11768
- C:\Windows\System\SKIBNrE.exe
  C:\Windows\System\SKIBNrE.exe
  2⤵
  PID:2420
- C:\Windows\System\NgmURdQ.exe
  C:\Windows\System\NgmURdQ.exe
  2⤵
  PID:12880
- C:\Windows\System\RwLSPIJ.exe
  C:\Windows\System\RwLSPIJ.exe
  2⤵
  PID:13680
- C:\Windows\System\omkWjsR.exe
  C:\Windows\System\omkWjsR.exe
  2⤵
  PID:11900
- C:\Windows\System\zGLxbpb.exe
  C:\Windows\System\zGLxbpb.exe
  2⤵
  PID:11960
- C:\Windows\System\EGVEYsZ.exe
  C:\Windows\System\EGVEYsZ.exe
  2⤵
  PID:11868
- C:\Windows\System\CbYacef.exe
  C:\Windows\System\CbYacef.exe
  2⤵
  PID:8488
- C:\Windows\System\zcKUhWK.exe
  C:\Windows\System\zcKUhWK.exe
  2⤵
  PID:11808
- C:\Windows\System\ESBDCcJ.exe
  C:\Windows\System\ESBDCcJ.exe
  2⤵
  PID:4792
- C:\Windows\System\stocZmU.exe
  C:\Windows\System\stocZmU.exe
  2⤵
  PID:9652
- C:\Windows\System\cAQEzHz.exe
  C:\Windows\System\cAQEzHz.exe
  2⤵
  PID:2312
- C:\Windows\System\hzNJMeh.exe
  C:\Windows\System\hzNJMeh.exe
  2⤵
  PID:11100
- C:\Windows\System\HxMLNjl.exe
  C:\Windows\System\HxMLNjl.exe
  2⤵
  PID:12488
- C:\Windows\System\zsEzLKa.exe
  C:\Windows\System\zsEzLKa.exe
  2⤵
  PID:2124
- C:\Windows\System\EjqWCbN.exe
  C:\Windows\System\EjqWCbN.exe
  2⤵
  PID:7608
- C:\Windows\System\BCmCKyn.exe
  C:\Windows\System\BCmCKyn.exe
  2⤵
  PID:11356
- C:\Windows\System\wkWqQSa.exe
  C:\Windows\System\wkWqQSa.exe
  2⤵
  PID:13520
- C:\Windows\System\mjfUklm.exe
  C:\Windows\System\mjfUklm.exe
  2⤵
  PID:10244
- C:\Windows\System\QiTBOSY.exe
  C:\Windows\System\QiTBOSY.exe
  2⤵
  PID:11532
- C:\Windows\System\qcfIYby.exe
  C:\Windows\System\qcfIYby.exe
  2⤵
  PID:14004
- C:\Windows\System\WgYVzeU.exe
  C:\Windows\System\WgYVzeU.exe
  2⤵
  PID:10484
- C:\Windows\System\ZPQDtGy.exe
  C:\Windows\System\ZPQDtGy.exe
  2⤵
  PID:2472
- C:\Windows\System\LpUkEtO.exe
  C:\Windows\System\LpUkEtO.exe
  2⤵
  PID:3360
- C:\Windows\System\sUlrsvv.exe
  C:\Windows\System\sUlrsvv.exe
  2⤵
  PID:13076
- C:\Windows\System\SExRYUn.exe
  C:\Windows\System\SExRYUn.exe
  2⤵
  PID:11940
- C:\Windows\System\Dvfifpu.exe
  C:\Windows\System\Dvfifpu.exe
  2⤵
  PID:13488
- C:\Windows\System\awhcAkU.exe
  C:\Windows\System\awhcAkU.exe
  2⤵
  PID:11312
- C:\Windows\System\bTabqMX.exe
  C:\Windows\System\bTabqMX.exe
  2⤵
  PID:13716
- C:\Windows\System\QhCfIEy.exe
  C:\Windows\System\QhCfIEy.exe
  2⤵
  PID:7560
- C:\Windows\System\bGZNEca.exe
  C:\Windows\System\bGZNEca.exe
  2⤵
  PID:11788
- C:\Windows\System\MkBbDYp.exe
  C:\Windows\System\MkBbDYp.exe
  2⤵
  PID:10216
- C:\Windows\System\aEvhdtb.exe
  C:\Windows\System\aEvhdtb.exe
  2⤵
  PID:12560
- C:\Windows\System\gNPxCTh.exe
  C:\Windows\System\gNPxCTh.exe
  2⤵
  PID:9220
- C:\Windows\System\pDXpyTw.exe
  C:\Windows\System\pDXpyTw.exe
  2⤵
  PID:10428
- C:\Windows\System\GQOsnnb.exe
  C:\Windows\System\GQOsnnb.exe
  2⤵
  PID:9032
- C:\Windows\System\bSPRfDF.exe
  C:\Windows\System\bSPRfDF.exe
  2⤵
  PID:11904
- C:\Windows\System\pmrBHMu.exe
  C:\Windows\System\pmrBHMu.exe
  2⤵
  PID:13872
- C:\Windows\System\srLPSSY.exe
  C:\Windows\System\srLPSSY.exe
  2⤵
  PID:10940
- C:\Windows\System\RWORsCa.exe
  C:\Windows\System\RWORsCa.exe
  2⤵
  PID:9804
- C:\Windows\System\KLEnFVb.exe
  C:\Windows\System\KLEnFVb.exe
  2⤵
  PID:13072
- C:\Windows\System\RjKkQhI.exe
  C:\Windows\System\RjKkQhI.exe
  2⤵
  PID:4948
- C:\Windows\System\GlFVvGY.exe
  C:\Windows\System\GlFVvGY.exe
  2⤵
  PID:10656
- C:\Windows\System\uustKLR.exe
  C:\Windows\System\uustKLR.exe
  2⤵
  PID:7004
- C:\Windows\System\pDcJzqK.exe
  C:\Windows\System\pDcJzqK.exe
  2⤵
  PID:13968
- C:\Windows\System\varvLQj.exe
  C:\Windows\System\varvLQj.exe
  2⤵
  PID:1624
- C:\Windows\System\XdtnQgJ.exe
  C:\Windows\System\XdtnQgJ.exe
  2⤵
  PID:12380
- C:\Windows\System\tADhPvF.exe
  C:\Windows\System\tADhPvF.exe
  2⤵
  PID:3444
- C:\Windows\System\NqtkuDa.exe
  C:\Windows\System\NqtkuDa.exe
  2⤵
  PID:10156
- C:\Windows\System\cNzKuhz.exe
  C:\Windows\System\cNzKuhz.exe
  2⤵
  PID:5944
- C:\Windows\System\KYwRRFN.exe
  C:\Windows\System\KYwRRFN.exe
  2⤵
  PID:11492
- C:\Windows\System\CnLBmHX.exe
  C:\Windows\System\CnLBmHX.exe
  2⤵
  PID:13420
- C:\Windows\System\GkMSOCE.exe
  C:\Windows\System\GkMSOCE.exe
  2⤵
  PID:13988
- C:\Windows\System\UScGQkW.exe
  C:\Windows\System\UScGQkW.exe
  2⤵
  PID:7120
- C:\Windows\System\BNEUsiL.exe
  C:\Windows\System\BNEUsiL.exe
  2⤵
  PID:10460
- C:\Windows\System\xzLzVlS.exe
  C:\Windows\System\xzLzVlS.exe
  2⤵
  PID:13596
- C:\Windows\System\vFOkoOv.exe
  C:\Windows\System\vFOkoOv.exe
  2⤵
  PID:3992
- C:\Windows\System\iXBJbiF.exe
  C:\Windows\System\iXBJbiF.exe
  2⤵
  PID:3096
- C:\Windows\System\iMEflvW.exe
  C:\Windows\System\iMEflvW.exe
  2⤵
  PID:13132
- C:\Windows\System\heuDWID.exe
  C:\Windows\System\heuDWID.exe
  2⤵
  PID:8964
- C:\Windows\System\YIndmdV.exe
  C:\Windows\System\YIndmdV.exe
  2⤵
  PID:14292
- C:\Windows\System\sEADcBW.exe
  C:\Windows\System\sEADcBW.exe
  2⤵
  PID:4524
- C:\Windows\System\zlOJJiz.exe
  C:\Windows\System\zlOJJiz.exe
  2⤵
  PID:4956
- C:\Windows\System\yvYylsa.exe
  C:\Windows\System\yvYylsa.exe
  2⤵
  PID:9840
- C:\Windows\System\TxdcvlE.exe
  C:\Windows\System\TxdcvlE.exe
  2⤵
  PID:3940
- C:\Windows\System\OQCDxna.exe
  C:\Windows\System\OQCDxna.exe
  2⤵
  PID:13976
- C:\Windows\System\cZnbsRD.exe
  C:\Windows\System\cZnbsRD.exe
  2⤵
  PID:11416
- C:\Windows\System\WeavxIb.exe
  C:\Windows\System\WeavxIb.exe
  2⤵
  PID:2376
- C:\Windows\System\oUragnK.exe
  C:\Windows\System\oUragnK.exe
  2⤵
  PID:1924
- C:\Windows\System\GeyStTc.exe
  C:\Windows\System\GeyStTc.exe
  2⤵
  PID:14048
- C:\Windows\System\MWSPBUh.exe
  C:\Windows\System\MWSPBUh.exe
  2⤵
  PID:1960
- C:\Windows\System\LdrrUGo.exe
  C:\Windows\System\LdrrUGo.exe
  2⤵
  PID:13164
- C:\Windows\System\QkAYDip.exe
  C:\Windows\System\QkAYDip.exe
  2⤵
  PID:4020
- C:\Windows\System\aTFLffu.exe
  C:\Windows\System\aTFLffu.exe
  2⤵
  PID:4484
- C:\Windows\System\eUwIraw.exe
  C:\Windows\System\eUwIraw.exe
  2⤵
  PID:1132
- C:\Windows\System\eReHwvZ.exe
  C:\Windows\System\eReHwvZ.exe
  2⤵
  PID:1968
- C:\Windows\System\GPNFCdt.exe
  C:\Windows\System\GPNFCdt.exe
  2⤵
  PID:10960
- C:\Windows\System\ZnWOWQN.exe
  C:\Windows\System\ZnWOWQN.exe
  2⤵
  PID:11748
- C:\Windows\System\EoFQBDB.exe
  C:\Windows\System\EoFQBDB.exe
  2⤵
  PID:13500
- C:\Windows\System\DmygCzX.exe
  C:\Windows\System\DmygCzX.exe
  2⤵
  PID:2528
- C:\Windows\System\HvTTBrK.exe
  C:\Windows\System\HvTTBrK.exe
  2⤵
  PID:696
- C:\Windows\System\uQUwGNp.exe
  C:\Windows\System\uQUwGNp.exe
  2⤵
  PID:3280
- C:\Windows\System\rVslGQL.exe
  C:\Windows\System\rVslGQL.exe
  2⤵
  PID:12600
- C:\Windows\System\rRDNhCo.exe
  C:\Windows\System\rRDNhCo.exe
  2⤵
  PID:448
- C:\Windows\System\lXnVzGL.exe
  C:\Windows\System\lXnVzGL.exe
  2⤵
  PID:11252
- C:\Windows\System\AlDztAm.exe
  C:\Windows\System\AlDztAm.exe
  2⤵
  PID:552
- C:\Windows\System\yAjqsKf.exe
  C:\Windows\System\yAjqsKf.exe
  2⤵
  PID:2640
- C:\Windows\System\McEjYvo.exe
  C:\Windows\System\McEjYvo.exe
  2⤵
  PID:6068
- C:\Windows\System\hmizlLq.exe
  C:\Windows\System\hmizlLq.exe
  2⤵
  PID:2880
- C:\Windows\System\PmNxWQF.exe
  C:\Windows\System\PmNxWQF.exe
  2⤵
  PID:5060
- C:\Windows\System\EfRBonH.exe
  C:\Windows\System\EfRBonH.exe
  2⤵
  PID:4688
- C:\Windows\System\vQSDVJs.exe
  C:\Windows\System\vQSDVJs.exe
  2⤵
  PID:3424
- C:\Windows\System\PMQLQkj.exe
  C:\Windows\System\PMQLQkj.exe
  2⤵
  PID:2344
- C:\Windows\System\yRqrZBw.exe
  C:\Windows\System\yRqrZBw.exe
  2⤵
  PID:5628
- C:\Windows\System\opUcWDC.exe
  C:\Windows\System\opUcWDC.exe
  2⤵
  PID:13480
- C:\Windows\System\ZYkNWXB.exe
  C:\Windows\System\ZYkNWXB.exe
  2⤵
  PID:14356
- C:\Windows\System\nhQGlrj.exe
  C:\Windows\System\nhQGlrj.exe
  2⤵
  PID:14384
- C:\Windows\System\fJOaGkW.exe
  C:\Windows\System\fJOaGkW.exe
  2⤵
  PID:14448
- C:\Windows\System\LnjpFWT.exe
  C:\Windows\System\LnjpFWT.exe
  2⤵
  PID:14488
- C:\Windows\System\XqayewG.exe
  C:\Windows\System\XqayewG.exe
  2⤵
  PID:14548
- C:\Windows\System\zhtUXTT.exe
  C:\Windows\System\zhtUXTT.exe
  2⤵
  PID:14576
- C:\Windows\System\vLCblla.exe
  C:\Windows\System\vLCblla.exe
  2⤵
  PID:14696
- C:\Windows\System\oVQCcVW.exe
  C:\Windows\System\oVQCcVW.exe
  2⤵
  PID:14768
- C:\Windows\System\XWVGqGp.exe
  C:\Windows\System\XWVGqGp.exe
  2⤵
  PID:14792
- C:\Windows\System\ErkHKYW.exe
  C:\Windows\System\ErkHKYW.exe
  2⤵
  PID:14812
- C:\Windows\System\cPPNboA.exe
  C:\Windows\System\cPPNboA.exe
  2⤵
  PID:14832
- C:\Windows\System\zqqKhAA.exe
  C:\Windows\System\zqqKhAA.exe
  2⤵
  PID:14860
- C:\Windows\System\gZZiBrW.exe
  C:\Windows\System\gZZiBrW.exe
  2⤵
  PID:14896
- C:\Windows\System\aXRlPRI.exe
  C:\Windows\System\aXRlPRI.exe
  2⤵
  PID:14916
- C:\Windows\System\JiANtsS.exe
  C:\Windows\System\JiANtsS.exe
  2⤵
  PID:14944
- C:\Windows\System\yIGdbDE.exe
  C:\Windows\System\yIGdbDE.exe
  2⤵
  PID:14972
- C:\Windows\System\UNhFmvP.exe
  C:\Windows\System\UNhFmvP.exe
  2⤵
  PID:15000
- C:\Windows\System\yubsAVC.exe
  C:\Windows\System\yubsAVC.exe
  2⤵
  PID:15032
- C:\Windows\System\azJkyYy.exe
  C:\Windows\System\azJkyYy.exe
  2⤵
  PID:15116
- C:\Windows\System\GIaAeMl.exe
  C:\Windows\System\GIaAeMl.exe
  2⤵
  PID:15144
- C:\Windows\System\RxXfmAa.exe
  C:\Windows\System\RxXfmAa.exe
  2⤵
  PID:15208
- C:\Windows\System\lTdlIvx.exe
  C:\Windows\System\lTdlIvx.exe
  2⤵
  PID:15312
- C:\Windows\System\avKMVYY.exe
  C:\Windows\System\avKMVYY.exe
  2⤵
  PID:15332
- C:\Windows\System\ECkoCNy.exe
  C:\Windows\System\ECkoCNy.exe
  2⤵
  PID:928
- C:\Windows\System\rnYtLqU.exe
  C:\Windows\System\rnYtLqU.exe
  2⤵
  PID:3148
- C:\Windows\System\oBOjlRe.exe
  C:\Windows\System\oBOjlRe.exe
  2⤵
  PID:14412
- C:\Windows\System\YgBpuFT.exe
  C:\Windows\System\YgBpuFT.exe
  2⤵
  PID:14424
- C:\Windows\System\fIZLgWi.exe
  C:\Windows\System\fIZLgWi.exe
  2⤵
  PID:1008
- C:\Windows\System\HWQkDcl.exe
  C:\Windows\System\HWQkDcl.exe
  2⤵
  PID:14588
- C:\Windows\System\BCfMSHU.exe
  C:\Windows\System\BCfMSHU.exe
  2⤵
  PID:14608
- C:\Windows\System\SSaqzdl.exe
  C:\Windows\System\SSaqzdl.exe
  2⤵
  PID:14636
- C:\Windows\System\SlWxKDt.exe
  C:\Windows\System\SlWxKDt.exe
  2⤵
  PID:5508
- C:\Windows\System\voRLrJx.exe
  C:\Windows\System\voRLrJx.exe
  2⤵
  PID:4476
- C:\Windows\System\RYVOeVL.exe
  C:\Windows\System\RYVOeVL.exe
  2⤵
  PID:14752
- C:\Windows\System\cPvegzp.exe
  C:\Windows\System\cPvegzp.exe
  2⤵
  PID:14756
- C:\Windows\System\CWzJydk.exe
  C:\Windows\System\CWzJydk.exe
  2⤵
  PID:5488
- C:\Windows\System\cCKvrWF.exe
  C:\Windows\System\cCKvrWF.exe
  2⤵
  PID:14828
- C:\Windows\System\cbVluNf.exe
  C:\Windows\System\cbVluNf.exe
  2⤵
  PID:15060
- C:\Windows\System\EbNfSuQ.exe
  C:\Windows\System\EbNfSuQ.exe
  2⤵
  PID:15024
- C:\Windows\System\jqOIwst.exe
  C:\Windows\System\jqOIwst.exe
  2⤵
  PID:15096
- C:\Windows\System\kvYCsmd.exe
  C:\Windows\System\kvYCsmd.exe
  2⤵
  PID:15180
- C:\Windows\System\mRTMpTp.exe
  C:\Windows\System\mRTMpTp.exe
  2⤵
  PID:4320
- C:\Windows\System\uTaAzxg.exe
  C:\Windows\System\uTaAzxg.exe
  2⤵
  PID:2064
- C:\Windows\System\kXiawnI.exe
  C:\Windows\System\kXiawnI.exe
  2⤵
  PID:15216
- C:\Windows\System\lNDSpqp.exe
  C:\Windows\System\lNDSpqp.exe
  2⤵
  PID:2944
- C:\Windows\System\LqubUxF.exe
  C:\Windows\System\LqubUxF.exe
  2⤵
  PID:15224
- C:\Windows\System\udsBvsb.exe
  C:\Windows\System\udsBvsb.exe
  2⤵
  PID:15340
- C:\Windows\System\KcALxZi.exe
  C:\Windows\System\KcALxZi.exe
  2⤵
  PID:3440
- C:\Windows\System\jdcyFhb.exe
  C:\Windows\System\jdcyFhb.exe
  2⤵
  PID:14404
- C:\Windows\System\BNwjJgZ.exe
  C:\Windows\System\BNwjJgZ.exe
  2⤵
  PID:1248
- C:\Windows\System\sFOQrNv.exe
  C:\Windows\System\sFOQrNv.exe
  2⤵
  PID:5504
- C:\Windows\System\DptYbuI.exe
  C:\Windows\System\DptYbuI.exe
  2⤵
  PID:772
- C:\Windows\System\zTbydKW.exe
  C:\Windows\System\zTbydKW.exe
  2⤵
  PID:14508
- C:\Windows\System\afwQIDE.exe
  C:\Windows\System\afwQIDE.exe
  2⤵
  PID:14572
- C:\Windows\System\iWFWIJF.exe
  C:\Windows\System\iWFWIJF.exe
  2⤵
  PID:5668
- C:\Windows\System\BJgYdeU.exe
  C:\Windows\System\BJgYdeU.exe
  2⤵
  PID:6376
- C:\Windows\System\cBvEGEX.exe
  C:\Windows\System\cBvEGEX.exe
  2⤵
  PID:14652
- C:\Windows\System\lzqVRFb.exe
  C:\Windows\System\lzqVRFb.exe
  2⤵
  PID:5952
- C:\Windows\System\NExdUZL.exe
  C:\Windows\System\NExdUZL.exe
  2⤵
  PID:15248
- C:\Windows\System\jPNgVQs.exe
  C:\Windows\System\jPNgVQs.exe
  2⤵
  PID:15156
- C:\Windows\System\dbJUpvU.exe
  C:\Windows\System\dbJUpvU.exe
  2⤵
  PID:5432
- C:\Windows\System\ZoyvRKQ.exe
  C:\Windows\System\ZoyvRKQ.exe
  2⤵
  PID:2668
- C:\Windows\System\pGDmAxs.exe
  C:\Windows\System\pGDmAxs.exe
  2⤵
  PID:2408
- C:\Windows\System\lZcPfpC.exe
  C:\Windows\System\lZcPfpC.exe
  2⤵
  PID:5580
- C:\Windows\System\malvUOY.exe
  C:\Windows\System\malvUOY.exe
  2⤵
  PID:4896
- C:\Windows\System\EaHmrVj.exe
  C:\Windows\System\EaHmrVj.exe
  2⤵
  PID:6260
- C:\Windows\System\PtABWfE.exe
  C:\Windows\System\PtABWfE.exe
  2⤵
  PID:14704
- C:\Windows\System\hBVZgpS.exe
  C:\Windows\System\hBVZgpS.exe
  2⤵
  PID:7400
- C:\Windows\System\PPUqjgB.exe
  C:\Windows\System\PPUqjgB.exe
  2⤵
  PID:6452
- C:\Windows\System\oRYpXpa.exe
  C:\Windows\System\oRYpXpa.exe
  2⤵
  PID:14820
- C:\Windows\System\hDlkzby.exe
  C:\Windows\System\hDlkzby.exe
  2⤵
  PID:15088
- C:\Windows\System\AFaziwr.exe
  C:\Windows\System\AFaziwr.exe
  2⤵
  PID:6576
- C:\Windows\System\xPaFWQj.exe
  C:\Windows\System\xPaFWQj.exe
  2⤵
  PID:15104
- C:\Windows\System\jmeanGA.exe
  C:\Windows\System\jmeanGA.exe
  2⤵
  PID:15016
- C:\Windows\System\AMCzabt.exe
  C:\Windows\System\AMCzabt.exe
  2⤵
  PID:3656
- C:\Windows\System\mKvizhe.exe
  C:\Windows\System\mKvizhe.exe
  2⤵
  PID:15292
- C:\Windows\System\LldfOrt.exe
  C:\Windows\System\LldfOrt.exe
  2⤵
  PID:7136
- C:\Windows\System\VJrnAZK.exe
  C:\Windows\System\VJrnAZK.exe
  2⤵
  PID:14352
- C:\Windows\System\TxxmEPq.exe
  C:\Windows\System\TxxmEPq.exe
  2⤵
  PID:6220
- C:\Windows\System\xbytzUn.exe
  C:\Windows\System\xbytzUn.exe
  2⤵
  PID:3620
- C:\Windows\System\MUbaVLm.exe
  C:\Windows\System\MUbaVLm.exe
  2⤵
  PID:5676
- C:\Windows\System\ZVhqpOm.exe
  C:\Windows\System\ZVhqpOm.exe
  2⤵
  PID:3688
- C:\Windows\System\wCZtITU.exe
  C:\Windows\System\wCZtITU.exe
  2⤵
  PID:14732
- C:\Windows\System\KFVdvaT.exe
  C:\Windows\System\KFVdvaT.exe
  2⤵
  PID:9760
- C:\Windows\System\HWziFgf.exe
  C:\Windows\System\HWziFgf.exe
  2⤵
  PID:5928
- C:\Windows\System\KtaOgKV.exe
  C:\Windows\System\KtaOgKV.exe
  2⤵
  PID:14932
- C:\Windows\System\nRLQANQ.exe
  C:\Windows\System\nRLQANQ.exe
  2⤵
  PID:9896
- C:\Windows\System\jgjTcbW.exe
  C:\Windows\System\jgjTcbW.exe
  2⤵
  PID:15276
- C:\Windows\System\EbkWwne.exe
  C:\Windows\System\EbkWwne.exe
  2⤵
  PID:9908
- C:\Windows\System\RadghHZ.exe
  C:\Windows\System\RadghHZ.exe
  2⤵
  PID:7312
- C:\Windows\System\KAwCrdC.exe
  C:\Windows\System\KAwCrdC.exe
  2⤵
  PID:7384
- C:\Windows\System\JqAKaVi.exe
  C:\Windows\System\JqAKaVi.exe
  2⤵
  PID:7572
- C:\Windows\System\UekDCFn.exe
  C:\Windows\System\UekDCFn.exe
  2⤵
  PID:5624
- C:\Windows\System\yBSaOBS.exe
  C:\Windows\System\yBSaOBS.exe
  2⤵
  PID:7512
- C:\Windows\System\ypcOSGa.exe
  C:\Windows\System\ypcOSGa.exe
  2⤵
  PID:7776
- C:\Windows\System\iObzBai.exe
  C:\Windows\System\iObzBai.exe
  2⤵
  PID:9288
- C:\Windows\System\RIIlfVe.exe
  C:\Windows\System\RIIlfVe.exe
  2⤵
  PID:14856
- C:\Windows\System\VdExxda.exe
  C:\Windows\System\VdExxda.exe
  2⤵
  PID:6616
- C:\Windows\System\JYJOLge.exe
  C:\Windows\System\JYJOLge.exe
  2⤵
  PID:8484
- C:\Windows\System\NryHJie.exe
  C:\Windows\System\NryHJie.exe
  2⤵
  PID:14888
- C:\Windows\System\AJPfOrV.exe
  C:\Windows\System\AJPfOrV.exe
  2⤵
  PID:5956
- C:\Windows\System\sqaRKYr.exe
  C:\Windows\System\sqaRKYr.exe
  2⤵
  PID:15108
- C:\Windows\System\yakWDUI.exe
  C:\Windows\System\yakWDUI.exe
  2⤵
  PID:10116
- C:\Windows\System\NlvYpbj.exe
  C:\Windows\System\NlvYpbj.exe
  2⤵
  PID:14456
- C:\Windows\System\jlGftZZ.exe
  C:\Windows\System\jlGftZZ.exe
  2⤵
  PID:8824
- C:\Windows\System\PiJpQxb.exe
  C:\Windows\System\PiJpQxb.exe
  2⤵
  PID:14432
- C:\Windows\System\FNfSbJJ.exe
  C:\Windows\System\FNfSbJJ.exe
  2⤵
  PID:1540
- C:\Windows\System\xFGMeFw.exe
  C:\Windows\System\xFGMeFw.exe
  2⤵
  PID:10632
- C:\Windows\System\CHyJaTf.exe
  C:\Windows\System\CHyJaTf.exe
  2⤵
  PID:6352
- C:\Windows\System\QYNRMVl.exe
  C:\Windows\System\QYNRMVl.exe
  2⤵
  PID:6176
- C:\Windows\System\vHyQNgS.exe
  C:\Windows\System\vHyQNgS.exe
  2⤵
  PID:7288
- C:\Windows\System\hcpgdtE.exe
  C:\Windows\System\hcpgdtE.exe
  2⤵
  PID:6660
- C:\Windows\System\jbqgdBk.exe
  C:\Windows\System\jbqgdBk.exe
  2⤵
  PID:8296
- C:\Windows\System\sNVzNEd.exe
  C:\Windows\System\sNVzNEd.exe
  2⤵
  PID:7032
- C:\Windows\System\bEZErMP.exe
  C:\Windows\System\bEZErMP.exe
  2⤵
  PID:7904
- C:\Windows\System\JjhhiSG.exe
  C:\Windows\System\JjhhiSG.exe
  2⤵
  PID:10356
- C:\Windows\System\fZkerJQ.exe
  C:\Windows\System\fZkerJQ.exe
  2⤵
  PID:15272
- C:\Windows\System\KJuWwBT.exe
  C:\Windows\System\KJuWwBT.exe
  2⤵
  PID:1816
- C:\Windows\System\aoQkweb.exe
  C:\Windows\System\aoQkweb.exe
  2⤵
  PID:5528
- C:\Windows\System\qBjLHcy.exe
  C:\Windows\System\qBjLHcy.exe
  2⤵
  PID:10288
- C:\Windows\System\FZYwlJC.exe
  C:\Windows\System\FZYwlJC.exe
  2⤵
  PID:14516
- C:\Windows\System\AzVqeUQ.exe
  C:\Windows\System\AzVqeUQ.exe
  2⤵
  PID:11376
- C:\Windows\System\HYuDzIF.exe
  C:\Windows\System\HYuDzIF.exe
  2⤵
  PID:11392
- C:\Windows\System\uuHdeaT.exe
  C:\Windows\System\uuHdeaT.exe
  2⤵
  PID:9776
- C:\Windows\System\DFAXUSq.exe
  C:\Windows\System\DFAXUSq.exe
  2⤵
  PID:14784
- C:\Windows\System\zvjzVAu.exe
  C:\Windows\System\zvjzVAu.exe
  2⤵
  PID:7820
- C:\Windows\System\IoXLefZ.exe
  C:\Windows\System\IoXLefZ.exe
  2⤵
  PID:10708
- C:\Windows\System\MYNntfh.exe
  C:\Windows\System\MYNntfh.exe
  2⤵
  PID:10924
- C:\Windows\System\gaTspZa.exe
  C:\Windows\System\gaTspZa.exe
  2⤵
  PID:10228
- C:\Windows\System\xzkuKVO.exe
  C:\Windows\System\xzkuKVO.exe
  2⤵
  PID:7356
- C:\Windows\System\GCggYNi.exe
  C:\Windows\System\GCggYNi.exe
  2⤵
  PID:14808
- C:\Windows\System\akqIvEa.exe
  C:\Windows\System\akqIvEa.exe
  2⤵
  PID:11112
- C:\Windows\System\CWaisao.exe
  C:\Windows\System\CWaisao.exe
  2⤵
  PID:9180
- C:\Windows\System\qhPJbCw.exe
  C:\Windows\System\qhPJbCw.exe
  2⤵
  PID:12232
- C:\Windows\System\SljHist.exe
  C:\Windows\System\SljHist.exe
  2⤵
  PID:14912
- C:\Windows\System\MiIygIC.exe
  C:\Windows\System\MiIygIC.exe
  2⤵
  PID:7544
- C:\Windows\System\FWTmLwq.exe
  C:\Windows\System\FWTmLwq.exe
  2⤵
  PID:10332
- C:\Windows\System\VmjxOuV.exe
  C:\Windows\System\VmjxOuV.exe
  2⤵
  PID:7864
- C:\Windows\System\KaRVxQy.exe
  C:\Windows\System\KaRVxQy.exe
  2⤵
  PID:8364
- C:\Windows\System\sJZIXhe.exe
  C:\Windows\System\sJZIXhe.exe
  2⤵
  PID:12588
- C:\Windows\System\BLTkWwn.exe
  C:\Windows\System\BLTkWwn.exe
  2⤵
  PID:10448
- C:\Windows\System\eFQCIxP.exe
  C:\Windows\System\eFQCIxP.exe
  2⤵
  PID:5512
- C:\Windows\System\cAekXac.exe
  C:\Windows\System\cAekXac.exe
  2⤵
  PID:10256
- C:\Windows\System\gdrrupM.exe
  C:\Windows\System\gdrrupM.exe
  2⤵
  PID:14524
- C:\Windows\System\lgoZqla.exe
  C:\Windows\System\lgoZqla.exe
  2⤵
  PID:10372
- C:\Windows\System\WqecZaN.exe
  C:\Windows\System\WqecZaN.exe
  2⤵
  PID:9820
- C:\Windows\System\VlUTDtI.exe
  C:\Windows\System\VlUTDtI.exe
  2⤵
  PID:9736
- C:\Windows\System\jBXKeNl.exe
  C:\Windows\System\jBXKeNl.exe
  2⤵
  PID:6196
- C:\Windows\System\NWjOzWY.exe
  C:\Windows\System\NWjOzWY.exe
  2⤵
  PID:8576
- C:\Windows\System\aQPvTbW.exe
  C:\Windows\System\aQPvTbW.exe
  2⤵
  PID:10728
- C:\Windows\System\vIvdIwx.exe
  C:\Windows\System\vIvdIwx.exe
  2⤵
  PID:13192
- C:\Windows\System\qUCnQAo.exe
  C:\Windows\System\qUCnQAo.exe
  2⤵
  PID:7764
- C:\Windows\System\GbpXIZc.exe
  C:\Windows\System\GbpXIZc.exe
  2⤵
  PID:10060
- C:\Windows\System\BJMQhte.exe
  C:\Windows\System\BJMQhte.exe
  2⤵
  PID:5732
- C:\Windows\System\IyukDZq.exe
  C:\Windows\System\IyukDZq.exe
  2⤵
  PID:11200
- C:\Windows\System\LjUvexR.exe
  C:\Windows\System\LjUvexR.exe
  2⤵
  PID:12700
- C:\Windows\System\vSXLJbo.exe
  C:\Windows\System\vSXLJbo.exe
  2⤵
  PID:11072
- C:\Windows\System\BcnmbuF.exe
  C:\Windows\System\BcnmbuF.exe
  2⤵
  PID:9668
- C:\Windows\System\FxGMpKH.exe
  C:\Windows\System\FxGMpKH.exe
  2⤵
  PID:5392
- C:\Windows\System\kzRIMya.exe
  C:\Windows\System\kzRIMya.exe
  2⤵
  PID:8024
- C:\Windows\System\xrIBDsu.exe
  C:\Windows\System\xrIBDsu.exe
  2⤵
  PID:9920
- C:\Windows\System\WKYrjLf.exe
  C:\Windows\System\WKYrjLf.exe
  2⤵
  PID:2352
- C:\Windows\System\DNCGwCV.exe
  C:\Windows\System\DNCGwCV.exe
  2⤵
  PID:10916
- C:\Windows\System\iflKfUm.exe
  C:\Windows\System\iflKfUm.exe
  2⤵
  PID:8044
- C:\Windows\System\rUADTQZ.exe
  C:\Windows\System\rUADTQZ.exe
  2⤵
  PID:10864
- C:\Windows\System\IFPrBpf.exe
  C:\Windows\System\IFPrBpf.exe
  2⤵
  PID:9660
- C:\Windows\System\eMomOFQ.exe
  C:\Windows\System\eMomOFQ.exe
  2⤵
  PID:13356
- C:\Windows\System\CDUfWrf.exe
  C:\Windows\System\CDUfWrf.exe
  2⤵
  PID:13340
- C:\Windows\System\KJYLPyg.exe
  C:\Windows\System\KJYLPyg.exe
  2⤵
  PID:11248
- C:\Windows\System\LgeFUgQ.exe
  C:\Windows\System\LgeFUgQ.exe
  2⤵
  PID:636
- C:\Windows\System\zkzSsqP.exe
  C:\Windows\System\zkzSsqP.exe
  2⤵
  PID:9136
- C:\Windows\System\QhpCnxE.exe
  C:\Windows\System\QhpCnxE.exe
  2⤵
  PID:13380
- C:\Windows\System\KWlQyod.exe
  C:\Windows\System\KWlQyod.exe
  2⤵
  PID:11984
- C:\Windows\System\biTWknl.exe
  C:\Windows\System\biTWknl.exe
  2⤵
  PID:8620
- C:\Windows\System\MbwXepy.exe
  C:\Windows\System\MbwXepy.exe
  2⤵
  PID:2840
- C:\Windows\System\HvMsNJm.exe
  C:\Windows\System\HvMsNJm.exe
  2⤵
  PID:13544
- C:\Windows\System\VVpVcCG.exe
  C:\Windows\System\VVpVcCG.exe
  2⤵
  PID:13228
- C:\Windows\System\IxMmGJS.exe
  C:\Windows\System\IxMmGJS.exe
  2⤵
  PID:5324
- C:\Windows\System\gvxVspR.exe
  C:\Windows\System\gvxVspR.exe
  2⤵
  PID:12072
- C:\Windows\System\zDheHDd.exe
  C:\Windows\System\zDheHDd.exe
  2⤵
  PID:12752
- C:\Windows\System\uTuEkzS.exe
  C:\Windows\System\uTuEkzS.exe
  2⤵
  PID:13452
- C:\Windows\System\pEpncgG.exe
  C:\Windows\System\pEpncgG.exe
  2⤵
  PID:7640
- C:\Windows\System\vOkiGQH.exe
  C:\Windows\System\vOkiGQH.exe
  2⤵
  PID:10344
- C:\Windows\System\fChjiCn.exe
  C:\Windows\System\fChjiCn.exe
  2⤵
  PID:13536
- C:\Windows\System\kxPInKX.exe
  C:\Windows\System\kxPInKX.exe
  2⤵
  PID:13440
- C:\Windows\System\lqagPdy.exe
  C:\Windows\System\lqagPdy.exe
  2⤵
  PID:10012
- C:\Windows\System\fMduoET.exe
  C:\Windows\System\fMduoET.exe
  2⤵
  PID:11032
- C:\Windows\System\akiIntC.exe
  C:\Windows\System\akiIntC.exe
  2⤵
  PID:7728
- C:\Windows\System\lgyrlHK.exe
  C:\Windows\System\lgyrlHK.exe
  2⤵
  PID:11936
- C:\Windows\System\URrlmHP.exe
  C:\Windows\System\URrlmHP.exe
  2⤵
  PID:11660
- C:\Windows\System\dWRvNLG.exe
  C:\Windows\System\dWRvNLG.exe
  2⤵
  PID:7352
- C:\Windows\System\ZwqLcBK.exe
  C:\Windows\System\ZwqLcBK.exe
  2⤵
  PID:13564
- C:\Windows\System\oCcIHWg.exe
  C:\Windows\System\oCcIHWg.exe
  2⤵
  PID:13384
- C:\Windows\System\zRjtPBj.exe
  C:\Windows\System\zRjtPBj.exe
  2⤵
  PID:12160
- C:\Windows\System\xGJFcTi.exe
  C:\Windows\System\xGJFcTi.exe
  2⤵
  PID:12384
- C:\Windows\System\ZcaLYUT.exe
  C:\Windows\System\ZcaLYUT.exe
  2⤵
  PID:12116
- C:\Windows\System\LErAXsi.exe
  C:\Windows\System\LErAXsi.exe
  2⤵
  PID:12788
- C:\Windows\System\BendZab.exe
  C:\Windows\System\BendZab.exe
  2⤵
  PID:13660
- C:\Windows\System\WcYAprO.exe
  C:\Windows\System\WcYAprO.exe
  2⤵
  PID:8988
- C:\Windows\System\pvesqSM.exe
  C:\Windows\System\pvesqSM.exe
  2⤵
  PID:13728
- C:\Windows\System\kYJSjLR.exe
  C:\Windows\System\kYJSjLR.exe
  2⤵
  PID:11292
- C:\Windows\System\iMVeYFD.exe
  C:\Windows\System\iMVeYFD.exe
  2⤵
  PID:13696
- C:\Windows\System\xolTgDh.exe
  C:\Windows\System\xolTgDh.exe
  2⤵
  PID:12712
- C:\Windows\System\qiVgztd.exe
  C:\Windows\System\qiVgztd.exe
  2⤵
  PID:8600
- C:\Windows\System\eJMcNkY.exe
  C:\Windows\System\eJMcNkY.exe
  2⤵
  PID:10092
- C:\Windows\System\QosaApi.exe
  C:\Windows\System\QosaApi.exe
  2⤵
  PID:8124
- C:\Windows\System\EHPIlAn.exe
  C:\Windows\System\EHPIlAn.exe
  2⤵
  PID:14064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vr1c31qi.vxb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DHURYPR.exe

Filesize
18B

MD5
9ac80bd3676a9afcd1b2b87ad503ff74

SHA1
9450a6252bf5581c786da39e335ef6daa84b2b14

SHA256
139bf5b4b00f1d1c9f3d4e09a18af03fd56e363a9ac57feac70ae54041e87fda

SHA512
226b7fdaf3841f974f5dc515ea308559528af6f1b3b8dde2492efb31cf145d9bc78df64f1a51b99bf63428b956e0222e2726ceae7a82f99d50ed082ea9487262

Download Submit
C:\Windows\System\EolombI.exe

Filesize
1.8MB

MD5
3f6157147c7f7438ae7ae7563f82a675

SHA1
dacd36a86648d6959212f8597176c2e8e1c6b0ab

SHA256
1a2d38ae23ef00331d98c786766f9825ab78f1e28a8a100a5b42fdec6b4624df

SHA512
b50de932ea289dc6e1339e0ca739cca05db19f6d2ab1778350ac2f7c3239b0fcd52add25e26fb265be8deccd40d9a5cf0ac234e03e2d54d9ae9d70c8e090bc3a

Download Submit
C:\Windows\System\FRfyNbi.exe

Filesize
1.8MB

MD5
e57ce2314a4e358b13f2ff05321f53b5

SHA1
006e725d29ad4a49a92b2ffc869d3280484cbb0c

SHA256
bf85c9fd34bfd719e8a156623622d22f0446febff0e4bc371748fdee68a580e2

SHA512
b09733baa295f5a08c20ef325ae42f68db2fce37b7dfc28e8dcf58bbd0193608945c81505c8b5bc98bdbe298d80347469a965e73355f25b9202682f9a8e54dce

Download Submit
C:\Windows\System\GQNKYAi.exe

Filesize
1.8MB

MD5
dd2e6a53b83d8a345cb25418ae678455

SHA1
61edc02bb3553b750ffce7a8e243b55e85ad85b8

SHA256
271484e2c67f0ed5e1202ba880b544b3a495ecc5a66c8d1d4ca13d365fd535fa

SHA512
c93f7a02d6cea5d7a2de2a10644a791729121d0205f1ef819a15aa3f8803df90752f85e80d4f3018afd71262ab7975985b0c90ac756decf8128e1798f0fcb44f

Download Submit
C:\Windows\System\HuoIGHS.exe

Filesize
1.8MB

MD5
26f4447dd85c76e7a19c571afba288c5

SHA1
5f97e5f48f7b0c88e73a5a83d476a03c276eb0ed

SHA256
635e9218edbb1b11f172ff88039d06ceaa3d23496af0ece058605380d6e54f3a

SHA512
451b17009ba0da94067cb1fd07af260c03a6dc15953137a7bddfa391a6993512bef59184525131d89ed0266beac8f7388c60b1bbe2c70aee592fa408eced36f8

Download Submit
C:\Windows\System\KHAHKWM.exe

Filesize
1.8MB

MD5
f5ef140ed5db1893fc09d24e4532e272

SHA1
d98549a9c6b9f20a6347659efe2590f1966137ea

SHA256
95d4184ea45a2785c1b334af68370d1e57a70fac786cda21f12cc4cd98090bc1

SHA512
9dbe7a01094be68afc9292090e05e421e48cdd5a69331d1066ce3153be6b57e6c0d17b36988ac2a46d28dd59924a02f3c2d4fa73b6aa853f3e3ab3234ee95e16

Download Submit
C:\Windows\System\KVJxMoC.exe

Filesize
1.8MB

MD5
d026090aef423a52394887a5e875a41a

SHA1
51ca68b6aeafa91b976ffbae00e2dd096ab09643

SHA256
92a8d41e85bb84be4d55003de104aebd8c9b1f11cb65245870ff2694c7d91cce

SHA512
eb6a5d6f56f901eafdf09f9f23b2f2f7068fbe6d60249ebcb6f9c35b64becff45ba539ae5f7fd6ac05572a1d426ee34827b90fa22bad5647302ed99b6ea08ec4

Download Submit
C:\Windows\System\MqQthPJ.exe

Filesize
1.8MB

MD5
73c13fb5c719055af7dc4cc3a1845a70

SHA1
7db5103521159e86bba85c2afe4134c33a373c4c

SHA256
0fc5b64395a221e35059a1f2e9e271a28ec8cbd52996345eebdb1bb577506eff

SHA512
3c10318182195e08b46b83e763cb9b1479ffc337ffa2e18536f1e2142466e192f2d3fb80ccd47f7d41a797a9735936815d5cd6ff33fa4660a4ade0e1ded74bf8

Download Submit
C:\Windows\System\PIlLueC.exe

Filesize
1.8MB

MD5
6150574e4fa8ac4895d95c2fd96e7737

SHA1
040a8586fcb13a89a04b879200aca395b1752d54

SHA256
e095efd53fed818675a8c837b70a130531170dbec4076d01c177ed92af79bf86

SHA512
816782e284b58645963b5c166b70edf8479e0645132421417eaf14a17dba4164237c41ed5be9c938bd673c6639c998e8226bd9060aac6843e3474e15e64f2873

Download Submit
C:\Windows\System\PZSurru.exe

Filesize
1.8MB

MD5
6f6fdde546967d79c75b9be8b6ae8d1b

SHA1
04359df739952728b9020266d13a5a5fc3a877de

SHA256
d274046ccbfde2baa151e25abf79e3830ca72a8e44483c52f7284e6025ecd87a

SHA512
1a6e8148fd8f350b1ffbb8e3ca349b8604ece52b90b946955def8b1d02bca7e354d1f0e89f41ede75aaa413e1fbf0c88a9a4233cd94bcb8c514659ed8a232ba7

Download Submit
C:\Windows\System\RfCyBYd.exe

Filesize
1.8MB

MD5
4dbf8723b6d0f436b7a10fddaac3921a

SHA1
2a3f95ffb03cd05c30b9fb714afc0295c25a3b2a

SHA256
3a032d568f79da0ae991b68771f1031348d5076043ef0721b2fb169ea48f5116

SHA512
7b2cdc20a01aa311658fecb0b3ce38b858b1a80726954a916f7e99b802bce2142bdcb9dde1be43b02fd1f1aeb0a1f863784d5b458ca439758202adabde44dd05

Download Submit
C:\Windows\System\SCSprBN.exe

Filesize
1.8MB

MD5
b5d2aa6c6dd34184ddb6824ea7262962

SHA1
506709c68e3ac1741c0169c0ca6feddf7d665d43

SHA256
2884a3ebf3fee04dcd58b1d5285adc72691bb2704189c200670389609f6ad789

SHA512
417563b1c7a9828ef53b0cc03dccd61ef34e8df050d6f808938cf1fe2fe8ca800741382987139cd914e34f5ca5c778b0cbdf58a3564321da2bae2472e48b80bb

Download Submit
C:\Windows\System\SueOCch.exe

Filesize
1.8MB

MD5
c740f8436e6ec01c612ca890f998c65e

SHA1
6bc2ac7e031d197783c2d5de132842de4b34503a

SHA256
68a1d94ab60532225672ba2c9de45f5c27f06282165be9d6fa3340a97b4664d2

SHA512
a1650fd78ac392ec1a39efd0a8c6667398e66805019ff12b6934bdc4d55e41e31692eac51e84c579269d45b71d7db0ccfb81b58cd726b76f73c207c30dd1cf44

Download Submit
C:\Windows\System\TCUgPCF.exe

Filesize
1.8MB

MD5
ff95fb15be2b77ed50ea7b82f6d2b292

SHA1
071fe436aca89c18c56932a3f767f8b7143cb7d1

SHA256
5bca1718b3ddcf1a1fb12f36da0d27cbcaadd5183fda905d95543fc003774d1b

SHA512
2502d2c8c3e8b677b9c22c61db568378842748054d6113f583db09b7ad2dd2d00de60f70f2f17ab771bae9280c24b0b4ef49294dd7996c0046d77c876b30ad16

Download Submit
C:\Windows\System\WiYWsnC.exe

Filesize
1.8MB

MD5
242a5d498f0967169efb181c86cb4e96

SHA1
a1e468d70ccda2d4d940f60d58bb55402318aab4

SHA256
6eada4054150d77d1edba6af1171b40369cf667f24eee147aef77cfdf561298c

SHA512
99705fcd4aa782f70581cfa8427f84431d3d7bd3caf99801e5a9ef7df75862e7335e0772c0a59f3460d75f9bd44b61e2b70f40c4b6a9a0a48199e98505df1ecb

Download Submit
C:\Windows\System\YXrzkXI.exe

Filesize
8B

MD5
b849dbcfb08ac877290add49e99178d8

SHA1
e96fe151173fd43a6d834740f52198931a388bf9

SHA256
a924546cb05e0d111a25fcb8e7f183457926abae319588a0b32ef2b05d457163

SHA512
8b4a01f83882b6e5a7d86633f11ab4b0beb94666eb64954ae2be067858515a1f39d026e62a6fa7cb4c876187b4f3fb07031095ae0126acf1cb139bd0d21d7863

Download Submit
C:\Windows\System\Ykplsiq.exe

Filesize
1.8MB

MD5
7d4de830f10499535979eed1db38ed26

SHA1
4c18f1952bbef088e5cc48acd653c80ec5612685

SHA256
1b4018709ed6f2401db4d7461e820e9ed07bed76e48f8799d7315c0498cf924b

SHA512
769e7d38f90829e069b803b4d73d8409f3097a9e38b23ea98de0136b577244bf945c04e38220a543e295fd2c6ddc8b5bea97a3f65eb40472c431f95fa6791fac

Download Submit
C:\Windows\System\ZtbbfpB.exe

Filesize
1.8MB

MD5
739d76971f3aa7ac86f89d25914913e7

SHA1
d9d5d75d3c90cb71847c63791cec39a31a499176

SHA256
6bedb7e89a62a1ce69aac147da31293b4e61b8c42d89076da0bd61fb0ded08e4

SHA512
e35f150f57b3472ce86cf4500def6ad714b82cc068a7f650c46ae9aa155729fcfee3953b7a8d251ebdefec81678757e326c5ae17a99212a09a90796f94dd2498

Download Submit
C:\Windows\System\bqLAHQG.exe

Filesize
1.8MB

MD5
17044e81833c27046544d03fae1e1964

SHA1
585fc9e3dddbf3f270854d1a897e798c3bc73ca1

SHA256
0198a8f9b218f1fe1a96e8a455159ebb25abc3fc22945a0fe4bd7e61b2a27074

SHA512
5d01917320c18d9ec1cb062b4a7e97741a0a7882a8f02d14de549c01977b3b7a36194f0389f3e17d80d1f6be1f6b47c3325cbdfaab08bc8b5d983f69cf9e35aa

Download Submit
C:\Windows\System\epmdyBg.exe

Filesize
1.8MB

MD5
10777ccf993a05a2e92f2d355867cb51

SHA1
00ec496f163cfde881e864624ec48e49980237ef

SHA256
938790792c9599bc9bb6b935121d89bfddd87d63ce55bb3743241ad2f8be2008

SHA512
473f8cbf10ee7850f8d5bca7fe48e7037376db9cb9958f07fb5c0506c4973be37d08bd59e4816d42fc3cadaf46ad5b45d31c91e204cd98407273e8adbdf901d3

Download Submit
C:\Windows\System\gowYKqb.exe

Filesize
1.8MB

MD5
2e01aa4856fbe2c4a6a7abf32474ddc6

SHA1
2d453b9676ce95821dd0a9dc667f60225f2ea195

SHA256
5ca94445f27a8266c9913877784f1bff65ef90f317710d2b373446485ff81710

SHA512
8fec3ddca2e877d698f314b71e9296ed7aa04dedfdf535e38616b30d34a584e8111d888ae4ae0721140c516dbaded5eb7885fd100f54a9292e7f42062a6a1496

Download Submit
C:\Windows\System\ianOeRf.exe

Filesize
1.8MB

MD5
d25183483e448299da505c97c324ba31

SHA1
98e44342f2be673a92274733339a66bfc78f5de2

SHA256
76ddf038c97e0ef03049d1c1ddbc9dfa83e38e325f3d3e00a2584ca61ca80e09

SHA512
0beab7a649b0f571767e725ec7a19f9072b8f9430f708114b33e622d347d9a9f2ee8a347f009cb51e38e2ee9b4aa8aa69abf0bd75ff155e54a0e8572d99e9b61

Download Submit
C:\Windows\System\kRnvwNj.exe

Filesize
1.8MB

MD5
6b89ad780dbe717f016f9ce91079cb85

SHA1
3911224d3902b23474eb869ebde8cc9a13419f92

SHA256
30bc14f7ab25279e368defbdf87782c91ae7d6a973aa564e1f4369b89a8cd599

SHA512
9dc11a68041a535eae29e42632c1cc401dcf68a06c229693406b281d8466d86351fa971a8b2710a440fcc61f4b8fc369865c6783a5b920526b94caeeb59fff45

Download Submit
C:\Windows\System\lFZaHdj.exe

Filesize
1.8MB

MD5
c534d6c782820d044d5c0d28bce5910b

SHA1
6c5b2c71842313ea74a540651830ad3c61d8a016

SHA256
c3fd917d16a49df183736db1b89395a3bbec0e8a46d668e9bb369dc19a98b955

SHA512
9a16eb3ead2f939a2a7073859ccddbf7f96b7c7097c039d58ea838f2daf88c7b2e64b874f51240bddc08068610ea0ef92a3f6eec5dda57800eaa6e12915d97d9

Download Submit
C:\Windows\System\lPjntwb.exe

Filesize
1.8MB

MD5
59522fc9e109063b4cdf119321466a97

SHA1
0fdc1441f4558c90a6bd6538840fe05eae84354a

SHA256
fb77265bec7167a1fcba64866d5fdb75bd3eb69528abb099aec80923da537480

SHA512
9ec5d7037fabf803491947b4a203c31eb9059c09052dd44f80b92138afbf199f5a4f70c21b08733547e24494dff07d95844377e090ae70ce124cc7d33bb5717d

Download Submit
C:\Windows\System\mcqlmnu.exe

Filesize
1.8MB

MD5
890a8c4fa2e59a2904545185764625cd

SHA1
829de796697ad9317c0a021e29938fdf9e936889

SHA256
f8aea95908ee5aa6264c76d91af0d5971bc163ea49a4edcf73ff9c36b73e0b29

SHA512
769b56cb8ca5ed57c71dae405e6bd796ec0c3aa47b43bcef56d1f4b1820b44f7cccf15e339cc5c2de83b350391831c66ea250036198ee309dc770f7786ffcee2

Download Submit
C:\Windows\System\plBkUCl.exe

Filesize
1.8MB

MD5
e98ef4bd390ae9ecaee18711218a3bb4

SHA1
4d2444b6f2148b4f71f5362674128aae33dd3f55

SHA256
ecd811f1d6c61a9d057c5e9b41eb43576d49dfb4e10d6f0229d26a68530518d3

SHA512
0cc746309af90c7f2b9d97343dd11731a7d37ff36a55615e24211dc1b2b31c77b3ecaf292864d3ff460b4c169db68bddd422a0b5f0d894097bcc7bb0a003a5ab

Download Submit
C:\Windows\System\pwUyYlZ.exe

Filesize
1.8MB

MD5
5867cf08e3bda61422ab9894a5833972

SHA1
7e37601da042deb33f09cb2ee7c0991910beddb6

SHA256
35fe5dd9bf3111130e7f4ccd8544435d1fab3e0bf6af5230a720c02fe6a8c402

SHA512
d29ab3c8a7df313978ed10c99a4842bae26098918ab4cb08cd487ad1a2572f0d63bc06cff560bea23341d751359675c7aed739eea7c57c6d6b287e331131c6ca

Download Submit
C:\Windows\System\qPpuZOX.exe

Filesize
1.8MB

MD5
ec6cf44be9f78e2b6b57c13a53bfbdeb

SHA1
1aa19172372343b75b1ec0cb9514ee56a7b50789

SHA256
705431371c73c33797575958affcb478c567dac12366922e30b5695bc2013268

SHA512
7bdbb7b13686752e3e2f6c6609f2684b9ec74d1ff87f8032087417c1468578b1e9b9cc11fadb40a09fd2ccc675ef2f9baaf39c39cbf0f01bad699624e4ed847b

Download Submit
C:\Windows\System\rPduTRs.exe

Filesize
1.8MB

MD5
21ff3339a3471214a335d6e8a9722637

SHA1
4c37e34dd0760592089f9bac8b801fa6a74ff6a9

SHA256
68c87e42b5a244028711ae2ad39aa4f08fb93a2edda76f101f8ad8d07da55f5f

SHA512
a472b4d8768525a44f473fef11a9da64d9e737af0cb59cdd04dcc4bad5cae0527ad665547129f592b9dd3c3286991234a76560bf78ec1a9a1209c90f7b99c36a

Download Submit
C:\Windows\System\rnWUZjH.exe

Filesize
1.8MB

MD5
e5fac5084569262248df2c0204372480

SHA1
deb4f3ccacb991a62899b35c37d0fe9a86ac252e

SHA256
93f74fbd553b4b3012bce43b411d180185b388b9e98fcd66807a198fd51089a3

SHA512
57670cc0ead03863fda0d0fdeef9c8bb7fbcda02510d3746e99999cb1137b83aa99f8423aa51174ace8af6eaf3f2d1dade02fa980c6154080d1ee3b96d43286d

Download Submit
C:\Windows\System\tVdrfly.exe

Filesize
1.8MB

MD5
023651204867dddd7f5697c0621d41fc

SHA1
2de93e7863a7d3d5fa9edc9caf0490e1c6e5b686

SHA256
0a46cb9e60a1d12032b68551df5ff8caae87ba3cb9b87be6ffc1475b6a00c6ac

SHA512
560c147f8c5f2b33861f4a8870c45a3a89571c25339c4a2c09a03636d5cfe09c4dfc7a6c94a90c49f30686f1aebe9cc0dd65640dbc10d02cf2c87227af084b89

Download Submit
C:\Windows\System\uOFUMPt.exe

Filesize
1.8MB

MD5
607fcfa2b63846d643b5c70ab447b7e9

SHA1
c785db0fa8e33f8a3983802e41e9c19f9f28d067

SHA256
4002ad9bcc9bf5788780386c80982cb25a1253309fbd60155c1ad35c91d484fb

SHA512
c936e9e6fbffaaaa424eed1c16cec674b09c18eabe0939eecbaabef01d06874ef98367fc8daa0064349f90cd558753a8867b02dd49abe97969c27ec4895d22e9

Download Submit
C:\Windows\System\ufoVZCu.exe

Filesize
1.8MB

MD5
b42a96052ae49a55621677714eb04e3e

SHA1
1e791dfd09ef3fdf87b49fc248c550a4ab432c02

SHA256
412a99472e70a06a80a6c52b29258065e8122f4cbd74157dec04c3a6162d8ecc

SHA512
7e9cdb07df99a55e1af0cb35ca9f8342a0ff5abb028483e5342a5f6ee7f28a253955e53e63b1c68f0f515c40774ff717ccf1f6c61294b443b0f335b8d46a89e9

Download Submit
C:\Windows\System\wCcUbxp.exe

Filesize
1.8MB

MD5
afb00faf0c08e468b5469ee3e694f840

SHA1
47d8c1d771822a05c0d445b9e860ca086f85bdac

SHA256
1ea63f706f8e38184e43a88dc0c13875187405575f04872dcb6f9d78e1f1dbf0

SHA512
665d7e1bd7401377e2169bd5137a30cc9366f419dbbd8e7745fb62c3c3b4f26090fe446d3cc3a35ef31ae8d23171f49b067929ed0156e8d8a640bc2cd93c31e4

Download Submit
C:\Windows\System\zSPCluH.exe

Filesize
1.8MB

MD5
47e0255dfc0a0f315bb3f9aed7f7a783

SHA1
4c67c96dca12ffe06ee297ad241244ef24356685

SHA256
ab9c36718853197e2822ad1550c36680dce27204aba4177d90a7b50611b40d78

SHA512
59fa5b1577b7eff78d8fb10f83a862d6a2bdf76f8eca7bcdac2fb1ed42ca878a7b88792835e30914b60deceb890f74bc64124b1b83e79ab276ccecb842680eab

Download Submit
C:\Windows\System\zdYqNGj.exe

Filesize
1.8MB

MD5
5a81bc9f95888b08beccd2d48b9398d0

SHA1
6d322d6f1fdec5ddf22a17c7ea9da71d5cdfd855

SHA256
e7d74d5c63cf3798036670445b7dc210a5861ef662ce0d593681cc83e8716cbb

SHA512
6d17dcf50c8e055944f0cb739489283eb64bf46c08b9a4b64e36470be3e350c09490d077b9a367d192dcfbb9130f59af0f0731bd8f9a60a27f9e0bf50ca37779

Download Submit
C:\Windows\System\zqkfwAK.exe

Filesize
1.8MB

MD5
f45fff2e38aa4aa9e2fd37a235315f6b

SHA1
a66e453c0c39d3728d923610c9a005f9b04aa862

SHA256
df191927ec800b3aefcc1fac3cfb32efe8af809a1ed12e392d8e081221b6cd61

SHA512
9df5cd1e6b6ef8827e919e20269729413676a8fbb36181919a7747a126975f1d6d48d7362abc0f3408871d27077063d14bf68442d9e3c1f8b15cbae4479b30fc

Download Submit
memory/780-52-0x000001B1770E0000-0x000001B1770F0000-memory.dmp

Filesize
64KB

Download
memory/780-50-0x00007FFEC9510000-0x00007FFEC9FD1000-memory.dmp

Filesize
10.8MB

Download
memory/780-190-0x000001B1770E0000-0x000001B1770F0000-memory.dmp

Filesize
64KB

Download
memory/780-267-0x000001B177040000-0x000001B177062000-memory.dmp

Filesize
136KB

Download
memory/780-2498-0x00007FFEC9510000-0x00007FFEC9FD1000-memory.dmp

Filesize
10.8MB

Download
memory/1600-366-0x00007FF7FD4E0000-0x00007FF7FD8D2000-memory.dmp

Filesize
3.9MB

Download
memory/1600-5752-0x00007FF7FD4E0000-0x00007FF7FD8D2000-memory.dmp

Filesize
3.9MB

Download
memory/2276-76-0x00007FF68AC40000-0x00007FF68B032000-memory.dmp

Filesize
3.9MB

Download
memory/2276-5717-0x00007FF68AC40000-0x00007FF68B032000-memory.dmp

Filesize
3.9MB

Download
memory/2620-117-0x00007FF74C450000-0x00007FF74C842000-memory.dmp

Filesize
3.9MB

Download
memory/2620-5722-0x00007FF74C450000-0x00007FF74C842000-memory.dmp

Filesize
3.9MB

Download
memory/3188-5772-0x00007FF639B70000-0x00007FF639F62000-memory.dmp

Filesize
3.9MB

Download
memory/3188-2539-0x00007FF639B70000-0x00007FF639F62000-memory.dmp

Filesize
3.9MB

Download
memory/3624-5769-0x00007FF6E4790000-0x00007FF6E4B82000-memory.dmp

Filesize
3.9MB

Download
memory/3624-187-0x00007FF6E4790000-0x00007FF6E4B82000-memory.dmp

Filesize
3.9MB

Download
memory/4280-786-0x00007FF790220000-0x00007FF790612000-memory.dmp

Filesize
3.9MB

Download
memory/4280-5736-0x00007FF790220000-0x00007FF790612000-memory.dmp

Filesize
3.9MB

Download
memory/4428-1044-0x00007FF618500000-0x00007FF6188F2000-memory.dmp

Filesize
3.9MB

Download
memory/4428-5765-0x00007FF618500000-0x00007FF6188F2000-memory.dmp

Filesize
3.9MB

Download
memory/4452-434-0x00007FF6A7360000-0x00007FF6A7752000-memory.dmp

Filesize
3.9MB

Download
memory/4452-5749-0x00007FF6A7360000-0x00007FF6A7752000-memory.dmp

Filesize
3.9MB

Download
memory/4492-226-0x00007FF6770D0000-0x00007FF6774C2000-memory.dmp

Filesize
3.9MB

Download
memory/4492-5739-0x00007FF6770D0000-0x00007FF6774C2000-memory.dmp

Filesize
3.9MB

Download
memory/4500-5732-0x00007FF65E510000-0x00007FF65E902000-memory.dmp

Filesize
3.9MB

Download
memory/4500-237-0x00007FF65E510000-0x00007FF65E902000-memory.dmp

Filesize
3.9MB

Download
memory/4716-410-0x00007FF672720000-0x00007FF672B12000-memory.dmp

Filesize
3.9MB

Download
memory/4716-5728-0x00007FF672720000-0x00007FF672B12000-memory.dmp

Filesize
3.9MB

Download
memory/4804-413-0x00007FF7065F0000-0x00007FF7069E2000-memory.dmp

Filesize
3.9MB

Download
memory/4804-5737-0x00007FF7065F0000-0x00007FF7069E2000-memory.dmp

Filesize
3.9MB

Download
memory/4824-85-0x00007FF7A0BC0000-0x00007FF7A0FB2000-memory.dmp

Filesize
3.9MB

Download
memory/4864-5753-0x00007FF768370000-0x00007FF768762000-memory.dmp

Filesize
3.9MB

Download
memory/4864-600-0x00007FF768370000-0x00007FF768762000-memory.dmp

Filesize
3.9MB

Download
memory/4880-0-0x00007FF724870000-0x00007FF724C62000-memory.dmp

Filesize
3.9MB

Download
memory/4880-1-0x000002A263750000-0x000002A263760000-memory.dmp

Filesize
64KB

Download
memory/4996-701-0x00007FF60A510000-0x00007FF60A902000-memory.dmp

Filesize
3.9MB

Download
memory/4996-5799-0x00007FF60A510000-0x00007FF60A902000-memory.dmp

Filesize
3.9MB

Download