xmrig | 8c71f9235564d57aca0ec8c773ebce07c356ee085c8e89ac297be295654f8dd1

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
Size

2.3MB
MD5

082f78421e1b4f7caf9b26a671becb25
SHA1

6abc5f54f1b092121339420cf3bfcfedd97091c7
SHA256

8c71f9235564d57aca0ec8c773ebce07c356ee085c8e89ac297be295654f8dd1
SHA512

9d54f0d197e312c656063a79593c0e049cfd21674d79ab63df47d0f2f9d30f25b5c9d02d5e661af34b9902d7f0f01f328f29c8f3c945244675b727ea059d867d
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqEq:NABu

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/1052-195-0x00007FF680E10000-0x00007FF681202000-memory.dmp	xmrig
behavioral2/memory/1368-264-0x00007FF7E2790000-0x00007FF7E2B82000-memory.dmp	xmrig
behavioral2/memory/2420-410-0x00007FF6123F0000-0x00007FF6127E2000-memory.dmp	xmrig
behavioral2/memory/3436-474-0x00007FF617AF0000-0x00007FF617EE2000-memory.dmp	xmrig
behavioral2/memory/1812-476-0x00007FF634FE0000-0x00007FF6353D2000-memory.dmp	xmrig
behavioral2/memory/1904-475-0x00007FF7E9CD0000-0x00007FF7EA0C2000-memory.dmp	xmrig
behavioral2/memory/4304-473-0x00007FF750F70000-0x00007FF751362000-memory.dmp	xmrig
behavioral2/memory/440-472-0x00007FF6BFFE0000-0x00007FF6C03D2000-memory.dmp	xmrig
behavioral2/memory/3296-471-0x00007FF719A90000-0x00007FF719E82000-memory.dmp	xmrig
behavioral2/memory/4992-457-0x00007FF656AA0000-0x00007FF656E92000-memory.dmp	xmrig
behavioral2/memory/4808-356-0x00007FF7CFC00000-0x00007FF7CFFF2000-memory.dmp	xmrig
behavioral2/memory/2568-298-0x00007FF706D00000-0x00007FF7070F2000-memory.dmp	xmrig
behavioral2/memory/1884-295-0x00007FF623DD0000-0x00007FF6241C2000-memory.dmp	xmrig
behavioral2/memory/1292-241-0x00007FF61F7E0000-0x00007FF61FBD2000-memory.dmp	xmrig
behavioral2/memory/2768-223-0x00007FF776D60000-0x00007FF777152000-memory.dmp	xmrig
behavioral2/memory/4840-182-0x00007FF6CAFB0000-0x00007FF6CB3A2000-memory.dmp	xmrig
behavioral2/memory/1280-139-0x00007FF71C200000-0x00007FF71C5F2000-memory.dmp	xmrig
behavioral2/memory/3812-98-0x00007FF762810000-0x00007FF762C02000-memory.dmp	xmrig
behavioral2/memory/4892-68-0x00007FF713100000-0x00007FF7134F2000-memory.dmp	xmrig
behavioral2/memory/860-18-0x00007FF7A2E10000-0x00007FF7A3202000-memory.dmp	xmrig
behavioral2/memory/4892-4297-0x00007FF713100000-0x00007FF7134F2000-memory.dmp	xmrig
behavioral2/memory/3436-4300-0x00007FF617AF0000-0x00007FF617EE2000-memory.dmp	xmrig
behavioral2/memory/3812-4303-0x00007FF762810000-0x00007FF762C02000-memory.dmp	xmrig
behavioral2/memory/1052-4307-0x00007FF680E10000-0x00007FF681202000-memory.dmp	xmrig
behavioral2/memory/4840-4312-0x00007FF6CAFB0000-0x00007FF6CB3A2000-memory.dmp	xmrig
behavioral2/memory/1280-4317-0x00007FF71C200000-0x00007FF71C5F2000-memory.dmp	xmrig
behavioral2/memory/992-4336-0x00007FF6E3BD0000-0x00007FF6E3FC2000-memory.dmp	xmrig
behavioral2/memory/4808-4345-0x00007FF7CFC00000-0x00007FF7CFFF2000-memory.dmp	xmrig
behavioral2/memory/440-4383-0x00007FF6BFFE0000-0x00007FF6C03D2000-memory.dmp	xmrig
behavioral2/memory/3296-4370-0x00007FF719A90000-0x00007FF719E82000-memory.dmp	xmrig
behavioral2/memory/1812-4362-0x00007FF634FE0000-0x00007FF6353D2000-memory.dmp	xmrig
behavioral2/memory/2768-4360-0x00007FF776D60000-0x00007FF777152000-memory.dmp	xmrig
behavioral2/memory/1904-4351-0x00007FF7E9CD0000-0x00007FF7EA0C2000-memory.dmp	xmrig
behavioral2/memory/2420-4357-0x00007FF6123F0000-0x00007FF6127E2000-memory.dmp	xmrig
behavioral2/memory/1292-4342-0x00007FF61F7E0000-0x00007FF61FBD2000-memory.dmp	xmrig
behavioral2/memory/2568-4339-0x00007FF706D00000-0x00007FF7070F2000-memory.dmp	xmrig
behavioral2/memory/4992-4332-0x00007FF656AA0000-0x00007FF656E92000-memory.dmp	xmrig
behavioral2/memory/1884-4326-0x00007FF623DD0000-0x00007FF6241C2000-memory.dmp	xmrig
behavioral2/memory/1368-4321-0x00007FF7E2790000-0x00007FF7E2B82000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
860	izcvCNG.exe
4304	WOYoEIc.exe
4892	TfHwBej.exe
3436	FDLfbhd.exe
3812	AVxWIRE.exe
992	klAhAcN.exe
1280	KQHjMiE.exe
4840	gDSVNWL.exe
1052	zlObXQu.exe
2768	LpYQiod.exe
1292	JnEFHzC.exe
1368	acZLFeV.exe
1884	TUMzAhj.exe
2568	AwRZkAg.exe
1904	KAECIGp.exe
4808	IsdUztM.exe
2420	RshzvhJ.exe
4992	TPMykEF.exe
1812	bASggzg.exe
3296	JGQukyz.exe
440	WEhMCDn.exe
3676	hOBsuHp.exe
2172	TLaySdQ.exe
1044	muYhKKe.exe
3872	NKTXqDS.exe
4868	CdhRvMW.exe
4268	SHoZRiZ.exe
3360	OCBwbjk.exe
1608	nNyUqXU.exe
3488	PqtiKTd.exe
3052	jsvQgxN.exe
4664	iYTuncq.exe
4944	ZkfKqRg.exe
2624	XrCgjyZ.exe
1152	VfKXnNZ.exe
2956	eftaiiI.exe
684	sDyFdhy.exe
3096	NZpsVhK.exe
4380	TZgZmtq.exe
5064	SAPgfpB.exe
3244	wiaWxUA.exe
3220	VptBAMf.exe
3612	jgdYumz.exe
3048	LyiGxWP.exe
3988	wJlhsXi.exe
4656	iXbQpxy.exe
1700	mkLFkPG.exe
1196	CFpgoCP.exe
5044	UfJOlLX.exe
5068	pWmQeei.exe
2944	sZhHYlF.exe
4356	BRDREyd.exe
3692	MyCKaSz.exe
4336	jmZguZV.exe
3596	ZGinRvL.exe
3492	mRFeTXG.exe
1256	BFpyboo.exe
4504	sQLwdEg.exe
1140	iVcNlWl.exe
1344	ENAYIUj.exe
752	eIfVIkx.exe
4908	eDmRCDV.exe
4484	BllAret.exe
4884	LplghYk.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2912-0-0x00007FF7A74C0000-0x00007FF7A78B2000-memory.dmp	upx
behavioral2/files/0x000c000000023b9d-6.dat	upx
behavioral2/files/0x000a000000023bb0-10.dat	upx
behavioral2/files/0x000a000000023bb5-35.dat	upx
behavioral2/files/0x000a000000023bc1-99.dat	upx
behavioral2/memory/992-121-0x00007FF6E3BD0000-0x00007FF6E3FC2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc2-136.dat	upx
behavioral2/memory/1052-195-0x00007FF680E10000-0x00007FF681202000-memory.dmp	upx
behavioral2/files/0x000a000000023bca-193.dat	upx
behavioral2/files/0x000a000000023bd0-192.dat	upx
behavioral2/memory/1368-264-0x00007FF7E2790000-0x00007FF7E2B82000-memory.dmp	upx
behavioral2/memory/2420-410-0x00007FF6123F0000-0x00007FF6127E2000-memory.dmp	upx
behavioral2/memory/3436-474-0x00007FF617AF0000-0x00007FF617EE2000-memory.dmp	upx
behavioral2/memory/1812-476-0x00007FF634FE0000-0x00007FF6353D2000-memory.dmp	upx
behavioral2/memory/1904-475-0x00007FF7E9CD0000-0x00007FF7EA0C2000-memory.dmp	upx
behavioral2/memory/4304-473-0x00007FF750F70000-0x00007FF751362000-memory.dmp	upx
behavioral2/memory/440-472-0x00007FF6BFFE0000-0x00007FF6C03D2000-memory.dmp	upx
behavioral2/memory/3296-471-0x00007FF719A90000-0x00007FF719E82000-memory.dmp	upx
behavioral2/memory/4992-457-0x00007FF656AA0000-0x00007FF656E92000-memory.dmp	upx
behavioral2/memory/4808-356-0x00007FF7CFC00000-0x00007FF7CFFF2000-memory.dmp	upx
behavioral2/memory/2568-298-0x00007FF706D00000-0x00007FF7070F2000-memory.dmp	upx
behavioral2/memory/1884-295-0x00007FF623DD0000-0x00007FF6241C2000-memory.dmp	upx
behavioral2/memory/1292-241-0x00007FF61F7E0000-0x00007FF61FBD2000-memory.dmp	upx
behavioral2/memory/2768-223-0x00007FF776D60000-0x00007FF777152000-memory.dmp	upx
behavioral2/files/0x000a000000023bcf-191.dat	upx
behavioral2/files/0x000a000000023bc9-187.dat	upx
behavioral2/files/0x000a000000023bce-185.dat	upx
behavioral2/files/0x000a000000023bc5-183.dat	upx
behavioral2/memory/4840-182-0x00007FF6CAFB0000-0x00007FF6CB3A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bc8-178.dat	upx
behavioral2/files/0x000a000000023bc4-173.dat	upx
behavioral2/files/0x000a000000023bc3-168.dat	upx
behavioral2/files/0x000a000000023bcd-157.dat	upx
behavioral2/files/0x000c000000023b9e-156.dat	upx
behavioral2/files/0x000a000000023bcb-154.dat	upx
behavioral2/files/0x000a000000023bcc-153.dat	upx
behavioral2/files/0x000a000000023bc7-147.dat	upx
behavioral2/memory/1280-139-0x00007FF71C200000-0x00007FF71C5F2000-memory.dmp	upx
behavioral2/files/0x000a000000023bbd-126.dat	upx
behavioral2/files/0x000a000000023bc6-143.dat	upx
behavioral2/files/0x000a000000023bbe-120.dat	upx
behavioral2/files/0x000a000000023bbf-109.dat	upx
behavioral2/files/0x000a000000023bb9-111.dat	upx
behavioral2/files/0x0031000000023bb8-110.dat	upx
behavioral2/files/0x000a000000023bbc-104.dat	upx
behavioral2/files/0x000a000000023bc0-91.dat	upx
behavioral2/files/0x000a000000023bbb-82.dat	upx
behavioral2/files/0x000a000000023bba-78.dat	upx
behavioral2/memory/3812-98-0x00007FF762810000-0x00007FF762C02000-memory.dmp	upx
behavioral2/memory/4892-68-0x00007FF713100000-0x00007FF7134F2000-memory.dmp	upx
behavioral2/files/0x0031000000023bb6-58.dat	upx
behavioral2/files/0x0031000000023bb7-47.dat	upx
behavioral2/files/0x000a000000023bb2-40.dat	upx
behavioral2/files/0x000a000000023bb4-55.dat	upx
behavioral2/files/0x000a000000023bb3-29.dat	upx
behavioral2/files/0x000a000000023bb1-25.dat	upx
behavioral2/memory/860-18-0x00007FF7A2E10000-0x00007FF7A3202000-memory.dmp	upx
behavioral2/memory/4892-4297-0x00007FF713100000-0x00007FF7134F2000-memory.dmp	upx
behavioral2/memory/3436-4300-0x00007FF617AF0000-0x00007FF617EE2000-memory.dmp	upx
behavioral2/memory/3812-4303-0x00007FF762810000-0x00007FF762C02000-memory.dmp	upx
behavioral2/memory/1052-4307-0x00007FF680E10000-0x00007FF681202000-memory.dmp	upx
behavioral2/memory/4840-4312-0x00007FF6CAFB0000-0x00007FF6CB3A2000-memory.dmp	upx
behavioral2/memory/1280-4317-0x00007FF71C200000-0x00007FF71C5F2000-memory.dmp	upx
behavioral2/memory/992-4336-0x00007FF6E3BD0000-0x00007FF6E3FC2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MKEKHdK.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\XKmbkAp.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\TZkBelj.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\jpilgHa.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\FeGhwaF.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\iSkMAKa.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\IPjefRd.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\FKydEHj.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\wMKQfOT.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\RGEtfXU.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\oKgHHIt.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\FZcmPRr.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\jxbfTHB.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\xxqbQEM.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\hJwQVTK.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\TIjBqKs.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\YUxJTjG.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\sISbjOG.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\oFBjtkc.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\JvVHIsQ.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\JuAPZxx.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\NaeqiZn.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\whVjTQC.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\QOMLAwr.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\xOLSEXW.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\ZnmEXTQ.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\ndfQPXl.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\ZiBoOzN.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\YWCFezC.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\SEFLCOq.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\brrVJFh.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\uXJBXCn.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\QAGPrmA.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\RsUkMle.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\HoiRjgB.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\LbIsAEi.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\aFhypqf.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\LfCfKuh.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\BVNVOcg.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\NwBQHaZ.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\WgdiAar.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\uydkdNa.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\xScFgBL.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\zttXfki.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\QtTgUJI.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\HpBOZtG.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\lFFgnGS.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\MCKFKaS.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\zBzxwmB.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\grjHZpT.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\yLjtage.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\ayMlDKf.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\RxDldPO.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\gKfRwPo.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\rxMTOQg.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\cUntGMO.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\kJrIDIT.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\YNIsbYw.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\wRVldts.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\XxsgrVh.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\xkGlDTY.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\BaXTDvX.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\UGiYcYu.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
File created	C:\Windows\System\xZmwCFE.exe	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
388	powershell.exe
388	powershell.exe
388	powershell.exe
388	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
Token: SeDebugPrivilege	388	powershell.exe
Token: SeLockMemoryPrivilege	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	14140	dwm.exe
Token: SeChangeNotifyPrivilege	14140	dwm.exe
Token: 33	14140	dwm.exe
Token: SeIncBasePriorityPrivilege	14140	dwm.exe
Token: SeCreateGlobalPrivilege	1384	dwm.exe
Token: SeChangeNotifyPrivilege	1384	dwm.exe
Token: 33	1384	dwm.exe
Token: SeIncBasePriorityPrivilege	1384	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 388	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	84
PID 2912 wrote to memory of 388	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	84
PID 2912 wrote to memory of 860	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	85
PID 2912 wrote to memory of 860	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	85
PID 2912 wrote to memory of 4304	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	86
PID 2912 wrote to memory of 4304	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	86
PID 2912 wrote to memory of 4892	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	87
PID 2912 wrote to memory of 4892	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	87
PID 2912 wrote to memory of 3436	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	88
PID 2912 wrote to memory of 3436	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	88
PID 2912 wrote to memory of 3812	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	89
PID 2912 wrote to memory of 3812	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	89
PID 2912 wrote to memory of 992	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	90
PID 2912 wrote to memory of 992	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	90
PID 2912 wrote to memory of 1280	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	91
PID 2912 wrote to memory of 1280	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	91
PID 2912 wrote to memory of 4840	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	92
PID 2912 wrote to memory of 4840	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	92
PID 2912 wrote to memory of 1052	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	93
PID 2912 wrote to memory of 1052	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	93
PID 2912 wrote to memory of 2768	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	94
PID 2912 wrote to memory of 2768	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	94
PID 2912 wrote to memory of 1292	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	95
PID 2912 wrote to memory of 1292	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	95
PID 2912 wrote to memory of 1368	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	96
PID 2912 wrote to memory of 1368	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	96
PID 2912 wrote to memory of 1884	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	97
PID 2912 wrote to memory of 1884	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	97
PID 2912 wrote to memory of 2568	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	98
PID 2912 wrote to memory of 2568	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	98
PID 2912 wrote to memory of 2420	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	99
PID 2912 wrote to memory of 2420	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	99
PID 2912 wrote to memory of 1904	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	100
PID 2912 wrote to memory of 1904	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	100
PID 2912 wrote to memory of 4808	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	101
PID 2912 wrote to memory of 4808	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	101
PID 2912 wrote to memory of 4992	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	102
PID 2912 wrote to memory of 4992	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	102
PID 2912 wrote to memory of 1812	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	103
PID 2912 wrote to memory of 1812	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	103
PID 2912 wrote to memory of 3296	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	104
PID 2912 wrote to memory of 3296	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	104
PID 2912 wrote to memory of 440	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	105
PID 2912 wrote to memory of 440	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	105
PID 2912 wrote to memory of 3676	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	106
PID 2912 wrote to memory of 3676	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	106
PID 2912 wrote to memory of 2172	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	107
PID 2912 wrote to memory of 2172	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	107
PID 2912 wrote to memory of 1044	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	108
PID 2912 wrote to memory of 1044	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	108
PID 2912 wrote to memory of 3872	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	109
PID 2912 wrote to memory of 3872	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	109
PID 2912 wrote to memory of 4868	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	110
PID 2912 wrote to memory of 4868	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	110
PID 2912 wrote to memory of 4268	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	111
PID 2912 wrote to memory of 4268	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	111
PID 2912 wrote to memory of 3360	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	112
PID 2912 wrote to memory of 3360	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	112
PID 2912 wrote to memory of 1608	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	113
PID 2912 wrote to memory of 1608	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	113
PID 2912 wrote to memory of 3488	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	114
PID 2912 wrote to memory of 3488	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	114
PID 2912 wrote to memory of 3052	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	115
PID 2912 wrote to memory of 3052	2912	082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\082f78421e1b4f7caf9b26a671becb25_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:388
- C:\Windows\System\izcvCNG.exe
  C:\Windows\System\izcvCNG.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\WOYoEIc.exe
  C:\Windows\System\WOYoEIc.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\TfHwBej.exe
  C:\Windows\System\TfHwBej.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\FDLfbhd.exe
  C:\Windows\System\FDLfbhd.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\AVxWIRE.exe
  C:\Windows\System\AVxWIRE.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\klAhAcN.exe
  C:\Windows\System\klAhAcN.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\KQHjMiE.exe
  C:\Windows\System\KQHjMiE.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\gDSVNWL.exe
  C:\Windows\System\gDSVNWL.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\zlObXQu.exe
  C:\Windows\System\zlObXQu.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\LpYQiod.exe
  C:\Windows\System\LpYQiod.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\JnEFHzC.exe
  C:\Windows\System\JnEFHzC.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\acZLFeV.exe
  C:\Windows\System\acZLFeV.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\TUMzAhj.exe
  C:\Windows\System\TUMzAhj.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\AwRZkAg.exe
  C:\Windows\System\AwRZkAg.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\RshzvhJ.exe
  C:\Windows\System\RshzvhJ.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\KAECIGp.exe
  C:\Windows\System\KAECIGp.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\IsdUztM.exe
  C:\Windows\System\IsdUztM.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\TPMykEF.exe
  C:\Windows\System\TPMykEF.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\bASggzg.exe
  C:\Windows\System\bASggzg.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\JGQukyz.exe
  C:\Windows\System\JGQukyz.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\WEhMCDn.exe
  C:\Windows\System\WEhMCDn.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\hOBsuHp.exe
  C:\Windows\System\hOBsuHp.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\TLaySdQ.exe
  C:\Windows\System\TLaySdQ.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\muYhKKe.exe
  C:\Windows\System\muYhKKe.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\NKTXqDS.exe
  C:\Windows\System\NKTXqDS.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\CdhRvMW.exe
  C:\Windows\System\CdhRvMW.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\SHoZRiZ.exe
  C:\Windows\System\SHoZRiZ.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\OCBwbjk.exe
  C:\Windows\System\OCBwbjk.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\nNyUqXU.exe
  C:\Windows\System\nNyUqXU.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\PqtiKTd.exe
  C:\Windows\System\PqtiKTd.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\jsvQgxN.exe
  C:\Windows\System\jsvQgxN.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\iYTuncq.exe
  C:\Windows\System\iYTuncq.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\ZkfKqRg.exe
  C:\Windows\System\ZkfKqRg.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\XrCgjyZ.exe
  C:\Windows\System\XrCgjyZ.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\VfKXnNZ.exe
  C:\Windows\System\VfKXnNZ.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\eftaiiI.exe
  C:\Windows\System\eftaiiI.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\sDyFdhy.exe
  C:\Windows\System\sDyFdhy.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\NZpsVhK.exe
  C:\Windows\System\NZpsVhK.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\TZgZmtq.exe
  C:\Windows\System\TZgZmtq.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\VptBAMf.exe
  C:\Windows\System\VptBAMf.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\SAPgfpB.exe
  C:\Windows\System\SAPgfpB.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\wiaWxUA.exe
  C:\Windows\System\wiaWxUA.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\MyCKaSz.exe
  C:\Windows\System\MyCKaSz.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\jgdYumz.exe
  C:\Windows\System\jgdYumz.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\LyiGxWP.exe
  C:\Windows\System\LyiGxWP.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\sQLwdEg.exe
  C:\Windows\System\sQLwdEg.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\wJlhsXi.exe
  C:\Windows\System\wJlhsXi.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\iXbQpxy.exe
  C:\Windows\System\iXbQpxy.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\mkLFkPG.exe
  C:\Windows\System\mkLFkPG.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\CFpgoCP.exe
  C:\Windows\System\CFpgoCP.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\UfJOlLX.exe
  C:\Windows\System\UfJOlLX.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\pWmQeei.exe
  C:\Windows\System\pWmQeei.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\sZhHYlF.exe
  C:\Windows\System\sZhHYlF.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\BRDREyd.exe
  C:\Windows\System\BRDREyd.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\jmZguZV.exe
  C:\Windows\System\jmZguZV.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\ZGinRvL.exe
  C:\Windows\System\ZGinRvL.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\mRFeTXG.exe
  C:\Windows\System\mRFeTXG.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\BFpyboo.exe
  C:\Windows\System\BFpyboo.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\iVcNlWl.exe
  C:\Windows\System\iVcNlWl.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\ENAYIUj.exe
  C:\Windows\System\ENAYIUj.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\eIfVIkx.exe
  C:\Windows\System\eIfVIkx.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\eDmRCDV.exe
  C:\Windows\System\eDmRCDV.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\BllAret.exe
  C:\Windows\System\BllAret.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\LplghYk.exe
  C:\Windows\System\LplghYk.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\vQQWnlp.exe
  C:\Windows\System\vQQWnlp.exe
  2⤵
  PID:4876
- C:\Windows\System\AwbNqJZ.exe
  C:\Windows\System\AwbNqJZ.exe
  2⤵
  PID:1928
- C:\Windows\System\PwUPluI.exe
  C:\Windows\System\PwUPluI.exe
  2⤵
  PID:3728
- C:\Windows\System\ZGReiLr.exe
  C:\Windows\System\ZGReiLr.exe
  2⤵
  PID:3344
- C:\Windows\System\pIdpRRc.exe
  C:\Windows\System\pIdpRRc.exe
  2⤵
  PID:2124
- C:\Windows\System\QYukvDR.exe
  C:\Windows\System\QYukvDR.exe
  2⤵
  PID:3752
- C:\Windows\System\iFwqEwb.exe
  C:\Windows\System\iFwqEwb.exe
  2⤵
  PID:3276
- C:\Windows\System\dalnoYo.exe
  C:\Windows\System\dalnoYo.exe
  2⤵
  PID:4964
- C:\Windows\System\lXSzCDL.exe
  C:\Windows\System\lXSzCDL.exe
  2⤵
  PID:2288
- C:\Windows\System\QdZXZSC.exe
  C:\Windows\System\QdZXZSC.exe
  2⤵
  PID:1424
- C:\Windows\System\UUfDESd.exe
  C:\Windows\System\UUfDESd.exe
  2⤵
  PID:1776
- C:\Windows\System\ROgtuVk.exe
  C:\Windows\System\ROgtuVk.exe
  2⤵
  PID:2036
- C:\Windows\System\dXUpazZ.exe
  C:\Windows\System\dXUpazZ.exe
  2⤵
  PID:4824
- C:\Windows\System\YIDlhBZ.exe
  C:\Windows\System\YIDlhBZ.exe
  2⤵
  PID:4024
- C:\Windows\System\LURRIoQ.exe
  C:\Windows\System\LURRIoQ.exe
  2⤵
  PID:1896
- C:\Windows\System\LGGtqpP.exe
  C:\Windows\System\LGGtqpP.exe
  2⤵
  PID:1472
- C:\Windows\System\VqbQSLE.exe
  C:\Windows\System\VqbQSLE.exe
  2⤵
  PID:4968
- C:\Windows\System\Yikdimx.exe
  C:\Windows\System\Yikdimx.exe
  2⤵
  PID:4072
- C:\Windows\System\IQezjee.exe
  C:\Windows\System\IQezjee.exe
  2⤵
  PID:3192
- C:\Windows\System\GUexvYS.exe
  C:\Windows\System\GUexvYS.exe
  2⤵
  PID:2056
- C:\Windows\System\NDUBusi.exe
  C:\Windows\System\NDUBusi.exe
  2⤵
  PID:5128
- C:\Windows\System\GytdWnO.exe
  C:\Windows\System\GytdWnO.exe
  2⤵
  PID:5144
- C:\Windows\System\kluDByY.exe
  C:\Windows\System\kluDByY.exe
  2⤵
  PID:5168
- C:\Windows\System\NqbltVi.exe
  C:\Windows\System\NqbltVi.exe
  2⤵
  PID:5188
- C:\Windows\System\vOTuVZx.exe
  C:\Windows\System\vOTuVZx.exe
  2⤵
  PID:5216
- C:\Windows\System\fsMjZhn.exe
  C:\Windows\System\fsMjZhn.exe
  2⤵
  PID:5240
- C:\Windows\System\kvpXgjc.exe
  C:\Windows\System\kvpXgjc.exe
  2⤵
  PID:5264
- C:\Windows\System\xROFPkw.exe
  C:\Windows\System\xROFPkw.exe
  2⤵
  PID:5284
- C:\Windows\System\clzJMft.exe
  C:\Windows\System\clzJMft.exe
  2⤵
  PID:5304
- C:\Windows\System\LWuhhKb.exe
  C:\Windows\System\LWuhhKb.exe
  2⤵
  PID:5328
- C:\Windows\System\JpBBHGs.exe
  C:\Windows\System\JpBBHGs.exe
  2⤵
  PID:5352
- C:\Windows\System\sGBaZYS.exe
  C:\Windows\System\sGBaZYS.exe
  2⤵
  PID:5368
- C:\Windows\System\kBxrpGu.exe
  C:\Windows\System\kBxrpGu.exe
  2⤵
  PID:5392
- C:\Windows\System\kxwbUEv.exe
  C:\Windows\System\kxwbUEv.exe
  2⤵
  PID:5408
- C:\Windows\System\QlioSXR.exe
  C:\Windows\System\QlioSXR.exe
  2⤵
  PID:5424
- C:\Windows\System\bhpPLRM.exe
  C:\Windows\System\bhpPLRM.exe
  2⤵
  PID:5440
- C:\Windows\System\uUaWPtw.exe
  C:\Windows\System\uUaWPtw.exe
  2⤵
  PID:5472
- C:\Windows\System\nbZpusB.exe
  C:\Windows\System\nbZpusB.exe
  2⤵
  PID:5508
- C:\Windows\System\nLJXzqu.exe
  C:\Windows\System\nLJXzqu.exe
  2⤵
  PID:5528
- C:\Windows\System\gYTlKjs.exe
  C:\Windows\System\gYTlKjs.exe
  2⤵
  PID:5548
- C:\Windows\System\TAggnvf.exe
  C:\Windows\System\TAggnvf.exe
  2⤵
  PID:5568
- C:\Windows\System\KKkCCGj.exe
  C:\Windows\System\KKkCCGj.exe
  2⤵
  PID:5640
- C:\Windows\System\oyKJFYR.exe
  C:\Windows\System\oyKJFYR.exe
  2⤵
  PID:5664
- C:\Windows\System\NjbGjXH.exe
  C:\Windows\System\NjbGjXH.exe
  2⤵
  PID:5688
- C:\Windows\System\EdxPShZ.exe
  C:\Windows\System\EdxPShZ.exe
  2⤵
  PID:5704
- C:\Windows\System\HYNAiXW.exe
  C:\Windows\System\HYNAiXW.exe
  2⤵
  PID:5720
- C:\Windows\System\XcHpbnw.exe
  C:\Windows\System\XcHpbnw.exe
  2⤵
  PID:5736
- C:\Windows\System\sbyoUzW.exe
  C:\Windows\System\sbyoUzW.exe
  2⤵
  PID:5752
- C:\Windows\System\NqjrOFY.exe
  C:\Windows\System\NqjrOFY.exe
  2⤵
  PID:5772
- C:\Windows\System\lIoKqhD.exe
  C:\Windows\System\lIoKqhD.exe
  2⤵
  PID:5792
- C:\Windows\System\rTUAiwd.exe
  C:\Windows\System\rTUAiwd.exe
  2⤵
  PID:5812
- C:\Windows\System\AkqxDsU.exe
  C:\Windows\System\AkqxDsU.exe
  2⤵
  PID:5828
- C:\Windows\System\TaVJOVp.exe
  C:\Windows\System\TaVJOVp.exe
  2⤵
  PID:5844
- C:\Windows\System\Hcyofyp.exe
  C:\Windows\System\Hcyofyp.exe
  2⤵
  PID:5868
- C:\Windows\System\QiqJSLa.exe
  C:\Windows\System\QiqJSLa.exe
  2⤵
  PID:5908
- C:\Windows\System\bvACEcL.exe
  C:\Windows\System\bvACEcL.exe
  2⤵
  PID:5928
- C:\Windows\System\PuRVLXS.exe
  C:\Windows\System\PuRVLXS.exe
  2⤵
  PID:5944
- C:\Windows\System\KeRNitq.exe
  C:\Windows\System\KeRNitq.exe
  2⤵
  PID:5972
- C:\Windows\System\dzWLhzO.exe
  C:\Windows\System\dzWLhzO.exe
  2⤵
  PID:5988
- C:\Windows\System\Pyudtwl.exe
  C:\Windows\System\Pyudtwl.exe
  2⤵
  PID:6012
- C:\Windows\System\pAPYSdi.exe
  C:\Windows\System\pAPYSdi.exe
  2⤵
  PID:6032
- C:\Windows\System\OFHQGAg.exe
  C:\Windows\System\OFHQGAg.exe
  2⤵
  PID:6052
- C:\Windows\System\ElqypSf.exe
  C:\Windows\System\ElqypSf.exe
  2⤵
  PID:6068
- C:\Windows\System\eNAhoTe.exe
  C:\Windows\System\eNAhoTe.exe
  2⤵
  PID:6116
- C:\Windows\System\QYYUNyu.exe
  C:\Windows\System\QYYUNyu.exe
  2⤵
  PID:6140
- C:\Windows\System\cOwrjov.exe
  C:\Windows\System\cOwrjov.exe
  2⤵
  PID:4572
- C:\Windows\System\dOTfPIp.exe
  C:\Windows\System\dOTfPIp.exe
  2⤵
  PID:1760
- C:\Windows\System\MojEFae.exe
  C:\Windows\System\MojEFae.exe
  2⤵
  PID:864
- C:\Windows\System\LgafxsZ.exe
  C:\Windows\System\LgafxsZ.exe
  2⤵
  PID:3540
- C:\Windows\System\oaJWGmY.exe
  C:\Windows\System\oaJWGmY.exe
  2⤵
  PID:428
- C:\Windows\System\qlakxGr.exe
  C:\Windows\System\qlakxGr.exe
  2⤵
  PID:3060
- C:\Windows\System\rRKWaph.exe
  C:\Windows\System\rRKWaph.exe
  2⤵
  PID:5280
- C:\Windows\System\xBDjzMD.exe
  C:\Windows\System\xBDjzMD.exe
  2⤵
  PID:5324
- C:\Windows\System\PjQrAze.exe
  C:\Windows\System\PjQrAze.exe
  2⤵
  PID:5364
- C:\Windows\System\gbbXYbF.exe
  C:\Windows\System\gbbXYbF.exe
  2⤵
  PID:3636
- C:\Windows\System\qGSvssh.exe
  C:\Windows\System\qGSvssh.exe
  2⤵
  PID:4152
- C:\Windows\System\dHKtOob.exe
  C:\Windows\System\dHKtOob.exe
  2⤵
  PID:5272
- C:\Windows\System\SdlFauQ.exe
  C:\Windows\System\SdlFauQ.exe
  2⤵
  PID:4668
- C:\Windows\System\MCpXqYp.exe
  C:\Windows\System\MCpXqYp.exe
  2⤵
  PID:3928
- C:\Windows\System\OhXhHXR.exe
  C:\Windows\System\OhXhHXR.exe
  2⤵
  PID:5964
- C:\Windows\System\OLtceZa.exe
  C:\Windows\System\OLtceZa.exe
  2⤵
  PID:6084
- C:\Windows\System\iZVWTDd.exe
  C:\Windows\System\iZVWTDd.exe
  2⤵
  PID:6132
- C:\Windows\System\OJMkQAM.exe
  C:\Windows\System\OJMkQAM.exe
  2⤵
  PID:3148
- C:\Windows\System\KlYTmKc.exe
  C:\Windows\System\KlYTmKc.exe
  2⤵
  PID:4872
- C:\Windows\System\EiqsCHA.exe
  C:\Windows\System\EiqsCHA.exe
  2⤵
  PID:5348
- C:\Windows\System\xslpwrV.exe
  C:\Windows\System\xslpwrV.exe
  2⤵
  PID:5520
- C:\Windows\System\IPzpSOy.exe
  C:\Windows\System\IPzpSOy.exe
  2⤵
  PID:4848
- C:\Windows\System\GXBHbMD.exe
  C:\Windows\System\GXBHbMD.exe
  2⤵
  PID:4852
- C:\Windows\System\hdbVdsi.exe
  C:\Windows\System\hdbVdsi.exe
  2⤵
  PID:804
- C:\Windows\System\FTNbCcf.exe
  C:\Windows\System\FTNbCcf.exe
  2⤵
  PID:5300
- C:\Windows\System\UgPaeIo.exe
  C:\Windows\System\UgPaeIo.exe
  2⤵
  PID:2880
- C:\Windows\System\gPUWNhq.exe
  C:\Windows\System\gPUWNhq.exe
  2⤵
  PID:376
- C:\Windows\System\mFNXaWC.exe
  C:\Windows\System\mFNXaWC.exe
  2⤵
  PID:888
- C:\Windows\System\LyrPypU.exe
  C:\Windows\System\LyrPypU.exe
  2⤵
  PID:556
- C:\Windows\System\uonFQLN.exe
  C:\Windows\System\uonFQLN.exe
  2⤵
  PID:3024
- C:\Windows\System\QolEayK.exe
  C:\Windows\System\QolEayK.exe
  2⤵
  PID:2680
- C:\Windows\System\PAvHNTW.exe
  C:\Windows\System\PAvHNTW.exe
  2⤵
  PID:456
- C:\Windows\System\qnkIRZY.exe
  C:\Windows\System\qnkIRZY.exe
  2⤵
  PID:4440
- C:\Windows\System\IfsAACK.exe
  C:\Windows\System\IfsAACK.exe
  2⤵
  PID:2772
- C:\Windows\System\zWmLRcT.exe
  C:\Windows\System\zWmLRcT.exe
  2⤵
  PID:3172
- C:\Windows\System\dKdglPy.exe
  C:\Windows\System\dKdglPy.exe
  2⤵
  PID:3548
- C:\Windows\System\ZgZBwDu.exe
  C:\Windows\System\ZgZBwDu.exe
  2⤵
  PID:3484
- C:\Windows\System\yUmVBOL.exe
  C:\Windows\System\yUmVBOL.exe
  2⤵
  PID:1108
- C:\Windows\System\lQmnjNW.exe
  C:\Windows\System\lQmnjNW.exe
  2⤵
  PID:2852
- C:\Windows\System\fGdsBSj.exe
  C:\Windows\System\fGdsBSj.exe
  2⤵
  PID:2376
- C:\Windows\System\eZQXfih.exe
  C:\Windows\System\eZQXfih.exe
  2⤵
  PID:5536
- C:\Windows\System\ADAevtC.exe
  C:\Windows\System\ADAevtC.exe
  2⤵
  PID:5676
- C:\Windows\System\elCQidB.exe
  C:\Windows\System\elCQidB.exe
  2⤵
  PID:2316
- C:\Windows\System\DNLmqvP.exe
  C:\Windows\System\DNLmqvP.exe
  2⤵
  PID:6160
- C:\Windows\System\BPPnQfT.exe
  C:\Windows\System\BPPnQfT.exe
  2⤵
  PID:6184
- C:\Windows\System\CWKNMrT.exe
  C:\Windows\System\CWKNMrT.exe
  2⤵
  PID:6208
- C:\Windows\System\WYoRHcu.exe
  C:\Windows\System\WYoRHcu.exe
  2⤵
  PID:6232
- C:\Windows\System\zmPpdDV.exe
  C:\Windows\System\zmPpdDV.exe
  2⤵
  PID:6256
- C:\Windows\System\KgVNjQU.exe
  C:\Windows\System\KgVNjQU.exe
  2⤵
  PID:6276
- C:\Windows\System\PBJErwv.exe
  C:\Windows\System\PBJErwv.exe
  2⤵
  PID:6296
- C:\Windows\System\eLSFFiR.exe
  C:\Windows\System\eLSFFiR.exe
  2⤵
  PID:6320
- C:\Windows\System\kYjZHLC.exe
  C:\Windows\System\kYjZHLC.exe
  2⤵
  PID:6372
- C:\Windows\System\IeMyAni.exe
  C:\Windows\System\IeMyAni.exe
  2⤵
  PID:6396
- C:\Windows\System\YNeafOu.exe
  C:\Windows\System\YNeafOu.exe
  2⤵
  PID:6416
- C:\Windows\System\OwBOKME.exe
  C:\Windows\System\OwBOKME.exe
  2⤵
  PID:6440
- C:\Windows\System\gCRIXco.exe
  C:\Windows\System\gCRIXco.exe
  2⤵
  PID:6464
- C:\Windows\System\pczJEwN.exe
  C:\Windows\System\pczJEwN.exe
  2⤵
  PID:6496
- C:\Windows\System\lChMdOQ.exe
  C:\Windows\System\lChMdOQ.exe
  2⤵
  PID:6520
- C:\Windows\System\llcxrwc.exe
  C:\Windows\System\llcxrwc.exe
  2⤵
  PID:6544
- C:\Windows\System\GJJhnRj.exe
  C:\Windows\System\GJJhnRj.exe
  2⤵
  PID:6568
- C:\Windows\System\diUWfWO.exe
  C:\Windows\System\diUWfWO.exe
  2⤵
  PID:6584
- C:\Windows\System\fIqYkgX.exe
  C:\Windows\System\fIqYkgX.exe
  2⤵
  PID:6604
- C:\Windows\System\auwsTZI.exe
  C:\Windows\System\auwsTZI.exe
  2⤵
  PID:6628
- C:\Windows\System\oDwqoUG.exe
  C:\Windows\System\oDwqoUG.exe
  2⤵
  PID:6656
- C:\Windows\System\lBfXWCU.exe
  C:\Windows\System\lBfXWCU.exe
  2⤵
  PID:6680
- C:\Windows\System\gYFGBla.exe
  C:\Windows\System\gYFGBla.exe
  2⤵
  PID:6708
- C:\Windows\System\VwFfuRf.exe
  C:\Windows\System\VwFfuRf.exe
  2⤵
  PID:6736
- C:\Windows\System\LwCGEpd.exe
  C:\Windows\System\LwCGEpd.exe
  2⤵
  PID:6752
- C:\Windows\System\favNPpM.exe
  C:\Windows\System\favNPpM.exe
  2⤵
  PID:6780
- C:\Windows\System\ELDaEmy.exe
  C:\Windows\System\ELDaEmy.exe
  2⤵
  PID:6808
- C:\Windows\System\ClBHyEK.exe
  C:\Windows\System\ClBHyEK.exe
  2⤵
  PID:6836
- C:\Windows\System\FAkLJJw.exe
  C:\Windows\System\FAkLJJw.exe
  2⤵
  PID:6856
- C:\Windows\System\HRZlOvz.exe
  C:\Windows\System\HRZlOvz.exe
  2⤵
  PID:6884
- C:\Windows\System\tuuZITx.exe
  C:\Windows\System\tuuZITx.exe
  2⤵
  PID:6904
- C:\Windows\System\DBRgXEb.exe
  C:\Windows\System\DBRgXEb.exe
  2⤵
  PID:6920
- C:\Windows\System\CvfzKfV.exe
  C:\Windows\System\CvfzKfV.exe
  2⤵
  PID:6940
- C:\Windows\System\MuXABoi.exe
  C:\Windows\System\MuXABoi.exe
  2⤵
  PID:6960
- C:\Windows\System\FYlRhZf.exe
  C:\Windows\System\FYlRhZf.exe
  2⤵
  PID:6988
- C:\Windows\System\dQlAEDb.exe
  C:\Windows\System\dQlAEDb.exe
  2⤵
  PID:7012
- C:\Windows\System\RaTMXMO.exe
  C:\Windows\System\RaTMXMO.exe
  2⤵
  PID:7036
- C:\Windows\System\ZFFoQHO.exe
  C:\Windows\System\ZFFoQHO.exe
  2⤵
  PID:7056
- C:\Windows\System\dGAbpJe.exe
  C:\Windows\System\dGAbpJe.exe
  2⤵
  PID:7084
- C:\Windows\System\OofqrAM.exe
  C:\Windows\System\OofqrAM.exe
  2⤵
  PID:7108
- C:\Windows\System\pvdQlFb.exe
  C:\Windows\System\pvdQlFb.exe
  2⤵
  PID:7132
- C:\Windows\System\oNaGHoS.exe
  C:\Windows\System\oNaGHoS.exe
  2⤵
  PID:7152
- C:\Windows\System\oLfKDgu.exe
  C:\Windows\System\oLfKDgu.exe
  2⤵
  PID:2328
- C:\Windows\System\LtAedpz.exe
  C:\Windows\System\LtAedpz.exe
  2⤵
  PID:1952
- C:\Windows\System\BvrTOng.exe
  C:\Windows\System\BvrTOng.exe
  2⤵
  PID:2652
- C:\Windows\System\cInUZqw.exe
  C:\Windows\System\cInUZqw.exe
  2⤵
  PID:2088
- C:\Windows\System\UFDjwiE.exe
  C:\Windows\System\UFDjwiE.exe
  2⤵
  PID:1416
- C:\Windows\System\dsSaDYm.exe
  C:\Windows\System\dsSaDYm.exe
  2⤵
  PID:4512
- C:\Windows\System\tzCPGHE.exe
  C:\Windows\System\tzCPGHE.exe
  2⤵
  PID:4148
- C:\Windows\System\JgIxEij.exe
  C:\Windows\System\JgIxEij.exe
  2⤵
  PID:6152
- C:\Windows\System\uvxsKBJ.exe
  C:\Windows\System\uvxsKBJ.exe
  2⤵
  PID:6196
- C:\Windows\System\JvnkCHW.exe
  C:\Windows\System\JvnkCHW.exe
  2⤵
  PID:6240
- C:\Windows\System\oaCOnpZ.exe
  C:\Windows\System\oaCOnpZ.exe
  2⤵
  PID:6284
- C:\Windows\System\OiWzogO.exe
  C:\Windows\System\OiWzogO.exe
  2⤵
  PID:5248
- C:\Windows\System\RVNtiZv.exe
  C:\Windows\System\RVNtiZv.exe
  2⤵
  PID:3260
- C:\Windows\System\WyqjkHz.exe
  C:\Windows\System\WyqjkHz.exe
  2⤵
  PID:6388
- C:\Windows\System\VVCINEB.exe
  C:\Windows\System\VVCINEB.exe
  2⤵
  PID:6460
- C:\Windows\System\BoKxHnq.exe
  C:\Windows\System\BoKxHnq.exe
  2⤵
  PID:6576
- C:\Windows\System\oQcnQwr.exe
  C:\Windows\System\oQcnQwr.exe
  2⤵
  PID:6620
- C:\Windows\System\jtgnXqP.exe
  C:\Windows\System\jtgnXqP.exe
  2⤵
  PID:6636
- C:\Windows\System\yzWoDdl.exe
  C:\Windows\System\yzWoDdl.exe
  2⤵
  PID:6760
- C:\Windows\System\OOyBOFs.exe
  C:\Windows\System\OOyBOFs.exe
  2⤵
  PID:6820
- C:\Windows\System\SFEEkVg.exe
  C:\Windows\System\SFEEkVg.exe
  2⤵
  PID:6328
- C:\Windows\System\eFERZzl.exe
  C:\Windows\System\eFERZzl.exe
  2⤵
  PID:6892
- C:\Windows\System\CtOWigB.exe
  C:\Windows\System\CtOWigB.exe
  2⤵
  PID:6968
- C:\Windows\System\DBRSnHl.exe
  C:\Windows\System\DBRSnHl.exe
  2⤵
  PID:3012
- C:\Windows\System\wTIsCUB.exe
  C:\Windows\System\wTIsCUB.exe
  2⤵
  PID:7000
- C:\Windows\System\GFXpRIL.exe
  C:\Windows\System\GFXpRIL.exe
  2⤵
  PID:6428
- C:\Windows\System\QRHuYfE.exe
  C:\Windows\System\QRHuYfE.exe
  2⤵
  PID:4432
- C:\Windows\System\HIbejBo.exe
  C:\Windows\System\HIbejBo.exe
  2⤵
  PID:7096
- C:\Windows\System\NucxoCB.exe
  C:\Windows\System\NucxoCB.exe
  2⤵
  PID:6540
- C:\Windows\System\fqPJJZU.exe
  C:\Windows\System\fqPJJZU.exe
  2⤵
  PID:6616
- C:\Windows\System\VHzGAlW.exe
  C:\Windows\System\VHzGAlW.exe
  2⤵
  PID:3684
- C:\Windows\System\hKOgRMC.exe
  C:\Windows\System\hKOgRMC.exe
  2⤵
  PID:7188
- C:\Windows\System\PSLDCCT.exe
  C:\Windows\System\PSLDCCT.exe
  2⤵
  PID:7208
- C:\Windows\System\eVHEjCA.exe
  C:\Windows\System\eVHEjCA.exe
  2⤵
  PID:7232
- C:\Windows\System\QFJulOI.exe
  C:\Windows\System\QFJulOI.exe
  2⤵
  PID:7256
- C:\Windows\System\gmmDRRo.exe
  C:\Windows\System\gmmDRRo.exe
  2⤵
  PID:7280
- C:\Windows\System\yaSmvgu.exe
  C:\Windows\System\yaSmvgu.exe
  2⤵
  PID:7300
- C:\Windows\System\ifZhqdt.exe
  C:\Windows\System\ifZhqdt.exe
  2⤵
  PID:7332
- C:\Windows\System\ouFwDPs.exe
  C:\Windows\System\ouFwDPs.exe
  2⤵
  PID:7352
- C:\Windows\System\TZZwxka.exe
  C:\Windows\System\TZZwxka.exe
  2⤵
  PID:7376
- C:\Windows\System\ktKpEqi.exe
  C:\Windows\System\ktKpEqi.exe
  2⤵
  PID:7396
- C:\Windows\System\YorBBdy.exe
  C:\Windows\System\YorBBdy.exe
  2⤵
  PID:7420
- C:\Windows\System\PlUHAzf.exe
  C:\Windows\System\PlUHAzf.exe
  2⤵
  PID:7440
- C:\Windows\System\zsxEVDO.exe
  C:\Windows\System\zsxEVDO.exe
  2⤵
  PID:7464
- C:\Windows\System\obQeStj.exe
  C:\Windows\System\obQeStj.exe
  2⤵
  PID:7488
- C:\Windows\System\yjENQdn.exe
  C:\Windows\System\yjENQdn.exe
  2⤵
  PID:7508
- C:\Windows\System\LZMreRq.exe
  C:\Windows\System\LZMreRq.exe
  2⤵
  PID:7532
- C:\Windows\System\axODsOj.exe
  C:\Windows\System\axODsOj.exe
  2⤵
  PID:7556
- C:\Windows\System\OQdMHiH.exe
  C:\Windows\System\OQdMHiH.exe
  2⤵
  PID:7580
- C:\Windows\System\eKumiGQ.exe
  C:\Windows\System\eKumiGQ.exe
  2⤵
  PID:7600
- C:\Windows\System\vLZSUff.exe
  C:\Windows\System\vLZSUff.exe
  2⤵
  PID:7620
- C:\Windows\System\gsIwfRI.exe
  C:\Windows\System\gsIwfRI.exe
  2⤵
  PID:7644
- C:\Windows\System\LOLYimN.exe
  C:\Windows\System\LOLYimN.exe
  2⤵
  PID:7664
- C:\Windows\System\jbEtfFE.exe
  C:\Windows\System\jbEtfFE.exe
  2⤵
  PID:7688
- C:\Windows\System\kXhKBhP.exe
  C:\Windows\System\kXhKBhP.exe
  2⤵
  PID:7708
- C:\Windows\System\pByiwfd.exe
  C:\Windows\System\pByiwfd.exe
  2⤵
  PID:7732
- C:\Windows\System\EIirOSI.exe
  C:\Windows\System\EIirOSI.exe
  2⤵
  PID:7756
- C:\Windows\System\yHxcHeh.exe
  C:\Windows\System\yHxcHeh.exe
  2⤵
  PID:7776
- C:\Windows\System\whOEljD.exe
  C:\Windows\System\whOEljD.exe
  2⤵
  PID:7800
- C:\Windows\System\VRvgARj.exe
  C:\Windows\System\VRvgARj.exe
  2⤵
  PID:7828
- C:\Windows\System\pVuPYhw.exe
  C:\Windows\System\pVuPYhw.exe
  2⤵
  PID:7852
- C:\Windows\System\gBRLqrO.exe
  C:\Windows\System\gBRLqrO.exe
  2⤵
  PID:7876
- C:\Windows\System\XYKrLyl.exe
  C:\Windows\System\XYKrLyl.exe
  2⤵
  PID:7896
- C:\Windows\System\StKJXuJ.exe
  C:\Windows\System\StKJXuJ.exe
  2⤵
  PID:7916
- C:\Windows\System\qNUaaqA.exe
  C:\Windows\System\qNUaaqA.exe
  2⤵
  PID:7940
- C:\Windows\System\WPKnpxU.exe
  C:\Windows\System\WPKnpxU.exe
  2⤵
  PID:7964
- C:\Windows\System\cDXdEzd.exe
  C:\Windows\System\cDXdEzd.exe
  2⤵
  PID:7988
- C:\Windows\System\ZssDAjl.exe
  C:\Windows\System\ZssDAjl.exe
  2⤵
  PID:8016
- C:\Windows\System\yvCCAUU.exe
  C:\Windows\System\yvCCAUU.exe
  2⤵
  PID:8040
- C:\Windows\System\ODXiWTt.exe
  C:\Windows\System\ODXiWTt.exe
  2⤵
  PID:8064
- C:\Windows\System\Nkxheah.exe
  C:\Windows\System\Nkxheah.exe
  2⤵
  PID:8084
- C:\Windows\System\bNuubuI.exe
  C:\Windows\System\bNuubuI.exe
  2⤵
  PID:8104
- C:\Windows\System\VfsfIbC.exe
  C:\Windows\System\VfsfIbC.exe
  2⤵
  PID:8132
- C:\Windows\System\nbXmqXb.exe
  C:\Windows\System\nbXmqXb.exe
  2⤵
  PID:8156
- C:\Windows\System\VTQGSMl.exe
  C:\Windows\System\VTQGSMl.exe
  2⤵
  PID:8180
- C:\Windows\System\OajTDKQ.exe
  C:\Windows\System\OajTDKQ.exe
  2⤵
  PID:5660
- C:\Windows\System\flPMWiN.exe
  C:\Windows\System\flPMWiN.exe
  2⤵
  PID:1000
- C:\Windows\System\NUPHhQS.exe
  C:\Windows\System\NUPHhQS.exe
  2⤵
  PID:6168
- C:\Windows\System\uYRyRLc.exe
  C:\Windows\System\uYRyRLc.exe
  2⤵
  PID:6192
- C:\Windows\System\hKqRHYX.exe
  C:\Windows\System\hKqRHYX.exe
  2⤵
  PID:6292
- C:\Windows\System\qaWNoWN.exe
  C:\Windows\System\qaWNoWN.exe
  2⤵
  PID:3992
- C:\Windows\System\FiQEXBd.exe
  C:\Windows\System\FiQEXBd.exe
  2⤵
  PID:6124
- C:\Windows\System\kjTjmZi.exe
  C:\Windows\System\kjTjmZi.exe
  2⤵
  PID:7024
- C:\Windows\System\MvDGRTj.exe
  C:\Windows\System\MvDGRTj.exe
  2⤵
  PID:2064
- C:\Windows\System\dfaRQva.exe
  C:\Windows\System\dfaRQva.exe
  2⤵
  PID:2960
- C:\Windows\System\ucfWuOD.exe
  C:\Windows\System\ucfWuOD.exe
  2⤵
  PID:5952
- C:\Windows\System\fiPkETA.exe
  C:\Windows\System\fiPkETA.exe
  2⤵
  PID:5560
- C:\Windows\System\LFoETgC.exe
  C:\Windows\System\LFoETgC.exe
  2⤵
  PID:7412
- C:\Windows\System\RKaIdqp.exe
  C:\Windows\System\RKaIdqp.exe
  2⤵
  PID:7456
- C:\Windows\System\EvltCeD.exe
  C:\Windows\System\EvltCeD.exe
  2⤵
  PID:7496
- C:\Windows\System\ZewghKt.exe
  C:\Windows\System\ZewghKt.exe
  2⤵
  PID:6724
- C:\Windows\System\OxIdCwN.exe
  C:\Windows\System\OxIdCwN.exe
  2⤵
  PID:7636
- C:\Windows\System\EFxcvmI.exe
  C:\Windows\System\EFxcvmI.exe
  2⤵
  PID:8200
- C:\Windows\System\zHHRuMx.exe
  C:\Windows\System\zHHRuMx.exe
  2⤵
  PID:8228
- C:\Windows\System\fqChLNn.exe
  C:\Windows\System\fqChLNn.exe
  2⤵
  PID:8252
- C:\Windows\System\sNlGsql.exe
  C:\Windows\System\sNlGsql.exe
  2⤵
  PID:8272
- C:\Windows\System\dOfjpzS.exe
  C:\Windows\System\dOfjpzS.exe
  2⤵
  PID:8292
- C:\Windows\System\rAkkrHp.exe
  C:\Windows\System\rAkkrHp.exe
  2⤵
  PID:8320
- C:\Windows\System\zrdwvgS.exe
  C:\Windows\System\zrdwvgS.exe
  2⤵
  PID:8340
- C:\Windows\System\xqEjKpv.exe
  C:\Windows\System\xqEjKpv.exe
  2⤵
  PID:8364
- C:\Windows\System\UymxlZE.exe
  C:\Windows\System\UymxlZE.exe
  2⤵
  PID:8388
- C:\Windows\System\ObXpGOR.exe
  C:\Windows\System\ObXpGOR.exe
  2⤵
  PID:8412
- C:\Windows\System\WNDxKsu.exe
  C:\Windows\System\WNDxKsu.exe
  2⤵
  PID:8440
- C:\Windows\System\UzOBZsA.exe
  C:\Windows\System\UzOBZsA.exe
  2⤵
  PID:8460
- C:\Windows\System\lZzGRtS.exe
  C:\Windows\System\lZzGRtS.exe
  2⤵
  PID:8480
- C:\Windows\System\SiArxwc.exe
  C:\Windows\System\SiArxwc.exe
  2⤵
  PID:8504
- C:\Windows\System\ZZZlBmD.exe
  C:\Windows\System\ZZZlBmD.exe
  2⤵
  PID:8524
- C:\Windows\System\qIoUXCg.exe
  C:\Windows\System\qIoUXCg.exe
  2⤵
  PID:8556
- C:\Windows\System\VzqDWfs.exe
  C:\Windows\System\VzqDWfs.exe
  2⤵
  PID:8572
- C:\Windows\System\yVPWviM.exe
  C:\Windows\System\yVPWviM.exe
  2⤵
  PID:8588
- C:\Windows\System\BiApbce.exe
  C:\Windows\System\BiApbce.exe
  2⤵
  PID:8608
- C:\Windows\System\nbwEDDj.exe
  C:\Windows\System\nbwEDDj.exe
  2⤵
  PID:8632
- C:\Windows\System\PfrBAuK.exe
  C:\Windows\System\PfrBAuK.exe
  2⤵
  PID:8660
- C:\Windows\System\oklKhLK.exe
  C:\Windows\System\oklKhLK.exe
  2⤵
  PID:8680
- C:\Windows\System\ZIWpMph.exe
  C:\Windows\System\ZIWpMph.exe
  2⤵
  PID:8700
- C:\Windows\System\irqFbuh.exe
  C:\Windows\System\irqFbuh.exe
  2⤵
  PID:8716
- C:\Windows\System\yyHRgYx.exe
  C:\Windows\System\yyHRgYx.exe
  2⤵
  PID:8744
- C:\Windows\System\efXuhTX.exe
  C:\Windows\System\efXuhTX.exe
  2⤵
  PID:8768
- C:\Windows\System\ndGvPqa.exe
  C:\Windows\System\ndGvPqa.exe
  2⤵
  PID:8792
- C:\Windows\System\BjAIdSL.exe
  C:\Windows\System\BjAIdSL.exe
  2⤵
  PID:8816
- C:\Windows\System\bXaPnUv.exe
  C:\Windows\System\bXaPnUv.exe
  2⤵
  PID:8840
- C:\Windows\System\MkcZqgI.exe
  C:\Windows\System\MkcZqgI.exe
  2⤵
  PID:8864
- C:\Windows\System\ShsXRkU.exe
  C:\Windows\System\ShsXRkU.exe
  2⤵
  PID:8888
- C:\Windows\System\fTrKTOA.exe
  C:\Windows\System\fTrKTOA.exe
  2⤵
  PID:8916
- C:\Windows\System\OLaRTPL.exe
  C:\Windows\System\OLaRTPL.exe
  2⤵
  PID:8936
- C:\Windows\System\qxAVxXu.exe
  C:\Windows\System\qxAVxXu.exe
  2⤵
  PID:8968
- C:\Windows\System\WyGughY.exe
  C:\Windows\System\WyGughY.exe
  2⤵
  PID:8988
- C:\Windows\System\vTTdcMa.exe
  C:\Windows\System\vTTdcMa.exe
  2⤵
  PID:9008
- C:\Windows\System\EfxaKQJ.exe
  C:\Windows\System\EfxaKQJ.exe
  2⤵
  PID:9032
- C:\Windows\System\BtZWZnI.exe
  C:\Windows\System\BtZWZnI.exe
  2⤵
  PID:9060
- C:\Windows\System\bxfProg.exe
  C:\Windows\System\bxfProg.exe
  2⤵
  PID:9084
- C:\Windows\System\amnDGja.exe
  C:\Windows\System\amnDGja.exe
  2⤵
  PID:9104
- C:\Windows\System\ImnGPgE.exe
  C:\Windows\System\ImnGPgE.exe
  2⤵
  PID:9128
- C:\Windows\System\uJNOnCO.exe
  C:\Windows\System\uJNOnCO.exe
  2⤵
  PID:9148
- C:\Windows\System\zPCIMdP.exe
  C:\Windows\System\zPCIMdP.exe
  2⤵
  PID:9168
- C:\Windows\System\voLHrAr.exe
  C:\Windows\System\voLHrAr.exe
  2⤵
  PID:9188
- C:\Windows\System\szCKwKu.exe
  C:\Windows\System\szCKwKu.exe
  2⤵
  PID:9212
- C:\Windows\System\msptclv.exe
  C:\Windows\System\msptclv.exe
  2⤵
  PID:7064
- C:\Windows\System\UurUNPw.exe
  C:\Windows\System\UurUNPw.exe
  2⤵
  PID:7820
- C:\Windows\System\wSNRMbe.exe
  C:\Windows\System\wSNRMbe.exe
  2⤵
  PID:6424
- C:\Windows\System\zZMIKqi.exe
  C:\Windows\System\zZMIKqi.exe
  2⤵
  PID:7144
- C:\Windows\System\mhHuipu.exe
  C:\Windows\System\mhHuipu.exe
  2⤵
  PID:8032
- C:\Windows\System\kwKVUhG.exe
  C:\Windows\System\kwKVUhG.exe
  2⤵
  PID:1408
- C:\Windows\System\UnjMRRv.exe
  C:\Windows\System\UnjMRRv.exe
  2⤵
  PID:8100
- C:\Windows\System\ejbGZxN.exe
  C:\Windows\System\ejbGZxN.exe
  2⤵
  PID:8164
- C:\Windows\System\RIzzRrv.exe
  C:\Windows\System\RIzzRrv.exe
  2⤵
  PID:6224
- C:\Windows\System\etMFfih.exe
  C:\Windows\System\etMFfih.exe
  2⤵
  PID:748
- C:\Windows\System\WMFEvLS.exe
  C:\Windows\System\WMFEvLS.exe
  2⤵
  PID:6488
- C:\Windows\System\hxyyXwE.exe
  C:\Windows\System\hxyyXwE.exe
  2⤵
  PID:6512
- C:\Windows\System\NJGiwGj.exe
  C:\Windows\System\NJGiwGj.exe
  2⤵
  PID:3412
- C:\Windows\System\AcrAFtK.exe
  C:\Windows\System\AcrAFtK.exe
  2⤵
  PID:6304
- C:\Windows\System\rguyJBM.exe
  C:\Windows\System\rguyJBM.exe
  2⤵
  PID:8196
- C:\Windows\System\xkhyJoz.exe
  C:\Windows\System\xkhyJoz.exe
  2⤵
  PID:7724
- C:\Windows\System\qCMIOzk.exe
  C:\Windows\System\qCMIOzk.exe
  2⤵
  PID:7772
- C:\Windows\System\sqUpzvQ.exe
  C:\Windows\System\sqUpzvQ.exe
  2⤵
  PID:9248
- C:\Windows\System\KqvxVuy.exe
  C:\Windows\System\KqvxVuy.exe
  2⤵
  PID:9268
- C:\Windows\System\zAstNmW.exe
  C:\Windows\System\zAstNmW.exe
  2⤵
  PID:9288
- C:\Windows\System\KeAkLAo.exe
  C:\Windows\System\KeAkLAo.exe
  2⤵
  PID:9312
- C:\Windows\System\XuCmWXQ.exe
  C:\Windows\System\XuCmWXQ.exe
  2⤵
  PID:9340
- C:\Windows\System\HTAHbcx.exe
  C:\Windows\System\HTAHbcx.exe
  2⤵
  PID:9364
- C:\Windows\System\vMYLurY.exe
  C:\Windows\System\vMYLurY.exe
  2⤵
  PID:9388
- C:\Windows\System\BjqZLLS.exe
  C:\Windows\System\BjqZLLS.exe
  2⤵
  PID:9408
- C:\Windows\System\hPVOLDO.exe
  C:\Windows\System\hPVOLDO.exe
  2⤵
  PID:9428
- C:\Windows\System\DJYQFMq.exe
  C:\Windows\System\DJYQFMq.exe
  2⤵
  PID:9448
- C:\Windows\System\fnMSClW.exe
  C:\Windows\System\fnMSClW.exe
  2⤵
  PID:9468
- C:\Windows\System\uihZTAP.exe
  C:\Windows\System\uihZTAP.exe
  2⤵
  PID:9496
- C:\Windows\System\evnPAoP.exe
  C:\Windows\System\evnPAoP.exe
  2⤵
  PID:9524
- C:\Windows\System\ZQcidDN.exe
  C:\Windows\System\ZQcidDN.exe
  2⤵
  PID:9552
- C:\Windows\System\dsbXYMV.exe
  C:\Windows\System\dsbXYMV.exe
  2⤵
  PID:9572
- C:\Windows\System\SVYXJqf.exe
  C:\Windows\System\SVYXJqf.exe
  2⤵
  PID:9592
- C:\Windows\System\SLlRDdQ.exe
  C:\Windows\System\SLlRDdQ.exe
  2⤵
  PID:9612
- C:\Windows\System\fJyARoq.exe
  C:\Windows\System\fJyARoq.exe
  2⤵
  PID:9636
- C:\Windows\System\PbquZEK.exe
  C:\Windows\System\PbquZEK.exe
  2⤵
  PID:9660
- C:\Windows\System\txBnbTQ.exe
  C:\Windows\System\txBnbTQ.exe
  2⤵
  PID:9680
- C:\Windows\System\YhOdYhP.exe
  C:\Windows\System\YhOdYhP.exe
  2⤵
  PID:9704
- C:\Windows\System\rTzxzsK.exe
  C:\Windows\System\rTzxzsK.exe
  2⤵
  PID:9728
- C:\Windows\System\rqMmGTr.exe
  C:\Windows\System\rqMmGTr.exe
  2⤵
  PID:9744
- C:\Windows\System\GaugLeD.exe
  C:\Windows\System\GaugLeD.exe
  2⤵
  PID:9772
- C:\Windows\System\WUYfJMR.exe
  C:\Windows\System\WUYfJMR.exe
  2⤵
  PID:9800
- C:\Windows\System\pnBwXRz.exe
  C:\Windows\System\pnBwXRz.exe
  2⤵
  PID:9820
- C:\Windows\System\HowEREN.exe
  C:\Windows\System\HowEREN.exe
  2⤵
  PID:9844
- C:\Windows\System\NeyHzxB.exe
  C:\Windows\System\NeyHzxB.exe
  2⤵
  PID:9864
- C:\Windows\System\DzoygtJ.exe
  C:\Windows\System\DzoygtJ.exe
  2⤵
  PID:9892
- C:\Windows\System\cPLePiX.exe
  C:\Windows\System\cPLePiX.exe
  2⤵
  PID:9920
- C:\Windows\System\ZkPYyGI.exe
  C:\Windows\System\ZkPYyGI.exe
  2⤵
  PID:9948
- C:\Windows\System\LlBVfAa.exe
  C:\Windows\System\LlBVfAa.exe
  2⤵
  PID:9968
- C:\Windows\System\fUTZlUe.exe
  C:\Windows\System\fUTZlUe.exe
  2⤵
  PID:9992
- C:\Windows\System\VkpRtCZ.exe
  C:\Windows\System\VkpRtCZ.exe
  2⤵
  PID:10016
- C:\Windows\System\kbgZJDR.exe
  C:\Windows\System\kbgZJDR.exe
  2⤵
  PID:10040
- C:\Windows\System\jYbWVTo.exe
  C:\Windows\System\jYbWVTo.exe
  2⤵
  PID:10060
- C:\Windows\System\ikssoPr.exe
  C:\Windows\System\ikssoPr.exe
  2⤵
  PID:10088
- C:\Windows\System\XIoQOiR.exe
  C:\Windows\System\XIoQOiR.exe
  2⤵
  PID:10108
- C:\Windows\System\hjqWLsw.exe
  C:\Windows\System\hjqWLsw.exe
  2⤵
  PID:10132
- C:\Windows\System\mIHuQUx.exe
  C:\Windows\System\mIHuQUx.exe
  2⤵
  PID:8052
- C:\Windows\System\NbooopC.exe
  C:\Windows\System\NbooopC.exe
  2⤵
  PID:8784
- C:\Windows\System\wYgenlv.exe
  C:\Windows\System\wYgenlv.exe
  2⤵
  PID:7320
- C:\Windows\System\ApmsyLA.exe
  C:\Windows\System\ApmsyLA.exe
  2⤵
  PID:7360
- C:\Windows\System\NRTNNTg.exe
  C:\Windows\System\NRTNNTg.exe
  2⤵
  PID:9000
- C:\Windows\System\JmplGGk.exe
  C:\Windows\System\JmplGGk.exe
  2⤵
  PID:9072
- C:\Windows\System\bKxcYad.exe
  C:\Windows\System\bKxcYad.exe
  2⤵
  PID:7572
- C:\Windows\System\ZAlpheD.exe
  C:\Windows\System\ZAlpheD.exe
  2⤵
  PID:7128
- C:\Windows\System\ehpFyKw.exe
  C:\Windows\System\ehpFyKw.exe
  2⤵
  PID:7392
- C:\Windows\System\zsVPmnp.exe
  C:\Windows\System\zsVPmnp.exe
  2⤵
  PID:8148
- C:\Windows\System\TXaFNGk.exe
  C:\Windows\System\TXaFNGk.exe
  2⤵
  PID:7484
- C:\Windows\System\AxXCAkk.exe
  C:\Windows\System\AxXCAkk.exe
  2⤵
  PID:6956
- C:\Windows\System\HZAJhSl.exe
  C:\Windows\System\HZAJhSl.exe
  2⤵
  PID:7540
- C:\Windows\System\sANuKFF.exe
  C:\Windows\System\sANuKFF.exe
  2⤵
  PID:7092
- C:\Windows\System\OvQfTvR.exe
  C:\Windows\System\OvQfTvR.exe
  2⤵
  PID:8268
- C:\Windows\System\iDhzHsz.exe
  C:\Windows\System\iDhzHsz.exe
  2⤵
  PID:8356
- C:\Windows\System\aanInUU.exe
  C:\Windows\System\aanInUU.exe
  2⤵
  PID:8456
- C:\Windows\System\CXKrBnV.exe
  C:\Windows\System\CXKrBnV.exe
  2⤵
  PID:9416
- C:\Windows\System\WLGnsNC.exe
  C:\Windows\System\WLGnsNC.exe
  2⤵
  PID:9540
- C:\Windows\System\WtQStHX.exe
  C:\Windows\System\WtQStHX.exe
  2⤵
  PID:8752
- C:\Windows\System\yRVDHjF.exe
  C:\Windows\System\yRVDHjF.exe
  2⤵
  PID:9692
- C:\Windows\System\bidlaqp.exe
  C:\Windows\System\bidlaqp.exe
  2⤵
  PID:9736
- C:\Windows\System\heJsPwp.exe
  C:\Windows\System\heJsPwp.exe
  2⤵
  PID:9784
- C:\Windows\System\pdQVCDP.exe
  C:\Windows\System\pdQVCDP.exe
  2⤵
  PID:9912
- C:\Windows\System\ZRWYpvY.exe
  C:\Windows\System\ZRWYpvY.exe
  2⤵
  PID:9028
- C:\Windows\System\TpNZyAh.exe
  C:\Windows\System\TpNZyAh.exe
  2⤵
  PID:10248
- C:\Windows\System\oRljmvT.exe
  C:\Windows\System\oRljmvT.exe
  2⤵
  PID:10268
- C:\Windows\System\AMSrLQI.exe
  C:\Windows\System\AMSrLQI.exe
  2⤵
  PID:10288
- C:\Windows\System\IgFbaRy.exe
  C:\Windows\System\IgFbaRy.exe
  2⤵
  PID:10316
- C:\Windows\System\zXVkAsl.exe
  C:\Windows\System\zXVkAsl.exe
  2⤵
  PID:10336
- C:\Windows\System\VDjokTX.exe
  C:\Windows\System\VDjokTX.exe
  2⤵
  PID:10364
- C:\Windows\System\jmRjLpk.exe
  C:\Windows\System\jmRjLpk.exe
  2⤵
  PID:10388
- C:\Windows\System\wibgFhX.exe
  C:\Windows\System\wibgFhX.exe
  2⤵
  PID:10412
- C:\Windows\System\mtOzUaQ.exe
  C:\Windows\System\mtOzUaQ.exe
  2⤵
  PID:10448
- C:\Windows\System\GKzXYJO.exe
  C:\Windows\System\GKzXYJO.exe
  2⤵
  PID:10468
- C:\Windows\System\PQwtifN.exe
  C:\Windows\System\PQwtifN.exe
  2⤵
  PID:10500
- C:\Windows\System\YkfIlyD.exe
  C:\Windows\System\YkfIlyD.exe
  2⤵
  PID:10524
- C:\Windows\System\nflCyKp.exe
  C:\Windows\System\nflCyKp.exe
  2⤵
  PID:10544
- C:\Windows\System\wzumPEj.exe
  C:\Windows\System\wzumPEj.exe
  2⤵
  PID:10564
- C:\Windows\System\QxYXncu.exe
  C:\Windows\System\QxYXncu.exe
  2⤵
  PID:10584
- C:\Windows\System\KUtAwOC.exe
  C:\Windows\System\KUtAwOC.exe
  2⤵
  PID:10608
- C:\Windows\System\DZGqvNY.exe
  C:\Windows\System\DZGqvNY.exe
  2⤵
  PID:10632
- C:\Windows\System\UyOfhAc.exe
  C:\Windows\System\UyOfhAc.exe
  2⤵
  PID:10652
- C:\Windows\System\WcAPHAz.exe
  C:\Windows\System\WcAPHAz.exe
  2⤵
  PID:10668
- C:\Windows\System\Xokcspu.exe
  C:\Windows\System\Xokcspu.exe
  2⤵
  PID:10684
- C:\Windows\System\YDizHhQ.exe
  C:\Windows\System\YDizHhQ.exe
  2⤵
  PID:10700
- C:\Windows\System\jeuegWL.exe
  C:\Windows\System\jeuegWL.exe
  2⤵
  PID:10720
- C:\Windows\System\mKWLVZy.exe
  C:\Windows\System\mKWLVZy.exe
  2⤵
  PID:10752
- C:\Windows\System\aIRfYYJ.exe
  C:\Windows\System\aIRfYYJ.exe
  2⤵
  PID:10776
- C:\Windows\System\auVdbjK.exe
  C:\Windows\System\auVdbjK.exe
  2⤵
  PID:10800
- C:\Windows\System\VwLAZXQ.exe
  C:\Windows\System\VwLAZXQ.exe
  2⤵
  PID:10828
- C:\Windows\System\xpzgJyl.exe
  C:\Windows\System\xpzgJyl.exe
  2⤵
  PID:10864
- C:\Windows\System\GDhfjMY.exe
  C:\Windows\System\GDhfjMY.exe
  2⤵
  PID:10920
- C:\Windows\System\UNVqErz.exe
  C:\Windows\System\UNVqErz.exe
  2⤵
  PID:10952
- C:\Windows\System\yOxkSSB.exe
  C:\Windows\System\yOxkSSB.exe
  2⤵
  PID:10972
- C:\Windows\System\REjUelI.exe
  C:\Windows\System\REjUelI.exe
  2⤵
  PID:11000
- C:\Windows\System\TaoGczt.exe
  C:\Windows\System\TaoGczt.exe
  2⤵
  PID:11016
- C:\Windows\System\zmyEbWG.exe
  C:\Windows\System\zmyEbWG.exe
  2⤵
  PID:11040
- C:\Windows\System\hLtZSUy.exe
  C:\Windows\System\hLtZSUy.exe
  2⤵
  PID:11060
- C:\Windows\System\AThmGvI.exe
  C:\Windows\System\AThmGvI.exe
  2⤵
  PID:11084
- C:\Windows\System\nyCzLRB.exe
  C:\Windows\System\nyCzLRB.exe
  2⤵
  PID:11112
- C:\Windows\System\TTPjYYS.exe
  C:\Windows\System\TTPjYYS.exe
  2⤵
  PID:11148
- C:\Windows\System\bEBryOD.exe
  C:\Windows\System\bEBryOD.exe
  2⤵
  PID:11172
- C:\Windows\System\tRLelsA.exe
  C:\Windows\System\tRLelsA.exe
  2⤵
  PID:11196
- C:\Windows\System\kUDUKra.exe
  C:\Windows\System\kUDUKra.exe
  2⤵
  PID:11220
- C:\Windows\System\uvcFVKh.exe
  C:\Windows\System\uvcFVKh.exe
  2⤵
  PID:11248
- C:\Windows\System\gzYFUSl.exe
  C:\Windows\System\gzYFUSl.exe
  2⤵
  PID:9048
- C:\Windows\System\JhHYUYY.exe
  C:\Windows\System\JhHYUYY.exe
  2⤵
  PID:9156
- C:\Windows\System\bsmEQvB.exe
  C:\Windows\System\bsmEQvB.exe
  2⤵
  PID:7220
- C:\Windows\System\pGznPhG.exe
  C:\Windows\System\pGznPhG.exe
  2⤵
  PID:10208
- C:\Windows\System\irCFulw.exe
  C:\Windows\System\irCFulw.exe
  2⤵
  PID:3976
- C:\Windows\System\iZEDDyj.exe
  C:\Windows\System\iZEDDyj.exe
  2⤵
  PID:8288
- C:\Windows\System\jvQUKiA.exe
  C:\Windows\System\jvQUKiA.exe
  2⤵
  PID:8244
- C:\Windows\System\xRshckn.exe
  C:\Windows\System\xRshckn.exe
  2⤵
  PID:6536
- C:\Windows\System\PBRixAe.exe
  C:\Windows\System\PBRixAe.exe
  2⤵
  PID:9264
- C:\Windows\System\diwhCVl.exe
  C:\Windows\System\diwhCVl.exe
  2⤵
  PID:8476
- C:\Windows\System\HXtwxUi.exe
  C:\Windows\System\HXtwxUi.exe
  2⤵
  PID:9352
- C:\Windows\System\sBWULYo.exe
  C:\Windows\System\sBWULYo.exe
  2⤵
  PID:8584
- C:\Windows\System\PhFuzKV.exe
  C:\Windows\System\PhFuzKV.exe
  2⤵
  PID:8580
- C:\Windows\System\BZTXfJI.exe
  C:\Windows\System\BZTXfJI.exe
  2⤵
  PID:8904
- C:\Windows\System\YpRuwbG.exe
  C:\Windows\System\YpRuwbG.exe
  2⤵
  PID:9560
- C:\Windows\System\CSfJMpc.exe
  C:\Windows\System\CSfJMpc.exe
  2⤵
  PID:7564
- C:\Windows\System\XSVMMPB.exe
  C:\Windows\System\XSVMMPB.exe
  2⤵
  PID:7860
- C:\Windows\System\cNtjnxV.exe
  C:\Windows\System\cNtjnxV.exe
  2⤵
  PID:760
- C:\Windows\System\jElWfMO.exe
  C:\Windows\System\jElWfMO.exe
  2⤵
  PID:8780
- C:\Windows\System\fNJwOZg.exe
  C:\Windows\System\fNJwOZg.exe
  2⤵
  PID:8852
- C:\Windows\System\XekdbOU.exe
  C:\Windows\System\XekdbOU.exe
  2⤵
  PID:692
- C:\Windows\System\fUyztSy.exe
  C:\Windows\System\fUyztSy.exe
  2⤵
  PID:9812
- C:\Windows\System\uNaaQNh.exe
  C:\Windows\System\uNaaQNh.exe
  2⤵
  PID:9916
- C:\Windows\System\FuyJvWN.exe
  C:\Windows\System\FuyJvWN.exe
  2⤵
  PID:9016
- C:\Windows\System\qPgLnTk.exe
  C:\Windows\System\qPgLnTk.exe
  2⤵
  PID:11288
- C:\Windows\System\yApXbsH.exe
  C:\Windows\System\yApXbsH.exe
  2⤵
  PID:11312
- C:\Windows\System\SlCVmCx.exe
  C:\Windows\System\SlCVmCx.exe
  2⤵
  PID:11332
- C:\Windows\System\FgKIEsy.exe
  C:\Windows\System\FgKIEsy.exe
  2⤵
  PID:11356
- C:\Windows\System\uaaMavQ.exe
  C:\Windows\System\uaaMavQ.exe
  2⤵
  PID:11380
- C:\Windows\System\XZGWenm.exe
  C:\Windows\System\XZGWenm.exe
  2⤵
  PID:11404
- C:\Windows\System\dmiNfmc.exe
  C:\Windows\System\dmiNfmc.exe
  2⤵
  PID:11428
- C:\Windows\System\HfWsXCw.exe
  C:\Windows\System\HfWsXCw.exe
  2⤵
  PID:11452
- C:\Windows\System\KrPoSNt.exe
  C:\Windows\System\KrPoSNt.exe
  2⤵
  PID:11480
- C:\Windows\System\trKherj.exe
  C:\Windows\System\trKherj.exe
  2⤵
  PID:11504
- C:\Windows\System\eVOGReA.exe
  C:\Windows\System\eVOGReA.exe
  2⤵
  PID:11520
- C:\Windows\System\dDaoerX.exe
  C:\Windows\System\dDaoerX.exe
  2⤵
  PID:11536
- C:\Windows\System\StzvSxA.exe
  C:\Windows\System\StzvSxA.exe
  2⤵
  PID:11552
- C:\Windows\System\iZpHAoU.exe
  C:\Windows\System\iZpHAoU.exe
  2⤵
  PID:11568
- C:\Windows\System\ocEHvhM.exe
  C:\Windows\System\ocEHvhM.exe
  2⤵
  PID:11588
- C:\Windows\System\OkLmfCi.exe
  C:\Windows\System\OkLmfCi.exe
  2⤵
  PID:11604
- C:\Windows\System\ToXbFbi.exe
  C:\Windows\System\ToXbFbi.exe
  2⤵
  PID:11628
- C:\Windows\System\iVUFlKJ.exe
  C:\Windows\System\iVUFlKJ.exe
  2⤵
  PID:11652
- C:\Windows\System\BSfIXgS.exe
  C:\Windows\System\BSfIXgS.exe
  2⤵
  PID:11676
- C:\Windows\System\dLxKqTt.exe
  C:\Windows\System\dLxKqTt.exe
  2⤵
  PID:11704
- C:\Windows\System\qXRXGJy.exe
  C:\Windows\System\qXRXGJy.exe
  2⤵
  PID:11724
- C:\Windows\System\JCtrxHo.exe
  C:\Windows\System\JCtrxHo.exe
  2⤵
  PID:11744
- C:\Windows\System\yErcFIX.exe
  C:\Windows\System\yErcFIX.exe
  2⤵
  PID:11768
- C:\Windows\System\JPDTfkO.exe
  C:\Windows\System\JPDTfkO.exe
  2⤵
  PID:11792
- C:\Windows\System\zZfmjcV.exe
  C:\Windows\System\zZfmjcV.exe
  2⤵
  PID:11824
- C:\Windows\System\rMlaEka.exe
  C:\Windows\System\rMlaEka.exe
  2⤵
  PID:11840
- C:\Windows\System\azESAnC.exe
  C:\Windows\System\azESAnC.exe
  2⤵
  PID:11868
- C:\Windows\System\HoAnrMq.exe
  C:\Windows\System\HoAnrMq.exe
  2⤵
  PID:11888
- C:\Windows\System\rDgNewl.exe
  C:\Windows\System\rDgNewl.exe
  2⤵
  PID:11908
- C:\Windows\System\ZagYDxx.exe
  C:\Windows\System\ZagYDxx.exe
  2⤵
  PID:11928
- C:\Windows\System\UgJwABU.exe
  C:\Windows\System\UgJwABU.exe
  2⤵
  PID:11948
- C:\Windows\System\DHVlukp.exe
  C:\Windows\System\DHVlukp.exe
  2⤵
  PID:11972
- C:\Windows\System\WGYkmon.exe
  C:\Windows\System\WGYkmon.exe
  2⤵
  PID:11988
- C:\Windows\System\oTnRadL.exe
  C:\Windows\System\oTnRadL.exe
  2⤵
  PID:12012
- C:\Windows\System\OyZXZOH.exe
  C:\Windows\System\OyZXZOH.exe
  2⤵
  PID:12032
- C:\Windows\System\tmtgaLF.exe
  C:\Windows\System\tmtgaLF.exe
  2⤵
  PID:12052
- C:\Windows\System\BmSJimO.exe
  C:\Windows\System\BmSJimO.exe
  2⤵
  PID:12072
- C:\Windows\System\gCgdlUX.exe
  C:\Windows\System\gCgdlUX.exe
  2⤵
  PID:12092
- C:\Windows\System\HlJfbRX.exe
  C:\Windows\System\HlJfbRX.exe
  2⤵
  PID:12116
- C:\Windows\System\WhNekBK.exe
  C:\Windows\System\WhNekBK.exe
  2⤵
  PID:12136
- C:\Windows\System\JaJTTJq.exe
  C:\Windows\System\JaJTTJq.exe
  2⤵
  PID:12164
- C:\Windows\System\fJulBop.exe
  C:\Windows\System\fJulBop.exe
  2⤵
  PID:12200
- C:\Windows\System\UCgHkZs.exe
  C:\Windows\System\UCgHkZs.exe
  2⤵
  PID:12220
- C:\Windows\System\puCwngE.exe
  C:\Windows\System\puCwngE.exe
  2⤵
  PID:12244
- C:\Windows\System\MawZCsW.exe
  C:\Windows\System\MawZCsW.exe
  2⤵
  PID:12268
- C:\Windows\System\yMDlqDl.exe
  C:\Windows\System\yMDlqDl.exe
  2⤵
  PID:10260
- C:\Windows\System\CBAIygB.exe
  C:\Windows\System\CBAIygB.exe
  2⤵
  PID:10280
- C:\Windows\System\KczjfpE.exe
  C:\Windows\System\KczjfpE.exe
  2⤵
  PID:10300
- C:\Windows\System\gzapIUY.exe
  C:\Windows\System\gzapIUY.exe
  2⤵
  PID:10096
- C:\Windows\System\AsbDHNv.exe
  C:\Windows\System\AsbDHNv.exe
  2⤵
  PID:2560
- C:\Windows\System\GUKWOfp.exe
  C:\Windows\System\GUKWOfp.exe
  2⤵
  PID:10168
- C:\Windows\System\WrKdDyP.exe
  C:\Windows\System\WrKdDyP.exe
  2⤵
  PID:8024
- C:\Windows\System\vGKkfxT.exe
  C:\Windows\System\vGKkfxT.exe
  2⤵
  PID:10520
- C:\Windows\System\PeWPHFq.exe
  C:\Windows\System\PeWPHFq.exe
  2⤵
  PID:10604
- C:\Windows\System\kpmqYBI.exe
  C:\Windows\System\kpmqYBI.exe
  2⤵
  PID:10680
- C:\Windows\System\kchbYUx.exe
  C:\Windows\System\kchbYUx.exe
  2⤵
  PID:4784
- C:\Windows\System\ZdmTrXF.exe
  C:\Windows\System\ZdmTrXF.exe
  2⤵
  PID:10784
- C:\Windows\System\XZwFgeI.exe
  C:\Windows\System\XZwFgeI.exe
  2⤵
  PID:10840
- C:\Windows\System\jZgmcBE.exe
  C:\Windows\System\jZgmcBE.exe
  2⤵
  PID:10968
- C:\Windows\System\AUvgtTT.exe
  C:\Windows\System\AUvgtTT.exe
  2⤵
  PID:9460
- C:\Windows\System\whKqnCN.exe
  C:\Windows\System\whKqnCN.exe
  2⤵
  PID:11008
- C:\Windows\System\BetgUye.exe
  C:\Windows\System\BetgUye.exe
  2⤵
  PID:9532
- C:\Windows\System\QVcJVSW.exe
  C:\Windows\System\QVcJVSW.exe
  2⤵
  PID:11136
- C:\Windows\System\iSvBEMu.exe
  C:\Windows\System\iSvBEMu.exe
  2⤵
  PID:11180
- C:\Windows\System\xrZQvFS.exe
  C:\Windows\System\xrZQvFS.exe
  2⤵
  PID:11216
- C:\Windows\System\ypDtLUO.exe
  C:\Windows\System\ypDtLUO.exe
  2⤵
  PID:10152
- C:\Windows\System\vhLTngj.exe
  C:\Windows\System\vhLTngj.exe
  2⤵
  PID:9712
- C:\Windows\System\kGRuELL.exe
  C:\Windows\System\kGRuELL.exe
  2⤵
  PID:5040
- C:\Windows\System\GDxZRLq.exe
  C:\Windows\System\GDxZRLq.exe
  2⤵
  PID:7912
- C:\Windows\System\ZcrJiOK.exe
  C:\Windows\System\ZcrJiOK.exe
  2⤵
  PID:9332
- C:\Windows\System\KvDzrRx.exe
  C:\Windows\System\KvDzrRx.exe
  2⤵
  PID:9436
- C:\Windows\System\qXXciLT.exe
  C:\Windows\System\qXXciLT.exe
  2⤵
  PID:9780
- C:\Windows\System\DVxCLkJ.exe
  C:\Windows\System\DVxCLkJ.exe
  2⤵
  PID:8956
- C:\Windows\System\DVeYQHa.exe
  C:\Windows\System\DVeYQHa.exe
  2⤵
  PID:9404
- C:\Windows\System\LMARJxJ.exe
  C:\Windows\System\LMARJxJ.exe
  2⤵
  PID:12308
- C:\Windows\System\FYYXSXZ.exe
  C:\Windows\System\FYYXSXZ.exe
  2⤵
  PID:12332
- C:\Windows\System\kCpDCKq.exe
  C:\Windows\System\kCpDCKq.exe
  2⤵
  PID:12352
- C:\Windows\System\YXKDWmZ.exe
  C:\Windows\System\YXKDWmZ.exe
  2⤵
  PID:12376
- C:\Windows\System\blqMIfP.exe
  C:\Windows\System\blqMIfP.exe
  2⤵
  PID:12400
- C:\Windows\System\JTIZFEi.exe
  C:\Windows\System\JTIZFEi.exe
  2⤵
  PID:12424
- C:\Windows\System\SbnEnZw.exe
  C:\Windows\System\SbnEnZw.exe
  2⤵
  PID:12448
- C:\Windows\System\wTOFdTr.exe
  C:\Windows\System\wTOFdTr.exe
  2⤵
  PID:12472
- C:\Windows\System\BeaUabs.exe
  C:\Windows\System\BeaUabs.exe
  2⤵
  PID:12492
- C:\Windows\System\TjdjEhL.exe
  C:\Windows\System\TjdjEhL.exe
  2⤵
  PID:12520
- C:\Windows\System\fwcHylT.exe
  C:\Windows\System\fwcHylT.exe
  2⤵
  PID:12540
- C:\Windows\System\mgfHGeD.exe
  C:\Windows\System\mgfHGeD.exe
  2⤵
  PID:12560
- C:\Windows\System\UMOXsLG.exe
  C:\Windows\System\UMOXsLG.exe
  2⤵
  PID:12584
- C:\Windows\System\nTxUbhg.exe
  C:\Windows\System\nTxUbhg.exe
  2⤵
  PID:12608
- C:\Windows\System\hXZOMLn.exe
  C:\Windows\System\hXZOMLn.exe
  2⤵
  PID:12628
- C:\Windows\System\zCpZSQm.exe
  C:\Windows\System\zCpZSQm.exe
  2⤵
  PID:12652
- C:\Windows\System\euYRpjd.exe
  C:\Windows\System\euYRpjd.exe
  2⤵
  PID:12680
- C:\Windows\System\uARvOjZ.exe
  C:\Windows\System\uARvOjZ.exe
  2⤵
  PID:12704
- C:\Windows\System\cwbmXdL.exe
  C:\Windows\System\cwbmXdL.exe
  2⤵
  PID:12732
- C:\Windows\System\FzNwBFd.exe
  C:\Windows\System\FzNwBFd.exe
  2⤵
  PID:12756
- C:\Windows\System\WrIorVL.exe
  C:\Windows\System\WrIorVL.exe
  2⤵
  PID:12776
- C:\Windows\System\hKcnOet.exe
  C:\Windows\System\hKcnOet.exe
  2⤵
  PID:12800
- C:\Windows\System\QyUMhkI.exe
  C:\Windows\System\QyUMhkI.exe
  2⤵
  PID:12816
- C:\Windows\System\WZYVSRx.exe
  C:\Windows\System\WZYVSRx.exe
  2⤵
  PID:12840
- C:\Windows\System\gpcnxso.exe
  C:\Windows\System\gpcnxso.exe
  2⤵
  PID:12864
- C:\Windows\System\dWJOcsI.exe
  C:\Windows\System\dWJOcsI.exe
  2⤵
  PID:12880
- C:\Windows\System\PrzPIqI.exe
  C:\Windows\System\PrzPIqI.exe
  2⤵
  PID:12896
- C:\Windows\System\DClHFpg.exe
  C:\Windows\System\DClHFpg.exe
  2⤵
  PID:12920
- C:\Windows\System\TyFxDKw.exe
  C:\Windows\System\TyFxDKw.exe
  2⤵
  PID:12944
- C:\Windows\System\dbamAQu.exe
  C:\Windows\System\dbamAQu.exe
  2⤵
  PID:12968
- C:\Windows\System\uOkeGHw.exe
  C:\Windows\System\uOkeGHw.exe
  2⤵
  PID:12988
- C:\Windows\System\eaXkJPB.exe
  C:\Windows\System\eaXkJPB.exe
  2⤵
  PID:13008
- C:\Windows\System\VGGZhHl.exe
  C:\Windows\System\VGGZhHl.exe
  2⤵
  PID:13028
- C:\Windows\System\jLANPka.exe
  C:\Windows\System\jLANPka.exe
  2⤵
  PID:13056
- C:\Windows\System\aUiMGEd.exe
  C:\Windows\System\aUiMGEd.exe
  2⤵
  PID:13080
- C:\Windows\System\huqWPcd.exe
  C:\Windows\System\huqWPcd.exe
  2⤵
  PID:13108
- C:\Windows\System\kWlZeke.exe
  C:\Windows\System\kWlZeke.exe
  2⤵
  PID:11832
- C:\Windows\System\hVbVVYn.exe
  C:\Windows\System\hVbVVYn.exe
  2⤵
  PID:11980
- C:\Windows\System\sudOJRU.exe
  C:\Windows\System\sudOJRU.exe
  2⤵
  PID:12396
- C:\Windows\System\REzHZXZ.exe
  C:\Windows\System\REzHZXZ.exe
  2⤵
  PID:12592
- C:\Windows\System\aHGVrGN.exe
  C:\Windows\System\aHGVrGN.exe
  2⤵
  PID:12744
- C:\Windows\System\ZPywIyt.exe
  C:\Windows\System\ZPywIyt.exe
  2⤵
  PID:12892
- C:\Windows\System\ciQcxdo.exe
  C:\Windows\System\ciQcxdo.exe
  2⤵
  PID:13048
- C:\Windows\System\zCGxpYN.exe
  C:\Windows\System\zCGxpYN.exe
  2⤵
  PID:13116
- C:\Windows\System\BeztxGc.exe
  C:\Windows\System\BeztxGc.exe
  2⤵
  PID:13144
- C:\Windows\System\lHqxmXb.exe
  C:\Windows\System\lHqxmXb.exe
  2⤵
  PID:13176
- C:\Windows\System\UwKTlum.exe
  C:\Windows\System\UwKTlum.exe
  2⤵
  PID:13288
- C:\Windows\System\MkrYsyO.exe
  C:\Windows\System\MkrYsyO.exe
  2⤵
  PID:9740
- C:\Windows\System\QxIEnZl.exe
  C:\Windows\System\QxIEnZl.exe
  2⤵
  PID:9808
- C:\Windows\System\AiBXPdZ.exe
  C:\Windows\System\AiBXPdZ.exe
  2⤵
  PID:10024
- C:\Windows\System\RnaNQtA.exe
  C:\Windows\System\RnaNQtA.exe
  2⤵
  PID:11472
- C:\Windows\System\BMyJrvo.exe
  C:\Windows\System\BMyJrvo.exe
  2⤵
  PID:10692
- C:\Windows\System\zPySWxc.exe
  C:\Windows\System\zPySWxc.exe
  2⤵
  PID:3792
- C:\Windows\System\ajRTeIy.exe
  C:\Windows\System\ajRTeIy.exe
  2⤵
  PID:10808
- C:\Windows\System\uoUhUmk.exe
  C:\Windows\System\uoUhUmk.exe
  2⤵
  PID:2828
- C:\Windows\System\EvRflRJ.exe
  C:\Windows\System\EvRflRJ.exe
  2⤵
  PID:11896
- C:\Windows\System\zFzCPdl.exe
  C:\Windows\System\zFzCPdl.exe
  2⤵
  PID:12128
- C:\Windows\System\MYHPrXj.exe
  C:\Windows\System\MYHPrXj.exe
  2⤵
  PID:12144
- C:\Windows\System\vjcsybx.exe
  C:\Windows\System\vjcsybx.exe
  2⤵
  PID:9076
- C:\Windows\System\QIqBqae.exe
  C:\Windows\System\QIqBqae.exe
  2⤵
  PID:11240
- C:\Windows\System\JKGetaO.exe
  C:\Windows\System\JKGetaO.exe
  2⤵
  PID:12256
- C:\Windows\System\SNHhtds.exe
  C:\Windows\System\SNHhtds.exe
  2⤵
  PID:9208
- C:\Windows\System\diXUcji.exe
  C:\Windows\System\diXUcji.exe
  2⤵
  PID:10532
- C:\Windows\System\LMJDsjV.exe
  C:\Windows\System\LMJDsjV.exe
  2⤵
  PID:10084
- C:\Windows\System\bIULUfP.exe
  C:\Windows\System\bIULUfP.exe
  2⤵
  PID:11388
- C:\Windows\System\CRjhpTC.exe
  C:\Windows\System\CRjhpTC.exe
  2⤵
  PID:11212
- C:\Windows\System\vXIFbcG.exe
  C:\Windows\System\vXIFbcG.exe
  2⤵
  PID:8264
- C:\Windows\System\DEvuLXS.exe
  C:\Windows\System\DEvuLXS.exe
  2⤵
  PID:12296
- C:\Windows\System\NBinTZu.exe
  C:\Windows\System\NBinTZu.exe
  2⤵
  PID:9196
- C:\Windows\System\ZXOMMvQ.exe
  C:\Windows\System\ZXOMMvQ.exe
  2⤵
  PID:4600
- C:\Windows\System\KMWPdEH.exe
  C:\Windows\System\KMWPdEH.exe
  2⤵
  PID:10032
- C:\Windows\System\yqOHMNc.exe
  C:\Windows\System\yqOHMNc.exe
  2⤵
  PID:12624
- C:\Windows\System\Knzgeym.exe
  C:\Windows\System\Knzgeym.exe
  2⤵
  PID:12964
- C:\Windows\System\KkEVewJ.exe
  C:\Windows\System\KkEVewJ.exe
  2⤵
  PID:11904
- C:\Windows\System\zpHQXVB.exe
  C:\Windows\System\zpHQXVB.exe
  2⤵
  PID:10728
- C:\Windows\System\PbYliYJ.exe
  C:\Windows\System\PbYliYJ.exe
  2⤵
  PID:8280
- C:\Windows\System\fesXWQd.exe
  C:\Windows\System\fesXWQd.exe
  2⤵
  PID:12232
- C:\Windows\System\jkkRaYc.exe
  C:\Windows\System\jkkRaYc.exe
  2⤵
  PID:9308
- C:\Windows\System\VkeuLQF.exe
  C:\Windows\System\VkeuLQF.exe
  2⤵
  PID:9520
- C:\Windows\System\IQGcHOf.exe
  C:\Windows\System\IQGcHOf.exe
  2⤵
  PID:6252
- C:\Windows\System\qPCzeDK.exe
  C:\Windows\System\qPCzeDK.exe
  2⤵
  PID:12940
- C:\Windows\System\QwsgGhR.exe
  C:\Windows\System\QwsgGhR.exe
  2⤵
  PID:1992
- C:\Windows\System\dEyIAjr.exe
  C:\Windows\System\dEyIAjr.exe
  2⤵
  PID:9588
- C:\Windows\System\lqIWXUi.exe
  C:\Windows\System\lqIWXUi.exe
  2⤵
  PID:12772
- C:\Windows\System\fihkiod.exe
  C:\Windows\System\fihkiod.exe
  2⤵
  PID:11396
- C:\Windows\System\sfCBbYr.exe
  C:\Windows\System\sfCBbYr.exe
  2⤵
  PID:13152
- C:\Windows\System\dxQUWrh.exe
  C:\Windows\System\dxQUWrh.exe
  2⤵
  PID:4212
- C:\Windows\System\dXjOlun.exe
  C:\Windows\System\dXjOlun.exe
  2⤵
  PID:3740
- C:\Windows\System\iOpEJbx.exe
  C:\Windows\System\iOpEJbx.exe
  2⤵
  PID:12872
- C:\Windows\System\HXKqECu.exe
  C:\Windows\System\HXKqECu.exe
  2⤵
  PID:13024
- C:\Windows\System\rbwmKgV.exe
  C:\Windows\System\rbwmKgV.exe
  2⤵
  PID:6600
- C:\Windows\System\uABaHXt.exe
  C:\Windows\System\uABaHXt.exe
  2⤵
  PID:10792
- C:\Windows\System\eEKXmpg.exe
  C:\Windows\System\eEKXmpg.exe
  2⤵
  PID:10736
- C:\Windows\System\NuCFnRQ.exe
  C:\Windows\System\NuCFnRQ.exe
  2⤵
  PID:13188
- C:\Windows\System\bpNrDdB.exe
  C:\Windows\System\bpNrDdB.exe
  2⤵
  PID:1476
- C:\Windows\System\qTmqtSv.exe
  C:\Windows\System\qTmqtSv.exe
  2⤵
  PID:12048
- C:\Windows\System\DncJadp.exe
  C:\Windows\System\DncJadp.exe
  2⤵
  PID:12692
- C:\Windows\System\DAxrRMH.exe
  C:\Windows\System\DAxrRMH.exe
  2⤵
  PID:12180
- C:\Windows\System\lRzXZiK.exe
  C:\Windows\System\lRzXZiK.exe
  2⤵
  PID:10640
- C:\Windows\System\CrquGMw.exe
  C:\Windows\System\CrquGMw.exe
  2⤵
  PID:11776
- C:\Windows\System\RgpeaYN.exe
  C:\Windows\System\RgpeaYN.exe
  2⤵
  PID:12100
- C:\Windows\System\cgctCTl.exe
  C:\Windows\System\cgctCTl.exe
  2⤵
  PID:13168
- C:\Windows\System\aekzcix.exe
  C:\Windows\System\aekzcix.exe
  2⤵
  PID:10516
- C:\Windows\System\txJKVty.exe
  C:\Windows\System\txJKVty.exe
  2⤵
  PID:9620
- C:\Windows\System\ZQfKRYh.exe
  C:\Windows\System\ZQfKRYh.exe
  2⤵
  PID:932
- C:\Windows\System\gRGhNwS.exe
  C:\Windows\System\gRGhNwS.exe
  2⤵
  PID:12808
- C:\Windows\System\nSGcHBu.exe
  C:\Windows\System\nSGcHBu.exe
  2⤵
  PID:13020
- C:\Windows\System\dfdNHIk.exe
  C:\Windows\System\dfdNHIk.exe
  2⤵
  PID:13324
- C:\Windows\System\QcXAEFO.exe
  C:\Windows\System\QcXAEFO.exe
  2⤵
  PID:13348
- C:\Windows\System\nsStxqq.exe
  C:\Windows\System\nsStxqq.exe
  2⤵
  PID:13372
- C:\Windows\System\gaijnxo.exe
  C:\Windows\System\gaijnxo.exe
  2⤵
  PID:13396
- C:\Windows\System\zwyhcNi.exe
  C:\Windows\System\zwyhcNi.exe
  2⤵
  PID:13420
- C:\Windows\System\AOquOCV.exe
  C:\Windows\System\AOquOCV.exe
  2⤵
  PID:13460
- C:\Windows\System\wwkjGPd.exe
  C:\Windows\System\wwkjGPd.exe
  2⤵
  PID:13484
- C:\Windows\System\cuifvzW.exe
  C:\Windows\System\cuifvzW.exe
  2⤵
  PID:13512
- C:\Windows\System\dDWHzXZ.exe
  C:\Windows\System\dDWHzXZ.exe
  2⤵
  PID:13536
- C:\Windows\System\ANMBnPv.exe
  C:\Windows\System\ANMBnPv.exe
  2⤵
  PID:13568
- C:\Windows\System\HBSzpIh.exe
  C:\Windows\System\HBSzpIh.exe
  2⤵
  PID:13588
- C:\Windows\System\KQTABJy.exe
  C:\Windows\System\KQTABJy.exe
  2⤵
  PID:13608
- C:\Windows\System\CUlXVdZ.exe
  C:\Windows\System\CUlXVdZ.exe
  2⤵
  PID:13628
- C:\Windows\System\BZenJXN.exe
  C:\Windows\System\BZenJXN.exe
  2⤵
  PID:13656
- C:\Windows\System\uoAZtSs.exe
  C:\Windows\System\uoAZtSs.exe
  2⤵
  PID:13676
- C:\Windows\System\GXWKduH.exe
  C:\Windows\System\GXWKduH.exe
  2⤵
  PID:13700
- C:\Windows\System\GYhtSLV.exe
  C:\Windows\System\GYhtSLV.exe
  2⤵
  PID:13720
- C:\Windows\System\ZdShxwI.exe
  C:\Windows\System\ZdShxwI.exe
  2⤵
  PID:13744
- C:\Windows\System\wrnktsg.exe
  C:\Windows\System\wrnktsg.exe
  2⤵
  PID:13768
- C:\Windows\System\SWWJirf.exe
  C:\Windows\System\SWWJirf.exe
  2⤵
  PID:13792
- C:\Windows\System\GkDiklZ.exe
  C:\Windows\System\GkDiklZ.exe
  2⤵
  PID:13820
- C:\Windows\System\wItaJhj.exe
  C:\Windows\System\wItaJhj.exe
  2⤵
  PID:13844
- C:\Windows\System\CRMRMZm.exe
  C:\Windows\System\CRMRMZm.exe
  2⤵
  PID:13868
- C:\Windows\System\BZHpykv.exe
  C:\Windows\System\BZHpykv.exe
  2⤵
  PID:13892
- C:\Windows\System\nODycxE.exe
  C:\Windows\System\nODycxE.exe
  2⤵
  PID:13916
- C:\Windows\System\nGmmpYj.exe
  C:\Windows\System\nGmmpYj.exe
  2⤵
  PID:13936
- C:\Windows\System\eVzXvif.exe
  C:\Windows\System\eVzXvif.exe
  2⤵
  PID:13956
- C:\Windows\System\ZtnuCMK.exe
  C:\Windows\System\ZtnuCMK.exe
  2⤵
  PID:13984
- C:\Windows\System\KkGPyZh.exe
  C:\Windows\System\KkGPyZh.exe
  2⤵
  PID:14000
- C:\Windows\System\PaoTOSb.exe
  C:\Windows\System\PaoTOSb.exe
  2⤵
  PID:14024
- C:\Windows\System\HqmTuyM.exe
  C:\Windows\System\HqmTuyM.exe
  2⤵
  PID:14048
- C:\Windows\System\QPSTFcs.exe
  C:\Windows\System\QPSTFcs.exe
  2⤵
  PID:14072
- C:\Windows\System\LCFdAJU.exe
  C:\Windows\System\LCFdAJU.exe
  2⤵
  PID:13368
- C:\Windows\System\Sizsfgd.exe
  C:\Windows\System\Sizsfgd.exe
  2⤵
  PID:13412
- C:\Windows\System\qPFqEgo.exe
  C:\Windows\System\qPFqEgo.exe
  2⤵
  PID:13196
- C:\Windows\System\IuCpqxF.exe
  C:\Windows\System\IuCpqxF.exe
  2⤵
  PID:12860
- C:\Windows\System\YjIqmZB.exe
  C:\Windows\System\YjIqmZB.exe
  2⤵
  PID:10644
- C:\Windows\System\omLHsNY.exe
  C:\Windows\System\omLHsNY.exe
  2⤵
  PID:13948
- C:\Windows\System\YaMomRH.exe
  C:\Windows\System\YaMomRH.exe
  2⤵
  PID:14032
- C:\Windows\System\YNuadFl.exe
  C:\Windows\System\YNuadFl.exe
  2⤵
  PID:13556
- C:\Windows\System\sGCUxwK.exe
  C:\Windows\System\sGCUxwK.exe
  2⤵
  PID:13504
- C:\Windows\System\jALEQds.exe
  C:\Windows\System\jALEQds.exe
  2⤵
  PID:13672
- C:\Windows\System\NOqFivM.exe
  C:\Windows\System\NOqFivM.exe
  2⤵
  PID:13764
- C:\Windows\System\PDTligH.exe
  C:\Windows\System\PDTligH.exe
  2⤵
  PID:14184
- C:\Windows\System\FRWOwyk.exe
  C:\Windows\System\FRWOwyk.exe
  2⤵
  PID:12152
- C:\Windows\System\rGBHNwg.exe
  C:\Windows\System\rGBHNwg.exe
  2⤵
  PID:14300
- C:\Windows\System\cCJzyST.exe
  C:\Windows\System\cCJzyST.exe
  2⤵
  PID:14276
- C:\Windows\System\xKkzhsl.exe
  C:\Windows\System\xKkzhsl.exe
  2⤵
  PID:12696
- C:\Windows\System\FAylFGA.exe
  C:\Windows\System\FAylFGA.exe
  2⤵
  PID:11276
- C:\Windows\System\sRzBDCf.exe
  C:\Windows\System\sRzBDCf.exe
  2⤵
  PID:2816
- C:\Windows\System\GIQhLtN.exe
  C:\Windows\System\GIQhLtN.exe
  2⤵
  PID:5180
- C:\Windows\System\QkGZSGf.exe
  C:\Windows\System\QkGZSGf.exe
  2⤵
  PID:14328
- C:\Windows\System\QhPdHcm.exe
  C:\Windows\System\QhPdHcm.exe
  2⤵
  PID:13888
- C:\Windows\System\PrpXypA.exe
  C:\Windows\System\PrpXypA.exe
  2⤵
  PID:14096
- C:\Windows\System\kPYXxpe.exe
  C:\Windows\System\kPYXxpe.exe
  2⤵
  PID:14332
- C:\Windows\System\gonDqqk.exe
  C:\Windows\System\gonDqqk.exe
  2⤵
  PID:11104
- C:\Windows\System\GvIhbEr.exe
  C:\Windows\System\GvIhbEr.exe
  2⤵
  PID:14296
- C:\Windows\System\KPNXxCA.exe
  C:\Windows\System\KPNXxCA.exe
  2⤵
  PID:9444
- C:\Windows\System\ORbKbVL.exe
  C:\Windows\System\ORbKbVL.exe
  2⤵
  PID:13760
- C:\Windows\System\WKkehoh.exe
  C:\Windows\System\WKkehoh.exe
  2⤵
  PID:13624
- C:\Windows\System\ucyRMOL.exe
  C:\Windows\System\ucyRMOL.exe
  2⤵
  PID:13668
- C:\Windows\System\AbXxtvS.exe
  C:\Windows\System\AbXxtvS.exe
  2⤵
  PID:13384
- C:\Windows\System\WjvKxvc.exe
  C:\Windows\System\WjvKxvc.exe
  2⤵
  PID:3964
- C:\Windows\System\ZSlIhbm.exe
  C:\Windows\System\ZSlIhbm.exe
  2⤵
  PID:14092
- C:\Windows\System\vcmVVKE.exe
  C:\Windows\System\vcmVVKE.exe
  2⤵
  PID:13284
- C:\Windows\System\snimzKX.exe
  C:\Windows\System\snimzKX.exe
  2⤵
  PID:12488
- C:\Windows\System\sxWNdsF.exe
  C:\Windows\System\sxWNdsF.exe
  2⤵
  PID:1876
- C:\Windows\System\NZbFWLw.exe
  C:\Windows\System\NZbFWLw.exe
  2⤵
  PID:11580
- C:\Windows\System\MufiJJs.exe
  C:\Windows\System\MufiJJs.exe
  2⤵
  PID:13044
- C:\Windows\System\uuoLMbE.exe
  C:\Windows\System\uuoLMbE.exe
  2⤵
  PID:14120
- C:\Windows\System\dIRDHce.exe
  C:\Windows\System\dIRDHce.exe
  2⤵
  PID:4260
- C:\Windows\System\hbVJjzH.exe
  C:\Windows\System\hbVJjzH.exe
  2⤵
  PID:3460
- C:\Windows\System\MUrsoRG.exe
  C:\Windows\System\MUrsoRG.exe
  2⤵
  PID:14124
- C:\Windows\System\bXSPCqt.exe
  C:\Windows\System\bXSPCqt.exe
  2⤵
  PID:1384
- C:\Windows\System\BpDLqmh.exe
  C:\Windows\System\BpDLqmh.exe
  2⤵
  PID:13712
- C:\Windows\System\GVvTzJm.exe
  C:\Windows\System\GVvTzJm.exe
  2⤵
  PID:2432
- C:\Windows\System\sKQxwRO.exe
  C:\Windows\System\sKQxwRO.exe
  2⤵
  PID:588
- C:\Windows\System\gjBtueF.exe
  C:\Windows\System\gjBtueF.exe
  2⤵
  PID:3704
- C:\Windows\System\TrzJJLy.exe
  C:\Windows\System\TrzJJLy.exe
  2⤵
  PID:13340
- C:\Windows\System\VIhBBhd.exe
  C:\Windows\System\VIhBBhd.exe
  2⤵
  PID:2820
- C:\Windows\System\suyLeAx.exe
  C:\Windows\System\suyLeAx.exe
  2⤵
  PID:3948
- C:\Windows\System\LQMaGMs.exe
  C:\Windows\System\LQMaGMs.exe
  2⤵
  PID:2896
- C:\Windows\System\HUTGTAF.exe
  C:\Windows\System\HUTGTAF.exe
  2⤵
  PID:13280
- C:\Windows\System\spUDHGS.exe
  C:\Windows\System\spUDHGS.exe
  2⤵
  PID:14204
- C:\Windows\System\UtBflQt.exe
  C:\Windows\System\UtBflQt.exe
  2⤵
  PID:2872
- C:\Windows\System\nbKUpdp.exe
  C:\Windows\System\nbKUpdp.exe
  2⤵
  PID:4224
- C:\Windows\System\DgkOuyI.exe
  C:\Windows\System\DgkOuyI.exe
  2⤵
  PID:4660
- C:\Windows\System\nHiOqHv.exe
  C:\Windows\System\nHiOqHv.exe
  2⤵
  PID:1160
- C:\Windows\System\DZnEFve.exe
  C:\Windows\System\DZnEFve.exe
  2⤵
  PID:4000
- C:\Windows\System\QjOiKiR.exe
  C:\Windows\System\QjOiKiR.exe
  2⤵
  PID:3452
- C:\Windows\System\dCcIpSt.exe
  C:\Windows\System\dCcIpSt.exe
  2⤵
  PID:13776
- C:\Windows\System\sFJnmLt.exe
  C:\Windows\System\sFJnmLt.exe
  2⤵
  PID:5800
- C:\Windows\System\UBxfwEo.exe
  C:\Windows\System\UBxfwEo.exe
  2⤵
  PID:672
- C:\Windows\System\rsDSVYE.exe
  C:\Windows\System\rsDSVYE.exe
  2⤵
  PID:4252
- C:\Windows\System\GeIrDzb.exe
  C:\Windows\System\GeIrDzb.exe
  2⤵
  PID:13544
- C:\Windows\System\oWOnrrk.exe
  C:\Windows\System\oWOnrrk.exe
  2⤵
  PID:4548
- C:\Windows\System\SJnimiA.exe
  C:\Windows\System\SJnimiA.exe
  2⤵
  PID:1800
- C:\Windows\System\hQnMpJt.exe
  C:\Windows\System\hQnMpJt.exe
  2⤵
  PID:3104
- C:\Windows\System\ssdydnw.exe
  C:\Windows\System\ssdydnw.exe
  2⤵
  PID:9936
- C:\Windows\System\bxDGeVe.exe
  C:\Windows\System\bxDGeVe.exe
  2⤵
  PID:4208
- C:\Windows\System\pjzJvAi.exe
  C:\Windows\System\pjzJvAi.exe
  2⤵
  PID:3020
- C:\Windows\System\tQklrPb.exe
  C:\Windows\System\tQklrPb.exe
  2⤵
  PID:1016
- C:\Windows\System\QbySwyW.exe
  C:\Windows\System\QbySwyW.exe
  2⤵
  PID:2552
- C:\Windows\System\ipEgFlv.exe
  C:\Windows\System\ipEgFlv.exe
  2⤵
  PID:2032
- C:\Windows\System\cYsnCLE.exe
  C:\Windows\System\cYsnCLE.exe
  2⤵
  PID:632
- C:\Windows\System\snrVwfq.exe
  C:\Windows\System\snrVwfq.exe
  2⤵
  PID:3960
- C:\Windows\System\FOaYnCb.exe
  C:\Windows\System\FOaYnCb.exe
  2⤵
  PID:4860
- C:\Windows\System\DRiYADq.exe
  C:\Windows\System\DRiYADq.exe
  2⤵
  PID:5768
- C:\Windows\System\vwacevY.exe
  C:\Windows\System\vwacevY.exe
  2⤵
  PID:4188
- C:\Windows\System\IHNQRBF.exe
  C:\Windows\System\IHNQRBF.exe
  2⤵
  PID:2204
- C:\Windows\System\fPQOzOl.exe
  C:\Windows\System\fPQOzOl.exe
  2⤵
  PID:1704
- C:\Windows\System\VjKQyql.exe
  C:\Windows\System\VjKQyql.exe
  2⤵
  PID:4532
- C:\Windows\System\gEyEAzc.exe
  C:\Windows\System\gEyEAzc.exe
  2⤵
  PID:544
- C:\Windows\System\bSSagmf.exe
  C:\Windows\System\bSSagmf.exe
  2⤵
  PID:2448
- C:\Windows\System\wxbRhVK.exe
  C:\Windows\System\wxbRhVK.exe
  2⤵
  PID:2112
- C:\Windows\System\qonuKiL.exe
  C:\Windows\System\qonuKiL.exe
  2⤵
  PID:392
- C:\Windows\System\cWlDXDM.exe
  C:\Windows\System\cWlDXDM.exe
  2⤵
  PID:2988
- C:\Windows\System\rbfeftI.exe
  C:\Windows\System\rbfeftI.exe
  2⤵
  PID:3936
- C:\Windows\System\LujaDSQ.exe
  C:\Windows\System\LujaDSQ.exe
  2⤵
  PID:3580
- C:\Windows\System\AAewTwT.exe
  C:\Windows\System\AAewTwT.exe
  2⤵
  PID:4916
- C:\Windows\System\HgOCRHc.exe
  C:\Windows\System\HgOCRHc.exe
  2⤵
  PID:3228
- C:\Windows\System\YAbnOym.exe
  C:\Windows\System\YAbnOym.exe
  2⤵
  PID:4332
- C:\Windows\System\HjFhBBk.exe
  C:\Windows\System\HjFhBBk.exe
  2⤵
  PID:4032
- C:\Windows\System\WGXclxS.exe
  C:\Windows\System\WGXclxS.exe
  2⤵
  PID:2888
- C:\Windows\System\oocxpqu.exe
  C:\Windows\System\oocxpqu.exe
  2⤵
  PID:5596
- C:\Windows\System\sUilmhs.exe
  C:\Windows\System\sUilmhs.exe
  2⤵
  PID:5340
- C:\Windows\System\FsokWyc.exe
  C:\Windows\System\FsokWyc.exe
  2⤵
  PID:14268
- C:\Windows\System\YDNDYAm.exe
  C:\Windows\System\YDNDYAm.exe
  2⤵
  PID:2856
- C:\Windows\System\ygCuLBY.exe
  C:\Windows\System\ygCuLBY.exe
  2⤵
  PID:3788
- C:\Windows\System\KpVusHX.exe
  C:\Windows\System\KpVusHX.exe
  2⤵
  PID:5496
- C:\Windows\System\DyVyExe.exe
  C:\Windows\System\DyVyExe.exe
  2⤵
  PID:4828
- C:\Windows\System\NelgHxn.exe
  C:\Windows\System\NelgHxn.exe
  2⤵
  PID:5916
- C:\Windows\System\vUHewdr.exe
  C:\Windows\System\vUHewdr.exe
  2⤵
  PID:4340
- C:\Windows\System\UvdFfro.exe
  C:\Windows\System\UvdFfro.exe
  2⤵
  PID:5608
- C:\Windows\System\SGrgeDF.exe
  C:\Windows\System\SGrgeDF.exe
  2⤵
  PID:4508
- C:\Windows\System\vYvcPDv.exe
  C:\Windows\System\vYvcPDv.exe
  2⤵
  PID:5856
- C:\Windows\System\kNMfYiH.exe
  C:\Windows\System\kNMfYiH.exe
  2⤵
  PID:5904
- C:\Windows\System\ZvUswsl.exe
  C:\Windows\System\ZvUswsl.exe
  2⤵
  PID:540
- C:\Windows\System\MKEMxps.exe
  C:\Windows\System\MKEMxps.exe
  2⤵
  PID:4076
- C:\Windows\System\YbWXnnt.exe
  C:\Windows\System\YbWXnnt.exe
  2⤵
  PID:6096
- C:\Windows\System\UUnSVdG.exe
  C:\Windows\System\UUnSVdG.exe
  2⤵
  PID:4552
- C:\Windows\System\cAaIwYB.exe
  C:\Windows\System\cAaIwYB.exe
  2⤵
  PID:5900
- C:\Windows\System\MTwPZZX.exe
  C:\Windows\System\MTwPZZX.exe
  2⤵
  PID:5968
- C:\Windows\System\lcStegv.exe
  C:\Windows\System\lcStegv.exe
  2⤵
  PID:5140
- C:\Windows\System\zDrzOfv.exe
  C:\Windows\System\zDrzOfv.exe
  2⤵
  PID:5156
- C:\Windows\System\nSYJInQ.exe
  C:\Windows\System\nSYJInQ.exe
  2⤵
  PID:5208
- C:\Windows\System\lzSOFep.exe
  C:\Windows\System\lzSOFep.exe
  2⤵
  PID:14352
- C:\Windows\System\dYwKwpl.exe
  C:\Windows\System\dYwKwpl.exe
  2⤵
  PID:14380
- C:\Windows\System\pXjSIsC.exe
  C:\Windows\System\pXjSIsC.exe
  2⤵
  PID:14408
- C:\Windows\System\vOCLEFk.exe
  C:\Windows\System\vOCLEFk.exe
  2⤵
  PID:14440
- C:\Windows\System\mEwflAC.exe
  C:\Windows\System\mEwflAC.exe
  2⤵
  PID:14520
- C:\Windows\System\hKjTsGi.exe
  C:\Windows\System\hKjTsGi.exe
  2⤵
  PID:14544
- C:\Windows\System\NwBQHaZ.exe
  C:\Windows\System\NwBQHaZ.exe
  2⤵
  PID:14560
- C:\Windows\System\QYHWhdw.exe
  C:\Windows\System\QYHWhdw.exe
  2⤵
  PID:14584
- C:\Windows\System\gwkREfx.exe
  C:\Windows\System\gwkREfx.exe
  2⤵
  PID:14600
- C:\Windows\System\IyFKDgY.exe
  C:\Windows\System\IyFKDgY.exe
  2⤵
  PID:14636
- C:\Windows\System\kRHwkwZ.exe
  C:\Windows\System\kRHwkwZ.exe
  2⤵
  PID:14692
- C:\Windows\System\oxTNwnh.exe
  C:\Windows\System\oxTNwnh.exe
  2⤵
  PID:14732
- C:\Windows\System\QXhXPim.exe
  C:\Windows\System\QXhXPim.exe
  2⤵
  PID:14808
- C:\Windows\System\wRNWoKc.exe
  C:\Windows\System\wRNWoKc.exe
  2⤵
  PID:14828
- C:\Windows\System\Scqthwx.exe
  C:\Windows\System\Scqthwx.exe
  2⤵
  PID:14864
- C:\Windows\System\yBSiSsH.exe
  C:\Windows\System\yBSiSsH.exe
  2⤵
  PID:14888
- C:\Windows\System\bYhZsBr.exe
  C:\Windows\System\bYhZsBr.exe
  2⤵
  PID:14912
- C:\Windows\System\WOELisl.exe
  C:\Windows\System\WOELisl.exe
  2⤵
  PID:14948
- C:\Windows\System\vQuVoEG.exe
  C:\Windows\System\vQuVoEG.exe
  2⤵
  PID:14968
- C:\Windows\System\vcJzBkX.exe
  C:\Windows\System\vcJzBkX.exe
  2⤵
  PID:14996
- C:\Windows\System\kDFIiGU.exe
  C:\Windows\System\kDFIiGU.exe
  2⤵
  PID:15032
- C:\Windows\System\BwXbBAP.exe
  C:\Windows\System\BwXbBAP.exe
  2⤵
  PID:14388
- C:\Windows\System\RLQQFSw.exe
  C:\Windows\System\RLQQFSw.exe
  2⤵
  PID:14448
- C:\Windows\System\TBFbsqV.exe
  C:\Windows\System\TBFbsqV.exe
  2⤵
  PID:14608
- C:\Windows\System\kTOjdSG.exe
  C:\Windows\System\kTOjdSG.exe
  2⤵
  PID:14700
- C:\Windows\System\gtZkwFq.exe
  C:\Windows\System\gtZkwFq.exe
  2⤵
  PID:3184
- C:\Windows\System\XOgBIQJ.exe
  C:\Windows\System\XOgBIQJ.exe
  2⤵
  PID:12528
- C:\Windows\System\CkwZtPH.exe
  C:\Windows\System\CkwZtPH.exe
  2⤵
  PID:14872
- C:\Windows\System\ebTEQOC.exe
  C:\Windows\System\ebTEQOC.exe
  2⤵
  PID:14908
- C:\Windows\System\rMUwFzh.exe
  C:\Windows\System\rMUwFzh.exe
  2⤵
  PID:14992
- C:\Windows\System\trOzgrb.exe
  C:\Windows\System\trOzgrb.exe
  2⤵
  PID:15076
- C:\Windows\System\dmbmvXM.exe
  C:\Windows\System\dmbmvXM.exe
  2⤵
  PID:15112
- C:\Windows\System\RPCcjcB.exe
  C:\Windows\System\RPCcjcB.exe
  2⤵
  PID:15144
- C:\Windows\System\ZudmiVr.exe
  C:\Windows\System\ZudmiVr.exe
  2⤵
  PID:15180
- C:\Windows\System\KtMqAlM.exe
  C:\Windows\System\KtMqAlM.exe
  2⤵
  PID:15212
- C:\Windows\System\UdsWXiY.exe
  C:\Windows\System\UdsWXiY.exe
  2⤵
  PID:15236
- C:\Windows\System\wMWsxkY.exe
  C:\Windows\System\wMWsxkY.exe
  2⤵
  PID:15280
- C:\Windows\System\OhFjbcQ.exe
  C:\Windows\System\OhFjbcQ.exe
  2⤵
  PID:15308
- C:\Windows\System\GJRYuDP.exe
  C:\Windows\System\GJRYuDP.exe
  2⤵
  PID:15336
- C:\Windows\System\hpWeUtG.exe
  C:\Windows\System\hpWeUtG.exe
  2⤵
  PID:5880
- C:\Windows\System\cdgycIS.exe
  C:\Windows\System\cdgycIS.exe
  2⤵
  PID:5212
- C:\Windows\System\TRssSWz.exe
  C:\Windows\System\TRssSWz.exe
  2⤵
  PID:4796
- C:\Windows\System\rOujHBh.exe
  C:\Windows\System\rOujHBh.exe
  2⤵
  PID:13036
- C:\Windows\System\uMwoMUA.exe
  C:\Windows\System\uMwoMUA.exe
  2⤵
  PID:3572
- C:\Windows\System\TLqQVKm.exe
  C:\Windows\System\TLqQVKm.exe
  2⤵
  PID:14500
- C:\Windows\System\snsWDSh.exe
  C:\Windows\System\snsWDSh.exe
  2⤵
  PID:2132
- C:\Windows\System\zIJuZKY.exe
  C:\Windows\System\zIJuZKY.exe
  2⤵
  PID:14540
- C:\Windows\System\bakRtbJ.exe
  C:\Windows\System\bakRtbJ.exe
  2⤵
  PID:5236
- C:\Windows\System\mRhNMLR.exe
  C:\Windows\System\mRhNMLR.exe
  2⤵
  PID:6492
- C:\Windows\System\Gtfzbql.exe
  C:\Windows\System\Gtfzbql.exe
  2⤵
  PID:2600
- C:\Windows\System\LpShsEI.exe
  C:\Windows\System\LpShsEI.exe
  2⤵
  PID:2272
- C:\Windows\System\pdWHKNF.exe
  C:\Windows\System\pdWHKNF.exe
  2⤵
  PID:6028
- C:\Windows\System\cSiwRkA.exe
  C:\Windows\System\cSiwRkA.exe
  2⤵
  PID:6664
- C:\Windows\System\KAjAzbQ.exe
  C:\Windows\System\KAjAzbQ.exe
  2⤵
  PID:6148
- C:\Windows\System\mnJFATt.exe
  C:\Windows\System\mnJFATt.exe
  2⤵
  PID:6272
- C:\Windows\System\nwlSDbx.exe
  C:\Windows\System\nwlSDbx.exe
  2⤵
  PID:15140
- C:\Windows\System\bGqXeHP.exe
  C:\Windows\System\bGqXeHP.exe
  2⤵
  PID:6404
- C:\Windows\System\xYNpQBm.exe
  C:\Windows\System\xYNpQBm.exe
  2⤵
  PID:6508
- C:\Windows\System\LlGycvD.exe
  C:\Windows\System\LlGycvD.exe
  2⤵
  PID:6532
- C:\Windows\System\wrGdeWg.exe
  C:\Windows\System\wrGdeWg.exe
  2⤵
  PID:5012
- C:\Windows\System\rRDouch.exe
  C:\Windows\System\rRDouch.exe
  2⤵
  PID:5696
- C:\Windows\System\vpwnVxV.exe
  C:\Windows\System\vpwnVxV.exe
  2⤵
  PID:6688
- C:\Windows\System\mmhxeHU.exe
  C:\Windows\System\mmhxeHU.exe
  2⤵
  PID:15328
- C:\Windows\System\GAUWPTI.exe
  C:\Windows\System\GAUWPTI.exe
  2⤵
  PID:6728
- C:\Windows\System\kmMeiNl.exe
  C:\Windows\System\kmMeiNl.exe
  2⤵
  PID:3564
- C:\Windows\System\WbHJJcQ.exe
  C:\Windows\System\WbHJJcQ.exe
  2⤵
  PID:6380
- C:\Windows\System\akRyohX.exe
  C:\Windows\System\akRyohX.exe
  2⤵
  PID:4280
- C:\Windows\System\prfunJm.exe
  C:\Windows\System\prfunJm.exe
  2⤵
  PID:6564
- C:\Windows\System\TPSUsDU.exe
  C:\Windows\System\TPSUsDU.exe
  2⤵
  PID:14140
- C:\Windows\System\EtnLpky.exe
  C:\Windows\System\EtnLpky.exe
  2⤵
  PID:7124
- C:\Windows\System\mZwpQSp.exe
  C:\Windows\System\mZwpQSp.exe
  2⤵
  PID:4044
- C:\Windows\System\dcCQPZY.exe
  C:\Windows\System\dcCQPZY.exe
  2⤵
  PID:220
- C:\Windows\System\qobVoED.exe
  C:\Windows\System\qobVoED.exe
  2⤵
  PID:14596
- C:\Windows\System\cPcQpfs.exe
  C:\Windows\System\cPcQpfs.exe
  2⤵
  PID:7312
- C:\Windows\System\KxSWZGm.exe
  C:\Windows\System\KxSWZGm.exe
  2⤵
  PID:5884
- C:\Windows\System\DxlBrvt.exe
  C:\Windows\System\DxlBrvt.exe
  2⤵
  PID:6612
- C:\Windows\System\eNhUdhF.exe
  C:\Windows\System\eNhUdhF.exe
  2⤵
  PID:6824
- C:\Windows\System\BcwHIog.exe
  C:\Windows\System\BcwHIog.exe
  2⤵
  PID:7176
- C:\Windows\System\GMeFvSy.exe
  C:\Windows\System\GMeFvSy.exe
  2⤵
  PID:8808
- C:\Windows\System\fvSluZU.exe
  C:\Windows\System\fvSluZU.exe
  2⤵
  PID:7120
- C:\Windows\System\cvVPuaQ.exe
  C:\Windows\System\cvVPuaQ.exe
  2⤵
  PID:1056
- C:\Windows\System\pMMXXqo.exe
  C:\Windows\System\pMMXXqo.exe
  2⤵
  PID:8060
- C:\Windows\System\oRCQtmM.exe
  C:\Windows\System\oRCQtmM.exe
  2⤵
  PID:7004
- C:\Windows\System\KAEZlJh.exe
  C:\Windows\System\KAEZlJh.exe
  2⤵
  PID:15200
- C:\Windows\System\DMMhyoQ.exe
  C:\Windows\System\DMMhyoQ.exe
  2⤵
  PID:8092
- C:\Windows\System\WrEaZcu.exe
  C:\Windows\System\WrEaZcu.exe
  2⤵
  PID:7116
- C:\Windows\System\FLaLmTE.exe
  C:\Windows\System\FLaLmTE.exe
  2⤵
  PID:6356
- C:\Windows\System\KjMaRae.exe
  C:\Windows\System\KjMaRae.exe
  2⤵
  PID:5176
- C:\Windows\System\XmKDGtB.exe
  C:\Windows\System\XmKDGtB.exe
  2⤵
  PID:5616
- C:\Windows\System\xtjLUhD.exe
  C:\Windows\System\xtjLUhD.exe
  2⤵
  PID:780
- C:\Windows\System\myXeJcb.exe
  C:\Windows\System\myXeJcb.exe
  2⤵
  PID:4596
- C:\Windows\System\CXCHpUE.exe
  C:\Windows\System\CXCHpUE.exe
  2⤵
  PID:5748
- C:\Windows\System\FKpdhaa.exe
  C:\Windows\System\FKpdhaa.exe
  2⤵
  PID:9240
- C:\Windows\System\DKxuOwN.exe
  C:\Windows\System\DKxuOwN.exe
  2⤵
  PID:8224
- C:\Windows\System\RGvCXTn.exe
  C:\Windows\System\RGvCXTn.exe
  2⤵
  PID:7028
- C:\Windows\System\CuUTjsZ.exe
  C:\Windows\System\CuUTjsZ.exe
  2⤵
  PID:10184
- C:\Windows\System\ppOFWsX.exe
  C:\Windows\System\ppOFWsX.exe
  2⤵
  PID:1556
- C:\Windows\System\WlppYki.exe
  C:\Windows\System\WlppYki.exe
  2⤵
  PID:7324
- C:\Windows\System\cpgVJOa.exe
  C:\Windows\System\cpgVJOa.exe
  2⤵
  PID:6932
- C:\Windows\System\dfAByEB.exe
  C:\Windows\System\dfAByEB.exe
  2⤵
  PID:7528
- C:\Windows\System\rwoAmHp.exe
  C:\Windows\System\rwoAmHp.exe
  2⤵
  PID:9768
- C:\Windows\System\VCacsje.exe
  C:\Windows\System\VCacsje.exe
  2⤵
  PID:9840
- C:\Windows\System\xOMyQAS.exe
  C:\Windows\System\xOMyQAS.exe
  2⤵
  PID:14708
- C:\Windows\System\QgLCAOw.exe
  C:\Windows\System\QgLCAOw.exe
  2⤵
  PID:13884
- C:\Windows\System\FvJgCmQ.exe
  C:\Windows\System\FvJgCmQ.exe
  2⤵
  PID:10012
- C:\Windows\System\yqOTDIz.exe
  C:\Windows\System\yqOTDIz.exe
  2⤵
  PID:10076
- C:\Windows\System\SUYdSQj.exe
  C:\Windows\System\SUYdSQj.exe
  2⤵
  PID:7716
- C:\Windows\System\WebjVcd.exe
  C:\Windows\System\WebjVcd.exe
  2⤵
  PID:3732
- C:\Windows\System\TNDsbZj.exe
  C:\Windows\System\TNDsbZj.exe
  2⤵
  PID:10232
- C:\Windows\System\VowFrOU.exe
  C:\Windows\System\VowFrOU.exe
  2⤵
  PID:15192
- C:\Windows\System\cwAamAJ.exe
  C:\Windows\System\cwAamAJ.exe
  2⤵
  PID:9324
- C:\Windows\System\vqNMBox.exe
  C:\Windows\System\vqNMBox.exe
  2⤵
  PID:9336
- C:\Windows\System\fBHXuLF.exe
  C:\Windows\System\fBHXuLF.exe
  2⤵
  PID:9276
- C:\Windows\System\FiTEyol.exe
  C:\Windows\System\FiTEyol.exe
  2⤵
  PID:1064
- C:\Windows\System\ntJoaoo.exe
  C:\Windows\System\ntJoaoo.exe
  2⤵
  PID:9536
- C:\Windows\System\iQKFaja.exe
  C:\Windows\System\iQKFaja.exe
  2⤵
  PID:15224
- C:\Windows\System\QLwsAgx.exe
  C:\Windows\System\QLwsAgx.exe
  2⤵
  PID:9020
- C:\Windows\System\VYYmIZr.exe
  C:\Windows\System\VYYmIZr.exe
  2⤵
  PID:5860
- C:\Windows\System\LuGntqO.exe
  C:\Windows\System\LuGntqO.exe
  2⤵
  PID:9872
- C:\Windows\System\laApWkr.exe
  C:\Windows\System\laApWkr.exe
  2⤵
  PID:8172
- C:\Windows\System\OOwKdjU.exe
  C:\Windows\System\OOwKdjU.exe
  2⤵
  PID:10080
- C:\Windows\System\jxSUAZw.exe
  C:\Windows\System\jxSUAZw.exe
  2⤵
  PID:9224
- C:\Windows\System\BQsCkgb.exe
  C:\Windows\System\BQsCkgb.exe
  2⤵
  PID:8912
- C:\Windows\System\MNEwwBF.exe
  C:\Windows\System\MNEwwBF.exe
  2⤵
  PID:9228
- C:\Windows\System\MvvfheA.exe
  C:\Windows\System\MvvfheA.exe
  2⤵
  PID:8436
- C:\Windows\System\uFAlwoQ.exe
  C:\Windows\System\uFAlwoQ.exe
  2⤵
  PID:4900
- C:\Windows\System\cbbOJNE.exe
  C:\Windows\System\cbbOJNE.exe
  2⤵
  PID:10512
- C:\Windows\System\bfLmTLM.exe
  C:\Windows\System\bfLmTLM.exe
  2⤵
  PID:4128
- C:\Windows\System\nxrTtmN.exe
  C:\Windows\System\nxrTtmN.exe
  2⤵
  PID:6048
- C:\Windows\System\YWgNVGB.exe
  C:\Windows\System\YWgNVGB.exe
  2⤵
  PID:2424
- C:\Windows\System\kQQPKeE.exe
  C:\Windows\System\kQQPKeE.exe
  2⤵
  PID:8532
- C:\Windows\System\Berbbac.exe
  C:\Windows\System\Berbbac.exe
  2⤵
  PID:8628
- C:\Windows\System\kLpsviL.exe
  C:\Windows\System\kLpsviL.exe
  2⤵
  PID:10992
- C:\Windows\System\kypOgBZ.exe
  C:\Windows\System\kypOgBZ.exe
  2⤵
  PID:9044
- C:\Windows\System\QpOvyVi.exe
  C:\Windows\System\QpOvyVi.exe
  2⤵
  PID:1652
- C:\Windows\System\oWUsZuf.exe
  C:\Windows\System\oWUsZuf.exe
  2⤵
  PID:8900
- C:\Windows\System\saVpAib.exe
  C:\Windows\System\saVpAib.exe
  2⤵
  PID:7228
- C:\Windows\System\yBllpXG.exe
  C:\Windows\System\yBllpXG.exe
  2⤵
  PID:5888
- C:\Windows\System\VynkkmP.exe
  C:\Windows\System\VynkkmP.exe
  2⤵
  PID:6788
- C:\Windows\System\XvFLeaM.exe
  C:\Windows\System\XvFLeaM.exe
  2⤵
  PID:9964
- C:\Windows\System\jevMfPN.exe
  C:\Windows\System\jevMfPN.exe
  2⤵
  PID:7520
- C:\Windows\System\CaoBeqd.exe
  C:\Windows\System\CaoBeqd.exe
  2⤵
  PID:10172
- C:\Windows\System\zDVpYKm.exe
  C:\Windows\System\zDVpYKm.exe
  2⤵
  PID:11400
- C:\Windows\System\mkthKoy.exe
  C:\Windows\System\mkthKoy.exe
  2⤵
  PID:7752
- C:\Windows\System\Nkfilpe.exe
  C:\Windows\System\Nkfilpe.exe
  2⤵
  PID:8452
- C:\Windows\System\CoaKIqc.exe
  C:\Windows\System\CoaKIqc.exe
  2⤵
  PID:8236
- C:\Windows\System\RdCxQzw.exe
  C:\Windows\System\RdCxQzw.exe
  2⤵
  PID:10536
- C:\Windows\System\buwfRAp.exe
  C:\Windows\System\buwfRAp.exe
  2⤵
  PID:11800
- C:\Windows\System\TDNdSWE.exe
  C:\Windows\System\TDNdSWE.exe
  2⤵
  PID:15204
- C:\Windows\System\PppwSoS.exe
  C:\Windows\System\PppwSoS.exe
  2⤵
  PID:10904
- C:\Windows\System\jKepXVK.exe
  C:\Windows\System\jKepXVK.exe
  2⤵
  PID:12184
- C:\Windows\System\PpjSkwM.exe
  C:\Windows\System\PpjSkwM.exe
  2⤵
  PID:12240
- C:\Windows\System\cFjFdpm.exe
  C:\Windows\System\cFjFdpm.exe
  2⤵
  PID:7660
- C:\Windows\System\NDUOfdq.exe
  C:\Windows\System\NDUOfdq.exe
  2⤵
  PID:6900
- C:\Windows\System\FgTqCJQ.exe
  C:\Windows\System\FgTqCJQ.exe
  2⤵
  PID:8472
- C:\Windows\System\QFOklEi.exe
  C:\Windows\System\QFOklEi.exe
  2⤵
  PID:9372
- C:\Windows\System\cUgzcZV.exe
  C:\Windows\System\cUgzcZV.exe
  2⤵
  PID:12648
- C:\Windows\System\Adrlvrn.exe
  C:\Windows\System\Adrlvrn.exe
  2⤵
  PID:7700
- C:\Windows\System\AVLwHQN.exe
  C:\Windows\System\AVLwHQN.exe
  2⤵
  PID:6100
- C:\Windows\System\BIJkOkk.exe
  C:\Windows\System\BIJkOkk.exe
  2⤵
  PID:11300
- C:\Windows\System\gpxptsh.exe
  C:\Windows\System\gpxptsh.exe
  2⤵
  PID:7908
- C:\Windows\System\KpmwULH.exe
  C:\Windows\System\KpmwULH.exe
  2⤵
  PID:3712
- C:\Windows\System\CmoVbhB.exe
  C:\Windows\System\CmoVbhB.exe
  2⤵
  PID:5628
- C:\Windows\System\hQpLTZR.exe
  C:\Windows\System\hQpLTZR.exe
  2⤵
  PID:12904
- C:\Windows\System\ZysxWJv.exe
  C:\Windows\System\ZysxWJv.exe
  2⤵
  PID:13016
- C:\Windows\System\hUYjQDq.exe
  C:\Windows\System\hUYjQDq.exe
  2⤵
  PID:13252
- C:\Windows\System\OCBbOQL.exe
  C:\Windows\System\OCBbOQL.exe
  2⤵
  PID:8316
- C:\Windows\System\aDZxieR.exe
  C:\Windows\System\aDZxieR.exe
  2⤵
  PID:4168
- C:\Windows\System\skNCBBD.exe
  C:\Windows\System\skNCBBD.exe
  2⤵
  PID:12080
- C:\Windows\System\BqEpADD.exe
  C:\Windows\System\BqEpADD.exe
  2⤵
  PID:12192
- C:\Windows\System\LsstPwz.exe
  C:\Windows\System\LsstPwz.exe
  2⤵
  PID:9944
- C:\Windows\System\ZoGBIhY.exe
  C:\Windows\System\ZoGBIhY.exe
  2⤵
  PID:10348
- C:\Windows\System\eSYnkPT.exe
  C:\Windows\System\eSYnkPT.exe
  2⤵
  PID:10484
- C:\Windows\System\siaokJM.exe
  C:\Windows\System\siaokJM.exe
  2⤵
  PID:9480
- C:\Windows\System\KJVDNcA.exe
  C:\Windows\System\KJVDNcA.exe
  2⤵
  PID:7104
- C:\Windows\System\TreKpsK.exe
  C:\Windows\System\TreKpsK.exe
  2⤵
  PID:8960
- C:\Windows\System\XDWDtVD.exe
  C:\Windows\System\XDWDtVD.exe
  2⤵
  PID:7568
- C:\Windows\System\oHhZChs.exe
  C:\Windows\System\oHhZChs.exe
  2⤵
  PID:7996
- C:\Windows\System\TmpJpoF.exe
  C:\Windows\System\TmpJpoF.exe
  2⤵
  PID:8848
- C:\Windows\System\TJPggpj.exe
  C:\Windows\System\TJPggpj.exe
  2⤵
  PID:9796
- C:\Windows\System\YYOFGly.exe
  C:\Windows\System\YYOFGly.exe
  2⤵
  PID:9832
- C:\Windows\System\SLxwfUQ.exe
  C:\Windows\System\SLxwfUQ.exe
  2⤵
  PID:6952
- C:\Windows\System\IBJsWJw.exe
  C:\Windows\System\IBJsWJw.exe
  2⤵
  PID:12572
- C:\Windows\System\SNMhtgv.exe
  C:\Windows\System\SNMhtgv.exe
  2⤵
  PID:10124
- C:\Windows\System\dgCeujw.exe
  C:\Windows\System\dgCeujw.exe
  2⤵
  PID:12712
- C:\Windows\System\jNUsBAp.exe
  C:\Windows\System\jNUsBAp.exe
  2⤵
  PID:8880
- C:\Windows\System\hBdUfxj.exe
  C:\Windows\System\hBdUfxj.exe
  2⤵
  PID:14340
- C:\Windows\System\FQvwQHr.exe
  C:\Windows\System\FQvwQHr.exe
  2⤵
  PID:10824
- C:\Windows\System\RBcsnCz.exe
  C:\Windows\System\RBcsnCz.exe
  2⤵
  PID:13068
- C:\Windows\System\togeznB.exe
  C:\Windows\System\togeznB.exe
  2⤵
  PID:12388
- C:\Windows\System\vIzkLlN.exe
  C:\Windows\System\vIzkLlN.exe
  2⤵
  PID:13392
- C:\Windows\System\bArNBjx.exe
  C:\Windows\System\bArNBjx.exe
  2⤵
  PID:9024
- C:\Windows\System\OvPnmcf.exe
  C:\Windows\System\OvPnmcf.exe
  2⤵
  PID:11696

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:14140

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:10036

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1400

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:14016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_knaa554l.x3s.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AVxWIRE.exe

Filesize
2.3MB

MD5
917d59446fc19e8fbac52d1b34d9c623

SHA1
07b5c585a9dafc3faba934ac3fe46c2638709e4c

SHA256
96f2bf62063793639419f5b7ecd8eaeb46afa1276dced278a50b04b5fb64cf1d

SHA512
cf0cdc303e04f4f2d9c1cd47608e67a06d7d672f684ea83de78050213a143c0a7662ed73c45513c09b6272a463bd9a790ceb25655d6ba81ccb45462b679e35ac

Download Submit
C:\Windows\System\AwRZkAg.exe

Filesize
2.3MB

MD5
7843f967f7d48e42215211596f10de0a

SHA1
867f5b7176a4ec862341087638c8aa35c2fd0b87

SHA256
52250ce23cd8845effa6541d153a4dea0c340e4e2ab9f4b2d4ecd582c1ee6213

SHA512
c751dac121487dc1a36bb3e27791408caa68e349a2ec80978eae08fa5f54dfe4412b52f74eac06dcd8747f98d4485521b8d160bf34b7d2200432eb008f500c3e

Download Submit
C:\Windows\System\CdhRvMW.exe

Filesize
2.3MB

MD5
986c5c9f8acfa4a0c6cff8a12b44bad2

SHA1
a9f045e95407f5bfb6adcea2a6fd5dee0f1429bf

SHA256
1aad8a586cb2125a39ff977cb2e24bf6ce8cd5dad30be5ddd40de41000f7d15f

SHA512
8102d99ab9ffc23dab1c98939338b6f75004ad1a2ef6914124a6497bcbf3dfaf3d950e3da71116a0b2164a99b6ccc9e46616a43a68f71bde15ea27e14c21aba2

Download Submit
C:\Windows\System\FDLfbhd.exe

Filesize
2.3MB

MD5
2c09e949de3e434b657a678054d5403a

SHA1
43a3c71a6dc68313c29fef6ecbf82034c4562def

SHA256
d4baa52e7f0d040ef2eb999162a0e87cc2312c0f147a9adb76f6c421050c2fd7

SHA512
dbce9f36b7b5dd5c7b860cc6469e219efccc4392728735b648975c80fb40ba2a2106466146322cbfcda38de3ba12e2bc4b6f2048dbd8764b181baaf41f60c654

Download Submit
C:\Windows\System\IkomlUm.exe

Filesize
18B

MD5
b0ce6cfd7adfa2a2ac8258485a5cb279

SHA1
7b40a580431de17fbac688fb86de9bd5a156cd21

SHA256
bd650a2baf71609d723ebd75e0c6c938067406e57d5e80cec86bd9162ab5b10c

SHA512
107fc307e13b0ac2fdfd2a988662ef1274a95d78ff717c971632ef49ca9c9ef1a3e2bfaf20cde619c9ddc0ce2412de1ca0af65582b8a143eef4fd273e3c869f6

Download Submit
C:\Windows\System\IsdUztM.exe

Filesize
2.3MB

MD5
f6ad9c6ee08287fda2fe55fa438222e8

SHA1
6183c1fc6da8acc53de70f7478176d15be9696a6

SHA256
e9c27420271f14c6ebf6ef21c980298fddaa2f4f4fb9a08f495199aeb46d8d7c

SHA512
8a14821eadaf7ebee2945c183e1df55c4fab2b72d197cd69ab2c21a0894cf3e37d036915a63733f0f0d88ac1705940724f1d8463d2b3279cec098d8b0a2ca24c

Download Submit
C:\Windows\System\JGQukyz.exe

Filesize
2.3MB

MD5
9d4ca3d37e5fd0bf83a0295f67c6c40b

SHA1
49ef24d47475915c37320a522d2895ec9569120d

SHA256
80ea8fdddb4ae58515fc0bce70f483f5a95cee9d94026379d2e3fd15c7427ba4

SHA512
5b56d4b7429aea09fc9415e261d3a559999cfbbb61b97260d45dc8975e540505b188f08c6b3748a2583333e1b1a6dca9924589218c13e283688649e4c72cc361

Download Submit
C:\Windows\System\JnEFHzC.exe

Filesize
2.3MB

MD5
c95c4e174be8977c73cf94611dbb169c

SHA1
69173752b36fce8a8b976772b2bfe0c9edb245f9

SHA256
9363aaadd5c9902cb3fe98987ac227c505713cdffb93e65fa96e73d1ac15e9b8

SHA512
a238d30cfda965c59c3a56ebc1ade2dcb7d3b23d5af1e73759095411be457e2c44def98d629042ab4567cd87ef631b92ebc0ed3c8829b5d6fd60a4f094fcb5e5

Download Submit
C:\Windows\System\KAECIGp.exe

Filesize
2.3MB

MD5
68fb541ab3a4c5f4ef8dad937e662296

SHA1
17e27cd335cb38d1d52b41dd49706523f7da886e

SHA256
a6354d429395e12232465115ef02aea2721b356fb2178b1bdb0c4963834439cf

SHA512
c052728412b186f1770fe2c84f53f265e2636ea9f7e38df61b8d9b413ff56eb846523d494ff8315910e82c7fb30d6e1a83e01ed6047215c14a39583caafb6a71

Download Submit
C:\Windows\System\KQHjMiE.exe

Filesize
2.3MB

MD5
482b02888bb4e939e3bbabee7df0c858

SHA1
348e30f3ebde6347ebb3c3384d3cd8e697668713

SHA256
87369529347ada684eefc28db398a3b5d7fadec6c4c95c35b9eab89d3e4810a3

SHA512
78f1740c9960bd7e77c4920b75ecf1882e61a5541279b57ba11996a8f65814b8e5c248c94c909522b38dee63c6ee2492e0c3eab5fc53c5957bb0683000224728

Download Submit
C:\Windows\System\LpYQiod.exe

Filesize
2.3MB

MD5
0ee0799585bfdc3a9ccd689323788f7f

SHA1
f2a8f924a846b34992640a1411c398e86c6d47bb

SHA256
4597282f31425dc2b3dac1bf2953a362f1dd8399fc6723df53cfd4b31b158260

SHA512
d113148294d4d118e2f569b15d4f5322436e7e619cebfcc81c771651bcfb5bcb48be43f77a0c9dec1c59d34c26785538d44f58dc79f627baaef9f024c1ad6eec

Download Submit
C:\Windows\System\NKTXqDS.exe

Filesize
2.3MB

MD5
efd2e2e266dd7354be515d1fcae772f0

SHA1
96f179242d102e81ea8ec91862a507928895f945

SHA256
3014e6260aa4c7de23c543b2b73a02ff0cdce9454e5704a3d79abcc20e9640ce

SHA512
8a09209585ce936c90938fd2b89ef01aec7ddb844e364c30e8ca022140960f59196960086b79e4c9290324aa0dae692140f6a330c750403f643b210a6ea1f0cf

Download Submit
C:\Windows\System\OCBwbjk.exe

Filesize
2.3MB

MD5
ce67c1775acf1ad9ccda3e6601343b91

SHA1
05bc7a584d630b506adfdfbf293ef944607f97cd

SHA256
16fca5acd48697a86461c987637cb8958ea841739b53f48f4830cf5916e471f0

SHA512
6f97702691622e61e64c54a21ab6f1c54ddbf6446a6957ac1f05e630de1a087e8b9fd4a7ec7c4d45dc91ba6c5762535296b7d72fdf6cfc2385eb49d086f88d05

Download Submit
C:\Windows\System\PqtiKTd.exe

Filesize
2.3MB

MD5
fdadec30db910e6a924917220b6b3663

SHA1
343e2821d595576f477139d6a0685cf089c66e63

SHA256
c8c3ce8ef0bcd846a116a267a8b342618c78b189327fb096ec3cb8a593897972

SHA512
d1e5a2003176f3022c4ed52d4b2017e5ad434f76f0f8c48e98e4b9fa71d657802e0d48d5507d1fe53f3b65b98530c4a0c70ed4681663f663a4f5e06679a8b7ea

Download Submit
C:\Windows\System\RshzvhJ.exe

Filesize
2.3MB

MD5
87a4139916124b9644ee577b8cb2c775

SHA1
bf637f08ec72b84ff002bf4ff26b44b872681998

SHA256
9bd463140cb44733d28aabdbf15fc98b29b2c5d03aa8d11b2208f56790ce84c7

SHA512
0b1f476dfc0f581afaf331c7071e5a8639786ffc3da5363c1a42b2ad4d0435d4a5a561ea0459469ef4631e1f4a8a9ba47f2a5dc54a546f52cb62567a9efe2f9a

Download Submit
C:\Windows\System\SHoZRiZ.exe

Filesize
2.3MB

MD5
2bea8bc52391479c492486fdbed99673

SHA1
b13c1fd4823b6ff0d7151d3c5ed5357e44ba05da

SHA256
3091af11c249232f9fd27735561db176a6d0aea28216735b0bd969108e03a477

SHA512
bfe1cb13a2fbbc955f0bc5ee062df8c888984e942817caf21363bd0c4559f36ba33beccff13813404e19205fb5934f294e08b4f048758989a90dc75c96d8d27e

Download Submit
C:\Windows\System\TLaySdQ.exe

Filesize
2.3MB

MD5
66afcbbcbaa404f3487a48430e44d750

SHA1
845b71407425f2fdc5029b5785268479158df29f

SHA256
bcb97732c885f2a0eb15e5b77ccda797e9fced40ecd91768edbc2da939c37054

SHA512
de8f3e48392a61496841ad654b695035c4cc02dd6975548a747e954c6d645af7c7ba2cee9f3da60d69dcba90c8837c4a1f7d49d53fe020d85cc02f5569618640

Download Submit
C:\Windows\System\TOPkyVa.exe

Filesize
8B

MD5
ce98e4fb0d1b3e55b413072afff0d9b0

SHA1
ea92124ca4b7f582ca9bded1d03be27e59b4ea59

SHA256
ff9bed5abd6e63c0617526102c0f954cef8653d22647e6d0cc15dd6455af1a78

SHA512
b03d5e8e2563e87b69e649ee452bd2c1714db6cee8c57a2d9c80350a9bfea4a14df4deeed12085a7535561f33b8025c13820b94443ecdbd732b098776b2234a9

Download Submit
C:\Windows\System\TPMykEF.exe

Filesize
2.3MB

MD5
98aecb257eb57df5079dd83d19b43ae4

SHA1
11491bc158ab5cbf01ee2282bee41af027d173d9

SHA256
eb47b45a05045a60a2c4d3b1e66c161cf423a97c18a0e1996baa3666a85f7bf4

SHA512
64ac2a90d45d357ccb3df8e1f5ca9541ec3afe94a74c5ec1dab9ddca33cb4e3f6ba96b3afd2db2f8364bf45ccab308006de7af17cdc2806f16112dfa48a5f720

Download Submit
C:\Windows\System\TUMzAhj.exe

Filesize
2.3MB

MD5
6db3f6a60b5b5f1ce56d1e93d82102e8

SHA1
fdf5354d569c068a7f3b797f7faa6f71c801c72d

SHA256
653120758da7eb7e9e452e6a2ad6e2606acb2e4926abde34c58bee1a1f56f9cb

SHA512
2812c33458677b657201ab8878d6b87038366c2984ec93197a90b475674e0f85b4986abaa4c33ccd767ef024aa9a16b97e3c61468e3acb2ced32f3624d8287e9

Download Submit
C:\Windows\System\TfHwBej.exe

Filesize
2.3MB

MD5
bfd983cd95a5c6fec77791db1186b4a8

SHA1
c3e0ba41efcc1ed1c2b25321e2eaeaeda217ed6e

SHA256
d222f77f951349d8a17d35f2bf3493423a0b3f145a8511aff5e07fd8d57a5c40

SHA512
63c12405f4ab8649aef043af136a4e7ecd254750f67fdab3e91fe5a5cb25ab600aa54052477f1dd113557f58a65f4a18a4727011e6d7da594865b9797e06ac9c

Download Submit
C:\Windows\System\VfKXnNZ.exe

Filesize
2.3MB

MD5
be6ad19cadc45e6ac0955720dbdd8435

SHA1
bb1d472015644f042bd3c84ee21057311fadb686

SHA256
17e3379ce46c8f4fe2d441429534cdff3b43614936c794e8059d34c462d03f5b

SHA512
7cc9f5ab63c3961e956961de5bd9667aa443393bcdd9cedfae8890a9deacec5a6606585fe8f58499a19df2f3b40a9e1a51087b99c19256375878117a02c650d0

Download Submit
C:\Windows\System\WEhMCDn.exe

Filesize
2.3MB

MD5
c2877b2d1cd553e39c51b1c18e6a65b4

SHA1
a6398a37353dde3ddff2c6b58857814fb4fef352

SHA256
b50df14512a3ec0410176fd16585254d19456f09ab9284f191745b5fa237473c

SHA512
67b447f53c3e114bcaf063c6f3a8dc5892c12096086faa9348e313df90a5047bc08912ce30caa985be4554c0d3fe49bd38adf018bd76d344145ffb8f43f02184

Download Submit
C:\Windows\System\WOYoEIc.exe

Filesize
2.3MB

MD5
3ff9f632cbebaea953fe2c48996b2842

SHA1
d6c7d74c98ccd5adf683e7e14b1ab9443963c209

SHA256
b3904eeb46298567c9d25cddf201fe85172a83646ef03e95b8b9bd90df05532e

SHA512
748a687523e503d5812ad5a3d4ee9a1aba09f01c39b2416c3e2c3eca79ada74d24839797f8a68057eeba3660f1925ef5a1fcd01adb70bbebde0a254c3d671ae1

Download Submit
C:\Windows\System\XrCgjyZ.exe

Filesize
2.3MB

MD5
b47ffd1ee5a82d0c90f0c7450e43bb62

SHA1
c626ce3185a5cf59dbb87695ad3151b1226d4f5c

SHA256
6efac766e32cb6bf71db690bc0c495dbc38014c204f75ba7bf3d7d7736373d47

SHA512
c816f6d6282b46a203f0434fbbaf9bcb5b8eea8bfa648e2f7a297cac049fab6cdd975ee3d3cc831c44da736f4c82cbb8ee480cc053ed3fea170dc7050c2ed73a

Download Submit
C:\Windows\System\ZkfKqRg.exe

Filesize
2.3MB

MD5
3652da4781b1fbb6b89831d410557c0e

SHA1
08b02d278940c606b32e17b31b876b23bdb45c76

SHA256
f4161462371dbc00cc59fc29f69428ce399305061a5b8efc8380eabc2414c569

SHA512
ec65bba2af8845fcbeda74ca6a592b5c2dc8ec83bf72db858460916e7f8fc2dfcee2b56200b5d67ae78bfc5c7e838e811006ea7e940f879f9a1b8f4e5da9c3c4

Download Submit
C:\Windows\System\acZLFeV.exe

Filesize
2.3MB

MD5
71adc5480217eb994b7a3598609f6385

SHA1
4609a3ddaed48469f6230015f2254774d576920b

SHA256
b9797034c0755bbc9d36fb6e6db303f51cc7eeb488be5edcd754ac28734cbb28

SHA512
5bb4ae68d24c45337d02e69100de7036bbb64f9757c53f9f6ad283f53a893cf25327f3c9bc1fbb4a75b686c088a13b2267c6f5ac395388ec3d6a449088ac1ae6

Download Submit
C:\Windows\System\bASggzg.exe

Filesize
2.3MB

MD5
e76713819cc86a08145cb3bd821981d0

SHA1
210e0bc24f1e9ea0f57e9f06b381c4a8d6b3786e

SHA256
14c00d475e3b75ce8707c963af3ddfe2903175f125ce12f166297b421a0ccf10

SHA512
bb31f5ede770ac06e23ab78cba3f8ca5fb28eab07ef2e716908ab0a8b75e635088188fd832f57f615b001b6670932a2b69c77c6a8a38840135ab16ce9cd9c8ca

Download Submit
C:\Windows\System\gDSVNWL.exe

Filesize
2.3MB

MD5
5987bd2b23364aee5ec981147100abcf

SHA1
7fe94bdb0ec74c24c4f925e3a92e54df5058c73c

SHA256
8f7abd7caf5d981fe6592a27db52e4a550fbdfd0b46eba6a49e8524a7362bc6a

SHA512
e971362671460122778c59f899686e08e38ae4fdf6739525eed8f9b172a873beefc08f013fc969e4ce681cef0f2ad0e7c50ba74992a6b773833a8e26440c3559

Download Submit
C:\Windows\System\hOBsuHp.exe

Filesize
2.3MB

MD5
d84dd0c9f88376f02d592b27113d566e

SHA1
1d19d6b8613e98f1922a8ebebed3a31d4f76d39c

SHA256
bc861fd58b5b7d8a7476bbd215ba256d532de91e689a92cfee19035565f0f769

SHA512
ddefb942ce3ba275db42afc9321afaf4a2e0011d5ad8714047349915600371e3a767309c4b07f602a869b9f7cb16c33da807b208c4ddc9631948e1228ac7d408

Download Submit
C:\Windows\System\iYTuncq.exe

Filesize
2.3MB

MD5
8781641c80c302eeabed490219d13570

SHA1
27c0815edb66605c7f7663ef5888c91f667d8dfb

SHA256
b7723e29e00d75b340b66e6286bbf39d6345df20858489d71597f88450b6a2b6

SHA512
f5778032f6865e5e022382b41e71d348a77ca896cb3254502ee26a4d8418b72fabeb8aab01160d6711e433401b4305d955d4429b49ae8ebcce2a4d1810e930b8

Download Submit
C:\Windows\System\izcvCNG.exe

Filesize
2.3MB

MD5
562d7fb8d2b1337580ae3e4499a4c1e4

SHA1
1a91012b52c3485ae4350b28b630559ef5de4eae

SHA256
5422837b8ab027317d4a5d2519643698676e2cad488410d5bf23bc4692e7c7f8

SHA512
a3572cda20d3ffc66294b9aa685e0a40b427777c99df53ff9ef7cb9f91e7dfe91ed88aef1d006ca68c215f4f8ff78a1a3880483e489f12e4c1c34e38cd3bf50c

Download Submit
C:\Windows\System\jsvQgxN.exe

Filesize
2.3MB

MD5
fb2b762724979ecac9d05963cf383ae3

SHA1
450d9cf0ff66c64f0a56706f5a8620a5bdfb0630

SHA256
dd7a3c9d143ef96b723d34f790808f0efb515fb783006c2bc0c98f2946989ece

SHA512
00d78f036e517b77350354cb423c960d7757ffc328e43395f3755227ff4f0a24bdfb27d191e19e874ac0768f3dad1e2ca451134449676aa5b747a8bae775a8ba

Download Submit
C:\Windows\System\klAhAcN.exe

Filesize
2.3MB

MD5
eeb215c60964dd4e0af1dcff91537638

SHA1
023b7031a2752cba1bdd1a289c4ede96b8146d8d

SHA256
daa002a2b23d002812e2f6aa875bd7842d471ce528df68176a64a7576a41a4ee

SHA512
cd6d902274d63e32aa4f8fc638453ac53ccd47ff4ddd0cc37e4636bc001acbc2c455ee69b86a76f3475bb23520ae20c336d81c35d4e26006fe29e104c1ac9269

Download Submit
C:\Windows\System\muYhKKe.exe

Filesize
2.3MB

MD5
539e6d3ab1d5aaa8459df0ba1429abcd

SHA1
65b2fd104e56ea371e689da05be2ff42bbd79899

SHA256
8bad2c4a28a8f5397558f9b63bdd8b67d67777baca37aa84e7c9bd4852250ab3

SHA512
fc2d3228cd0a5578d6a85d11dfd1db227b52e6f6a47f0f246a369f7f11ed65954a41000e7f20fa536ee5dc5d02a325e6ebe56cd77e4cf06c1da3745419c72a00

Download Submit
C:\Windows\System\nNyUqXU.exe

Filesize
2.3MB

MD5
bf04d8d5ebc94350e8b80610ea6a280e

SHA1
183352b7c42220bf2bb965df50a79fef6e776407

SHA256
b0f6304216fee3ec29af1c1e09043b92e3f4294e31413060616de19ee7f566f7

SHA512
2c255a9d9c58b7904c6fa53ab6afe397eb2989d68d7e0c08913189c791308bae5dd1480c9c15290f6555963730dc63491a529df9dd4675b3b7f03cccaeb5d4d3

Download Submit
C:\Windows\System\zlObXQu.exe

Filesize
2.3MB

MD5
774bab21f2d97402eebccae9ea940dd9

SHA1
cfc120d06d651d98a520d08507124c9b3f746aa6

SHA256
c52dcef6ab163578cd95ed9a12dce7170896de0ca2eb618fdf9c445e0d9cc192

SHA512
a8dad43a81fb27dd1e317d7beebe96787c96b7a36a3221d97b251da3c91fa33e8c5aeac7e6090c420e447e8df63289da77a2c4fe965f8903191d155f8321d6f1

Download Submit
memory/388-1932-0x00007FF896300000-0x00007FF896DC1000-memory.dmp

Filesize
10.8MB

Download
memory/388-167-0x0000023F5C2D0000-0x0000023F5C2F2000-memory.dmp

Filesize
136KB

Download
memory/388-65-0x00007FF896300000-0x00007FF896DC1000-memory.dmp

Filesize
10.8MB

Download
memory/388-92-0x0000023F74910000-0x0000023F74920000-memory.dmp

Filesize
64KB

Download
memory/440-472-0x00007FF6BFFE0000-0x00007FF6C03D2000-memory.dmp

Filesize
3.9MB

Download
memory/440-4383-0x00007FF6BFFE0000-0x00007FF6C03D2000-memory.dmp

Filesize
3.9MB

Download
memory/860-18-0x00007FF7A2E10000-0x00007FF7A3202000-memory.dmp

Filesize
3.9MB

Download
memory/992-4336-0x00007FF6E3BD0000-0x00007FF6E3FC2000-memory.dmp

Filesize
3.9MB

Download
memory/992-121-0x00007FF6E3BD0000-0x00007FF6E3FC2000-memory.dmp

Filesize
3.9MB

Download
memory/1052-4307-0x00007FF680E10000-0x00007FF681202000-memory.dmp

Filesize
3.9MB

Download
memory/1052-195-0x00007FF680E10000-0x00007FF681202000-memory.dmp

Filesize
3.9MB

Download
memory/1280-4317-0x00007FF71C200000-0x00007FF71C5F2000-memory.dmp

Filesize
3.9MB

Download
memory/1280-139-0x00007FF71C200000-0x00007FF71C5F2000-memory.dmp

Filesize
3.9MB

Download
memory/1292-241-0x00007FF61F7E0000-0x00007FF61FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/1292-4342-0x00007FF61F7E0000-0x00007FF61FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/1368-4321-0x00007FF7E2790000-0x00007FF7E2B82000-memory.dmp

Filesize
3.9MB

Download
memory/1368-264-0x00007FF7E2790000-0x00007FF7E2B82000-memory.dmp

Filesize
3.9MB

Download
memory/1812-4362-0x00007FF634FE0000-0x00007FF6353D2000-memory.dmp

Filesize
3.9MB

Download
memory/1812-476-0x00007FF634FE0000-0x00007FF6353D2000-memory.dmp

Filesize
3.9MB

Download
memory/1884-295-0x00007FF623DD0000-0x00007FF6241C2000-memory.dmp

Filesize
3.9MB

Download
memory/1884-4326-0x00007FF623DD0000-0x00007FF6241C2000-memory.dmp

Filesize
3.9MB

Download
memory/1904-475-0x00007FF7E9CD0000-0x00007FF7EA0C2000-memory.dmp

Filesize
3.9MB

Download
memory/1904-4351-0x00007FF7E9CD0000-0x00007FF7EA0C2000-memory.dmp

Filesize
3.9MB

Download
memory/2420-4357-0x00007FF6123F0000-0x00007FF6127E2000-memory.dmp

Filesize
3.9MB

Download
memory/2420-410-0x00007FF6123F0000-0x00007FF6127E2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-4339-0x00007FF706D00000-0x00007FF7070F2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-298-0x00007FF706D00000-0x00007FF7070F2000-memory.dmp

Filesize
3.9MB

Download
memory/2768-4360-0x00007FF776D60000-0x00007FF777152000-memory.dmp

Filesize
3.9MB

Download
memory/2768-223-0x00007FF776D60000-0x00007FF777152000-memory.dmp

Filesize
3.9MB

Download
memory/2912-1-0x0000019031830000-0x0000019031840000-memory.dmp

Filesize
64KB

Download
memory/2912-0-0x00007FF7A74C0000-0x00007FF7A78B2000-memory.dmp

Filesize
3.9MB

Download
memory/3296-4370-0x00007FF719A90000-0x00007FF719E82000-memory.dmp

Filesize
3.9MB

Download
memory/3296-471-0x00007FF719A90000-0x00007FF719E82000-memory.dmp

Filesize
3.9MB

Download
memory/3436-474-0x00007FF617AF0000-0x00007FF617EE2000-memory.dmp

Filesize
3.9MB

Download
memory/3436-4300-0x00007FF617AF0000-0x00007FF617EE2000-memory.dmp

Filesize
3.9MB

Download
memory/3812-4303-0x00007FF762810000-0x00007FF762C02000-memory.dmp

Filesize
3.9MB

Download
memory/3812-98-0x00007FF762810000-0x00007FF762C02000-memory.dmp

Filesize
3.9MB

Download
memory/4304-473-0x00007FF750F70000-0x00007FF751362000-memory.dmp

Filesize
3.9MB

Download
memory/4808-356-0x00007FF7CFC00000-0x00007FF7CFFF2000-memory.dmp

Filesize
3.9MB

Download
memory/4808-4345-0x00007FF7CFC00000-0x00007FF7CFFF2000-memory.dmp

Filesize
3.9MB

Download
memory/4840-4312-0x00007FF6CAFB0000-0x00007FF6CB3A2000-memory.dmp

Filesize
3.9MB

Download
memory/4840-182-0x00007FF6CAFB0000-0x00007FF6CB3A2000-memory.dmp

Filesize
3.9MB

Download
memory/4892-4297-0x00007FF713100000-0x00007FF7134F2000-memory.dmp

Filesize
3.9MB

Download
memory/4892-68-0x00007FF713100000-0x00007FF7134F2000-memory.dmp

Filesize
3.9MB

Download
memory/4992-457-0x00007FF656AA0000-0x00007FF656E92000-memory.dmp

Filesize
3.9MB

Download
memory/4992-4332-0x00007FF656AA0000-0x00007FF656E92000-memory.dmp

Filesize
3.9MB

Download