xmrig | a40c81159d30d421e24552430f17ff6622c22c276565df0faf3dc56067b4e676

Analysis

max time kernel
139s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
Size

2.3MB
MD5

0a8aa340f84f3d4b352c5f12dbfbafd4
SHA1

88aabb6dc1e07b93366257c2e0ea60dde653cd6b
SHA256

a40c81159d30d421e24552430f17ff6622c22c276565df0faf3dc56067b4e676
SHA512

436ed45f3c4820479e2984397c92b46e079dfa219200a830cc57d8e38231f9efb58461482f5c0a53a0e8efb05bfd8c85fd755f56eda15e333c83c8046b7c6665
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//2o:NABF

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/memory/1184-188-0x00007FF6201E0000-0x00007FF6205D2000-memory.dmp	xmrig
behavioral2/memory/5060-205-0x00007FF74D590000-0x00007FF74D982000-memory.dmp	xmrig
behavioral2/memory/2488-265-0x00007FF6DEE10000-0x00007FF6DF202000-memory.dmp	xmrig
behavioral2/memory/1336-226-0x00007FF662600000-0x00007FF6629F2000-memory.dmp	xmrig
behavioral2/memory/3584-204-0x00007FF6ECB50000-0x00007FF6ECF42000-memory.dmp	xmrig
behavioral2/memory/2064-279-0x00007FF6B0520000-0x00007FF6B0912000-memory.dmp	xmrig
behavioral2/memory/408-287-0x00007FF7383F0000-0x00007FF7387E2000-memory.dmp	xmrig
behavioral2/memory/3316-329-0x00007FF638D80000-0x00007FF639172000-memory.dmp	xmrig
behavioral2/memory/2140-372-0x00007FF768640000-0x00007FF768A32000-memory.dmp	xmrig
behavioral2/memory/4028-380-0x00007FF61FD20000-0x00007FF620112000-memory.dmp	xmrig
behavioral2/memory/3776-396-0x00007FF746F10000-0x00007FF747302000-memory.dmp	xmrig
behavioral2/memory/5100-395-0x00007FF6EB1C0000-0x00007FF6EB5B2000-memory.dmp	xmrig
behavioral2/memory/4592-392-0x00007FF601DF0000-0x00007FF6021E2000-memory.dmp	xmrig
behavioral2/memory/1236-366-0x00007FF617C80000-0x00007FF618072000-memory.dmp	xmrig
behavioral2/memory/964-343-0x00007FF73C170000-0x00007FF73C562000-memory.dmp	xmrig
behavioral2/memory/4296-332-0x00007FF7E3970000-0x00007FF7E3D62000-memory.dmp	xmrig
behavioral2/memory/4792-322-0x00007FF62C710000-0x00007FF62CB02000-memory.dmp	xmrig
behavioral2/memory/828-319-0x00007FF7ABFF0000-0x00007FF7AC3E2000-memory.dmp	xmrig
behavioral2/memory/1924-142-0x00007FF712EC0000-0x00007FF7132B2000-memory.dmp	xmrig
behavioral2/memory/3180-113-0x00007FF677590000-0x00007FF677982000-memory.dmp	xmrig
behavioral2/memory/5100-4400-0x00007FF6EB1C0000-0x00007FF6EB5B2000-memory.dmp	xmrig
behavioral2/memory/3180-4393-0x00007FF677590000-0x00007FF677982000-memory.dmp	xmrig
behavioral2/memory/2488-4431-0x00007FF6DEE10000-0x00007FF6DF202000-memory.dmp	xmrig
behavioral2/memory/964-4438-0x00007FF73C170000-0x00007FF73C562000-memory.dmp	xmrig
behavioral2/memory/408-4456-0x00007FF7383F0000-0x00007FF7387E2000-memory.dmp	xmrig
behavioral2/memory/2064-4443-0x00007FF6B0520000-0x00007FF6B0912000-memory.dmp	xmrig
behavioral2/memory/828-4480-0x00007FF7ABFF0000-0x00007FF7AC3E2000-memory.dmp	xmrig
behavioral2/memory/4792-4478-0x00007FF62C710000-0x00007FF62CB02000-memory.dmp	xmrig
behavioral2/memory/1336-4507-0x00007FF662600000-0x00007FF6629F2000-memory.dmp	xmrig
behavioral2/memory/3776-4575-0x00007FF746F10000-0x00007FF747302000-memory.dmp	xmrig
behavioral2/memory/1236-4522-0x00007FF617C80000-0x00007FF618072000-memory.dmp	xmrig
behavioral2/memory/4028-4526-0x00007FF61FD20000-0x00007FF620112000-memory.dmp	xmrig
behavioral2/memory/4592-4516-0x00007FF601DF0000-0x00007FF6021E2000-memory.dmp	xmrig
behavioral2/memory/3316-4510-0x00007FF638D80000-0x00007FF639172000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2572	vhoGBdV.exe
5100	AgzQzXv.exe
3180	hVZCHwW.exe
1924	QrJXsdF.exe
1184	IGHjuhc.exe
3584	xrpctDv.exe
5060	lpiwzUd.exe
1336	RizfTMn.exe
2488	FlEkrhV.exe
2064	aBsmOGu.exe
408	WBROMgV.exe
828	nhVRedA.exe
4792	zAehWWF.exe
3316	PSBWhYk.exe
4296	PrtMCYB.exe
964	CzWtQhL.exe
1236	fQPsurI.exe
2140	BBNRPFd.exe
4028	HsoMVUX.exe
4592	siAYaop.exe
3776	Tnkzlka.exe
3060	vXXeRuK.exe
208	xPSiVme.exe
3088	cxfPXaC.exe
4728	sIjsHJN.exe
4976	gZLCsfe.exe
3864	XrfmCni.exe
4548	nFOoozq.exe
3392	WRlswgP.exe
4260	tPIcMyD.exe
640	tjJTusB.exe
1460	XXRvRoo.exe
2100	JxYekCx.exe
5012	eNiTadX.exe
1872	SHJgZQN.exe
4584	dFpcdWX.exe
836	QRHsTPd.exe
2180	JJIvLdb.exe
2844	blmhlCj.exe
3176	xLoPefY.exe
3772	rPgTfff.exe
4572	sUtBrYu.exe
3544	WOUawSL.exe
3520	OHiJSZy.exe
4200	clnooGM.exe
4544	JujOKhb.exe
2576	OgqyDIQ.exe
2496	Rfcxjtd.exe
2196	VvytQcy.exe
384	eLepHFx.exe
4884	ZXIsGrQ.exe
2460	xIUGrBj.exe
4556	KWkVggj.exe
760	zHoLlHz.exe
4804	ICJofAo.exe
532	xfLvoJK.exe
4528	WVREXzE.exe
4256	TapoNDU.exe
5088	VNUhALd.exe
4364	MFYygXg.exe
212	hzSnyjZ.exe
4192	XHFCLEa.exe
396	tGfcuwO.exe
2448	YxzZxqO.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4420-0-0x00007FF71A1A0000-0x00007FF71A592000-memory.dmp	upx
behavioral2/files/0x000a000000023bca-7.dat	upx
behavioral2/files/0x000a000000023bcf-42.dat	upx
behavioral2/files/0x000a000000023bd0-44.dat	upx
behavioral2/files/0x000a000000023bd5-62.dat	upx
behavioral2/files/0x000a000000023bd4-98.dat	upx
behavioral2/files/0x000a000000023bd3-97.dat	upx
behavioral2/files/0x000a000000023bda-149.dat	upx
behavioral2/memory/1184-188-0x00007FF6201E0000-0x00007FF6205D2000-memory.dmp	upx
behavioral2/memory/5060-205-0x00007FF74D590000-0x00007FF74D982000-memory.dmp	upx
behavioral2/memory/2488-265-0x00007FF6DEE10000-0x00007FF6DF202000-memory.dmp	upx
behavioral2/memory/1336-226-0x00007FF662600000-0x00007FF6629F2000-memory.dmp	upx
behavioral2/memory/3584-204-0x00007FF6ECB50000-0x00007FF6ECF42000-memory.dmp	upx
behavioral2/files/0x0008000000023c00-184.dat	upx
behavioral2/files/0x000b000000023bc6-183.dat	upx
behavioral2/files/0x000a000000023bdd-182.dat	upx
behavioral2/files/0x000a000000023be0-177.dat	upx
behavioral2/memory/2064-279-0x00007FF6B0520000-0x00007FF6B0912000-memory.dmp	upx
behavioral2/memory/408-287-0x00007FF7383F0000-0x00007FF7387E2000-memory.dmp	upx
behavioral2/memory/3316-329-0x00007FF638D80000-0x00007FF639172000-memory.dmp	upx
behavioral2/memory/2140-372-0x00007FF768640000-0x00007FF768A32000-memory.dmp	upx
behavioral2/memory/4028-380-0x00007FF61FD20000-0x00007FF620112000-memory.dmp	upx
behavioral2/memory/3776-396-0x00007FF746F10000-0x00007FF747302000-memory.dmp	upx
behavioral2/memory/5100-395-0x00007FF6EB1C0000-0x00007FF6EB5B2000-memory.dmp	upx
behavioral2/memory/4592-392-0x00007FF601DF0000-0x00007FF6021E2000-memory.dmp	upx
behavioral2/memory/1236-366-0x00007FF617C80000-0x00007FF618072000-memory.dmp	upx
behavioral2/memory/964-343-0x00007FF73C170000-0x00007FF73C562000-memory.dmp	upx
behavioral2/memory/4296-332-0x00007FF7E3970000-0x00007FF7E3D62000-memory.dmp	upx
behavioral2/memory/4792-322-0x00007FF62C710000-0x00007FF62CB02000-memory.dmp	upx
behavioral2/memory/828-319-0x00007FF7ABFF0000-0x00007FF7AC3E2000-memory.dmp	upx
behavioral2/files/0x000a000000023bdf-172.dat	upx
behavioral2/files/0x000a000000023bde-170.dat	upx
behavioral2/files/0x000a000000023bd9-166.dat	upx
behavioral2/files/0x000a000000023bdc-163.dat	upx
behavioral2/files/0x000e000000023bf7-162.dat	upx
behavioral2/files/0x000b000000023be6-161.dat	upx
behavioral2/files/0x000a000000023be5-160.dat	upx
behavioral2/files/0x000a000000023be3-153.dat	upx
behavioral2/files/0x000a000000023be2-152.dat	upx
behavioral2/files/0x000b000000023be8-151.dat	upx
behavioral2/files/0x000a000000023bd8-145.dat	upx
behavioral2/memory/1924-142-0x00007FF712EC0000-0x00007FF7132B2000-memory.dmp	upx
behavioral2/files/0x000b000000023be7-139.dat	upx
behavioral2/files/0x000a000000023bf0-159.dat	upx
behavioral2/files/0x000a000000023be4-154.dat	upx
behavioral2/files/0x000a000000023bd6-115.dat	upx
behavioral2/memory/3180-113-0x00007FF677590000-0x00007FF677982000-memory.dmp	upx
behavioral2/files/0x000a000000023bdb-107.dat	upx
behavioral2/files/0x000a000000023bd2-87.dat	upx
behavioral2/files/0x000a000000023bd7-84.dat	upx
behavioral2/files/0x000a000000023be1-125.dat	upx
behavioral2/files/0x000a000000023bd1-74.dat	upx
behavioral2/files/0x000a000000023bce-70.dat	upx
behavioral2/files/0x000a000000023bcd-64.dat	upx
behavioral2/files/0x000a000000023bcc-32.dat	upx
behavioral2/files/0x000a000000023bc9-28.dat	upx
behavioral2/files/0x000a000000023bcb-26.dat	upx
behavioral2/memory/2572-19-0x00007FF7CBC30000-0x00007FF7CC022000-memory.dmp	upx
behavioral2/files/0x000c000000023bc2-12.dat	upx
behavioral2/memory/5100-4400-0x00007FF6EB1C0000-0x00007FF6EB5B2000-memory.dmp	upx
behavioral2/memory/3180-4393-0x00007FF677590000-0x00007FF677982000-memory.dmp	upx
behavioral2/memory/2488-4431-0x00007FF6DEE10000-0x00007FF6DF202000-memory.dmp	upx
behavioral2/memory/964-4438-0x00007FF73C170000-0x00007FF73C562000-memory.dmp	upx
behavioral2/memory/408-4456-0x00007FF7383F0000-0x00007FF7387E2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QczsPkE.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\udSMmjD.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\jmehydH.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\bbhTxWN.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\EEUyHxa.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\zIPEIFv.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\MjFdDAA.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\LTchPcE.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\elaqmrt.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\AnDrTnz.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\fpihPDR.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\gSBvduN.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\rZmiUmm.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\vzlNtYJ.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\NtIAHQx.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\meSGXps.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\jdtHMnV.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\MkrfYjX.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\HwNlVgP.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\nxZvxks.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\uoJisMK.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\TwHqjVL.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\jqpUpHM.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\KstqZYi.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\MYMoyFf.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\xznepOL.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\FPcgxsj.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\ACUScIR.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\gsIODEX.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\XMfADBJ.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\MvdqCyt.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\BLECgia.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\WtbpGTx.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\AbmmnTa.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\ZeBqAvi.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\TsFhfln.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\MOoWPWG.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\WOIdodj.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\aDbkMXF.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\yVNNFfT.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\jhwMDBd.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\UzRnaLO.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\rHuWhqZ.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\nrYOdDE.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\WLluaWd.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\bTIvqoM.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\qhxmazs.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\htpfzYL.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\fmzpFVZ.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\UDRxZiZ.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\fRkpsBa.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\LJnJuje.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\qGSprHo.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\ZWuawgT.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\mDxuPeU.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\zyCXoEr.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\UiHMnlg.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\TCeibMJ.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\USATefm.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\ZcZLoJy.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\RqwBimx.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\CuMFazG.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\kLCLKAN.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\jeGfIFH.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4512	powershell.exe
4512	powershell.exe
4512	powershell.exe
4512	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeLockMemoryPrivilege	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 4512	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	84
PID 4420 wrote to memory of 4512	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	84
PID 4420 wrote to memory of 2572	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	85
PID 4420 wrote to memory of 2572	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	85
PID 4420 wrote to memory of 1924	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	86
PID 4420 wrote to memory of 1924	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	86
PID 4420 wrote to memory of 5100	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	87
PID 4420 wrote to memory of 5100	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	87
PID 4420 wrote to memory of 3180	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	88
PID 4420 wrote to memory of 3180	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	88
PID 4420 wrote to memory of 1184	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	89
PID 4420 wrote to memory of 1184	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	89
PID 4420 wrote to memory of 3584	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	90
PID 4420 wrote to memory of 3584	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	90
PID 4420 wrote to memory of 408	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	91
PID 4420 wrote to memory of 408	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	91
PID 4420 wrote to memory of 5060	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	92
PID 4420 wrote to memory of 5060	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	92
PID 4420 wrote to memory of 1336	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	93
PID 4420 wrote to memory of 1336	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	93
PID 4420 wrote to memory of 2488	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	94
PID 4420 wrote to memory of 2488	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	94
PID 4420 wrote to memory of 2064	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	95
PID 4420 wrote to memory of 2064	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	95
PID 4420 wrote to memory of 828	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	96
PID 4420 wrote to memory of 828	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	96
PID 4420 wrote to memory of 4792	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	97
PID 4420 wrote to memory of 4792	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	97
PID 4420 wrote to memory of 3316	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	98
PID 4420 wrote to memory of 3316	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	98
PID 4420 wrote to memory of 4296	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	99
PID 4420 wrote to memory of 4296	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	99
PID 4420 wrote to memory of 964	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	100
PID 4420 wrote to memory of 964	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	100
PID 4420 wrote to memory of 1236	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	101
PID 4420 wrote to memory of 1236	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	101
PID 4420 wrote to memory of 2140	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	102
PID 4420 wrote to memory of 2140	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	102
PID 4420 wrote to memory of 4028	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	103
PID 4420 wrote to memory of 4028	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	103
PID 4420 wrote to memory of 4592	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	104
PID 4420 wrote to memory of 4592	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	104
PID 4420 wrote to memory of 3776	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	105
PID 4420 wrote to memory of 3776	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	105
PID 4420 wrote to memory of 3060	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	106
PID 4420 wrote to memory of 3060	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	106
PID 4420 wrote to memory of 208	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	107
PID 4420 wrote to memory of 208	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	107
PID 4420 wrote to memory of 3088	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	108
PID 4420 wrote to memory of 3088	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	108
PID 4420 wrote to memory of 4728	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	109
PID 4420 wrote to memory of 4728	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	109
PID 4420 wrote to memory of 4976	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	110
PID 4420 wrote to memory of 4976	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	110
PID 4420 wrote to memory of 640	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	111
PID 4420 wrote to memory of 640	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	111
PID 4420 wrote to memory of 3864	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	112
PID 4420 wrote to memory of 3864	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	112
PID 4420 wrote to memory of 4548	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	113
PID 4420 wrote to memory of 4548	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	113
PID 4420 wrote to memory of 2100	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	114
PID 4420 wrote to memory of 2100	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	114
PID 4420 wrote to memory of 5012	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	115
PID 4420 wrote to memory of 5012	4420	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4512
- C:\Windows\System\vhoGBdV.exe
  C:\Windows\System\vhoGBdV.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\QrJXsdF.exe
  C:\Windows\System\QrJXsdF.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\AgzQzXv.exe
  C:\Windows\System\AgzQzXv.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\hVZCHwW.exe
  C:\Windows\System\hVZCHwW.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\IGHjuhc.exe
  C:\Windows\System\IGHjuhc.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\xrpctDv.exe
  C:\Windows\System\xrpctDv.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\WBROMgV.exe
  C:\Windows\System\WBROMgV.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\lpiwzUd.exe
  C:\Windows\System\lpiwzUd.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\RizfTMn.exe
  C:\Windows\System\RizfTMn.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\FlEkrhV.exe
  C:\Windows\System\FlEkrhV.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\aBsmOGu.exe
  C:\Windows\System\aBsmOGu.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\nhVRedA.exe
  C:\Windows\System\nhVRedA.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\zAehWWF.exe
  C:\Windows\System\zAehWWF.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\PSBWhYk.exe
  C:\Windows\System\PSBWhYk.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\PrtMCYB.exe
  C:\Windows\System\PrtMCYB.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\CzWtQhL.exe
  C:\Windows\System\CzWtQhL.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\fQPsurI.exe
  C:\Windows\System\fQPsurI.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\BBNRPFd.exe
  C:\Windows\System\BBNRPFd.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\HsoMVUX.exe
  C:\Windows\System\HsoMVUX.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\siAYaop.exe
  C:\Windows\System\siAYaop.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\Tnkzlka.exe
  C:\Windows\System\Tnkzlka.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\vXXeRuK.exe
  C:\Windows\System\vXXeRuK.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\xPSiVme.exe
  C:\Windows\System\xPSiVme.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\cxfPXaC.exe
  C:\Windows\System\cxfPXaC.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\sIjsHJN.exe
  C:\Windows\System\sIjsHJN.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\gZLCsfe.exe
  C:\Windows\System\gZLCsfe.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\tjJTusB.exe
  C:\Windows\System\tjJTusB.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\XrfmCni.exe
  C:\Windows\System\XrfmCni.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\nFOoozq.exe
  C:\Windows\System\nFOoozq.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\JxYekCx.exe
  C:\Windows\System\JxYekCx.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\eNiTadX.exe
  C:\Windows\System\eNiTadX.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\WRlswgP.exe
  C:\Windows\System\WRlswgP.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\tPIcMyD.exe
  C:\Windows\System\tPIcMyD.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\XXRvRoo.exe
  C:\Windows\System\XXRvRoo.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\SHJgZQN.exe
  C:\Windows\System\SHJgZQN.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\dFpcdWX.exe
  C:\Windows\System\dFpcdWX.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\QRHsTPd.exe
  C:\Windows\System\QRHsTPd.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\JujOKhb.exe
  C:\Windows\System\JujOKhb.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\JJIvLdb.exe
  C:\Windows\System\JJIvLdb.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\blmhlCj.exe
  C:\Windows\System\blmhlCj.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\xLoPefY.exe
  C:\Windows\System\xLoPefY.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\rPgTfff.exe
  C:\Windows\System\rPgTfff.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\sUtBrYu.exe
  C:\Windows\System\sUtBrYu.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\WOUawSL.exe
  C:\Windows\System\WOUawSL.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\OHiJSZy.exe
  C:\Windows\System\OHiJSZy.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\clnooGM.exe
  C:\Windows\System\clnooGM.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\OgqyDIQ.exe
  C:\Windows\System\OgqyDIQ.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\Rfcxjtd.exe
  C:\Windows\System\Rfcxjtd.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\VvytQcy.exe
  C:\Windows\System\VvytQcy.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\eLepHFx.exe
  C:\Windows\System\eLepHFx.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\ZXIsGrQ.exe
  C:\Windows\System\ZXIsGrQ.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\xIUGrBj.exe
  C:\Windows\System\xIUGrBj.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\KWkVggj.exe
  C:\Windows\System\KWkVggj.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\zHoLlHz.exe
  C:\Windows\System\zHoLlHz.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\ICJofAo.exe
  C:\Windows\System\ICJofAo.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\xfLvoJK.exe
  C:\Windows\System\xfLvoJK.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\WVREXzE.exe
  C:\Windows\System\WVREXzE.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\TapoNDU.exe
  C:\Windows\System\TapoNDU.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\VNUhALd.exe
  C:\Windows\System\VNUhALd.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\MFYygXg.exe
  C:\Windows\System\MFYygXg.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\hzSnyjZ.exe
  C:\Windows\System\hzSnyjZ.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\XHFCLEa.exe
  C:\Windows\System\XHFCLEa.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\tGfcuwO.exe
  C:\Windows\System\tGfcuwO.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\YxzZxqO.exe
  C:\Windows\System\YxzZxqO.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\UrrNiGa.exe
  C:\Windows\System\UrrNiGa.exe
  2⤵
  PID:1572
- C:\Windows\System\gpfXkpb.exe
  C:\Windows\System\gpfXkpb.exe
  2⤵
  PID:4456
- C:\Windows\System\jRBDQfv.exe
  C:\Windows\System\jRBDQfv.exe
  2⤵
  PID:3056
- C:\Windows\System\qzEBlqS.exe
  C:\Windows\System\qzEBlqS.exe
  2⤵
  PID:3480
- C:\Windows\System\SeoTinI.exe
  C:\Windows\System\SeoTinI.exe
  2⤵
  PID:436
- C:\Windows\System\GrIPxdm.exe
  C:\Windows\System\GrIPxdm.exe
  2⤵
  PID:628
- C:\Windows\System\wyGmwze.exe
  C:\Windows\System\wyGmwze.exe
  2⤵
  PID:3632
- C:\Windows\System\GMFHrZI.exe
  C:\Windows\System\GMFHrZI.exe
  2⤵
  PID:3820
- C:\Windows\System\eWggFKf.exe
  C:\Windows\System\eWggFKf.exe
  2⤵
  PID:4148
- C:\Windows\System\BQFveYf.exe
  C:\Windows\System\BQFveYf.exe
  2⤵
  PID:4320
- C:\Windows\System\wjhqhGu.exe
  C:\Windows\System\wjhqhGu.exe
  2⤵
  PID:4012
- C:\Windows\System\sQWRLcD.exe
  C:\Windows\System\sQWRLcD.exe
  2⤵
  PID:2668
- C:\Windows\System\ABEEkeo.exe
  C:\Windows\System\ABEEkeo.exe
  2⤵
  PID:5132
- C:\Windows\System\DnBbEmx.exe
  C:\Windows\System\DnBbEmx.exe
  2⤵
  PID:5152
- C:\Windows\System\AANpExK.exe
  C:\Windows\System\AANpExK.exe
  2⤵
  PID:5180
- C:\Windows\System\AKgOxJL.exe
  C:\Windows\System\AKgOxJL.exe
  2⤵
  PID:5208
- C:\Windows\System\VxBegkP.exe
  C:\Windows\System\VxBegkP.exe
  2⤵
  PID:5232
- C:\Windows\System\hymFSZA.exe
  C:\Windows\System\hymFSZA.exe
  2⤵
  PID:5260
- C:\Windows\System\wGTCvOG.exe
  C:\Windows\System\wGTCvOG.exe
  2⤵
  PID:5280
- C:\Windows\System\NpZFqOx.exe
  C:\Windows\System\NpZFqOx.exe
  2⤵
  PID:5300
- C:\Windows\System\INKjjIO.exe
  C:\Windows\System\INKjjIO.exe
  2⤵
  PID:5512
- C:\Windows\System\BSaBhov.exe
  C:\Windows\System\BSaBhov.exe
  2⤵
  PID:5528
- C:\Windows\System\ZEcnCdC.exe
  C:\Windows\System\ZEcnCdC.exe
  2⤵
  PID:5556
- C:\Windows\System\mIcKGTW.exe
  C:\Windows\System\mIcKGTW.exe
  2⤵
  PID:5576
- C:\Windows\System\coBmNKM.exe
  C:\Windows\System\coBmNKM.exe
  2⤵
  PID:5608
- C:\Windows\System\hfsWHja.exe
  C:\Windows\System\hfsWHja.exe
  2⤵
  PID:5624
- C:\Windows\System\puZUhFH.exe
  C:\Windows\System\puZUhFH.exe
  2⤵
  PID:5640
- C:\Windows\System\KhRPESA.exe
  C:\Windows\System\KhRPESA.exe
  2⤵
  PID:5656
- C:\Windows\System\shPcBzq.exe
  C:\Windows\System\shPcBzq.exe
  2⤵
  PID:5672
- C:\Windows\System\ESBDgwm.exe
  C:\Windows\System\ESBDgwm.exe
  2⤵
  PID:5688
- C:\Windows\System\AZzMQuP.exe
  C:\Windows\System\AZzMQuP.exe
  2⤵
  PID:5704
- C:\Windows\System\QWRkKaf.exe
  C:\Windows\System\QWRkKaf.exe
  2⤵
  PID:5720
- C:\Windows\System\DsNEYwe.exe
  C:\Windows\System\DsNEYwe.exe
  2⤵
  PID:5744
- C:\Windows\System\pdmSdyu.exe
  C:\Windows\System\pdmSdyu.exe
  2⤵
  PID:5764
- C:\Windows\System\goOidZV.exe
  C:\Windows\System\goOidZV.exe
  2⤵
  PID:5872
- C:\Windows\System\bLKhAHq.exe
  C:\Windows\System\bLKhAHq.exe
  2⤵
  PID:5888
- C:\Windows\System\nwdJhED.exe
  C:\Windows\System\nwdJhED.exe
  2⤵
  PID:6088
- C:\Windows\System\DJpqksm.exe
  C:\Windows\System\DJpqksm.exe
  2⤵
  PID:6104
- C:\Windows\System\mIpzfaJ.exe
  C:\Windows\System\mIpzfaJ.exe
  2⤵
  PID:6120
- C:\Windows\System\KIfisxe.exe
  C:\Windows\System\KIfisxe.exe
  2⤵
  PID:6136
- C:\Windows\System\ZYEsQLE.exe
  C:\Windows\System\ZYEsQLE.exe
  2⤵
  PID:552
- C:\Windows\System\nTurMCz.exe
  C:\Windows\System\nTurMCz.exe
  2⤵
  PID:1392
- C:\Windows\System\fkWqMnU.exe
  C:\Windows\System\fkWqMnU.exe
  2⤵
  PID:1584
- C:\Windows\System\WyZZhcb.exe
  C:\Windows\System\WyZZhcb.exe
  2⤵
  PID:2392
- C:\Windows\System\pAYDnix.exe
  C:\Windows\System\pAYDnix.exe
  2⤵
  PID:2948
- C:\Windows\System\EAQdfmu.exe
  C:\Windows\System\EAQdfmu.exe
  2⤵
  PID:380
- C:\Windows\System\sIhpfWs.exe
  C:\Windows\System\sIhpfWs.exe
  2⤵
  PID:3944
- C:\Windows\System\ssMTWsT.exe
  C:\Windows\System\ssMTWsT.exe
  2⤵
  PID:4488
- C:\Windows\System\hDyplgU.exe
  C:\Windows\System\hDyplgU.exe
  2⤵
  PID:4432
- C:\Windows\System\RNhgWiM.exe
  C:\Windows\System\RNhgWiM.exe
  2⤵
  PID:2320
- C:\Windows\System\lJqavqD.exe
  C:\Windows\System\lJqavqD.exe
  2⤵
  PID:1544
- C:\Windows\System\sOnVFbH.exe
  C:\Windows\System\sOnVFbH.exe
  2⤵
  PID:5092
- C:\Windows\System\cHTlQrS.exe
  C:\Windows\System\cHTlQrS.exe
  2⤵
  PID:1576
- C:\Windows\System\WtGkbqD.exe
  C:\Windows\System\WtGkbqD.exe
  2⤵
  PID:4376
- C:\Windows\System\UYDNBRS.exe
  C:\Windows\System\UYDNBRS.exe
  2⤵
  PID:3196
- C:\Windows\System\VqHQSgx.exe
  C:\Windows\System\VqHQSgx.exe
  2⤵
  PID:4460
- C:\Windows\System\maTmubs.exe
  C:\Windows\System\maTmubs.exe
  2⤵
  PID:5148
- C:\Windows\System\dWHJSyj.exe
  C:\Windows\System\dWHJSyj.exe
  2⤵
  PID:5176
- C:\Windows\System\lOdERzV.exe
  C:\Windows\System\lOdERzV.exe
  2⤵
  PID:5272
- C:\Windows\System\rMSLTMi.exe
  C:\Windows\System\rMSLTMi.exe
  2⤵
  PID:5220
- C:\Windows\System\xbySPYF.exe
  C:\Windows\System\xbySPYF.exe
  2⤵
  PID:5348
- C:\Windows\System\pBfTPBr.exe
  C:\Windows\System\pBfTPBr.exe
  2⤵
  PID:5392
- C:\Windows\System\VRdvSxp.exe
  C:\Windows\System\VRdvSxp.exe
  2⤵
  PID:5440
- C:\Windows\System\CosmNUo.exe
  C:\Windows\System\CosmNUo.exe
  2⤵
  PID:5492
- C:\Windows\System\DXmnhUg.exe
  C:\Windows\System\DXmnhUg.exe
  2⤵
  PID:5568
- C:\Windows\System\pjDIcBE.exe
  C:\Windows\System\pjDIcBE.exe
  2⤵
  PID:5632
- C:\Windows\System\oihRsKL.exe
  C:\Windows\System\oihRsKL.exe
  2⤵
  PID:5680
- C:\Windows\System\etcUPrM.exe
  C:\Windows\System\etcUPrM.exe
  2⤵
  PID:5740
- C:\Windows\System\amjxmvg.exe
  C:\Windows\System\amjxmvg.exe
  2⤵
  PID:5760
- C:\Windows\System\ZxwVOpj.exe
  C:\Windows\System\ZxwVOpj.exe
  2⤵
  PID:5820
- C:\Windows\System\tybeJaR.exe
  C:\Windows\System\tybeJaR.exe
  2⤵
  PID:5864
- C:\Windows\System\kUpHSmm.exe
  C:\Windows\System\kUpHSmm.exe
  2⤵
  PID:464
- C:\Windows\System\qJFAwwk.exe
  C:\Windows\System\qJFAwwk.exe
  2⤵
  PID:6172
- C:\Windows\System\KSQfZGx.exe
  C:\Windows\System\KSQfZGx.exe
  2⤵
  PID:6188
- C:\Windows\System\EvIkUVK.exe
  C:\Windows\System\EvIkUVK.exe
  2⤵
  PID:6204
- C:\Windows\System\AgKwBsL.exe
  C:\Windows\System\AgKwBsL.exe
  2⤵
  PID:6224
- C:\Windows\System\umNlZZv.exe
  C:\Windows\System\umNlZZv.exe
  2⤵
  PID:6244
- C:\Windows\System\LHWvTJZ.exe
  C:\Windows\System\LHWvTJZ.exe
  2⤵
  PID:6260
- C:\Windows\System\nMCJXDS.exe
  C:\Windows\System\nMCJXDS.exe
  2⤵
  PID:6276
- C:\Windows\System\ztFQdoT.exe
  C:\Windows\System\ztFQdoT.exe
  2⤵
  PID:6292
- C:\Windows\System\KkQEXhk.exe
  C:\Windows\System\KkQEXhk.exe
  2⤵
  PID:6316
- C:\Windows\System\yckPlMz.exe
  C:\Windows\System\yckPlMz.exe
  2⤵
  PID:6336
- C:\Windows\System\HRUmgaG.exe
  C:\Windows\System\HRUmgaG.exe
  2⤵
  PID:6356
- C:\Windows\System\FjnSOxA.exe
  C:\Windows\System\FjnSOxA.exe
  2⤵
  PID:6380
- C:\Windows\System\jIHAcry.exe
  C:\Windows\System\jIHAcry.exe
  2⤵
  PID:6404
- C:\Windows\System\rvWzGrD.exe
  C:\Windows\System\rvWzGrD.exe
  2⤵
  PID:6432
- C:\Windows\System\FsiwgVk.exe
  C:\Windows\System\FsiwgVk.exe
  2⤵
  PID:6452
- C:\Windows\System\QqTaEvt.exe
  C:\Windows\System\QqTaEvt.exe
  2⤵
  PID:6472
- C:\Windows\System\jiqrJRV.exe
  C:\Windows\System\jiqrJRV.exe
  2⤵
  PID:6588
- C:\Windows\System\LqibpOq.exe
  C:\Windows\System\LqibpOq.exe
  2⤵
  PID:6612
- C:\Windows\System\qZPkIEB.exe
  C:\Windows\System\qZPkIEB.exe
  2⤵
  PID:6636
- C:\Windows\System\JpTPvmM.exe
  C:\Windows\System\JpTPvmM.exe
  2⤵
  PID:6660
- C:\Windows\System\qZaCdiC.exe
  C:\Windows\System\qZaCdiC.exe
  2⤵
  PID:6684
- C:\Windows\System\uFbopzp.exe
  C:\Windows\System\uFbopzp.exe
  2⤵
  PID:6788
- C:\Windows\System\ejDAsiV.exe
  C:\Windows\System\ejDAsiV.exe
  2⤵
  PID:6804
- C:\Windows\System\eDEqcjj.exe
  C:\Windows\System\eDEqcjj.exe
  2⤵
  PID:6820
- C:\Windows\System\ksygaaX.exe
  C:\Windows\System\ksygaaX.exe
  2⤵
  PID:6844
- C:\Windows\System\lkCekGL.exe
  C:\Windows\System\lkCekGL.exe
  2⤵
  PID:6868
- C:\Windows\System\rmaTJVC.exe
  C:\Windows\System\rmaTJVC.exe
  2⤵
  PID:6884
- C:\Windows\System\locuiaT.exe
  C:\Windows\System\locuiaT.exe
  2⤵
  PID:6908
- C:\Windows\System\zChPSXJ.exe
  C:\Windows\System\zChPSXJ.exe
  2⤵
  PID:6932
- C:\Windows\System\UPOqPYS.exe
  C:\Windows\System\UPOqPYS.exe
  2⤵
  PID:6952
- C:\Windows\System\ndWuFwR.exe
  C:\Windows\System\ndWuFwR.exe
  2⤵
  PID:7076
- C:\Windows\System\zcPlrLQ.exe
  C:\Windows\System\zcPlrLQ.exe
  2⤵
  PID:7164
- C:\Windows\System\NsZBUQX.exe
  C:\Windows\System\NsZBUQX.exe
  2⤵
  PID:3324
- C:\Windows\System\RlqYIXz.exe
  C:\Windows\System\RlqYIXz.exe
  2⤵
  PID:2032
- C:\Windows\System\vaeJYJn.exe
  C:\Windows\System\vaeJYJn.exe
  2⤵
  PID:2396
- C:\Windows\System\qsOwAOE.exe
  C:\Windows\System\qsOwAOE.exe
  2⤵
  PID:5216
- C:\Windows\System\lKzHgPY.exe
  C:\Windows\System\lKzHgPY.exe
  2⤵
  PID:6112
- C:\Windows\System\LZMALzq.exe
  C:\Windows\System\LZMALzq.exe
  2⤵
  PID:5036
- C:\Windows\System\xXkfVQH.exe
  C:\Windows\System\xXkfVQH.exe
  2⤵
  PID:6180
- C:\Windows\System\IaiSDSl.exe
  C:\Windows\System\IaiSDSl.exe
  2⤵
  PID:6212
- C:\Windows\System\TxnQmug.exe
  C:\Windows\System\TxnQmug.exe
  2⤵
  PID:6236
- C:\Windows\System\RrzgHCP.exe
  C:\Windows\System\RrzgHCP.exe
  2⤵
  PID:6268
- C:\Windows\System\CkiggLb.exe
  C:\Windows\System\CkiggLb.exe
  2⤵
  PID:6300
- C:\Windows\System\hIzsRTQ.exe
  C:\Windows\System\hIzsRTQ.exe
  2⤵
  PID:6324
- C:\Windows\System\HcZfbiU.exe
  C:\Windows\System\HcZfbiU.exe
  2⤵
  PID:6348
- C:\Windows\System\lJkYHsq.exe
  C:\Windows\System\lJkYHsq.exe
  2⤵
  PID:6376
- C:\Windows\System\zJBOEjR.exe
  C:\Windows\System\zJBOEjR.exe
  2⤵
  PID:6412
- C:\Windows\System\yllgYhp.exe
  C:\Windows\System\yllgYhp.exe
  2⤵
  PID:6448
- C:\Windows\System\oSsfLAi.exe
  C:\Windows\System\oSsfLAi.exe
  2⤵
  PID:6544
- C:\Windows\System\XUXAePR.exe
  C:\Windows\System\XUXAePR.exe
  2⤵
  PID:6668
- C:\Windows\System\fvMUBxO.exe
  C:\Windows\System\fvMUBxO.exe
  2⤵
  PID:6736
- C:\Windows\System\SWkrTCv.exe
  C:\Windows\System\SWkrTCv.exe
  2⤵
  PID:6796
- C:\Windows\System\VQEKSpB.exe
  C:\Windows\System\VQEKSpB.exe
  2⤵
  PID:6964
- C:\Windows\System\fWZIdGn.exe
  C:\Windows\System\fWZIdGn.exe
  2⤵
  PID:7036
- C:\Windows\System\YPMlkOe.exe
  C:\Windows\System\YPMlkOe.exe
  2⤵
  PID:7072
- C:\Windows\System\hMMtIsO.exe
  C:\Windows\System\hMMtIsO.exe
  2⤵
  PID:4908
- C:\Windows\System\dGBctTp.exe
  C:\Windows\System\dGBctTp.exe
  2⤵
  PID:6312
- C:\Windows\System\vrVfWXT.exe
  C:\Windows\System\vrVfWXT.exe
  2⤵
  PID:6696
- C:\Windows\System\tAUMzLk.exe
  C:\Windows\System\tAUMzLk.exe
  2⤵
  PID:6396
- C:\Windows\System\JZfTLOM.exe
  C:\Windows\System\JZfTLOM.exe
  2⤵
  PID:6480
- C:\Windows\System\SoUYkex.exe
  C:\Windows\System\SoUYkex.exe
  2⤵
  PID:2444
- C:\Windows\System\smYDThq.exe
  C:\Windows\System\smYDThq.exe
  2⤵
  PID:6596
- C:\Windows\System\NQMFfmp.exe
  C:\Windows\System\NQMFfmp.exe
  2⤵
  PID:624
- C:\Windows\System\XgMZwBp.exe
  C:\Windows\System\XgMZwBp.exe
  2⤵
  PID:6752
- C:\Windows\System\JmVBcTw.exe
  C:\Windows\System\JmVBcTw.exe
  2⤵
  PID:3064
- C:\Windows\System\wKWJKTT.exe
  C:\Windows\System\wKWJKTT.exe
  2⤵
  PID:6944
- C:\Windows\System\lKxQlPy.exe
  C:\Windows\System\lKxQlPy.exe
  2⤵
  PID:3668
- C:\Windows\System\EgTHcwO.exe
  C:\Windows\System\EgTHcwO.exe
  2⤵
  PID:5140
- C:\Windows\System\IUjspTa.exe
  C:\Windows\System\IUjspTa.exe
  2⤵
  PID:6128
- C:\Windows\System\ddmqAsS.exe
  C:\Windows\System\ddmqAsS.exe
  2⤵
  PID:1932
- C:\Windows\System\mHCKLdA.exe
  C:\Windows\System\mHCKLdA.exe
  2⤵
  PID:2568
- C:\Windows\System\AxMtUVA.exe
  C:\Windows\System\AxMtUVA.exe
  2⤵
  PID:1180
- C:\Windows\System\PirarDT.exe
  C:\Windows\System\PirarDT.exe
  2⤵
  PID:5948
- C:\Windows\System\FKpaSdW.exe
  C:\Windows\System\FKpaSdW.exe
  2⤵
  PID:5296
- C:\Windows\System\XMfADBJ.exe
  C:\Windows\System\XMfADBJ.exe
  2⤵
  PID:5396
- C:\Windows\System\AsYnsZw.exe
  C:\Windows\System\AsYnsZw.exe
  2⤵
  PID:4208
- C:\Windows\System\zfhHEcu.exe
  C:\Windows\System\zfhHEcu.exe
  2⤵
  PID:4500
- C:\Windows\System\PfOxMOZ.exe
  C:\Windows\System\PfOxMOZ.exe
  2⤵
  PID:2416
- C:\Windows\System\YqkcIlU.exe
  C:\Windows\System\YqkcIlU.exe
  2⤵
  PID:6552
- C:\Windows\System\fWUExKN.exe
  C:\Windows\System\fWUExKN.exe
  2⤵
  PID:3988
- C:\Windows\System\hTAsjUE.exe
  C:\Windows\System\hTAsjUE.exe
  2⤵
  PID:6720
- C:\Windows\System\OKXrbXX.exe
  C:\Windows\System\OKXrbXX.exe
  2⤵
  PID:6928
- C:\Windows\System\QNExJCX.exe
  C:\Windows\System\QNExJCX.exe
  2⤵
  PID:5696
- C:\Windows\System\vllCPmC.exe
  C:\Windows\System\vllCPmC.exe
  2⤵
  PID:2156
- C:\Windows\System\pfLtUIm.exe
  C:\Windows\System\pfLtUIm.exe
  2⤵
  PID:4152
- C:\Windows\System\kLwlfeK.exe
  C:\Windows\System\kLwlfeK.exe
  2⤵
  PID:2160
- C:\Windows\System\idIwwQl.exe
  C:\Windows\System\idIwwQl.exe
  2⤵
  PID:1528
- C:\Windows\System\euFKYbs.exe
  C:\Windows\System\euFKYbs.exe
  2⤵
  PID:6372
- C:\Windows\System\sOPrkdT.exe
  C:\Windows\System\sOPrkdT.exe
  2⤵
  PID:7188
- C:\Windows\System\ZzDYadq.exe
  C:\Windows\System\ZzDYadq.exe
  2⤵
  PID:7204
- C:\Windows\System\bkjdTsC.exe
  C:\Windows\System\bkjdTsC.exe
  2⤵
  PID:7228
- C:\Windows\System\yzSegAq.exe
  C:\Windows\System\yzSegAq.exe
  2⤵
  PID:7252
- C:\Windows\System\wannTVH.exe
  C:\Windows\System\wannTVH.exe
  2⤵
  PID:7272
- C:\Windows\System\lDIOros.exe
  C:\Windows\System\lDIOros.exe
  2⤵
  PID:7296
- C:\Windows\System\SpnCkKn.exe
  C:\Windows\System\SpnCkKn.exe
  2⤵
  PID:7316
- C:\Windows\System\kFcOJLv.exe
  C:\Windows\System\kFcOJLv.exe
  2⤵
  PID:7340
- C:\Windows\System\vDKBMlL.exe
  C:\Windows\System\vDKBMlL.exe
  2⤵
  PID:7372
- C:\Windows\System\jiIrjmM.exe
  C:\Windows\System\jiIrjmM.exe
  2⤵
  PID:7392
- C:\Windows\System\dMMpUCV.exe
  C:\Windows\System\dMMpUCV.exe
  2⤵
  PID:7420
- C:\Windows\System\thDrDwA.exe
  C:\Windows\System\thDrDwA.exe
  2⤵
  PID:7440
- C:\Windows\System\ropFkqL.exe
  C:\Windows\System\ropFkqL.exe
  2⤵
  PID:7464
- C:\Windows\System\xQZYRNV.exe
  C:\Windows\System\xQZYRNV.exe
  2⤵
  PID:7488
- C:\Windows\System\xlGBjyc.exe
  C:\Windows\System\xlGBjyc.exe
  2⤵
  PID:7512
- C:\Windows\System\dwafDDI.exe
  C:\Windows\System\dwafDDI.exe
  2⤵
  PID:7540
- C:\Windows\System\dmQwZIC.exe
  C:\Windows\System\dmQwZIC.exe
  2⤵
  PID:7556
- C:\Windows\System\GFDyslW.exe
  C:\Windows\System\GFDyslW.exe
  2⤵
  PID:7580
- C:\Windows\System\hEgtnMi.exe
  C:\Windows\System\hEgtnMi.exe
  2⤵
  PID:7596
- C:\Windows\System\mUTOVro.exe
  C:\Windows\System\mUTOVro.exe
  2⤵
  PID:7616
- C:\Windows\System\TdADFmm.exe
  C:\Windows\System\TdADFmm.exe
  2⤵
  PID:7640
- C:\Windows\System\EUJHrwn.exe
  C:\Windows\System\EUJHrwn.exe
  2⤵
  PID:7664
- C:\Windows\System\qhnysqK.exe
  C:\Windows\System\qhnysqK.exe
  2⤵
  PID:7692
- C:\Windows\System\YxRBYFd.exe
  C:\Windows\System\YxRBYFd.exe
  2⤵
  PID:7712
- C:\Windows\System\xImwMJm.exe
  C:\Windows\System\xImwMJm.exe
  2⤵
  PID:7732
- C:\Windows\System\bJMcNAn.exe
  C:\Windows\System\bJMcNAn.exe
  2⤵
  PID:7752
- C:\Windows\System\WWOuoTa.exe
  C:\Windows\System\WWOuoTa.exe
  2⤵
  PID:7772
- C:\Windows\System\XSmaYRD.exe
  C:\Windows\System\XSmaYRD.exe
  2⤵
  PID:7792
- C:\Windows\System\PpMARjR.exe
  C:\Windows\System\PpMARjR.exe
  2⤵
  PID:7816
- C:\Windows\System\MlWgXkp.exe
  C:\Windows\System\MlWgXkp.exe
  2⤵
  PID:7840
- C:\Windows\System\pAnTPUG.exe
  C:\Windows\System\pAnTPUG.exe
  2⤵
  PID:7868
- C:\Windows\System\JcOJeHl.exe
  C:\Windows\System\JcOJeHl.exe
  2⤵
  PID:7884
- C:\Windows\System\DEYhKKr.exe
  C:\Windows\System\DEYhKKr.exe
  2⤵
  PID:7916
- C:\Windows\System\nCiQUnV.exe
  C:\Windows\System\nCiQUnV.exe
  2⤵
  PID:7936
- C:\Windows\System\QvYBZjh.exe
  C:\Windows\System\QvYBZjh.exe
  2⤵
  PID:7964
- C:\Windows\System\rfzlghW.exe
  C:\Windows\System\rfzlghW.exe
  2⤵
  PID:7984
- C:\Windows\System\AJfZyvV.exe
  C:\Windows\System\AJfZyvV.exe
  2⤵
  PID:8004
- C:\Windows\System\OiMEWGI.exe
  C:\Windows\System\OiMEWGI.exe
  2⤵
  PID:8032
- C:\Windows\System\ciZgejU.exe
  C:\Windows\System\ciZgejU.exe
  2⤵
  PID:8056
- C:\Windows\System\fdFINCX.exe
  C:\Windows\System\fdFINCX.exe
  2⤵
  PID:8076
- C:\Windows\System\bWilhnd.exe
  C:\Windows\System\bWilhnd.exe
  2⤵
  PID:8100
- C:\Windows\System\bqNpzSi.exe
  C:\Windows\System\bqNpzSi.exe
  2⤵
  PID:8124
- C:\Windows\System\zjIhGTz.exe
  C:\Windows\System\zjIhGTz.exe
  2⤵
  PID:8152
- C:\Windows\System\KOgJptW.exe
  C:\Windows\System\KOgJptW.exe
  2⤵
  PID:8172
- C:\Windows\System\YnslBIF.exe
  C:\Windows\System\YnslBIF.exe
  2⤵
  PID:8188
- C:\Windows\System\zWvZegm.exe
  C:\Windows\System\zWvZegm.exe
  2⤵
  PID:6444
- C:\Windows\System\AcLtxIw.exe
  C:\Windows\System\AcLtxIw.exe
  2⤵
  PID:3840
- C:\Windows\System\RmOmuAc.exe
  C:\Windows\System\RmOmuAc.exe
  2⤵
  PID:548
- C:\Windows\System\qmnXspg.exe
  C:\Windows\System\qmnXspg.exe
  2⤵
  PID:3924
- C:\Windows\System\odgAqRJ.exe
  C:\Windows\System\odgAqRJ.exe
  2⤵
  PID:7324
- C:\Windows\System\gwEHSfJ.exe
  C:\Windows\System\gwEHSfJ.exe
  2⤵
  PID:7500
- C:\Windows\System\iHyXrBX.exe
  C:\Windows\System\iHyXrBX.exe
  2⤵
  PID:7528
- C:\Windows\System\Mrmvskv.exe
  C:\Windows\System\Mrmvskv.exe
  2⤵
  PID:4896
- C:\Windows\System\fhiaPOJ.exe
  C:\Windows\System\fhiaPOJ.exe
  2⤵
  PID:7184
- C:\Windows\System\OGScwNT.exe
  C:\Windows\System\OGScwNT.exe
  2⤵
  PID:7236
- C:\Windows\System\sGYolHN.exe
  C:\Windows\System\sGYolHN.exe
  2⤵
  PID:7568
- C:\Windows\System\ymKJJkZ.exe
  C:\Windows\System\ymKJJkZ.exe
  2⤵
  PID:7480
- C:\Windows\System\zqGwDqL.exe
  C:\Windows\System\zqGwDqL.exe
  2⤵
  PID:7408
- C:\Windows\System\gCCfSvq.exe
  C:\Windows\System\gCCfSvq.exe
  2⤵
  PID:3208
- C:\Windows\System\xKrelDe.exe
  C:\Windows\System\xKrelDe.exe
  2⤵
  PID:7656
- C:\Windows\System\OguxOIy.exe
  C:\Windows\System\OguxOIy.exe
  2⤵
  PID:8020
- C:\Windows\System\QgaBmjx.exe
  C:\Windows\System\QgaBmjx.exe
  2⤵
  PID:8048
- C:\Windows\System\OVJcdaM.exe
  C:\Windows\System\OVJcdaM.exe
  2⤵
  PID:7788
- C:\Windows\System\jknfYRk.exe
  C:\Windows\System\jknfYRk.exe
  2⤵
  PID:7880
- C:\Windows\System\DYQiYBF.exe
  C:\Windows\System\DYQiYBF.exe
  2⤵
  PID:7908
- C:\Windows\System\THensnc.exe
  C:\Windows\System\THensnc.exe
  2⤵
  PID:7980
- C:\Windows\System\gfLcRtX.exe
  C:\Windows\System\gfLcRtX.exe
  2⤵
  PID:7708
- C:\Windows\System\eBvqDcX.exe
  C:\Windows\System\eBvqDcX.exe
  2⤵
  PID:5084
- C:\Windows\System\WmfFOim.exe
  C:\Windows\System\WmfFOim.exe
  2⤵
  PID:7288
- C:\Windows\System\gnqJJRx.exe
  C:\Windows\System\gnqJJRx.exe
  2⤵
  PID:8092
- C:\Windows\System\JHcRsNf.exe
  C:\Windows\System\JHcRsNf.exe
  2⤵
  PID:8120
- C:\Windows\System\zqgcJWi.exe
  C:\Windows\System\zqgcJWi.exe
  2⤵
  PID:7244
- C:\Windows\System\ZsHAZvq.exe
  C:\Windows\System\ZsHAZvq.exe
  2⤵
  PID:8200
- C:\Windows\System\bJIrypw.exe
  C:\Windows\System\bJIrypw.exe
  2⤵
  PID:8220
- C:\Windows\System\LLojupH.exe
  C:\Windows\System\LLojupH.exe
  2⤵
  PID:8244
- C:\Windows\System\PwYFIcV.exe
  C:\Windows\System\PwYFIcV.exe
  2⤵
  PID:8264
- C:\Windows\System\NvFwLgu.exe
  C:\Windows\System\NvFwLgu.exe
  2⤵
  PID:8288
- C:\Windows\System\WeqnXzl.exe
  C:\Windows\System\WeqnXzl.exe
  2⤵
  PID:8312
- C:\Windows\System\BypzXpT.exe
  C:\Windows\System\BypzXpT.exe
  2⤵
  PID:8340
- C:\Windows\System\HLsOXme.exe
  C:\Windows\System\HLsOXme.exe
  2⤵
  PID:8360
- C:\Windows\System\muOPdPS.exe
  C:\Windows\System\muOPdPS.exe
  2⤵
  PID:8384
- C:\Windows\System\EtNewHW.exe
  C:\Windows\System\EtNewHW.exe
  2⤵
  PID:8408
- C:\Windows\System\QEULGTG.exe
  C:\Windows\System\QEULGTG.exe
  2⤵
  PID:8428
- C:\Windows\System\tCrwrve.exe
  C:\Windows\System\tCrwrve.exe
  2⤵
  PID:8452
- C:\Windows\System\QvGcOKh.exe
  C:\Windows\System\QvGcOKh.exe
  2⤵
  PID:8480
- C:\Windows\System\lSIClkW.exe
  C:\Windows\System\lSIClkW.exe
  2⤵
  PID:8500
- C:\Windows\System\jjhaBpG.exe
  C:\Windows\System\jjhaBpG.exe
  2⤵
  PID:8520
- C:\Windows\System\ztgfcsZ.exe
  C:\Windows\System\ztgfcsZ.exe
  2⤵
  PID:8548
- C:\Windows\System\aVkwLXZ.exe
  C:\Windows\System\aVkwLXZ.exe
  2⤵
  PID:8568
- C:\Windows\System\oAsanza.exe
  C:\Windows\System\oAsanza.exe
  2⤵
  PID:8588
- C:\Windows\System\KByRyzD.exe
  C:\Windows\System\KByRyzD.exe
  2⤵
  PID:8604
- C:\Windows\System\UloFKgA.exe
  C:\Windows\System\UloFKgA.exe
  2⤵
  PID:8628
- C:\Windows\System\mTjEmJd.exe
  C:\Windows\System\mTjEmJd.exe
  2⤵
  PID:8652
- C:\Windows\System\cbUkLqt.exe
  C:\Windows\System\cbUkLqt.exe
  2⤵
  PID:8676
- C:\Windows\System\bDiUnab.exe
  C:\Windows\System\bDiUnab.exe
  2⤵
  PID:8700
- C:\Windows\System\LihHTlX.exe
  C:\Windows\System\LihHTlX.exe
  2⤵
  PID:8716
- C:\Windows\System\stPCMaY.exe
  C:\Windows\System\stPCMaY.exe
  2⤵
  PID:8736
- C:\Windows\System\XvsWFST.exe
  C:\Windows\System\XvsWFST.exe
  2⤵
  PID:8756
- C:\Windows\System\YeLbLFG.exe
  C:\Windows\System\YeLbLFG.exe
  2⤵
  PID:8784
- C:\Windows\System\ZQfPSxq.exe
  C:\Windows\System\ZQfPSxq.exe
  2⤵
  PID:8800
- C:\Windows\System\KocArPm.exe
  C:\Windows\System\KocArPm.exe
  2⤵
  PID:8824
- C:\Windows\System\PFcamrj.exe
  C:\Windows\System\PFcamrj.exe
  2⤵
  PID:8848
- C:\Windows\System\SFCPzUt.exe
  C:\Windows\System\SFCPzUt.exe
  2⤵
  PID:8872
- C:\Windows\System\ALTpeTe.exe
  C:\Windows\System\ALTpeTe.exe
  2⤵
  PID:8892
- C:\Windows\System\lIjwfPJ.exe
  C:\Windows\System\lIjwfPJ.exe
  2⤵
  PID:8912
- C:\Windows\System\LDyqPTs.exe
  C:\Windows\System\LDyqPTs.exe
  2⤵
  PID:8936
- C:\Windows\System\esFIWFz.exe
  C:\Windows\System\esFIWFz.exe
  2⤵
  PID:8964
- C:\Windows\System\EDGHOfZ.exe
  C:\Windows\System\EDGHOfZ.exe
  2⤵
  PID:8988
- C:\Windows\System\uSvbzrc.exe
  C:\Windows\System\uSvbzrc.exe
  2⤵
  PID:9012
- C:\Windows\System\LSUkJVP.exe
  C:\Windows\System\LSUkJVP.exe
  2⤵
  PID:9032
- C:\Windows\System\hosBPPe.exe
  C:\Windows\System\hosBPPe.exe
  2⤵
  PID:9052
- C:\Windows\System\kvdGzaB.exe
  C:\Windows\System\kvdGzaB.exe
  2⤵
  PID:9072
- C:\Windows\System\FpOjrIz.exe
  C:\Windows\System\FpOjrIz.exe
  2⤵
  PID:9092
- C:\Windows\System\dwdauow.exe
  C:\Windows\System\dwdauow.exe
  2⤵
  PID:9120
- C:\Windows\System\OIjEwzp.exe
  C:\Windows\System\OIjEwzp.exe
  2⤵
  PID:9140
- C:\Windows\System\LloPAKc.exe
  C:\Windows\System\LloPAKc.exe
  2⤵
  PID:9164
- C:\Windows\System\qfxxHnz.exe
  C:\Windows\System\qfxxHnz.exe
  2⤵
  PID:9188
- C:\Windows\System\SvWzcmv.exe
  C:\Windows\System\SvWzcmv.exe
  2⤵
  PID:9212
- C:\Windows\System\HmUPmfL.exe
  C:\Windows\System\HmUPmfL.exe
  2⤵
  PID:8012
- C:\Windows\System\ZPVKAvV.exe
  C:\Windows\System\ZPVKAvV.exe
  2⤵
  PID:7808
- C:\Windows\System\uFYGQsw.exe
  C:\Windows\System\uFYGQsw.exe
  2⤵
  PID:8096
- C:\Windows\System\QXDqLJk.exe
  C:\Windows\System\QXDqLJk.exe
  2⤵
  PID:7388
- C:\Windows\System\APvMROZ.exe
  C:\Windows\System\APvMROZ.exe
  2⤵
  PID:7632
- C:\Windows\System\RXdhDJw.exe
  C:\Windows\System\RXdhDJw.exe
  2⤵
  PID:8252
- C:\Windows\System\DjbAney.exe
  C:\Windows\System\DjbAney.exe
  2⤵
  PID:8296
- C:\Windows\System\nHslSfe.exe
  C:\Windows\System\nHslSfe.exe
  2⤵
  PID:6812
- C:\Windows\System\cXevMAw.exe
  C:\Windows\System\cXevMAw.exe
  2⤵
  PID:7996
- C:\Windows\System\JMMqvOx.exe
  C:\Windows\System\JMMqvOx.exe
  2⤵
  PID:8368
- C:\Windows\System\FzuVcJR.exe
  C:\Windows\System\FzuVcJR.exe
  2⤵
  PID:8420
- C:\Windows\System\yAMAoIS.exe
  C:\Windows\System\yAMAoIS.exe
  2⤵
  PID:8540
- C:\Windows\System\WHUCCxw.exe
  C:\Windows\System\WHUCCxw.exe
  2⤵
  PID:8620
- C:\Windows\System\NtJSAEz.exe
  C:\Windows\System\NtJSAEz.exe
  2⤵
  PID:8752
- C:\Windows\System\VHOgwVA.exe
  C:\Windows\System\VHOgwVA.exe
  2⤵
  PID:8820
- C:\Windows\System\DktETHQ.exe
  C:\Windows\System\DktETHQ.exe
  2⤵
  PID:7976
- C:\Windows\System\zAGzZYF.exe
  C:\Windows\System\zAGzZYF.exe
  2⤵
  PID:7312
- C:\Windows\System\DcOMVIV.exe
  C:\Windows\System\DcOMVIV.exe
  2⤵
  PID:7432
- C:\Windows\System\qsUIgiv.exe
  C:\Windows\System\qsUIgiv.exe
  2⤵
  PID:9220
- C:\Windows\System\EsDtLKZ.exe
  C:\Windows\System\EsDtLKZ.exe
  2⤵
  PID:9244
- C:\Windows\System\PefDvnC.exe
  C:\Windows\System\PefDvnC.exe
  2⤵
  PID:9264
- C:\Windows\System\wShTCjF.exe
  C:\Windows\System\wShTCjF.exe
  2⤵
  PID:9288
- C:\Windows\System\hHzNxYC.exe
  C:\Windows\System\hHzNxYC.exe
  2⤵
  PID:9308
- C:\Windows\System\mXbuDOM.exe
  C:\Windows\System\mXbuDOM.exe
  2⤵
  PID:9328
- C:\Windows\System\PNhwUhw.exe
  C:\Windows\System\PNhwUhw.exe
  2⤵
  PID:9352
- C:\Windows\System\ebEqhjV.exe
  C:\Windows\System\ebEqhjV.exe
  2⤵
  PID:9376
- C:\Windows\System\qIHhWmY.exe
  C:\Windows\System\qIHhWmY.exe
  2⤵
  PID:9400
- C:\Windows\System\zwZQrfR.exe
  C:\Windows\System\zwZQrfR.exe
  2⤵
  PID:9420
- C:\Windows\System\BhaGjQO.exe
  C:\Windows\System\BhaGjQO.exe
  2⤵
  PID:9448
- C:\Windows\System\AbuOCly.exe
  C:\Windows\System\AbuOCly.exe
  2⤵
  PID:9472
- C:\Windows\System\LOSbuQr.exe
  C:\Windows\System\LOSbuQr.exe
  2⤵
  PID:9496
- C:\Windows\System\hbuZshf.exe
  C:\Windows\System\hbuZshf.exe
  2⤵
  PID:9512
- C:\Windows\System\MgYtXEP.exe
  C:\Windows\System\MgYtXEP.exe
  2⤵
  PID:9528
- C:\Windows\System\neYwfRN.exe
  C:\Windows\System\neYwfRN.exe
  2⤵
  PID:9552
- C:\Windows\System\qVaZryZ.exe
  C:\Windows\System\qVaZryZ.exe
  2⤵
  PID:9568
- C:\Windows\System\eTutgcc.exe
  C:\Windows\System\eTutgcc.exe
  2⤵
  PID:9584
- C:\Windows\System\foDmgdD.exe
  C:\Windows\System\foDmgdD.exe
  2⤵
  PID:9608
- C:\Windows\System\cHeMVsz.exe
  C:\Windows\System\cHeMVsz.exe
  2⤵
  PID:9628
- C:\Windows\System\iGPBXVJ.exe
  C:\Windows\System\iGPBXVJ.exe
  2⤵
  PID:9648
- C:\Windows\System\znyHoRH.exe
  C:\Windows\System\znyHoRH.exe
  2⤵
  PID:9672
- C:\Windows\System\zJJdcFD.exe
  C:\Windows\System\zJJdcFD.exe
  2⤵
  PID:9700
- C:\Windows\System\hcnHPFW.exe
  C:\Windows\System\hcnHPFW.exe
  2⤵
  PID:9724
- C:\Windows\System\nQzSUKD.exe
  C:\Windows\System\nQzSUKD.exe
  2⤵
  PID:9744
- C:\Windows\System\cUhmJYF.exe
  C:\Windows\System\cUhmJYF.exe
  2⤵
  PID:9772
- C:\Windows\System\MWwjrLv.exe
  C:\Windows\System\MWwjrLv.exe
  2⤵
  PID:9796
- C:\Windows\System\tArYVpJ.exe
  C:\Windows\System\tArYVpJ.exe
  2⤵
  PID:9816
- C:\Windows\System\KrYIDKm.exe
  C:\Windows\System\KrYIDKm.exe
  2⤵
  PID:9844
- C:\Windows\System\nCgqEpR.exe
  C:\Windows\System\nCgqEpR.exe
  2⤵
  PID:9864
- C:\Windows\System\nIoxYCU.exe
  C:\Windows\System\nIoxYCU.exe
  2⤵
  PID:9896
- C:\Windows\System\fFosVVJ.exe
  C:\Windows\System\fFosVVJ.exe
  2⤵
  PID:9916
- C:\Windows\System\FmcbiID.exe
  C:\Windows\System\FmcbiID.exe
  2⤵
  PID:9952
- C:\Windows\System\pgSxGor.exe
  C:\Windows\System\pgSxGor.exe
  2⤵
  PID:9976
- C:\Windows\System\eilcBjU.exe
  C:\Windows\System\eilcBjU.exe
  2⤵
  PID:9996
- C:\Windows\System\cKLtUxa.exe
  C:\Windows\System\cKLtUxa.exe
  2⤵
  PID:10020
- C:\Windows\System\smkyZEv.exe
  C:\Windows\System\smkyZEv.exe
  2⤵
  PID:10044
- C:\Windows\System\vslbReP.exe
  C:\Windows\System\vslbReP.exe
  2⤵
  PID:10064
- C:\Windows\System\BKyweji.exe
  C:\Windows\System\BKyweji.exe
  2⤵
  PID:10088
- C:\Windows\System\UFKfzne.exe
  C:\Windows\System\UFKfzne.exe
  2⤵
  PID:10116
- C:\Windows\System\yjdESgh.exe
  C:\Windows\System\yjdESgh.exe
  2⤵
  PID:10136
- C:\Windows\System\zJAytyI.exe
  C:\Windows\System\zJAytyI.exe
  2⤵
  PID:10156
- C:\Windows\System\xlNyiiZ.exe
  C:\Windows\System\xlNyiiZ.exe
  2⤵
  PID:10176
- C:\Windows\System\cRKiZLH.exe
  C:\Windows\System\cRKiZLH.exe
  2⤵
  PID:10204
- C:\Windows\System\VwOBYAA.exe
  C:\Windows\System\VwOBYAA.exe
  2⤵
  PID:10228
- C:\Windows\System\nWqkBjz.exe
  C:\Windows\System\nWqkBjz.exe
  2⤵
  PID:8640
- C:\Windows\System\bgfnhpy.exe
  C:\Windows\System\bgfnhpy.exe
  2⤵
  PID:8712
- C:\Windows\System\gcwNLBp.exe
  C:\Windows\System\gcwNLBp.exe
  2⤵
  PID:8336
- C:\Windows\System\ZJqaVpK.exe
  C:\Windows\System\ZJqaVpK.exe
  2⤵
  PID:7724
- C:\Windows\System\LkGOiGQ.exe
  C:\Windows\System\LkGOiGQ.exe
  2⤵
  PID:7612
- C:\Windows\System\VBSpwEX.exe
  C:\Windows\System\VBSpwEX.exe
  2⤵
  PID:8404
- C:\Windows\System\ZmLzjbN.exe
  C:\Windows\System\ZmLzjbN.exe
  2⤵
  PID:8460
- C:\Windows\System\aqPcnwS.exe
  C:\Windows\System\aqPcnwS.exe
  2⤵
  PID:8180
- C:\Windows\System\iVGYMlB.exe
  C:\Windows\System\iVGYMlB.exe
  2⤵
  PID:8516
- C:\Windows\System\Okvykcv.exe
  C:\Windows\System\Okvykcv.exe
  2⤵
  PID:9232
- C:\Windows\System\AEvKFem.exe
  C:\Windows\System\AEvKFem.exe
  2⤵
  PID:8600
- C:\Windows\System\LGnnCWb.exe
  C:\Windows\System\LGnnCWb.exe
  2⤵
  PID:9284
- C:\Windows\System\mFLjvDh.exe
  C:\Windows\System\mFLjvDh.exe
  2⤵
  PID:9336
- C:\Windows\System\STAAejx.exe
  C:\Windows\System\STAAejx.exe
  2⤵
  PID:9360
- C:\Windows\System\jhHJxdU.exe
  C:\Windows\System\jhHJxdU.exe
  2⤵
  PID:9160
- C:\Windows\System\Vgyhirf.exe
  C:\Windows\System\Vgyhirf.exe
  2⤵
  PID:9184
- C:\Windows\System\otXHDVU.exe
  C:\Windows\System\otXHDVU.exe
  2⤵
  PID:9480
- C:\Windows\System\QMHxjQJ.exe
  C:\Windows\System\QMHxjQJ.exe
  2⤵
  PID:9536
- C:\Windows\System\UaGJtYI.exe
  C:\Windows\System\UaGJtYI.exe
  2⤵
  PID:9600
- C:\Windows\System\GmVjwtG.exe
  C:\Windows\System\GmVjwtG.exe
  2⤵
  PID:9620
- C:\Windows\System\afrlwhe.exe
  C:\Windows\System\afrlwhe.exe
  2⤵
  PID:9664
- C:\Windows\System\USzwQEh.exe
  C:\Windows\System\USzwQEh.exe
  2⤵
  PID:8888
- C:\Windows\System\QHCRBsv.exe
  C:\Windows\System\QHCRBsv.exe
  2⤵
  PID:9688
- C:\Windows\System\qjbHybt.exe
  C:\Windows\System\qjbHybt.exe
  2⤵
  PID:8352
- C:\Windows\System\abkkvOZ.exe
  C:\Windows\System\abkkvOZ.exe
  2⤵
  PID:9784
- C:\Windows\System\dXUpyOf.exe
  C:\Windows\System\dXUpyOf.exe
  2⤵
  PID:9860
- C:\Windows\System\ybzsLnM.exe
  C:\Windows\System\ybzsLnM.exe
  2⤵
  PID:9876
- C:\Windows\System\lhkXcGF.exe
  C:\Windows\System\lhkXcGF.exe
  2⤵
  PID:8560
- C:\Windows\System\ThvveNl.exe
  C:\Windows\System\ThvveNl.exe
  2⤵
  PID:9988
- C:\Windows\System\SCOHAgS.exe
  C:\Windows\System\SCOHAgS.exe
  2⤵
  PID:10080
- C:\Windows\System\CjjHKWk.exe
  C:\Windows\System\CjjHKWk.exe
  2⤵
  PID:10256
- C:\Windows\System\bOUTdwy.exe
  C:\Windows\System\bOUTdwy.exe
  2⤵
  PID:10280
- C:\Windows\System\BGUYoyz.exe
  C:\Windows\System\BGUYoyz.exe
  2⤵
  PID:10296
- C:\Windows\System\crCMXoT.exe
  C:\Windows\System\crCMXoT.exe
  2⤵
  PID:10312
- C:\Windows\System\kkTNgIx.exe
  C:\Windows\System\kkTNgIx.exe
  2⤵
  PID:10328
- C:\Windows\System\gDUMIeQ.exe
  C:\Windows\System\gDUMIeQ.exe
  2⤵
  PID:10352
- C:\Windows\System\uHOCIhb.exe
  C:\Windows\System\uHOCIhb.exe
  2⤵
  PID:10372
- C:\Windows\System\dgjtkvU.exe
  C:\Windows\System\dgjtkvU.exe
  2⤵
  PID:10392
- C:\Windows\System\jvICJRx.exe
  C:\Windows\System\jvICJRx.exe
  2⤵
  PID:10412
- C:\Windows\System\DJawbzW.exe
  C:\Windows\System\DJawbzW.exe
  2⤵
  PID:10440
- C:\Windows\System\JfcvOJI.exe
  C:\Windows\System\JfcvOJI.exe
  2⤵
  PID:10464
- C:\Windows\System\uFQGfFZ.exe
  C:\Windows\System\uFQGfFZ.exe
  2⤵
  PID:10484
- C:\Windows\System\lmXUDUl.exe
  C:\Windows\System\lmXUDUl.exe
  2⤵
  PID:10504
- C:\Windows\System\ydmSMkY.exe
  C:\Windows\System\ydmSMkY.exe
  2⤵
  PID:10528
- C:\Windows\System\btTUMIc.exe
  C:\Windows\System\btTUMIc.exe
  2⤵
  PID:10556
- C:\Windows\System\ObTBHaA.exe
  C:\Windows\System\ObTBHaA.exe
  2⤵
  PID:10580
- C:\Windows\System\pjzJhiJ.exe
  C:\Windows\System\pjzJhiJ.exe
  2⤵
  PID:10604
- C:\Windows\System\rCduyvP.exe
  C:\Windows\System\rCduyvP.exe
  2⤵
  PID:10624
- C:\Windows\System\OtVviHN.exe
  C:\Windows\System\OtVviHN.exe
  2⤵
  PID:10644
- C:\Windows\System\YJJnjMi.exe
  C:\Windows\System\YJJnjMi.exe
  2⤵
  PID:10664
- C:\Windows\System\KArUcbF.exe
  C:\Windows\System\KArUcbF.exe
  2⤵
  PID:10688
- C:\Windows\System\dpqOSZP.exe
  C:\Windows\System\dpqOSZP.exe
  2⤵
  PID:10716
- C:\Windows\System\TSQNAKW.exe
  C:\Windows\System\TSQNAKW.exe
  2⤵
  PID:10736
- C:\Windows\System\IACWUCt.exe
  C:\Windows\System\IACWUCt.exe
  2⤵
  PID:10756
- C:\Windows\System\AgEKcYx.exe
  C:\Windows\System\AgEKcYx.exe
  2⤵
  PID:10780
- C:\Windows\System\XibLJln.exe
  C:\Windows\System\XibLJln.exe
  2⤵
  PID:10804
- C:\Windows\System\ONGdmoB.exe
  C:\Windows\System\ONGdmoB.exe
  2⤵
  PID:10828
- C:\Windows\System\IXfSXQM.exe
  C:\Windows\System\IXfSXQM.exe
  2⤵
  PID:10852
- C:\Windows\System\ZwGWSPv.exe
  C:\Windows\System\ZwGWSPv.exe
  2⤵
  PID:10872
- C:\Windows\System\XrVkvEo.exe
  C:\Windows\System\XrVkvEo.exe
  2⤵
  PID:10892
- C:\Windows\System\qVFcXOP.exe
  C:\Windows\System\qVFcXOP.exe
  2⤵
  PID:10912
- C:\Windows\System\JDMueLl.exe
  C:\Windows\System\JDMueLl.exe
  2⤵
  PID:10936
- C:\Windows\System\HpQBXJU.exe
  C:\Windows\System\HpQBXJU.exe
  2⤵
  PID:10960
- C:\Windows\System\FaNilsh.exe
  C:\Windows\System\FaNilsh.exe
  2⤵
  PID:10984
- C:\Windows\System\ExfYwlO.exe
  C:\Windows\System\ExfYwlO.exe
  2⤵
  PID:11004
- C:\Windows\System\qVJiBDH.exe
  C:\Windows\System\qVJiBDH.exe
  2⤵
  PID:11024
- C:\Windows\System\wKuJgeF.exe
  C:\Windows\System\wKuJgeF.exe
  2⤵
  PID:11048
- C:\Windows\System\rxJleDW.exe
  C:\Windows\System\rxJleDW.exe
  2⤵
  PID:11076
- C:\Windows\System\HbPsYFV.exe
  C:\Windows\System\HbPsYFV.exe
  2⤵
  PID:11096
- C:\Windows\System\oDrtChC.exe
  C:\Windows\System\oDrtChC.exe
  2⤵
  PID:11116
- C:\Windows\System\PISikSH.exe
  C:\Windows\System\PISikSH.exe
  2⤵
  PID:11140
- C:\Windows\System\plIuLkL.exe
  C:\Windows\System\plIuLkL.exe
  2⤵
  PID:11160
- C:\Windows\System\YxsHyLf.exe
  C:\Windows\System\YxsHyLf.exe
  2⤵
  PID:11180
- C:\Windows\System\TMNxtkQ.exe
  C:\Windows\System\TMNxtkQ.exe
  2⤵
  PID:11204
- C:\Windows\System\IdQIyIv.exe
  C:\Windows\System\IdQIyIv.exe
  2⤵
  PID:11228
- C:\Windows\System\HDhxlXv.exe
  C:\Windows\System\HDhxlXv.exe
  2⤵
  PID:11252
- C:\Windows\System\vHNPWQL.exe
  C:\Windows\System\vHNPWQL.exe
  2⤵
  PID:10200
- C:\Windows\System\WMqlVcO.exe
  C:\Windows\System\WMqlVcO.exe
  2⤵
  PID:8688
- C:\Windows\System\sCmsoew.exe
  C:\Windows\System\sCmsoew.exe
  2⤵
  PID:8776
- C:\Windows\System\LapEGwO.exe
  C:\Windows\System\LapEGwO.exe
  2⤵
  PID:8436
- C:\Windows\System\RYFVoIT.exe
  C:\Windows\System\RYFVoIT.exe
  2⤵
  PID:9048
- C:\Windows\System\cCtzGBP.exe
  C:\Windows\System\cCtzGBP.exe
  2⤵
  PID:8284
- C:\Windows\System\KCoknPX.exe
  C:\Windows\System\KCoknPX.exe
  2⤵
  PID:9348
- C:\Windows\System\FfOBdNH.exe
  C:\Windows\System\FfOBdNH.exe
  2⤵
  PID:9456
- C:\Windows\System\pwqOMPi.exe
  C:\Windows\System\pwqOMPi.exe
  2⤵
  PID:9564
- C:\Windows\System\iLGLYvo.exe
  C:\Windows\System\iLGLYvo.exe
  2⤵
  PID:9720
- C:\Windows\System\AacSVNP.exe
  C:\Windows\System\AacSVNP.exe
  2⤵
  PID:8564
- C:\Windows\System\EkhjORp.exe
  C:\Windows\System\EkhjORp.exe
  2⤵
  PID:10008
- C:\Windows\System\MhFupus.exe
  C:\Windows\System\MhFupus.exe
  2⤵
  PID:10040
- C:\Windows\System\CHnlpbB.exe
  C:\Windows\System\CHnlpbB.exe
  2⤵
  PID:3640
- C:\Windows\System\cQwwQuP.exe
  C:\Windows\System\cQwwQuP.exe
  2⤵
  PID:10108
- C:\Windows\System\TtClLrA.exe
  C:\Windows\System\TtClLrA.exe
  2⤵
  PID:10340
- C:\Windows\System\FqjfTGU.exe
  C:\Windows\System\FqjfTGU.exe
  2⤵
  PID:11524
- C:\Windows\System\JwJeAjK.exe
  C:\Windows\System\JwJeAjK.exe
  2⤵
  PID:11544
- C:\Windows\System\PaToXRA.exe
  C:\Windows\System\PaToXRA.exe
  2⤵
  PID:11568
- C:\Windows\System\gKoZAzh.exe
  C:\Windows\System\gKoZAzh.exe
  2⤵
  PID:11592
- C:\Windows\System\fPDGRAM.exe
  C:\Windows\System\fPDGRAM.exe
  2⤵
  PID:11616
- C:\Windows\System\qZxHflR.exe
  C:\Windows\System\qZxHflR.exe
  2⤵
  PID:11640
- C:\Windows\System\vCDpdfF.exe
  C:\Windows\System\vCDpdfF.exe
  2⤵
  PID:11660
- C:\Windows\System\KXzQOtM.exe
  C:\Windows\System\KXzQOtM.exe
  2⤵
  PID:11684
- C:\Windows\System\irNtMbu.exe
  C:\Windows\System\irNtMbu.exe
  2⤵
  PID:11704
- C:\Windows\System\cZRFYOh.exe
  C:\Windows\System\cZRFYOh.exe
  2⤵
  PID:11728
- C:\Windows\System\JWfVvCp.exe
  C:\Windows\System\JWfVvCp.exe
  2⤵
  PID:11752
- C:\Windows\System\lVmJqdm.exe
  C:\Windows\System\lVmJqdm.exe
  2⤵
  PID:11772
- C:\Windows\System\uEiVdmy.exe
  C:\Windows\System\uEiVdmy.exe
  2⤵
  PID:11796
- C:\Windows\System\lwwqORF.exe
  C:\Windows\System\lwwqORF.exe
  2⤵
  PID:11824
- C:\Windows\System\uBGvOtw.exe
  C:\Windows\System\uBGvOtw.exe
  2⤵
  PID:11844
- C:\Windows\System\AWeWmpP.exe
  C:\Windows\System\AWeWmpP.exe
  2⤵
  PID:11864
- C:\Windows\System\roEHijf.exe
  C:\Windows\System\roEHijf.exe
  2⤵
  PID:11884
- C:\Windows\System\pggQNVF.exe
  C:\Windows\System\pggQNVF.exe
  2⤵
  PID:11908
- C:\Windows\System\kYfOOwY.exe
  C:\Windows\System\kYfOOwY.exe
  2⤵
  PID:11932
- C:\Windows\System\RThFQzw.exe
  C:\Windows\System\RThFQzw.exe
  2⤵
  PID:11956
- C:\Windows\System\RQBHBfX.exe
  C:\Windows\System\RQBHBfX.exe
  2⤵
  PID:11980
- C:\Windows\System\HwDFLrN.exe
  C:\Windows\System\HwDFLrN.exe
  2⤵
  PID:12008
- C:\Windows\System\XvVOavs.exe
  C:\Windows\System\XvVOavs.exe
  2⤵
  PID:12036
- C:\Windows\System\PEvQgDt.exe
  C:\Windows\System\PEvQgDt.exe
  2⤵
  PID:12052
- C:\Windows\System\TgbfWsM.exe
  C:\Windows\System\TgbfWsM.exe
  2⤵
  PID:12076
- C:\Windows\System\GjquZVe.exe
  C:\Windows\System\GjquZVe.exe
  2⤵
  PID:12096
- C:\Windows\System\zJyvxvW.exe
  C:\Windows\System\zJyvxvW.exe
  2⤵
  PID:12116
- C:\Windows\System\kzwmtsP.exe
  C:\Windows\System\kzwmtsP.exe
  2⤵
  PID:12132
- C:\Windows\System\IgEPkbR.exe
  C:\Windows\System\IgEPkbR.exe
  2⤵
  PID:12156
- C:\Windows\System\aPMhZlp.exe
  C:\Windows\System\aPMhZlp.exe
  2⤵
  PID:12180
- C:\Windows\System\HvMyNds.exe
  C:\Windows\System\HvMyNds.exe
  2⤵
  PID:12200
- C:\Windows\System\LCgHZxO.exe
  C:\Windows\System\LCgHZxO.exe
  2⤵
  PID:12220
- C:\Windows\System\mjJYbYn.exe
  C:\Windows\System\mjJYbYn.exe
  2⤵
  PID:12244
- C:\Windows\System\HZGcZrd.exe
  C:\Windows\System\HZGcZrd.exe
  2⤵
  PID:12264
- C:\Windows\System\eWGcLwD.exe
  C:\Windows\System\eWGcLwD.exe
  2⤵
  PID:12284
- C:\Windows\System\WxGVNKW.exe
  C:\Windows\System\WxGVNKW.exe
  2⤵
  PID:4492
- C:\Windows\System\JCfQEby.exe
  C:\Windows\System\JCfQEby.exe
  2⤵
  PID:9712
- C:\Windows\System\EokgCCK.exe
  C:\Windows\System\EokgCCK.exe
  2⤵
  PID:10880
- C:\Windows\System\RhSUheF.exe
  C:\Windows\System\RhSUheF.exe
  2⤵
  PID:10920
- C:\Windows\System\dnTMtJL.exe
  C:\Windows\System\dnTMtJL.exe
  2⤵
  PID:9812
- C:\Windows\System\wRLAVXK.exe
  C:\Windows\System\wRLAVXK.exe
  2⤵
  PID:1724
- C:\Windows\System\EGqWTkB.exe
  C:\Windows\System\EGqWTkB.exe
  2⤵
  PID:9872
- C:\Windows\System\lwEbeuo.exe
  C:\Windows\System\lwEbeuo.exe
  2⤵
  PID:9640
- C:\Windows\System\OqsZlOA.exe
  C:\Windows\System\OqsZlOA.exe
  2⤵
  PID:11124
- C:\Windows\System\sEbGGVy.exe
  C:\Windows\System\sEbGGVy.exe
  2⤵
  PID:3644
- C:\Windows\System\LumXfkz.exe
  C:\Windows\System\LumXfkz.exe
  2⤵
  PID:8328
- C:\Windows\System\VKcsatI.exe
  C:\Windows\System\VKcsatI.exe
  2⤵
  PID:8728
- C:\Windows\System\jqyGSpx.exe
  C:\Windows\System\jqyGSpx.exe
  2⤵
  PID:9068
- C:\Windows\System\eKtlUwG.exe
  C:\Windows\System\eKtlUwG.exe
  2⤵
  PID:10244
- C:\Windows\System\IaKHbsr.exe
  C:\Windows\System\IaKHbsr.exe
  2⤵
  PID:10304
- C:\Windows\System\AbgHAcd.exe
  C:\Windows\System\AbgHAcd.exe
  2⤵
  PID:10360
- C:\Windows\System\KZiISnZ.exe
  C:\Windows\System\KZiISnZ.exe
  2⤵
  PID:10252
- C:\Windows\System\tFofCHo.exe
  C:\Windows\System\tFofCHo.exe
  2⤵
  PID:10188
- C:\Windows\System\zHfsqmk.exe
  C:\Windows\System\zHfsqmk.exe
  2⤵
  PID:10524
- C:\Windows\System\RFkVwgy.exe
  C:\Windows\System\RFkVwgy.exe
  2⤵
  PID:8808
- C:\Windows\System\HvsLbZW.exe
  C:\Windows\System\HvsLbZW.exe
  2⤵
  PID:10660
- C:\Windows\System\BMXJSAD.exe
  C:\Windows\System\BMXJSAD.exe
  2⤵
  PID:10732
- C:\Windows\System\ZAefrxv.exe
  C:\Windows\System\ZAefrxv.exe
  2⤵
  PID:11040
- C:\Windows\System\SQODSXq.exe
  C:\Windows\System\SQODSXq.exe
  2⤵
  PID:12300
- C:\Windows\System\HtNdOFs.exe
  C:\Windows\System\HtNdOFs.exe
  2⤵
  PID:12320
- C:\Windows\System\yeKrMzh.exe
  C:\Windows\System\yeKrMzh.exe
  2⤵
  PID:12352
- C:\Windows\System\xuHBNIY.exe
  C:\Windows\System\xuHBNIY.exe
  2⤵
  PID:12384
- C:\Windows\System\SKKdQku.exe
  C:\Windows\System\SKKdQku.exe
  2⤵
  PID:12408
- C:\Windows\System\VrgigEM.exe
  C:\Windows\System\VrgigEM.exe
  2⤵
  PID:12440
- C:\Windows\System\YQyKICc.exe
  C:\Windows\System\YQyKICc.exe
  2⤵
  PID:12468
- C:\Windows\System\duOrzkH.exe
  C:\Windows\System\duOrzkH.exe
  2⤵
  PID:12488
- C:\Windows\System\bffEpkC.exe
  C:\Windows\System\bffEpkC.exe
  2⤵
  PID:12508
- C:\Windows\System\ZfudpFY.exe
  C:\Windows\System\ZfudpFY.exe
  2⤵
  PID:12524
- C:\Windows\System\BYZYrjI.exe
  C:\Windows\System\BYZYrjI.exe
  2⤵
  PID:12552
- C:\Windows\System\YZoFJrt.exe
  C:\Windows\System\YZoFJrt.exe
  2⤵
  PID:12572
- C:\Windows\System\qdCOysZ.exe
  C:\Windows\System\qdCOysZ.exe
  2⤵
  PID:12592
- C:\Windows\System\HXJreGb.exe
  C:\Windows\System\HXJreGb.exe
  2⤵
  PID:12616
- C:\Windows\System\gshdDNJ.exe
  C:\Windows\System\gshdDNJ.exe
  2⤵
  PID:12632
- C:\Windows\System\MzuLSJm.exe
  C:\Windows\System\MzuLSJm.exe
  2⤵
  PID:12652
- C:\Windows\System\aENuhoy.exe
  C:\Windows\System\aENuhoy.exe
  2⤵
  PID:12676
- C:\Windows\System\ICxPExv.exe
  C:\Windows\System\ICxPExv.exe
  2⤵
  PID:12700
- C:\Windows\System\qxZYNvn.exe
  C:\Windows\System\qxZYNvn.exe
  2⤵
  PID:12728
- C:\Windows\System\mWLePCH.exe
  C:\Windows\System\mWLePCH.exe
  2⤵
  PID:12748
- C:\Windows\System\UBikHez.exe
  C:\Windows\System\UBikHez.exe
  2⤵
  PID:12772
- C:\Windows\System\mwWpRUd.exe
  C:\Windows\System\mwWpRUd.exe
  2⤵
  PID:12796
- C:\Windows\System\AenbjhR.exe
  C:\Windows\System\AenbjhR.exe
  2⤵
  PID:12816
- C:\Windows\System\ShLFvqS.exe
  C:\Windows\System\ShLFvqS.exe
  2⤵
  PID:12844
- C:\Windows\System\SzsWJyV.exe
  C:\Windows\System\SzsWJyV.exe
  2⤵
  PID:12868
- C:\Windows\System\cMfKhBJ.exe
  C:\Windows\System\cMfKhBJ.exe
  2⤵
  PID:12888
- C:\Windows\System\GNuuKWr.exe
  C:\Windows\System\GNuuKWr.exe
  2⤵
  PID:12912
- C:\Windows\System\GTUiQHb.exe
  C:\Windows\System\GTUiQHb.exe
  2⤵
  PID:12936
- C:\Windows\System\dbcCWaH.exe
  C:\Windows\System\dbcCWaH.exe
  2⤵
  PID:12956
- C:\Windows\System\dlUiiiC.exe
  C:\Windows\System\dlUiiiC.exe
  2⤵
  PID:12984
- C:\Windows\System\kAdXaMo.exe
  C:\Windows\System\kAdXaMo.exe
  2⤵
  PID:13004
- C:\Windows\System\mXrLtWz.exe
  C:\Windows\System\mXrLtWz.exe
  2⤵
  PID:13024
- C:\Windows\System\tkTQifO.exe
  C:\Windows\System\tkTQifO.exe
  2⤵
  PID:13044
- C:\Windows\System\RNvXgRO.exe
  C:\Windows\System\RNvXgRO.exe
  2⤵
  PID:13068
- C:\Windows\System\VGNYsyX.exe
  C:\Windows\System\VGNYsyX.exe
  2⤵
  PID:13092
- C:\Windows\System\TtCnUfP.exe
  C:\Windows\System\TtCnUfP.exe
  2⤵
  PID:13116
- C:\Windows\System\WPQwymN.exe
  C:\Windows\System\WPQwymN.exe
  2⤵
  PID:13136
- C:\Windows\System\yMAWUDS.exe
  C:\Windows\System\yMAWUDS.exe
  2⤵
  PID:13160
- C:\Windows\System\XhqNghn.exe
  C:\Windows\System\XhqNghn.exe
  2⤵
  PID:13188
- C:\Windows\System\pYNjEqW.exe
  C:\Windows\System\pYNjEqW.exe
  2⤵
  PID:13208
- C:\Windows\System\jbcVjIT.exe
  C:\Windows\System\jbcVjIT.exe
  2⤵
  PID:11464
- C:\Windows\System\YlTnQmY.exe
  C:\Windows\System\YlTnQmY.exe
  2⤵
  PID:10320
- C:\Windows\System\qbTmeEJ.exe
  C:\Windows\System\qbTmeEJ.exe
  2⤵
  PID:12124
- C:\Windows\System\IwMUKFH.exe
  C:\Windows\System\IwMUKFH.exe
  2⤵
  PID:8140
- C:\Windows\System\EkLvpuC.exe
  C:\Windows\System\EkLvpuC.exe
  2⤵
  PID:11784
- C:\Windows\System\rWXFosK.exe
  C:\Windows\System\rWXFosK.exe
  2⤵
  PID:12104
- C:\Windows\System\VmvfFNs.exe
  C:\Windows\System\VmvfFNs.exe
  2⤵
  PID:12140
- C:\Windows\System\UkMUSzl.exe
  C:\Windows\System\UkMUSzl.exe
  2⤵
  PID:1092
- C:\Windows\System\crQMTBH.exe
  C:\Windows\System\crQMTBH.exe
  2⤵
  PID:3768
- C:\Windows\System\SZmeklH.exe
  C:\Windows\System\SZmeklH.exe
  2⤵
  PID:10748
- C:\Windows\System\QGatjku.exe
  C:\Windows\System\QGatjku.exe
  2⤵
  PID:8956
- C:\Windows\System\FsQuVrk.exe
  C:\Windows\System\FsQuVrk.exe
  2⤵
  PID:10168
- C:\Windows\System\WAnePEX.exe
  C:\Windows\System\WAnePEX.exe
  2⤵
  PID:10864
- C:\Windows\System\KJmAiSb.exe
  C:\Windows\System\KJmAiSb.exe
  2⤵
  PID:10216
- C:\Windows\System\AvmpWlz.exe
  C:\Windows\System\AvmpWlz.exe
  2⤵
  PID:12804
- C:\Windows\System\RqAiPwq.exe
  C:\Windows\System\RqAiPwq.exe
  2⤵
  PID:13228
- C:\Windows\System\lUBSoXG.exe
  C:\Windows\System\lUBSoXG.exe
  2⤵
  PID:13036
- C:\Windows\System\OYROzDz.exe
  C:\Windows\System\OYROzDz.exe
  2⤵
  PID:4892
- C:\Windows\System\cDolFDW.exe
  C:\Windows\System\cDolFDW.exe
  2⤵
  PID:7748
- C:\Windows\System\MAvkFQR.exe
  C:\Windows\System\MAvkFQR.exe
  2⤵
  PID:2332
- C:\Windows\System\MBZREwr.exe
  C:\Windows\System\MBZREwr.exe
  2⤵
  PID:11972
- C:\Windows\System\pkeQYkL.exe
  C:\Windows\System\pkeQYkL.exe
  2⤵
  PID:10704
- C:\Windows\System\mrNfOnM.exe
  C:\Windows\System\mrNfOnM.exe
  2⤵
  PID:12068
- C:\Windows\System\PeQOwNA.exe
  C:\Windows\System\PeQOwNA.exe
  2⤵
  PID:7904
- C:\Windows\System\HnErIuk.exe
  C:\Windows\System\HnErIuk.exe
  2⤵
  PID:11920
- C:\Windows\System\WWhksCT.exe
  C:\Windows\System\WWhksCT.exe
  2⤵
  PID:9992
- C:\Windows\System\JYwlEwX.exe
  C:\Windows\System\JYwlEwX.exe
  2⤵
  PID:11388
- C:\Windows\System\LzqFWMR.exe
  C:\Windows\System\LzqFWMR.exe
  2⤵
  PID:6048
- C:\Windows\System\owQInrx.exe
  C:\Windows\System\owQInrx.exe
  2⤵
  PID:11092
- C:\Windows\System\rYCDxyQ.exe
  C:\Windows\System\rYCDxyQ.exe
  2⤵
  PID:3452
- C:\Windows\System\cbKABcM.exe
  C:\Windows\System\cbKABcM.exe
  2⤵
  PID:11948
- C:\Windows\System\YvpoiIf.exe
  C:\Windows\System\YvpoiIf.exe
  2⤵
  PID:12252
- C:\Windows\System\YZjqZgG.exe
  C:\Windows\System\YZjqZgG.exe
  2⤵
  PID:10640
- C:\Windows\System\BTaAbmI.exe
  C:\Windows\System\BTaAbmI.exe
  2⤵
  PID:3096
- C:\Windows\System\kxNDGnA.exe
  C:\Windows\System\kxNDGnA.exe
  2⤵
  PID:12424
- C:\Windows\System\AXByyjH.exe
  C:\Windows\System\AXByyjH.exe
  2⤵
  PID:10288
- C:\Windows\System\bqumtch.exe
  C:\Windows\System\bqumtch.exe
  2⤵
  PID:9148
- C:\Windows\System\RWNQMsr.exe
  C:\Windows\System\RWNQMsr.exe
  2⤵
  PID:9932
- C:\Windows\System\KaprYZq.exe
  C:\Windows\System\KaprYZq.exe
  2⤵
  PID:11156
- C:\Windows\System\rytwxLv.exe
  C:\Windows\System\rytwxLv.exe
  2⤵
  PID:4796
- C:\Windows\System\fDezfgS.exe
  C:\Windows\System\fDezfgS.exe
  2⤵
  PID:10684
- C:\Windows\System\LXveLJR.exe
  C:\Windows\System\LXveLJR.exe
  2⤵
  PID:216
- C:\Windows\System\VhdFtdl.exe
  C:\Windows\System\VhdFtdl.exe
  2⤵
  PID:6072
- C:\Windows\System\JXMrLNB.exe
  C:\Windows\System\JXMrLNB.exe
  2⤵
  PID:12716
- C:\Windows\System\LEeZvmI.exe
  C:\Windows\System\LEeZvmI.exe
  2⤵
  PID:3432
- C:\Windows\System\NldPoFn.exe
  C:\Windows\System\NldPoFn.exe
  2⤵
  PID:12864
- C:\Windows\System\RvuVtbh.exe
  C:\Windows\System\RvuVtbh.exe
  2⤵
  PID:12428
- C:\Windows\System\nnnjQdH.exe
  C:\Windows\System\nnnjQdH.exe
  2⤵
  PID:5716
- C:\Windows\System\ABWWaTI.exe
  C:\Windows\System\ABWWaTI.exe
  2⤵
  PID:6020
- C:\Windows\System\HZuNZrh.exe
  C:\Windows\System\HZuNZrh.exe
  2⤵
  PID:944
- C:\Windows\System\mzEMFZR.exe
  C:\Windows\System\mzEMFZR.exe
  2⤵
  PID:11940
- C:\Windows\System\YuLrjDt.exe
  C:\Windows\System\YuLrjDt.exe
  2⤵
  PID:9580
- C:\Windows\System\TcwLlrR.exe
  C:\Windows\System\TcwLlrR.exe
  2⤵
  PID:5040
- C:\Windows\System\FAmchVG.exe
  C:\Windows\System\FAmchVG.exe
  2⤵
  PID:3868
- C:\Windows\System\dpvwKBA.exe
  C:\Windows\System\dpvwKBA.exe
  2⤵
  PID:1700
- C:\Windows\System\uzGbEwz.exe
  C:\Windows\System\uzGbEwz.exe
  2⤵
  PID:12684
- C:\Windows\System\frpqnXD.exe
  C:\Windows\System\frpqnXD.exe
  2⤵
  PID:13344
- C:\Windows\System\bGaDlqA.exe
  C:\Windows\System\bGaDlqA.exe
  2⤵
  PID:13368
- C:\Windows\System\SQodXlx.exe
  C:\Windows\System\SQodXlx.exe
  2⤵
  PID:13396
- C:\Windows\System\hTwpXID.exe
  C:\Windows\System\hTwpXID.exe
  2⤵
  PID:13416
- C:\Windows\System\XPjAKBi.exe
  C:\Windows\System\XPjAKBi.exe
  2⤵
  PID:13444
- C:\Windows\System\RGjsfpS.exe
  C:\Windows\System\RGjsfpS.exe
  2⤵
  PID:13480
- C:\Windows\System\WOMNYXu.exe
  C:\Windows\System\WOMNYXu.exe
  2⤵
  PID:13504
- C:\Windows\System\DXfKPwN.exe
  C:\Windows\System\DXfKPwN.exe
  2⤵
  PID:13532
- C:\Windows\System\xzbjPGR.exe
  C:\Windows\System\xzbjPGR.exe
  2⤵
  PID:13688
- C:\Windows\System\iCOpGiS.exe
  C:\Windows\System\iCOpGiS.exe
  2⤵
  PID:13712
- C:\Windows\System\qqIRRpx.exe
  C:\Windows\System\qqIRRpx.exe
  2⤵
  PID:13732
- C:\Windows\System\iUbTiIj.exe
  C:\Windows\System\iUbTiIj.exe
  2⤵
  PID:13768
- C:\Windows\System\feAQlBL.exe
  C:\Windows\System\feAQlBL.exe
  2⤵
  PID:13792
- C:\Windows\System\NEDyTVu.exe
  C:\Windows\System\NEDyTVu.exe
  2⤵
  PID:13828
- C:\Windows\System\CoCWRKf.exe
  C:\Windows\System\CoCWRKf.exe
  2⤵
  PID:13864
- C:\Windows\System\EkBFFGr.exe
  C:\Windows\System\EkBFFGr.exe
  2⤵
  PID:13940
- C:\Windows\System\yxtjeKm.exe
  C:\Windows\System\yxtjeKm.exe
  2⤵
  PID:13956
- C:\Windows\System\twctRZD.exe
  C:\Windows\System\twctRZD.exe
  2⤵
  PID:13996
- C:\Windows\System\TQEFvZH.exe
  C:\Windows\System\TQEFvZH.exe
  2⤵
  PID:14020
- C:\Windows\System\cKepCLz.exe
  C:\Windows\System\cKepCLz.exe
  2⤵
  PID:14048
- C:\Windows\System\pkGqsTj.exe
  C:\Windows\System\pkGqsTj.exe
  2⤵
  PID:14068
- C:\Windows\System\MnnejrK.exe
  C:\Windows\System\MnnejrK.exe
  2⤵
  PID:14092
- C:\Windows\System\cioRJWL.exe
  C:\Windows\System\cioRJWL.exe
  2⤵
  PID:14112
- C:\Windows\System\LsetObB.exe
  C:\Windows\System\LsetObB.exe
  2⤵
  PID:14164
- C:\Windows\System\Rtodiuo.exe
  C:\Windows\System\Rtodiuo.exe
  2⤵
  PID:14188
- C:\Windows\System\uUTXSuL.exe
  C:\Windows\System\uUTXSuL.exe
  2⤵
  PID:14212
- C:\Windows\System\IdJDJaz.exe
  C:\Windows\System\IdJDJaz.exe
  2⤵
  PID:14228
- C:\Windows\System\atJOqSj.exe
  C:\Windows\System\atJOqSj.exe
  2⤵
  PID:14256
- C:\Windows\System\aAbrFjF.exe
  C:\Windows\System\aAbrFjF.exe
  2⤵
  PID:14280
- C:\Windows\System\pcvLNcz.exe
  C:\Windows\System\pcvLNcz.exe
  2⤵
  PID:14308
- C:\Windows\System\nBZaHPh.exe
  C:\Windows\System\nBZaHPh.exe
  2⤵
  PID:14324
- C:\Windows\System\hEiUkVv.exe
  C:\Windows\System\hEiUkVv.exe
  2⤵
  PID:13296
- C:\Windows\System\BdadhGh.exe
  C:\Windows\System\BdadhGh.exe
  2⤵
  PID:3312
- C:\Windows\System\veOYTvP.exe
  C:\Windows\System\veOYTvP.exe
  2⤵
  PID:368
- C:\Windows\System\vflOECQ.exe
  C:\Windows\System\vflOECQ.exe
  2⤵
  PID:4372
- C:\Windows\System\gOAbqFV.exe
  C:\Windows\System\gOAbqFV.exe
  2⤵
  PID:3504
- C:\Windows\System\BWexLjl.exe
  C:\Windows\System\BWexLjl.exe
  2⤵
  PID:13316
- C:\Windows\System\xGPZEbJ.exe
  C:\Windows\System\xGPZEbJ.exe
  2⤵
  PID:4324
- C:\Windows\System\bvPtRAq.exe
  C:\Windows\System\bvPtRAq.exe
  2⤵
  PID:13648
- C:\Windows\System\qfRVozB.exe
  C:\Windows\System\qfRVozB.exe
  2⤵
  PID:13676
- C:\Windows\System\XxYjeku.exe
  C:\Windows\System\XxYjeku.exe
  2⤵
  PID:4652
- C:\Windows\System\AsFOKoj.exe
  C:\Windows\System\AsFOKoj.exe
  2⤵
  PID:13780
- C:\Windows\System\WbaICZo.exe
  C:\Windows\System\WbaICZo.exe
  2⤵
  PID:2536
- C:\Windows\System\DKMlfZE.exe
  C:\Windows\System\DKMlfZE.exe
  2⤵
  PID:13872
- C:\Windows\System\SxVMdqP.exe
  C:\Windows\System\SxVMdqP.exe
  2⤵
  PID:3404
- C:\Windows\System\waauPJd.exe
  C:\Windows\System\waauPJd.exe
  2⤵
  PID:14044
- C:\Windows\System\GXHKFuJ.exe
  C:\Windows\System\GXHKFuJ.exe
  2⤵
  PID:13980
- C:\Windows\System\EaYzEwD.exe
  C:\Windows\System\EaYzEwD.exe
  2⤵
  PID:14088
- C:\Windows\System\HnbfOdN.exe
  C:\Windows\System\HnbfOdN.exe
  2⤵
  PID:14108
- C:\Windows\System\aEaPQlZ.exe
  C:\Windows\System\aEaPQlZ.exe
  2⤵
  PID:4464
- C:\Windows\System\ODlsUib.exe
  C:\Windows\System\ODlsUib.exe
  2⤵
  PID:1224
- C:\Windows\System\QpEXoiF.exe
  C:\Windows\System\QpEXoiF.exe
  2⤵
  PID:2036
- C:\Windows\System\NWVzYxl.exe
  C:\Windows\System\NWVzYxl.exe
  2⤵
  PID:14276
- C:\Windows\System\NyXOeCX.exe
  C:\Windows\System\NyXOeCX.exe
  2⤵
  PID:14140
- C:\Windows\System\eyKdfut.exe
  C:\Windows\System\eyKdfut.exe
  2⤵
  PID:14152
- C:\Windows\System\AqSylaM.exe
  C:\Windows\System\AqSylaM.exe
  2⤵
  PID:14300
- C:\Windows\System\rfenMpn.exe
  C:\Windows\System\rfenMpn.exe
  2⤵
  PID:14236
- C:\Windows\System\nqJSGNA.exe
  C:\Windows\System\nqJSGNA.exe
  2⤵
  PID:1072
- C:\Windows\System\CWAdLDX.exe
  C:\Windows\System\CWAdLDX.exe
  2⤵
  PID:3812
- C:\Windows\System\bELkcVy.exe
  C:\Windows\System\bELkcVy.exe
  2⤵
  PID:14316
- C:\Windows\System\HHtxYut.exe
  C:\Windows\System\HHtxYut.exe
  2⤵
  PID:5328
- C:\Windows\System\hiSqAyU.exe
  C:\Windows\System\hiSqAyU.exe
  2⤵
  PID:1004
- C:\Windows\System\Ajliepo.exe
  C:\Windows\System\Ajliepo.exe
  2⤵
  PID:1776
- C:\Windows\System\JZBuAzk.exe
  C:\Windows\System\JZBuAzk.exe
  2⤵
  PID:13364
- C:\Windows\System\HeUYmMt.exe
  C:\Windows\System\HeUYmMt.exe
  2⤵
  PID:13620
- C:\Windows\System\zEYkVHN.exe
  C:\Windows\System\zEYkVHN.exe
  2⤵
  PID:13520
- C:\Windows\System\VKxfytI.exe
  C:\Windows\System\VKxfytI.exe
  2⤵
  PID:13540
- C:\Windows\System\yceGgoQ.exe
  C:\Windows\System\yceGgoQ.exe
  2⤵
  PID:7652
- C:\Windows\System\QicctTi.exe
  C:\Windows\System\QicctTi.exe
  2⤵
  PID:13720
- C:\Windows\System\BEdiiSV.exe
  C:\Windows\System\BEdiiSV.exe
  2⤵
  PID:14132
- C:\Windows\System\UwKXVBM.exe
  C:\Windows\System\UwKXVBM.exe
  2⤵
  PID:4936
- C:\Windows\System\PjcWoiH.exe
  C:\Windows\System\PjcWoiH.exe
  2⤵
  PID:14244
- C:\Windows\System\QPVizKu.exe
  C:\Windows\System\QPVizKu.exe
  2⤵
  PID:652
- C:\Windows\System\jwxFPum.exe
  C:\Windows\System\jwxFPum.exe
  2⤵
  PID:3228
- C:\Windows\System\hkjDdhI.exe
  C:\Windows\System\hkjDdhI.exe
  2⤵
  PID:13440
- C:\Windows\System\ZQbKnTU.exe
  C:\Windows\System\ZQbKnTU.exe
  2⤵
  PID:14136
- C:\Windows\System\OkCKvYH.exe
  C:\Windows\System\OkCKvYH.exe
  2⤵
  PID:13572
- C:\Windows\System\lUbCsHo.exe
  C:\Windows\System\lUbCsHo.exe
  2⤵
  PID:5912
- C:\Windows\System\jTTESqu.exe
  C:\Windows\System\jTTESqu.exe
  2⤵
  PID:13624
- C:\Windows\System\garRcnp.exe
  C:\Windows\System\garRcnp.exe
  2⤵
  PID:4692
- C:\Windows\System\LSWUVUH.exe
  C:\Windows\System\LSWUVUH.exe
  2⤵
  PID:5928
- C:\Windows\System\EiWeUxT.exe
  C:\Windows\System\EiWeUxT.exe
  2⤵
  PID:13600
- C:\Windows\System\rDWGyuT.exe
  C:\Windows\System\rDWGyuT.exe
  2⤵
  PID:13992
- C:\Windows\System\bPmOssW.exe
  C:\Windows\System\bPmOssW.exe
  2⤵
  PID:13340
- C:\Windows\System\lPxCtta.exe
  C:\Windows\System\lPxCtta.exe
  2⤵
  PID:13728
- C:\Windows\System\usBhoeb.exe
  C:\Windows\System\usBhoeb.exe
  2⤵
  PID:2520
- C:\Windows\System\huZtyQv.exe
  C:\Windows\System\huZtyQv.exe
  2⤵
  PID:13988
- C:\Windows\System\VCbReYk.exe
  C:\Windows\System\VCbReYk.exe
  2⤵
  PID:13640
- C:\Windows\System\bIOTMrq.exe
  C:\Windows\System\bIOTMrq.exe
  2⤵
  PID:5332
- C:\Windows\System\PGacUiA.exe
  C:\Windows\System\PGacUiA.exe
  2⤵
  PID:13472
- C:\Windows\System\XSFDtUs.exe
  C:\Windows\System\XSFDtUs.exe
  2⤵
  PID:13608
- C:\Windows\System\BdcTMmk.exe
  C:\Windows\System\BdcTMmk.exe
  2⤵
  PID:400
- C:\Windows\System\KrbbWkv.exe
  C:\Windows\System\KrbbWkv.exe
  2⤵
  PID:5784
- C:\Windows\System\ktAGkOq.exe
  C:\Windows\System\ktAGkOq.exe
  2⤵
  PID:4072
- C:\Windows\System\WdPcVke.exe
  C:\Windows\System\WdPcVke.exe
  2⤵
  PID:13708
- C:\Windows\System\rsrfTVn.exe
  C:\Windows\System\rsrfTVn.exe
  2⤵
  PID:1488
- C:\Windows\System\AqiTvVq.exe
  C:\Windows\System\AqiTvVq.exe
  2⤵
  PID:5940
- C:\Windows\System\GCZLPIX.exe
  C:\Windows\System\GCZLPIX.exe
  2⤵
  PID:13876
- C:\Windows\System\xqyCygM.exe
  C:\Windows\System\xqyCygM.exe
  2⤵
  PID:13764
- C:\Windows\System\MZihglP.exe
  C:\Windows\System\MZihglP.exe
  2⤵
  PID:14040
- C:\Windows\System\XMwDNUQ.exe
  C:\Windows\System\XMwDNUQ.exe
  2⤵
  PID:13576
- C:\Windows\System\XkYBkKL.exe
  C:\Windows\System\XkYBkKL.exe
  2⤵
  PID:3416
- C:\Windows\System\XlDbQwf.exe
  C:\Windows\System\XlDbQwf.exe
  2⤵
  PID:5972
- C:\Windows\System\ppSJCSQ.exe
  C:\Windows\System\ppSJCSQ.exe
  2⤵
  PID:5900
- C:\Windows\System\QjWSZEQ.exe
  C:\Windows\System\QjWSZEQ.exe
  2⤵
  PID:14036
- C:\Windows\System\BlkUOpC.exe
  C:\Windows\System\BlkUOpC.exe
  2⤵
  PID:5664
- C:\Windows\System\VFEgmHZ.exe
  C:\Windows\System\VFEgmHZ.exe
  2⤵
  PID:13552
- C:\Windows\System\thnARuV.exe
  C:\Windows\System\thnARuV.exe
  2⤵
  PID:5700
- C:\Windows\System\JXuwQmG.exe
  C:\Windows\System\JXuwQmG.exe
  2⤵
  PID:13476
- C:\Windows\System\PvNZrqB.exe
  C:\Windows\System\PvNZrqB.exe
  2⤵
  PID:13816
- C:\Windows\System\ejLBvPY.exe
  C:\Windows\System\ejLBvPY.exe
  2⤵
  PID:5020
- C:\Windows\System\rcQPzLC.exe
  C:\Windows\System\rcQPzLC.exe
  2⤵
  PID:5944
- C:\Windows\System\duDLFaH.exe
  C:\Windows\System\duDLFaH.exe
  2⤵
  PID:5732
- C:\Windows\System\nwSbySs.exe
  C:\Windows\System\nwSbySs.exe
  2⤵
  PID:14008
- C:\Windows\System\GvveFJQ.exe
  C:\Windows\System\GvveFJQ.exe
  2⤵
  PID:1956
- C:\Windows\System\VUYjbBp.exe
  C:\Windows\System\VUYjbBp.exe
  2⤵
  PID:6100
- C:\Windows\System\iaHZpaC.exe
  C:\Windows\System\iaHZpaC.exe
  2⤵
  PID:5856
- C:\Windows\System\kOhJxyq.exe
  C:\Windows\System\kOhJxyq.exe
  2⤵
  PID:388
- C:\Windows\System\fXtTuyS.exe
  C:\Windows\System\fXtTuyS.exe
  2⤵
  PID:6368
- C:\Windows\System\eVxUzSy.exe
  C:\Windows\System\eVxUzSy.exe
  2⤵
  PID:5904
- C:\Windows\System\acEkVDP.exe
  C:\Windows\System\acEkVDP.exe
  2⤵
  PID:6528
- C:\Windows\System\tngGrkb.exe
  C:\Windows\System\tngGrkb.exe
  2⤵
  PID:14332
- C:\Windows\System\lHOcoir.exe
  C:\Windows\System\lHOcoir.exe
  2⤵
  PID:13352
- C:\Windows\System\LrehlXP.exe
  C:\Windows\System\LrehlXP.exe
  2⤵
  PID:6392
- C:\Windows\System\COrxfsB.exe
  C:\Windows\System\COrxfsB.exe
  2⤵
  PID:14016
- C:\Windows\System\IMifCSV.exe
  C:\Windows\System\IMifCSV.exe
  2⤵
  PID:6504
- C:\Windows\System\WhIrrqS.exe
  C:\Windows\System\WhIrrqS.exe
  2⤵
  PID:5240
- C:\Windows\System\MdxsHyS.exe
  C:\Windows\System\MdxsHyS.exe
  2⤵
  PID:5472
- C:\Windows\System\AuLmcfE.exe
  C:\Windows\System\AuLmcfE.exe
  2⤵
  PID:6564
- C:\Windows\System\aWWdMBg.exe
  C:\Windows\System\aWWdMBg.exe
  2⤵
  PID:6976
- C:\Windows\System\HOsgSEY.exe
  C:\Windows\System\HOsgSEY.exe
  2⤵
  PID:6740
- C:\Windows\System\RCvWrJI.exe
  C:\Windows\System\RCvWrJI.exe
  2⤵
  PID:13452
- C:\Windows\System\tBaKRDL.exe
  C:\Windows\System\tBaKRDL.exe
  2⤵
  PID:5860
- C:\Windows\System\bGdAQjZ.exe
  C:\Windows\System\bGdAQjZ.exe
  2⤵
  PID:13700
- C:\Windows\System\OlwNdeN.exe
  C:\Windows\System\OlwNdeN.exe
  2⤵
  PID:1280
- C:\Windows\System\sYfbZCP.exe
  C:\Windows\System\sYfbZCP.exe
  2⤵
  PID:5496
- C:\Windows\System\xcPYiji.exe
  C:\Windows\System\xcPYiji.exe
  2⤵
  PID:6524
- C:\Windows\System\rcLTuek.exe
  C:\Windows\System\rcLTuek.exe
  2⤵
  PID:7096
- C:\Windows\System\swPGMky.exe
  C:\Windows\System\swPGMky.exe
  2⤵
  PID:6920
- C:\Windows\System\lvUantR.exe
  C:\Windows\System\lvUantR.exe
  2⤵
  PID:14032
- C:\Windows\System\bPHogec.exe
  C:\Windows\System\bPHogec.exe
  2⤵
  PID:7024
- C:\Windows\System\MlTVKPu.exe
  C:\Windows\System\MlTVKPu.exe
  2⤵
  PID:6084
- C:\Windows\System\cFrPllA.exe
  C:\Windows\System\cFrPllA.exe
  2⤵
  PID:7120
- C:\Windows\System\rjhhSdy.exe
  C:\Windows\System\rjhhSdy.exe
  2⤵
  PID:7008
- C:\Windows\System\gFliAJi.exe
  C:\Windows\System\gFliAJi.exe
  2⤵
  PID:6748
- C:\Windows\System\lbBncyR.exe
  C:\Windows\System\lbBncyR.exe
  2⤵
  PID:5848
- C:\Windows\System\THFLfGs.exe
  C:\Windows\System\THFLfGs.exe
  2⤵
  PID:7084
- C:\Windows\System\woCMRQs.exe
  C:\Windows\System\woCMRQs.exe
  2⤵
  PID:6520
- C:\Windows\System\flZdgMg.exe
  C:\Windows\System\flZdgMg.exe
  2⤵
  PID:14104
- C:\Windows\System\Owpabwc.exe
  C:\Windows\System\Owpabwc.exe
  2⤵
  PID:4588
- C:\Windows\System\SpQCYMd.exe
  C:\Windows\System\SpQCYMd.exe
  2⤵
  PID:6984
- C:\Windows\System\JRapMkE.exe
  C:\Windows\System\JRapMkE.exe
  2⤵
  PID:7100
- C:\Windows\System\vzyXpRN.exe
  C:\Windows\System\vzyXpRN.exe
  2⤵
  PID:5668
- C:\Windows\System\cqEvouk.exe
  C:\Windows\System\cqEvouk.exe
  2⤵
  PID:6840
- C:\Windows\System\KbOKkEp.exe
  C:\Windows\System\KbOKkEp.exe
  2⤵
  PID:6856
- C:\Windows\System\CvuWTPO.exe
  C:\Windows\System\CvuWTPO.exe
  2⤵
  PID:6568
- C:\Windows\System\bHiGQKw.exe
  C:\Windows\System\bHiGQKw.exe
  2⤵
  PID:6704
- C:\Windows\System\DNUzPAz.exe
  C:\Windows\System\DNUzPAz.exe
  2⤵
  PID:1984
- C:\Windows\System\QFIgXuN.exe
  C:\Windows\System\QFIgXuN.exe
  2⤵
  PID:6200
- C:\Windows\System\coAVuQI.exe
  C:\Windows\System\coAVuQI.exe
  2⤵
  PID:5356
- C:\Windows\System\LcEKoGN.exe
  C:\Windows\System\LcEKoGN.exe
  2⤵
  PID:5384
- C:\Windows\System\eQTkdwA.exe
  C:\Windows\System\eQTkdwA.exe
  2⤵
  PID:5468
- C:\Windows\System\DTDKCcv.exe
  C:\Windows\System\DTDKCcv.exe
  2⤵
  PID:6628
- C:\Windows\System\ZpiPNBG.exe
  C:\Windows\System\ZpiPNBG.exe
  2⤵
  PID:5844
- C:\Windows\System\aOgCnFL.exe
  C:\Windows\System\aOgCnFL.exe
  2⤵
  PID:4316
- C:\Windows\System\NaoGKeo.exe
  C:\Windows\System\NaoGKeo.exe
  2⤵
  PID:5536
- C:\Windows\System\eBzusPQ.exe
  C:\Windows\System\eBzusPQ.exe
  2⤵
  PID:6756
- C:\Windows\System\EfLLVxE.exe
  C:\Windows\System\EfLLVxE.exe
  2⤵
  PID:7004
- C:\Windows\System\QpdCRBp.exe
  C:\Windows\System\QpdCRBp.exe
  2⤵
  PID:15144
- C:\Windows\System\OHvycZb.exe
  C:\Windows\System\OHvycZb.exe
  2⤵
  PID:15212
- C:\Windows\System\bvFqlSK.exe
  C:\Windows\System\bvFqlSK.exe
  2⤵
  PID:15248
- C:\Windows\System\XpLZJhd.exe
  C:\Windows\System\XpLZJhd.exe
  2⤵
  PID:15296
- C:\Windows\System\otxCLYy.exe
  C:\Windows\System\otxCLYy.exe
  2⤵
  PID:15320
- C:\Windows\System\LpoDWpr.exe
  C:\Windows\System\LpoDWpr.exe
  2⤵
  PID:14340
- C:\Windows\System\hfovlJL.exe
  C:\Windows\System\hfovlJL.exe
  2⤵
  PID:14604
- C:\Windows\System\BEcrMiK.exe
  C:\Windows\System\BEcrMiK.exe
  2⤵
  PID:14624
- C:\Windows\System\PXJlPzp.exe
  C:\Windows\System\PXJlPzp.exe
  2⤵
  PID:14636
- C:\Windows\System\eIlbfpM.exe
  C:\Windows\System\eIlbfpM.exe
  2⤵
  PID:14684
- C:\Windows\System\FUNKQAG.exe
  C:\Windows\System\FUNKQAG.exe
  2⤵
  PID:14712
- C:\Windows\System\vYzKaAY.exe
  C:\Windows\System\vYzKaAY.exe
  2⤵
  PID:14736
- C:\Windows\System\NVxMqJs.exe
  C:\Windows\System\NVxMqJs.exe
  2⤵
  PID:14764
- C:\Windows\System\hjqcVmU.exe
  C:\Windows\System\hjqcVmU.exe
  2⤵
  PID:14784
- C:\Windows\System\ZohQvJF.exe
  C:\Windows\System\ZohQvJF.exe
  2⤵
  PID:14808
- C:\Windows\System\FVkYgmj.exe
  C:\Windows\System\FVkYgmj.exe
  2⤵
  PID:14828
- C:\Windows\System\FqeDkmY.exe
  C:\Windows\System\FqeDkmY.exe
  2⤵
  PID:14852
- C:\Windows\System\HImhvNh.exe
  C:\Windows\System\HImhvNh.exe
  2⤵
  PID:14884
- C:\Windows\System\kSdzUBd.exe
  C:\Windows\System\kSdzUBd.exe
  2⤵
  PID:14924
- C:\Windows\System\XPziiHi.exe
  C:\Windows\System\XPziiHi.exe
  2⤵
  PID:14964
- C:\Windows\System\vdPwngr.exe
  C:\Windows\System\vdPwngr.exe
  2⤵
  PID:14992
- C:\Windows\System\ggMRXpS.exe
  C:\Windows\System\ggMRXpS.exe
  2⤵
  PID:15024
- C:\Windows\System\PyNClKO.exe
  C:\Windows\System\PyNClKO.exe
  2⤵
  PID:15056
- C:\Windows\System\KqxwbCV.exe
  C:\Windows\System\KqxwbCV.exe
  2⤵
  PID:15104
- C:\Windows\System\LDhWeaI.exe
  C:\Windows\System\LDhWeaI.exe
  2⤵
  PID:15108
- C:\Windows\System\BzjlkGu.exe
  C:\Windows\System\BzjlkGu.exe
  2⤵
  PID:5756
- C:\Windows\System\remIYSu.exe
  C:\Windows\System\remIYSu.exe
  2⤵
  PID:15188
- C:\Windows\System\zCbwFZr.exe
  C:\Windows\System\zCbwFZr.exe
  2⤵
  PID:15236
- C:\Windows\System\ZBhxtWn.exe
  C:\Windows\System\ZBhxtWn.exe
  2⤵
  PID:15260
- C:\Windows\System\oVnbErn.exe
  C:\Windows\System\oVnbErn.exe
  2⤵
  PID:15340
- C:\Windows\System\poOtYKU.exe
  C:\Windows\System\poOtYKU.exe
  2⤵
  PID:15292
- C:\Windows\System\lNxbPIM.exe
  C:\Windows\System\lNxbPIM.exe
  2⤵
  PID:1440
- C:\Windows\System\RTAGpZr.exe
  C:\Windows\System\RTAGpZr.exe
  2⤵
  PID:14392
- C:\Windows\System\SjPaEwG.exe
  C:\Windows\System\SjPaEwG.exe
  2⤵
  PID:1272
- C:\Windows\System\vzuwwwc.exe
  C:\Windows\System\vzuwwwc.exe
  2⤵
  PID:15196
- C:\Windows\System\nrmBdoF.exe
  C:\Windows\System\nrmBdoF.exe
  2⤵
  PID:14460
- C:\Windows\System\ieWnBdu.exe
  C:\Windows\System\ieWnBdu.exe
  2⤵
  PID:3148
- C:\Windows\System\FSQkVEA.exe
  C:\Windows\System\FSQkVEA.exe
  2⤵
  PID:7124
- C:\Windows\System\rtaNFUp.exe
  C:\Windows\System\rtaNFUp.exe
  2⤵
  PID:5004
- C:\Windows\System\NqRwYgL.exe
  C:\Windows\System\NqRwYgL.exe
  2⤵
  PID:14584
- C:\Windows\System\aJpFhkC.exe
  C:\Windows\System\aJpFhkC.exe
  2⤵
  PID:1240
- C:\Windows\System\diIoQsF.exe
  C:\Windows\System\diIoQsF.exe
  2⤵
  PID:14564
- C:\Windows\System\wBJKGhM.exe
  C:\Windows\System\wBJKGhM.exe
  2⤵
  PID:14644
- C:\Windows\System\vwGFlTk.exe
  C:\Windows\System\vwGFlTk.exe
  2⤵
  PID:14672
- C:\Windows\System\uGQXEHg.exe
  C:\Windows\System\uGQXEHg.exe
  2⤵
  PID:7524
- C:\Windows\System\SBrvtAv.exe
  C:\Windows\System\SBrvtAv.exe
  2⤵
  PID:7404
- C:\Windows\System\rafZSmB.exe
  C:\Windows\System\rafZSmB.exe
  2⤵
  PID:7856
- C:\Windows\System\RSaKYEt.exe
  C:\Windows\System\RSaKYEt.exe
  2⤵
  PID:7900
- C:\Windows\System\JUVCTVC.exe
  C:\Windows\System\JUVCTVC.exe
  2⤵
  PID:5044
- C:\Windows\System\dXXeloj.exe
  C:\Windows\System\dXXeloj.exe
  2⤵
  PID:7944
- C:\Windows\System\uuajAZX.exe
  C:\Windows\System\uuajAZX.exe
  2⤵
  PID:15080
- C:\Windows\System\msxkYgJ.exe
  C:\Windows\System\msxkYgJ.exe
  2⤵
  PID:15100
- C:\Windows\System\rONoCEE.exe
  C:\Windows\System\rONoCEE.exe
  2⤵
  PID:8024
- C:\Windows\System\JmwYQMf.exe
  C:\Windows\System\JmwYQMf.exe
  2⤵
  PID:15116
- C:\Windows\System\ePjuGgA.exe
  C:\Windows\System\ePjuGgA.exe
  2⤵
  PID:15176
- C:\Windows\System\ooLyhYP.exe
  C:\Windows\System\ooLyhYP.exe
  2⤵
  PID:15244
- C:\Windows\System\UWYngvi.exe
  C:\Windows\System\UWYngvi.exe
  2⤵
  PID:15336
- C:\Windows\System\oSIdGoW.exe
  C:\Windows\System\oSIdGoW.exe
  2⤵
  PID:7460
- C:\Windows\System\jgpebwj.exe
  C:\Windows\System\jgpebwj.exe
  2⤵
  PID:14376
- C:\Windows\System\uMFsGXB.exe
  C:\Windows\System\uMFsGXB.exe
  2⤵
  PID:4000
- C:\Windows\System\XWYnAGu.exe
  C:\Windows\System\XWYnAGu.exe
  2⤵
  PID:15352
- C:\Windows\System\eMihAMi.exe
  C:\Windows\System\eMihAMi.exe
  2⤵
  PID:14420
- C:\Windows\System\bKGpEbT.exe
  C:\Windows\System\bKGpEbT.exe
  2⤵
  PID:14444
- C:\Windows\System\AVHQSTH.exe
  C:\Windows\System\AVHQSTH.exe
  2⤵
  PID:14508
- C:\Windows\System\khImebx.exe
  C:\Windows\System\khImebx.exe
  2⤵
  PID:14560
- C:\Windows\System\eSdOkxH.exe
  C:\Windows\System\eSdOkxH.exe
  2⤵
  PID:14532
- C:\Windows\System\pefmdzo.exe
  C:\Windows\System\pefmdzo.exe
  2⤵
  PID:7660
- C:\Windows\System\cfQxkQY.exe
  C:\Windows\System\cfQxkQY.exe
  2⤵
  PID:8324
- C:\Windows\System\JSSgqeL.exe
  C:\Windows\System\JSSgqeL.exe
  2⤵
  PID:7240
- C:\Windows\System\JQQiiuR.exe
  C:\Windows\System\JQQiiuR.exe
  2⤵
  PID:7292
- C:\Windows\System\TnhPmDJ.exe
  C:\Windows\System\TnhPmDJ.exe
  2⤵
  PID:14664
- C:\Windows\System\mmOCSUb.exe
  C:\Windows\System\mmOCSUb.exe
  2⤵
  PID:14752
- C:\Windows\System\fVHRpyi.exe
  C:\Windows\System\fVHRpyi.exe
  2⤵
  PID:9176
- C:\Windows\System\lkgQenq.exe
  C:\Windows\System\lkgQenq.exe
  2⤵
  PID:14868
- C:\Windows\System\EuwHTXw.exe
  C:\Windows\System\EuwHTXw.exe
  2⤵
  PID:8844
- C:\Windows\System\REZkZoc.exe
  C:\Windows\System\REZkZoc.exe
  2⤵
  PID:9316
- C:\Windows\System\YnmAiKe.exe
  C:\Windows\System\YnmAiKe.exe
  2⤵
  PID:7896
- C:\Windows\System\htbkyYz.exe
  C:\Windows\System\htbkyYz.exe
  2⤵
  PID:15036
- C:\Windows\System\OZaGTSX.exe
  C:\Windows\System\OZaGTSX.exe
  2⤵
  PID:8812
- C:\Windows\System\hbsIHSE.exe
  C:\Windows\System\hbsIHSE.exe
  2⤵
  PID:8148
- C:\Windows\System\GXmjGdC.exe
  C:\Windows\System\GXmjGdC.exe
  2⤵
  PID:9928
- C:\Windows\System\cRHtAaz.exe
  C:\Windows\System\cRHtAaz.exe
  2⤵
  PID:7780
- C:\Windows\System\htClaJo.exe
  C:\Windows\System\htClaJo.exe
  2⤵
  PID:14952
- C:\Windows\System\VADrltc.exe
  C:\Windows\System\VADrltc.exe
  2⤵
  PID:15184
- C:\Windows\System\LMLkaBX.exe
  C:\Windows\System\LMLkaBX.exe
  2⤵
  PID:10096
- C:\Windows\System\DHIjyVi.exe
  C:\Windows\System\DHIjyVi.exe
  2⤵
  PID:7700
- C:\Windows\System\fnHvtgF.exe
  C:\Windows\System\fnHvtgF.exe
  2⤵
  PID:15068
- C:\Windows\System\OHTwWbw.exe
  C:\Windows\System\OHTwWbw.exe
  2⤵
  PID:9780
- C:\Windows\System\kTAnFNI.exe
  C:\Windows\System\kTAnFNI.exe
  2⤵
  PID:15180
- C:\Windows\System\Nmgugop.exe
  C:\Windows\System\Nmgugop.exe
  2⤵
  PID:7608
- C:\Windows\System\uYclWrY.exe
  C:\Windows\System\uYclWrY.exe
  2⤵
  PID:9732
- C:\Windows\System\AaSTrSc.exe
  C:\Windows\System\AaSTrSc.exe
  2⤵
  PID:9596
- C:\Windows\System\aCFeYlL.exe
  C:\Windows\System\aCFeYlL.exe
  2⤵
  PID:3344
- C:\Windows\System\glOafAY.exe
  C:\Windows\System\glOafAY.exe
  2⤵
  PID:8544
- C:\Windows\System\hkBYndm.exe
  C:\Windows\System\hkBYndm.exe
  2⤵
  PID:15348
- C:\Windows\System\daYtxPu.exe
  C:\Windows\System\daYtxPu.exe
  2⤵
  PID:13200
- C:\Windows\System\VgOfwZa.exe
  C:\Windows\System\VgOfwZa.exe
  2⤵
  PID:10144
- C:\Windows\System\jONSgvU.exe
  C:\Windows\System\jONSgvU.exe
  2⤵
  PID:14576
- C:\Windows\System\NjCeqZB.exe
  C:\Windows\System\NjCeqZB.exe
  2⤵
  PID:10480
- C:\Windows\System\UtAzkDR.exe
  C:\Windows\System\UtAzkDR.exe
  2⤵
  PID:5420
- C:\Windows\System\jUABzdH.exe
  C:\Windows\System\jUABzdH.exe
  2⤵
  PID:1020
- C:\Windows\System\tSpXVil.exe
  C:\Windows\System\tSpXVil.exe
  2⤵
  PID:9460
- C:\Windows\System\LdpscZa.exe
  C:\Windows\System\LdpscZa.exe
  2⤵
  PID:9260
- C:\Windows\System\ecaujiZ.exe
  C:\Windows\System\ecaujiZ.exe
  2⤵
  PID:8240
- C:\Windows\System\QsZHxPU.exe
  C:\Windows\System\QsZHxPU.exe
  2⤵
  PID:10056
- C:\Windows\System\AEDjYZo.exe
  C:\Windows\System\AEDjYZo.exe
  2⤵
  PID:14860
- C:\Windows\System\PjOkrGf.exe
  C:\Windows\System\PjOkrGf.exe
  2⤵
  PID:9152
- C:\Windows\System\rwveNmg.exe
  C:\Windows\System\rwveNmg.exe
  2⤵
  PID:15008
- C:\Windows\System\jegYkCY.exe
  C:\Windows\System\jegYkCY.exe
  2⤵
  PID:9300
- C:\Windows\System\QDaREaU.exe
  C:\Windows\System\QDaREaU.exe
  2⤵
  PID:8660
- C:\Windows\System\oSSewVi.exe
  C:\Windows\System\oSSewVi.exe
  2⤵
  PID:10568
- C:\Windows\System\MlmOKcH.exe
  C:\Windows\System\MlmOKcH.exe
  2⤵
  PID:8996
- C:\Windows\System\kNLoOYG.exe
  C:\Windows\System\kNLoOYG.exe
  2⤵
  PID:15124
- C:\Windows\System\nAdtErD.exe
  C:\Windows\System\nAdtErD.exe
  2⤵
  PID:15040
- C:\Windows\System\KtFrEXq.exe
  C:\Windows\System\KtFrEXq.exe
  2⤵
  PID:10924
- C:\Windows\System\GsqdqCM.exe
  C:\Windows\System\GsqdqCM.exe
  2⤵
  PID:8136
- C:\Windows\System\DlXrOAV.exe
  C:\Windows\System\DlXrOAV.exe
  2⤵
  PID:4904
- C:\Windows\System\UAFkRCh.exe
  C:\Windows\System\UAFkRCh.exe
  2⤵
  PID:10336
- C:\Windows\System\wToshSj.exe
  C:\Windows\System\wToshSj.exe
  2⤵
  PID:1708
- C:\Windows\System\IkRYvur.exe
  C:\Windows\System\IkRYvur.exe
  2⤵
  PID:14500
- C:\Windows\System\obZJjDR.exe
  C:\Windows\System\obZJjDR.exe
  2⤵
  PID:11952
- C:\Windows\System\dVZLirN.exe
  C:\Windows\System\dVZLirN.exe
  2⤵
  PID:8380
- C:\Windows\System\KAspZlG.exe
  C:\Windows\System\KAspZlG.exe
  2⤵
  PID:9024
- C:\Windows\System\iJIymrO.exe
  C:\Windows\System\iJIymrO.exe
  2⤵
  PID:7172
- C:\Windows\System\IUzMUSE.exe
  C:\Windows\System\IUzMUSE.exe
  2⤵
  PID:11344
- C:\Windows\System\SXSCBTO.exe
  C:\Windows\System\SXSCBTO.exe
  2⤵
  PID:11384
- C:\Windows\System\RvbcfCn.exe
  C:\Windows\System\RvbcfCn.exe
  2⤵
  PID:8576
- C:\Windows\System\EuxmavQ.exe
  C:\Windows\System\EuxmavQ.exe
  2⤵
  PID:14864
- C:\Windows\System\XdIdeKo.exe
  C:\Windows\System\XdIdeKo.exe
  2⤵
  PID:7364
- C:\Windows\System\YGxlcGa.exe
  C:\Windows\System\YGxlcGa.exe
  2⤵
  PID:9372
- C:\Windows\System\Qizbkps.exe
  C:\Windows\System\Qizbkps.exe
  2⤵
  PID:9432
- C:\Windows\System\EHWuqlB.exe
  C:\Windows\System\EHWuqlB.exe
  2⤵
  PID:7224
- C:\Windows\System\YbxFysC.exe
  C:\Windows\System\YbxFysC.exe
  2⤵
  PID:12344
- C:\Windows\System\vXJDDbo.exe
  C:\Windows\System\vXJDDbo.exe
  2⤵
  PID:9492
- C:\Windows\System\WwkaAMD.exe
  C:\Windows\System\WwkaAMD.exe
  2⤵
  PID:11820
- C:\Windows\System\QJGTiLr.exe
  C:\Windows\System\QJGTiLr.exe
  2⤵
  PID:12548
- C:\Windows\System\TrgVchf.exe
  C:\Windows\System\TrgVchf.exe
  2⤵
  PID:9576
- C:\Windows\System\yBJIuuW.exe
  C:\Windows\System\yBJIuuW.exe
  2⤵
  PID:11716
- C:\Windows\System\vwmMCNh.exe
  C:\Windows\System\vwmMCNh.exe
  2⤵
  PID:11444
- C:\Windows\System\CCnijPw.exe
  C:\Windows\System\CCnijPw.exe
  2⤵
  PID:11812
- C:\Windows\System\HGQCUaM.exe
  C:\Windows\System\HGQCUaM.exe
  2⤵
  PID:9636
- C:\Windows\System\HiWgakT.exe
  C:\Windows\System\HiWgakT.exe
  2⤵
  PID:12072
- C:\Windows\System\uzKKhVv.exe
  C:\Windows\System\uzKKhVv.exe
  2⤵
  PID:12208
- C:\Windows\System\fkGKmlp.exe
  C:\Windows\System\fkGKmlp.exe
  2⤵
  PID:11380
- C:\Windows\System\DeDLZAG.exe
  C:\Windows\System\DeDLZAG.exe
  2⤵
  PID:9856
- C:\Windows\System\ErGiavi.exe
  C:\Windows\System\ErGiavi.exe
  2⤵
  PID:9276
- C:\Windows\System\xkAlYcw.exe
  C:\Windows\System\xkAlYcw.exe
  2⤵
  PID:15012
- C:\Windows\System\vGhCyVc.exe
  C:\Windows\System\vGhCyVc.exe
  2⤵
  PID:11308
- C:\Windows\System\aiwtnNo.exe
  C:\Windows\System\aiwtnNo.exe
  2⤵
  PID:15256
- C:\Windows\System\BfzmMXj.exe
  C:\Windows\System\BfzmMXj.exe
  2⤵
  PID:11360
- C:\Windows\System\sLqlWjY.exe
  C:\Windows\System\sLqlWjY.exe
  2⤵
  PID:10436
- C:\Windows\System\nrRXCmh.exe
  C:\Windows\System\nrRXCmh.exe
  2⤵
  PID:12004
- C:\Windows\System\VQcCSyo.exe
  C:\Windows\System\VQcCSyo.exe
  2⤵
  PID:12368
- C:\Windows\System\aQXHxDP.exe
  C:\Windows\System\aQXHxDP.exe
  2⤵
  PID:12736
- C:\Windows\System\thJHbHC.exe
  C:\Windows\System\thJHbHC.exe
  2⤵
  PID:12580
- C:\Windows\System\kiQxUSh.exe
  C:\Windows\System\kiQxUSh.exe
  2⤵
  PID:9464
- C:\Windows\System\SQUEYgy.exe
  C:\Windows\System\SQUEYgy.exe
  2⤵
  PID:10076
- C:\Windows\System\KsBIPoV.exe
  C:\Windows\System\KsBIPoV.exe
  2⤵
  PID:8948
- C:\Windows\System\umnEtrH.exe
  C:\Windows\System\umnEtrH.exe
  2⤵
  PID:11060
- C:\Windows\System\cNkqxqF.exe
  C:\Windows\System\cNkqxqF.exe
  2⤵
  PID:11624
- C:\Windows\System\kSUVdEc.exe
  C:\Windows\System\kSUVdEc.exe
  2⤵
  PID:13080
- C:\Windows\System\AgCzXCc.exe
  C:\Windows\System\AgCzXCc.exe
  2⤵
  PID:7624
- C:\Windows\System\xKyXcdC.exe
  C:\Windows\System\xKyXcdC.exe
  2⤵
  PID:1260
- C:\Windows\System\CCfluKr.exe
  C:\Windows\System\CCfluKr.exe
  2⤵
  PID:15224
- C:\Windows\System\qcFOArs.exe
  C:\Windows\System\qcFOArs.exe
  2⤵
  PID:8880
- C:\Windows\System\ifsiuCK.exe
  C:\Windows\System\ifsiuCK.exe
  2⤵
  PID:7264
- C:\Windows\System\utnOenw.exe
  C:\Windows\System\utnOenw.exe
  2⤵
  PID:2424
- C:\Windows\System\hXuVZvl.exe
  C:\Windows\System\hXuVZvl.exe
  2⤵
  PID:9832
- C:\Windows\System\RGfzKTO.exe
  C:\Windows\System\RGfzKTO.exe
  2⤵
  PID:10764
- C:\Windows\System\hgXTqQn.exe
  C:\Windows\System\hgXTqQn.exe
  2⤵
  PID:7760
- C:\Windows\System\mjsoKOn.exe
  C:\Windows\System\mjsoKOn.exe
  2⤵
  PID:9304
- C:\Windows\System\gZfgPpM.exe
  C:\Windows\System\gZfgPpM.exe
  2⤵
  PID:11804
- C:\Windows\System\ACHhOtr.exe
  C:\Windows\System\ACHhOtr.exe
  2⤵
  PID:10404
- C:\Windows\System\jwYuyTV.exe
  C:\Windows\System\jwYuyTV.exe
  2⤵
  PID:12980
- C:\Windows\System\LeHMRfo.exe
  C:\Windows\System\LeHMRfo.exe
  2⤵
  PID:12952
- C:\Windows\System\eReDNCk.exe
  C:\Windows\System\eReDNCk.exe
  2⤵
  PID:11996
- C:\Windows\System\FPRSepY.exe
  C:\Windows\System\FPRSepY.exe
  2⤵
  PID:12336
- C:\Windows\System\CPCYhez.exe
  C:\Windows\System\CPCYhez.exe
  2⤵
  PID:13224
- C:\Windows\System\gjUkgIG.exe
  C:\Windows\System\gjUkgIG.exe
  2⤵
  PID:2400
- C:\Windows\System\iiQyqle.exe
  C:\Windows\System\iiQyqle.exe
  2⤵
  PID:13056
- C:\Windows\System\OefsZBK.exe
  C:\Windows\System\OefsZBK.exe
  2⤵
  PID:11436
- C:\Windows\System\dLmpIzB.exe
  C:\Windows\System\dLmpIzB.exe
  2⤵
  PID:12340
- C:\Windows\System\NOayvBv.exe
  C:\Windows\System\NOayvBv.exe
  2⤵
  PID:11968
- C:\Windows\System\XwCYCqh.exe
  C:\Windows\System\XwCYCqh.exe
  2⤵
  PID:11560
- C:\Windows\System\bPJhSdp.exe
  C:\Windows\System\bPJhSdp.exe
  2⤵
  PID:8932
- C:\Windows\System\kqvclNT.exe
  C:\Windows\System\kqvclNT.exe
  2⤵
  PID:11448
- C:\Windows\System\HQHJqln.exe
  C:\Windows\System\HQHJqln.exe
  2⤵
  PID:8668
- C:\Windows\System\afRDYnq.exe
  C:\Windows\System\afRDYnq.exe
  2⤵
  PID:12416
- C:\Windows\System\yLPkTyK.exe
  C:\Windows\System\yLPkTyK.exe
  2⤵
  PID:11512
- C:\Windows\System\VtppjUs.exe
  C:\Windows\System\VtppjUs.exe
  2⤵
  PID:12564
- C:\Windows\System\EytidCC.exe
  C:\Windows\System\EytidCC.exe
  2⤵
  PID:11964
- C:\Windows\System\qfmVKua.exe
  C:\Windows\System\qfmVKua.exe
  2⤵
  PID:14708
- C:\Windows\System\MMgaroV.exe
  C:\Windows\System\MMgaroV.exe
  2⤵
  PID:13268
- C:\Windows\System\rBPkSbw.exe
  C:\Windows\System\rBPkSbw.exe
  2⤵
  PID:12612
- C:\Windows\System\uhHVENK.exe
  C:\Windows\System\uhHVENK.exe
  2⤵
  PID:11236
- C:\Windows\System\lRSePps.exe
  C:\Windows\System\lRSePps.exe
  2⤵
  PID:12380
- C:\Windows\System\PTZNYJT.exe
  C:\Windows\System\PTZNYJT.exe
  2⤵
  PID:10712
- C:\Windows\System\PCmgEDk.exe
  C:\Windows\System\PCmgEDk.exe
  2⤵
  PID:9984
- C:\Windows\System\ZfdEHhp.exe
  C:\Windows\System\ZfdEHhp.exe
  2⤵
  PID:10028
- C:\Windows\System\MErWbdw.exe
  C:\Windows\System\MErWbdw.exe
  2⤵
  PID:12028
- C:\Windows\System\Bxxiovx.exe
  C:\Windows\System\Bxxiovx.exe
  2⤵
  PID:10220
- C:\Windows\System\rtAkhuJ.exe
  C:\Windows\System\rtAkhuJ.exe
  2⤵
  PID:11496
- C:\Windows\System\SWizpdh.exe
  C:\Windows\System\SWizpdh.exe
  2⤵
  PID:11084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ajqppsx3.unt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AgzQzXv.exe

Filesize
2.3MB

MD5
74f476a0ee0e51707bee7e074f6e8fc5

SHA1
f8f25a20f2cffc8a3580d30a94e8a168110e5390

SHA256
a127f656b9ab7c300261ea79388d921859ea8cb7bad16cc8884f9abd8d2a2ddb

SHA512
4d209f394e436cc2790438005be833fb7c37d9ff976cec491098f85a5b5f116866ee2145446352a309ddd41c8fd23338e816f062944405a83dc9476dfb6f48e5

Download Submit
C:\Windows\System\BBNRPFd.exe

Filesize
2.3MB

MD5
3690b69c865983df4aecbfa9e4744589

SHA1
1486d3430e06944ac1aeec2e216f698738dd4fc2

SHA256
1766a03885e3b986031e486481d2e4e71870778e4de52e43c2a3de8238be7863

SHA512
0be74ec29ec144eaacb67ddd014f9b66091a8525d2079b726198104f897bed6c20dc3b7b0c02062a21a279de4c3f222be2fee42815f56d1e594909d870ae1ce7

Download Submit
C:\Windows\System\CzWtQhL.exe

Filesize
2.3MB

MD5
1c8bfeb6e0df22a37201bf996c58479e

SHA1
39341b12aeb80cad77ceaabab91d1c298d628b91

SHA256
b5a594377b9e6ee1e94589831c10907b1beb2bde5d0c63f01130034f3745619c

SHA512
e8665d239676e7a18f8956cb8a64e29bd3ae6ab411ab88bcb93fbd44ca71f87ddb1cd6bd3c6b2eea6e7afd03cd56111d518ea3f5f6afff27a8993eac83b91c78

Download Submit
C:\Windows\System\FlEkrhV.exe

Filesize
2.3MB

MD5
c1a5180ee913c43ab6af3becbfbf921e

SHA1
8b32757238b4e518f185799b52313ef12882e951

SHA256
55e69406aa2cf238d05fd3cdfedab2ac9c43235aab481762991f1b5f4ddaba87

SHA512
9a83a0edc4bf8ded210cffe7e91d3d7a06121294d619fa1137816eb864e3ec1e81d8408237d98d87a709c4c79ef56b4991c97770d9aac70b1986cb4c147dbf61

Download Submit
C:\Windows\System\HsoMVUX.exe

Filesize
2.3MB

MD5
90d7ee40110ce1aa4ec40cb121227bf6

SHA1
36998ccbc18ff098325e8be10384e940bdbd49a9

SHA256
d32e813930a0b97f8e680ec002ae1af744bf9ed60cb6bbf8978d76165261f85e

SHA512
ca421ca70f43366d490acb162f2193839672f5c96e03401a3e8077811f10d316ec8ef3ed3e6c5c24a1b40687ece488a4f7e6573835c3dcf23dc26b8083a8a3f0

Download Submit
C:\Windows\System\IGHjuhc.exe

Filesize
2.3MB

MD5
5abce0e221c915385466088a2c9feef2

SHA1
01dd808ac5b16f19c80bb878e1754c3a9e2c74db

SHA256
3a64f78d3ce0dfd5ca7371cc22c5993be9d315bd31bd5cc6640dbc22e03e87da

SHA512
1398b43d17e3528022379f872e9f8ffbc5247587509468dc91b21675d307c8ed2dc164d1d48dae597378890fc884d5a358a7d0f26f5a313053fd815b97505382

Download Submit
C:\Windows\System\JxYekCx.exe

Filesize
2.3MB

MD5
c00043f984e22f7d342e2717b3806cc6

SHA1
bedc643258ef2c35701611708e52aea302495ebb

SHA256
c72f344d5c5536ced92e2e3b28f40d9afd8a1f6913d69039dc8a8251bd415f2f

SHA512
323bd3c94c5653371c168ef3471af45a544e4fe4a3ebaed3ef87e6741542a52f378783a9b1d5912114c4d98dd2867130ab84c503fae4ba9b8dde551359cdc365

Download Submit
C:\Windows\System\PSBWhYk.exe

Filesize
2.3MB

MD5
968030036e52bf4363921fc7c9252602

SHA1
c37ba55721ddb62fcd1f6c037ebc2b98bbdcb08e

SHA256
b2eaf7e7626fa849e14c67f07be878de1e6eebc21b44accadb73934101b7b2c3

SHA512
fbcfaaab6f9809e879cce4bf64fd87e1a5df405e58bf166a60344f003945feafd2afd48ef1da69fb7cc1309aa6146ab619e48f6f94907009d69e0ec9496373cb

Download Submit
C:\Windows\System\PrtMCYB.exe

Filesize
2.3MB

MD5
22c3198de00d36519464fc34588bc5b6

SHA1
e77a22fbe01585fdc0f4d29dc42e586eca6afcdb

SHA256
608d00b8a477fdfd18969f00755856fd61f24a3885bc0e79ffeb0f4acac90e96

SHA512
9f5debda0a12d5265654212e5e1b7e859b50a64ea6b12f8e3d6defa47b9eec83e39b31109d93a5da8733fa53f55734b42a201533f080cbd92fb21a1b330b0d9c

Download Submit
C:\Windows\System\QRHsTPd.exe

Filesize
2.3MB

MD5
9ce059a64ce5d28557f1e6d17b9b2d95

SHA1
25da2de01536202794016bf057f754bc6647f3ba

SHA256
773da463b037597869c1d289d340b6afb4950c3ad02b304f63478cbcabb6d46a

SHA512
6b297f5a71054489233956788522e336c6ca9e41a9dd4dab4e6b28e32edbc589a1f287461c38e7335712b3e82e5ebb3b455ba30951d668ebfcea4a5d04a1ab62

Download Submit
C:\Windows\System\QrJXsdF.exe

Filesize
2.3MB

MD5
56fdccbcece5b75ae28b10477eafc6c8

SHA1
3c1e3e6e77d9a003e4b7d9d3d5a1cb325619d97c

SHA256
b3d7aec24828263d6cdb07b9ea8aac04f6668fa42e4bef54a49158f8c9b9b8b9

SHA512
5256a39e35b0e19d49cebe793b113b0e09ac920f85e2d7b04fc7dd3b026d3dc028e66b084a7c0e0c3c4d73623039ed25164fd0a8bc22a6cc76cc9146f7b308d1

Download Submit
C:\Windows\System\RizfTMn.exe

Filesize
2.3MB

MD5
34fbc097a077a6e276092a7b467279e1

SHA1
c670e7d8ae64711625ce33e4e53b1fc0e37a9b4f

SHA256
6093fe0a469b323843a0b5bf788b18339760c8bc752594e3d6456ebae45ced36

SHA512
573f28db3c275acab80015ff820c94e40ed3370f93251e9a4431079ca99cf984bf7cacf5a97cbd164745fad17795d247de3a5aec81f2945a5678f0b531ec5baa

Download Submit
C:\Windows\System\SHJgZQN.exe

Filesize
2.3MB

MD5
ddac1ac96c65e38404e9b91d6c187456

SHA1
628d9322bb659a02784772e8f6cef7ef8df28c52

SHA256
b4a6a1de0e7599e57fe40ec62357b7ff111e74e3f9230037292e19755fa258b2

SHA512
4c9663c3c3e4ae6da0fd0d39e58c10bc3465290ccac7b4cdc43f2cfcc14c51aab6bf9dfb095692e8873597590bd844ce8dc4a39394b8fb40f05528feb683aa4c

Download Submit
C:\Windows\System\Tnkzlka.exe

Filesize
2.3MB

MD5
11bed2eb4de907f9b402e398d3cb80c6

SHA1
0a113257d139a03a2e1eb144af165afcc5948227

SHA256
0690dbad52a809c4d238712241fb43b786b263c34b67a74b2f77256f1c92e47a

SHA512
27c9252a9bb0864a7798e1fbd8910cc165fe8f361f502d2cd23459117b0340e8ded973781ded456c7821cfe31b55531e99d4d7cef9d8f63f341415cff623fad1

Download Submit
C:\Windows\System\WBROMgV.exe

Filesize
2.3MB

MD5
3e33ad4516eff625ddf043ef38f6317f

SHA1
b4210d13591a1486f033b1d1e4cc255c99e5adbf

SHA256
4a19486547b9eea426a9cc20fda8701ce14fca0e1f009a10663731b136f1d061

SHA512
9bca91af71c7c8126520fa1d38cc9556841185d4cfadc1eac2a5e7f7ab3538ab1cfc4c20796a2b60c42129e1a97bc1c71af11e750442f9ea25d7e9d578b38ec7

Download Submit
C:\Windows\System\WKmruVP.exe

Filesize
8B

MD5
7844449f1717b2590e53c215fcf07352

SHA1
79d0c9d199e3401234813cacf5dd2de0f53d76f4

SHA256
d54f9b9a769720c875f9b7152a74884a4a9e5a4d80da35d3f847cb8b30b14f4d

SHA512
08987ef45e3b930599e24a17bad53cfff0dadf3651ece3e5b0469612e6c0a9a6cc61ef278c49c769a425e8c5349976b197865ce68d78055e84972e2fe8a0851c

Download Submit
C:\Windows\System\WRlswgP.exe

Filesize
2.3MB

MD5
4e90367975af4e33cbc1450b18475521

SHA1
a229ef78e260a7ee88528cd3ff36f18dc253f395

SHA256
fc1b9fc3d6d6b09f7749691ff0af62fc467ff613b52707a245cd6d77745bd659

SHA512
d331b15feab7f1f5833857ece58c8fe106fe91189cd0728be0e2134b0b88e417485dec501ca6d88cb359758c1de0dcd0cf3dee427da1cc3e5b7201004239b536

Download Submit
C:\Windows\System\XXRvRoo.exe

Filesize
2.3MB

MD5
25a5f91e60f64a5bd3db65727a490854

SHA1
6bfbe79e3ae55c271930dac8089548c5df3a9aff

SHA256
433587292ed0cf1c7a335a714566f8b3506a3e0f65ac52da871a4c9802e96d0d

SHA512
a95c30034508ef7b204537ff7fc6f8f6d062d46654e3c6e85ee7337afc13c8bbe4d46eadeb0d9d5a5329e0b2ffb439d7d8f56d94cac88a375c74552c747b9d23

Download Submit
C:\Windows\System\XrfmCni.exe

Filesize
2.3MB

MD5
7ca0ddc81a66b75ec7f4f1e31b202e63

SHA1
823136f6f0bc1da8a7a58534863240e979b248d4

SHA256
9f8620e04af1db46b90b694f199928d0c9a79b23e5fbd435566d8313ea309bcb

SHA512
490b6c11e195f041373cb18f25631d601f6b0b881f53be526a7fd068b6abd881154aa93e56ac410754ac585397d480f085cd4172643d275849d0759ab28f3c9c

Download Submit
C:\Windows\System\aBsmOGu.exe

Filesize
2.3MB

MD5
c1cccb4a61f7c7a942a06b993eca8831

SHA1
8c36009e9e1ab30b896a00e6fef1da6720c07747

SHA256
0ecfb6215b1b15f623eca0e7da533365e5f7b907a8a96bdbdf721d2a6ea97e85

SHA512
93bb856c7e0ebfadd17969c2e746dba23475f657099fa02f57e451dad0aeac67e21fe56ace375d3e39c1f94ddbb635b19fd4451b640606e6dca62fd2c56588e3

Download Submit
C:\Windows\System\cxfPXaC.exe

Filesize
2.3MB

MD5
3a6691de71d50c7e8031ee82213b9f76

SHA1
eb2b040c00944c3397c3b8bc426098a490e8683d

SHA256
7994ecf07d4a015a417d9c64a721963e55fb2be28cb824e3c10aec4683c616d6

SHA512
995f7ee96e954c1a05632e0bf06e7ac9964c02e14fef241317cf7c0d80979e852322ccf8f085a1e2c3ba842a6003e7e3a4385a0544ab5c699524e2cb16da22f6

Download Submit
C:\Windows\System\dFpcdWX.exe

Filesize
2.3MB

MD5
89f12379ef2c32e12a2ad737faaee0b7

SHA1
70d80b86a960611971002506548878f6a82a25c9

SHA256
75ca0c04b9893ee348b51b57d6ceb702369fe45d76d91844da56c2228961efd5

SHA512
74a11e9eea04c2c93e76ff8856df84cb8717ba07385aa1dc08bf8cab154997a2ce558e22dadaaffb85f3f97091705d5be1fbed2dd07004097151e71a0ff6930b

Download Submit
C:\Windows\System\eNiTadX.exe

Filesize
2.3MB

MD5
cd869858216d0d52d5f4815b34ebe156

SHA1
5921c6aba045a5431960450a3b9b065552bb4a19

SHA256
a94ba42774e42b609c94db7cc45ef35470ba5126f3a56f7b96a2bf6547ff466b

SHA512
351638a225445bd23da3acaf74ff4ea442472974b1a18b51ec5610514dd6bd474ee2005f0abf946b553056e827da3dd26e895e73975b1bae09ecb9bd4b6513a7

Download Submit
C:\Windows\System\fQPsurI.exe

Filesize
2.3MB

MD5
ffe79cda3261ee38348d5a0a85b14c17

SHA1
d0257e8e1c142bd9dd0a498a18dff94b9144ef51

SHA256
3624040d306262d6faf0334bf0d186bb49f9a4e46f92ba32ebaadcd35dae5dd2

SHA512
186c7a5bffea2d78f2d89477c7816cc81e7c0bbe42bb75b6cb15c8475f77909d91c08e91bf30bf52f25afc83cd6d46b26870083877b3af7d5ee14f9f19b0a7e5

Download Submit
C:\Windows\System\gZLCsfe.exe

Filesize
2.3MB

MD5
8310645de1ea37e19877b84423083b64

SHA1
8a6e8106c8dc3e8f1c546827247bd868435543ad

SHA256
c7eaf24bbca77033a004995ca9b46cec7f3d907fc7013915ea72124f4a6de216

SHA512
c6c8b93bec0bfc5518a5ecf03e940f05e6cab060f6d56860e5ff4cd63839d6850ea5180d1f38709ab8f98581f3ff7b4a030607de2dcbc1c3ce756240f7d17c68

Download Submit
C:\Windows\System\hVZCHwW.exe

Filesize
2.3MB

MD5
9dfe0cb8a5c453af967261c1a12360e0

SHA1
a5377f37a2a1882cbbca9766dd9e2db5eabfcbf7

SHA256
adc3d0e1f371488a6359a2606b1cc193cb0c27991195f4369c10db30bd0f3610

SHA512
4365f4629ae48aa01adab4473faf479fb1be1e360fbc3d480a825aaabb038b9f87318b984980db40837984a93e6a3c995d935d11cd6e9ff9bbd17605dcbdd34b

Download Submit
C:\Windows\System\lpiwzUd.exe

Filesize
2.3MB

MD5
e5a05ba44a2c38c0102421c849b83691

SHA1
55a0c087d2ab81f3e622511d3faebb14cd0d61ab

SHA256
d0ca6db34060e11655e3353f92aca07e996b343ad3a963b56ae14fd7a5edfd82

SHA512
6bc73ca8173b265bb71f74b7f068dc6f0df0d47e04de7f9b4de6c015e02c1b504f5badcc2885a66f5af1e32452de475ea1d4f66e313c3b1cefd5d42ee24d19b2

Download Submit
C:\Windows\System\nFOoozq.exe

Filesize
2.3MB

MD5
4aeddaf3246b74d2e80d5f676ceb7b48

SHA1
c35510fb5fabf90fd2882e2fdc8039587f248116

SHA256
bffa3e8b120e2b09c649458917b88a36c3f094e138ee592e0411facfc0cfbe7c

SHA512
ba6b10e1d66a34a2277f5d92e7b8dd8b9f2a1cec73bc66320bb4bb24c2ba90cb1d8af3047b16551a542953008503169464bf3927b186647fa2549a3b458f1863

Download Submit
C:\Windows\System\nLTkHMc.exe

Filesize
18B

MD5
0f74d26e324b3e4ca82621930feb3f71

SHA1
51c6fa90586c9009cc733bd2843df60120221d7c

SHA256
fd7091421895dbcf3ff7ed5b13b38b3963999338b6384ef6aea7e3d35f76533b

SHA512
4138922aed63819f2a910844c95c594cb337f1a54724135c8e61e94f0fb0e215db86c537da9be91f8c7625d109830aca6217c6d58a22b0f4be237d3c65bc9b67

Download Submit
C:\Windows\System\nhVRedA.exe

Filesize
2.3MB

MD5
c7b4d8ecb51d5789bf506b4ad4d4e45b

SHA1
925d6337e421b39a32b483683d597c7f0f415f42

SHA256
9faeb837475671a456a218966935fcf5b2e7245a82304e7d11a8eadcca6c208f

SHA512
dc63050ee560acdaa5b4095fecd97197756fd549db5ea0d1fa1413406ad7e07dc6b690ee439c66f93527b5ea99c4755d78389616f87e7c673a5509fb0384cc4e

Download Submit
C:\Windows\System\sIjsHJN.exe

Filesize
2.3MB

MD5
6e000399178df5956e1371ad105432c0

SHA1
fc55c43be066d2f94f618f2264f875c4d653a592

SHA256
aec5b6c7c21a5067c1196d27bc018eb49dc34a0a6627e9dfb7f51d1d71df49ed

SHA512
6a7e5a133023b7602400a499cdcb217568b3df5929c6d446f27ee01dde37258733a63eff1bbd9f4994c7217fb9290e5baf341686edf23ba62b2ca1a70564e493

Download Submit
C:\Windows\System\siAYaop.exe

Filesize
2.3MB

MD5
282bebf0f3930658c7922be4347bd699

SHA1
e08db5c269c5275aa481a022295b658f75a129e7

SHA256
105a0c361e7c25bd9afc72288fbe8e407ebcf38a7edab03b4f2f88b2471b2af4

SHA512
1dd26593b1a8559798b32eac0d022b5e8e20047ee2bdb8f0255b68c49567013925df888390aa41d21d6067ee09bd812e1d298fc94e7fe047e3b1d4f6f5510d82

Download Submit
C:\Windows\System\tPIcMyD.exe

Filesize
2.3MB

MD5
4e279c7206af7f9d41687066a0d0150d

SHA1
012b945819588693d9890da0a96489778f793a81

SHA256
2b83ed078bbd111be3902a02b924bd8fe727625a20424963e4f52001d7795c4c

SHA512
259bd0ac177233eecaa4d1ad7a645685439d9169085b8a2a3bd11c67b5597f0b609cdf9eea076fee3550d9dd0fd6ecdeae23f5397275c87f2cdff5dd0b7ce388

Download Submit
C:\Windows\System\tjJTusB.exe

Filesize
2.3MB

MD5
54b24736bc0da6a1eb68072eb8434c1b

SHA1
56a201e1887aaef782de3c497d1d3ebc62436675

SHA256
6ce39125cc83faeb523fd596e07676c1b7f0e7218a3002606703126d1a1f65a7

SHA512
43f3a7c32eca4728e331e8f559d05286224a3c7d4c2aacdebbf8192e7db1a7a868d7c4a8930a55cea40b4f447ad5111dcd2dc79a3db9ea80f03683c973106ba0

Download Submit
C:\Windows\System\vXXeRuK.exe

Filesize
2.3MB

MD5
459d2cfdc94b0e7fbe53727e2ffa2787

SHA1
ec125349e673c477be5da813c72f894260eb73a3

SHA256
5ac995885840d313fa605f7a5c7a8fd7dee82b25366fac349b30455adc065250

SHA512
cafc4e2e480631f7336c62b20a01cf9c1e000754a08fe93686b8b0392f321d7b786816790fbbd30fa1c659069540c21dd3f89c53ff1ff68200af59a2a1f15673

Download Submit
C:\Windows\System\vhoGBdV.exe

Filesize
2.3MB

MD5
b5ea597126f477638dd894ce0122181e

SHA1
1e5da24d265923fe23b3fd214aa1b397e966027e

SHA256
15f3c7b226d9ba60437fd9d41d758b00416792a4c87121ae1a1002647a9a8300

SHA512
83e887bdbcf51b73b0aef790d1cca0f73ab213801943ca66d944c7b6b05eaae3ffc1e2538c7d3b717044939582e2fc8e61545653d578a724e2b4985433743575

Download Submit
C:\Windows\System\xPSiVme.exe

Filesize
2.3MB

MD5
3c24c583789a1477f98ae146942ada33

SHA1
21ecad3d9fc3188a2c74a7e3a4890cf5ecb756f8

SHA256
27668bdfc825488a80f864ff697da654e4d25315aa0624f2975ff62370021cec

SHA512
c073c9237aba753503b485bfc0a453941dbd9475e23d05d1c2a6f32c864a6fabcc326fe181d2739fe32d26dbdf665077e70772b9a930a6c9d597a4b1f44b8a46

Download Submit
C:\Windows\System\xrpctDv.exe

Filesize
2.3MB

MD5
17c3bb1cdee2a17d55eafe9bb492f2ac

SHA1
ccdea1caec4f78646d982b3772e19872171a61dd

SHA256
6528455e60e1fcdb51a49846b54ab371488bf88e28c96b9bbd2b974012a046f6

SHA512
115a9ea30a31664d052ef040aa6d12fe5dad9542488da937b32d2d8b04e0e2aa2523ddb37ea7dd9f0d61004381815a2fbe7a90a129a873617241c30ba766fae7

Download Submit
C:\Windows\System\zAehWWF.exe

Filesize
2.3MB

MD5
7f95c72dc587cf8aa842701a7eb0d221

SHA1
863920cd1bef49e7d44d98e8f28fc188d17abb98

SHA256
27221c693fefdd27247c984771515d6d4b2c5e4098e475e2848b8545889de4c9

SHA512
5afdbc70854f139d2f440637ad9375c403a156e17986ca361096281f5bd51b797050514f617f659875fb2fb68a06876b50b6a29aeac232ff37ed69daf7c0ceee

Download Submit
memory/408-287-0x00007FF7383F0000-0x00007FF7387E2000-memory.dmp

Filesize
3.9MB

Download
memory/408-4456-0x00007FF7383F0000-0x00007FF7387E2000-memory.dmp

Filesize
3.9MB

Download
memory/828-4480-0x00007FF7ABFF0000-0x00007FF7AC3E2000-memory.dmp

Filesize
3.9MB

Download
memory/828-319-0x00007FF7ABFF0000-0x00007FF7AC3E2000-memory.dmp

Filesize
3.9MB

Download
memory/964-343-0x00007FF73C170000-0x00007FF73C562000-memory.dmp

Filesize
3.9MB

Download
memory/964-4438-0x00007FF73C170000-0x00007FF73C562000-memory.dmp

Filesize
3.9MB

Download
memory/1184-188-0x00007FF6201E0000-0x00007FF6205D2000-memory.dmp

Filesize
3.9MB

Download
memory/1236-4522-0x00007FF617C80000-0x00007FF618072000-memory.dmp

Filesize
3.9MB

Download
memory/1236-366-0x00007FF617C80000-0x00007FF618072000-memory.dmp

Filesize
3.9MB

Download
memory/1336-226-0x00007FF662600000-0x00007FF6629F2000-memory.dmp

Filesize
3.9MB

Download
memory/1336-4507-0x00007FF662600000-0x00007FF6629F2000-memory.dmp

Filesize
3.9MB

Download
memory/1924-142-0x00007FF712EC0000-0x00007FF7132B2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-279-0x00007FF6B0520000-0x00007FF6B0912000-memory.dmp

Filesize
3.9MB

Download
memory/2064-4443-0x00007FF6B0520000-0x00007FF6B0912000-memory.dmp

Filesize
3.9MB

Download
memory/2140-372-0x00007FF768640000-0x00007FF768A32000-memory.dmp

Filesize
3.9MB

Download
memory/2488-4431-0x00007FF6DEE10000-0x00007FF6DF202000-memory.dmp

Filesize
3.9MB

Download
memory/2488-265-0x00007FF6DEE10000-0x00007FF6DF202000-memory.dmp

Filesize
3.9MB

Download
memory/2572-19-0x00007FF7CBC30000-0x00007FF7CC022000-memory.dmp

Filesize
3.9MB

Download
memory/3180-113-0x00007FF677590000-0x00007FF677982000-memory.dmp

Filesize
3.9MB

Download
memory/3180-4393-0x00007FF677590000-0x00007FF677982000-memory.dmp

Filesize
3.9MB

Download
memory/3316-4510-0x00007FF638D80000-0x00007FF639172000-memory.dmp

Filesize
3.9MB

Download
memory/3316-329-0x00007FF638D80000-0x00007FF639172000-memory.dmp

Filesize
3.9MB

Download
memory/3584-204-0x00007FF6ECB50000-0x00007FF6ECF42000-memory.dmp

Filesize
3.9MB

Download
memory/3776-396-0x00007FF746F10000-0x00007FF747302000-memory.dmp

Filesize
3.9MB

Download
memory/3776-4575-0x00007FF746F10000-0x00007FF747302000-memory.dmp

Filesize
3.9MB

Download
memory/4028-4526-0x00007FF61FD20000-0x00007FF620112000-memory.dmp

Filesize
3.9MB

Download
memory/4028-380-0x00007FF61FD20000-0x00007FF620112000-memory.dmp

Filesize
3.9MB

Download
memory/4296-332-0x00007FF7E3970000-0x00007FF7E3D62000-memory.dmp

Filesize
3.9MB

Download
memory/4420-0-0x00007FF71A1A0000-0x00007FF71A592000-memory.dmp

Filesize
3.9MB

Download
memory/4420-1-0x000001EEC9B60000-0x000001EEC9B70000-memory.dmp

Filesize
64KB

Download
memory/4512-111-0x0000022344CB0000-0x0000022344CC0000-memory.dmp

Filesize
64KB

Download
memory/4512-276-0x0000022344C00000-0x0000022344C22000-memory.dmp

Filesize
136KB

Download
memory/4512-78-0x00007FFE63300000-0x00007FFE63DC1000-memory.dmp

Filesize
10.8MB

Download
memory/4592-392-0x00007FF601DF0000-0x00007FF6021E2000-memory.dmp

Filesize
3.9MB

Download
memory/4592-4516-0x00007FF601DF0000-0x00007FF6021E2000-memory.dmp

Filesize
3.9MB

Download
memory/4792-322-0x00007FF62C710000-0x00007FF62CB02000-memory.dmp

Filesize
3.9MB

Download
memory/4792-4478-0x00007FF62C710000-0x00007FF62CB02000-memory.dmp

Filesize
3.9MB

Download
memory/5060-205-0x00007FF74D590000-0x00007FF74D982000-memory.dmp

Filesize
3.9MB

Download
memory/5100-4400-0x00007FF6EB1C0000-0x00007FF6EB5B2000-memory.dmp

Filesize
3.9MB

Download
memory/5100-395-0x00007FF6EB1C0000-0x00007FF6EB5B2000-memory.dmp

Filesize
3.9MB

Download