xmrig | 7e7505e180b234d7a466c564d6afaf609a237173bf90a2d745cc6dd00153c794

Analysis

max time kernel
62s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 03:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
Size

1.9MB
MD5

08e9e6027acf20cbc830e6e2208d7375
SHA1

54a0680641abfa78358aeaca6a494d871f3cb7c3
SHA256

7e7505e180b234d7a466c564d6afaf609a237173bf90a2d745cc6dd00153c794
SHA512

d43ca8ad75854b2cf9cdc3bd3f1aa62f06d6af4547b30b48e80fca60f00b37e54d9299da41be221f483a29ef14c2578a8ef01cad5e8bd3894db4eaebdc20ab60
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1V:NABc

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/680-19-0x00007FF67CE50000-0x00007FF67D242000-memory.dmp	xmrig
behavioral2/memory/3112-93-0x00007FF7420A0000-0x00007FF742492000-memory.dmp	xmrig
behavioral2/memory/3132-105-0x00007FF6128B0000-0x00007FF612CA2000-memory.dmp	xmrig
behavioral2/memory/4284-108-0x00007FF7E01D0000-0x00007FF7E05C2000-memory.dmp	xmrig
behavioral2/memory/3460-110-0x00007FF6CFDF0000-0x00007FF6D01E2000-memory.dmp	xmrig
behavioral2/memory/1784-109-0x00007FF784520000-0x00007FF784912000-memory.dmp	xmrig
behavioral2/memory/5084-107-0x00007FF6B72D0000-0x00007FF6B76C2000-memory.dmp	xmrig
behavioral2/memory/3580-106-0x00007FF63C160000-0x00007FF63C552000-memory.dmp	xmrig
behavioral2/memory/1652-103-0x00007FF6F14D0000-0x00007FF6F18C2000-memory.dmp	xmrig
behavioral2/memory/4252-88-0x00007FF6AB840000-0x00007FF6ABC32000-memory.dmp	xmrig
behavioral2/memory/1256-82-0x00007FF6B82F0000-0x00007FF6B86E2000-memory.dmp	xmrig
behavioral2/memory/892-74-0x00007FF7A26A0000-0x00007FF7A2A92000-memory.dmp	xmrig
behavioral2/memory/2940-72-0x00007FF63B820000-0x00007FF63BC12000-memory.dmp	xmrig
behavioral2/memory/1116-66-0x00007FF759D10000-0x00007FF75A102000-memory.dmp	xmrig
behavioral2/memory/924-173-0x00007FF6CCA30000-0x00007FF6CCE22000-memory.dmp	xmrig
behavioral2/memory/4868-168-0x00007FF6450D0000-0x00007FF6454C2000-memory.dmp	xmrig
behavioral2/memory/2376-148-0x00007FF6B44F0000-0x00007FF6B48E2000-memory.dmp	xmrig
behavioral2/memory/1408-137-0x00007FF6867E0000-0x00007FF686BD2000-memory.dmp	xmrig
behavioral2/memory/1640-138-0x00007FF7C3520000-0x00007FF7C3912000-memory.dmp	xmrig
behavioral2/memory/3580-2086-0x00007FF63C160000-0x00007FF63C552000-memory.dmp	xmrig
behavioral2/memory/3112-2123-0x00007FF7420A0000-0x00007FF742492000-memory.dmp	xmrig
behavioral2/memory/892-2087-0x00007FF7A26A0000-0x00007FF7A2A92000-memory.dmp	xmrig
behavioral2/memory/1652-2118-0x00007FF6F14D0000-0x00007FF6F18C2000-memory.dmp	xmrig
behavioral2/memory/4252-2122-0x00007FF6AB840000-0x00007FF6ABC32000-memory.dmp	xmrig
behavioral2/memory/1116-2119-0x00007FF759D10000-0x00007FF75A102000-memory.dmp	xmrig
behavioral2/memory/1256-2111-0x00007FF6B82F0000-0x00007FF6B86E2000-memory.dmp	xmrig
behavioral2/memory/2940-2106-0x00007FF63B820000-0x00007FF63BC12000-memory.dmp	xmrig
behavioral2/memory/4868-2011-0x00007FF6450D0000-0x00007FF6454C2000-memory.dmp	xmrig
behavioral2/memory/4284-2191-0x00007FF7E01D0000-0x00007FF7E05C2000-memory.dmp	xmrig
behavioral2/memory/5084-2142-0x00007FF6B72D0000-0x00007FF6B76C2000-memory.dmp	xmrig
behavioral2/memory/1784-2178-0x00007FF784520000-0x00007FF784912000-memory.dmp	xmrig
behavioral2/memory/3460-2175-0x00007FF6CFDF0000-0x00007FF6D01E2000-memory.dmp	xmrig
behavioral2/memory/1080-2278-0x00007FF79A930000-0x00007FF79AD22000-memory.dmp	xmrig
behavioral2/memory/380-2280-0x00007FF6B47F0000-0x00007FF6B4BE2000-memory.dmp	xmrig
behavioral2/memory/924-2451-0x00007FF6CCA30000-0x00007FF6CCE22000-memory.dmp	xmrig
behavioral2/memory/1408-2450-0x00007FF6867E0000-0x00007FF686BD2000-memory.dmp	xmrig
behavioral2/memory/2376-2457-0x00007FF6B44F0000-0x00007FF6B48E2000-memory.dmp	xmrig
behavioral2/memory/4956-2460-0x00007FF629560000-0x00007FF629952000-memory.dmp	xmrig
behavioral2/memory/1640-2863-0x00007FF7C3520000-0x00007FF7C3912000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
8	1548	powershell.exe
12	1548	powershell.exe
25	1548	powershell.exe
26	1548	powershell.exe
27	1548	powershell.exe
30	1548	powershell.exe
32	1548	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4868	FlDPaYB.exe
680	QDFBPCR.exe
3132	uUcNyHP.exe
1116	SvRdnIl.exe
3580	Vuiuwdo.exe
2940	nMZohdr.exe
892	XSyCbeK.exe
1256	rAWezyC.exe
4252	WdgvLvD.exe
3112	vvQnjNv.exe
5084	KoshfKq.exe
1652	uICJxCJ.exe
4284	AvSOoIr.exe
1784	zmbgsVO.exe
3460	XIbqeqk.exe
380	xXfcphO.exe
1080	BUjJYGh.exe
4956	hAKmedJ.exe
1408	QwEwrfV.exe
924	YJMrtvP.exe
2376	hOMKYHx.exe
3484	ZsHtQpf.exe
5000	CfZAnDn.exe
3488	NLmRfbM.exe
208	iukQalC.exe
2316	ewFSiLD.exe
1524	KOFYKeh.exe
1684	ujTfsvU.exe
5096	qkiBroa.exe
1384	mUrquJh.exe
1708	qVrlbdU.exe
3496	posvott.exe
1288	OUgVzCU.exe
2120	wzyiCLA.exe
4540	fOjgXuv.exe
4016	seKuDwj.exe
2764	LDvzmzl.exe
2020	bvwkEvJ.exe
3140	AwCirEm.exe
4564	OHPynDQ.exe
232	KadqGwO.exe
4464	eqCzeIM.exe
2620	aylCMow.exe
2976	LOVDAuu.exe
3300	bUeiQWR.exe
3232	RwpLJHh.exe
1964	cmIAtEG.exe
2432	IDATCOP.exe
1556	HpSCpMm.exe
1444	ShvCYEj.exe
4172	CwjXkJj.exe
2172	THHUCUs.exe
1188	KskDUdu.exe
2500	OFTtvrY.exe
4056	wensrkO.exe
1772	oqGEyzr.exe
2772	RVJWgjb.exe
2004	jAQpPVb.exe
1428	UhQNlTq.exe
2536	WkKsOpW.exe
1812	apcHfdX.exe
4356	VrfqPOf.exe
560	TZnmuEM.exe
4068	DivHMzW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1640-0-0x00007FF7C3520000-0x00007FF7C3912000-memory.dmp	upx
behavioral2/files/0x000800000002325a-5.dat	upx
behavioral2/memory/4868-8-0x00007FF6450D0000-0x00007FF6454C2000-memory.dmp	upx
behavioral2/files/0x000800000002325d-12.dat	upx
behavioral2/files/0x0008000000023260-16.dat	upx
behavioral2/memory/680-19-0x00007FF67CE50000-0x00007FF67D242000-memory.dmp	upx
behavioral2/files/0x0008000000023262-20.dat	upx
behavioral2/files/0x0007000000023263-26.dat	upx
behavioral2/files/0x0007000000023264-34.dat	upx
behavioral2/files/0x0007000000023266-38.dat	upx
behavioral2/files/0x0007000000023265-39.dat	upx
behavioral2/files/0x000800000002325e-69.dat	upx
behavioral2/memory/3112-93-0x00007FF7420A0000-0x00007FF742492000-memory.dmp	upx
behavioral2/files/0x0008000000023267-100.dat	upx
behavioral2/memory/3132-105-0x00007FF6128B0000-0x00007FF612CA2000-memory.dmp	upx
behavioral2/memory/4284-108-0x00007FF7E01D0000-0x00007FF7E05C2000-memory.dmp	upx
behavioral2/memory/380-111-0x00007FF6B47F0000-0x00007FF6B4BE2000-memory.dmp	upx
behavioral2/files/0x000700000002326d-113.dat	upx
behavioral2/files/0x000700000002326e-115.dat	upx
behavioral2/memory/1080-112-0x00007FF79A930000-0x00007FF79AD22000-memory.dmp	upx
behavioral2/memory/3460-110-0x00007FF6CFDF0000-0x00007FF6D01E2000-memory.dmp	upx
behavioral2/memory/1784-109-0x00007FF784520000-0x00007FF784912000-memory.dmp	upx
behavioral2/memory/5084-107-0x00007FF6B72D0000-0x00007FF6B76C2000-memory.dmp	upx
behavioral2/memory/3580-106-0x00007FF63C160000-0x00007FF63C552000-memory.dmp	upx
behavioral2/memory/1652-103-0x00007FF6F14D0000-0x00007FF6F18C2000-memory.dmp	upx
behavioral2/files/0x000700000002326c-96.dat	upx
behavioral2/files/0x0008000000023268-92.dat	upx
behavioral2/memory/4252-88-0x00007FF6AB840000-0x00007FF6ABC32000-memory.dmp	upx
behavioral2/memory/1256-82-0x00007FF6B82F0000-0x00007FF6B86E2000-memory.dmp	upx
behavioral2/files/0x0007000000023269-83.dat	upx
behavioral2/memory/892-74-0x00007FF7A26A0000-0x00007FF7A2A92000-memory.dmp	upx
behavioral2/memory/2940-72-0x00007FF63B820000-0x00007FF63BC12000-memory.dmp	upx
behavioral2/files/0x000700000002326b-76.dat	upx
behavioral2/files/0x000700000002326a-75.dat	upx
behavioral2/memory/1116-66-0x00007FF759D10000-0x00007FF75A102000-memory.dmp	upx
behavioral2/files/0x000700000002326f-120.dat	upx
behavioral2/memory/4956-121-0x00007FF629560000-0x00007FF629952000-memory.dmp	upx
behavioral2/files/0x0007000000023270-127.dat	upx
behavioral2/files/0x0007000000023272-132.dat	upx
behavioral2/files/0x0007000000023274-142.dat	upx
behavioral2/files/0x0007000000023273-141.dat	upx
behavioral2/files/0x0007000000023275-147.dat	upx
behavioral2/files/0x0007000000023277-158.dat	upx
behavioral2/files/0x0007000000023278-164.dat	upx
behavioral2/files/0x0007000000023279-170.dat	upx
behavioral2/files/0x000700000002327a-179.dat	upx
behavioral2/memory/924-173-0x00007FF6CCA30000-0x00007FF6CCE22000-memory.dmp	upx
behavioral2/memory/4868-168-0x00007FF6450D0000-0x00007FF6454C2000-memory.dmp	upx
behavioral2/files/0x0007000000023276-161.dat	upx
behavioral2/memory/2376-148-0x00007FF6B44F0000-0x00007FF6B48E2000-memory.dmp	upx
behavioral2/memory/1408-137-0x00007FF6867E0000-0x00007FF686BD2000-memory.dmp	upx
behavioral2/memory/1640-138-0x00007FF7C3520000-0x00007FF7C3912000-memory.dmp	upx
behavioral2/files/0x000700000002327b-184.dat	upx
behavioral2/files/0x000700000002327c-187.dat	upx
behavioral2/files/0x000700000002327d-193.dat	upx
behavioral2/files/0x000700000002327e-197.dat	upx
behavioral2/files/0x000700000002327f-200.dat	upx
behavioral2/memory/3580-2086-0x00007FF63C160000-0x00007FF63C552000-memory.dmp	upx
behavioral2/memory/3112-2123-0x00007FF7420A0000-0x00007FF742492000-memory.dmp	upx
behavioral2/memory/892-2087-0x00007FF7A26A0000-0x00007FF7A2A92000-memory.dmp	upx
behavioral2/memory/1652-2118-0x00007FF6F14D0000-0x00007FF6F18C2000-memory.dmp	upx
behavioral2/memory/4252-2122-0x00007FF6AB840000-0x00007FF6ABC32000-memory.dmp	upx
behavioral2/memory/1116-2119-0x00007FF759D10000-0x00007FF75A102000-memory.dmp	upx
behavioral2/memory/1256-2111-0x00007FF6B82F0000-0x00007FF6B86E2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KPmEnIB.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\YucxJAG.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\vMGxPqK.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\DLlRgSO.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\jRSJmrh.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\UaPLQAx.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\pttLQtJ.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\uuHBSdM.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\GIFGElH.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\UqOWDrE.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\oNDYYpm.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\FwoXFpN.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\oQpFhsR.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\KCwuXoV.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\IKadyBU.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\LdJHOmb.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\btBTmHU.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\tuZYgnt.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\hAKmedJ.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\XjsqDJg.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\FfynjfK.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\lPFpVHF.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\FpWJTwO.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\mUrquJh.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\DgEQaQe.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\zGuRmtY.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\IyWOeUz.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\XbtTkbc.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\dOBSAow.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\OHPynDQ.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\ZRhIvnr.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\PsvPNMJ.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\SkXlenW.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\KOFYKeh.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\DkXIIVM.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\mxBjKzt.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\iRKYqiJ.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\OULZeaw.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\LDvzmzl.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\lXcKegI.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\hKboEba.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\tcqiYnl.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\ZDFeKFF.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\LGkBTSY.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\VolbbgW.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\AWUgAjA.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\vatvVDH.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\sFnVTou.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\TaUZUQy.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\mHhCmNG.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\hzpszIR.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\zqjDqnJ.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\yPWNBSP.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\tGinoSg.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\eHzwJwE.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\ehGfMsb.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\INrJYtm.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\faiBTLw.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\zLRapOq.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\NrzXIJj.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\kwBIIrO.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\PrUSTPf.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\aCpURVZ.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
File created	C:\Windows\System\QwEwrfV.exe	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1548	powershell.exe
1548	powershell.exe
1548	powershell.exe
1548	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
Token: SeDebugPrivilege	1548	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1548	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	93
PID 1640 wrote to memory of 1548	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	93
PID 1640 wrote to memory of 4868	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	94
PID 1640 wrote to memory of 4868	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	94
PID 1640 wrote to memory of 680	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	95
PID 1640 wrote to memory of 680	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	95
PID 1640 wrote to memory of 3132	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	96
PID 1640 wrote to memory of 3132	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	96
PID 1640 wrote to memory of 1116	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	97
PID 1640 wrote to memory of 1116	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	97
PID 1640 wrote to memory of 3580	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	98
PID 1640 wrote to memory of 3580	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	98
PID 1640 wrote to memory of 2940	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	99
PID 1640 wrote to memory of 2940	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	99
PID 1640 wrote to memory of 892	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	100
PID 1640 wrote to memory of 892	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	100
PID 1640 wrote to memory of 1256	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	101
PID 1640 wrote to memory of 1256	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	101
PID 1640 wrote to memory of 4252	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	102
PID 1640 wrote to memory of 4252	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	102
PID 1640 wrote to memory of 3112	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	103
PID 1640 wrote to memory of 3112	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	103
PID 1640 wrote to memory of 5084	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	104
PID 1640 wrote to memory of 5084	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	104
PID 1640 wrote to memory of 1652	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	105
PID 1640 wrote to memory of 1652	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	105
PID 1640 wrote to memory of 4284	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	106
PID 1640 wrote to memory of 4284	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	106
PID 1640 wrote to memory of 1784	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	107
PID 1640 wrote to memory of 1784	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	107
PID 1640 wrote to memory of 3460	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	108
PID 1640 wrote to memory of 3460	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	108
PID 1640 wrote to memory of 380	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	109
PID 1640 wrote to memory of 380	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	109
PID 1640 wrote to memory of 1080	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	110
PID 1640 wrote to memory of 1080	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	110
PID 1640 wrote to memory of 4956	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	111
PID 1640 wrote to memory of 4956	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	111
PID 1640 wrote to memory of 1408	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	112
PID 1640 wrote to memory of 1408	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	112
PID 1640 wrote to memory of 924	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	113
PID 1640 wrote to memory of 924	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	113
PID 1640 wrote to memory of 2376	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	114
PID 1640 wrote to memory of 2376	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	114
PID 1640 wrote to memory of 3484	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	115
PID 1640 wrote to memory of 3484	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	115
PID 1640 wrote to memory of 5000	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	116
PID 1640 wrote to memory of 5000	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	116
PID 1640 wrote to memory of 3488	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	117
PID 1640 wrote to memory of 3488	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	117
PID 1640 wrote to memory of 208	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	118
PID 1640 wrote to memory of 208	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	118
PID 1640 wrote to memory of 2316	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	119
PID 1640 wrote to memory of 2316	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	119
PID 1640 wrote to memory of 1524	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	120
PID 1640 wrote to memory of 1524	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	120
PID 1640 wrote to memory of 1684	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	121
PID 1640 wrote to memory of 1684	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	121
PID 1640 wrote to memory of 5096	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	122
PID 1640 wrote to memory of 5096	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	122
PID 1640 wrote to memory of 1384	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	123
PID 1640 wrote to memory of 1384	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	123
PID 1640 wrote to memory of 1708	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	124
PID 1640 wrote to memory of 1708	1640	08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe	124

C:\Users\Admin\AppData\Local\Temp\08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08e9e6027acf20cbc830e6e2208d7375_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1548
- C:\Windows\System\FlDPaYB.exe
  C:\Windows\System\FlDPaYB.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\QDFBPCR.exe
  C:\Windows\System\QDFBPCR.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\uUcNyHP.exe
  C:\Windows\System\uUcNyHP.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\SvRdnIl.exe
  C:\Windows\System\SvRdnIl.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\Vuiuwdo.exe
  C:\Windows\System\Vuiuwdo.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\nMZohdr.exe
  C:\Windows\System\nMZohdr.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\XSyCbeK.exe
  C:\Windows\System\XSyCbeK.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\rAWezyC.exe
  C:\Windows\System\rAWezyC.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\WdgvLvD.exe
  C:\Windows\System\WdgvLvD.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\vvQnjNv.exe
  C:\Windows\System\vvQnjNv.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\KoshfKq.exe
  C:\Windows\System\KoshfKq.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\uICJxCJ.exe
  C:\Windows\System\uICJxCJ.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\AvSOoIr.exe
  C:\Windows\System\AvSOoIr.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\zmbgsVO.exe
  C:\Windows\System\zmbgsVO.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\XIbqeqk.exe
  C:\Windows\System\XIbqeqk.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\xXfcphO.exe
  C:\Windows\System\xXfcphO.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\BUjJYGh.exe
  C:\Windows\System\BUjJYGh.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\hAKmedJ.exe
  C:\Windows\System\hAKmedJ.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\QwEwrfV.exe
  C:\Windows\System\QwEwrfV.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\YJMrtvP.exe
  C:\Windows\System\YJMrtvP.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\hOMKYHx.exe
  C:\Windows\System\hOMKYHx.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\ZsHtQpf.exe
  C:\Windows\System\ZsHtQpf.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\CfZAnDn.exe
  C:\Windows\System\CfZAnDn.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\NLmRfbM.exe
  C:\Windows\System\NLmRfbM.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\iukQalC.exe
  C:\Windows\System\iukQalC.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\ewFSiLD.exe
  C:\Windows\System\ewFSiLD.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\KOFYKeh.exe
  C:\Windows\System\KOFYKeh.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\ujTfsvU.exe
  C:\Windows\System\ujTfsvU.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\qkiBroa.exe
  C:\Windows\System\qkiBroa.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\mUrquJh.exe
  C:\Windows\System\mUrquJh.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\qVrlbdU.exe
  C:\Windows\System\qVrlbdU.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\posvott.exe
  C:\Windows\System\posvott.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\OUgVzCU.exe
  C:\Windows\System\OUgVzCU.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\wzyiCLA.exe
  C:\Windows\System\wzyiCLA.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\fOjgXuv.exe
  C:\Windows\System\fOjgXuv.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\seKuDwj.exe
  C:\Windows\System\seKuDwj.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\LDvzmzl.exe
  C:\Windows\System\LDvzmzl.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\bvwkEvJ.exe
  C:\Windows\System\bvwkEvJ.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\AwCirEm.exe
  C:\Windows\System\AwCirEm.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\OHPynDQ.exe
  C:\Windows\System\OHPynDQ.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\KadqGwO.exe
  C:\Windows\System\KadqGwO.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\eqCzeIM.exe
  C:\Windows\System\eqCzeIM.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\aylCMow.exe
  C:\Windows\System\aylCMow.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\LOVDAuu.exe
  C:\Windows\System\LOVDAuu.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\bUeiQWR.exe
  C:\Windows\System\bUeiQWR.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\RwpLJHh.exe
  C:\Windows\System\RwpLJHh.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\cmIAtEG.exe
  C:\Windows\System\cmIAtEG.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\IDATCOP.exe
  C:\Windows\System\IDATCOP.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\HpSCpMm.exe
  C:\Windows\System\HpSCpMm.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\ShvCYEj.exe
  C:\Windows\System\ShvCYEj.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\CwjXkJj.exe
  C:\Windows\System\CwjXkJj.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\THHUCUs.exe
  C:\Windows\System\THHUCUs.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\KskDUdu.exe
  C:\Windows\System\KskDUdu.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\OFTtvrY.exe
  C:\Windows\System\OFTtvrY.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\wensrkO.exe
  C:\Windows\System\wensrkO.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\oqGEyzr.exe
  C:\Windows\System\oqGEyzr.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\RVJWgjb.exe
  C:\Windows\System\RVJWgjb.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\jAQpPVb.exe
  C:\Windows\System\jAQpPVb.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\UhQNlTq.exe
  C:\Windows\System\UhQNlTq.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\WkKsOpW.exe
  C:\Windows\System\WkKsOpW.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\apcHfdX.exe
  C:\Windows\System\apcHfdX.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\VrfqPOf.exe
  C:\Windows\System\VrfqPOf.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\TZnmuEM.exe
  C:\Windows\System\TZnmuEM.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\DivHMzW.exe
  C:\Windows\System\DivHMzW.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\OEayyzR.exe
  C:\Windows\System\OEayyzR.exe
  2⤵
  PID:4220
- C:\Windows\System\GObdtOw.exe
  C:\Windows\System\GObdtOw.exe
  2⤵
  PID:5148
- C:\Windows\System\liAOLLZ.exe
  C:\Windows\System\liAOLLZ.exe
  2⤵
  PID:5168
- C:\Windows\System\RSfOYyf.exe
  C:\Windows\System\RSfOYyf.exe
  2⤵
  PID:5200
- C:\Windows\System\pnnKiuq.exe
  C:\Windows\System\pnnKiuq.exe
  2⤵
  PID:5224
- C:\Windows\System\dbDscDm.exe
  C:\Windows\System\dbDscDm.exe
  2⤵
  PID:5284
- C:\Windows\System\iDmbzub.exe
  C:\Windows\System\iDmbzub.exe
  2⤵
  PID:5300
- C:\Windows\System\QetvEZO.exe
  C:\Windows\System\QetvEZO.exe
  2⤵
  PID:5324
- C:\Windows\System\NonZAIp.exe
  C:\Windows\System\NonZAIp.exe
  2⤵
  PID:5352
- C:\Windows\System\ykAOFto.exe
  C:\Windows\System\ykAOFto.exe
  2⤵
  PID:5380
- C:\Windows\System\dhRebMC.exe
  C:\Windows\System\dhRebMC.exe
  2⤵
  PID:5412
- C:\Windows\System\NYbyOHM.exe
  C:\Windows\System\NYbyOHM.exe
  2⤵
  PID:5432
- C:\Windows\System\EjsBwik.exe
  C:\Windows\System\EjsBwik.exe
  2⤵
  PID:5448
- C:\Windows\System\qkUhzfj.exe
  C:\Windows\System\qkUhzfj.exe
  2⤵
  PID:5472
- C:\Windows\System\hoEHsGx.exe
  C:\Windows\System\hoEHsGx.exe
  2⤵
  PID:5504
- C:\Windows\System\wyhbTXP.exe
  C:\Windows\System\wyhbTXP.exe
  2⤵
  PID:5532
- C:\Windows\System\aabTlfh.exe
  C:\Windows\System\aabTlfh.exe
  2⤵
  PID:5556
- C:\Windows\System\BxEHkjZ.exe
  C:\Windows\System\BxEHkjZ.exe
  2⤵
  PID:5576
- C:\Windows\System\LKCnKQA.exe
  C:\Windows\System\LKCnKQA.exe
  2⤵
  PID:5604
- C:\Windows\System\PIJpilO.exe
  C:\Windows\System\PIJpilO.exe
  2⤵
  PID:5620
- C:\Windows\System\OlwcRyV.exe
  C:\Windows\System\OlwcRyV.exe
  2⤵
  PID:5640
- C:\Windows\System\HRWFlBW.exe
  C:\Windows\System\HRWFlBW.exe
  2⤵
  PID:5664
- C:\Windows\System\NMjwZHh.exe
  C:\Windows\System\NMjwZHh.exe
  2⤵
  PID:5708
- C:\Windows\System\onReFBr.exe
  C:\Windows\System\onReFBr.exe
  2⤵
  PID:5724
- C:\Windows\System\lBFFyli.exe
  C:\Windows\System\lBFFyli.exe
  2⤵
  PID:5752
- C:\Windows\System\ztZSWDH.exe
  C:\Windows\System\ztZSWDH.exe
  2⤵
  PID:5768
- C:\Windows\System\IXIiUoh.exe
  C:\Windows\System\IXIiUoh.exe
  2⤵
  PID:5788
- C:\Windows\System\ZvHAxIM.exe
  C:\Windows\System\ZvHAxIM.exe
  2⤵
  PID:5816
- C:\Windows\System\UWfjcJg.exe
  C:\Windows\System\UWfjcJg.exe
  2⤵
  PID:5840
- C:\Windows\System\RJnMbfj.exe
  C:\Windows\System\RJnMbfj.exe
  2⤵
  PID:5880
- C:\Windows\System\bKzVPUw.exe
  C:\Windows\System\bKzVPUw.exe
  2⤵
  PID:5896
- C:\Windows\System\lYpZmys.exe
  C:\Windows\System\lYpZmys.exe
  2⤵
  PID:5920
- C:\Windows\System\YFgZJEe.exe
  C:\Windows\System\YFgZJEe.exe
  2⤵
  PID:5944
- C:\Windows\System\cSGcHeF.exe
  C:\Windows\System\cSGcHeF.exe
  2⤵
  PID:6012
- C:\Windows\System\IvJvPSE.exe
  C:\Windows\System\IvJvPSE.exe
  2⤵
  PID:6088
- C:\Windows\System\fHUkqlO.exe
  C:\Windows\System\fHUkqlO.exe
  2⤵
  PID:6108
- C:\Windows\System\nBNKIaY.exe
  C:\Windows\System\nBNKIaY.exe
  2⤵
  PID:6124
- C:\Windows\System\ldHOYcX.exe
  C:\Windows\System\ldHOYcX.exe
  2⤵
  PID:5136
- C:\Windows\System\KiFhSly.exe
  C:\Windows\System\KiFhSly.exe
  2⤵
  PID:5160
- C:\Windows\System\BQcYOKY.exe
  C:\Windows\System\BQcYOKY.exe
  2⤵
  PID:5212
- C:\Windows\System\TNPuaCJ.exe
  C:\Windows\System\TNPuaCJ.exe
  2⤵
  PID:5272
- C:\Windows\System\cltaFZy.exe
  C:\Windows\System\cltaFZy.exe
  2⤵
  PID:2832
- C:\Windows\System\RNrUZIV.exe
  C:\Windows\System\RNrUZIV.exe
  2⤵
  PID:5344
- C:\Windows\System\NHlTgtp.exe
  C:\Windows\System\NHlTgtp.exe
  2⤵
  PID:3824
- C:\Windows\System\VzdbDIQ.exe
  C:\Windows\System\VzdbDIQ.exe
  2⤵
  PID:5496
- C:\Windows\System\iONzTWJ.exe
  C:\Windows\System\iONzTWJ.exe
  2⤵
  PID:5512
- C:\Windows\System\nUfqVow.exe
  C:\Windows\System\nUfqVow.exe
  2⤵
  PID:5600
- C:\Windows\System\bQiaFTF.exe
  C:\Windows\System\bQiaFTF.exe
  2⤵
  PID:5636
- C:\Windows\System\wpPxcBB.exe
  C:\Windows\System\wpPxcBB.exe
  2⤵
  PID:5720
- C:\Windows\System\bamkdKP.exe
  C:\Windows\System\bamkdKP.exe
  2⤵
  PID:5744
- C:\Windows\System\rJTENCw.exe
  C:\Windows\System\rJTENCw.exe
  2⤵
  PID:5780
- C:\Windows\System\vBZbgCi.exe
  C:\Windows\System\vBZbgCi.exe
  2⤵
  PID:5964
- C:\Windows\System\LQEZqmv.exe
  C:\Windows\System\LQEZqmv.exe
  2⤵
  PID:5916
- C:\Windows\System\QpUmFzq.exe
  C:\Windows\System\QpUmFzq.exe
  2⤵
  PID:5872
- C:\Windows\System\GLsghdc.exe
  C:\Windows\System\GLsghdc.exe
  2⤵
  PID:6096
- C:\Windows\System\MJDSWpJ.exe
  C:\Windows\System\MJDSWpJ.exe
  2⤵
  PID:6120
- C:\Windows\System\ygWqHFS.exe
  C:\Windows\System\ygWqHFS.exe
  2⤵
  PID:4772
- C:\Windows\System\wCVVPqJ.exe
  C:\Windows\System\wCVVPqJ.exe
  2⤵
  PID:5332
- C:\Windows\System\WfvPzjL.exe
  C:\Windows\System\WfvPzjL.exe
  2⤵
  PID:1156
- C:\Windows\System\QAFMVby.exe
  C:\Windows\System\QAFMVby.exe
  2⤵
  PID:5696
- C:\Windows\System\pXvYKad.exe
  C:\Windows\System\pXvYKad.exe
  2⤵
  PID:5980
- C:\Windows\System\GcSnHdl.exe
  C:\Windows\System\GcSnHdl.exe
  2⤵
  PID:6004
- C:\Windows\System\WdnbYir.exe
  C:\Windows\System\WdnbYir.exe
  2⤵
  PID:6052
- C:\Windows\System\TMpNWha.exe
  C:\Windows\System\TMpNWha.exe
  2⤵
  PID:404
- C:\Windows\System\EcuWxIK.exe
  C:\Windows\System\EcuWxIK.exe
  2⤵
  PID:2472
- C:\Windows\System\bQlWsxE.exe
  C:\Windows\System\bQlWsxE.exe
  2⤵
  PID:5764
- C:\Windows\System\TGtnVPx.exe
  C:\Windows\System\TGtnVPx.exe
  2⤵
  PID:6024
- C:\Windows\System\giqwxeB.exe
  C:\Windows\System\giqwxeB.exe
  2⤵
  PID:5940
- C:\Windows\System\VTkVJTL.exe
  C:\Windows\System\VTkVJTL.exe
  2⤵
  PID:5140
- C:\Windows\System\YrnuGaK.exe
  C:\Windows\System\YrnuGaK.exe
  2⤵
  PID:6164
- C:\Windows\System\uuHBSdM.exe
  C:\Windows\System\uuHBSdM.exe
  2⤵
  PID:6188
- C:\Windows\System\IOoHugh.exe
  C:\Windows\System\IOoHugh.exe
  2⤵
  PID:6208
- C:\Windows\System\EABkTvg.exe
  C:\Windows\System\EABkTvg.exe
  2⤵
  PID:6228
- C:\Windows\System\EAXpopL.exe
  C:\Windows\System\EAXpopL.exe
  2⤵
  PID:6252
- C:\Windows\System\wlzPtOx.exe
  C:\Windows\System\wlzPtOx.exe
  2⤵
  PID:6272
- C:\Windows\System\xinNHUP.exe
  C:\Windows\System\xinNHUP.exe
  2⤵
  PID:6296
- C:\Windows\System\WtNbCoO.exe
  C:\Windows\System\WtNbCoO.exe
  2⤵
  PID:6328
- C:\Windows\System\pDvpYUg.exe
  C:\Windows\System\pDvpYUg.exe
  2⤵
  PID:6380
- C:\Windows\System\VYJBdBZ.exe
  C:\Windows\System\VYJBdBZ.exe
  2⤵
  PID:6400
- C:\Windows\System\DUjenuG.exe
  C:\Windows\System\DUjenuG.exe
  2⤵
  PID:6440
- C:\Windows\System\TQSvWzS.exe
  C:\Windows\System\TQSvWzS.exe
  2⤵
  PID:6460
- C:\Windows\System\omWHUSs.exe
  C:\Windows\System\omWHUSs.exe
  2⤵
  PID:6476
- C:\Windows\System\ZDFeKFF.exe
  C:\Windows\System\ZDFeKFF.exe
  2⤵
  PID:6512
- C:\Windows\System\kEgNKfe.exe
  C:\Windows\System\kEgNKfe.exe
  2⤵
  PID:6532
- C:\Windows\System\OCkizxX.exe
  C:\Windows\System\OCkizxX.exe
  2⤵
  PID:6588
- C:\Windows\System\VTouoMj.exe
  C:\Windows\System\VTouoMj.exe
  2⤵
  PID:6624
- C:\Windows\System\ChXXqRP.exe
  C:\Windows\System\ChXXqRP.exe
  2⤵
  PID:6640
- C:\Windows\System\iuQGXPw.exe
  C:\Windows\System\iuQGXPw.exe
  2⤵
  PID:6720
- C:\Windows\System\djVZwwF.exe
  C:\Windows\System\djVZwwF.exe
  2⤵
  PID:6768
- C:\Windows\System\UEihCfG.exe
  C:\Windows\System\UEihCfG.exe
  2⤵
  PID:6784
- C:\Windows\System\xOjIKen.exe
  C:\Windows\System\xOjIKen.exe
  2⤵
  PID:6812
- C:\Windows\System\dsBDUsI.exe
  C:\Windows\System\dsBDUsI.exe
  2⤵
  PID:6828
- C:\Windows\System\EXlNdON.exe
  C:\Windows\System\EXlNdON.exe
  2⤵
  PID:6848
- C:\Windows\System\hzpszIR.exe
  C:\Windows\System\hzpszIR.exe
  2⤵
  PID:6868
- C:\Windows\System\ahgfSlx.exe
  C:\Windows\System\ahgfSlx.exe
  2⤵
  PID:6928
- C:\Windows\System\woGvgGU.exe
  C:\Windows\System\woGvgGU.exe
  2⤵
  PID:6944
- C:\Windows\System\WYCCVNd.exe
  C:\Windows\System\WYCCVNd.exe
  2⤵
  PID:6960
- C:\Windows\System\TrSuFGM.exe
  C:\Windows\System\TrSuFGM.exe
  2⤵
  PID:6980
- C:\Windows\System\bagazuf.exe
  C:\Windows\System\bagazuf.exe
  2⤵
  PID:7000
- C:\Windows\System\vilnQlC.exe
  C:\Windows\System\vilnQlC.exe
  2⤵
  PID:7020
- C:\Windows\System\aWeFkZO.exe
  C:\Windows\System\aWeFkZO.exe
  2⤵
  PID:7052
- C:\Windows\System\pzgcEXl.exe
  C:\Windows\System\pzgcEXl.exe
  2⤵
  PID:7072
- C:\Windows\System\MVpuRZr.exe
  C:\Windows\System\MVpuRZr.exe
  2⤵
  PID:7096
- C:\Windows\System\XgBTXVh.exe
  C:\Windows\System\XgBTXVh.exe
  2⤵
  PID:7112
- C:\Windows\System\thcEKzr.exe
  C:\Windows\System\thcEKzr.exe
  2⤵
  PID:7136
- C:\Windows\System\NqZwcUv.exe
  C:\Windows\System\NqZwcUv.exe
  2⤵
  PID:7152
- C:\Windows\System\OtRcjIx.exe
  C:\Windows\System\OtRcjIx.exe
  2⤵
  PID:5836
- C:\Windows\System\rccAwfI.exe
  C:\Windows\System\rccAwfI.exe
  2⤵
  PID:6160
- C:\Windows\System\BRsTXmd.exe
  C:\Windows\System\BRsTXmd.exe
  2⤵
  PID:6260
- C:\Windows\System\INrJYtm.exe
  C:\Windows\System\INrJYtm.exe
  2⤵
  PID:6032
- C:\Windows\System\LXspMOH.exe
  C:\Windows\System\LXspMOH.exe
  2⤵
  PID:6352
- C:\Windows\System\ZzQNFUu.exe
  C:\Windows\System\ZzQNFUu.exe
  2⤵
  PID:6392
- C:\Windows\System\OqDGngc.exe
  C:\Windows\System\OqDGngc.exe
  2⤵
  PID:6340
- C:\Windows\System\EeWKDFR.exe
  C:\Windows\System\EeWKDFR.exe
  2⤵
  PID:6368
- C:\Windows\System\GhUNcUQ.exe
  C:\Windows\System\GhUNcUQ.exe
  2⤵
  PID:6600
- C:\Windows\System\YvtUizU.exe
  C:\Windows\System\YvtUizU.exe
  2⤵
  PID:6824
- C:\Windows\System\TrknBAG.exe
  C:\Windows\System\TrknBAG.exe
  2⤵
  PID:6924
- C:\Windows\System\rxekeQM.exe
  C:\Windows\System\rxekeQM.exe
  2⤵
  PID:6988
- C:\Windows\System\RBYlmEy.exe
  C:\Windows\System\RBYlmEy.exe
  2⤵
  PID:7016
- C:\Windows\System\MYxVHPZ.exe
  C:\Windows\System\MYxVHPZ.exe
  2⤵
  PID:7164
- C:\Windows\System\tXERxRq.exe
  C:\Windows\System\tXERxRq.exe
  2⤵
  PID:7088
- C:\Windows\System\oPNIoZY.exe
  C:\Windows\System\oPNIoZY.exe
  2⤵
  PID:7068
- C:\Windows\System\bAaxKDG.exe
  C:\Windows\System\bAaxKDG.exe
  2⤵
  PID:6248
- C:\Windows\System\SBTtQwO.exe
  C:\Windows\System\SBTtQwO.exe
  2⤵
  PID:6636
- C:\Windows\System\LfXYeTN.exe
  C:\Windows\System\LfXYeTN.exe
  2⤵
  PID:6708
- C:\Windows\System\ZSHerXT.exe
  C:\Windows\System\ZSHerXT.exe
  2⤵
  PID:6676
- C:\Windows\System\heyKVCR.exe
  C:\Windows\System\heyKVCR.exe
  2⤵
  PID:6700
- C:\Windows\System\asCDVJE.exe
  C:\Windows\System\asCDVJE.exe
  2⤵
  PID:7012
- C:\Windows\System\LMhMrAT.exe
  C:\Windows\System\LMhMrAT.exe
  2⤵
  PID:7148
- C:\Windows\System\HcvJMKe.exe
  C:\Windows\System\HcvJMKe.exe
  2⤵
  PID:7160
- C:\Windows\System\cUGkxAj.exe
  C:\Windows\System\cUGkxAj.exe
  2⤵
  PID:6180
- C:\Windows\System\gmEQYNj.exe
  C:\Windows\System\gmEQYNj.exe
  2⤵
  PID:6800
- C:\Windows\System\gmJwJFO.exe
  C:\Windows\System\gmJwJFO.exe
  2⤵
  PID:6604
- C:\Windows\System\FwtVTlq.exe
  C:\Windows\System\FwtVTlq.exe
  2⤵
  PID:6888
- C:\Windows\System\gxPkrqc.exe
  C:\Windows\System\gxPkrqc.exe
  2⤵
  PID:6972
- C:\Windows\System\IRbTpTK.exe
  C:\Windows\System\IRbTpTK.exe
  2⤵
  PID:7184
- C:\Windows\System\lwYsuFW.exe
  C:\Windows\System\lwYsuFW.exe
  2⤵
  PID:7224
- C:\Windows\System\pOvvNyd.exe
  C:\Windows\System\pOvvNyd.exe
  2⤵
  PID:7260
- C:\Windows\System\xzNgYgx.exe
  C:\Windows\System\xzNgYgx.exe
  2⤵
  PID:7280
- C:\Windows\System\iXtseSm.exe
  C:\Windows\System\iXtseSm.exe
  2⤵
  PID:7296
- C:\Windows\System\omHJcyG.exe
  C:\Windows\System\omHJcyG.exe
  2⤵
  PID:7332
- C:\Windows\System\iCBuhgB.exe
  C:\Windows\System\iCBuhgB.exe
  2⤵
  PID:7376
- C:\Windows\System\FdHpFSG.exe
  C:\Windows\System\FdHpFSG.exe
  2⤵
  PID:7452
- C:\Windows\System\kwtcbxM.exe
  C:\Windows\System\kwtcbxM.exe
  2⤵
  PID:7472
- C:\Windows\System\GfqlqxL.exe
  C:\Windows\System\GfqlqxL.exe
  2⤵
  PID:7492
- C:\Windows\System\aZUOgxN.exe
  C:\Windows\System\aZUOgxN.exe
  2⤵
  PID:7540
- C:\Windows\System\SWMMYzj.exe
  C:\Windows\System\SWMMYzj.exe
  2⤵
  PID:7564
- C:\Windows\System\VVtOdzq.exe
  C:\Windows\System\VVtOdzq.exe
  2⤵
  PID:7584
- C:\Windows\System\qmIIfBQ.exe
  C:\Windows\System\qmIIfBQ.exe
  2⤵
  PID:7608
- C:\Windows\System\ByDdPhX.exe
  C:\Windows\System\ByDdPhX.exe
  2⤵
  PID:7652
- C:\Windows\System\rrxbDih.exe
  C:\Windows\System\rrxbDih.exe
  2⤵
  PID:7692
- C:\Windows\System\XjsqDJg.exe
  C:\Windows\System\XjsqDJg.exe
  2⤵
  PID:7712
- C:\Windows\System\yfTiuit.exe
  C:\Windows\System\yfTiuit.exe
  2⤵
  PID:7732
- C:\Windows\System\MHvFcQL.exe
  C:\Windows\System\MHvFcQL.exe
  2⤵
  PID:7764
- C:\Windows\System\iciaGUj.exe
  C:\Windows\System\iciaGUj.exe
  2⤵
  PID:7788
- C:\Windows\System\zFCTGXE.exe
  C:\Windows\System\zFCTGXE.exe
  2⤵
  PID:7808
- C:\Windows\System\EPyPkog.exe
  C:\Windows\System\EPyPkog.exe
  2⤵
  PID:7836
- C:\Windows\System\qWJlXvT.exe
  C:\Windows\System\qWJlXvT.exe
  2⤵
  PID:7892
- C:\Windows\System\aUIaItl.exe
  C:\Windows\System\aUIaItl.exe
  2⤵
  PID:7912
- C:\Windows\System\LSoEcUX.exe
  C:\Windows\System\LSoEcUX.exe
  2⤵
  PID:7940
- C:\Windows\System\SChZBwM.exe
  C:\Windows\System\SChZBwM.exe
  2⤵
  PID:7964
- C:\Windows\System\FfynjfK.exe
  C:\Windows\System\FfynjfK.exe
  2⤵
  PID:7988
- C:\Windows\System\GESABXo.exe
  C:\Windows\System\GESABXo.exe
  2⤵
  PID:8008
- C:\Windows\System\QsgcpUe.exe
  C:\Windows\System\QsgcpUe.exe
  2⤵
  PID:8040
- C:\Windows\System\FyLYIqe.exe
  C:\Windows\System\FyLYIqe.exe
  2⤵
  PID:8056
- C:\Windows\System\SabVOdD.exe
  C:\Windows\System\SabVOdD.exe
  2⤵
  PID:8080
- C:\Windows\System\AoAcqAo.exe
  C:\Windows\System\AoAcqAo.exe
  2⤵
  PID:8100
- C:\Windows\System\oCPZtBl.exe
  C:\Windows\System\oCPZtBl.exe
  2⤵
  PID:8148
- C:\Windows\System\MOqIUyu.exe
  C:\Windows\System\MOqIUyu.exe
  2⤵
  PID:8184
- C:\Windows\System\KWNWhzB.exe
  C:\Windows\System\KWNWhzB.exe
  2⤵
  PID:7196
- C:\Windows\System\zVHFStb.exe
  C:\Windows\System\zVHFStb.exe
  2⤵
  PID:6856
- C:\Windows\System\XLBzkPv.exe
  C:\Windows\System\XLBzkPv.exe
  2⤵
  PID:7288
- C:\Windows\System\wlAPhBd.exe
  C:\Windows\System\wlAPhBd.exe
  2⤵
  PID:7392
- C:\Windows\System\nxopUif.exe
  C:\Windows\System\nxopUif.exe
  2⤵
  PID:7444
- C:\Windows\System\QesmGuV.exe
  C:\Windows\System\QesmGuV.exe
  2⤵
  PID:7464
- C:\Windows\System\qIvjOxE.exe
  C:\Windows\System\qIvjOxE.exe
  2⤵
  PID:7548
- C:\Windows\System\hnIQUWL.exe
  C:\Windows\System\hnIQUWL.exe
  2⤵
  PID:7672
- C:\Windows\System\PgKLnBh.exe
  C:\Windows\System\PgKLnBh.exe
  2⤵
  PID:7756
- C:\Windows\System\tHxxwai.exe
  C:\Windows\System\tHxxwai.exe
  2⤵
  PID:7800
- C:\Windows\System\HWsWPKG.exe
  C:\Windows\System\HWsWPKG.exe
  2⤵
  PID:7864
- C:\Windows\System\SsoUhmY.exe
  C:\Windows\System\SsoUhmY.exe
  2⤵
  PID:7932
- C:\Windows\System\zGzzTNq.exe
  C:\Windows\System\zGzzTNq.exe
  2⤵
  PID:7984
- C:\Windows\System\NfRcePf.exe
  C:\Windows\System\NfRcePf.exe
  2⤵
  PID:7980
- C:\Windows\System\foeStug.exe
  C:\Windows\System\foeStug.exe
  2⤵
  PID:8016
- C:\Windows\System\ArBYaAm.exe
  C:\Windows\System\ArBYaAm.exe
  2⤵
  PID:8076
- C:\Windows\System\fPynOYT.exe
  C:\Windows\System\fPynOYT.exe
  2⤵
  PID:7144
- C:\Windows\System\aTNyTBf.exe
  C:\Windows\System\aTNyTBf.exe
  2⤵
  PID:4124
- C:\Windows\System\KeqAWga.exe
  C:\Windows\System\KeqAWga.exe
  2⤵
  PID:7688
- C:\Windows\System\cGGsMlb.exe
  C:\Windows\System\cGGsMlb.exe
  2⤵
  PID:7728
- C:\Windows\System\MhWKGsB.exe
  C:\Windows\System\MhWKGsB.exe
  2⤵
  PID:7956
- C:\Windows\System\FfvuMuA.exe
  C:\Windows\System\FfvuMuA.exe
  2⤵
  PID:8000
- C:\Windows\System\ooMMKJD.exe
  C:\Windows\System\ooMMKJD.exe
  2⤵
  PID:8024
- C:\Windows\System\bqSQsaE.exe
  C:\Windows\System\bqSQsaE.exe
  2⤵
  PID:8172
- C:\Windows\System\jXRVuDj.exe
  C:\Windows\System\jXRVuDj.exe
  2⤵
  PID:7108
- C:\Windows\System\ZyCQZhn.exe
  C:\Windows\System\ZyCQZhn.exe
  2⤵
  PID:7460
- C:\Windows\System\KscGLrh.exe
  C:\Windows\System\KscGLrh.exe
  2⤵
  PID:7908
- C:\Windows\System\dbfeGbf.exe
  C:\Windows\System\dbfeGbf.exe
  2⤵
  PID:8092
- C:\Windows\System\KBxiXur.exe
  C:\Windows\System\KBxiXur.exe
  2⤵
  PID:8200
- C:\Windows\System\mYFJsaZ.exe
  C:\Windows\System\mYFJsaZ.exe
  2⤵
  PID:8224
- C:\Windows\System\zqjDqnJ.exe
  C:\Windows\System\zqjDqnJ.exe
  2⤵
  PID:8256
- C:\Windows\System\DdFaIGl.exe
  C:\Windows\System\DdFaIGl.exe
  2⤵
  PID:8272
- C:\Windows\System\hcfZmXk.exe
  C:\Windows\System\hcfZmXk.exe
  2⤵
  PID:8288
- C:\Windows\System\SsToroQ.exe
  C:\Windows\System\SsToroQ.exe
  2⤵
  PID:8312
- C:\Windows\System\FqxelQS.exe
  C:\Windows\System\FqxelQS.exe
  2⤵
  PID:8332
- C:\Windows\System\NSADAih.exe
  C:\Windows\System\NSADAih.exe
  2⤵
  PID:8348
- C:\Windows\System\calYtue.exe
  C:\Windows\System\calYtue.exe
  2⤵
  PID:8380
- C:\Windows\System\PGXfJmq.exe
  C:\Windows\System\PGXfJmq.exe
  2⤵
  PID:8400
- C:\Windows\System\hLMWNtv.exe
  C:\Windows\System\hLMWNtv.exe
  2⤵
  PID:8420
- C:\Windows\System\tOUwNHY.exe
  C:\Windows\System\tOUwNHY.exe
  2⤵
  PID:8436
- C:\Windows\System\LnmeyBE.exe
  C:\Windows\System\LnmeyBE.exe
  2⤵
  PID:8456
- C:\Windows\System\GonSqqE.exe
  C:\Windows\System\GonSqqE.exe
  2⤵
  PID:8476
- C:\Windows\System\suZKjhS.exe
  C:\Windows\System\suZKjhS.exe
  2⤵
  PID:8496
- C:\Windows\System\MZhxTam.exe
  C:\Windows\System\MZhxTam.exe
  2⤵
  PID:8512
- C:\Windows\System\mVtWpcH.exe
  C:\Windows\System\mVtWpcH.exe
  2⤵
  PID:8532
- C:\Windows\System\umWsGSW.exe
  C:\Windows\System\umWsGSW.exe
  2⤵
  PID:8556
- C:\Windows\System\YDXeDZx.exe
  C:\Windows\System\YDXeDZx.exe
  2⤵
  PID:8576
- C:\Windows\System\UvrwOqA.exe
  C:\Windows\System\UvrwOqA.exe
  2⤵
  PID:8596
- C:\Windows\System\rjYoGBu.exe
  C:\Windows\System\rjYoGBu.exe
  2⤵
  PID:8616
- C:\Windows\System\VolbbgW.exe
  C:\Windows\System\VolbbgW.exe
  2⤵
  PID:8636
- C:\Windows\System\NuwhQct.exe
  C:\Windows\System\NuwhQct.exe
  2⤵
  PID:8660
- C:\Windows\System\ndUxoPN.exe
  C:\Windows\System\ndUxoPN.exe
  2⤵
  PID:8680
- C:\Windows\System\kRPEptF.exe
  C:\Windows\System\kRPEptF.exe
  2⤵
  PID:8700
- C:\Windows\System\vXiEpcG.exe
  C:\Windows\System\vXiEpcG.exe
  2⤵
  PID:8724
- C:\Windows\System\UGpVGqo.exe
  C:\Windows\System\UGpVGqo.exe
  2⤵
  PID:8740
- C:\Windows\System\vKXVQKv.exe
  C:\Windows\System\vKXVQKv.exe
  2⤵
  PID:8764
- C:\Windows\System\WJmtcMi.exe
  C:\Windows\System\WJmtcMi.exe
  2⤵
  PID:8784
- C:\Windows\System\kJxqkJc.exe
  C:\Windows\System\kJxqkJc.exe
  2⤵
  PID:8804
- C:\Windows\System\igpeBhG.exe
  C:\Windows\System\igpeBhG.exe
  2⤵
  PID:8820
- C:\Windows\System\CAoSias.exe
  C:\Windows\System\CAoSias.exe
  2⤵
  PID:8844
- C:\Windows\System\YBwWIlx.exe
  C:\Windows\System\YBwWIlx.exe
  2⤵
  PID:8868
- C:\Windows\System\ZgxwqRx.exe
  C:\Windows\System\ZgxwqRx.exe
  2⤵
  PID:8892
- C:\Windows\System\AOUqwGz.exe
  C:\Windows\System\AOUqwGz.exe
  2⤵
  PID:8912
- C:\Windows\System\Rbuteck.exe
  C:\Windows\System\Rbuteck.exe
  2⤵
  PID:8932
- C:\Windows\System\RklUryS.exe
  C:\Windows\System\RklUryS.exe
  2⤵
  PID:8952
- C:\Windows\System\wbJRfjO.exe
  C:\Windows\System\wbJRfjO.exe
  2⤵
  PID:8972
- C:\Windows\System\sVsHyRu.exe
  C:\Windows\System\sVsHyRu.exe
  2⤵
  PID:8996
- C:\Windows\System\LkUyjdm.exe
  C:\Windows\System\LkUyjdm.exe
  2⤵
  PID:9016
- C:\Windows\System\kFrDbFQ.exe
  C:\Windows\System\kFrDbFQ.exe
  2⤵
  PID:9036
- C:\Windows\System\uOtsrmM.exe
  C:\Windows\System\uOtsrmM.exe
  2⤵
  PID:9056
- C:\Windows\System\iZJBpwJ.exe
  C:\Windows\System\iZJBpwJ.exe
  2⤵
  PID:9076
- C:\Windows\System\SAHMxju.exe
  C:\Windows\System\SAHMxju.exe
  2⤵
  PID:9096
- C:\Windows\System\udCMniv.exe
  C:\Windows\System\udCMniv.exe
  2⤵
  PID:9116
- C:\Windows\System\uFeMCpO.exe
  C:\Windows\System\uFeMCpO.exe
  2⤵
  PID:9132
- C:\Windows\System\qyIqbUs.exe
  C:\Windows\System\qyIqbUs.exe
  2⤵
  PID:9156
- C:\Windows\System\MhBmSBz.exe
  C:\Windows\System\MhBmSBz.exe
  2⤵
  PID:9180
- C:\Windows\System\cQVtCcl.exe
  C:\Windows\System\cQVtCcl.exe
  2⤵
  PID:9200
- C:\Windows\System\aKYwdPp.exe
  C:\Windows\System\aKYwdPp.exe
  2⤵
  PID:7388
- C:\Windows\System\NUzIRSc.exe
  C:\Windows\System\NUzIRSc.exe
  2⤵
  PID:8232
- C:\Windows\System\hAMiyRt.exe
  C:\Windows\System\hAMiyRt.exe
  2⤵
  PID:7828
- C:\Windows\System\ClXitkv.exe
  C:\Windows\System\ClXitkv.exe
  2⤵
  PID:7600
- C:\Windows\System\RRMDcaD.exe
  C:\Windows\System\RRMDcaD.exe
  2⤵
  PID:8360
- C:\Windows\System\gIkFTSD.exe
  C:\Windows\System\gIkFTSD.exe
  2⤵
  PID:8284
- C:\Windows\System\IMyDCsz.exe
  C:\Windows\System\IMyDCsz.exe
  2⤵
  PID:8308
- C:\Windows\System\hdfkorz.exe
  C:\Windows\System\hdfkorz.exe
  2⤵
  PID:8376
- C:\Windows\System\DRCYzzX.exe
  C:\Windows\System\DRCYzzX.exe
  2⤵
  PID:8412
- C:\Windows\System\NmRccJO.exe
  C:\Windows\System\NmRccJO.exe
  2⤵
  PID:8608
- C:\Windows\System\lPFpVHF.exe
  C:\Windows\System\lPFpVHF.exe
  2⤵
  PID:8676
- C:\Windows\System\JpPEsIK.exe
  C:\Windows\System\JpPEsIK.exe
  2⤵
  PID:8756
- C:\Windows\System\gNXHLjq.exe
  C:\Windows\System\gNXHLjq.exe
  2⤵
  PID:8884
- C:\Windows\System\kxitAYP.exe
  C:\Windows\System\kxitAYP.exe
  2⤵
  PID:8944
- C:\Windows\System\SiAkVbi.exe
  C:\Windows\System\SiAkVbi.exe
  2⤵
  PID:8980
- C:\Windows\System\teDlqaf.exe
  C:\Windows\System\teDlqaf.exe
  2⤵
  PID:8748
- C:\Windows\System\hQFIoVu.exe
  C:\Windows\System\hQFIoVu.exe
  2⤵
  PID:9084
- C:\Windows\System\MmOCrcS.exe
  C:\Windows\System\MmOCrcS.exe
  2⤵
  PID:8772
- C:\Windows\System\WDBmpZE.exe
  C:\Windows\System\WDBmpZE.exe
  2⤵
  PID:9236
- C:\Windows\System\EEbrVRu.exe
  C:\Windows\System\EEbrVRu.exe
  2⤵
  PID:9256
- C:\Windows\System\lPdIQrN.exe
  C:\Windows\System\lPdIQrN.exe
  2⤵
  PID:9272
- C:\Windows\System\wFjtHwZ.exe
  C:\Windows\System\wFjtHwZ.exe
  2⤵
  PID:9292
- C:\Windows\System\VcWQlmB.exe
  C:\Windows\System\VcWQlmB.exe
  2⤵
  PID:9312
- C:\Windows\System\nLiEknj.exe
  C:\Windows\System\nLiEknj.exe
  2⤵
  PID:9328
- C:\Windows\System\GIFGElH.exe
  C:\Windows\System\GIFGElH.exe
  2⤵
  PID:9352
- C:\Windows\System\pVXrkyh.exe
  C:\Windows\System\pVXrkyh.exe
  2⤵
  PID:9372
- C:\Windows\System\GKxMkjN.exe
  C:\Windows\System\GKxMkjN.exe
  2⤵
  PID:9392
- C:\Windows\System\gbUEZix.exe
  C:\Windows\System\gbUEZix.exe
  2⤵
  PID:9412
- C:\Windows\System\iNmgyVn.exe
  C:\Windows\System\iNmgyVn.exe
  2⤵
  PID:9432
- C:\Windows\System\owGihqa.exe
  C:\Windows\System\owGihqa.exe
  2⤵
  PID:9460
- C:\Windows\System\CqVOZLj.exe
  C:\Windows\System\CqVOZLj.exe
  2⤵
  PID:9480
- C:\Windows\System\Hllgivj.exe
  C:\Windows\System\Hllgivj.exe
  2⤵
  PID:9500
- C:\Windows\System\dJoAdUc.exe
  C:\Windows\System\dJoAdUc.exe
  2⤵
  PID:9524
- C:\Windows\System\DCGBBpl.exe
  C:\Windows\System\DCGBBpl.exe
  2⤵
  PID:9544
- C:\Windows\System\XElZOxs.exe
  C:\Windows\System\XElZOxs.exe
  2⤵
  PID:9564
- C:\Windows\System\lXcKegI.exe
  C:\Windows\System\lXcKegI.exe
  2⤵
  PID:9584
- C:\Windows\System\DgEQaQe.exe
  C:\Windows\System\DgEQaQe.exe
  2⤵
  PID:9608
- C:\Windows\System\FhNNMbx.exe
  C:\Windows\System\FhNNMbx.exe
  2⤵
  PID:9628
- C:\Windows\System\pOqiNOE.exe
  C:\Windows\System\pOqiNOE.exe
  2⤵
  PID:9648
- C:\Windows\System\vIHtHhT.exe
  C:\Windows\System\vIHtHhT.exe
  2⤵
  PID:9664
- C:\Windows\System\NLeSKtj.exe
  C:\Windows\System\NLeSKtj.exe
  2⤵
  PID:9684
- C:\Windows\System\xerFMdP.exe
  C:\Windows\System\xerFMdP.exe
  2⤵
  PID:9700
- C:\Windows\System\ZWwkGna.exe
  C:\Windows\System\ZWwkGna.exe
  2⤵
  PID:9724
- C:\Windows\System\yPWNBSP.exe
  C:\Windows\System\yPWNBSP.exe
  2⤵
  PID:9752
- C:\Windows\System\VkEDoTx.exe
  C:\Windows\System\VkEDoTx.exe
  2⤵
  PID:9772
- C:\Windows\System\tgUyEAa.exe
  C:\Windows\System\tgUyEAa.exe
  2⤵
  PID:9792
- C:\Windows\System\qBWIBMc.exe
  C:\Windows\System\qBWIBMc.exe
  2⤵
  PID:9812
- C:\Windows\System\TVXaVkw.exe
  C:\Windows\System\TVXaVkw.exe
  2⤵
  PID:9828
- C:\Windows\System\XFMumxW.exe
  C:\Windows\System\XFMumxW.exe
  2⤵
  PID:9852
- C:\Windows\System\TGdHEXA.exe
  C:\Windows\System\TGdHEXA.exe
  2⤵
  PID:9872
- C:\Windows\System\Sptnqdv.exe
  C:\Windows\System\Sptnqdv.exe
  2⤵
  PID:9896
- C:\Windows\System\whlaGaQ.exe
  C:\Windows\System\whlaGaQ.exe
  2⤵
  PID:9916
- C:\Windows\System\PgHZkhk.exe
  C:\Windows\System\PgHZkhk.exe
  2⤵
  PID:9936
- C:\Windows\System\ahJlTHK.exe
  C:\Windows\System\ahJlTHK.exe
  2⤵
  PID:9952
- C:\Windows\System\UCTdGhy.exe
  C:\Windows\System\UCTdGhy.exe
  2⤵
  PID:9280
- C:\Windows\System\ZqYiezN.exe
  C:\Windows\System\ZqYiezN.exe
  2⤵
  PID:9320
- C:\Windows\System\GKYEnfD.exe
  C:\Windows\System\GKYEnfD.exe
  2⤵
  PID:9400
- C:\Windows\System\qQEyMjH.exe
  C:\Windows\System\qQEyMjH.exe
  2⤵
  PID:8300
- C:\Windows\System\TPNVVKt.exe
  C:\Windows\System\TPNVVKt.exe
  2⤵
  PID:9032
- C:\Windows\System\wlzxwnv.exe
  C:\Windows\System\wlzxwnv.exe
  2⤵
  PID:8652
- C:\Windows\System\DkXIIVM.exe
  C:\Windows\System\DkXIIVM.exe
  2⤵
  PID:9644
- C:\Windows\System\WmLnKIK.exe
  C:\Windows\System\WmLnKIK.exe
  2⤵
  PID:8940
- C:\Windows\System\WLJKoZR.exe
  C:\Windows\System\WLJKoZR.exe
  2⤵
  PID:9696
- C:\Windows\System\XWiMVlP.exe
  C:\Windows\System\XWiMVlP.exe
  2⤵
  PID:9744
- C:\Windows\System\UqOWDrE.exe
  C:\Windows\System\UqOWDrE.exe
  2⤵
  PID:8732
- C:\Windows\System\CSVtViH.exe
  C:\Windows\System\CSVtViH.exe
  2⤵
  PID:9928
- C:\Windows\System\XZpZimx.exe
  C:\Windows\System\XZpZimx.exe
  2⤵
  PID:7524
- C:\Windows\System\bycoBwp.exe
  C:\Windows\System\bycoBwp.exe
  2⤵
  PID:8408
- C:\Windows\System\HNccbtA.exe
  C:\Windows\System\HNccbtA.exe
  2⤵
  PID:8468
- C:\Windows\System\uLHAPbv.exe
  C:\Windows\System\uLHAPbv.exe
  2⤵
  PID:10052
- C:\Windows\System\cAiuSwZ.exe
  C:\Windows\System\cAiuSwZ.exe
  2⤵
  PID:9888
- C:\Windows\System\btnHudZ.exe
  C:\Windows\System\btnHudZ.exe
  2⤵
  PID:10080
- C:\Windows\System\aTTnNQS.exe
  C:\Windows\System\aTTnNQS.exe
  2⤵
  PID:9964
- C:\Windows\System\puLgqWO.exe
  C:\Windows\System\puLgqWO.exe
  2⤵
  PID:9348
- C:\Windows\System\YqCUUzi.exe
  C:\Windows\System\YqCUUzi.exe
  2⤵
  PID:9428
- C:\Windows\System\HShmgOq.exe
  C:\Windows\System\HShmgOq.exe
  2⤵
  PID:9476
- C:\Windows\System\joMzFOS.exe
  C:\Windows\System\joMzFOS.exe
  2⤵
  PID:9516
- C:\Windows\System\UomStfV.exe
  C:\Windows\System\UomStfV.exe
  2⤵
  PID:9560
- C:\Windows\System\qRquQOf.exe
  C:\Windows\System\qRquQOf.exe
  2⤵
  PID:9620
- C:\Windows\System\otUhUoY.exe
  C:\Windows\System\otUhUoY.exe
  2⤵
  PID:9820
- C:\Windows\System\CdHxDKb.exe
  C:\Windows\System\CdHxDKb.exe
  2⤵
  PID:9864
- C:\Windows\System\RxeVuKZ.exe
  C:\Windows\System\RxeVuKZ.exe
  2⤵
  PID:7776
- C:\Windows\System\WJDQtTj.exe
  C:\Windows\System\WJDQtTj.exe
  2⤵
  PID:10012
- C:\Windows\System\OejgEDG.exe
  C:\Windows\System\OejgEDG.exe
  2⤵
  PID:10256
- C:\Windows\System\cNkjCsw.exe
  C:\Windows\System\cNkjCsw.exe
  2⤵
  PID:10276
- C:\Windows\System\NJHWguR.exe
  C:\Windows\System\NJHWguR.exe
  2⤵
  PID:10292
- C:\Windows\System\MJYNviU.exe
  C:\Windows\System\MJYNviU.exe
  2⤵
  PID:10312
- C:\Windows\System\DIaGqqE.exe
  C:\Windows\System\DIaGqqE.exe
  2⤵
  PID:10332
- C:\Windows\System\mfqbNms.exe
  C:\Windows\System\mfqbNms.exe
  2⤵
  PID:10352
- C:\Windows\System\otRcEbM.exe
  C:\Windows\System\otRcEbM.exe
  2⤵
  PID:10368
- C:\Windows\System\kCQfRxi.exe
  C:\Windows\System\kCQfRxi.exe
  2⤵
  PID:10388
- C:\Windows\System\PKejJwB.exe
  C:\Windows\System\PKejJwB.exe
  2⤵
  PID:10404
- C:\Windows\System\YYNJbhg.exe
  C:\Windows\System\YYNJbhg.exe
  2⤵
  PID:10424
- C:\Windows\System\FTChJCr.exe
  C:\Windows\System\FTChJCr.exe
  2⤵
  PID:10444
- C:\Windows\System\HCarsFl.exe
  C:\Windows\System\HCarsFl.exe
  2⤵
  PID:10460
- C:\Windows\System\iCKICkU.exe
  C:\Windows\System\iCKICkU.exe
  2⤵
  PID:10480
- C:\Windows\System\mhJQvlb.exe
  C:\Windows\System\mhJQvlb.exe
  2⤵
  PID:10500
- C:\Windows\System\WHGkohj.exe
  C:\Windows\System\WHGkohj.exe
  2⤵
  PID:10516
- C:\Windows\System\gtVSBXQ.exe
  C:\Windows\System\gtVSBXQ.exe
  2⤵
  PID:10536
- C:\Windows\System\apKQDun.exe
  C:\Windows\System\apKQDun.exe
  2⤵
  PID:10556
- C:\Windows\System\VNrAJUF.exe
  C:\Windows\System\VNrAJUF.exe
  2⤵
  PID:10576
- C:\Windows\System\mIXiEiu.exe
  C:\Windows\System\mIXiEiu.exe
  2⤵
  PID:10592
- C:\Windows\System\FqwTkWZ.exe
  C:\Windows\System\FqwTkWZ.exe
  2⤵
  PID:10612
- C:\Windows\System\MRdrswF.exe
  C:\Windows\System\MRdrswF.exe
  2⤵
  PID:10636
- C:\Windows\System\ckgHRpk.exe
  C:\Windows\System\ckgHRpk.exe
  2⤵
  PID:10940
- C:\Windows\System\FUhZLYR.exe
  C:\Windows\System\FUhZLYR.exe
  2⤵
  PID:10976
- C:\Windows\System\xrmjnmV.exe
  C:\Windows\System\xrmjnmV.exe
  2⤵
  PID:10992
- C:\Windows\System\tevSjtP.exe
  C:\Windows\System\tevSjtP.exe
  2⤵
  PID:11012
- C:\Windows\System\GSLJBCt.exe
  C:\Windows\System\GSLJBCt.exe
  2⤵
  PID:11060
- C:\Windows\System\ZRhIvnr.exe
  C:\Windows\System\ZRhIvnr.exe
  2⤵
  PID:11076
- C:\Windows\System\qBAdtGa.exe
  C:\Windows\System\qBAdtGa.exe
  2⤵
  PID:11092
- C:\Windows\System\EGVnZSK.exe
  C:\Windows\System\EGVnZSK.exe
  2⤵
  PID:11108
- C:\Windows\System\imJVJvH.exe
  C:\Windows\System\imJVJvH.exe
  2⤵
  PID:11124
- C:\Windows\System\eInEtQe.exe
  C:\Windows\System\eInEtQe.exe
  2⤵
  PID:11140
- C:\Windows\System\BwSDWQe.exe
  C:\Windows\System\BwSDWQe.exe
  2⤵
  PID:11156
- C:\Windows\System\mxBjKzt.exe
  C:\Windows\System\mxBjKzt.exe
  2⤵
  PID:11172
- C:\Windows\System\JDKcLsJ.exe
  C:\Windows\System\JDKcLsJ.exe
  2⤵
  PID:11188
- C:\Windows\System\lpMBszZ.exe
  C:\Windows\System\lpMBszZ.exe
  2⤵
  PID:11204
- C:\Windows\System\NuvcvWT.exe
  C:\Windows\System\NuvcvWT.exe
  2⤵
  PID:11220
- C:\Windows\System\IMDqjIX.exe
  C:\Windows\System\IMDqjIX.exe
  2⤵
  PID:11260
- C:\Windows\System\eTCKegy.exe
  C:\Windows\System\eTCKegy.exe
  2⤵
  PID:9448
- C:\Windows\System\ZtLbhaI.exe
  C:\Windows\System\ZtLbhaI.exe
  2⤵
  PID:3080
- C:\Windows\System\lVJZgIA.exe
  C:\Windows\System\lVJZgIA.exe
  2⤵
  PID:9732
- C:\Windows\System\trnZDtO.exe
  C:\Windows\System\trnZDtO.exe
  2⤵
  PID:9788
- C:\Windows\System\PLsXblg.exe
  C:\Windows\System\PLsXblg.exe
  2⤵
  PID:10264
- C:\Windows\System\gvgKAHI.exe
  C:\Windows\System\gvgKAHI.exe
  2⤵
  PID:1608
- C:\Windows\System\iwafQhF.exe
  C:\Windows\System\iwafQhF.exe
  2⤵
  PID:10528
- C:\Windows\System\CZBAjGi.exe
  C:\Windows\System\CZBAjGi.exe
  2⤵
  PID:10672
- C:\Windows\System\zixOFJa.exe
  C:\Windows\System\zixOFJa.exe
  2⤵
  PID:10696
- C:\Windows\System\faiBTLw.exe
  C:\Windows\System\faiBTLw.exe
  2⤵
  PID:3964
- C:\Windows\System\qWtxkIN.exe
  C:\Windows\System\qWtxkIN.exe
  2⤵
  PID:3548
- C:\Windows\System\YdxOXpt.exe
  C:\Windows\System\YdxOXpt.exe
  2⤵
  PID:9692
- C:\Windows\System\wgjgPvo.exe
  C:\Windows\System\wgjgPvo.exe
  2⤵
  PID:8220
- C:\Windows\System\ZqFECjs.exe
  C:\Windows\System\ZqFECjs.exe
  2⤵
  PID:10792
- C:\Windows\System\KPmEnIB.exe
  C:\Windows\System\KPmEnIB.exe
  2⤵
  PID:9492
- C:\Windows\System\mlYIONP.exe
  C:\Windows\System\mlYIONP.exe
  2⤵
  PID:9840
- C:\Windows\System\VWeoqLV.exe
  C:\Windows\System\VWeoqLV.exe
  2⤵
  PID:8924
- C:\Windows\System\ZaNkqMk.exe
  C:\Windows\System\ZaNkqMk.exe
  2⤵
  PID:11276
- C:\Windows\System\IBGJnGD.exe
  C:\Windows\System\IBGJnGD.exe
  2⤵
  PID:11292
- C:\Windows\System\UVQEBBB.exe
  C:\Windows\System\UVQEBBB.exe
  2⤵
  PID:11308
- C:\Windows\System\RZGZddF.exe
  C:\Windows\System\RZGZddF.exe
  2⤵
  PID:11512
- C:\Windows\System\ZDxVRBL.exe
  C:\Windows\System\ZDxVRBL.exe
  2⤵
  PID:11528
- C:\Windows\System\mKwvpfe.exe
  C:\Windows\System\mKwvpfe.exe
  2⤵
  PID:11552
- C:\Windows\System\FImLmdE.exe
  C:\Windows\System\FImLmdE.exe
  2⤵
  PID:11576
- C:\Windows\System\wnbDKZt.exe
  C:\Windows\System\wnbDKZt.exe
  2⤵
  PID:11604
- C:\Windows\System\laRMekK.exe
  C:\Windows\System\laRMekK.exe
  2⤵
  PID:11624
- C:\Windows\System\DQrndLq.exe
  C:\Windows\System\DQrndLq.exe
  2⤵
  PID:11652
- C:\Windows\System\YDrBtfE.exe
  C:\Windows\System\YDrBtfE.exe
  2⤵
  PID:11672
- C:\Windows\System\KOmuNhK.exe
  C:\Windows\System\KOmuNhK.exe
  2⤵
  PID:11692
- C:\Windows\System\nJlhocw.exe
  C:\Windows\System\nJlhocw.exe
  2⤵
  PID:11716
- C:\Windows\System\jRSJmrh.exe
  C:\Windows\System\jRSJmrh.exe
  2⤵
  PID:11736
- C:\Windows\System\cikybQx.exe
  C:\Windows\System\cikybQx.exe
  2⤵
  PID:11760
- C:\Windows\System\vGBJiCF.exe
  C:\Windows\System\vGBJiCF.exe
  2⤵
  PID:11776
- C:\Windows\System\Tcgxdhm.exe
  C:\Windows\System\Tcgxdhm.exe
  2⤵
  PID:11792
- C:\Windows\System\fABXpCr.exe
  C:\Windows\System\fABXpCr.exe
  2⤵
  PID:11808
- C:\Windows\System\WAJNCCi.exe
  C:\Windows\System\WAJNCCi.exe
  2⤵
  PID:11828
- C:\Windows\System\uWAeplD.exe
  C:\Windows\System\uWAeplD.exe
  2⤵
  PID:11844
- C:\Windows\System\HuEkFQP.exe
  C:\Windows\System\HuEkFQP.exe
  2⤵
  PID:11864
- C:\Windows\System\bZDfQgi.exe
  C:\Windows\System\bZDfQgi.exe
  2⤵
  PID:11896
- C:\Windows\System\bnTlOjx.exe
  C:\Windows\System\bnTlOjx.exe
  2⤵
  PID:11920
- C:\Windows\System\UaPLQAx.exe
  C:\Windows\System\UaPLQAx.exe
  2⤵
  PID:11936
- C:\Windows\System\gHOGUWW.exe
  C:\Windows\System\gHOGUWW.exe
  2⤵
  PID:11956
- C:\Windows\System\BTMaTXc.exe
  C:\Windows\System\BTMaTXc.exe
  2⤵
  PID:11976
- C:\Windows\System\aybSpeE.exe
  C:\Windows\System\aybSpeE.exe
  2⤵
  PID:10324
- C:\Windows\System\CSzEdGR.exe
  C:\Windows\System\CSzEdGR.exe
  2⤵
  PID:10572
- C:\Windows\System\UfotHnG.exe
  C:\Windows\System\UfotHnG.exe
  2⤵
  PID:11088
- C:\Windows\System\mwOPTiF.exe
  C:\Windows\System\mwOPTiF.exe
  2⤵
  PID:11148
- C:\Windows\System\tGinoSg.exe
  C:\Windows\System\tGinoSg.exe
  2⤵
  PID:10720
- C:\Windows\System\FysswXZ.exe
  C:\Windows\System\FysswXZ.exe
  2⤵
  PID:11236
- C:\Windows\System\YwjtswY.exe
  C:\Windows\System\YwjtswY.exe
  2⤵
  PID:8928
- C:\Windows\System\ZcSJnfc.exe
  C:\Windows\System\ZcSJnfc.exe
  2⤵
  PID:8396
- C:\Windows\System\AJrmqEN.exe
  C:\Windows\System\AJrmqEN.exe
  2⤵
  PID:9224
- C:\Windows\System\VCHpgar.exe
  C:\Windows\System\VCHpgar.exe
  2⤵
  PID:10568
- C:\Windows\System\eKdroQD.exe
  C:\Windows\System\eKdroQD.exe
  2⤵
  PID:10608
- C:\Windows\System\RTamnND.exe
  C:\Windows\System\RTamnND.exe
  2⤵
  PID:10656
- C:\Windows\System\ljkucyN.exe
  C:\Windows\System\ljkucyN.exe
  2⤵
  PID:10984
- C:\Windows\System\ScsSmEw.exe
  C:\Windows\System\ScsSmEw.exe
  2⤵
  PID:10732
- C:\Windows\System\kwBIIrO.exe
  C:\Windows\System\kwBIIrO.exe
  2⤵
  PID:11352
- C:\Windows\System\NTNNJOB.exe
  C:\Windows\System\NTNNJOB.exe
  2⤵
  PID:9248
- C:\Windows\System\ngxokVE.exe
  C:\Windows\System\ngxokVE.exe
  2⤵
  PID:8072
- C:\Windows\System\fNQnCDn.exe
  C:\Windows\System\fNQnCDn.exe
  2⤵
  PID:10348
- C:\Windows\System\pOKubZV.exe
  C:\Windows\System\pOKubZV.exe
  2⤵
  PID:10512
- C:\Windows\System\BNbiMHz.exe
  C:\Windows\System\BNbiMHz.exe
  2⤵
  PID:11416
- C:\Windows\System\AWUgAjA.exe
  C:\Windows\System\AWUgAjA.exe
  2⤵
  PID:11444
- C:\Windows\System\MImhhXB.exe
  C:\Windows\System\MImhhXB.exe
  2⤵
  PID:9660
- C:\Windows\System\epCPmmD.exe
  C:\Windows\System\epCPmmD.exe
  2⤵
  PID:9540
- C:\Windows\System\NJbNeIX.exe
  C:\Windows\System\NJbNeIX.exe
  2⤵
  PID:11536
- C:\Windows\System\tEINXfK.exe
  C:\Windows\System\tEINXfK.exe
  2⤵
  PID:11008
- C:\Windows\System\nsVGENy.exe
  C:\Windows\System\nsVGENy.exe
  2⤵
  PID:11200
- C:\Windows\System\yQfzpdD.exe
  C:\Windows\System\yQfzpdD.exe
  2⤵
  PID:11784
- C:\Windows\System\SgnPEuv.exe
  C:\Windows\System\SgnPEuv.exe
  2⤵
  PID:11816
- C:\Windows\System\LEaGTpM.exe
  C:\Windows\System\LEaGTpM.exe
  2⤵
  PID:11388
- C:\Windows\System\cfbjpWk.exe
  C:\Windows\System\cfbjpWk.exe
  2⤵
  PID:11948
- C:\Windows\System\OmAapwX.exe
  C:\Windows\System\OmAapwX.exe
  2⤵
  PID:2288
- C:\Windows\System\iRKYqiJ.exe
  C:\Windows\System\iRKYqiJ.exe
  2⤵
  PID:12116
- C:\Windows\System\wPOEKDg.exe
  C:\Windows\System\wPOEKDg.exe
  2⤵
  PID:11268
- C:\Windows\System\hKboEba.exe
  C:\Windows\System\hKboEba.exe
  2⤵
  PID:11492
- C:\Windows\System\WaFNpNt.exe
  C:\Windows\System\WaFNpNt.exe
  2⤵
  PID:11664
- C:\Windows\System\AgCLFIg.exe
  C:\Windows\System\AgCLFIg.exe
  2⤵
  PID:11708
- C:\Windows\System\CfQbyoe.exe
  C:\Windows\System\CfQbyoe.exe
  2⤵
  PID:11872
- C:\Windows\System\eiPnuJE.exe
  C:\Windows\System\eiPnuJE.exe
  2⤵
  PID:10440
- C:\Windows\System\rfHQnms.exe
  C:\Windows\System\rfHQnms.exe
  2⤵
  PID:12064
- C:\Windows\System\AxPfNLM.exe
  C:\Windows\System\AxPfNLM.exe
  2⤵
  PID:8388
- C:\Windows\System\IOKaHde.exe
  C:\Windows\System\IOKaHde.exe
  2⤵
  PID:11508
- C:\Windows\System\udvsSVS.exe
  C:\Windows\System\udvsSVS.exe
  2⤵
  PID:11632
- C:\Windows\System\vfFlExK.exe
  C:\Windows\System\vfFlExK.exe
  2⤵
  PID:10328
- C:\Windows\System\oZNQzYg.exe
  C:\Windows\System\oZNQzYg.exe
  2⤵
  PID:11892
- C:\Windows\System\rDLbLwt.exe
  C:\Windows\System\rDLbLwt.exe
  2⤵
  PID:12312
- C:\Windows\System\CpVSncm.exe
  C:\Windows\System\CpVSncm.exe
  2⤵
  PID:12340
- C:\Windows\System\ZeZmXyq.exe
  C:\Windows\System\ZeZmXyq.exe
  2⤵
  PID:12356
- C:\Windows\System\pcIPXqR.exe
  C:\Windows\System\pcIPXqR.exe
  2⤵
  PID:12376
- C:\Windows\System\cvnOTSM.exe
  C:\Windows\System\cvnOTSM.exe
  2⤵
  PID:12392
- C:\Windows\System\fVhFmTh.exe
  C:\Windows\System\fVhFmTh.exe
  2⤵
  PID:12408
- C:\Windows\System\JOupvgY.exe
  C:\Windows\System\JOupvgY.exe
  2⤵
  PID:12424
- C:\Windows\System\kzsZOhk.exe
  C:\Windows\System\kzsZOhk.exe
  2⤵
  PID:12440
- C:\Windows\System\eMgbXNj.exe
  C:\Windows\System\eMgbXNj.exe
  2⤵
  PID:12456
- C:\Windows\System\BSBqagO.exe
  C:\Windows\System\BSBqagO.exe
  2⤵
  PID:12472
- C:\Windows\System\cVTeMDO.exe
  C:\Windows\System\cVTeMDO.exe
  2⤵
  PID:12496
- C:\Windows\System\TyEYJqM.exe
  C:\Windows\System\TyEYJqM.exe
  2⤵
  PID:12516
- C:\Windows\System\kgXTsoq.exe
  C:\Windows\System\kgXTsoq.exe
  2⤵
  PID:12548
- C:\Windows\System\CGjiASx.exe
  C:\Windows\System\CGjiASx.exe
  2⤵
  PID:12568
- C:\Windows\System\iOsekFs.exe
  C:\Windows\System\iOsekFs.exe
  2⤵
  PID:12588
- C:\Windows\System\OSnLZnh.exe
  C:\Windows\System\OSnLZnh.exe
  2⤵
  PID:12608
- C:\Windows\System\ABdQMWF.exe
  C:\Windows\System\ABdQMWF.exe
  2⤵
  PID:12636
- C:\Windows\System\HTwnMCr.exe
  C:\Windows\System\HTwnMCr.exe
  2⤵
  PID:12660
- C:\Windows\System\ZSZQdYQ.exe
  C:\Windows\System\ZSZQdYQ.exe
  2⤵
  PID:12676
- C:\Windows\System\AOsnZOA.exe
  C:\Windows\System\AOsnZOA.exe
  2⤵
  PID:12700
- C:\Windows\System\dBsoAuc.exe
  C:\Windows\System\dBsoAuc.exe
  2⤵
  PID:12724
- C:\Windows\System\pZaMXwk.exe
  C:\Windows\System\pZaMXwk.exe
  2⤵
  PID:12744
- C:\Windows\System\XfbVxOn.exe
  C:\Windows\System\XfbVxOn.exe
  2⤵
  PID:12760
- C:\Windows\System\pxczUXy.exe
  C:\Windows\System\pxczUXy.exe
  2⤵
  PID:12780
- C:\Windows\System\cvtUDGC.exe
  C:\Windows\System\cvtUDGC.exe
  2⤵
  PID:12800
- C:\Windows\System\asmQWgO.exe
  C:\Windows\System\asmQWgO.exe
  2⤵
  PID:12828
- C:\Windows\System\qTVsxVt.exe
  C:\Windows\System\qTVsxVt.exe
  2⤵
  PID:12844
- C:\Windows\System\SmBIzQY.exe
  C:\Windows\System\SmBIzQY.exe
  2⤵
  PID:13136
- C:\Windows\System\peUhPQx.exe
  C:\Windows\System\peUhPQx.exe
  2⤵
  PID:13156
- C:\Windows\System\vleCnWf.exe
  C:\Windows\System\vleCnWf.exe
  2⤵
  PID:13180
- C:\Windows\System\xQKMZAk.exe
  C:\Windows\System\xQKMZAk.exe
  2⤵
  PID:13204
- C:\Windows\System\PsvPNMJ.exe
  C:\Windows\System\PsvPNMJ.exe
  2⤵
  PID:13232
- C:\Windows\System\gdeeixE.exe
  C:\Windows\System\gdeeixE.exe
  2⤵
  PID:13248
- C:\Windows\System\EmKMbUS.exe
  C:\Windows\System\EmKMbUS.exe
  2⤵
  PID:13268
- C:\Windows\System\wkGwHKR.exe
  C:\Windows\System\wkGwHKR.exe
  2⤵
  PID:13284
- C:\Windows\System\NnmJDaA.exe
  C:\Windows\System\NnmJDaA.exe
  2⤵
  PID:13300
- C:\Windows\System\jBuUmzh.exe
  C:\Windows\System\jBuUmzh.exe
  2⤵
  PID:12276
- C:\Windows\System\TyfpzLH.exe
  C:\Windows\System\TyfpzLH.exe
  2⤵
  PID:10684
- C:\Windows\System\vnpdCHJ.exe
  C:\Windows\System\vnpdCHJ.exe
  2⤵
  PID:11120
- C:\Windows\System\ICkIvmZ.exe
  C:\Windows\System\ICkIvmZ.exe
  2⤵
  PID:11228
- C:\Windows\System\oNDYYpm.exe
  C:\Windows\System\oNDYYpm.exe
  2⤵
  PID:12084
- C:\Windows\System\BkdwwMm.exe
  C:\Windows\System\BkdwwMm.exe
  2⤵
  PID:10492
- C:\Windows\System\BregEEY.exe
  C:\Windows\System\BregEEY.exe
  2⤵
  PID:9288
- C:\Windows\System\QNXdeGE.exe
  C:\Windows\System\QNXdeGE.exe
  2⤵
  PID:13048
- C:\Windows\System\cBWKRdM.exe
  C:\Windows\System\cBWKRdM.exe
  2⤵
  PID:12480
- C:\Windows\System\zIDXEpm.exe
  C:\Windows\System\zIDXEpm.exe
  2⤵
  PID:12692
- C:\Windows\System\pqaMUAb.exe
  C:\Windows\System\pqaMUAb.exe
  2⤵
  PID:13212
- C:\Windows\System\vrjhhhX.exe
  C:\Windows\System\vrjhhhX.exe
  2⤵
  PID:9188
- C:\Windows\System\xkSizlD.exe
  C:\Windows\System\xkSizlD.exe
  2⤵
  PID:12812
- C:\Windows\System\tXMoBxW.exe
  C:\Windows\System\tXMoBxW.exe
  2⤵
  PID:12372
- C:\Windows\System\KuWCEaa.exe
  C:\Windows\System\KuWCEaa.exe
  2⤵
  PID:12168
- C:\Windows\System\ouUmgEC.exe
  C:\Windows\System\ouUmgEC.exe
  2⤵
  PID:13244
- C:\Windows\System\LuUzqAN.exe
  C:\Windows\System\LuUzqAN.exe
  2⤵
  PID:9424
- C:\Windows\System\vfWyrnt.exe
  C:\Windows\System\vfWyrnt.exe
  2⤵
  PID:10380
- C:\Windows\System\htHmMaj.exe
  C:\Windows\System\htHmMaj.exe
  2⤵
  PID:11644
- C:\Windows\System\KErjGEm.exe
  C:\Windows\System\KErjGEm.exe
  2⤵
  PID:12180
- C:\Windows\System\QDNCaXl.exe
  C:\Windows\System\QDNCaXl.exe
  2⤵
  PID:13152
- C:\Windows\System\oQpFhsR.exe
  C:\Windows\System\oQpFhsR.exe
  2⤵
  PID:12492
- C:\Windows\System\fOCOxNY.exe
  C:\Windows\System\fOCOxNY.exe
  2⤵
  PID:13148
- C:\Windows\System\HdexRzb.exe
  C:\Windows\System\HdexRzb.exe
  2⤵
  PID:9932
- C:\Windows\System\CTPbtXG.exe
  C:\Windows\System\CTPbtXG.exe
  2⤵
  PID:12004
- C:\Windows\System\BJHPtys.exe
  C:\Windows\System\BJHPtys.exe
  2⤵
  PID:10604
- C:\Windows\System\kbQhltb.exe
  C:\Windows\System\kbQhltb.exe
  2⤵
  PID:13164
- C:\Windows\System\srPGWaM.exe
  C:\Windows\System\srPGWaM.exe
  2⤵
  PID:11888
- C:\Windows\System\cstDhun.exe
  C:\Windows\System\cstDhun.exe
  2⤵
  PID:12368
- C:\Windows\System\IjbVWQU.exe
  C:\Windows\System\IjbVWQU.exe
  2⤵
  PID:11560
- C:\Windows\System\LTsYDzR.exe
  C:\Windows\System\LTsYDzR.exe
  2⤵
  PID:12416
- C:\Windows\System\McwuIbU.exe
  C:\Windows\System\McwuIbU.exe
  2⤵
  PID:4224
- C:\Windows\System\zhBCJrV.exe
  C:\Windows\System\zhBCJrV.exe
  2⤵
  PID:4060
- C:\Windows\System\dMqgkIr.exe
  C:\Windows\System\dMqgkIr.exe
  2⤵
  PID:12404
- C:\Windows\System\WKrPzsc.exe
  C:\Windows\System\WKrPzsc.exe
  2⤵
  PID:4792
- C:\Windows\System\hxoJyop.exe
  C:\Windows\System\hxoJyop.exe
  2⤵
  PID:13332
- C:\Windows\System\lmLHswG.exe
  C:\Windows\System\lmLHswG.exe
  2⤵
  PID:13352
- C:\Windows\System\wPqMhym.exe
  C:\Windows\System\wPqMhym.exe
  2⤵
  PID:13376
- C:\Windows\System\vkDUaeh.exe
  C:\Windows\System\vkDUaeh.exe
  2⤵
  PID:13392
- C:\Windows\System\BHjphNC.exe
  C:\Windows\System\BHjphNC.exe
  2⤵
  PID:13408
- C:\Windows\System\LZXksvG.exe
  C:\Windows\System\LZXksvG.exe
  2⤵
  PID:13436
- C:\Windows\System\GLEBORx.exe
  C:\Windows\System\GLEBORx.exe
  2⤵
  PID:13452
- C:\Windows\System\ElTPFyw.exe
  C:\Windows\System\ElTPFyw.exe
  2⤵
  PID:13468
- C:\Windows\System\AkfDwdx.exe
  C:\Windows\System\AkfDwdx.exe
  2⤵
  PID:13484
- C:\Windows\System\dwYFgAQ.exe
  C:\Windows\System\dwYFgAQ.exe
  2⤵
  PID:13500
- C:\Windows\System\yPYoPqq.exe
  C:\Windows\System\yPYoPqq.exe
  2⤵
  PID:13516
- C:\Windows\System\Odcuxpr.exe
  C:\Windows\System\Odcuxpr.exe
  2⤵
  PID:13544
- C:\Windows\System\EOaUxoU.exe
  C:\Windows\System\EOaUxoU.exe
  2⤵
  PID:13564
- C:\Windows\System\DVtSkhD.exe
  C:\Windows\System\DVtSkhD.exe
  2⤵
  PID:13700
- C:\Windows\System\dKJpfXp.exe
  C:\Windows\System\dKJpfXp.exe
  2⤵
  PID:13736
- C:\Windows\System\cLiFkUR.exe
  C:\Windows\System\cLiFkUR.exe
  2⤵
  PID:13864
- C:\Windows\System\omxGrST.exe
  C:\Windows\System\omxGrST.exe
  2⤵
  PID:11680
- C:\Windows\System\ZyyEbVe.exe
  C:\Windows\System\ZyyEbVe.exe
  2⤵
  PID:11988
- C:\Windows\System\hBrFRGO.exe
  C:\Windows\System\hBrFRGO.exe
  2⤵
  PID:4488
- C:\Windows\System\klHdkXZ.exe
  C:\Windows\System\klHdkXZ.exe
  2⤵
  PID:12880
- C:\Windows\System\wIfgZSZ.exe
  C:\Windows\System\wIfgZSZ.exe
  2⤵
  PID:12836
- C:\Windows\System\EolVYfe.exe
  C:\Windows\System\EolVYfe.exe
  2⤵
  PID:11836
- C:\Windows\System\JtIYnJy.exe
  C:\Windows\System\JtIYnJy.exe
  2⤵
  PID:13324
- C:\Windows\System\DboSQhq.exe
  C:\Windows\System\DboSQhq.exe
  2⤵
  PID:13240
- C:\Windows\System\Escttzs.exe
  C:\Windows\System\Escttzs.exe
  2⤵
  PID:4760
- C:\Windows\System\hdOndYS.exe
  C:\Windows\System\hdOndYS.exe
  2⤵
  PID:4272
- C:\Windows\System\PAeBlMy.exe
  C:\Windows\System\PAeBlMy.exe
  2⤵
  PID:13344
- C:\Windows\System\NEFMAUO.exe
  C:\Windows\System\NEFMAUO.exe
  2⤵
  PID:5180
- C:\Windows\System\mwBJTBW.exe
  C:\Windows\System\mwBJTBW.exe
  2⤵
  PID:5124
- C:\Windows\System\IKadyBU.exe
  C:\Windows\System\IKadyBU.exe
  2⤵
  PID:5632
- C:\Windows\System\tcqiYnl.exe
  C:\Windows\System\tcqiYnl.exe
  2⤵
  PID:1180
- C:\Windows\System\RqSEDyn.exe
  C:\Windows\System\RqSEDyn.exe
  2⤵
  PID:4752
- C:\Windows\System\RogkfGm.exe
  C:\Windows\System\RogkfGm.exe
  2⤵
  PID:11752
- C:\Windows\System\GBdgsZL.exe
  C:\Windows\System\GBdgsZL.exe
  2⤵
  PID:13720
- C:\Windows\System\GlQefpf.exe
  C:\Windows\System\GlQefpf.exe
  2⤵
  PID:13616
- C:\Windows\System\ctcgSmX.exe
  C:\Windows\System\ctcgSmX.exe
  2⤵
  PID:13640
- C:\Windows\System\LWMAGME.exe
  C:\Windows\System\LWMAGME.exe
  2⤵
  PID:13664
- C:\Windows\System\FpWJTwO.exe
  C:\Windows\System\FpWJTwO.exe
  2⤵
  PID:13688
- C:\Windows\System\mcFbMSE.exe
  C:\Windows\System\mcFbMSE.exe
  2⤵
  PID:13756
- C:\Windows\System\LdJHOmb.exe
  C:\Windows\System\LdJHOmb.exe
  2⤵
  PID:13780
- C:\Windows\System\ZZKfmsP.exe
  C:\Windows\System\ZZKfmsP.exe
  2⤵
  PID:13836
- C:\Windows\System\YCAxXeS.exe
  C:\Windows\System\YCAxXeS.exe
  2⤵
  PID:4004
- C:\Windows\System\kzNAkFG.exe
  C:\Windows\System\kzNAkFG.exe
  2⤵
  PID:4848
- C:\Windows\System\gLZuJnu.exe
  C:\Windows\System\gLZuJnu.exe
  2⤵
  PID:6388
- C:\Windows\System\XylRPUd.exe
  C:\Windows\System\XylRPUd.exe
  2⤵
  PID:14252
- C:\Windows\System\aSmEkeI.exe
  C:\Windows\System\aSmEkeI.exe
  2⤵
  PID:14276
- C:\Windows\System\ncdNiha.exe
  C:\Windows\System\ncdNiha.exe
  2⤵
  PID:14304
- C:\Windows\System\OhYFMtp.exe
  C:\Windows\System\OhYFMtp.exe
  2⤵
  PID:3776
- C:\Windows\System\OULZeaw.exe
  C:\Windows\System\OULZeaw.exe
  2⤵
  PID:14204
- C:\Windows\System\qYpmECH.exe
  C:\Windows\System\qYpmECH.exe
  2⤵
  PID:14228
- C:\Windows\System\PFRHtfj.exe
  C:\Windows\System\PFRHtfj.exe
  2⤵
  PID:3876
- C:\Windows\System\ooZYwsa.exe
  C:\Windows\System\ooZYwsa.exe
  2⤵
  PID:1624
- C:\Windows\System\KALLCPh.exe
  C:\Windows\System\KALLCPh.exe
  2⤵
  PID:5104
- C:\Windows\System\TRjLVkV.exe
  C:\Windows\System\TRjLVkV.exe
  2⤵
  PID:3092
- C:\Windows\System\GlfBvAC.exe
  C:\Windows\System\GlfBvAC.exe
  2⤵
  PID:5864
- C:\Windows\System\pttLQtJ.exe
  C:\Windows\System\pttLQtJ.exe
  2⤵
  PID:13424
- C:\Windows\System\qeMRNDa.exe
  C:\Windows\System\qeMRNDa.exe
  2⤵
  PID:6060
- C:\Windows\System\LWWoItq.exe
  C:\Windows\System\LWWoItq.exe
  2⤵
  PID:5848
- C:\Windows\System\FuxWgke.exe
  C:\Windows\System\FuxWgke.exe
  2⤵
  PID:6992
- C:\Windows\System\PcVbgzb.exe
  C:\Windows\System\PcVbgzb.exe
  2⤵
  PID:5036
- C:\Windows\System\Hjjsvbf.exe
  C:\Windows\System\Hjjsvbf.exe
  2⤵
  PID:5056
- C:\Windows\System\YjVkMsM.exe
  C:\Windows\System\YjVkMsM.exe
  2⤵
  PID:11004
- C:\Windows\System\bLKyvVI.exe
  C:\Windows\System\bLKyvVI.exe
  2⤵
  PID:5804
- C:\Windows\System\NjYUVLK.exe
  C:\Windows\System\NjYUVLK.exe
  2⤵
  PID:7860
- C:\Windows\System\NRbUOxF.exe
  C:\Windows\System\NRbUOxF.exe
  2⤵
  PID:13636
- C:\Windows\System\qNGwcxf.exe
  C:\Windows\System\qNGwcxf.exe
  2⤵
  PID:13612
- C:\Windows\System\ZffKhwd.exe
  C:\Windows\System\ZffKhwd.exe
  2⤵
  PID:13792
- C:\Windows\System\kKUWjnB.exe
  C:\Windows\System\kKUWjnB.exe
  2⤵
  PID:7220
- C:\Windows\System\ohbnpHI.exe
  C:\Windows\System\ohbnpHI.exe
  2⤵
  PID:14332
- C:\Windows\System\SjZxilO.exe
  C:\Windows\System\SjZxilO.exe
  2⤵
  PID:3756
- C:\Windows\System\mHhCmNG.exe
  C:\Windows\System\mHhCmNG.exe
  2⤵
  PID:4264
- C:\Windows\System\TtjVuOx.exe
  C:\Windows\System\TtjVuOx.exe
  2⤵
  PID:12960
- C:\Windows\System\ZyMRCAB.exe
  C:\Windows\System\ZyMRCAB.exe
  2⤵
  PID:5252
- C:\Windows\System\TudezCA.exe
  C:\Windows\System\TudezCA.exe
  2⤵
  PID:5564
- C:\Windows\System\TsIcZDB.exe
  C:\Windows\System\TsIcZDB.exe
  2⤵
  PID:2324
- C:\Windows\System\jyRkLTt.exe
  C:\Windows\System\jyRkLTt.exe
  2⤵
  PID:2836
- C:\Windows\System\NsrBiJY.exe
  C:\Windows\System\NsrBiJY.exe
  2⤵
  PID:2964
- C:\Windows\System\YxyrTdA.exe
  C:\Windows\System\YxyrTdA.exe
  2⤵
  PID:13576
- C:\Windows\System\DMNUZOg.exe
  C:\Windows\System\DMNUZOg.exe
  2⤵
  PID:1228
- C:\Windows\System\DDyLCdX.exe
  C:\Windows\System\DDyLCdX.exe
  2⤵
  PID:6528
- C:\Windows\System\PveWiYO.exe
  C:\Windows\System\PveWiYO.exe
  2⤵
  PID:4604
- C:\Windows\System\tskYwpz.exe
  C:\Windows\System\tskYwpz.exe
  2⤵
  PID:7720
- C:\Windows\System\FQrewQI.exe
  C:\Windows\System\FQrewQI.exe
  2⤵
  PID:11856
- C:\Windows\System\CIdeXGK.exe
  C:\Windows\System\CIdeXGK.exe
  2⤵
  PID:6048
- C:\Windows\System\gLokQyB.exe
  C:\Windows\System\gLokQyB.exe
  2⤵
  PID:6580
- C:\Windows\System\iYACyNx.exe
  C:\Windows\System\iYACyNx.exe
  2⤵
  PID:7396
- C:\Windows\System\ecgMpuM.exe
  C:\Windows\System\ecgMpuM.exe
  2⤵
  PID:7440
- C:\Windows\System\FdZKRes.exe
  C:\Windows\System\FdZKRes.exe
  2⤵
  PID:7312
- C:\Windows\System\LGkBTSY.exe
  C:\Windows\System\LGkBTSY.exe
  2⤵
  PID:1060
- C:\Windows\System\kWhgvmM.exe
  C:\Windows\System\kWhgvmM.exe
  2⤵
  PID:3660
- C:\Windows\System\fltYWeI.exe
  C:\Windows\System\fltYWeI.exe
  2⤵
  PID:7668
- C:\Windows\System\StIkCdf.exe
  C:\Windows\System\StIkCdf.exe
  2⤵
  PID:7796
- C:\Windows\System\ytSbJgZ.exe
  C:\Windows\System\ytSbJgZ.exe
  2⤵
  PID:5292
- C:\Windows\System\VjidQJT.exe
  C:\Windows\System\VjidQJT.exe
  2⤵
  PID:7820
- C:\Windows\System\kPlXUfR.exe
  C:\Windows\System\kPlXUfR.exe
  2⤵
  PID:7884
- C:\Windows\System\mKqqEvd.exe
  C:\Windows\System\mKqqEvd.exe
  2⤵
  PID:13744
- C:\Windows\System\EHTAYjM.exe
  C:\Windows\System\EHTAYjM.exe
  2⤵
  PID:7328
- C:\Windows\System\WQmqSgk.exe
  C:\Windows\System\WQmqSgk.exe
  2⤵
  PID:9768
- C:\Windows\System\QIYoxpS.exe
  C:\Windows\System\QIYoxpS.exe
  2⤵
  PID:7536
- C:\Windows\System\MngghQz.exe
  C:\Windows\System\MngghQz.exe
  2⤵
  PID:5952
- C:\Windows\System\CSuPJPI.exe
  C:\Windows\System\CSuPJPI.exe
  2⤵
  PID:5296
- C:\Windows\System\VtSYXJP.exe
  C:\Windows\System\VtSYXJP.exe
  2⤵
  PID:3972
- C:\Windows\System\pScOYMP.exe
  C:\Windows\System\pScOYMP.exe
  2⤵
  PID:2504
- C:\Windows\System\ontilrO.exe
  C:\Windows\System\ontilrO.exe
  2⤵
  PID:12840
- C:\Windows\System\pBSMdkZ.exe
  C:\Windows\System\pBSMdkZ.exe
  2⤵
  PID:3048
- C:\Windows\System\NdZpSYL.exe
  C:\Windows\System\NdZpSYL.exe
  2⤵
  PID:11328
- C:\Windows\System\TPUpJLF.exe
  C:\Windows\System\TPUpJLF.exe
  2⤵
  PID:13260
- C:\Windows\System\klIsupp.exe
  C:\Windows\System\klIsupp.exe
  2⤵
  PID:14268
- C:\Windows\System\mZGULTg.exe
  C:\Windows\System\mZGULTg.exe
  2⤵
  PID:5460
- C:\Windows\System\kmSfNTh.exe
  C:\Windows\System\kmSfNTh.exe
  2⤵
  PID:5188
- C:\Windows\System\txmvnAk.exe
  C:\Windows\System\txmvnAk.exe
  2⤵
  PID:3104
- C:\Windows\System\LesaqfT.exe
  C:\Windows\System\LesaqfT.exe
  2⤵
  PID:2888
- C:\Windows\System\bEctWLB.exe
  C:\Windows\System\bEctWLB.exe
  2⤵
  PID:13444
- C:\Windows\System\oSfnkmA.exe
  C:\Windows\System\oSfnkmA.exe
  2⤵
  PID:5672
- C:\Windows\System\KcDELyY.exe
  C:\Windows\System\KcDELyY.exe
  2⤵
  PID:13432
- C:\Windows\System\ouuXrem.exe
  C:\Windows\System\ouuXrem.exe
  2⤵
  PID:5956
- C:\Windows\System\HuYMCSx.exe
  C:\Windows\System\HuYMCSx.exe
  2⤵
  PID:13508
- C:\Windows\System\mOPINWj.exe
  C:\Windows\System\mOPINWj.exe
  2⤵
  PID:4556
- C:\Windows\System\HBbHxic.exe
  C:\Windows\System\HBbHxic.exe
  2⤵
  PID:13952
- C:\Windows\System\qyapRCv.exe
  C:\Windows\System\qyapRCv.exe
  2⤵
  PID:5996
- C:\Windows\System\pTWjxoI.exe
  C:\Windows\System\pTWjxoI.exe
  2⤵
  PID:4732
- C:\Windows\System\xKcMrCG.exe
  C:\Windows\System\xKcMrCG.exe
  2⤵
  PID:5268
- C:\Windows\System\sEPBQCl.exe
  C:\Windows\System\sEPBQCl.exe
  2⤵
  PID:7372
- C:\Windows\System\EvZVawY.exe
  C:\Windows\System\EvZVawY.exe
  2⤵
  PID:5396
- C:\Windows\System\NveyoLZ.exe
  C:\Windows\System\NveyoLZ.exe
  2⤵
  PID:3248
- C:\Windows\System\iTwiYeG.exe
  C:\Windows\System\iTwiYeG.exe
  2⤵
  PID:3828
- C:\Windows\System\wCOmlUc.exe
  C:\Windows\System\wCOmlUc.exe
  2⤵
  PID:4972
- C:\Windows\System\cGCZUGv.exe
  C:\Windows\System\cGCZUGv.exe
  2⤵
  PID:5972
- C:\Windows\System\hhRXmcR.exe
  C:\Windows\System\hhRXmcR.exe
  2⤵
  PID:5276
- C:\Windows\System\fYjyYva.exe
  C:\Windows\System\fYjyYva.exe
  2⤵
  PID:5652
- C:\Windows\System\YTnYBLJ.exe
  C:\Windows\System\YTnYBLJ.exe
  2⤵
  PID:7316
- C:\Windows\System\EMaZMbm.exe
  C:\Windows\System\EMaZMbm.exe
  2⤵
  PID:4776
- C:\Windows\System\jELWWKJ.exe
  C:\Windows\System\jELWWKJ.exe
  2⤵
  PID:7232
- C:\Windows\System\ClYhMsw.exe
  C:\Windows\System\ClYhMsw.exe
  2⤵
  PID:6564
- C:\Windows\System\bzbKLNi.exe
  C:\Windows\System\bzbKLNi.exe
  2⤵
  PID:5596
- C:\Windows\System\PuJzIxz.exe
  C:\Windows\System\PuJzIxz.exe
  2⤵
  PID:6064
- C:\Windows\System\dMNFsMe.exe
  C:\Windows\System\dMNFsMe.exe
  2⤵
  PID:6240
- C:\Windows\System\XcKPYzU.exe
  C:\Windows\System\XcKPYzU.exe
  2⤵
  PID:5484
- C:\Windows\System\VZeMxyr.exe
  C:\Windows\System\VZeMxyr.exe
  2⤵
  PID:6312
- C:\Windows\System\ZazhLaH.exe
  C:\Windows\System\ZazhLaH.exe
  2⤵
  PID:6576
- C:\Windows\System\PQcliwC.exe
  C:\Windows\System\PQcliwC.exe
  2⤵
  PID:6376
- C:\Windows\System\VOPqgEL.exe
  C:\Windows\System\VOPqgEL.exe
  2⤵
  PID:6556
- C:\Windows\System\GFWANPp.exe
  C:\Windows\System\GFWANPp.exe
  2⤵
  PID:5372
- C:\Windows\System\rVSQkme.exe
  C:\Windows\System\rVSQkme.exe
  2⤵
  PID:7852
- C:\Windows\System\yVeIQvl.exe
  C:\Windows\System\yVeIQvl.exe
  2⤵
  PID:6292
- C:\Windows\System\shLOLRR.exe
  C:\Windows\System\shLOLRR.exe
  2⤵
  PID:5588
- C:\Windows\System\AmciWpU.exe
  C:\Windows\System\AmciWpU.exe
  2⤵
  PID:4268
- C:\Windows\System\AhaPPDD.exe
  C:\Windows\System\AhaPPDD.exe
  2⤵
  PID:2584
- C:\Windows\System\LxkHLfg.exe
  C:\Windows\System\LxkHLfg.exe
  2⤵
  PID:7832
- C:\Windows\System\EtEJccr.exe
  C:\Windows\System\EtEJccr.exe
  2⤵
  PID:7876
- C:\Windows\System\NJtEaLt.exe
  C:\Windows\System\NJtEaLt.exe
  2⤵
  PID:14244
- C:\Windows\System\aWPHiqw.exe
  C:\Windows\System\aWPHiqw.exe
  2⤵
  PID:1092
- C:\Windows\System\yZgQGjW.exe
  C:\Windows\System\yZgQGjW.exe
  2⤵
  PID:6836
- C:\Windows\System\oFShUBU.exe
  C:\Windows\System\oFShUBU.exe
  2⤵
  PID:6668
- C:\Windows\System\aHhdFXJ.exe
  C:\Windows\System\aHhdFXJ.exe
  2⤵
  PID:5628
- C:\Windows\System\PNIwjKd.exe
  C:\Windows\System\PNIwjKd.exe
  2⤵
  PID:6804
- C:\Windows\System\gVvCLvZ.exe
  C:\Windows\System\gVvCLvZ.exe
  2⤵
  PID:13816
- C:\Windows\System\JkhkCVX.exe
  C:\Windows\System\JkhkCVX.exe
  2⤵
  PID:5260
- C:\Windows\System\lnvelMb.exe
  C:\Windows\System\lnvelMb.exe
  2⤵
  PID:14164
- C:\Windows\System\MsVKgQl.exe
  C:\Windows\System\MsVKgQl.exe
  2⤵
  PID:10048
- C:\Windows\System\fRPvcsu.exe
  C:\Windows\System\fRPvcsu.exe
  2⤵
  PID:6560
- C:\Windows\System\ogvsVHe.exe
  C:\Windows\System\ogvsVHe.exe
  2⤵
  PID:7648
- C:\Windows\System\uitjuDt.exe
  C:\Windows\System\uitjuDt.exe
  2⤵
  PID:9716
- C:\Windows\System\nzknFFI.exe
  C:\Windows\System\nzknFFI.exe
  2⤵
  PID:1380
- C:\Windows\System\WkvvXgL.exe
  C:\Windows\System\WkvvXgL.exe
  2⤵
  PID:3060
- C:\Windows\System\uLLoAWM.exe
  C:\Windows\System\uLLoAWM.exe
  2⤵
  PID:7624
- C:\Windows\System\AOKLhgT.exe
  C:\Windows\System\AOKLhgT.exe
  2⤵
  PID:12536
- C:\Windows\System\yclDthl.exe
  C:\Windows\System\yclDthl.exe
  2⤵
  PID:6496
- C:\Windows\System\yHsepsm.exe
  C:\Windows\System\yHsepsm.exe
  2⤵
  PID:4892
- C:\Windows\System\gMRKpPw.exe
  C:\Windows\System\gMRKpPw.exe
  2⤵
  PID:12604
- C:\Windows\System\hJEwzbt.exe
  C:\Windows\System\hJEwzbt.exe
  2⤵
  PID:3416
- C:\Windows\System\ggAHYdn.exe
  C:\Windows\System\ggAHYdn.exe
  2⤵
  PID:6900
- C:\Windows\System\PerMZcE.exe
  C:\Windows\System\PerMZcE.exe
  2⤵
  PID:6956
- C:\Windows\System\qnigczk.exe
  C:\Windows\System\qnigczk.exe
  2⤵
  PID:7036
- C:\Windows\System\LDuINMZ.exe
  C:\Windows\System\LDuINMZ.exe
  2⤵
  PID:13036
- C:\Windows\System\MEvLojL.exe
  C:\Windows\System\MEvLojL.exe
  2⤵
  PID:12900
- C:\Windows\System\gYSYybP.exe
  C:\Windows\System\gYSYybP.exe
  2⤵
  PID:216
- C:\Windows\System\VSgpQhe.exe
  C:\Windows\System\VSgpQhe.exe
  2⤵
  PID:6976
- C:\Windows\System\UGVSous.exe
  C:\Windows\System\UGVSous.exe
  2⤵
  PID:14340
- C:\Windows\System\LkJfXjY.exe
  C:\Windows\System\LkJfXjY.exe
  2⤵
  PID:14360
- C:\Windows\System\zaLwIiP.exe
  C:\Windows\System\zaLwIiP.exe
  2⤵
  PID:14376
- C:\Windows\System\bNhNyAc.exe
  C:\Windows\System\bNhNyAc.exe
  2⤵
  PID:14396
- C:\Windows\System\RCQjSNy.exe
  C:\Windows\System\RCQjSNy.exe
  2⤵
  PID:14416
- C:\Windows\System\JjamsYO.exe
  C:\Windows\System\JjamsYO.exe
  2⤵
  PID:14432
- C:\Windows\System\fUSbCgX.exe
  C:\Windows\System\fUSbCgX.exe
  2⤵
  PID:14456
- C:\Windows\System\eIXXpGT.exe
  C:\Windows\System\eIXXpGT.exe
  2⤵
  PID:14560
- C:\Windows\System\rEVEvSG.exe
  C:\Windows\System\rEVEvSG.exe
  2⤵
  PID:14840
- C:\Windows\System\ZHHMQQu.exe
  C:\Windows\System\ZHHMQQu.exe
  2⤵
  PID:15260
- C:\Windows\System\HUKWtUz.exe
  C:\Windows\System\HUKWtUz.exe
  2⤵
  PID:15284
- C:\Windows\System\vzLXIMR.exe
  C:\Windows\System\vzLXIMR.exe
  2⤵
  PID:15316
- C:\Windows\System\quQvXRO.exe
  C:\Windows\System\quQvXRO.exe
  2⤵
  PID:15340
- C:\Windows\System\HvkTuPD.exe
  C:\Windows\System\HvkTuPD.exe
  2⤵
  PID:6508
- C:\Windows\System\CMZOUYW.exe
  C:\Windows\System\CMZOUYW.exe
  2⤵
  PID:6236
- C:\Windows\System\KyDBAPo.exe
  C:\Windows\System\KyDBAPo.exe
  2⤵
  PID:728
- C:\Windows\System\XJzqJzq.exe
  C:\Windows\System\XJzqJzq.exe
  2⤵
  PID:7132
- C:\Windows\System\hEVirdb.exe
  C:\Windows\System\hEVirdb.exe
  2⤵
  PID:6776
- C:\Windows\System\BclSzRK.exe
  C:\Windows\System\BclSzRK.exe
  2⤵
  PID:5828
- C:\Windows\System\eKcifFZ.exe
  C:\Windows\System\eKcifFZ.exe
  2⤵
  PID:1968
- C:\Windows\System\TkRCETQ.exe
  C:\Windows\System\TkRCETQ.exe
  2⤵
  PID:1836
- C:\Windows\System\LvUewwg.exe
  C:\Windows\System\LvUewwg.exe
  2⤵
  PID:14404
- C:\Windows\System\jtZHWpV.exe
  C:\Windows\System\jtZHWpV.exe
  2⤵
  PID:14424
- C:\Windows\System\nhmKvzF.exe
  C:\Windows\System\nhmKvzF.exe
  2⤵
  PID:6732
- C:\Windows\System\LSeMRdU.exe
  C:\Windows\System\LSeMRdU.exe
  2⤵
  PID:6696
- C:\Windows\System\SjdEjzP.exe
  C:\Windows\System\SjdEjzP.exe
  2⤵
  PID:5616
- C:\Windows\System\BwEiMbn.exe
  C:\Windows\System\BwEiMbn.exe
  2⤵
  PID:12184
- C:\Windows\System\JhymKdy.exe
  C:\Windows\System\JhymKdy.exe
  2⤵
  PID:7320
- C:\Windows\System\iWdjXIh.exe
  C:\Windows\System\iWdjXIh.exe
  2⤵
  PID:12236
- C:\Windows\System\ijWyoza.exe
  C:\Windows\System\ijWyoza.exe
  2⤵
  PID:14388
- C:\Windows\System\CzbLNYM.exe
  C:\Windows\System\CzbLNYM.exe
  2⤵
  PID:14224
- C:\Windows\System\JnhDqlE.exe
  C:\Windows\System\JnhDqlE.exe
  2⤵
  PID:3632
- C:\Windows\System\lCioKnZ.exe
  C:\Windows\System\lCioKnZ.exe
  2⤵
  PID:6448
- C:\Windows\System\NhQHlCl.exe
  C:\Windows\System\NhQHlCl.exe
  2⤵
  PID:6652
- C:\Windows\System\nMWzMWv.exe
  C:\Windows\System\nMWzMWv.exe
  2⤵
  PID:3752
- C:\Windows\System\wjOdJni.exe
  C:\Windows\System\wjOdJni.exe
  2⤵
  PID:4508
- C:\Windows\System\vgeigPt.exe
  C:\Windows\System\vgeigPt.exe
  2⤵
  PID:4388
- C:\Windows\System\vPlgvPl.exe
  C:\Windows\System\vPlgvPl.exe
  2⤵
  PID:7640
- C:\Windows\System\kGyIMRA.exe
  C:\Windows\System\kGyIMRA.exe
  2⤵
  PID:7352
- C:\Windows\System\aDaOTSe.exe
  C:\Windows\System\aDaOTSe.exe
  2⤵
  PID:6348
- C:\Windows\System\WuTOYda.exe
  C:\Windows\System\WuTOYda.exe
  2⤵
  PID:14368
- C:\Windows\System\oxnLeny.exe
  C:\Windows\System\oxnLeny.exe
  2⤵
  PID:14548
- C:\Windows\System\IVbUrkP.exe
  C:\Windows\System\IVbUrkP.exe
  2⤵
  PID:14496
- C:\Windows\System\jbzyzHl.exe
  C:\Windows\System\jbzyzHl.exe
  2⤵
  PID:14476
- C:\Windows\System\RoRATyu.exe
  C:\Windows\System\RoRATyu.exe
  2⤵
  PID:13460
- C:\Windows\System\dfKflji.exe
  C:\Windows\System\dfKflji.exe
  2⤵
  PID:7248
- C:\Windows\System\FrrPJME.exe
  C:\Windows\System\FrrPJME.exe
  2⤵
  PID:6748
- C:\Windows\System\zuOxyRe.exe
  C:\Windows\System\zuOxyRe.exe
  2⤵
  PID:8036
- C:\Windows\System\SgsycVX.exe
  C:\Windows\System\SgsycVX.exe
  2⤵
  PID:14644
- C:\Windows\System\bYGrKrz.exe
  C:\Windows\System\bYGrKrz.exe
  2⤵
  PID:7528
- C:\Windows\System\nLIHfrz.exe
  C:\Windows\System\nLIHfrz.exe
  2⤵
  PID:14712
- C:\Windows\System\patKYPg.exe
  C:\Windows\System\patKYPg.exe
  2⤵
  PID:14736
- C:\Windows\System\BOayqoD.exe
  C:\Windows\System\BOayqoD.exe
  2⤵
  PID:14768
- C:\Windows\System\CdxSABs.exe
  C:\Windows\System\CdxSABs.exe
  2⤵
  PID:7484
- C:\Windows\System\NuZESNK.exe
  C:\Windows\System\NuZESNK.exe
  2⤵
  PID:14948
- C:\Windows\System\qYPqQgZ.exe
  C:\Windows\System\qYPqQgZ.exe
  2⤵
  PID:8688
- C:\Windows\System\GCXtcFO.exe
  C:\Windows\System\GCXtcFO.exe
  2⤵
  PID:14720
- C:\Windows\System\IznUkNJ.exe
  C:\Windows\System\IznUkNJ.exe
  2⤵
  PID:14732
- C:\Windows\System\dXQfNiZ.exe
  C:\Windows\System\dXQfNiZ.exe
  2⤵
  PID:14756
- C:\Windows\System\SXeWUoC.exe
  C:\Windows\System\SXeWUoC.exe
  2⤵
  PID:15080
- C:\Windows\System\PggnphW.exe
  C:\Windows\System\PggnphW.exe
  2⤵
  PID:15276
- C:\Windows\System\QNvCBRr.exe
  C:\Windows\System\QNvCBRr.exe
  2⤵
  PID:9244
- C:\Windows\System\quhSVRA.exe
  C:\Windows\System\quhSVRA.exe
  2⤵
  PID:15336
- C:\Windows\System\sZaBPcE.exe
  C:\Windows\System\sZaBPcE.exe
  2⤵
  PID:13856
- C:\Windows\System\YWNTdnL.exe
  C:\Windows\System\YWNTdnL.exe
  2⤵
  PID:9860
- C:\Windows\System\LgiCNum.exe
  C:\Windows\System\LgiCNum.exe
  2⤵
  PID:8780
- C:\Windows\System\CRiHqOo.exe
  C:\Windows\System\CRiHqOo.exe
  2⤵
  PID:3900
- C:\Windows\System\PNMsebt.exe
  C:\Windows\System\PNMsebt.exe
  2⤵
  PID:8032
- C:\Windows\System\cXhvAaJ.exe
  C:\Windows\System\cXhvAaJ.exe
  2⤵
  PID:12560
- C:\Windows\System\LJmNGAE.exe
  C:\Windows\System\LJmNGAE.exe
  2⤵
  PID:12576
- C:\Windows\System\OBBYngT.exe
  C:\Windows\System\OBBYngT.exe
  2⤵
  PID:2296
- C:\Windows\System\aZWxUXk.exe
  C:\Windows\System\aZWxUXk.exe
  2⤵
  PID:12332
- C:\Windows\System\CsXsNAf.exe
  C:\Windows\System\CsXsNAf.exe
  2⤵
  PID:14448
- C:\Windows\System\ZTsyIMO.exe
  C:\Windows\System\ZTsyIMO.exe
  2⤵
  PID:15268
- C:\Windows\System\KadbHlC.exe
  C:\Windows\System\KadbHlC.exe
  2⤵
  PID:8716
- C:\Windows\System\RzbZgoD.exe
  C:\Windows\System\RzbZgoD.exe
  2⤵
  PID:1984
- C:\Windows\System\RvasBQc.exe
  C:\Windows\System\RvasBQc.exe
  2⤵
  PID:7340
- C:\Windows\System\poLTRRD.exe
  C:\Windows\System\poLTRRD.exe
  2⤵
  PID:5312
- C:\Windows\System\KkQrSkt.exe
  C:\Windows\System\KkQrSkt.exe
  2⤵
  PID:6880
- C:\Windows\System\jZRzlWK.exe
  C:\Windows\System\jZRzlWK.exe
  2⤵
  PID:7236
- C:\Windows\System\BkhyZMG.exe
  C:\Windows\System\BkhyZMG.exe
  2⤵
  PID:1028
- C:\Windows\System\OjJwRDd.exe
  C:\Windows\System\OjJwRDd.exe
  2⤵
  PID:7560
- C:\Windows\System\ExrLGdu.exe
  C:\Windows\System\ExrLGdu.exe
  2⤵
  PID:6684
- C:\Windows\System\uJrjEpf.exe
  C:\Windows\System\uJrjEpf.exe
  2⤵
  PID:8096
- C:\Windows\System\JnQqnJm.exe
  C:\Windows\System\JnQqnJm.exe
  2⤵
  PID:10848
- C:\Windows\System\kAyqynP.exe
  C:\Windows\System\kAyqynP.exe
  2⤵
  PID:10112
- C:\Windows\System\ElqrKdR.exe
  C:\Windows\System\ElqrKdR.exe
  2⤵
  PID:4432
- C:\Windows\System\ONXPjvb.exe
  C:\Windows\System\ONXPjvb.exe
  2⤵
  PID:9592
- C:\Windows\System\OgZAKho.exe
  C:\Windows\System\OgZAKho.exe
  2⤵
  PID:1120
- C:\Windows\System\YlwUquA.exe
  C:\Windows\System\YlwUquA.exe
  2⤵
  PID:10064
- C:\Windows\System\cCPecUU.exe
  C:\Windows\System\cCPecUU.exe
  2⤵
  PID:10644
- C:\Windows\System\MYMvGtp.exe
  C:\Windows\System\MYMvGtp.exe
  2⤵
  PID:10144
- C:\Windows\System\eQwYoZn.exe
  C:\Windows\System\eQwYoZn.exe
  2⤵
  PID:9140
- C:\Windows\System\XZhHEPs.exe
  C:\Windows\System\XZhHEPs.exe
  2⤵
  PID:14888
- C:\Windows\System\uuDtWvu.exe
  C:\Windows\System\uuDtWvu.exe
  2⤵
  PID:12508
- C:\Windows\System\sIcmXOr.exe
  C:\Windows\System\sIcmXOr.exe
  2⤵
  PID:14924
- C:\Windows\System\AWNSwyN.exe
  C:\Windows\System\AWNSwyN.exe
  2⤵
  PID:15204
- C:\Windows\System\RLHognd.exe
  C:\Windows\System\RLHognd.exe
  2⤵
  PID:15180
- C:\Windows\System\uwzPBVN.exe
  C:\Windows\System\uwzPBVN.exe
  2⤵
  PID:8236
- C:\Windows\System\iIOkVKb.exe
  C:\Windows\System\iIOkVKb.exe
  2⤵
  PID:14932
- C:\Windows\System\MBPnrwg.exe
  C:\Windows\System\MBPnrwg.exe
  2⤵
  PID:14984
- C:\Windows\System\MKImIdX.exe
  C:\Windows\System\MKImIdX.exe
  2⤵
  PID:14392
- C:\Windows\System\EsuAHzH.exe
  C:\Windows\System\EsuAHzH.exe
  2⤵
  PID:8584
- C:\Windows\System\SMBkvcg.exe
  C:\Windows\System\SMBkvcg.exe
  2⤵
  PID:9064
- C:\Windows\System\WTrhwFy.exe
  C:\Windows\System\WTrhwFy.exe
  2⤵
  PID:10824
- C:\Windows\System\yPmygyF.exe
  C:\Windows\System\yPmygyF.exe
  2⤵
  PID:8800
- C:\Windows\System\hYlOsEc.exe
  C:\Windows\System\hYlOsEc.exe
  2⤵
  PID:4940
- C:\Windows\System\qHZIWab.exe
  C:\Windows\System\qHZIWab.exe
  2⤵
  PID:9164
- C:\Windows\System\VFMzeDp.exe
  C:\Windows\System\VFMzeDp.exe
  2⤵
  PID:6484
- C:\Windows\System\IoLHGPJ.exe
  C:\Windows\System\IoLHGPJ.exe
  2⤵
  PID:9672
- C:\Windows\System\kqGRPgz.exe
  C:\Windows\System\kqGRPgz.exe
  2⤵
  PID:3904
- C:\Windows\System\abOvCbI.exe
  C:\Windows\System\abOvCbI.exe
  2⤵
  PID:8840
- C:\Windows\System\sBaIQQr.exe
  C:\Windows\System\sBaIQQr.exe
  2⤵
  PID:9472
- C:\Windows\System\ozODoaT.exe
  C:\Windows\System\ozODoaT.exe
  2⤵
  PID:12488
- C:\Windows\System\mUaTzEs.exe
  C:\Windows\System\mUaTzEs.exe
  2⤵
  PID:11684
- C:\Windows\System\hsfowDl.exe
  C:\Windows\System\hsfowDl.exe
  2⤵
  PID:9232
- C:\Windows\System\KSUfjJl.exe
  C:\Windows\System\KSUfjJl.exe
  2⤵
  PID:10784
- C:\Windows\System\NUKErIP.exe
  C:\Windows\System\NUKErIP.exe
  2⤵
  PID:9220
- C:\Windows\System\fXEAhjQ.exe
  C:\Windows\System\fXEAhjQ.exe
  2⤵
  PID:8592
- C:\Windows\System\FNNmKdd.exe
  C:\Windows\System\FNNmKdd.exe
  2⤵
  PID:9924
- C:\Windows\System\uBfxmfB.exe
  C:\Windows\System\uBfxmfB.exe
  2⤵
  PID:12188
- C:\Windows\System\MvxRjih.exe
  C:\Windows\System\MvxRjih.exe
  2⤵
  PID:11564
- C:\Windows\System\SvqXJCC.exe
  C:\Windows\System\SvqXJCC.exe
  2⤵
  PID:9212
- C:\Windows\System\fLlKnWb.exe
  C:\Windows\System\fLlKnWb.exe
  2⤵
  PID:9128
- C:\Windows\System\HKfaEPF.exe
  C:\Windows\System\HKfaEPF.exe
  2⤵
  PID:8304
- C:\Windows\System\CLAKXXZ.exe
  C:\Windows\System\CLAKXXZ.exe
  2⤵
  PID:12088
- C:\Windows\System\psUSuMO.exe
  C:\Windows\System\psUSuMO.exe
  2⤵
  PID:14724
- C:\Windows\System\pgUwnNH.exe
  C:\Windows\System\pgUwnNH.exe
  2⤵
  PID:13968
- C:\Windows\System\yWznwZb.exe
  C:\Windows\System\yWznwZb.exe
  2⤵
  PID:14000
- C:\Windows\System\zhJApgn.exe
  C:\Windows\System\zhJApgn.exe
  2⤵
  PID:14072
- C:\Windows\System\IRzNALH.exe
  C:\Windows\System\IRzNALH.exe
  2⤵
  PID:14064
- C:\Windows\System\MdHEuSW.exe
  C:\Windows\System\MdHEuSW.exe
  2⤵
  PID:14020
- C:\Windows\System\iZZBDVc.exe
  C:\Windows\System\iZZBDVc.exe
  2⤵
  PID:14008
- C:\Windows\System\LDUdHWO.exe
  C:\Windows\System\LDUdHWO.exe
  2⤵
  PID:7520
- C:\Windows\System\gfrYcEH.exe
  C:\Windows\System\gfrYcEH.exe
  2⤵
  PID:14800
- C:\Windows\System\uPJxVZE.exe
  C:\Windows\System\uPJxVZE.exe
  2⤵
  PID:1208
- C:\Windows\System\sDhecaK.exe
  C:\Windows\System\sDhecaK.exe
  2⤵
  PID:10860
- C:\Windows\System\NEqihtg.exe
  C:\Windows\System\NEqihtg.exe
  2⤵
  PID:9748
- C:\Windows\System\JDCUTkz.exe
  C:\Windows\System\JDCUTkz.exe
  2⤵
  PID:10872
- C:\Windows\System\tgNSEkn.exe
  C:\Windows\System\tgNSEkn.exe
  2⤵
  PID:5716
- C:\Windows\System\ULJRpuY.exe
  C:\Windows\System\ULJRpuY.exe
  2⤵
  PID:15096
- C:\Windows\System\tluOHjB.exe
  C:\Windows\System\tluOHjB.exe
  2⤵
  PID:11020
- C:\Windows\System\PXyustl.exe
  C:\Windows\System\PXyustl.exe
  2⤵
  PID:11448
- C:\Windows\System\cgTGwvg.exe
  C:\Windows\System\cgTGwvg.exe
  2⤵
  PID:4880
- C:\Windows\System\ePWNJbn.exe
  C:\Windows\System\ePWNJbn.exe
  2⤵
  PID:10340
- C:\Windows\System\zpWHAOS.exe
  C:\Windows\System\zpWHAOS.exe
  2⤵
  PID:11324
- C:\Windows\System\jWmuUDR.exe
  C:\Windows\System\jWmuUDR.exe
  2⤵
  PID:12036
- C:\Windows\System\tqdTVYV.exe
  C:\Windows\System\tqdTVYV.exe
  2⤵
  PID:12868
- C:\Windows\System\EmxYEVH.exe
  C:\Windows\System\EmxYEVH.exe
  2⤵
  PID:10668
- C:\Windows\System\GSmpdue.exe
  C:\Windows\System\GSmpdue.exe
  2⤵
  PID:12884
- C:\Windows\System\XDuaHZm.exe
  C:\Windows\System\XDuaHZm.exe
  2⤵
  PID:8908
- C:\Windows\System\pGaBVlA.exe
  C:\Windows\System\pGaBVlA.exe
  2⤵
  PID:8340
- C:\Windows\System\PUCHOhd.exe
  C:\Windows\System\PUCHOhd.exe
  2⤵
  PID:14900
- C:\Windows\System\fcZkUCw.exe
  C:\Windows\System\fcZkUCw.exe
  2⤵
  PID:9844
- C:\Windows\System\XbQnjXl.exe
  C:\Windows\System\XbQnjXl.exe
  2⤵
  PID:10552
- C:\Windows\System\GxUPLVl.exe
  C:\Windows\System\GxUPLVl.exe
  2⤵
  PID:12932
- C:\Windows\System\myNawcP.exe
  C:\Windows\System\myNawcP.exe
  2⤵
  PID:13104
- C:\Windows\System\msHfxbM.exe
  C:\Windows\System\msHfxbM.exe
  2⤵
  PID:14540
- C:\Windows\System\USyDMip.exe
  C:\Windows\System\USyDMip.exe
  2⤵
  PID:10164
- C:\Windows\System\rlFGLJm.exe
  C:\Windows\System\rlFGLJm.exe
  2⤵
  PID:12336
- C:\Windows\System\qkfCvxx.exe
  C:\Windows\System\qkfCvxx.exe
  2⤵
  PID:11484
- C:\Windows\System\tcrNtKU.exe
  C:\Windows\System\tcrNtKU.exe
  2⤵
  PID:12944
- C:\Windows\System\gIdXsDq.exe
  C:\Windows\System\gIdXsDq.exe
  2⤵
  PID:11968
- C:\Windows\System\hvcFJco.exe
  C:\Windows\System\hvcFJco.exe
  2⤵
  PID:12684
- C:\Windows\System\UFKqYCq.exe
  C:\Windows\System\UFKqYCq.exe
  2⤵
  PID:14112
- C:\Windows\System\rbtmiva.exe
  C:\Windows\System\rbtmiva.exe
  2⤵
  PID:10624
- C:\Windows\System\Kiukahm.exe
  C:\Windows\System\Kiukahm.exe
  2⤵
  PID:12816
- C:\Windows\System\rtplxfS.exe
  C:\Windows\System\rtplxfS.exe
  2⤵
  PID:12148
- C:\Windows\System\sOqKJpb.exe
  C:\Windows\System\sOqKJpb.exe
  2⤵
  PID:6716
- C:\Windows\System\pOXqNqU.exe
  C:\Windows\System\pOXqNqU.exe
  2⤵
  PID:8344
- C:\Windows\System\ubMDPdB.exe
  C:\Windows\System\ubMDPdB.exe
  2⤵
  PID:13060
- C:\Windows\System\bWFQkrl.exe
  C:\Windows\System\bWFQkrl.exe
  2⤵
  PID:10544
- C:\Windows\System\URnrfdn.exe
  C:\Windows\System\URnrfdn.exe
  2⤵
  PID:14876
- C:\Windows\System\pjPpuzG.exe
  C:\Windows\System\pjPpuzG.exe
  2⤵
  PID:11944
- C:\Windows\System\ozcmRcU.exe
  C:\Windows\System\ozcmRcU.exe
  2⤵
  PID:13020
- C:\Windows\System\gAjGwSK.exe
  C:\Windows\System\gAjGwSK.exe
  2⤵
  PID:12196
- C:\Windows\System\UXGInch.exe
  C:\Windows\System\UXGInch.exe
  2⤵
  PID:13084
- C:\Windows\System\xlDcEWq.exe
  C:\Windows\System\xlDcEWq.exe
  2⤵
  PID:12152
- C:\Windows\System\FsJwerl.exe
  C:\Windows\System\FsJwerl.exe
  2⤵
  PID:11504
- C:\Windows\System\TLxJVdo.exe
  C:\Windows\System\TLxJVdo.exe
  2⤵
  PID:6840
- C:\Windows\System\zPTwbTO.exe
  C:\Windows\System\zPTwbTO.exe
  2⤵
  PID:14024
- C:\Windows\System\blKgZWc.exe
  C:\Windows\System\blKgZWc.exe
  2⤵
  PID:8356
- C:\Windows\System\LpxFMlA.exe
  C:\Windows\System\LpxFMlA.exe
  2⤵
  PID:7408
- C:\Windows\System\QJQaJkk.exe
  C:\Windows\System\QJQaJkk.exe
  2⤵
  PID:14128
- C:\Windows\System\EhKyFRQ.exe
  C:\Windows\System\EhKyFRQ.exe
  2⤵
  PID:13556
- C:\Windows\System\knwCjdw.exe
  C:\Windows\System\knwCjdw.exe
  2⤵
  PID:5960
- C:\Windows\System\HexESrJ.exe
  C:\Windows\System\HexESrJ.exe
  2⤵
  PID:10864
- C:\Windows\System\xJEdBwO.exe
  C:\Windows\System\xJEdBwO.exe
  2⤵
  PID:10924
- C:\Windows\System\svoKJXP.exe
  C:\Windows\System\svoKJXP.exe
  2⤵
  PID:10436
- C:\Windows\System\bTzNuJP.exe
  C:\Windows\System\bTzNuJP.exe
  2⤵
  PID:13996
- C:\Windows\System\afTknHy.exe
  C:\Windows\System\afTknHy.exe
  2⤵
  PID:9836
- C:\Windows\System\yLvNOCN.exe
  C:\Windows\System\yLvNOCN.exe
  2⤵
  PID:14848
- C:\Windows\System\XTRtGwY.exe
  C:\Windows\System\XTRtGwY.exe
  2⤵
  PID:11824
- C:\Windows\System\HWmMXkP.exe
  C:\Windows\System\HWmMXkP.exe
  2⤵
  PID:13096
- C:\Windows\System\OMeHVpJ.exe
  C:\Windows\System\OMeHVpJ.exe
  2⤵
  PID:13964
- C:\Windows\System\mjxXCbs.exe
  C:\Windows\System\mjxXCbs.exe
  2⤵
  PID:13804
- C:\Windows\System\toasXit.exe
  C:\Windows\System\toasXit.exe
  2⤵
  PID:13828
- C:\Windows\System\dmFrcce.exe
  C:\Windows\System\dmFrcce.exe
  2⤵
  PID:13812
- C:\Windows\System\gvEDNvR.exe
  C:\Windows\System\gvEDNvR.exe
  2⤵
  PID:10780
- C:\Windows\System\XcltgqK.exe
  C:\Windows\System\XcltgqK.exe
  2⤵
  PID:8832
- C:\Windows\System\TLKKPsB.exe
  C:\Windows\System\TLKKPsB.exe
  2⤵
  PID:12204
- C:\Windows\System\qABWYwT.exe
  C:\Windows\System\qABWYwT.exe
  2⤵
  PID:8160
- C:\Windows\System\MAHiSgM.exe
  C:\Windows\System\MAHiSgM.exe
  2⤵
  PID:13540
- C:\Windows\System\LQzOlnQ.exe
  C:\Windows\System\LQzOlnQ.exe
  2⤵
  PID:12108
- C:\Windows\System\oHCHYxQ.exe
  C:\Windows\System\oHCHYxQ.exe
  2⤵
  PID:10776
- C:\Windows\System\fhrUmAs.exe
  C:\Windows\System\fhrUmAs.exe
  2⤵
  PID:11984
- C:\Windows\System\jGMIfki.exe
  C:\Windows\System\jGMIfki.exe
  2⤵
  PID:14764
- C:\Windows\System\MHGJRdt.exe
  C:\Windows\System\MHGJRdt.exe
  2⤵
  PID:3960
- C:\Windows\System\BNCvsPW.exe
  C:\Windows\System\BNCvsPW.exe
  2⤵
  PID:13256
- C:\Windows\System\UfgSlge.exe
  C:\Windows\System\UfgSlge.exe
  2⤵
  PID:10820
- C:\Windows\System\jydVfbz.exe
  C:\Windows\System\jydVfbz.exe
  2⤵
  PID:10892
- C:\Windows\System\DIOFaDI.exe
  C:\Windows\System\DIOFaDI.exe
  2⤵
  PID:13388
- C:\Windows\System\mcuJXPs.exe
  C:\Windows\System\mcuJXPs.exe
  2⤵
  PID:7256
- C:\Windows\System\HKeHPIH.exe
  C:\Windows\System\HKeHPIH.exe
  2⤵
  PID:13852
- C:\Windows\System\IKBjAcc.exe
  C:\Windows\System\IKBjAcc.exe
  2⤵
  PID:6796
- C:\Windows\System\giNvWJN.exe
  C:\Windows\System\giNvWJN.exe
  2⤵
  PID:12524
- C:\Windows\System\mBSUbgz.exe
  C:\Windows\System\mBSUbgz.exe
  2⤵
  PID:9508
- C:\Windows\System\ZaChczz.exe
  C:\Windows\System\ZaChczz.exe
  2⤵
  PID:3532
- C:\Windows\System\DQFswvU.exe
  C:\Windows\System\DQFswvU.exe
  2⤵
  PID:12992
- C:\Windows\System\NDgRTVq.exe
  C:\Windows\System\NDgRTVq.exe
  2⤵
  PID:11800
- C:\Windows\System\rfGUmsH.exe
  C:\Windows\System\rfGUmsH.exe
  2⤵
  PID:12400
- C:\Windows\System\EdIxeGC.exe
  C:\Windows\System\EdIxeGC.exe
  2⤵
  PID:10068
- C:\Windows\System\IpkShdC.exe
  C:\Windows\System\IpkShdC.exe
  2⤵
  PID:11216
- C:\Windows\System\CyKvMVw.exe
  C:\Windows\System\CyKvMVw.exe
  2⤵
  PID:11548
- C:\Windows\System\lQoiGbv.exe
  C:\Windows\System\lQoiGbv.exe
  2⤵
  PID:12280
- C:\Windows\System\JARmsrO.exe
  C:\Windows\System\JARmsrO.exe
  2⤵
  PID:11756
- C:\Windows\System\qzghppu.exe
  C:\Windows\System\qzghppu.exe
  2⤵
  PID:9804
- C:\Windows\System\HUKRpRn.exe
  C:\Windows\System\HUKRpRn.exe
  2⤵
  PID:12556
- C:\Windows\System\tNGFElf.exe
  C:\Windows\System\tNGFElf.exe
  2⤵
  PID:13220
- C:\Windows\System\UBmKPEG.exe
  C:\Windows\System\UBmKPEG.exe
  2⤵
  PID:116
- C:\Windows\System\fPZthLq.exe
  C:\Windows\System\fPZthLq.exe
  2⤵
  PID:14168
- C:\Windows\System\rayQFEG.exe
  C:\Windows\System\rayQFEG.exe
  2⤵
  PID:14192
- C:\Windows\System\FjYymUR.exe
  C:\Windows\System\FjYymUR.exe
  2⤵
  PID:13844
- C:\Windows\System\rLIuzMt.exe
  C:\Windows\System\rLIuzMt.exe
  2⤵
  PID:14608
- C:\Windows\System\PigeocG.exe
  C:\Windows\System\PigeocG.exe
  2⤵
  PID:13056
- C:\Windows\System\mGBDnJw.exe
  C:\Windows\System\mGBDnJw.exe
  2⤵
  PID:10840
- C:\Windows\System\QVUvjlc.exe
  C:\Windows\System\QVUvjlc.exe
  2⤵
  PID:6820
- C:\Windows\System\cTSCDWT.exe
  C:\Windows\System\cTSCDWT.exe
  2⤵
  PID:6020
- C:\Windows\System\ztRlkcJ.exe
  C:\Windows\System\ztRlkcJ.exe
  2⤵
  PID:13908
- C:\Windows\System\blFuUfq.exe
  C:\Windows\System\blFuUfq.exe
  2⤵
  PID:11288
- C:\Windows\System\qwODTPJ.exe
  C:\Windows\System\qwODTPJ.exe
  2⤵
  PID:8328
- C:\Windows\System\quiejgH.exe
  C:\Windows\System\quiejgH.exe
  2⤵
  PID:13128
- C:\Windows\System\JsaVnTY.exe
  C:\Windows\System\JsaVnTY.exe
  2⤵
  PID:13088
- C:\Windows\System\rgdMSQM.exe
  C:\Windows\System\rgdMSQM.exe
  2⤵
  PID:9360
- C:\Windows\System\nzjHyji.exe
  C:\Windows\System\nzjHyji.exe
  2⤵
  PID:11364
- C:\Windows\System\ioyrfQx.exe
  C:\Windows\System\ioyrfQx.exe
  2⤵
  PID:13608
- C:\Windows\System\uhKyTaI.exe
  C:\Windows\System\uhKyTaI.exe
  2⤵
  PID:13168
- C:\Windows\System\LhRqXMb.exe
  C:\Windows\System\LhRqXMb.exe
  2⤵
  PID:10188
- C:\Windows\System\MzMzAid.exe
  C:\Windows\System\MzMzAid.exe
  2⤵
  PID:13948
- C:\Windows\System\BDQzmRb.exe
  C:\Windows\System\BDQzmRb.exe
  2⤵
  PID:10496
- C:\Windows\System\JVRCWig.exe
  C:\Windows\System\JVRCWig.exe
  2⤵
  PID:12068
- C:\Windows\System\esJKohS.exe
  C:\Windows\System\esJKohS.exe
  2⤵
  PID:15372
- C:\Windows\System\AECCEgE.exe
  C:\Windows\System\AECCEgE.exe
  2⤵
  PID:15396

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 9368 -i 9368 -h 420 -j 428 -s 580 -d 0
1⤵
PID:12628

C:\Windows\system32\WerFaultSecure.exe
C:\Windows\system32\WerFaultSecure.exe -u -p 9368 -s 764
1⤵
PID:6428

C:\Windows\system32\WerFaultSecure.exe
C:\Windows\system32\WerFaultSecure.exe -u -p 9368 -s 764
1⤵
PID:14856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ygepdo3q.bel.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AvSOoIr.exe

Filesize
1.9MB

MD5
8ad47cc05dee6557a51fbe0deea219d2

SHA1
9a41488b5386db9c031f613c66f02f410b34dc76

SHA256
a02589242f6766b1ad628864574df149ba642ad6152a13451cea8218116ff8f8

SHA512
f1423059d0969fbc9511dd155a7cba7f329db17cd5eda02d982cb1685f8c647c4eade3980bfc91c8fd702df9b0be5b313a52eb53c0673e1b4b248cf09cb07273

Download Submit
C:\Windows\System\BUjJYGh.exe

Filesize
1.9MB

MD5
9636cdd9ce88449989ab258bafe2d097

SHA1
877700cbd03fda3eb2dbbfee81cab0ac9614be04

SHA256
722528823d1f80de53cdc131501f72b3a76714719b767a6218b05f235eb5c47b

SHA512
2d699aa64dffa840ec3d5f8f9dbb04994d0f302dc8e85821fa621b64751187a67b1d2ec7f42f792cf8cdbaa9a50db12e3fbb51e9a261668e206ccd9663372a3d

Download Submit
C:\Windows\System\CfZAnDn.exe

Filesize
1.9MB

MD5
ad8d27908f1dbfa4e142d505b69d5db6

SHA1
fb72cad4b56aef457198b7c5c6a9709356cba881

SHA256
709968fe1136fb3c04b3b72c0e0d18f9c8d7855a42723abb3e1b0643eb631f6c

SHA512
15664fd59bc240ca7852a6e036db3c3007d3afc1cc6b3ffad6341781311beda80ab774d9c5b6a55ad1a4a93fdab9dfdabbb050491fd83cf25e69248c587808e6

Download Submit
C:\Windows\System\FlDPaYB.exe

Filesize
1.9MB

MD5
a9f8e11cd39413338ab2d1f529cd8e7f

SHA1
eeb62393212d1fb6725ec228a925ebd5461037dc

SHA256
dd37ce79105bf04db870ec29e465812e1fac794cd79790ed14dee09f6781449c

SHA512
a8839685834b1e61366e7980d0c08293694d8583bb81fb3e47118f95e9d14c033200355167cbee8e02a93293916280fae9789c4b8c4b378a2f790852ffc2b612

Download Submit
C:\Windows\System\KOFYKeh.exe

Filesize
1.9MB

MD5
79f0f7cb07a81af8220fe54fa9893926

SHA1
564e004d262d9195a54fac85c9ad00a26c7dd61d

SHA256
1272b4bc27cc644ae560e151741cf6cbd94011d60e8cde742310ad5bc713f4cc

SHA512
8a8c76d87b81559d9c262a4ad04e835728249cf4b871054a9e1768e8e037af34bf7dd409f11a2a3c5331e69181c99210fef62e50de462db3301f7fd0cdcdbef1

Download Submit
C:\Windows\System\KoshfKq.exe

Filesize
1.9MB

MD5
11949288594fc0f0da05e732a06b0676

SHA1
0277541511e270211c8d3b4c9c14d895ea518cbd

SHA256
f343ad7c3fe6cfb1a6a1b19e3aa34e455d2e39c3f419ba7363699ba5594ce25c

SHA512
b832bb812fb6dcb72cfcefb986bd975aad7ee1ca6091621edf03bbbac87d586204026971520e998b698a65858d623f906c52ac9ece149cfd24379ca023b6fbcc

Download Submit
C:\Windows\System\NLmRfbM.exe

Filesize
1.9MB

MD5
cc27dfce3b6521937e9e0edfa0884dcf

SHA1
ff4a19f55df62fd314144c0c2c4c2156ec0cde0c

SHA256
be0cfd6e5c255dcb98588ec718f39534c07c7b822c7eab247daa94d0d26fb4a0

SHA512
61fceb9c7757c0c0add9be22312c344b649697a643d04fb11d6b5f0807eb10e9a8af9218aa9dc0faf9db39c443b9a052d090078d75611ddbdd7cc540ac76e816

Download Submit
C:\Windows\System\OUgVzCU.exe

Filesize
1.9MB

MD5
58c115954d211ae2e8f142d0c2f6d7cf

SHA1
0354e2a0cb78e91a6613da02e168fda75f72f045

SHA256
c0f21bb6c97804ab1aa1eeb49349c896b6c08033167273715924bd834d958874

SHA512
bd8062143c7b8156a7c679b7e667ea6fa478bb440f30c535c91b1413dc8bc815310458b062e2404a6b0b38a1d82440f508502deccc56e8b556e662e66bc8b770

Download Submit
C:\Windows\System\QDFBPCR.exe

Filesize
1.9MB

MD5
f76f0499808e482e4ead4934b79ee724

SHA1
c0648875fe61800797d8dd3a026d3c0e418615aa

SHA256
e428af66c8918d6467b8eb09197af9ff47576debcea8dab7517461bc113bf812

SHA512
807f071104e4f47c39d0de8b74d6b5065315450efcb4ee5db0c31851e1f8b0a252fd26d4b331e050f3f8fbf103c94d579e9ea346c027ac80bd97d2b0b37577f8

Download Submit
C:\Windows\System\QwEwrfV.exe

Filesize
1.9MB

MD5
60b905c3b2c8b57a78404c5c39b5b07f

SHA1
194d7c1ccd665b007baef6cd3d84bfbe433cb7ef

SHA256
86ce607340d2001bcf8efaccf5475a4fb345671d22a78297bf08ed55a29a1f8f

SHA512
15011fb068d106be04c61ff943aee413bb37c59157c3e4bd37f7b1bbb08c241ca60a405b1cd245baa79402d0ac5428d8d618b19c6647141f80b215f91dd98484

Download Submit
C:\Windows\System\SvRdnIl.exe

Filesize
1.9MB

MD5
3b4e8e9a944545eac4ebc8330418cea6

SHA1
e9dc8b00e372423b295d618d74edd9addc020d1d

SHA256
3a028129b1657f11596ac703c0cbb3295686c562494295d5765c32bdfdcb0181

SHA512
64217dd431c62481b3e628603c06b774b2933458e067917628173d34a9f61ecc29bbecdf1dc248dfb1655cb7c48a2bdde8f7ab21903620dbe5ea11f45ecd3cec

Download Submit
C:\Windows\System\Vuiuwdo.exe

Filesize
1.9MB

MD5
422d4e05498731b33df54d1a991e00e5

SHA1
7259aee79acf04c507bab4f6947a2954dbeb7d90

SHA256
210deadd48658ed0cd75f32a560700c4750621d2f26bd5e9d889fa96cc4605b7

SHA512
493f7749e33da520de450fad713c4aef6cef33d46745f89d0c98cecb9f05593febdce30c6afa7c9841414796b265d3dd24a0901726d40e41eadc73db9a588aab

Download Submit
C:\Windows\System\WdgvLvD.exe

Filesize
1.9MB

MD5
1b064698d1a8f9fefc05e94d33d1af47

SHA1
5596f84112eaac12178505b9574608ee1f15bef9

SHA256
883459d0391eb009e31657b7ec9fd84b42a86b2c85661cb63b46676e5d5406cf

SHA512
d433b46c45c48c698e339250d8ef818f04d17371c717442746daa109fd48a0e9fa5479af102abc11874b3f3a16ac6df046e15c6ec1449dc1195aacfc02a2ff4e

Download Submit
C:\Windows\System\XIbqeqk.exe

Filesize
1.9MB

MD5
b088666cac7bbe4ff5b3910993f3c551

SHA1
6f8410c42c1bf152a7d9e1172925d3b4c21e8eda

SHA256
752d8ca86ac36b89e3f16a83dadf5403c4d7b6c61db0d06b9de844ae36dff0af

SHA512
7860358ed30b6c0ffba052b395065b88395a8ca7e93531b9dacfaf28dd6590a3ff09e8549e84f5caeaefbad5281a19db2a30490248cc03bf2ee09ccc9979ce0e

Download Submit
C:\Windows\System\XSyCbeK.exe

Filesize
1.9MB

MD5
74e48d198b97fb92f5adb75979b6d27f

SHA1
ee28c302fdda2943f226792647b97b946678f337

SHA256
15cda8183cb0e43f2c9d49d5bd86b55497b6c06ee170d82eab4b34c25fa319a3

SHA512
fbf3a9053da3201a8ffeffbd00031b99d626043222fb61343bfc22df419a956ca61bca2e018fbe59b764e9e95209458243bb0264314ebec5b5d84edfea3a0025

Download Submit
C:\Windows\System\YJMrtvP.exe

Filesize
1.9MB

MD5
d4f1f05d24d5826ce3c0a0e935a862ac

SHA1
013025659a63aa97f0927b95991b79eada60177d

SHA256
bedb1c6fd165ac61bf8287a5c8a8a4cc21bdced872e667df4fc1bad57d714eba

SHA512
049e96fad7a445baff9b007a9befceb0a1000066c03d59bdd8a2fd0debce702587f29535ae76a11f862220d92bbf750285b98b8aba7d654779fb524b18a529a1

Download Submit
C:\Windows\System\ZsHtQpf.exe

Filesize
1.9MB

MD5
d7ba79366b4c09ea19f54b0073e85326

SHA1
b3d3a90a065b2e154b42b9bb1152ae88397af85f

SHA256
8093c69f41f6fd1b31457121d59b4baec2127cd7e57bac54cf21494e0df845be

SHA512
2d8b3f5f16ea71cfa417de57e8a94760594d7fdb20bbeaa8bbbfa5191d4cb073577ecba38ff0c5a3cb9d4bcb63f2c77806c233743e7a7f14741460fa5e9c5ae2

Download Submit
C:\Windows\System\ewFSiLD.exe

Filesize
1.9MB

MD5
fff406c6085523d26b5f09ea95d4e91c

SHA1
9ddfe63bba204b8727262e61082ff2c85c76009b

SHA256
f323bc69c828ed801a59f2995754556cd93108e63a085a854577cf558f4ae41e

SHA512
e550a3d55dbaeddc53d8050cd3f777565be0b88f3368f3df1a0168819e5854767ad1329364023d72f4078e82b8b1ec942873628642da945cab66644dc2e30a31

Download Submit
C:\Windows\System\hAKmedJ.exe

Filesize
1.9MB

MD5
9684236040cdb84107f6062563ef0ec6

SHA1
e2a5b591a62c6e49494df51d5b87a6d7c0f49a6e

SHA256
5885affde4dcd984a7370fd059572b648afc4b6e0643918111db9ff06a789bab

SHA512
676488c1a0789755d8c290877ddcf569e17693653f61946ae07f3fdb73e45677551a05d8e54c314e366d0a08f44e8a7efd22352f4d9b99c2b629657ccdf947a1

Download Submit
C:\Windows\System\hOMKYHx.exe

Filesize
1.9MB

MD5
8e2f1b303f14b9a13bb1de5599b5c402

SHA1
e6f6920d6ad626a5b34be63f2a6cb5795c916733

SHA256
adfffb518b6a044086f1359d5226450a753386e6f31606104e2618d9f1f09044

SHA512
bf464b6f8fedebdf19f0bd3add8397bf8a7a5bbae760a5fa52b6f0d2afe797a39b4f3ef2971c4191d4546023deca68abed2156e9c62ca3f783305d181ead1f02

Download Submit
C:\Windows\System\iukQalC.exe

Filesize
1.9MB

MD5
663029b8fbb0cff284d88f760e9c3edc

SHA1
bfee33dae8d1ca22f89b760f31bcb22b6b89ec94

SHA256
2ae4f7a03fafa6642d4d41baa4434c1d66a292eb59134621be787774880b10e7

SHA512
292e1fe2b27fce9ba98cb323a545e12b69d9524560977351f2c201d963218dadbc20ffa294719b5b7c4a05cedd63c5e32cc54240a1aaa13f53da28b8e33f710d

Download Submit
C:\Windows\System\mUrquJh.exe

Filesize
1.9MB

MD5
73d75c3a4ab1d041da17169d90cfc76e

SHA1
9f7a8763146e4ee01cc6f88ee4eaa85e2064b18f

SHA256
4139f9513b33ba5c367dfcf6da3490e25fe2f76d7e4770f49c94ac1e01987fb7

SHA512
ff544b86c59f843de6e9c1cac26820d21b875caad54ad980443b0bde8659205534b0a63ae6e0f447e73f7f627f12219e85431de9b23d2db28c8175ff844d1107

Download Submit
C:\Windows\System\nMZohdr.exe

Filesize
1.9MB

MD5
45409bbbdcec2bb960a18ac3a2df9ec3

SHA1
ec1cab037556ffefabd126aec57a7667210c1c1b

SHA256
81d852bd8afce9fe582ecc218e4875f04b797d1546b1f5aca5c719bdbb1c8aab

SHA512
dfc890ee9236ec84086af42cd849bc9d3fb3db078616dfe2184e1999c4046df0f8a9ac13edb2b1ca31faf25d0a254bca5547277dde32db8177b876e381ad07cd

Download Submit
C:\Windows\System\posvott.exe

Filesize
1.9MB

MD5
1a7912918e9d06baf1aaeab992f8afa4

SHA1
637d554f60478cfca5e0de392d942a4e4aaba1b3

SHA256
5d4e6b28b3083ea3c3c7bebf8efb1ffd39ab82ba7d2c1962802ec409bba05704

SHA512
4cb62c68b1d7ce7793b362eb6c0fc2dd92879b8aa52fb0d648fb683fae7dc6c53ee7516c166d0802f2c7cc1b378101fb2a371a85ba48f48174f8e0986f9c9c71

Download Submit
C:\Windows\System\qVrlbdU.exe

Filesize
1.9MB

MD5
d98f8465e40f62d219519dfd0f3115af

SHA1
2aa77b70d26a9754e693f569607c30a2f1bac48b

SHA256
519f351b963a98e683985e0fa3faaeb1d19d434f556c1318f01a467286e3b06b

SHA512
9366809177db6904b85f6d2330713fa5dcf88ff0537fd1d0a7f01159789cd1d3ec901e68a244cccee5f8c0e9acfce423dbc6c9c687d888449aa4f6d39173d9c1

Download Submit
C:\Windows\System\qkiBroa.exe

Filesize
1.9MB

MD5
a072a8f9219e55ac015d976d1062d92b

SHA1
ccd3202c6059058374c581d5f684c8fa44abf032

SHA256
6a6fa6bec1d482b2629cece6eca6b38dbfe878ccef0f74124adbe74084c6b82b

SHA512
e882e6581f3589b6b9208c10f0f37666852f17207e4c83d5618d2fa944fedda58833310451f2e06bbfd49613c7628fac092e7270e4f509f81d9f016c54ea9ad1

Download Submit
C:\Windows\System\rAWezyC.exe

Filesize
1.9MB

MD5
dd36f16ff5f4ef0999dc38b2e6626568

SHA1
1db217415c498bc3002613e3848d402311d80bee

SHA256
19061d767555db59c3d7e80740280a8d039bb93e10ba857a4fc0389a07ee8c32

SHA512
60a3204249677296eb7180e34e0f07c8d00f0c55687a76b71e323bacb89d58a8cdd7bbf5bc1f090c94761f90aaddbbdd5d30769f30daf916af260a37c6fcc6be

Download Submit
C:\Windows\System\uICJxCJ.exe

Filesize
1.9MB

MD5
ab0607e75b421a726005a2a41cd8ba3d

SHA1
292ee3a426766843951977a00b8b63667d0fdb1e

SHA256
63eff31348fc419d912b3cf6cdfbe12e796d89e038def697a242eb6a23280221

SHA512
d9537e6e8a315cca531fa0b82af3ac816f099e48150837289ca3a5f3db26f05d959487128b529b2d9fb13102ae46c7e153aa4941e3982ccfc712b9452c2a6553

Download Submit
C:\Windows\System\uUcNyHP.exe

Filesize
1.9MB

MD5
4dfb1a67a1a3c40cbb19c079c0bffd66

SHA1
728d82ae981087c9f19d56c557147e4df241b114

SHA256
759b9bd1929dfd033bec7eeada0a7ae8556d4e332ba7adc2018a635e6adb7f27

SHA512
7ab6719eb231e6ad9529c489a4d47dcee284e32d078b9f6bffa915d7e8e526361dd08e0c377c63c15428ce57c3346f543c6f59655cf9626f20680f77038f1e75

Download Submit
C:\Windows\System\ujTfsvU.exe

Filesize
1.9MB

MD5
4b47165214ead8ac6191ce8421e253d8

SHA1
0a4ea5801f0e27c24619f6fb42ec6eba03037083

SHA256
f73dc014723fed73449665eccb36d7cae77c3af403c7167ce2b039fc0d8ddd3a

SHA512
8846768415a064d86581acfd380574488f37c05d9cf2e4896bf4b2f2d87c21a9d03eb7432e8f5b00fc82dc1c727f4e659e7168b4ffbf4f9dcd22ceaf0c48b6fd

Download Submit
C:\Windows\System\vvQnjNv.exe

Filesize
1.9MB

MD5
963d01cf49b3e88c11e23e72dfeebab8

SHA1
da235531d0a0939664e3ff29d816b20f37ba8b94

SHA256
2c7c96d6685b720d2a5317729f334fca370708c9ac343fb200e907cc7765ecb5

SHA512
3db3ac38b58567c01dd0fac1a57b807c964a2ccaeb44a7689edd99a3b4d4508067dbb2beed8cb748b8d01035b63d9e17bf894098d60966e800672a851e306af1

Download Submit
C:\Windows\System\xXfcphO.exe

Filesize
1.9MB

MD5
96f5568de0c698f4f42be013fa85fd6c

SHA1
83e8bece27b07edf944d00464949ea1bfa82823c

SHA256
5c8904446e036be642c07776c0bf1745cbad85a3c0765e47db2f9e4ec9e2c861

SHA512
fe770423bc2555d62af5dcf4b147576916dcfd0b76c6913012aa3b9c4ad77aa5a8b915d2f510d37df7acbad5116e18a8f5669cbac103a96bb926fd7e476373c5

Download Submit
C:\Windows\System\zmbgsVO.exe

Filesize
1.9MB

MD5
4bb4520e43a33a3cbf9d57c8a03fab63

SHA1
2e7582d0df7ce0c82e626d82c3e2710e486e4f84

SHA256
be567deecd4d78c375c9c4934403371c0f3a95ac1c70620b497a7705a5092f51

SHA512
bdd84ebeebc0ab5a122abd9656476104ae011ad4c5b1793e60ec177b70f3f84faed0be6b4730fa138bbc36204e5ea4ca243d5d462b1a94be9d114894df0b8b5b

Download Submit
memory/380-111-0x00007FF6B47F0000-0x00007FF6B4BE2000-memory.dmp

Filesize
3.9MB

Download
memory/380-2280-0x00007FF6B47F0000-0x00007FF6B4BE2000-memory.dmp

Filesize
3.9MB

Download
memory/680-19-0x00007FF67CE50000-0x00007FF67D242000-memory.dmp

Filesize
3.9MB

Download
memory/892-74-0x00007FF7A26A0000-0x00007FF7A2A92000-memory.dmp

Filesize
3.9MB

Download
memory/892-2087-0x00007FF7A26A0000-0x00007FF7A2A92000-memory.dmp

Filesize
3.9MB

Download
memory/924-2451-0x00007FF6CCA30000-0x00007FF6CCE22000-memory.dmp

Filesize
3.9MB

Download
memory/924-173-0x00007FF6CCA30000-0x00007FF6CCE22000-memory.dmp

Filesize
3.9MB

Download
memory/1080-2278-0x00007FF79A930000-0x00007FF79AD22000-memory.dmp

Filesize
3.9MB

Download
memory/1080-112-0x00007FF79A930000-0x00007FF79AD22000-memory.dmp

Filesize
3.9MB

Download
memory/1116-66-0x00007FF759D10000-0x00007FF75A102000-memory.dmp

Filesize
3.9MB

Download
memory/1116-2119-0x00007FF759D10000-0x00007FF75A102000-memory.dmp

Filesize
3.9MB

Download
memory/1256-2111-0x00007FF6B82F0000-0x00007FF6B86E2000-memory.dmp

Filesize
3.9MB

Download
memory/1256-82-0x00007FF6B82F0000-0x00007FF6B86E2000-memory.dmp

Filesize
3.9MB

Download
memory/1408-137-0x00007FF6867E0000-0x00007FF686BD2000-memory.dmp

Filesize
3.9MB

Download
memory/1408-2450-0x00007FF6867E0000-0x00007FF686BD2000-memory.dmp

Filesize
3.9MB

Download
memory/1548-5230-0x0000027DEFB60000-0x0000027DEFB70000-memory.dmp

Filesize
64KB

Download
memory/1548-61-0x00007FFCE8BB0000-0x00007FFCE9671000-memory.dmp

Filesize
10.8MB

Download
memory/1548-4639-0x00007FFCE8BB0000-0x00007FFCE9671000-memory.dmp

Filesize
10.8MB

Download
memory/1548-117-0x0000027DF2AD0000-0x0000027DF3276000-memory.dmp

Filesize
7.6MB

Download
memory/1548-42-0x0000027DF1E00000-0x0000027DF1E22000-memory.dmp

Filesize
136KB

Download
memory/1548-62-0x0000027DEFB60000-0x0000027DEFB70000-memory.dmp

Filesize
64KB

Download
memory/1640-0-0x00007FF7C3520000-0x00007FF7C3912000-memory.dmp

Filesize
3.9MB

Download
memory/1640-2863-0x00007FF7C3520000-0x00007FF7C3912000-memory.dmp

Filesize
3.9MB

Download
memory/1640-138-0x00007FF7C3520000-0x00007FF7C3912000-memory.dmp

Filesize
3.9MB

Download
memory/1640-1-0x000002277EE60000-0x000002277EE70000-memory.dmp

Filesize
64KB

Download
memory/1652-2118-0x00007FF6F14D0000-0x00007FF6F18C2000-memory.dmp

Filesize
3.9MB

Download
memory/1652-103-0x00007FF6F14D0000-0x00007FF6F18C2000-memory.dmp

Filesize
3.9MB

Download
memory/1784-109-0x00007FF784520000-0x00007FF784912000-memory.dmp

Filesize
3.9MB

Download
memory/1784-2178-0x00007FF784520000-0x00007FF784912000-memory.dmp

Filesize
3.9MB

Download
memory/2376-2457-0x00007FF6B44F0000-0x00007FF6B48E2000-memory.dmp

Filesize
3.9MB

Download
memory/2376-148-0x00007FF6B44F0000-0x00007FF6B48E2000-memory.dmp

Filesize
3.9MB

Download
memory/2940-72-0x00007FF63B820000-0x00007FF63BC12000-memory.dmp

Filesize
3.9MB

Download
memory/2940-2106-0x00007FF63B820000-0x00007FF63BC12000-memory.dmp

Filesize
3.9MB

Download
memory/3112-93-0x00007FF7420A0000-0x00007FF742492000-memory.dmp

Filesize
3.9MB

Download
memory/3112-2123-0x00007FF7420A0000-0x00007FF742492000-memory.dmp

Filesize
3.9MB

Download
memory/3132-105-0x00007FF6128B0000-0x00007FF612CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3460-110-0x00007FF6CFDF0000-0x00007FF6D01E2000-memory.dmp

Filesize
3.9MB

Download
memory/3460-2175-0x00007FF6CFDF0000-0x00007FF6D01E2000-memory.dmp

Filesize
3.9MB

Download
memory/3580-106-0x00007FF63C160000-0x00007FF63C552000-memory.dmp

Filesize
3.9MB

Download
memory/3580-2086-0x00007FF63C160000-0x00007FF63C552000-memory.dmp

Filesize
3.9MB

Download
memory/4252-2122-0x00007FF6AB840000-0x00007FF6ABC32000-memory.dmp

Filesize
3.9MB

Download
memory/4252-88-0x00007FF6AB840000-0x00007FF6ABC32000-memory.dmp

Filesize
3.9MB

Download
memory/4284-2191-0x00007FF7E01D0000-0x00007FF7E05C2000-memory.dmp

Filesize
3.9MB

Download
memory/4284-108-0x00007FF7E01D0000-0x00007FF7E05C2000-memory.dmp

Filesize
3.9MB

Download
memory/4868-2011-0x00007FF6450D0000-0x00007FF6454C2000-memory.dmp

Filesize
3.9MB

Download
memory/4868-168-0x00007FF6450D0000-0x00007FF6454C2000-memory.dmp

Filesize
3.9MB

Download
memory/4868-8-0x00007FF6450D0000-0x00007FF6454C2000-memory.dmp

Filesize
3.9MB

Download
memory/4956-2460-0x00007FF629560000-0x00007FF629952000-memory.dmp

Filesize
3.9MB

Download
memory/4956-121-0x00007FF629560000-0x00007FF629952000-memory.dmp

Filesize
3.9MB

Download
memory/5084-107-0x00007FF6B72D0000-0x00007FF6B76C2000-memory.dmp

Filesize
3.9MB

Download
memory/5084-2142-0x00007FF6B72D0000-0x00007FF6B76C2000-memory.dmp

Filesize
3.9MB

Download