xmrig | 3966bf10a679055cca2ef9b25d8f08070059678df9e2156539dd44bb9f7f4f14

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
Size

1.6MB
MD5

0938f66df725143335dc34a5b839c5c2
SHA1

0e7345d330b03417539b24ef6607cc1f2058254e
SHA256

3966bf10a679055cca2ef9b25d8f08070059678df9e2156539dd44bb9f7f4f14
SHA512

839dcb3659abb25439881d6bc1ccb92fe121bcf6fcaeb0ddbe050f25c22d31b621f514f358d4ede0ad8a124f6fea760780880bc6ae0ecf21e0a63128736f4062
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82Sz/:NABO

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/memory/5028-133-0x00007FF7AAAA0000-0x00007FF7AAE92000-memory.dmp	xmrig
behavioral2/memory/2072-137-0x00007FF6B3BB0000-0x00007FF6B3FA2000-memory.dmp	xmrig
behavioral2/memory/444-1715-0x00007FF6E8080000-0x00007FF6E8472000-memory.dmp	xmrig
behavioral2/memory/2216-1756-0x00007FF72C4C0000-0x00007FF72C8B2000-memory.dmp	xmrig
behavioral2/memory/4208-1759-0x00007FF7916A0000-0x00007FF791A92000-memory.dmp	xmrig
behavioral2/memory/980-1755-0x00007FF63B680000-0x00007FF63BA72000-memory.dmp	xmrig
behavioral2/memory/8-1758-0x00007FF6750B0000-0x00007FF6754A2000-memory.dmp	xmrig
behavioral2/memory/408-1712-0x00007FF649590000-0x00007FF649982000-memory.dmp	xmrig
behavioral2/memory/4696-1711-0x00007FF779C60000-0x00007FF77A052000-memory.dmp	xmrig
behavioral2/memory/380-1822-0x00007FF602D80000-0x00007FF603172000-memory.dmp	xmrig
behavioral2/memory/3212-1771-0x00007FF63E200000-0x00007FF63E5F2000-memory.dmp	xmrig
behavioral2/memory/3904-1767-0x00007FF62B160000-0x00007FF62B552000-memory.dmp	xmrig
behavioral2/memory/5028-1766-0x00007FF7AAAA0000-0x00007FF7AAE92000-memory.dmp	xmrig
behavioral2/memory/2072-1780-0x00007FF6B3BB0000-0x00007FF6B3FA2000-memory.dmp	xmrig
behavioral2/memory/2012-1779-0x00007FF77DB90000-0x00007FF77DF82000-memory.dmp	xmrig
behavioral2/memory/684-1775-0x00007FF7F9920000-0x00007FF7F9D12000-memory.dmp	xmrig
behavioral2/memory/3992-1770-0x00007FF7F1570000-0x00007FF7F1962000-memory.dmp	xmrig
behavioral2/memory/2816-1910-0x00007FF747190000-0x00007FF747582000-memory.dmp	xmrig
behavioral2/memory/788-1909-0x00007FF70F100000-0x00007FF70F4F2000-memory.dmp	xmrig
behavioral2/memory/4028-1894-0x00007FF6F9B00000-0x00007FF6F9EF2000-memory.dmp	xmrig
behavioral2/memory/2428-1897-0x00007FF6CF030000-0x00007FF6CF422000-memory.dmp	xmrig
behavioral2/memory/4908-1891-0x00007FF7DDF50000-0x00007FF7DE342000-memory.dmp	xmrig
behavioral2/memory/1664-1843-0x00007FF76EB50000-0x00007FF76EF42000-memory.dmp	xmrig
behavioral2/memory/380-145-0x00007FF602D80000-0x00007FF603172000-memory.dmp	xmrig
behavioral2/memory/1664-141-0x00007FF76EB50000-0x00007FF76EF42000-memory.dmp	xmrig
behavioral2/memory/684-139-0x00007FF7F9920000-0x00007FF7F9D12000-memory.dmp	xmrig
behavioral2/memory/3904-138-0x00007FF62B160000-0x00007FF62B552000-memory.dmp	xmrig
behavioral2/memory/2012-136-0x00007FF77DB90000-0x00007FF77DF82000-memory.dmp	xmrig
behavioral2/memory/8-135-0x00007FF6750B0000-0x00007FF6754A2000-memory.dmp	xmrig
behavioral2/memory/3992-134-0x00007FF7F1570000-0x00007FF7F1962000-memory.dmp	xmrig
behavioral2/memory/980-122-0x00007FF63B680000-0x00007FF63BA72000-memory.dmp	xmrig
behavioral2/memory/4208-103-0x00007FF7916A0000-0x00007FF791A92000-memory.dmp	xmrig
behavioral2/memory/3212-93-0x00007FF63E200000-0x00007FF63E5F2000-memory.dmp	xmrig
behavioral2/memory/2216-80-0x00007FF72C4C0000-0x00007FF72C8B2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
408	WYLFRBS.exe
444	WUMkVVr.exe
4696	HePMgUl.exe
2216	lofsaRf.exe
3212	mbmiXxt.exe
4208	TWCXAiN.exe
980	weSgKbP.exe
5028	IkalWrp.exe
3992	RodomSd.exe
8	FflTsVI.exe
2012	gTopPuD.exe
2072	xORpqlX.exe
3904	vwOedKi.exe
380	ioqFpFY.exe
684	EzfGgjO.exe
2428	nOoOcIq.exe
1664	cRDpHZo.exe
4028	ebuODZi.exe
2816	gitoLIy.exe
788	NeOdCjc.exe
4908	uJyxSIH.exe
3000	juPCxEF.exe
3260	NyievkH.exe
1516	gojDjJe.exe
2340	aFBhnnp.exe
4000	hWTKyJj.exe
2408	uUEdzmJ.exe
2320	QxabdIT.exe
3348	BbOsvNf.exe
1740	jeiVrcc.exe
4832	VXkFkYh.exe
4516	QJrIDne.exe
1448	WyUsfKi.exe
2980	JgYIxif.exe
3232	EuEOjvA.exe
3684	nmsIAeI.exe
4864	BuEyYUb.exe
4232	IFyMkro.exe
3912	eiOqsXI.exe
3920	rnHoMNt.exe
3508	gfIlHem.exe
1636	FIXpRAC.exe
1960	oBqXyqx.exe
3024	YkSsAeK.exe
4928	gqUBSsr.exe
4420	XbBtzzA.exe
1736	VKrqLPc.exe
2712	BTSJIQP.exe
1944	yKnRunX.exe
3540	VQEcMXM.exe
3172	CGvtePu.exe
1912	wETkofC.exe
3016	KjMWsIY.exe
5132	bLxSLWP.exe
5156	ByRMmsT.exe
5180	rWJldtq.exe
5200	XRtiZvd.exe
5216	CTzUfBz.exe
5496	obNyjZE.exe
5528	kXnhuHz.exe
5544	SKHFTkf.exe
5568	ActjbHb.exe
5612	mmgDcDt.exe
5644	LPfWoRO.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4544-0-0x00007FF690090000-0x00007FF690482000-memory.dmp	upx
behavioral2/files/0x000e000000023240-5.dat	upx
behavioral2/files/0x000700000002326f-8.dat	upx
behavioral2/files/0x000800000002326e-11.dat	upx
behavioral2/memory/444-16-0x00007FF6E8080000-0x00007FF6E8472000-memory.dmp	upx
behavioral2/memory/4696-18-0x00007FF779C60000-0x00007FF77A052000-memory.dmp	upx
behavioral2/memory/408-9-0x00007FF649590000-0x00007FF649982000-memory.dmp	upx
behavioral2/files/0x0007000000023270-22.dat	upx
behavioral2/files/0x000800000002326c-27.dat	upx
behavioral2/files/0x0007000000023271-32.dat	upx
behavioral2/files/0x0007000000023272-35.dat	upx
behavioral2/files/0x0007000000023275-49.dat	upx
behavioral2/files/0x0007000000023278-61.dat	upx
behavioral2/files/0x000700000002327c-77.dat	upx
behavioral2/files/0x000700000002327d-100.dat	upx
behavioral2/files/0x0007000000023280-101.dat	upx
behavioral2/memory/5028-133-0x00007FF7AAAA0000-0x00007FF7AAE92000-memory.dmp	upx
behavioral2/memory/2072-137-0x00007FF6B3BB0000-0x00007FF6B3FA2000-memory.dmp	upx
behavioral2/memory/2428-140-0x00007FF6CF030000-0x00007FF6CF422000-memory.dmp	upx
behavioral2/memory/4908-144-0x00007FF7DDF50000-0x00007FF7DE342000-memory.dmp	upx
behavioral2/memory/4028-146-0x00007FF6F9B00000-0x00007FF6F9EF2000-memory.dmp	upx
behavioral2/files/0x000700000002328c-201.dat	upx
behavioral2/files/0x0007000000023290-215.dat	upx
behavioral2/files/0x000700000002328a-220.dat	upx
behavioral2/files/0x000700000002328f-210.dat	upx
behavioral2/files/0x000700000002328e-207.dat	upx
behavioral2/files/0x000700000002328d-204.dat	upx
behavioral2/files/0x0007000000023288-199.dat	upx
behavioral2/files/0x0007000000023281-196.dat	upx
behavioral2/files/0x0007000000023287-192.dat	upx
behavioral2/files/0x0007000000023286-190.dat	upx
behavioral2/files/0x0007000000023285-187.dat	upx
behavioral2/files/0x0007000000023282-182.dat	upx
behavioral2/files/0x0008000000023283-181.dat	upx
behavioral2/files/0x0008000000023284-179.dat	upx
behavioral2/memory/444-1715-0x00007FF6E8080000-0x00007FF6E8472000-memory.dmp	upx
behavioral2/memory/2216-1756-0x00007FF72C4C0000-0x00007FF72C8B2000-memory.dmp	upx
behavioral2/memory/4208-1759-0x00007FF7916A0000-0x00007FF791A92000-memory.dmp	upx
behavioral2/memory/980-1755-0x00007FF63B680000-0x00007FF63BA72000-memory.dmp	upx
behavioral2/memory/8-1758-0x00007FF6750B0000-0x00007FF6754A2000-memory.dmp	upx
behavioral2/memory/408-1712-0x00007FF649590000-0x00007FF649982000-memory.dmp	upx
behavioral2/memory/4696-1711-0x00007FF779C60000-0x00007FF77A052000-memory.dmp	upx
behavioral2/files/0x0007000000023289-162.dat	upx
behavioral2/files/0x000700000002327e-159.dat	upx
behavioral2/memory/380-1822-0x00007FF602D80000-0x00007FF603172000-memory.dmp	upx
behavioral2/memory/3212-1771-0x00007FF63E200000-0x00007FF63E5F2000-memory.dmp	upx
behavioral2/memory/3904-1767-0x00007FF62B160000-0x00007FF62B552000-memory.dmp	upx
behavioral2/memory/5028-1766-0x00007FF7AAAA0000-0x00007FF7AAE92000-memory.dmp	upx
behavioral2/memory/2072-1780-0x00007FF6B3BB0000-0x00007FF6B3FA2000-memory.dmp	upx
behavioral2/memory/2012-1779-0x00007FF77DB90000-0x00007FF77DF82000-memory.dmp	upx
behavioral2/memory/684-1775-0x00007FF7F9920000-0x00007FF7F9D12000-memory.dmp	upx
behavioral2/memory/3992-1770-0x00007FF7F1570000-0x00007FF7F1962000-memory.dmp	upx
behavioral2/memory/2816-1910-0x00007FF747190000-0x00007FF747582000-memory.dmp	upx
behavioral2/memory/788-1909-0x00007FF70F100000-0x00007FF70F4F2000-memory.dmp	upx
behavioral2/memory/4028-1894-0x00007FF6F9B00000-0x00007FF6F9EF2000-memory.dmp	upx
behavioral2/memory/2428-1897-0x00007FF6CF030000-0x00007FF6CF422000-memory.dmp	upx
behavioral2/memory/4908-1891-0x00007FF7DDF50000-0x00007FF7DE342000-memory.dmp	upx
behavioral2/memory/1664-1843-0x00007FF76EB50000-0x00007FF76EF42000-memory.dmp	upx
behavioral2/memory/380-145-0x00007FF602D80000-0x00007FF603172000-memory.dmp	upx
behavioral2/memory/788-143-0x00007FF70F100000-0x00007FF70F4F2000-memory.dmp	upx
behavioral2/memory/2816-142-0x00007FF747190000-0x00007FF747582000-memory.dmp	upx
behavioral2/memory/1664-141-0x00007FF76EB50000-0x00007FF76EF42000-memory.dmp	upx
behavioral2/memory/684-139-0x00007FF7F9920000-0x00007FF7F9D12000-memory.dmp	upx
behavioral2/memory/3904-138-0x00007FF62B160000-0x00007FF62B552000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
12	raw.githubusercontent.com
13	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gqUBSsr.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\LzmyqUi.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\IInIXom.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\QJrIDne.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\JgYIxif.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\lqytHbt.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\kiXWBaL.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\gojDjJe.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\HQtFWpT.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\oqEZkTY.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\sqrKZlV.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\zbzwsNh.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\OYZlRTN.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\mdfCdgb.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\aNmuwQa.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\XdvpZrv.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\SKHFTkf.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\LPfWoRO.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\rMbdpDN.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\KTBiGVX.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\WYLFRBS.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\XcROjuD.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\rKGRRKy.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\bfAsmxx.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\kPAzTzi.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\QphhqEB.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\nbixqlT.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\VKrqLPc.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\gVKbaVE.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\TbQJGZa.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\QgNihPR.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\GgKOrnd.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\iCuhkzo.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\lofsaRf.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\gTopPuD.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\uJyxSIH.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\eiOqsXI.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\TWCXAiN.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\RodomSd.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\IkscTrQ.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\yqStzSA.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\PDcGVbZ.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\gLvJrUk.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\LfNuzlF.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\EzfGgjO.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\XHcWVia.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\XIwPMps.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\xRcfwmR.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\XfWDdWD.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\DztpoPZ.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\zDwMgwO.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\zjAaOWy.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\cGbLLqA.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\djEmBSS.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\vZDpuCM.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\WHxvjgo.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\WUMkVVr.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\LJnaOvj.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\ySNGqKl.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\RzgrDgy.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\FPCcRNQ.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\CGHZucA.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\DfxnWvY.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\GzIbfjT.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4752	powershell.exe
4752	powershell.exe
4752	powershell.exe
4752	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
Token: SeDebugPrivilege	4752	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 4752	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	92
PID 4544 wrote to memory of 4752	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	92
PID 4544 wrote to memory of 408	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	93
PID 4544 wrote to memory of 408	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	93
PID 4544 wrote to memory of 444	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	94
PID 4544 wrote to memory of 444	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	94
PID 4544 wrote to memory of 4696	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	95
PID 4544 wrote to memory of 4696	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	95
PID 4544 wrote to memory of 2216	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	96
PID 4544 wrote to memory of 2216	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	96
PID 4544 wrote to memory of 3212	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	97
PID 4544 wrote to memory of 3212	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	97
PID 4544 wrote to memory of 4208	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	98
PID 4544 wrote to memory of 4208	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	98
PID 4544 wrote to memory of 980	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	99
PID 4544 wrote to memory of 980	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	99
PID 4544 wrote to memory of 5028	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	100
PID 4544 wrote to memory of 5028	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	100
PID 4544 wrote to memory of 3992	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	101
PID 4544 wrote to memory of 3992	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	101
PID 4544 wrote to memory of 8	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	102
PID 4544 wrote to memory of 8	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	102
PID 4544 wrote to memory of 2012	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	103
PID 4544 wrote to memory of 2012	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	103
PID 4544 wrote to memory of 2072	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	104
PID 4544 wrote to memory of 2072	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	104
PID 4544 wrote to memory of 3904	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	105
PID 4544 wrote to memory of 3904	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	105
PID 4544 wrote to memory of 380	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	106
PID 4544 wrote to memory of 380	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	106
PID 4544 wrote to memory of 684	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	107
PID 4544 wrote to memory of 684	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	107
PID 4544 wrote to memory of 2428	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	108
PID 4544 wrote to memory of 2428	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	108
PID 4544 wrote to memory of 1664	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	109
PID 4544 wrote to memory of 1664	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	109
PID 4544 wrote to memory of 788	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	110
PID 4544 wrote to memory of 788	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	110
PID 4544 wrote to memory of 4028	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	111
PID 4544 wrote to memory of 4028	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	111
PID 4544 wrote to memory of 2816	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	112
PID 4544 wrote to memory of 2816	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	112
PID 4544 wrote to memory of 4908	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	113
PID 4544 wrote to memory of 4908	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	113
PID 4544 wrote to memory of 4000	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	114
PID 4544 wrote to memory of 4000	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	114
PID 4544 wrote to memory of 3000	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	115
PID 4544 wrote to memory of 3000	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	115
PID 4544 wrote to memory of 3260	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	116
PID 4544 wrote to memory of 3260	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	116
PID 4544 wrote to memory of 1516	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	117
PID 4544 wrote to memory of 1516	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	117
PID 4544 wrote to memory of 2340	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	118
PID 4544 wrote to memory of 2340	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	118
PID 4544 wrote to memory of 2408	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	119
PID 4544 wrote to memory of 2408	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	119
PID 4544 wrote to memory of 2320	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	120
PID 4544 wrote to memory of 2320	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	120
PID 4544 wrote to memory of 3348	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	121
PID 4544 wrote to memory of 3348	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	121
PID 4544 wrote to memory of 1740	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	122
PID 4544 wrote to memory of 1740	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	122
PID 4544 wrote to memory of 4832	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	123
PID 4544 wrote to memory of 4832	4544	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	123

C:\Users\Admin\AppData\Local\Temp\0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4752
- C:\Windows\System\WYLFRBS.exe
  C:\Windows\System\WYLFRBS.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\WUMkVVr.exe
  C:\Windows\System\WUMkVVr.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\HePMgUl.exe
  C:\Windows\System\HePMgUl.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\lofsaRf.exe
  C:\Windows\System\lofsaRf.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\mbmiXxt.exe
  C:\Windows\System\mbmiXxt.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\TWCXAiN.exe
  C:\Windows\System\TWCXAiN.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\weSgKbP.exe
  C:\Windows\System\weSgKbP.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\IkalWrp.exe
  C:\Windows\System\IkalWrp.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\RodomSd.exe
  C:\Windows\System\RodomSd.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\FflTsVI.exe
  C:\Windows\System\FflTsVI.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\gTopPuD.exe
  C:\Windows\System\gTopPuD.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\xORpqlX.exe
  C:\Windows\System\xORpqlX.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\vwOedKi.exe
  C:\Windows\System\vwOedKi.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\ioqFpFY.exe
  C:\Windows\System\ioqFpFY.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\EzfGgjO.exe
  C:\Windows\System\EzfGgjO.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\nOoOcIq.exe
  C:\Windows\System\nOoOcIq.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\cRDpHZo.exe
  C:\Windows\System\cRDpHZo.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\NeOdCjc.exe
  C:\Windows\System\NeOdCjc.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\ebuODZi.exe
  C:\Windows\System\ebuODZi.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\gitoLIy.exe
  C:\Windows\System\gitoLIy.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\uJyxSIH.exe
  C:\Windows\System\uJyxSIH.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\hWTKyJj.exe
  C:\Windows\System\hWTKyJj.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\juPCxEF.exe
  C:\Windows\System\juPCxEF.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\NyievkH.exe
  C:\Windows\System\NyievkH.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\gojDjJe.exe
  C:\Windows\System\gojDjJe.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\aFBhnnp.exe
  C:\Windows\System\aFBhnnp.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\uUEdzmJ.exe
  C:\Windows\System\uUEdzmJ.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\QxabdIT.exe
  C:\Windows\System\QxabdIT.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\BbOsvNf.exe
  C:\Windows\System\BbOsvNf.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\jeiVrcc.exe
  C:\Windows\System\jeiVrcc.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\VXkFkYh.exe
  C:\Windows\System\VXkFkYh.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\XbBtzzA.exe
  C:\Windows\System\XbBtzzA.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\QJrIDne.exe
  C:\Windows\System\QJrIDne.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\WyUsfKi.exe
  C:\Windows\System\WyUsfKi.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\JgYIxif.exe
  C:\Windows\System\JgYIxif.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\EuEOjvA.exe
  C:\Windows\System\EuEOjvA.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\nmsIAeI.exe
  C:\Windows\System\nmsIAeI.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\BuEyYUb.exe
  C:\Windows\System\BuEyYUb.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\IFyMkro.exe
  C:\Windows\System\IFyMkro.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\eiOqsXI.exe
  C:\Windows\System\eiOqsXI.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\rnHoMNt.exe
  C:\Windows\System\rnHoMNt.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\gfIlHem.exe
  C:\Windows\System\gfIlHem.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\FIXpRAC.exe
  C:\Windows\System\FIXpRAC.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\oBqXyqx.exe
  C:\Windows\System\oBqXyqx.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\YkSsAeK.exe
  C:\Windows\System\YkSsAeK.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\gqUBSsr.exe
  C:\Windows\System\gqUBSsr.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\VKrqLPc.exe
  C:\Windows\System\VKrqLPc.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\BTSJIQP.exe
  C:\Windows\System\BTSJIQP.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\yKnRunX.exe
  C:\Windows\System\yKnRunX.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\VQEcMXM.exe
  C:\Windows\System\VQEcMXM.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\CGvtePu.exe
  C:\Windows\System\CGvtePu.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\wETkofC.exe
  C:\Windows\System\wETkofC.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\KjMWsIY.exe
  C:\Windows\System\KjMWsIY.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\bLxSLWP.exe
  C:\Windows\System\bLxSLWP.exe
  2⤵
  - Executes dropped EXE
  PID:5132
- C:\Windows\System\ByRMmsT.exe
  C:\Windows\System\ByRMmsT.exe
  2⤵
  - Executes dropped EXE
  PID:5156
- C:\Windows\System\rWJldtq.exe
  C:\Windows\System\rWJldtq.exe
  2⤵
  - Executes dropped EXE
  PID:5180
- C:\Windows\System\XRtiZvd.exe
  C:\Windows\System\XRtiZvd.exe
  2⤵
  - Executes dropped EXE
  PID:5200
- C:\Windows\System\CTzUfBz.exe
  C:\Windows\System\CTzUfBz.exe
  2⤵
  - Executes dropped EXE
  PID:5216
- C:\Windows\System\obNyjZE.exe
  C:\Windows\System\obNyjZE.exe
  2⤵
  - Executes dropped EXE
  PID:5496
- C:\Windows\System\kXnhuHz.exe
  C:\Windows\System\kXnhuHz.exe
  2⤵
  - Executes dropped EXE
  PID:5528
- C:\Windows\System\SKHFTkf.exe
  C:\Windows\System\SKHFTkf.exe
  2⤵
  - Executes dropped EXE
  PID:5544
- C:\Windows\System\ActjbHb.exe
  C:\Windows\System\ActjbHb.exe
  2⤵
  - Executes dropped EXE
  PID:5568
- C:\Windows\System\mmgDcDt.exe
  C:\Windows\System\mmgDcDt.exe
  2⤵
  - Executes dropped EXE
  PID:5612
- C:\Windows\System\LPfWoRO.exe
  C:\Windows\System\LPfWoRO.exe
  2⤵
  - Executes dropped EXE
  PID:5644
- C:\Windows\System\IkTCOZc.exe
  C:\Windows\System\IkTCOZc.exe
  2⤵
  PID:5660
- C:\Windows\System\HQtFWpT.exe
  C:\Windows\System\HQtFWpT.exe
  2⤵
  PID:5680
- C:\Windows\System\lCvddjI.exe
  C:\Windows\System\lCvddjI.exe
  2⤵
  PID:5752
- C:\Windows\System\FQJbEuN.exe
  C:\Windows\System\FQJbEuN.exe
  2⤵
  PID:5780
- C:\Windows\System\lDOYeJU.exe
  C:\Windows\System\lDOYeJU.exe
  2⤵
  PID:5800
- C:\Windows\System\oQCAihe.exe
  C:\Windows\System\oQCAihe.exe
  2⤵
  PID:5816
- C:\Windows\System\vZFLuyt.exe
  C:\Windows\System\vZFLuyt.exe
  2⤵
  PID:5832
- C:\Windows\System\QxVCFSb.exe
  C:\Windows\System\QxVCFSb.exe
  2⤵
  PID:5848
- C:\Windows\System\OEnNIKH.exe
  C:\Windows\System\OEnNIKH.exe
  2⤵
  PID:5864
- C:\Windows\System\mMRiVZB.exe
  C:\Windows\System\mMRiVZB.exe
  2⤵
  PID:5880
- C:\Windows\System\QgNihPR.exe
  C:\Windows\System\QgNihPR.exe
  2⤵
  PID:5900
- C:\Windows\System\KSfYuGG.exe
  C:\Windows\System\KSfYuGG.exe
  2⤵
  PID:5916
- C:\Windows\System\bfLVMgv.exe
  C:\Windows\System\bfLVMgv.exe
  2⤵
  PID:5932
- C:\Windows\System\xSytmUf.exe
  C:\Windows\System\xSytmUf.exe
  2⤵
  PID:5956
- C:\Windows\System\tEyAmYW.exe
  C:\Windows\System\tEyAmYW.exe
  2⤵
  PID:5976
- C:\Windows\System\GgKOrnd.exe
  C:\Windows\System\GgKOrnd.exe
  2⤵
  PID:5992
- C:\Windows\System\PTceTKI.exe
  C:\Windows\System\PTceTKI.exe
  2⤵
  PID:6008
- C:\Windows\System\lXNqZzq.exe
  C:\Windows\System\lXNqZzq.exe
  2⤵
  PID:6052
- C:\Windows\System\NSeQIVh.exe
  C:\Windows\System\NSeQIVh.exe
  2⤵
  PID:6068
- C:\Windows\System\TmnmBcM.exe
  C:\Windows\System\TmnmBcM.exe
  2⤵
  PID:6084
- C:\Windows\System\LJnaOvj.exe
  C:\Windows\System\LJnaOvj.exe
  2⤵
  PID:6100
- C:\Windows\System\bfAsmxx.exe
  C:\Windows\System\bfAsmxx.exe
  2⤵
  PID:6116
- C:\Windows\System\FwBjxVS.exe
  C:\Windows\System\FwBjxVS.exe
  2⤵
  PID:6132
- C:\Windows\System\XHcWVia.exe
  C:\Windows\System\XHcWVia.exe
  2⤵
  PID:2416
- C:\Windows\System\RzikTjr.exe
  C:\Windows\System\RzikTjr.exe
  2⤵
  PID:4336
- C:\Windows\System\zDwMgwO.exe
  C:\Windows\System\zDwMgwO.exe
  2⤵
  PID:412
- C:\Windows\System\tWYiNrO.exe
  C:\Windows\System\tWYiNrO.exe
  2⤵
  PID:116
- C:\Windows\System\dsmsoGF.exe
  C:\Windows\System\dsmsoGF.exe
  2⤵
  PID:3868
- C:\Windows\System\zjAaOWy.exe
  C:\Windows\System\zjAaOWy.exe
  2⤵
  PID:1016
- C:\Windows\System\RzgrDgy.exe
  C:\Windows\System\RzgrDgy.exe
  2⤵
  PID:2424
- C:\Windows\System\gmUDteC.exe
  C:\Windows\System\gmUDteC.exe
  2⤵
  PID:3900
- C:\Windows\System\nBMHDoA.exe
  C:\Windows\System\nBMHDoA.exe
  2⤵
  PID:1568
- C:\Windows\System\kPAzTzi.exe
  C:\Windows\System\kPAzTzi.exe
  2⤵
  PID:4472
- C:\Windows\System\iCuhkzo.exe
  C:\Windows\System\iCuhkzo.exe
  2⤵
  PID:5212
- C:\Windows\System\zkWsyuV.exe
  C:\Windows\System\zkWsyuV.exe
  2⤵
  PID:5324
- C:\Windows\System\KwTFYgw.exe
  C:\Windows\System\KwTFYgw.exe
  2⤵
  PID:5604
- C:\Windows\System\UkExdIM.exe
  C:\Windows\System\UkExdIM.exe
  2⤵
  PID:5540
- C:\Windows\System\PDcGVbZ.exe
  C:\Windows\System\PDcGVbZ.exe
  2⤵
  PID:5484
- C:\Windows\System\rMbdpDN.exe
  C:\Windows\System\rMbdpDN.exe
  2⤵
  PID:5468
- C:\Windows\System\cGbLLqA.exe
  C:\Windows\System\cGbLLqA.exe
  2⤵
  PID:5624
- C:\Windows\System\EkryKze.exe
  C:\Windows\System\EkryKze.exe
  2⤵
  PID:5728
- C:\Windows\System\KNgWCwL.exe
  C:\Windows\System\KNgWCwL.exe
  2⤵
  PID:5792
- C:\Windows\System\CGHZucA.exe
  C:\Windows\System\CGHZucA.exe
  2⤵
  PID:5840
- C:\Windows\System\VumMKgg.exe
  C:\Windows\System\VumMKgg.exe
  2⤵
  PID:5876
- C:\Windows\System\XjcfbYt.exe
  C:\Windows\System\XjcfbYt.exe
  2⤵
  PID:5928
- C:\Windows\System\LJeujQJ.exe
  C:\Windows\System\LJeujQJ.exe
  2⤵
  PID:5968
- C:\Windows\System\sumrZTt.exe
  C:\Windows\System\sumrZTt.exe
  2⤵
  PID:6016
- C:\Windows\System\djEmBSS.exe
  C:\Windows\System\djEmBSS.exe
  2⤵
  PID:6064
- C:\Windows\System\oqEZkTY.exe
  C:\Windows\System\oqEZkTY.exe
  2⤵
  PID:6124
- C:\Windows\System\IkscTrQ.exe
  C:\Windows\System\IkscTrQ.exe
  2⤵
  PID:6148
- C:\Windows\System\jlAGznX.exe
  C:\Windows\System\jlAGznX.exe
  2⤵
  PID:6172
- C:\Windows\System\ySNGqKl.exe
  C:\Windows\System\ySNGqKl.exe
  2⤵
  PID:6196
- C:\Windows\System\MhhFfRt.exe
  C:\Windows\System\MhhFfRt.exe
  2⤵
  PID:6212
- C:\Windows\System\nKpXVxS.exe
  C:\Windows\System\nKpXVxS.exe
  2⤵
  PID:6236
- C:\Windows\System\XcROjuD.exe
  C:\Windows\System\XcROjuD.exe
  2⤵
  PID:6260
- C:\Windows\System\gLvJrUk.exe
  C:\Windows\System\gLvJrUk.exe
  2⤵
  PID:6276
- C:\Windows\System\vZDpuCM.exe
  C:\Windows\System\vZDpuCM.exe
  2⤵
  PID:6312
- C:\Windows\System\bvthOYd.exe
  C:\Windows\System\bvthOYd.exe
  2⤵
  PID:6328
- C:\Windows\System\MLstTty.exe
  C:\Windows\System\MLstTty.exe
  2⤵
  PID:6408
- C:\Windows\System\DfxnWvY.exe
  C:\Windows\System\DfxnWvY.exe
  2⤵
  PID:6452
- C:\Windows\System\sqrKZlV.exe
  C:\Windows\System\sqrKZlV.exe
  2⤵
  PID:6468
- C:\Windows\System\OytGokZ.exe
  C:\Windows\System\OytGokZ.exe
  2⤵
  PID:6488
- C:\Windows\System\XIwPMps.exe
  C:\Windows\System\XIwPMps.exe
  2⤵
  PID:6708
- C:\Windows\System\ICRpzBa.exe
  C:\Windows\System\ICRpzBa.exe
  2⤵
  PID:6736
- C:\Windows\System\hIAgRUl.exe
  C:\Windows\System\hIAgRUl.exe
  2⤵
  PID:6756
- C:\Windows\System\GzIbfjT.exe
  C:\Windows\System\GzIbfjT.exe
  2⤵
  PID:6776
- C:\Windows\System\daJChPb.exe
  C:\Windows\System\daJChPb.exe
  2⤵
  PID:6796
- C:\Windows\System\oFMNwmi.exe
  C:\Windows\System\oFMNwmi.exe
  2⤵
  PID:6820
- C:\Windows\System\XfWDdWD.exe
  C:\Windows\System\XfWDdWD.exe
  2⤵
  PID:6836
- C:\Windows\System\gDmsprh.exe
  C:\Windows\System\gDmsprh.exe
  2⤵
  PID:6852
- C:\Windows\System\OYZlRTN.exe
  C:\Windows\System\OYZlRTN.exe
  2⤵
  PID:6872
- C:\Windows\System\xRcfwmR.exe
  C:\Windows\System\xRcfwmR.exe
  2⤵
  PID:6896
- C:\Windows\System\PphfXBD.exe
  C:\Windows\System\PphfXBD.exe
  2⤵
  PID:6912
- C:\Windows\System\xfAdyfI.exe
  C:\Windows\System\xfAdyfI.exe
  2⤵
  PID:6928
- C:\Windows\System\ljRkLuI.exe
  C:\Windows\System\ljRkLuI.exe
  2⤵
  PID:6948
- C:\Windows\System\LfNuzlF.exe
  C:\Windows\System\LfNuzlF.exe
  2⤵
  PID:6972
- C:\Windows\System\duCPAnN.exe
  C:\Windows\System\duCPAnN.exe
  2⤵
  PID:6996
- C:\Windows\System\QZKsQBx.exe
  C:\Windows\System\QZKsQBx.exe
  2⤵
  PID:7016
- C:\Windows\System\WHxvjgo.exe
  C:\Windows\System\WHxvjgo.exe
  2⤵
  PID:7056
- C:\Windows\System\PCTexYx.exe
  C:\Windows\System\PCTexYx.exe
  2⤵
  PID:7072
- C:\Windows\System\rKGRRKy.exe
  C:\Windows\System\rKGRRKy.exe
  2⤵
  PID:7088
- C:\Windows\System\yTuOpwt.exe
  C:\Windows\System\yTuOpwt.exe
  2⤵
  PID:7104
- C:\Windows\System\dFoduWV.exe
  C:\Windows\System\dFoduWV.exe
  2⤵
  PID:7124
- C:\Windows\System\DrNHxOp.exe
  C:\Windows\System\DrNHxOp.exe
  2⤵
  PID:7164
- C:\Windows\System\CVrezGw.exe
  C:\Windows\System\CVrezGw.exe
  2⤵
  PID:2996
- C:\Windows\System\lQBQooe.exe
  C:\Windows\System\lQBQooe.exe
  2⤵
  PID:4592
- C:\Windows\System\DnHSzIp.exe
  C:\Windows\System\DnHSzIp.exe
  2⤵
  PID:4136
- C:\Windows\System\WITCGNn.exe
  C:\Windows\System\WITCGNn.exe
  2⤵
  PID:1800
- C:\Windows\System\NkfUOse.exe
  C:\Windows\System\NkfUOse.exe
  2⤵
  PID:4600
- C:\Windows\System\dZqLxZD.exe
  C:\Windows\System\dZqLxZD.exe
  2⤵
  PID:5444
- C:\Windows\System\aQuYXCg.exe
  C:\Windows\System\aQuYXCg.exe
  2⤵
  PID:5556
- C:\Windows\System\gxybFcy.exe
  C:\Windows\System\gxybFcy.exe
  2⤵
  PID:5452
- C:\Windows\System\YCpPYsq.exe
  C:\Windows\System\YCpPYsq.exe
  2⤵
  PID:5760
- C:\Windows\System\HpijsDH.exe
  C:\Windows\System\HpijsDH.exe
  2⤵
  PID:5860
- C:\Windows\System\ubcfEjO.exe
  C:\Windows\System\ubcfEjO.exe
  2⤵
  PID:5924
- C:\Windows\System\lqytHbt.exe
  C:\Windows\System\lqytHbt.exe
  2⤵
  PID:4608
- C:\Windows\System\vjVdtas.exe
  C:\Windows\System\vjVdtas.exe
  2⤵
  PID:6080
- C:\Windows\System\nNzLsNH.exe
  C:\Windows\System\nNzLsNH.exe
  2⤵
  PID:6140
- C:\Windows\System\NYmlGuS.exe
  C:\Windows\System\NYmlGuS.exe
  2⤵
  PID:6208
- C:\Windows\System\LzmyqUi.exe
  C:\Windows\System\LzmyqUi.exe
  2⤵
  PID:6232
- C:\Windows\System\mdfCdgb.exe
  C:\Windows\System\mdfCdgb.exe
  2⤵
  PID:3676
- C:\Windows\System\BAcRvQC.exe
  C:\Windows\System\BAcRvQC.exe
  2⤵
  PID:6388
- C:\Windows\System\yQxPoLl.exe
  C:\Windows\System\yQxPoLl.exe
  2⤵
  PID:6436
- C:\Windows\System\ltzAFSV.exe
  C:\Windows\System\ltzAFSV.exe
  2⤵
  PID:6476
- C:\Windows\System\RCHhqcm.exe
  C:\Windows\System\RCHhqcm.exe
  2⤵
  PID:4476
- C:\Windows\System\SqWHhMW.exe
  C:\Windows\System\SqWHhMW.exe
  2⤵
  PID:1088
- C:\Windows\System\FPCcRNQ.exe
  C:\Windows\System\FPCcRNQ.exe
  2⤵
  PID:1376
- C:\Windows\System\RkyaFup.exe
  C:\Windows\System\RkyaFup.exe
  2⤵
  PID:2028
- C:\Windows\System\QphhqEB.exe
  C:\Windows\System\QphhqEB.exe
  2⤵
  PID:4200
- C:\Windows\System\egQyery.exe
  C:\Windows\System\egQyery.exe
  2⤵
  PID:4640
- C:\Windows\System\DztpoPZ.exe
  C:\Windows\System\DztpoPZ.exe
  2⤵
  PID:2440
- C:\Windows\System\zqhQNRG.exe
  C:\Windows\System\zqhQNRG.exe
  2⤵
  PID:3620
- C:\Windows\System\VcSzBnA.exe
  C:\Windows\System\VcSzBnA.exe
  2⤵
  PID:6844
- C:\Windows\System\wsexrBF.exe
  C:\Windows\System\wsexrBF.exe
  2⤵
  PID:6924
- C:\Windows\System\zbzwsNh.exe
  C:\Windows\System\zbzwsNh.exe
  2⤵
  PID:6684
- C:\Windows\System\DygxBVL.exe
  C:\Windows\System\DygxBVL.exe
  2⤵
  PID:4272
- C:\Windows\System\cWMPBOO.exe
  C:\Windows\System\cWMPBOO.exe
  2⤵
  PID:5460
- C:\Windows\System\narOSMB.exe
  C:\Windows\System\narOSMB.exe
  2⤵
  PID:6220
- C:\Windows\System\NHtORDh.exe
  C:\Windows\System\NHtORDh.exe
  2⤵
  PID:6696
- C:\Windows\System\KYAFIwL.exe
  C:\Windows\System\KYAFIwL.exe
  2⤵
  PID:7136
- C:\Windows\System\KTBiGVX.exe
  C:\Windows\System\KTBiGVX.exe
  2⤵
  PID:7184
- C:\Windows\System\aNmuwQa.exe
  C:\Windows\System\aNmuwQa.exe
  2⤵
  PID:7208
- C:\Windows\System\SiyZTWQ.exe
  C:\Windows\System\SiyZTWQ.exe
  2⤵
  PID:7240
- C:\Windows\System\LosnLKd.exe
  C:\Windows\System\LosnLKd.exe
  2⤵
  PID:7256
- C:\Windows\System\vQZonwj.exe
  C:\Windows\System\vQZonwj.exe
  2⤵
  PID:7280
- C:\Windows\System\gVKbaVE.exe
  C:\Windows\System\gVKbaVE.exe
  2⤵
  PID:7304
- C:\Windows\System\zjoSBZN.exe
  C:\Windows\System\zjoSBZN.exe
  2⤵
  PID:7320
- C:\Windows\System\XdvpZrv.exe
  C:\Windows\System\XdvpZrv.exe
  2⤵
  PID:7340
- C:\Windows\System\WmpJubs.exe
  C:\Windows\System\WmpJubs.exe
  2⤵
  PID:7356
- C:\Windows\System\yqStzSA.exe
  C:\Windows\System\yqStzSA.exe
  2⤵
  PID:7376
- C:\Windows\System\jVnSNXL.exe
  C:\Windows\System\jVnSNXL.exe
  2⤵
  PID:7396
- C:\Windows\System\TbQJGZa.exe
  C:\Windows\System\TbQJGZa.exe
  2⤵
  PID:7412
- C:\Windows\System\yeTyncQ.exe
  C:\Windows\System\yeTyncQ.exe
  2⤵
  PID:7432
- C:\Windows\System\nbixqlT.exe
  C:\Windows\System\nbixqlT.exe
  2⤵
  PID:7448
- C:\Windows\System\VFBgktd.exe
  C:\Windows\System\VFBgktd.exe
  2⤵
  PID:7468
- C:\Windows\System\sUYEuLA.exe
  C:\Windows\System\sUYEuLA.exe
  2⤵
  PID:7484
- C:\Windows\System\IInIXom.exe
  C:\Windows\System\IInIXom.exe
  2⤵
  PID:7504
- C:\Windows\System\JeZYuJG.exe
  C:\Windows\System\JeZYuJG.exe
  2⤵
  PID:7524
- C:\Windows\System\kiXWBaL.exe
  C:\Windows\System\kiXWBaL.exe
  2⤵
  PID:7700
- C:\Windows\System\vBXlmsN.exe
  C:\Windows\System\vBXlmsN.exe
  2⤵
  PID:7872
- C:\Windows\System\lHImaPv.exe
  C:\Windows\System\lHImaPv.exe
  2⤵
  PID:7888
- C:\Windows\System\mmXELtF.exe
  C:\Windows\System\mmXELtF.exe
  2⤵
  PID:7912
- C:\Windows\System\yektorp.exe
  C:\Windows\System\yektorp.exe
  2⤵
  PID:7928
- C:\Windows\System\xmTOjad.exe
  C:\Windows\System\xmTOjad.exe
  2⤵
  PID:7948
- C:\Windows\System\WacWcJA.exe
  C:\Windows\System\WacWcJA.exe
  2⤵
  PID:7972
- C:\Windows\System\FXVDsKU.exe
  C:\Windows\System\FXVDsKU.exe
  2⤵
  PID:7988
- C:\Windows\System\QbBPSox.exe
  C:\Windows\System\QbBPSox.exe
  2⤵
  PID:8016
- C:\Windows\System\GhkdXAA.exe
  C:\Windows\System\GhkdXAA.exe
  2⤵
  PID:8160
- C:\Windows\System\LginHqR.exe
  C:\Windows\System\LginHqR.exe
  2⤵
  PID:8184
- C:\Windows\System\bLnyHqK.exe
  C:\Windows\System\bLnyHqK.exe
  2⤵
  PID:6764
- C:\Windows\System\tXpXGDb.exe
  C:\Windows\System\tXpXGDb.exe
  2⤵
  PID:2892
- C:\Windows\System\AbuGvpg.exe
  C:\Windows\System\AbuGvpg.exe
  2⤵
  PID:404
- C:\Windows\System\YqfTiNH.exe
  C:\Windows\System\YqfTiNH.exe
  2⤵
  PID:1932
- C:\Windows\System\ElCulQx.exe
  C:\Windows\System\ElCulQx.exe
  2⤵
  PID:500
- C:\Windows\System\FEzFBmv.exe
  C:\Windows\System\FEzFBmv.exe
  2⤵
  PID:5892
- C:\Windows\System\QOXsrhF.exe
  C:\Windows\System\QOXsrhF.exe
  2⤵
  PID:6020
- C:\Windows\System\ycpxeQj.exe
  C:\Windows\System\ycpxeQj.exe
  2⤵
  PID:7012
- C:\Windows\System\JhZRsSi.exe
  C:\Windows\System\JhZRsSi.exe
  2⤵
  PID:1360
- C:\Windows\System\otJVkfp.exe
  C:\Windows\System\otJVkfp.exe
  2⤵
  PID:7120
- C:\Windows\System\hXjrPzO.exe
  C:\Windows\System\hXjrPzO.exe
  2⤵
  PID:7160
- C:\Windows\System\yXeshsN.exe
  C:\Windows\System\yXeshsN.exe
  2⤵
  PID:7252
- C:\Windows\System\ezaVYNe.exe
  C:\Windows\System\ezaVYNe.exe
  2⤵
  PID:7292
- C:\Windows\System\OLwGerB.exe
  C:\Windows\System\OLwGerB.exe
  2⤵
  PID:552
- C:\Windows\System\sIStKuj.exe
  C:\Windows\System\sIStKuj.exe
  2⤵
  PID:4040
- C:\Windows\System\KigvRdM.exe
  C:\Windows\System\KigvRdM.exe
  2⤵
  PID:5492
- C:\Windows\System\vnZFyRl.exe
  C:\Windows\System\vnZFyRl.exe
  2⤵
  PID:7476
- C:\Windows\System\kGEwVZo.exe
  C:\Windows\System\kGEwVZo.exe
  2⤵
  PID:2248
- C:\Windows\System\uERRHca.exe
  C:\Windows\System\uERRHca.exe
  2⤵
  PID:5740
- C:\Windows\System\JNcfHsA.exe
  C:\Windows\System\JNcfHsA.exe
  2⤵
  PID:6656
- C:\Windows\System\XfjsXZB.exe
  C:\Windows\System\XfjsXZB.exe
  2⤵
  PID:7200
- C:\Windows\System\NkYkxzj.exe
  C:\Windows\System\NkYkxzj.exe
  2⤵
  PID:7384
- C:\Windows\System\BbXXAmJ.exe
  C:\Windows\System\BbXXAmJ.exe
  2⤵
  PID:7520
- C:\Windows\System\rKgAlYG.exe
  C:\Windows\System\rKgAlYG.exe
  2⤵
  PID:7616
- C:\Windows\System\wFsvvla.exe
  C:\Windows\System\wFsvvla.exe
  2⤵
  PID:7668
- C:\Windows\System\NlhukGf.exe
  C:\Windows\System\NlhukGf.exe
  2⤵
  PID:7920
- C:\Windows\System\qMwCAFq.exe
  C:\Windows\System\qMwCAFq.exe
  2⤵
  PID:7780
- C:\Windows\System\ZuhfDqC.exe
  C:\Windows\System\ZuhfDqC.exe
  2⤵
  PID:7936
- C:\Windows\System\JLPCZHy.exe
  C:\Windows\System\JLPCZHy.exe
  2⤵
  PID:8024
- C:\Windows\System\kQZuFwg.exe
  C:\Windows\System\kQZuFwg.exe
  2⤵
  PID:6752
- C:\Windows\System\YfnDlmA.exe
  C:\Windows\System\YfnDlmA.exe
  2⤵
  PID:7480
- C:\Windows\System\FaKavZX.exe
  C:\Windows\System\FaKavZX.exe
  2⤵
  PID:8212
- C:\Windows\System\ODlvsFR.exe
  C:\Windows\System\ODlvsFR.exe
  2⤵
  PID:8236
- C:\Windows\System\ygWcpMD.exe
  C:\Windows\System\ygWcpMD.exe
  2⤵
  PID:8252
- C:\Windows\System\nPYCtAG.exe
  C:\Windows\System\nPYCtAG.exe
  2⤵
  PID:8272
- C:\Windows\System\GZQhnjg.exe
  C:\Windows\System\GZQhnjg.exe
  2⤵
  PID:8292
- C:\Windows\System\zvGHOFk.exe
  C:\Windows\System\zvGHOFk.exe
  2⤵
  PID:8312
- C:\Windows\System\CkCFadv.exe
  C:\Windows\System\CkCFadv.exe
  2⤵
  PID:8328
- C:\Windows\System\uaDdKgT.exe
  C:\Windows\System\uaDdKgT.exe
  2⤵
  PID:8352
- C:\Windows\System\ImCawoC.exe
  C:\Windows\System\ImCawoC.exe
  2⤵
  PID:8376
- C:\Windows\System\BlreKtj.exe
  C:\Windows\System\BlreKtj.exe
  2⤵
  PID:8392
- C:\Windows\System\DsloEVl.exe
  C:\Windows\System\DsloEVl.exe
  2⤵
  PID:8416
- C:\Windows\System\TPWVONR.exe
  C:\Windows\System\TPWVONR.exe
  2⤵
  PID:8432
- C:\Windows\System\rtzgEgG.exe
  C:\Windows\System\rtzgEgG.exe
  2⤵
  PID:8448
- C:\Windows\System\UIvTXGW.exe
  C:\Windows\System\UIvTXGW.exe
  2⤵
  PID:8468
- C:\Windows\System\rgCXsVo.exe
  C:\Windows\System\rgCXsVo.exe
  2⤵
  PID:8492
- C:\Windows\System\SitUxLI.exe
  C:\Windows\System\SitUxLI.exe
  2⤵
  PID:8508
- C:\Windows\System\zIUdtvA.exe
  C:\Windows\System\zIUdtvA.exe
  2⤵
  PID:8532
- C:\Windows\System\DIwJoBY.exe
  C:\Windows\System\DIwJoBY.exe
  2⤵
  PID:8548
- C:\Windows\System\jLCCiZL.exe
  C:\Windows\System\jLCCiZL.exe
  2⤵
  PID:8564
- C:\Windows\System\EuUSwxL.exe
  C:\Windows\System\EuUSwxL.exe
  2⤵
  PID:8584
- C:\Windows\System\IsSPaJs.exe
  C:\Windows\System\IsSPaJs.exe
  2⤵
  PID:8604
- C:\Windows\System\HElLOEe.exe
  C:\Windows\System\HElLOEe.exe
  2⤵
  PID:8620
- C:\Windows\System\dYYbqik.exe
  C:\Windows\System\dYYbqik.exe
  2⤵
  PID:8640
- C:\Windows\System\PYbvHiZ.exe
  C:\Windows\System\PYbvHiZ.exe
  2⤵
  PID:8664
- C:\Windows\System\iIBUZAS.exe
  C:\Windows\System\iIBUZAS.exe
  2⤵
  PID:8684
- C:\Windows\System\ULdbpFg.exe
  C:\Windows\System\ULdbpFg.exe
  2⤵
  PID:8704
- C:\Windows\System\ObBcQWA.exe
  C:\Windows\System\ObBcQWA.exe
  2⤵
  PID:8724
- C:\Windows\System\NeiONtO.exe
  C:\Windows\System\NeiONtO.exe
  2⤵
  PID:8744
- C:\Windows\System\QjMSpcf.exe
  C:\Windows\System\QjMSpcf.exe
  2⤵
  PID:8760
- C:\Windows\System\xFgUDVo.exe
  C:\Windows\System\xFgUDVo.exe
  2⤵
  PID:8776
- C:\Windows\System\oolRzTy.exe
  C:\Windows\System\oolRzTy.exe
  2⤵
  PID:8796
- C:\Windows\System\tsIODiu.exe
  C:\Windows\System\tsIODiu.exe
  2⤵
  PID:8812
- C:\Windows\System\dxjUOgf.exe
  C:\Windows\System\dxjUOgf.exe
  2⤵
  PID:8832
- C:\Windows\System\USxCEHY.exe
  C:\Windows\System\USxCEHY.exe
  2⤵
  PID:8852
- C:\Windows\System\GgMCDhA.exe
  C:\Windows\System\GgMCDhA.exe
  2⤵
  PID:8868
- C:\Windows\System\TerXMaV.exe
  C:\Windows\System\TerXMaV.exe
  2⤵
  PID:8896
- C:\Windows\System\PhhnEoj.exe
  C:\Windows\System\PhhnEoj.exe
  2⤵
  PID:9004
- C:\Windows\System\utdVtXU.exe
  C:\Windows\System\utdVtXU.exe
  2⤵
  PID:9020
- C:\Windows\System\tMLvujy.exe
  C:\Windows\System\tMLvujy.exe
  2⤵
  PID:9044
- C:\Windows\System\SZkTrcT.exe
  C:\Windows\System\SZkTrcT.exe
  2⤵
  PID:9068
- C:\Windows\System\aibqHYI.exe
  C:\Windows\System\aibqHYI.exe
  2⤵
  PID:9092
- C:\Windows\System\aldFYTL.exe
  C:\Windows\System\aldFYTL.exe
  2⤵
  PID:9112
- C:\Windows\System\qoSOyiS.exe
  C:\Windows\System\qoSOyiS.exe
  2⤵
  PID:7964
- C:\Windows\System\GeCFnBs.exe
  C:\Windows\System\GeCFnBs.exe
  2⤵
  PID:7048
- C:\Windows\System\EgEaiVM.exe
  C:\Windows\System\EgEaiVM.exe
  2⤵
  PID:1392
- C:\Windows\System\bkQrQlG.exe
  C:\Windows\System\bkQrQlG.exe
  2⤵
  PID:1140
- C:\Windows\System\IYVnxOY.exe
  C:\Windows\System\IYVnxOY.exe
  2⤵
  PID:3144
- C:\Windows\System\tprOwsv.exe
  C:\Windows\System\tprOwsv.exe
  2⤵
  PID:8244
- C:\Windows\System\Ytoshal.exe
  C:\Windows\System\Ytoshal.exe
  2⤵
  PID:8364
- C:\Windows\System\oLjIndT.exe
  C:\Windows\System\oLjIndT.exe
  2⤵
  PID:5952
- C:\Windows\System\asbynHN.exe
  C:\Windows\System\asbynHN.exe
  2⤵
  PID:7224
- C:\Windows\System\exBuNCA.exe
  C:\Windows\System\exBuNCA.exe
  2⤵
  PID:8500
- C:\Windows\System\Zhirjbd.exe
  C:\Windows\System\Zhirjbd.exe
  2⤵
  PID:7884
- C:\Windows\System\ReqNZDd.exe
  C:\Windows\System\ReqNZDd.exe
  2⤵
  PID:7084
- C:\Windows\System\WTUYIbg.exe
  C:\Windows\System\WTUYIbg.exe
  2⤵
  PID:8656
- C:\Windows\System\JrtVOKg.exe
  C:\Windows\System\JrtVOKg.exe
  2⤵
  PID:884
- C:\Windows\System\DqmrDqQ.exe
  C:\Windows\System\DqmrDqQ.exe
  2⤵
  PID:8988
- C:\Windows\System\ubQPpGk.exe
  C:\Windows\System\ubQPpGk.exe
  2⤵
  PID:9160
- C:\Windows\System\TIaBWTg.exe
  C:\Windows\System\TIaBWTg.exe
  2⤵
  PID:8904
- C:\Windows\System\bRqgoHD.exe
  C:\Windows\System\bRqgoHD.exe
  2⤵
  PID:6792
- C:\Windows\System\KmQSGsL.exe
  C:\Windows\System\KmQSGsL.exe
  2⤵
  PID:3864
- C:\Windows\System\INrXknY.exe
  C:\Windows\System\INrXknY.exe
  2⤵
  PID:6692
- C:\Windows\System\vxygNHD.exe
  C:\Windows\System\vxygNHD.exe
  2⤵
  PID:6864
- C:\Windows\System\EFDTPDz.exe
  C:\Windows\System\EFDTPDz.exe
  2⤵
  PID:8428
- C:\Windows\System\EFqRBBm.exe
  C:\Windows\System\EFqRBBm.exe
  2⤵
  PID:9124
- C:\Windows\System\RxgODeR.exe
  C:\Windows\System\RxgODeR.exe
  2⤵
  PID:9012
- C:\Windows\System\rGTYfLr.exe
  C:\Windows\System\rGTYfLr.exe
  2⤵
  PID:3792
- C:\Windows\System\kJrCNeO.exe
  C:\Windows\System\kJrCNeO.exe
  2⤵
  PID:1144
- C:\Windows\System\pNgTNgL.exe
  C:\Windows\System\pNgTNgL.exe
  2⤵
  PID:8324
- C:\Windows\System\dNEIgfT.exe
  C:\Windows\System\dNEIgfT.exe
  2⤵
  PID:6940
- C:\Windows\System\jNVBxVL.exe
  C:\Windows\System\jNVBxVL.exe
  2⤵
  PID:9140
- C:\Windows\System\VyDBrxF.exe
  C:\Windows\System\VyDBrxF.exe
  2⤵
  PID:8156
- C:\Windows\System\zTinBRN.exe
  C:\Windows\System\zTinBRN.exe
  2⤵
  PID:7276
- C:\Windows\System\SKurzsI.exe
  C:\Windows\System\SKurzsI.exe
  2⤵
  PID:7944
- C:\Windows\System\nJLzdDn.exe
  C:\Windows\System\nJLzdDn.exe
  2⤵
  PID:8736
- C:\Windows\System\mERJARP.exe
  C:\Windows\System\mERJARP.exe
  2⤵
  PID:8696
- C:\Windows\System\HNmUwBH.exe
  C:\Windows\System\HNmUwBH.exe
  2⤵
  PID:9232
- C:\Windows\System\zACluDQ.exe
  C:\Windows\System\zACluDQ.exe
  2⤵
  PID:9252
- C:\Windows\System\cRdFkAV.exe
  C:\Windows\System\cRdFkAV.exe
  2⤵
  PID:9272
- C:\Windows\System\VeaIVdx.exe
  C:\Windows\System\VeaIVdx.exe
  2⤵
  PID:9292
- C:\Windows\System\KZPUuTK.exe
  C:\Windows\System\KZPUuTK.exe
  2⤵
  PID:9308
- C:\Windows\System\SnCXgsj.exe
  C:\Windows\System\SnCXgsj.exe
  2⤵
  PID:9332
- C:\Windows\System\RGoWNEz.exe
  C:\Windows\System\RGoWNEz.exe
  2⤵
  PID:9352
- C:\Windows\System\SLiDxcT.exe
  C:\Windows\System\SLiDxcT.exe
  2⤵
  PID:9368
- C:\Windows\System\kNWPKeA.exe
  C:\Windows\System\kNWPKeA.exe
  2⤵
  PID:9392
- C:\Windows\System\WlQradq.exe
  C:\Windows\System\WlQradq.exe
  2⤵
  PID:9412
- C:\Windows\System\cpUBfIo.exe
  C:\Windows\System\cpUBfIo.exe
  2⤵
  PID:9432
- C:\Windows\System\npLrNAn.exe
  C:\Windows\System\npLrNAn.exe
  2⤵
  PID:9464
- C:\Windows\System\lAwfLqy.exe
  C:\Windows\System\lAwfLqy.exe
  2⤵
  PID:9560
- C:\Windows\System\qdzAkHi.exe
  C:\Windows\System\qdzAkHi.exe
  2⤵
  PID:9580
- C:\Windows\System\WhdmZzX.exe
  C:\Windows\System\WhdmZzX.exe
  2⤵
  PID:9604
- C:\Windows\System\jJnCahX.exe
  C:\Windows\System\jJnCahX.exe
  2⤵
  PID:9624
- C:\Windows\System\edbPLFS.exe
  C:\Windows\System\edbPLFS.exe
  2⤵
  PID:9644
- C:\Windows\System\PDENJtU.exe
  C:\Windows\System\PDENJtU.exe
  2⤵
  PID:9664
- C:\Windows\System\dkLTPEg.exe
  C:\Windows\System\dkLTPEg.exe
  2⤵
  PID:9680
- C:\Windows\System\bJktIqP.exe
  C:\Windows\System\bJktIqP.exe
  2⤵
  PID:9696
- C:\Windows\System\dSPtWKi.exe
  C:\Windows\System\dSPtWKi.exe
  2⤵
  PID:9716
- C:\Windows\System\ZHosSzV.exe
  C:\Windows\System\ZHosSzV.exe
  2⤵
  PID:9732
- C:\Windows\System\riQHtaX.exe
  C:\Windows\System\riQHtaX.exe
  2⤵
  PID:9748
- C:\Windows\System\Dcjbllb.exe
  C:\Windows\System\Dcjbllb.exe
  2⤵
  PID:9768
- C:\Windows\System\uZXhXiO.exe
  C:\Windows\System\uZXhXiO.exe
  2⤵
  PID:9796
- C:\Windows\System\BDmVUcr.exe
  C:\Windows\System\BDmVUcr.exe
  2⤵
  PID:9812
- C:\Windows\System\zfRZDla.exe
  C:\Windows\System\zfRZDla.exe
  2⤵
  PID:9836
- C:\Windows\System\RJeMRDk.exe
  C:\Windows\System\RJeMRDk.exe
  2⤵
  PID:9856
- C:\Windows\System\bGwYsGW.exe
  C:\Windows\System\bGwYsGW.exe
  2⤵
  PID:9880
- C:\Windows\System\CfNAvDY.exe
  C:\Windows\System\CfNAvDY.exe
  2⤵
  PID:9904
- C:\Windows\System\UEwYxgy.exe
  C:\Windows\System\UEwYxgy.exe
  2⤵
  PID:9924
- C:\Windows\System\xhQPaLm.exe
  C:\Windows\System\xhQPaLm.exe
  2⤵
  PID:9956
- C:\Windows\System\CDTmQti.exe
  C:\Windows\System\CDTmQti.exe
  2⤵
  PID:9972
- C:\Windows\System\VcEVPjf.exe
  C:\Windows\System\VcEVPjf.exe
  2⤵
  PID:9996
- C:\Windows\System\sBVowNM.exe
  C:\Windows\System\sBVowNM.exe
  2⤵
  PID:10016
- C:\Windows\System\lkgtMpV.exe
  C:\Windows\System\lkgtMpV.exe
  2⤵
  PID:10036
- C:\Windows\System\LUmRkxn.exe
  C:\Windows\System\LUmRkxn.exe
  2⤵
  PID:10060
- C:\Windows\System\ZABxyIL.exe
  C:\Windows\System\ZABxyIL.exe
  2⤵
  PID:10080
- C:\Windows\System\coHjPQZ.exe
  C:\Windows\System\coHjPQZ.exe
  2⤵
  PID:10100
- C:\Windows\System\CSNwSKi.exe
  C:\Windows\System\CSNwSKi.exe
  2⤵
  PID:10116
- C:\Windows\System\RbcxDKl.exe
  C:\Windows\System\RbcxDKl.exe
  2⤵
  PID:10136
- C:\Windows\System\GsgrqCV.exe
  C:\Windows\System\GsgrqCV.exe
  2⤵
  PID:10156
- C:\Windows\System\KWbYLnB.exe
  C:\Windows\System\KWbYLnB.exe
  2⤵
  PID:10176
- C:\Windows\System\tcbGQMx.exe
  C:\Windows\System\tcbGQMx.exe
  2⤵
  PID:10196
- C:\Windows\System\VRuFZlG.exe
  C:\Windows\System\VRuFZlG.exe
  2⤵
  PID:10212
- C:\Windows\System\buwBpyN.exe
  C:\Windows\System\buwBpyN.exe
  2⤵
  PID:10232
- C:\Windows\System\ABbNqoY.exe
  C:\Windows\System\ABbNqoY.exe
  2⤵
  PID:3664
- C:\Windows\System\VFimPqB.exe
  C:\Windows\System\VFimPqB.exe
  2⤵
  PID:9032
- C:\Windows\System\JHEybQX.exe
  C:\Windows\System\JHEybQX.exe
  2⤵
  PID:7180
- C:\Windows\System\tClwSor.exe
  C:\Windows\System\tClwSor.exe
  2⤵
  PID:8504
- C:\Windows\System\vZeTZcr.exe
  C:\Windows\System\vZeTZcr.exe
  2⤵
  PID:8912
- C:\Windows\System\xsgdjDl.exe
  C:\Windows\System\xsgdjDl.exe
  2⤵
  PID:1436
- C:\Windows\System\FkBgmDw.exe
  C:\Windows\System\FkBgmDw.exe
  2⤵
  PID:3732
- C:\Windows\System\ElLMtqX.exe
  C:\Windows\System\ElLMtqX.exe
  2⤵
  PID:8660
- C:\Windows\System\EERPyql.exe
  C:\Windows\System\EERPyql.exe
  2⤵
  PID:7464
- C:\Windows\System\czQCGRC.exe
  C:\Windows\System\czQCGRC.exe
  2⤵
  PID:9228
- C:\Windows\System\nCFSRQR.exe
  C:\Windows\System\nCFSRQR.exe
  2⤵
  PID:9408
- C:\Windows\System\xZcuSGv.exe
  C:\Windows\System\xZcuSGv.exe
  2⤵
  PID:9472
- C:\Windows\System\CFrJMxr.exe
  C:\Windows\System\CFrJMxr.exe
  2⤵
  PID:4748
- C:\Windows\System\raLwFap.exe
  C:\Windows\System\raLwFap.exe
  2⤵
  PID:9588
- C:\Windows\System\fDkpmfC.exe
  C:\Windows\System\fDkpmfC.exe
  2⤵
  PID:6632
- C:\Windows\System\OoIXTmj.exe
  C:\Windows\System\OoIXTmj.exe
  2⤵
  PID:9448
- C:\Windows\System\eQqAfRc.exe
  C:\Windows\System\eQqAfRc.exe
  2⤵
  PID:10092
- C:\Windows\System\twKOtOe.exe
  C:\Windows\System\twKOtOe.exe
  2⤵
  PID:10148
- C:\Windows\System\WCRzaBq.exe
  C:\Windows\System\WCRzaBq.exe
  2⤵
  PID:8772
- C:\Windows\System\JcELRNb.exe
  C:\Windows\System\JcELRNb.exe
  2⤵
  PID:9036
- C:\Windows\System\GKeauEL.exe
  C:\Windows\System\GKeauEL.exe
  2⤵
  PID:9688
- C:\Windows\System\PbHOgyJ.exe
  C:\Windows\System\PbHOgyJ.exe
  2⤵
  PID:8844
- C:\Windows\System\eNxLPlc.exe
  C:\Windows\System\eNxLPlc.exe
  2⤵
  PID:2668
- C:\Windows\System\ITgDGnU.exe
  C:\Windows\System\ITgDGnU.exe
  2⤵
  PID:8908
- C:\Windows\System\WWKQqaf.exe
  C:\Windows\System\WWKQqaf.exe
  2⤵
  PID:9556
- C:\Windows\System\SzKoLIw.exe
  C:\Windows\System\SzKoLIw.exe
  2⤵
  PID:9572
- C:\Windows\System\sfXeXmj.exe
  C:\Windows\System\sfXeXmj.exe
  2⤵
  PID:3688
- C:\Windows\System\YBmmJuP.exe
  C:\Windows\System\YBmmJuP.exe
  2⤵
  PID:10208
- C:\Windows\System\EBKTbHC.exe
  C:\Windows\System\EBKTbHC.exe
  2⤵
  PID:10376
- C:\Windows\System\CTvwJAM.exe
  C:\Windows\System\CTvwJAM.exe
  2⤵
  PID:10400
- C:\Windows\System\azyCJaG.exe
  C:\Windows\System\azyCJaG.exe
  2⤵
  PID:10420
- C:\Windows\System\rNWDYFe.exe
  C:\Windows\System\rNWDYFe.exe
  2⤵
  PID:10444
- C:\Windows\System\BgjCDgP.exe
  C:\Windows\System\BgjCDgP.exe
  2⤵
  PID:10468
- C:\Windows\System\qLDifad.exe
  C:\Windows\System\qLDifad.exe
  2⤵
  PID:10492
- C:\Windows\System\EMgfbqS.exe
  C:\Windows\System\EMgfbqS.exe
  2⤵
  PID:10508
- C:\Windows\System\jTYinHZ.exe
  C:\Windows\System\jTYinHZ.exe
  2⤵
  PID:10532
- C:\Windows\System\cnnubdy.exe
  C:\Windows\System\cnnubdy.exe
  2⤵
  PID:10588
- C:\Windows\System\RyJOuFq.exe
  C:\Windows\System\RyJOuFq.exe
  2⤵
  PID:10700
- C:\Windows\System\zKdWRCx.exe
  C:\Windows\System\zKdWRCx.exe
  2⤵
  PID:10724
- C:\Windows\System\qNsFumc.exe
  C:\Windows\System\qNsFumc.exe
  2⤵
  PID:10744
- C:\Windows\System\zdoXhHB.exe
  C:\Windows\System\zdoXhHB.exe
  2⤵
  PID:10764
- C:\Windows\System\FdxAFIC.exe
  C:\Windows\System\FdxAFIC.exe
  2⤵
  PID:10784
- C:\Windows\System\QadeMkI.exe
  C:\Windows\System\QadeMkI.exe
  2⤵
  PID:10864
- C:\Windows\System\hBaMwen.exe
  C:\Windows\System\hBaMwen.exe
  2⤵
  PID:10888
- C:\Windows\System\CcKnXlm.exe
  C:\Windows\System\CcKnXlm.exe
  2⤵
  PID:10908
- C:\Windows\System\PGdswZj.exe
  C:\Windows\System\PGdswZj.exe
  2⤵
  PID:10936
- C:\Windows\System\aGPyBok.exe
  C:\Windows\System\aGPyBok.exe
  2⤵
  PID:10952
- C:\Windows\System\GOuMXzn.exe
  C:\Windows\System\GOuMXzn.exe
  2⤵
  PID:10972
- C:\Windows\System\dNjsmec.exe
  C:\Windows\System\dNjsmec.exe
  2⤵
  PID:10996
- C:\Windows\System\yGoJUGS.exe
  C:\Windows\System\yGoJUGS.exe
  2⤵
  PID:11024
- C:\Windows\System\smnIlIj.exe
  C:\Windows\System\smnIlIj.exe
  2⤵
  PID:11040
- C:\Windows\System\JMUbuqc.exe
  C:\Windows\System\JMUbuqc.exe
  2⤵
  PID:11072
- C:\Windows\System\aJIqPyM.exe
  C:\Windows\System\aJIqPyM.exe
  2⤵
  PID:11088
- C:\Windows\System\xEOrBWK.exe
  C:\Windows\System\xEOrBWK.exe
  2⤵
  PID:11108
- C:\Windows\System\MODSDpp.exe
  C:\Windows\System\MODSDpp.exe
  2⤵
  PID:11128
- C:\Windows\System\disgfCG.exe
  C:\Windows\System\disgfCG.exe
  2⤵
  PID:11148
- C:\Windows\System\pAUaxIk.exe
  C:\Windows\System\pAUaxIk.exe
  2⤵
  PID:11168
- C:\Windows\System\tCjVHDx.exe
  C:\Windows\System\tCjVHDx.exe
  2⤵
  PID:11188
- C:\Windows\System\YRvZmHL.exe
  C:\Windows\System\YRvZmHL.exe
  2⤵
  PID:11216
- C:\Windows\System\YCVIXeq.exe
  C:\Windows\System\YCVIXeq.exe
  2⤵
  PID:11244
- C:\Windows\System\XbAQxNu.exe
  C:\Windows\System\XbAQxNu.exe
  2⤵
  PID:9652
- C:\Windows\System\kGWhNux.exe
  C:\Windows\System\kGWhNux.exe
  2⤵
  PID:10044
- C:\Windows\System\cUyMeJI.exe
  C:\Windows\System\cUyMeJI.exe
  2⤵
  PID:9988
- C:\Windows\System\RCdxeJx.exe
  C:\Windows\System\RCdxeJx.exe
  2⤵
  PID:9640
- C:\Windows\System\xWdIIZi.exe
  C:\Windows\System\xWdIIZi.exe
  2⤵
  PID:10308
- C:\Windows\System\lpdxFNn.exe
  C:\Windows\System\lpdxFNn.exe
  2⤵
  PID:9744
- C:\Windows\System\FhFtCVp.exe
  C:\Windows\System\FhFtCVp.exe
  2⤵
  PID:9820
- C:\Windows\System\kiZJgaG.exe
  C:\Windows\System\kiZJgaG.exe
  2⤵
  PID:10260
- C:\Windows\System\FcYhQWQ.exe
  C:\Windows\System\FcYhQWQ.exe
  2⤵
  PID:10284
- C:\Windows\System\kMdNtqe.exe
  C:\Windows\System\kMdNtqe.exe
  2⤵
  PID:3472
- C:\Windows\System\DRfsmhA.exe
  C:\Windows\System\DRfsmhA.exe
  2⤵
  PID:9224
- C:\Windows\System\qZTHDtk.exe
  C:\Windows\System\qZTHDtk.exe
  2⤵
  PID:3612
- C:\Windows\System\ogcHjYO.exe
  C:\Windows\System\ogcHjYO.exe
  2⤵
  PID:10428
- C:\Windows\System\hPDHhVn.exe
  C:\Windows\System\hPDHhVn.exe
  2⤵
  PID:10476
- C:\Windows\System\FnRwDja.exe
  C:\Windows\System\FnRwDja.exe
  2⤵
  PID:10504
- C:\Windows\System\uoYTPDr.exe
  C:\Windows\System\uoYTPDr.exe
  2⤵
  PID:10548
- C:\Windows\System\KxPpqPM.exe
  C:\Windows\System\KxPpqPM.exe
  2⤵
  PID:10708
- C:\Windows\System\VrooFeL.exe
  C:\Windows\System\VrooFeL.exe
  2⤵
  PID:3788
- C:\Windows\System\AqNzbqW.exe
  C:\Windows\System\AqNzbqW.exe
  2⤵
  PID:10712
- C:\Windows\System\aUzsPTS.exe
  C:\Windows\System\aUzsPTS.exe
  2⤵
  PID:10876
- C:\Windows\System\ZcZEDSg.exe
  C:\Windows\System\ZcZEDSg.exe
  2⤵
  PID:11008
- C:\Windows\System\TTSmxwZ.exe
  C:\Windows\System\TTSmxwZ.exe
  2⤵
  PID:11180
- C:\Windows\System\qwdddvU.exe
  C:\Windows\System\qwdddvU.exe
  2⤵
  PID:11256
- C:\Windows\System\DroBEde.exe
  C:\Windows\System\DroBEde.exe
  2⤵
  PID:11292
- C:\Windows\System\HBGTVeO.exe
  C:\Windows\System\HBGTVeO.exe
  2⤵
  PID:11312
- C:\Windows\System\YOSnstX.exe
  C:\Windows\System\YOSnstX.exe
  2⤵
  PID:11332
- C:\Windows\System\vpNecfy.exe
  C:\Windows\System\vpNecfy.exe
  2⤵
  PID:11352
- C:\Windows\System\vrvttdF.exe
  C:\Windows\System\vrvttdF.exe
  2⤵
  PID:11372
- C:\Windows\System\MLVMEcF.exe
  C:\Windows\System\MLVMEcF.exe
  2⤵
  PID:11396
- C:\Windows\System\TPCCrNB.exe
  C:\Windows\System\TPCCrNB.exe
  2⤵
  PID:11420
- C:\Windows\System\vyksyxg.exe
  C:\Windows\System\vyksyxg.exe
  2⤵
  PID:11440
- C:\Windows\System\ScOtkNI.exe
  C:\Windows\System\ScOtkNI.exe
  2⤵
  PID:11460
- C:\Windows\System\GMXZfII.exe
  C:\Windows\System\GMXZfII.exe
  2⤵
  PID:11480
- C:\Windows\System\ZlAZeTj.exe
  C:\Windows\System\ZlAZeTj.exe
  2⤵
  PID:11500
- C:\Windows\System\oJKNWyP.exe
  C:\Windows\System\oJKNWyP.exe
  2⤵
  PID:11520
- C:\Windows\System\QiSYrKd.exe
  C:\Windows\System\QiSYrKd.exe
  2⤵
  PID:11540
- C:\Windows\System\kYBsITX.exe
  C:\Windows\System\kYBsITX.exe
  2⤵
  PID:11560
- C:\Windows\System\vIlOjEo.exe
  C:\Windows\System\vIlOjEo.exe
  2⤵
  PID:11580
- C:\Windows\System\pFZIRBG.exe
  C:\Windows\System\pFZIRBG.exe
  2⤵
  PID:11760
- C:\Windows\System\cbaUxWz.exe
  C:\Windows\System\cbaUxWz.exe
  2⤵
  PID:11780
- C:\Windows\System\BmXoSYB.exe
  C:\Windows\System\BmXoSYB.exe
  2⤵
  PID:11804
- C:\Windows\System\HZPZfcU.exe
  C:\Windows\System\HZPZfcU.exe
  2⤵
  PID:11824
- C:\Windows\System\uNiAnrR.exe
  C:\Windows\System\uNiAnrR.exe
  2⤵
  PID:11844
- C:\Windows\System\aksrQdu.exe
  C:\Windows\System\aksrQdu.exe
  2⤵
  PID:11864
- C:\Windows\System\vKRAfea.exe
  C:\Windows\System\vKRAfea.exe
  2⤵
  PID:11888
- C:\Windows\System\xluEwtO.exe
  C:\Windows\System\xluEwtO.exe
  2⤵
  PID:11904
- C:\Windows\System\SBdoGpk.exe
  C:\Windows\System\SBdoGpk.exe
  2⤵
  PID:11932
- C:\Windows\System\rqhHyZH.exe
  C:\Windows\System\rqhHyZH.exe
  2⤵
  PID:11956
- C:\Windows\System\MWVVfVD.exe
  C:\Windows\System\MWVVfVD.exe
  2⤵
  PID:11976
- C:\Windows\System\BowtRzl.exe
  C:\Windows\System\BowtRzl.exe
  2⤵
  PID:11992
- C:\Windows\System\iVtsxgD.exe
  C:\Windows\System\iVtsxgD.exe
  2⤵
  PID:12012
- C:\Windows\System\iuUfwxk.exe
  C:\Windows\System\iuUfwxk.exe
  2⤵
  PID:12060
- C:\Windows\System\WEOTFmp.exe
  C:\Windows\System\WEOTFmp.exe
  2⤵
  PID:12076
- C:\Windows\System\crPETDl.exe
  C:\Windows\System\crPETDl.exe
  2⤵
  PID:12100
- C:\Windows\System\tTXsHre.exe
  C:\Windows\System\tTXsHre.exe
  2⤵
  PID:12128
- C:\Windows\System\Tallsei.exe
  C:\Windows\System\Tallsei.exe
  2⤵
  PID:10772
- C:\Windows\System\lpdXNMN.exe
  C:\Windows\System\lpdXNMN.exe
  2⤵
  PID:10880
- C:\Windows\System\pdJigxp.exe
  C:\Windows\System\pdJigxp.exe
  2⤵
  PID:10684
- C:\Windows\System\rCTvtbc.exe
  C:\Windows\System\rCTvtbc.exe
  2⤵
  PID:7300
- C:\Windows\System\NCflJzI.exe
  C:\Windows\System\NCflJzI.exe
  2⤵
  PID:10896
- C:\Windows\System\WWhPsHB.exe
  C:\Windows\System\WWhPsHB.exe
  2⤵
  PID:11432
- C:\Windows\System\xlDPfxN.exe
  C:\Windows\System\xlDPfxN.exe
  2⤵
  PID:10980
- C:\Windows\System\vpODOkY.exe
  C:\Windows\System\vpODOkY.exe
  2⤵
  PID:2348
- C:\Windows\System\PrYSALA.exe
  C:\Windows\System\PrYSALA.exe
  2⤵
  PID:11740
- C:\Windows\System\dUVoXUB.exe
  C:\Windows\System\dUVoXUB.exe
  2⤵
  PID:10488
- C:\Windows\System\SBaizbU.exe
  C:\Windows\System\SBaizbU.exe
  2⤵
  PID:11880
- C:\Windows\System\hRXEYaf.exe
  C:\Windows\System\hRXEYaf.exe
  2⤵
  PID:11280
- C:\Windows\System\tXHflPH.exe
  C:\Windows\System\tXHflPH.exe
  2⤵
  PID:11800
- C:\Windows\System\iVbezwT.exe
  C:\Windows\System\iVbezwT.exe
  2⤵
  PID:11872
- C:\Windows\System\rDbngeC.exe
  C:\Windows\System\rDbngeC.exe
  2⤵
  PID:12072
- C:\Windows\System\cQyhfMq.exe
  C:\Windows\System\cQyhfMq.exe
  2⤵
  PID:10112
- C:\Windows\System\QGtuxZO.exe
  C:\Windows\System\QGtuxZO.exe
  2⤵
  PID:11392
- C:\Windows\System\INofnRt.exe
  C:\Windows\System\INofnRt.exe
  2⤵
  PID:12244
- C:\Windows\System\QZnzcst.exe
  C:\Windows\System\QZnzcst.exe
  2⤵
  PID:3068
- C:\Windows\System\LubjDQk.exe
  C:\Windows\System\LubjDQk.exe
  2⤵
  PID:9492
- C:\Windows\System\EPYxErb.exe
  C:\Windows\System\EPYxErb.exe
  2⤵
  PID:11288
- C:\Windows\System\cprmFlq.exe
  C:\Windows\System\cprmFlq.exe
  2⤵
  PID:9656
- C:\Windows\System\bTpEVKl.exe
  C:\Windows\System\bTpEVKl.exe
  2⤵
  PID:11640
- C:\Windows\System\ziXImZO.exe
  C:\Windows\System\ziXImZO.exe
  2⤵
  PID:11492
- C:\Windows\System\ZzeZjYE.exe
  C:\Windows\System\ZzeZjYE.exe
  2⤵
  PID:11600
- C:\Windows\System\gHyVgKl.exe
  C:\Windows\System\gHyVgKl.exe
  2⤵
  PID:11340
- C:\Windows\System\zCmDXQN.exe
  C:\Windows\System\zCmDXQN.exe
  2⤵
  PID:11080
- C:\Windows\System\UJgVHiE.exe
  C:\Windows\System\UJgVHiE.exe
  2⤵
  PID:2916
- C:\Windows\System\ecTAqnb.exe
  C:\Windows\System\ecTAqnb.exe
  2⤵
  PID:11428
- C:\Windows\System\jxYOpur.exe
  C:\Windows\System\jxYOpur.exe
  2⤵
  PID:11036
- C:\Windows\System\ueQONLW.exe
  C:\Windows\System\ueQONLW.exe
  2⤵
  PID:11876
- C:\Windows\System\FYhkylk.exe
  C:\Windows\System\FYhkylk.exe
  2⤵
  PID:3524
- C:\Windows\System\wRPLjhu.exe
  C:\Windows\System\wRPLjhu.exe
  2⤵
  PID:12344
- C:\Windows\System\kMAtLwZ.exe
  C:\Windows\System\kMAtLwZ.exe
  2⤵
  PID:12372
- C:\Windows\System\qVhJVYQ.exe
  C:\Windows\System\qVhJVYQ.exe
  2⤵
  PID:12392
- C:\Windows\System\zPkFIbq.exe
  C:\Windows\System\zPkFIbq.exe
  2⤵
  PID:12420
- C:\Windows\System\ElTFqeA.exe
  C:\Windows\System\ElTFqeA.exe
  2⤵
  PID:12436
- C:\Windows\System\QlEaUht.exe
  C:\Windows\System\QlEaUht.exe
  2⤵
  PID:12456
- C:\Windows\System\uVsocUn.exe
  C:\Windows\System\uVsocUn.exe
  2⤵
  PID:12480
- C:\Windows\System\NOePzLc.exe
  C:\Windows\System\NOePzLc.exe
  2⤵
  PID:12500
- C:\Windows\System\LmMhDte.exe
  C:\Windows\System\LmMhDte.exe
  2⤵
  PID:12516
- C:\Windows\System\hPqgrNC.exe
  C:\Windows\System\hPqgrNC.exe
  2⤵
  PID:12548
- C:\Windows\System\YVinJaJ.exe
  C:\Windows\System\YVinJaJ.exe
  2⤵
  PID:12564
- C:\Windows\System\EeZwDUR.exe
  C:\Windows\System\EeZwDUR.exe
  2⤵
  PID:12584
- C:\Windows\System\RXiTOGb.exe
  C:\Windows\System\RXiTOGb.exe
  2⤵
  PID:12608
- C:\Windows\System\uFwcaGp.exe
  C:\Windows\System\uFwcaGp.exe
  2⤵
  PID:12624
- C:\Windows\System\ZUuTrvX.exe
  C:\Windows\System\ZUuTrvX.exe
  2⤵
  PID:12640
- C:\Windows\System\aCKkMsU.exe
  C:\Windows\System\aCKkMsU.exe
  2⤵
  PID:12660
- C:\Windows\System\XaLRGlx.exe
  C:\Windows\System\XaLRGlx.exe
  2⤵
  PID:12680
- C:\Windows\System\jrBHFLs.exe
  C:\Windows\System\jrBHFLs.exe
  2⤵
  PID:12696
- C:\Windows\System\gNZeRmM.exe
  C:\Windows\System\gNZeRmM.exe
  2⤵
  PID:12724
- C:\Windows\System\zwWZpdt.exe
  C:\Windows\System\zwWZpdt.exe
  2⤵
  PID:12744
- C:\Windows\System\OMFcDmL.exe
  C:\Windows\System\OMFcDmL.exe
  2⤵
  PID:12760
- C:\Windows\System\HHXIKMl.exe
  C:\Windows\System\HHXIKMl.exe
  2⤵
  PID:12776
- C:\Windows\System\KliVnnC.exe
  C:\Windows\System\KliVnnC.exe
  2⤵
  PID:12796
- C:\Windows\System\sslZLlD.exe
  C:\Windows\System\sslZLlD.exe
  2⤵
  PID:12840
- C:\Windows\System\PumHBRJ.exe
  C:\Windows\System\PumHBRJ.exe
  2⤵
  PID:12864
- C:\Windows\System\qarAPzt.exe
  C:\Windows\System\qarAPzt.exe
  2⤵
  PID:12884
- C:\Windows\System\KPEVvji.exe
  C:\Windows\System\KPEVvji.exe
  2⤵
  PID:12980
- C:\Windows\System\VTKmlJj.exe
  C:\Windows\System\VTKmlJj.exe
  2⤵
  PID:13008
- C:\Windows\System\yTuDcXM.exe
  C:\Windows\System\yTuDcXM.exe
  2⤵
  PID:13148
- C:\Windows\System\unSQpGJ.exe
  C:\Windows\System\unSQpGJ.exe
  2⤵
  PID:13220
- C:\Windows\System\AXFOJNu.exe
  C:\Windows\System\AXFOJNu.exe
  2⤵
  PID:13240
- C:\Windows\System\CZUzHoY.exe
  C:\Windows\System\CZUzHoY.exe
  2⤵
  PID:13276
- C:\Windows\System\eUSAbPY.exe
  C:\Windows\System\eUSAbPY.exe
  2⤵
  PID:13296
- C:\Windows\System\KfswPra.exe
  C:\Windows\System\KfswPra.exe
  2⤵
  PID:11380
- C:\Windows\System\kvQMcXs.exe
  C:\Windows\System\kvQMcXs.exe
  2⤵
  PID:12304
- C:\Windows\System\bbZtXtn.exe
  C:\Windows\System\bbZtXtn.exe
  2⤵
  PID:4304
- C:\Windows\System\xqPsNsk.exe
  C:\Windows\System\xqPsNsk.exe
  2⤵
  PID:8516
- C:\Windows\System\zxLPYRd.exe
  C:\Windows\System\zxLPYRd.exe
  2⤵
  PID:12356
- C:\Windows\System\fHnxEox.exe
  C:\Windows\System\fHnxEox.exe
  2⤵
  PID:12384
- C:\Windows\System\uuyvTzr.exe
  C:\Windows\System\uuyvTzr.exe
  2⤵
  PID:12476
- C:\Windows\System\JXGvQKu.exe
  C:\Windows\System\JXGvQKu.exe
  2⤵
  PID:12496
- C:\Windows\System\tovccgM.exe
  C:\Windows\System\tovccgM.exe
  2⤵
  PID:12832
- C:\Windows\System\Feqqbrh.exe
  C:\Windows\System\Feqqbrh.exe
  2⤵
  PID:4252
- C:\Windows\System\QyQHoUH.exe
  C:\Windows\System\QyQHoUH.exe
  2⤵
  PID:1208
- C:\Windows\System\iuJDeRY.exe
  C:\Windows\System\iuJDeRY.exe
  2⤵
  PID:12932
- C:\Windows\System\mBPxIKy.exe
  C:\Windows\System\mBPxIKy.exe
  2⤵
  PID:12880
- C:\Windows\System\OJDexoC.exe
  C:\Windows\System\OJDexoC.exe
  2⤵
  PID:12944
- C:\Windows\System\vEYcJyh.exe
  C:\Windows\System\vEYcJyh.exe
  2⤵
  PID:3516
- C:\Windows\System\pEnELyb.exe
  C:\Windows\System\pEnELyb.exe
  2⤵
  PID:13020
- C:\Windows\System\BDMWCCu.exe
  C:\Windows\System\BDMWCCu.exe
  2⤵
  PID:492
- C:\Windows\System\nzxLZVD.exe
  C:\Windows\System\nzxLZVD.exe
  2⤵
  PID:13252
- C:\Windows\System\VWKGHBd.exe
  C:\Windows\System\VWKGHBd.exe
  2⤵
  PID:9672
- C:\Windows\System\utJxWER.exe
  C:\Windows\System\utJxWER.exe
  2⤵
  PID:13184
- C:\Windows\System\PgPHmxl.exe
  C:\Windows\System\PgPHmxl.exe
  2⤵
  PID:1456
- C:\Windows\System\DiugUJI.exe
  C:\Windows\System\DiugUJI.exe
  2⤵
  PID:13284
- C:\Windows\System\NaZRDLw.exe
  C:\Windows\System\NaZRDLw.exe
  2⤵
  PID:11328
- C:\Windows\System\SIiLcjd.exe
  C:\Windows\System\SIiLcjd.exe
  2⤵
  PID:12332
- C:\Windows\System\LZrRhTP.exe
  C:\Windows\System\LZrRhTP.exe
  2⤵
  PID:12400
- C:\Windows\System\MiMIOmV.exe
  C:\Windows\System\MiMIOmV.exe
  2⤵
  PID:12620
- C:\Windows\System\hybsioi.exe
  C:\Windows\System\hybsioi.exe
  2⤵
  PID:12492
- C:\Windows\System\tGYieKG.exe
  C:\Windows\System\tGYieKG.exe
  2⤵
  PID:12488
- C:\Windows\System\Tfvapfw.exe
  C:\Windows\System\Tfvapfw.exe
  2⤵
  PID:13400
- C:\Windows\System\EhrLIga.exe
  C:\Windows\System\EhrLIga.exe
  2⤵
  PID:13492
- C:\Windows\System\dTXDfZy.exe
  C:\Windows\System\dTXDfZy.exe
  2⤵
  PID:13540
- C:\Windows\System\EMYHAfU.exe
  C:\Windows\System\EMYHAfU.exe
  2⤵
  PID:13724
- C:\Windows\System\mQwamiA.exe
  C:\Windows\System\mQwamiA.exe
  2⤵
  PID:13756
- C:\Windows\System\QwtaPnw.exe
  C:\Windows\System\QwtaPnw.exe
  2⤵
  PID:13828
- C:\Windows\System\joDuaAf.exe
  C:\Windows\System\joDuaAf.exe
  2⤵
  PID:13856
- C:\Windows\System\twWHCwY.exe
  C:\Windows\System\twWHCwY.exe
  2⤵
  PID:13880
- C:\Windows\System\hRAVVDh.exe
  C:\Windows\System\hRAVVDh.exe
  2⤵
  PID:13904
- C:\Windows\System\BgwnhaK.exe
  C:\Windows\System\BgwnhaK.exe
  2⤵
  PID:13924
- C:\Windows\System\NKeHzfj.exe
  C:\Windows\System\NKeHzfj.exe
  2⤵
  PID:14004
- C:\Windows\System\herausj.exe
  C:\Windows\System\herausj.exe
  2⤵
  PID:14100
- C:\Windows\System\yxTtQta.exe
  C:\Windows\System\yxTtQta.exe
  2⤵
  PID:14160
- C:\Windows\System\SnXowWl.exe
  C:\Windows\System\SnXowWl.exe
  2⤵
  PID:14248
- C:\Windows\System\FyXSFSB.exe
  C:\Windows\System\FyXSFSB.exe
  2⤵
  PID:13196
- C:\Windows\System\nOUBopD.exe
  C:\Windows\System\nOUBopD.exe
  2⤵
  PID:2316
- C:\Windows\System\jackxGP.exe
  C:\Windows\System\jackxGP.exe
  2⤵
  PID:12320
- C:\Windows\System\vIWEkqU.exe
  C:\Windows\System\vIWEkqU.exe
  2⤵
  PID:3648
- C:\Windows\System\mHzbcjw.exe
  C:\Windows\System\mHzbcjw.exe
  2⤵
  PID:3544
- C:\Windows\System\VnkYwVp.exe
  C:\Windows\System\VnkYwVp.exe
  2⤵
  PID:2908
- C:\Windows\System\gtzlAaK.exe
  C:\Windows\System\gtzlAaK.exe
  2⤵
  PID:12912
- C:\Windows\System\fgHbFLC.exe
  C:\Windows\System\fgHbFLC.exe
  2⤵
  PID:13512
- C:\Windows\System\ylFSoQR.exe
  C:\Windows\System\ylFSoQR.exe
  2⤵
  PID:4664
- C:\Windows\System\aMVmNfG.exe
  C:\Windows\System\aMVmNfG.exe
  2⤵
  PID:13632
- C:\Windows\System\tGwbmAY.exe
  C:\Windows\System\tGwbmAY.exe
  2⤵
  PID:13524
- C:\Windows\System\RoDOcAa.exe
  C:\Windows\System\RoDOcAa.exe
  2⤵
  PID:13432
- C:\Windows\System\HhmRBRM.exe
  C:\Windows\System\HhmRBRM.exe
  2⤵
  PID:13476
- C:\Windows\System\dHmdEFA.exe
  C:\Windows\System\dHmdEFA.exe
  2⤵
  PID:13548
- C:\Windows\System\PlznbuT.exe
  C:\Windows\System\PlznbuT.exe
  2⤵
  PID:13580
- C:\Windows\System\tgJcrJn.exe
  C:\Windows\System\tgJcrJn.exe
  2⤵
  PID:13804
- C:\Windows\System\nycJrgB.exe
  C:\Windows\System\nycJrgB.exe
  2⤵
  PID:13820
- C:\Windows\System\yaLpbpG.exe
  C:\Windows\System\yaLpbpG.exe
  2⤵
  PID:13936
- C:\Windows\System\hTbwyTZ.exe
  C:\Windows\System\hTbwyTZ.exe
  2⤵
  PID:13968
- C:\Windows\System\NdPyJrX.exe
  C:\Windows\System\NdPyJrX.exe
  2⤵
  PID:2108
- C:\Windows\System\EkbaJZC.exe
  C:\Windows\System\EkbaJZC.exe
  2⤵
  PID:13668
- C:\Windows\System\RVhDTyd.exe
  C:\Windows\System\RVhDTyd.exe
  2⤵
  PID:14148
- C:\Windows\System\OEestSX.exe
  C:\Windows\System\OEestSX.exe
  2⤵
  PID:4604
- C:\Windows\System\wsbvlyM.exe
  C:\Windows\System\wsbvlyM.exe
  2⤵
  PID:14132
- C:\Windows\System\KnAXSJW.exe
  C:\Windows\System\KnAXSJW.exe
  2⤵
  PID:13824
- C:\Windows\System\gHMCuhK.exe
  C:\Windows\System\gHMCuhK.exe
  2⤵
  PID:13892
- C:\Windows\System\FqptIuC.exe
  C:\Windows\System\FqptIuC.exe
  2⤵
  PID:13848
- C:\Windows\System\VwczrSJ.exe
  C:\Windows\System\VwczrSJ.exe
  2⤵
  PID:14120
- C:\Windows\System\GnEuMZU.exe
  C:\Windows\System\GnEuMZU.exe
  2⤵
  PID:3008
- C:\Windows\System\tOxlchK.exe
  C:\Windows\System\tOxlchK.exe
  2⤵
  PID:5168
- C:\Windows\System\jAryDEz.exe
  C:\Windows\System\jAryDEz.exe
  2⤵
  PID:13236
- C:\Windows\System\ppMSFeQ.exe
  C:\Windows\System\ppMSFeQ.exe
  2⤵
  PID:3948
- C:\Windows\System\rIzZUsg.exe
  C:\Windows\System\rIzZUsg.exe
  2⤵
  PID:868
- C:\Windows\System\XprRymM.exe
  C:\Windows\System\XprRymM.exe
  2⤵
  PID:5388
- C:\Windows\System\UzLPZic.exe
  C:\Windows\System\UzLPZic.exe
  2⤵
  PID:5252
- C:\Windows\System\LNleRZB.exe
  C:\Windows\System\LNleRZB.exe
  2⤵
  PID:12556
- C:\Windows\System\kpcudqr.exe
  C:\Windows\System\kpcudqr.exe
  2⤵
  PID:5368
- C:\Windows\System\PSjXcKb.exe
  C:\Windows\System\PSjXcKb.exe
  2⤵
  PID:13364
- C:\Windows\System\RMAWqFP.exe
  C:\Windows\System\RMAWqFP.exe
  2⤵
  PID:1592
- C:\Windows\System\rxHcbtM.exe
  C:\Windows\System\rxHcbtM.exe
  2⤵
  PID:13332
- C:\Windows\System\qowXIzs.exe
  C:\Windows\System\qowXIzs.exe
  2⤵
  PID:5304
- C:\Windows\System\GypcxSC.exe
  C:\Windows\System\GypcxSC.exe
  2⤵
  PID:13992
- C:\Windows\System\oerTHsf.exe
  C:\Windows\System\oerTHsf.exe
  2⤵
  PID:5292
- C:\Windows\System\xXdxCPy.exe
  C:\Windows\System\xXdxCPy.exe
  2⤵
  PID:13964
- C:\Windows\System\EQsTPLY.exe
  C:\Windows\System\EQsTPLY.exe
  2⤵
  PID:13368
- C:\Windows\System\FyYmpbM.exe
  C:\Windows\System\FyYmpbM.exe
  2⤵
  PID:13208
- C:\Windows\System\SMTdZtt.exe
  C:\Windows\System\SMTdZtt.exe
  2⤵
  PID:1112
- C:\Windows\System\HhhroqP.exe
  C:\Windows\System\HhhroqP.exe
  2⤵
  PID:13664
- C:\Windows\System\rHSKMBD.exe
  C:\Windows\System\rHSKMBD.exe
  2⤵
  PID:13452
- C:\Windows\System\LOWHygM.exe
  C:\Windows\System\LOWHygM.exe
  2⤵
  PID:5768
- C:\Windows\System\nuboGij.exe
  C:\Windows\System\nuboGij.exe
  2⤵
  PID:13864
- C:\Windows\System\HNEDZnZ.exe
  C:\Windows\System\HNEDZnZ.exe
  2⤵
  PID:13376
- C:\Windows\System\PETWHFH.exe
  C:\Windows\System\PETWHFH.exe
  2⤵
  PID:2032
- C:\Windows\System\ohdrosN.exe
  C:\Windows\System\ohdrosN.exe
  2⤵
  PID:2600
- C:\Windows\System\GuLlAau.exe
  C:\Windows\System\GuLlAau.exe
  2⤵
  PID:1496
- C:\Windows\System\mRtCXQy.exe
  C:\Windows\System\mRtCXQy.exe
  2⤵
  PID:2196
- C:\Windows\System\eEeypdM.exe
  C:\Windows\System\eEeypdM.exe
  2⤵
  PID:14128
- C:\Windows\System\QogFOfC.exe
  C:\Windows\System\QogFOfC.exe
  2⤵
  PID:13876
- C:\Windows\System\awzaWXk.exe
  C:\Windows\System\awzaWXk.exe
  2⤵
  PID:5732
- C:\Windows\System\QZraoFF.exe
  C:\Windows\System\QZraoFF.exe
  2⤵
  PID:5656
- C:\Windows\System\EqavBYX.exe
  C:\Windows\System\EqavBYX.exe
  2⤵
  PID:5312
- C:\Windows\System\xNDJQqz.exe
  C:\Windows\System\xNDJQqz.exe
  2⤵
  PID:13488
- C:\Windows\System\waGtRNw.exe
  C:\Windows\System\waGtRNw.exe
  2⤵
  PID:5908
- C:\Windows\System\vgVHsQD.exe
  C:\Windows\System\vgVHsQD.exe
  2⤵
  PID:13692
- C:\Windows\System\euKUJmL.exe
  C:\Windows\System\euKUJmL.exe
  2⤵
  PID:13568
- C:\Windows\System\DeRdyVM.exe
  C:\Windows\System\DeRdyVM.exe
  2⤵
  PID:14188
- C:\Windows\System\AscXPwF.exe
  C:\Windows\System\AscXPwF.exe
  2⤵
  PID:13628
- C:\Windows\System\YicpneV.exe
  C:\Windows\System\YicpneV.exe
  2⤵
  PID:6300
- C:\Windows\System\uxVmGRN.exe
  C:\Windows\System\uxVmGRN.exe
  2⤵
  PID:13792
- C:\Windows\System\nEDMAaq.exe
  C:\Windows\System\nEDMAaq.exe
  2⤵
  PID:6048
- C:\Windows\System\uQxoACz.exe
  C:\Windows\System\uQxoACz.exe
  2⤵
  PID:5260
- C:\Windows\System\LmoEJRN.exe
  C:\Windows\System\LmoEJRN.exe
  2⤵
  PID:5420
- C:\Windows\System\mJDcvbF.exe
  C:\Windows\System\mJDcvbF.exe
  2⤵
  PID:14308
- C:\Windows\System\dJSThiw.exe
  C:\Windows\System\dJSThiw.exe
  2⤵
  PID:5104
- C:\Windows\System\aKAbPqP.exe
  C:\Windows\System\aKAbPqP.exe
  2⤵
  PID:5172
- C:\Windows\System\rcNndgM.exe
  C:\Windows\System\rcNndgM.exe
  2⤵
  PID:12956
- C:\Windows\System\WGvOwFX.exe
  C:\Windows\System\WGvOwFX.exe
  2⤵
  PID:3124
- C:\Windows\System\KXbAUyf.exe
  C:\Windows\System\KXbAUyf.exe
  2⤵
  PID:8936
- C:\Windows\System\WKOIPvX.exe
  C:\Windows\System\WKOIPvX.exe
  2⤵
  PID:8984
- C:\Windows\System\KBpvUiN.exe
  C:\Windows\System\KBpvUiN.exe
  2⤵
  PID:9040
- C:\Windows\System\SUOruZO.exe
  C:\Windows\System\SUOruZO.exe
  2⤵
  PID:8932
- C:\Windows\System\JyHFqDR.exe
  C:\Windows\System\JyHFqDR.exe
  2⤵
  PID:2172
- C:\Windows\System\vPuZSSj.exe
  C:\Windows\System\vPuZSSj.exe
  2⤵
  PID:9148
- C:\Windows\System\EQYwuld.exe
  C:\Windows\System\EQYwuld.exe
  2⤵
  PID:9180
- C:\Windows\System\XTawWih.exe
  C:\Windows\System\XTawWih.exe
  2⤵
  PID:12668
- C:\Windows\System\ZisVvXh.exe
  C:\Windows\System\ZisVvXh.exe
  2⤵
  PID:13504
- C:\Windows\System\wxjChkp.exe
  C:\Windows\System\wxjChkp.exe
  2⤵
  PID:13200
- C:\Windows\System\OfJiQHB.exe
  C:\Windows\System\OfJiQHB.exe
  2⤵
  PID:5396
- C:\Windows\System\AROCsmj.exe
  C:\Windows\System\AROCsmj.exe
  2⤵
  PID:5448
- C:\Windows\System\dWIGyHC.exe
  C:\Windows\System\dWIGyHC.exe
  2⤵
  PID:6376
- C:\Windows\System\HvLqwsl.exe
  C:\Windows\System\HvLqwsl.exe
  2⤵
  PID:13324
- C:\Windows\System\CWNEYRs.exe
  C:\Windows\System\CWNEYRs.exe
  2⤵
  PID:6688
- C:\Windows\System\BpVjcGb.exe
  C:\Windows\System\BpVjcGb.exe
  2⤵
  PID:14040
- C:\Windows\System\jOwzAZo.exe
  C:\Windows\System\jOwzAZo.exe
  2⤵
  PID:2156
- C:\Windows\System\RSAJYRm.exe
  C:\Windows\System\RSAJYRm.exe
  2⤵
  PID:13464
- C:\Windows\System\pvfLcrO.exe
  C:\Windows\System\pvfLcrO.exe
  2⤵
  PID:6504
- C:\Windows\System\PbqSitm.exe
  C:\Windows\System\PbqSitm.exe
  2⤵
  PID:5776
- C:\Windows\System\NAmMnWR.exe
  C:\Windows\System\NAmMnWR.exe
  2⤵
  PID:6164
- C:\Windows\System\KhsdEVx.exe
  C:\Windows\System\KhsdEVx.exe
  2⤵
  PID:1968
- C:\Windows\System\QDwxlIH.exe
  C:\Windows\System\QDwxlIH.exe
  2⤵
  PID:2868
- C:\Windows\System\OmJvlnW.exe
  C:\Windows\System\OmJvlnW.exe
  2⤵
  PID:6724
- C:\Windows\System\pZZiTfh.exe
  C:\Windows\System\pZZiTfh.exe
  2⤵
  PID:4940
- C:\Windows\System\xzSoNiq.exe
  C:\Windows\System\xzSoNiq.exe
  2⤵
  PID:13680
- C:\Windows\System\giLxzQz.exe
  C:\Windows\System\giLxzQz.exe
  2⤵
  PID:6816
- C:\Windows\System\qdDkYMm.exe
  C:\Windows\System\qdDkYMm.exe
  2⤵
  PID:5772
- C:\Windows\System\yxwBJlH.exe
  C:\Windows\System\yxwBJlH.exe
  2⤵
  PID:4140
- C:\Windows\System\ujUVbEm.exe
  C:\Windows\System\ujUVbEm.exe
  2⤵
  PID:14028
- C:\Windows\System\fUsISdd.exe
  C:\Windows\System\fUsISdd.exe
  2⤵
  PID:9076
- C:\Windows\System\fsjELRb.exe
  C:\Windows\System\fsjELRb.exe
  2⤵
  PID:312
- C:\Windows\System\TtuHqJu.exe
  C:\Windows\System\TtuHqJu.exe
  2⤵
  PID:12636
- C:\Windows\System\lGKFsQP.exe
  C:\Windows\System\lGKFsQP.exe
  2⤵
  PID:6244
- C:\Windows\System\Hwqcjzk.exe
  C:\Windows\System\Hwqcjzk.exe
  2⤵
  PID:13100
- C:\Windows\System\zFCRqGl.exe
  C:\Windows\System\zFCRqGl.exe
  2⤵
  PID:13952
- C:\Windows\System\OkXvCPN.exe
  C:\Windows\System\OkXvCPN.exe
  2⤵
  PID:7800
- C:\Windows\System\ueWxPzJ.exe
  C:\Windows\System\ueWxPzJ.exe
  2⤵
  PID:13656
- C:\Windows\System\ULRNNlq.exe
  C:\Windows\System\ULRNNlq.exe
  2⤵
  PID:6992
- C:\Windows\System\cwcjDiK.exe
  C:\Windows\System\cwcjDiK.exe
  2⤵
  PID:9060
- C:\Windows\System\wyXZlOs.exe
  C:\Windows\System\wyXZlOs.exe
  2⤵
  PID:7036
- C:\Windows\System\smCqZPU.exe
  C:\Windows\System\smCqZPU.exe
  2⤵
  PID:7804
- C:\Windows\System\EylWxTJ.exe
  C:\Windows\System\EylWxTJ.exe
  2⤵
  PID:5000
- C:\Windows\System\AtrCjwZ.exe
  C:\Windows\System\AtrCjwZ.exe
  2⤵
  PID:6732
- C:\Windows\System\UDQFZdM.exe
  C:\Windows\System\UDQFZdM.exe
  2⤵
  PID:5856
- C:\Windows\System\onAOzoe.exe
  C:\Windows\System\onAOzoe.exe
  2⤵
  PID:6536
- C:\Windows\System\aZcfoQd.exe
  C:\Windows\System\aZcfoQd.exe
  2⤵
  PID:9132
- C:\Windows\System\rONVPwx.exe
  C:\Windows\System\rONVPwx.exe
  2⤵
  PID:9204
- C:\Windows\System\AOoyqXS.exe
  C:\Windows\System\AOoyqXS.exe
  2⤵
  PID:7544
- C:\Windows\System\VtVdRLv.exe
  C:\Windows\System\VtVdRLv.exe
  2⤵
  PID:6664
- C:\Windows\System\LMifJMi.exe
  C:\Windows\System\LMifJMi.exe
  2⤵
  PID:5796
- C:\Windows\System\rdwuqOr.exe
  C:\Windows\System\rdwuqOr.exe
  2⤵
  PID:7996
- C:\Windows\System\tSJqlxn.exe
  C:\Windows\System\tSJqlxn.exe
  2⤵
  PID:6532
- C:\Windows\System\mYEjAou.exe
  C:\Windows\System\mYEjAou.exe
  2⤵
  PID:7812
- C:\Windows\System\xDRXPwn.exe
  C:\Windows\System\xDRXPwn.exe
  2⤵
  PID:7712
- C:\Windows\System\yMeFxbn.exe
  C:\Windows\System\yMeFxbn.exe
  2⤵
  PID:7612
- C:\Windows\System\AIruXmE.exe
  C:\Windows\System\AIruXmE.exe
  2⤵
  PID:3804
- C:\Windows\System\qkawlgk.exe
  C:\Windows\System\qkawlgk.exe
  2⤵
  PID:4328
- C:\Windows\System\eEePGmH.exe
  C:\Windows\System\eEePGmH.exe
  2⤵
  PID:8044
- C:\Windows\System\yfHaXfN.exe
  C:\Windows\System\yfHaXfN.exe
  2⤵
  PID:6484
- C:\Windows\System\KWeXPoi.exe
  C:\Windows\System\KWeXPoi.exe
  2⤵
  PID:7856
- C:\Windows\System\lYtMAXY.exe
  C:\Windows\System\lYtMAXY.exe
  2⤵
  PID:6728
- C:\Windows\System\TrcYapw.exe
  C:\Windows\System\TrcYapw.exe
  2⤵
  PID:7816
- C:\Windows\System\NgQqoxl.exe
  C:\Windows\System\NgQqoxl.exe
  2⤵
  PID:7600
- C:\Windows\System\TeCmAts.exe
  C:\Windows\System\TeCmAts.exe
  2⤵
  PID:7592
- C:\Windows\System\SkaZbyA.exe
  C:\Windows\System\SkaZbyA.exe
  2⤵
  PID:6556
- C:\Windows\System\hXdQVrZ.exe
  C:\Windows\System\hXdQVrZ.exe
  2⤵
  PID:6228
- C:\Windows\System\YBTCQoA.exe
  C:\Windows\System\YBTCQoA.exe
  2⤵
  PID:1900
- C:\Windows\System\TWnxMSX.exe
  C:\Windows\System\TWnxMSX.exe
  2⤵
  PID:11416
- C:\Windows\System\rHLYBim.exe
  C:\Windows\System\rHLYBim.exe
  2⤵
  PID:7248
- C:\Windows\System\PoriUtB.exe
  C:\Windows\System\PoriUtB.exe
  2⤵
  PID:5652
- C:\Windows\System\xNuAjFy.exe
  C:\Windows\System\xNuAjFy.exe
  2⤵
  PID:6184
- C:\Windows\System\LEUdynK.exe
  C:\Windows\System\LEUdynK.exe
  2⤵
  PID:8140
- C:\Windows\System\CvAHmvx.exe
  C:\Windows\System\CvAHmvx.exe
  2⤵
  PID:13096
- C:\Windows\System\peIQJjR.exe
  C:\Windows\System\peIQJjR.exe
  2⤵
  PID:7776
- C:\Windows\System\uVjZMzC.exe
  C:\Windows\System\uVjZMzC.exe
  2⤵
  PID:7632
- C:\Windows\System\uknVwKm.exe
  C:\Windows\System\uknVwKm.exe
  2⤵
  PID:7828
- C:\Windows\System\vRObvQT.exe
  C:\Windows\System\vRObvQT.exe
  2⤵
  PID:8096
- C:\Windows\System\znyQCDJ.exe
  C:\Windows\System\znyQCDJ.exe
  2⤵
  PID:8028
- C:\Windows\System\xlMglEF.exe
  C:\Windows\System\xlMglEF.exe
  2⤵
  PID:7716
- C:\Windows\System\GWAPsdG.exe
  C:\Windows\System\GWAPsdG.exe
  2⤵
  PID:8088
- C:\Windows\System\YhEpYtT.exe
  C:\Windows\System\YhEpYtT.exe
  2⤵
  PID:7272
- C:\Windows\System\iwXHRVc.exe
  C:\Windows\System\iwXHRVc.exe
  2⤵
  PID:8104
- C:\Windows\System\NDlEbkC.exe
  C:\Windows\System\NDlEbkC.exe
  2⤵
  PID:1040
- C:\Windows\System\UwFSKFE.exe
  C:\Windows\System\UwFSKFE.exe
  2⤵
  PID:6380
- C:\Windows\System\McYpluU.exe
  C:\Windows\System\McYpluU.exe
  2⤵
  PID:7148
- C:\Windows\System\KgIKOEG.exe
  C:\Windows\System\KgIKOEG.exe
  2⤵
  PID:8068
- C:\Windows\System\wBLrAZD.exe
  C:\Windows\System\wBLrAZD.exe
  2⤵
  PID:6288
- C:\Windows\System\TdKJdhm.exe
  C:\Windows\System\TdKJdhm.exe
  2⤵
  PID:7032
- C:\Windows\System\COJIZVl.exe
  C:\Windows\System\COJIZVl.exe
  2⤵
  PID:7868
- C:\Windows\System\lAiRRbM.exe
  C:\Windows\System\lAiRRbM.exe
  2⤵
  PID:6580
- C:\Windows\System\YbDOdmy.exe
  C:\Windows\System\YbDOdmy.exe
  2⤵
  PID:6296
- C:\Windows\System\MZsGQie.exe
  C:\Windows\System\MZsGQie.exe
  2⤵
  PID:3352
- C:\Windows\System\oufYCPI.exe
  C:\Windows\System\oufYCPI.exe
  2⤵
  PID:13976
- C:\Windows\System\BWGKXEE.exe
  C:\Windows\System\BWGKXEE.exe
  2⤵
  PID:14344
- C:\Windows\System\HqBRvrN.exe
  C:\Windows\System\HqBRvrN.exe
  2⤵
  PID:14368
- C:\Windows\System\nggEOBJ.exe
  C:\Windows\System\nggEOBJ.exe
  2⤵
  PID:14388
- C:\Windows\System\cbvCOEF.exe
  C:\Windows\System\cbvCOEF.exe
  2⤵
  PID:14404
- C:\Windows\System\aCoNgag.exe
  C:\Windows\System\aCoNgag.exe
  2⤵
  PID:14424
- C:\Windows\System\BwXlWjO.exe
  C:\Windows\System\BwXlWjO.exe
  2⤵
  PID:14444
- C:\Windows\System\aUuHbFJ.exe
  C:\Windows\System\aUuHbFJ.exe
  2⤵
  PID:14464
- C:\Windows\System\LkJOqQq.exe
  C:\Windows\System\LkJOqQq.exe
  2⤵
  PID:14492
- C:\Windows\System\kqYsEJR.exe
  C:\Windows\System\kqYsEJR.exe
  2⤵
  PID:14512
- C:\Windows\System\EAmtARs.exe
  C:\Windows\System\EAmtARs.exe
  2⤵
  PID:14752
- C:\Windows\System\yeaRFUL.exe
  C:\Windows\System\yeaRFUL.exe
  2⤵
  PID:14768
- C:\Windows\System\pjAqquK.exe
  C:\Windows\System\pjAqquK.exe
  2⤵
  PID:14792
- C:\Windows\System\XCjOMow.exe
  C:\Windows\System\XCjOMow.exe
  2⤵
  PID:14812
- C:\Windows\System\sMjmjJD.exe
  C:\Windows\System\sMjmjJD.exe
  2⤵
  PID:14836
- C:\Windows\System\oEljHxQ.exe
  C:\Windows\System\oEljHxQ.exe
  2⤵
  PID:14856
- C:\Windows\System\LbMhWIE.exe
  C:\Windows\System\LbMhWIE.exe
  2⤵
  PID:14876
- C:\Windows\System\FotSIHN.exe
  C:\Windows\System\FotSIHN.exe
  2⤵
  PID:14896
- C:\Windows\System\wdrCpjc.exe
  C:\Windows\System\wdrCpjc.exe
  2⤵
  PID:14912
- C:\Windows\System\JyDYYjM.exe
  C:\Windows\System\JyDYYjM.exe
  2⤵
  PID:14944
- C:\Windows\System\CRBHEIV.exe
  C:\Windows\System\CRBHEIV.exe
  2⤵
  PID:14976
- C:\Windows\System\UXUcYLl.exe
  C:\Windows\System\UXUcYLl.exe
  2⤵
  PID:14992
- C:\Windows\System\mQhbJWL.exe
  C:\Windows\System\mQhbJWL.exe
  2⤵
  PID:15008
- C:\Windows\System\suVIyjj.exe
  C:\Windows\System\suVIyjj.exe
  2⤵
  PID:15032
- C:\Windows\System\MALmsnw.exe
  C:\Windows\System\MALmsnw.exe
  2⤵
  PID:15056
- C:\Windows\System\vDRqeiJ.exe
  C:\Windows\System\vDRqeiJ.exe
  2⤵
  PID:15076
- C:\Windows\System\wHGIIvd.exe
  C:\Windows\System\wHGIIvd.exe
  2⤵
  PID:15096
- C:\Windows\System\FBPkXwU.exe
  C:\Windows\System\FBPkXwU.exe
  2⤵
  PID:15316
- C:\Windows\System\aRtQIFi.exe
  C:\Windows\System\aRtQIFi.exe
  2⤵
  PID:15344
- C:\Windows\System\CjzNsib.exe
  C:\Windows\System\CjzNsib.exe
  2⤵
  PID:6832
- C:\Windows\System\ZNhcOuL.exe
  C:\Windows\System\ZNhcOuL.exe
  2⤵
  PID:5508
- C:\Windows\System\fTdGZGL.exe
  C:\Windows\System\fTdGZGL.exe
  2⤵
  PID:7588
- C:\Windows\System\BMlnXgz.exe
  C:\Windows\System\BMlnXgz.exe
  2⤵
  PID:6668
- C:\Windows\System\TcNPASy.exe
  C:\Windows\System\TcNPASy.exe
  2⤵
  PID:3632
- C:\Windows\System\bXQjiXq.exe
  C:\Windows\System\bXQjiXq.exe
  2⤵
  PID:8080
- C:\Windows\System\USaYmQc.exe
  C:\Windows\System\USaYmQc.exe
  2⤵
  PID:8636
- C:\Windows\System\ZPQjMyr.exe
  C:\Windows\System\ZPQjMyr.exe
  2⤵
  PID:14616
- C:\Windows\System\rPkLfwf.exe
  C:\Windows\System\rPkLfwf.exe
  2⤵
  PID:14256
- C:\Windows\System\wCtGEuh.exe
  C:\Windows\System\wCtGEuh.exe
  2⤵
  PID:14508
- C:\Windows\System\tRsVkjq.exe
  C:\Windows\System\tRsVkjq.exe
  2⤵
  PID:644
- C:\Windows\System\TeKDbrB.exe
  C:\Windows\System\TeKDbrB.exe
  2⤵
  PID:7420
- C:\Windows\System\qDtNRlH.exe
  C:\Windows\System\qDtNRlH.exe
  2⤵
  PID:7368
- C:\Windows\System\BLpageT.exe
  C:\Windows\System\BLpageT.exe
  2⤵
  PID:15188
- C:\Windows\System\VwymEQl.exe
  C:\Windows\System\VwymEQl.exe
  2⤵
  PID:5176
- C:\Windows\System\ibKhdsY.exe
  C:\Windows\System\ibKhdsY.exe
  2⤵
  PID:8048
- C:\Windows\System\BNdLMtJ.exe
  C:\Windows\System\BNdLMtJ.exe
  2⤵
  PID:7832
- C:\Windows\System\nytPmhh.exe
  C:\Windows\System\nytPmhh.exe
  2⤵
  PID:8116
- C:\Windows\System\SpDnSKv.exe
  C:\Windows\System\SpDnSKv.exe
  2⤵
  PID:6060
- C:\Windows\System\gBMSqqy.exe
  C:\Windows\System\gBMSqqy.exe
  2⤵
  PID:13676
- C:\Windows\System\TewSkTR.exe
  C:\Windows\System\TewSkTR.exe
  2⤵
  PID:14712
- C:\Windows\System\GOWBzkB.exe
  C:\Windows\System\GOWBzkB.exe
  2⤵
  PID:14808
- C:\Windows\System\AAzjRnw.exe
  C:\Windows\System\AAzjRnw.exe
  2⤵
  PID:14460
- C:\Windows\System\LsluWxe.exe
  C:\Windows\System\LsluWxe.exe
  2⤵
  PID:2360
- C:\Windows\System\zIHkMBk.exe
  C:\Windows\System\zIHkMBk.exe
  2⤵
  PID:15240
- C:\Windows\System\UQiGzaR.exe
  C:\Windows\System\UQiGzaR.exe
  2⤵
  PID:15024
- C:\Windows\System\ZhMpRle.exe
  C:\Windows\System\ZhMpRle.exe
  2⤵
  PID:3464
- C:\Windows\System\qbgrUdO.exe
  C:\Windows\System\qbgrUdO.exe
  2⤵
  PID:15108
- C:\Windows\System\dqgCRwW.exe
  C:\Windows\System\dqgCRwW.exe
  2⤵
  PID:7044
- C:\Windows\System\FXUhGan.exe
  C:\Windows\System\FXUhGan.exe
  2⤵
  PID:4896
- C:\Windows\System\jWYUkBU.exe
  C:\Windows\System\jWYUkBU.exe
  2⤵
  PID:8580
- C:\Windows\System\ajQRrVg.exe
  C:\Windows\System\ajQRrVg.exe
  2⤵
  PID:7052
- C:\Windows\System\pujhVTM.exe
  C:\Windows\System\pujhVTM.exe
  2⤵
  PID:8300
- C:\Windows\System\gOXcfgF.exe
  C:\Windows\System\gOXcfgF.exe
  2⤵
  PID:9900
- C:\Windows\System\MVbanYl.exe
  C:\Windows\System\MVbanYl.exe
  2⤵
  PID:14144
- C:\Windows\System\msjpKjC.exe
  C:\Windows\System\msjpKjC.exe
  2⤵
  PID:14488
- C:\Windows\System\LtbEqHH.exe
  C:\Windows\System\LtbEqHH.exe
  2⤵
  PID:14524
- C:\Windows\System\kYSOkEq.exe
  C:\Windows\System\kYSOkEq.exe
  2⤵
  PID:8268
- C:\Windows\System\beAauPx.exe
  C:\Windows\System\beAauPx.exe
  2⤵
  PID:8700
- C:\Windows\System\ZyJKRTC.exe
  C:\Windows\System\ZyJKRTC.exe
  2⤵
  PID:15004
- C:\Windows\System\QLdspdi.exe
  C:\Windows\System\QLdspdi.exe
  2⤵
  PID:14356
- C:\Windows\System\qbfrxMw.exe
  C:\Windows\System\qbfrxMw.exe
  2⤵
  PID:8228
- C:\Windows\System\ruxgXMP.exe
  C:\Windows\System\ruxgXMP.exe
  2⤵
  PID:7232
- C:\Windows\System\kigyYuz.exe
  C:\Windows\System\kigyYuz.exe
  2⤵
  PID:7792
- C:\Windows\System\SnpSkBx.exe
  C:\Windows\System\SnpSkBx.exe
  2⤵
  PID:14592
- C:\Windows\System\ZbhrJxA.exe
  C:\Windows\System\ZbhrJxA.exe
  2⤵
  PID:7796
- C:\Windows\System\hwGkEVz.exe
  C:\Windows\System\hwGkEVz.exe
  2⤵
  PID:14636
- C:\Windows\System\GERMput.exe
  C:\Windows\System\GERMput.exe
  2⤵
  PID:8560
- C:\Windows\System\ZTZjTOT.exe
  C:\Windows\System\ZTZjTOT.exe
  2⤵
  PID:15312
- C:\Windows\System\QUKFHer.exe
  C:\Windows\System\QUKFHer.exe
  2⤵
  PID:15296
- C:\Windows\System\vkgXBzU.exe
  C:\Windows\System\vkgXBzU.exe
  2⤵
  PID:9440
- C:\Windows\System\lNWdlpt.exe
  C:\Windows\System\lNWdlpt.exe
  2⤵
  PID:7424
- C:\Windows\System\UbXkfkA.exe
  C:\Windows\System\UbXkfkA.exe
  2⤵
  PID:7408
- C:\Windows\System\dNqRfBq.exe
  C:\Windows\System\dNqRfBq.exe
  2⤵
  PID:9536
- C:\Windows\System\JgWOGLX.exe
  C:\Windows\System\JgWOGLX.exe
  2⤵
  PID:9420
- C:\Windows\System\WtEPvMu.exe
  C:\Windows\System\WtEPvMu.exe
  2⤵
  PID:9456
- C:\Windows\System\IKuOBgG.exe
  C:\Windows\System\IKuOBgG.exe
  2⤵
  PID:9488
- C:\Windows\System\GzqQvsr.exe
  C:\Windows\System\GzqQvsr.exe
  2⤵
  PID:8132
- C:\Windows\System\FPoAKRl.exe
  C:\Windows\System\FPoAKRl.exe
  2⤵
  PID:3244
- C:\Windows\System\qoTXjYd.exe
  C:\Windows\System\qoTXjYd.exe
  2⤵
  PID:9388
- C:\Windows\System\hQoIDDe.exe
  C:\Windows\System\hQoIDDe.exe
  2⤵
  PID:10188
- C:\Windows\System\YxRJaWD.exe
  C:\Windows\System\YxRJaWD.exe
  2⤵
  PID:14660
- C:\Windows\System\VnAwnYh.exe
  C:\Windows\System\VnAwnYh.exe
  2⤵
  PID:9508
- C:\Windows\System\PJhZJhB.exe
  C:\Windows\System\PJhZJhB.exe
  2⤵
  PID:14720
- C:\Windows\System\ZENLJdT.exe
  C:\Windows\System\ZENLJdT.exe
  2⤵
  PID:14564
- C:\Windows\System\MnrFdse.exe
  C:\Windows\System\MnrFdse.exe
  2⤵
  PID:9212
- C:\Windows\System\UUfqKBP.exe
  C:\Windows\System\UUfqKBP.exe
  2⤵
  PID:9728
- C:\Windows\System\zKOxZIO.exe
  C:\Windows\System\zKOxZIO.exe
  2⤵
  PID:8424
- C:\Windows\System\PyOrqFp.exe
  C:\Windows\System\PyOrqFp.exe
  2⤵
  PID:14620
- C:\Windows\System\sOhpnil.exe
  C:\Windows\System\sOhpnil.exe
  2⤵
  PID:7236
- C:\Windows\System\zXNUMwB.exe
  C:\Windows\System\zXNUMwB.exe
  2⤵
  PID:8264
- C:\Windows\System\CEKuyiQ.exe
  C:\Windows\System\CEKuyiQ.exe
  2⤵
  PID:7820
- C:\Windows\System\uQjyYLW.exe
  C:\Windows\System\uQjyYLW.exe
  2⤵
  PID:7024
- C:\Windows\System\DcOarAR.exe
  C:\Windows\System\DcOarAR.exe
  2⤵
  PID:15180
- C:\Windows\System\JPHAgyT.exe
  C:\Windows\System\JPHAgyT.exe
  2⤵
  PID:6292
- C:\Windows\System\zcYDWNZ.exe
  C:\Windows\System\zcYDWNZ.exe
  2⤵
  PID:7896
- C:\Windows\System\tIkpKaG.exe
  C:\Windows\System\tIkpKaG.exe
  2⤵
  PID:8680
- C:\Windows\System\GPXmqoZ.exe
  C:\Windows\System\GPXmqoZ.exe
  2⤵
  PID:10052
- C:\Windows\System\dpBeFtf.exe
  C:\Windows\System\dpBeFtf.exe
  2⤵
  PID:9756
- C:\Windows\System\AzejFeJ.exe
  C:\Windows\System\AzejFeJ.exe
  2⤵
  PID:6096
- C:\Windows\System\FfaRVuX.exe
  C:\Windows\System\FfaRVuX.exe
  2⤵
  PID:8808
- C:\Windows\System\goJtufj.exe
  C:\Windows\System\goJtufj.exe
  2⤵
  PID:8260
- C:\Windows\System\JrKTLgg.exe
  C:\Windows\System\JrKTLgg.exe
  2⤵
  PID:8120
- C:\Windows\System\gXRAgAp.exe
  C:\Windows\System\gXRAgAp.exe
  2⤵
  PID:8220
- C:\Windows\System\AzvukNu.exe
  C:\Windows\System\AzvukNu.exe
  2⤵
  PID:9088
- C:\Windows\System\PNQpMSh.exe
  C:\Windows\System\PNQpMSh.exe
  2⤵
  PID:10300
- C:\Windows\System\tYYqkkT.exe
  C:\Windows\System\tYYqkkT.exe
  2⤵
  PID:9724
- C:\Windows\System\VrLSrjN.exe
  C:\Windows\System\VrLSrjN.exe
  2⤵
  PID:8136
- C:\Windows\System\zTLaNTR.exe
  C:\Windows\System\zTLaNTR.exe
  2⤵
  PID:3284
- C:\Windows\System\wiuazPc.exe
  C:\Windows\System\wiuazPc.exe
  2⤵
  PID:10560
- C:\Windows\System\ssXchod.exe
  C:\Windows\System\ssXchod.exe
  2⤵
  PID:7808
- C:\Windows\System\zwCoMGe.exe
  C:\Windows\System\zwCoMGe.exe
  2⤵
  PID:10520
- C:\Windows\System\zwShlbS.exe
  C:\Windows\System\zwShlbS.exe
  2⤵
  PID:10296
- C:\Windows\System\xkqiANx.exe
  C:\Windows\System\xkqiANx.exe
  2⤵
  PID:10144
- C:\Windows\System\hLewVzH.exe
  C:\Windows\System\hLewVzH.exe
  2⤵
  PID:10672
- C:\Windows\System\AeYmVks.exe
  C:\Windows\System\AeYmVks.exe
  2⤵
  PID:10656
- C:\Windows\System\fTNddYP.exe
  C:\Windows\System\fTNddYP.exe
  2⤵
  PID:6192
- C:\Windows\System\xhHeyWW.exe
  C:\Windows\System\xhHeyWW.exe
  2⤵
  PID:3308
- C:\Windows\System\SeaAWRT.exe
  C:\Windows\System\SeaAWRT.exe
  2⤵
  PID:9280
- C:\Windows\System\vthZibE.exe
  C:\Windows\System\vthZibE.exe
  2⤵
  PID:10540
- C:\Windows\System\UqzkmKo.exe
  C:\Windows\System\UqzkmKo.exe
  2⤵
  PID:14672
- C:\Windows\System\htcqobg.exe
  C:\Windows\System\htcqobg.exe
  2⤵
  PID:11664
- C:\Windows\System\pFSEdkE.exe
  C:\Windows\System\pFSEdkE.exe
  2⤵
  PID:9544
- C:\Windows\System\aAmbQAa.exe
  C:\Windows\System\aAmbQAa.exe
  2⤵
  PID:10348
- C:\Windows\System\reQawAU.exe
  C:\Windows\System\reQawAU.exe
  2⤵
  PID:9636
- C:\Windows\System\HicjhHi.exe
  C:\Windows\System\HicjhHi.exe
  2⤵
  PID:8876
- C:\Windows\System\oAesAqr.exe
  C:\Windows\System\oAesAqr.exe
  2⤵
  PID:14940
- C:\Windows\System\pxjrWFV.exe
  C:\Windows\System\pxjrWFV.exe
  2⤵
  PID:10276
- C:\Windows\System\jXOqVSy.exe
  C:\Windows\System\jXOqVSy.exe
  2⤵
  PID:9100
- C:\Windows\System\CaANiTK.exe
  C:\Windows\System\CaANiTK.exe
  2⤵
  PID:9524
- C:\Windows\System\MnRFMGV.exe
  C:\Windows\System\MnRFMGV.exe
  2⤵
  PID:11704
- C:\Windows\System\eqYPwft.exe
  C:\Windows\System\eqYPwft.exe
  2⤵
  PID:8320
- C:\Windows\System\epzIZcX.exe
  C:\Windows\System\epzIZcX.exe
  2⤵
  PID:10792
- C:\Windows\System\DAMoqLt.exe
  C:\Windows\System\DAMoqLt.exe
  2⤵
  PID:12036
- C:\Windows\System\yxYdEhK.exe
  C:\Windows\System\yxYdEhK.exe
  2⤵
  PID:10884
- C:\Windows\System\YGLtCqh.exe
  C:\Windows\System\YGLtCqh.exe
  2⤵
  PID:11700
- C:\Windows\System\kjODwqu.exe
  C:\Windows\System\kjODwqu.exe
  2⤵
  PID:10340
- C:\Windows\System\nlxQGMY.exe
  C:\Windows\System\nlxQGMY.exe
  2⤵
  PID:9480
- C:\Windows\System\vkkJveU.exe
  C:\Windows\System\vkkJveU.exe
  2⤵
  PID:8348
- C:\Windows\System\kYLEeWz.exe
  C:\Windows\System\kYLEeWz.exe
  2⤵
  PID:9760
- C:\Windows\System\nPFtCKc.exe
  C:\Windows\System\nPFtCKc.exe
  2⤵
  PID:12044
- C:\Windows\System\ehjeorL.exe
  C:\Windows\System\ehjeorL.exe
  2⤵
  PID:11124
- C:\Windows\System\zQNLtTH.exe
  C:\Windows\System\zQNLtTH.exe
  2⤵
  PID:9344
- C:\Windows\System\FuTfFLn.exe
  C:\Windows\System\FuTfFLn.exe
  2⤵
  PID:10396
- C:\Windows\System\CoJzCle.exe
  C:\Windows\System\CoJzCle.exe
  2⤵
  PID:12284
- C:\Windows\System\rgifAVC.exe
  C:\Windows\System\rgifAVC.exe
  2⤵
  PID:11832
- C:\Windows\System\KeyZUZh.exe
  C:\Windows\System\KeyZUZh.exe
  2⤵
  PID:12264
- C:\Windows\System\jHbrumt.exe
  C:\Windows\System\jHbrumt.exe
  2⤵
  PID:12160
- C:\Windows\System\AGxKXwU.exe
  C:\Windows\System\AGxKXwU.exe
  2⤵
  PID:11596
- C:\Windows\System\jHBnChP.exe
  C:\Windows\System\jHBnChP.exe
  2⤵
  PID:11412
- C:\Windows\System\edjyyjj.exe
  C:\Windows\System\edjyyjj.exe
  2⤵
  PID:9776
- C:\Windows\System\KtYiGkV.exe
  C:\Windows\System\KtYiGkV.exe
  2⤵
  PID:11100
- C:\Windows\System\ooCKDZP.exe
  C:\Windows\System\ooCKDZP.exe
  2⤵
  PID:10184
- C:\Windows\System\CTkwMHC.exe
  C:\Windows\System\CTkwMHC.exe
  2⤵
  PID:10780
- C:\Windows\System\TPhxJny.exe
  C:\Windows\System\TPhxJny.exe
  2⤵
  PID:9632
- C:\Windows\System\IysGmQK.exe
  C:\Windows\System\IysGmQK.exe
  2⤵
  PID:12148
- C:\Windows\System\XWBmurZ.exe
  C:\Windows\System\XWBmurZ.exe
  2⤵
  PID:11968
- C:\Windows\System\sbRNkkB.exe
  C:\Windows\System\sbRNkkB.exe
  2⤵
  PID:9888
- C:\Windows\System\FyWAPHe.exe
  C:\Windows\System\FyWAPHe.exe
  2⤵
  PID:11468
- C:\Windows\System\VvIMzqm.exe
  C:\Windows\System\VvIMzqm.exe
  2⤵
  PID:9384
- C:\Windows\System\wJMiRej.exe
  C:\Windows\System\wJMiRej.exe
  2⤵
  PID:11144
- C:\Windows\System\ehpeLyL.exe
  C:\Windows\System\ehpeLyL.exe
  2⤵
  PID:10576
- C:\Windows\System\CioBZxZ.exe
  C:\Windows\System\CioBZxZ.exe
  2⤵
  PID:9792
- C:\Windows\System\yuzvrOx.exe
  C:\Windows\System\yuzvrOx.exe
  2⤵
  PID:11612
- C:\Windows\System\sGhBByH.exe
  C:\Windows\System\sGhBByH.exe
  2⤵
  PID:11556
- C:\Windows\System\ZfmAwKV.exe
  C:\Windows\System\ZfmAwKV.exe
  2⤵
  PID:12260
- C:\Windows\System\QAnXjXn.exe
  C:\Windows\System\QAnXjXn.exe
  2⤵
  PID:15248
- C:\Windows\System\iXeQZNt.exe
  C:\Windows\System\iXeQZNt.exe
  2⤵
  PID:11756
- C:\Windows\System\lbODHQa.exe
  C:\Windows\System\lbODHQa.exe
  2⤵
  PID:11680
- C:\Windows\System\tWtTaLh.exe
  C:\Windows\System\tWtTaLh.exe
  2⤵
  PID:11660
- C:\Windows\System\cVovHMj.exe
  C:\Windows\System\cVovHMj.exe
  2⤵
  PID:15252
- C:\Windows\System\jKGiHSL.exe
  C:\Windows\System\jKGiHSL.exe
  2⤵
  PID:10484
- C:\Windows\System\BTKnTVL.exe
  C:\Windows\System\BTKnTVL.exe
  2⤵
  PID:11236
- C:\Windows\System\cwASJnN.exe
  C:\Windows\System\cwASJnN.exe
  2⤵
  PID:11900
- C:\Windows\System\InvoThr.exe
  C:\Windows\System\InvoThr.exe
  2⤵
  PID:11948
- C:\Windows\System\fzUQxbg.exe
  C:\Windows\System\fzUQxbg.exe
  2⤵
  PID:14604
- C:\Windows\System\ORWFPTJ.exe
  C:\Windows\System\ORWFPTJ.exe
  2⤵
  PID:11200
- C:\Windows\System\QOSxWPx.exe
  C:\Windows\System\QOSxWPx.exe
  2⤵
  PID:9804
- C:\Windows\System\NVPufAD.exe
  C:\Windows\System\NVPufAD.exe
  2⤵
  PID:11472
- C:\Windows\System\CuhJNEP.exe
  C:\Windows\System\CuhJNEP.exe
  2⤵
  PID:15384
- C:\Windows\System\jVDDiEW.exe
  C:\Windows\System\jVDDiEW.exe
  2⤵
  PID:15408
- C:\Windows\System\KbcASGz.exe
  C:\Windows\System\KbcASGz.exe
  2⤵
  PID:15428
- C:\Windows\System\oiiOffU.exe
  C:\Windows\System\oiiOffU.exe
  2⤵
  PID:15448
- C:\Windows\System\JjSfXvc.exe
  C:\Windows\System\JjSfXvc.exe
  2⤵
  PID:15468
- C:\Windows\System\Ksnlkqf.exe
  C:\Windows\System\Ksnlkqf.exe
  2⤵
  PID:15488
- C:\Windows\System\HrVBbaH.exe
  C:\Windows\System\HrVBbaH.exe
  2⤵
  PID:15512
- C:\Windows\System\SaVAlQk.exe
  C:\Windows\System\SaVAlQk.exe
  2⤵
  PID:15532
- C:\Windows\System\nOJSkyK.exe
  C:\Windows\System\nOJSkyK.exe
  2⤵
  PID:15552
- C:\Windows\System\vLeOePY.exe
  C:\Windows\System\vLeOePY.exe
  2⤵
  PID:15572
- C:\Windows\System\YxzMDfA.exe
  C:\Windows\System\YxzMDfA.exe
  2⤵
  PID:15592
- C:\Windows\System\aQQRmFJ.exe
  C:\Windows\System\aQQRmFJ.exe
  2⤵
  PID:15608
- C:\Windows\System\UmkssLF.exe
  C:\Windows\System\UmkssLF.exe
  2⤵
  PID:15628
- C:\Windows\System\UDQbrti.exe
  C:\Windows\System\UDQbrti.exe
  2⤵
  PID:15648
- C:\Windows\System\wrtKbpB.exe
  C:\Windows\System\wrtKbpB.exe
  2⤵
  PID:15668
- C:\Windows\System\oUHdhvs.exe
  C:\Windows\System\oUHdhvs.exe
  2⤵
  PID:15688
- C:\Windows\System\ODfHRCt.exe
  C:\Windows\System\ODfHRCt.exe
  2⤵
  PID:15708
- C:\Windows\System\atEzAzJ.exe
  C:\Windows\System\atEzAzJ.exe
  2⤵
  PID:15724
- C:\Windows\System\OsPfXZL.exe
  C:\Windows\System\OsPfXZL.exe
  2⤵
  PID:15740
- C:\Windows\System\FuaUFxT.exe
  C:\Windows\System\FuaUFxT.exe
  2⤵
  PID:15756
- C:\Windows\System\JEzvczK.exe
  C:\Windows\System\JEzvczK.exe
  2⤵
  PID:15780
- C:\Windows\System\tXiyMOk.exe
  C:\Windows\System\tXiyMOk.exe
  2⤵
  PID:15800
- C:\Windows\System\nzAhWug.exe
  C:\Windows\System\nzAhWug.exe
  2⤵
  PID:15820
- C:\Windows\System\TnaulQq.exe
  C:\Windows\System\TnaulQq.exe
  2⤵
  PID:15840
- C:\Windows\System\PjSziaa.exe
  C:\Windows\System\PjSziaa.exe
  2⤵
  PID:15856
- C:\Windows\System\orQonYK.exe
  C:\Windows\System\orQonYK.exe
  2⤵
  PID:16208
- C:\Windows\System\afFRkXe.exe
  C:\Windows\System\afFRkXe.exe
  2⤵
  PID:12140
- C:\Windows\System\xJfPCjc.exe
  C:\Windows\System\xJfPCjc.exe
  2⤵
  PID:15404
- C:\Windows\System\JfCWLmb.exe
  C:\Windows\System\JfCWLmb.exe
  2⤵
  PID:11452
- C:\Windows\System\XTQXrsB.exe
  C:\Windows\System\XTQXrsB.exe
  2⤵
  PID:11056
- C:\Windows\System\YCCXTwW.exe
  C:\Windows\System\YCCXTwW.exe
  2⤵
  PID:15504
- C:\Windows\System\BnLJaTV.exe
  C:\Windows\System\BnLJaTV.exe
  2⤵
  PID:10832
- C:\Windows\System\LgLFupD.exe
  C:\Windows\System\LgLFupD.exe
  2⤵
  PID:15696
- C:\Windows\System\xJwsmKK.exe
  C:\Windows\System\xJwsmKK.exe
  2⤵
  PID:12340
- C:\Windows\System\uvZeWsz.exe
  C:\Windows\System\uvZeWsz.exe
  2⤵
  PID:10828
- C:\Windows\System\kJoPJuO.exe
  C:\Windows\System\kJoPJuO.exe
  2⤵
  PID:8384
- C:\Windows\System\sKYiech.exe
  C:\Windows\System\sKYiech.exe
  2⤵
  PID:12312
- C:\Windows\System\GtbZGmc.exe
  C:\Windows\System\GtbZGmc.exe
  2⤵
  PID:12812
- C:\Windows\System\BGjimfz.exe
  C:\Windows\System\BGjimfz.exe
  2⤵
  PID:12380
- C:\Windows\System\BoFNXRd.exe
  C:\Windows\System\BoFNXRd.exe
  2⤵
  PID:11156
- C:\Windows\System\ZrzqcXf.exe
  C:\Windows\System\ZrzqcXf.exe
  2⤵
  PID:12828
- C:\Windows\System\nOfYtFN.exe
  C:\Windows\System\nOfYtFN.exe
  2⤵
  PID:12960
- C:\Windows\System\RRcQGZI.exe
  C:\Windows\System\RRcQGZI.exe
  2⤵
  PID:15496
- C:\Windows\System\lsXRNVQ.exe
  C:\Windows\System\lsXRNVQ.exe
  2⤵
  PID:13072
- C:\Windows\System\tBnTLSQ.exe
  C:\Windows\System\tBnTLSQ.exe
  2⤵
  PID:15640
- C:\Windows\System\nnAbjbL.exe
  C:\Windows\System\nnAbjbL.exe
  2⤵
  PID:15992
- C:\Windows\System\wgzYMLO.exe
  C:\Windows\System\wgzYMLO.exe
  2⤵
  PID:15996
- C:\Windows\System\uWWqGaR.exe
  C:\Windows\System\uWWqGaR.exe
  2⤵
  PID:13048
- C:\Windows\System\QRpvXnl.exe
  C:\Windows\System\QRpvXnl.exe
  2⤵
  PID:13068
- C:\Windows\System\oWIfWaP.exe
  C:\Windows\System\oWIfWaP.exe
  2⤵
  PID:16028
- C:\Windows\System\CloAArG.exe
  C:\Windows\System\CloAArG.exe
  2⤵
  PID:15788
- C:\Windows\System\LNNQFru.exe
  C:\Windows\System\LNNQFru.exe
  2⤵
  PID:10760
- C:\Windows\System\qRlQbhC.exe
  C:\Windows\System\qRlQbhC.exe
  2⤵
  PID:15836
- C:\Windows\System\RLKIvQw.exe
  C:\Windows\System\RLKIvQw.exe
  2⤵
  PID:16060
- C:\Windows\System\qkZDTzb.exe
  C:\Windows\System\qkZDTzb.exe
  2⤵
  PID:13168
- C:\Windows\System\BQTMvIb.exe
  C:\Windows\System\BQTMvIb.exe
  2⤵
  PID:13064
- C:\Windows\System\SwbfEvA.exe
  C:\Windows\System\SwbfEvA.exe
  2⤵
  PID:12720
- C:\Windows\System\hpITgDy.exe
  C:\Windows\System\hpITgDy.exe
  2⤵
  PID:16108
- C:\Windows\System\MeTLljy.exe
  C:\Windows\System\MeTLljy.exe
  2⤵
  PID:15392
- C:\Windows\System\wCTgrAr.exe
  C:\Windows\System\wCTgrAr.exe
  2⤵
  PID:15424
- C:\Windows\System\owNmlrq.exe
  C:\Windows\System\owNmlrq.exe
  2⤵
  PID:15932
- C:\Windows\System\dTzZTVw.exe
  C:\Windows\System\dTzZTVw.exe
  2⤵
  PID:15776
- C:\Windows\System\AGOaZGC.exe
  C:\Windows\System\AGOaZGC.exe
  2⤵
  PID:13112
- C:\Windows\System\rNYXRNM.exe
  C:\Windows\System\rNYXRNM.exe
  2⤵
  PID:12188
- C:\Windows\System\QdkEcSF.exe
  C:\Windows\System\QdkEcSF.exe
  2⤵
  PID:16336
- C:\Windows\System\hdrlHcv.exe
  C:\Windows\System\hdrlHcv.exe
  2⤵
  PID:15976
- C:\Windows\System\vVKrtff.exe
  C:\Windows\System\vVKrtff.exe
  2⤵
  PID:16076
- C:\Windows\System\mqnJzDF.exe
  C:\Windows\System\mqnJzDF.exe
  2⤵
  PID:16148
- C:\Windows\System\KXawrbs.exe
  C:\Windows\System\KXawrbs.exe
  2⤵
  PID:13472
- C:\Windows\System\QlNyIoS.exe
  C:\Windows\System\QlNyIoS.exe
  2⤵
  PID:16220
- C:\Windows\System\gPVavcv.exe
  C:\Windows\System\gPVavcv.exe
  2⤵
  PID:13260
- C:\Windows\System\UxeDYsZ.exe
  C:\Windows\System\UxeDYsZ.exe
  2⤵
  PID:13180
- C:\Windows\System\ZvYkkeA.exe
  C:\Windows\System\ZvYkkeA.exe
  2⤵
  PID:8124
- C:\Windows\System\uufitSI.exe
  C:\Windows\System\uufitSI.exe
  2⤵
  PID:6652
- C:\Windows\System\ZkMJeSN.exe
  C:\Windows\System\ZkMJeSN.exe
  2⤵
  PID:16360
- C:\Windows\System\cZHiTWn.exe
  C:\Windows\System\cZHiTWn.exe
  2⤵
  PID:11140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y5patcu5.ufi.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BbOsvNf.exe

Filesize
1.7MB

MD5
d8a2bd921d42db104e961a161b8ce7c2

SHA1
4b1d6d98c8c7ed46e80c22cacad772e55cea8105

SHA256
087456f58e7e2c7fa35cfc48eddd74ba718d058c978189ba0abd40226dc92c6c

SHA512
b7e443a2356a05e3f759a103c9cbd4f3c5b8a661e1edc46d85a0c097a3fe4f55eaa131575b8117676c00a7b0f53e3c861825b70af0de55922a86b58692196050

Download Submit
C:\Windows\System\EuEOjvA.exe

Filesize
1.7MB

MD5
63e58ea664b80f07a98cd4970c26ea6b

SHA1
21bb9c44fa07199ceaf4328d5113e729b6f34907

SHA256
521ddcf0856ca75112a915f35656062f4884b548a6b5407234c94bfcf1b4f9ac

SHA512
5ba3529438510674dfb47e775d5628fcc52d4f5a2d4c40268ea147dd9ddfd1c4cdce33f9d3cf38707a7c0a4dc249309183d3cf816549610bdde9a8c611561138

Download Submit
C:\Windows\System\EzfGgjO.exe

Filesize
1.7MB

MD5
0b8a64c4ba59066db9297f22838bc8d7

SHA1
ef7c32b0243fd1f89b3e2aa093db9a72a1d29b4c

SHA256
946a3f31d1f2728ee02c7e372e2212e737ea99f3fae8616c3d5128cbece30c99

SHA512
26872f024943e7329a591bacbacf73cc4b376b83d31b9d8141944a2166e2df97f38c66ac2fbc8d0012c4a597151da74fa5c3dbb5a8c2c425fc894aaf41001657

Download Submit
C:\Windows\System\FflTsVI.exe

Filesize
1.6MB

MD5
2a158657b2a0b280ebf1c049ef887eef

SHA1
a9c5b46d34cb3a21548b607347444ebb2f14b3dc

SHA256
1d60289bdf029ced3df639ae7df0f76a319c8655d8adb18d506074754464a9ee

SHA512
9d6d6ed0041bbe42d7cb92e323f1171c95c08eed1e3c1487e9e860bd0404a4485001bf458641b33e1084b7e2816a733e362dc33637e26132e77870790453ad23

Download Submit
C:\Windows\System\HePMgUl.exe

Filesize
1.6MB

MD5
2f7ced8b5a7be6f268d79ed54831f8ad

SHA1
b8f8dda7821bb0729de1c7e07cbf2ccfe3f0654c

SHA256
af9d1e6918298ac39a1194ef2be3f25e4f991da50cb084daf858ad3b1fbbd45f

SHA512
21979a39ab6b0631054806ec1807fcf5f17194222859511fb5db6abad1a81382032aba87bd55593be8a17c303a85cfd540c43ad8cc105d9e4d3272fed61cb3f1

Download Submit
C:\Windows\System\IkalWrp.exe

Filesize
1.6MB

MD5
e3cb12046877861c36dae61ac34db3e3

SHA1
b233244931caceea7af46823e03e77f8aadd95cd

SHA256
971fefe66f08c34878238e27eceeb1d07c32f7eb407f4a87151da726d1490fec

SHA512
840d6cc1cc0ecef9a1511f483cdc6ba50c21456938077763f44e6055d439157c4f574c500bf3046ff0b12d60a488b0244ef1ef8ed9173eaa2b2cb010b8090492

Download Submit
C:\Windows\System\JgYIxif.exe

Filesize
1.7MB

MD5
055fe0c179ab5ea9486fabfd3002b876

SHA1
90fdd858f90642acac204f22e642e2197060a450

SHA256
89dd9816165a49790ef2da9c792ed72a4bdbc35c86fc6028aba047ec7106dd8d

SHA512
410a37d09389a8936df28896ae3b107882408f1e24942d5ba27e7f64972ff4aa1707d8d6761b1172709d71f055ed202361496e366320b7f9069deb3dbf508546

Download Submit
C:\Windows\System\NeOdCjc.exe

Filesize
1.7MB

MD5
36428256fc16961d2ba00a2d445a0e4d

SHA1
9674b8dfb7b2ce56d15f91b00a520d359b54e627

SHA256
c6635c3a565915048f7cd4ef444d63258ee72c6c0a7450981d8b7154f1b31bde

SHA512
a8f0936802b6fa82fc133a25274d17ccb4e9bed9b5c13ea00756371bf8d50d3f029068460a6643625b754c41e77c9567ab7aa2da9ecc69ac6c3a6ee4cd1ef0df

Download Submit
C:\Windows\System\NyievkH.exe

Filesize
1.7MB

MD5
4672d3ef6232f3b7c65eb304c24e2b3e

SHA1
2674548c840aec3d744ae41f7b549929be5fbb56

SHA256
297b921b2c7f8f3256417c91e92e7655adcb84be9375f4f2f7a849d3c404f988

SHA512
65b6fe2bce1d837e58863c8bdc94285a18895d15b7873279d364d22ea548f74c807da1a3e3e2b0b9ec363dd7b9102ff330c04bd139179133c118e624bf5ed38a

Download Submit
C:\Windows\System\QJrIDne.exe

Filesize
1.7MB

MD5
5b68fffcd40006abf2110c0770606b2f

SHA1
5a5a95bb2e07f74a1fcc63e6de31a865b3753899

SHA256
36492d970070f892cbf7d70858e675cd0fb405abaeba55e25c37d7bd1fcc65c2

SHA512
01b3c6f9a3d24e34061abacad3558985f33dc3861373542f59d2d344686366f28ceb8ba872fab5acabc5d0d163110e294c2068caa1b59269217c497c3d68f31a

Download Submit
C:\Windows\System\QxabdIT.exe

Filesize
1.7MB

MD5
652fc3fd37fa1a4a73c413ccd9a8f652

SHA1
86f4bff2f3bbca8fe0df8bd0c4d9da663b54bdd0

SHA256
5bfaf93e350acb928a66b2d8941ecd1fa0ca28fe907e15af044a5282c250df7f

SHA512
16b6928f2d31c72a82a793f3e8cfdf1d7ff744b0964d2288e8210d1d80a1575bc02feb39155a7bfa158ab194c9944c13d94eec38d2b83d2ecc4fa35b86076836

Download Submit
C:\Windows\System\RodomSd.exe

Filesize
1.6MB

MD5
19f24ebb26f13548cf960f5520d4d623

SHA1
1c56298b7d305bd04b9cb394692fb9d1d6cfb5c0

SHA256
f84ee0cba0cea6d9d0619741dc1d6e4bc21afd7afae5cd3cd20958fc4d1e418e

SHA512
9787cd64f99d5741147f2a131e5d2cf827de14d971f15525f9a663950ade18373a2219d98b3cc9b87d1b0493f6c42bf9e8d4c5bdf7c4fece33452c9a51e58be2

Download Submit
C:\Windows\System\TWCXAiN.exe

Filesize
1.6MB

MD5
c301c8cc0307d77cc8e0cfdaa7c99d08

SHA1
235cd084a2d162cf8b6bfdac420187f42fc2df58

SHA256
d4d09f1df863c5d1f0feb15e8cbc09103951f336644878e80549dbb7cd6b0af2

SHA512
9831e5068bd1e8b414e025027a48ff9657842a32dc17c28d889a17473c36c86d1f34689cca1a87b5563251c05ddb987d624d44e718de9758c0cc6c775a7c86ed

Download Submit
C:\Windows\System\VXkFkYh.exe

Filesize
1.7MB

MD5
db7c02db293d4181cf63fd6d762e3df8

SHA1
8fb0b2fc623573f60cff719089470f6140310a80

SHA256
f15464385dbf7837c35755c5618344e51dac85974f11ed2bca75691d19d1bd1a

SHA512
c7f5273380a16cd0cb8891055d550ab1867d0fd15e3d7c9fff85c0befea5fc06f2f44b537761d9113c89f8a2cc53295a4c03387f3cced7a90daa1472a7344ed6

Download Submit
C:\Windows\System\WUMkVVr.exe

Filesize
1.6MB

MD5
a37d87b47727a7c01014601d4aca4164

SHA1
401942bf47bd10fa1d3dca8c19c4a441108b5213

SHA256
70e9bb53e27c91f32e9fb75d8c5b30d0da08889f3c7d6eb87a7fd8b3c3de85f1

SHA512
d4a44077fe09c76b1fa959a5705b75c5272d6d9ebdd6478bfc573e12ce2f52c8683155630c85d6aff63a1a9f9051fe10a2c5b00b4cf58c2ceeba789e114c7479

Download Submit
C:\Windows\System\WYLFRBS.exe

Filesize
1.6MB

MD5
ec60d5f0a5887a2dcfe9a3bbc713e1b5

SHA1
1c2cac89cca0c0eba409e33406ec2b5c3d38906d

SHA256
d8eb24137eaf74d5cbadc5c971e274324b13b9661a4bd6372ba8717caf4b70ce

SHA512
bb5043d711742c71b2b0a5ca84cf8fac2aff7806af79608943f72efd50faafec1a8abb5a8a577008b753a63263443c4c551b3fff161cba08032cc342fc21f0c8

Download Submit
C:\Windows\System\WyUsfKi.exe

Filesize
1.7MB

MD5
0cd30ee73f7c5c65b3f0d4f6201d0804

SHA1
9f8c253f35f7ef233adab194665e0ef494830dc7

SHA256
9228a5dccc0266d85421df7c5c3d6b5f66b973f025d86a16eceb44b88938d3f6

SHA512
96981b323d9ce54b8c0bb378a59d3540c9a81d29baf11bccfba0fe1a0838e7b4d8af2928e045ab0dd5458a6e03d1e5043561463bd1e00c463c32de053fbbc807

Download Submit
C:\Windows\System\aFBhnnp.exe

Filesize
1.7MB

MD5
4128dac06ceed55d8e95350939a4242a

SHA1
b5ea6604ebe521937e59eb1da15868f2d3f6ebde

SHA256
b59882966d372669f4bf69f556f4a32cf2e91b5be42230d9f59720f254b571de

SHA512
cf135d0ff2665f09c491d244087cceaf9ecd86d7b1ff6bcc5ed069e60066b88e7feed1ca57ed939282c293fccc73c942fa4717d96d2b072a3ed329c1899f5366

Download Submit
C:\Windows\System\cRDpHZo.exe

Filesize
1.7MB

MD5
cf5d173b99e7e01e1e2710ec95581bce

SHA1
936d61c14011181ac39d74dea6b604a2f3448588

SHA256
7f73fec989c287b48668e0027db0578cae6ea333bef7d4095968ccfdb64c448d

SHA512
f0a5f77bd17afba0a679790f231b28d36556905a3517aebb0ac720b06f9a2e333a052954dff8873f191385c8a9a3a2578b2dbdaaf0bc347b8e7cc098055a42c2

Download Submit
C:\Windows\System\ebuODZi.exe

Filesize
1.7MB

MD5
3b45eb5f4a3003feaf920c789f547a3e

SHA1
5709d1d16edad990ad26537dfd4ca584bc400434

SHA256
29cb466ffee9ebcacc031c5bab14a2e9f801907e63a97412cb225ec2880c9a56

SHA512
d929f1706c6c900874ce4d8827d424c885e0c3bc205749d8a10a791e2b8987ea53955b58d0564d4b20ab55e55a17bd3beac5c4c7a5d22f1446602306fb1becdc

Download Submit
C:\Windows\System\gTopPuD.exe

Filesize
1.7MB

MD5
e579b707885141006179072e3cc76636

SHA1
7c5267168a3386b547bae5f93c4258bc2b3c4749

SHA256
001d92354ffdbd0e44783e06ea976de960da7eb5786bd76871e07a8e2db10479

SHA512
b6e562e49c088b833526d22d6daef62cb51ec1d4b7afe18be22d5c471b8e3f4068303033c624b3ecc0cdb0f56343b53f6acad17183af9f9537e20adeaa706bc1

Download Submit
C:\Windows\System\gitoLIy.exe

Filesize
1.7MB

MD5
8e3a81e69bb9d5d977f8e97f872a0f23

SHA1
35894a746306f729b5f0d8956f8ca02bf4b95464

SHA256
c367cdf6b97604fe2cf4c23f9d8dbeeee81998172218ee34f67fce4c09afa3fe

SHA512
24240a4a94fc1dbf98b06ff963c6702dea43ca0fe3656d4149b275d88ca992f180560ac9a9fb54dec66c0bc0a728d4007347b94a49e07b9ced9b48ca2782d3fb

Download Submit
C:\Windows\System\gojDjJe.exe

Filesize
1.7MB

MD5
7ddd8c225072d00c1c38c34f1d3e8704

SHA1
db693378d341bde7be5b7c08a46cfe76da86486a

SHA256
db6fd185398c42517a337a662f754fc99986b6dfc78d4eb7694c7c6c6711a6db

SHA512
da734f91bed64a99612ba572cdc1685e51a0c1ce7fbdcc5131e651334527692799537b143d1a95f8323055bb9a348019a592c33e8073fd33f29a11623ce5aac8

Download Submit
C:\Windows\System\hWTKyJj.exe

Filesize
1.7MB

MD5
0aa89b12ab0c609acd164a9d0d899e68

SHA1
d17f935d5bb4628e56c95dc5cfedb451f034f404

SHA256
9013bf88785828cad0ffde24b6abb1df9015ccea2480f94247cab21bc4bb6703

SHA512
ffbf32594accd30623f2d1ab8ef5c9ab55f397b36134db31217b72fde0b3dc6edc8661236ba4e585e21a76075da9062fb2082081aa7cf1f6cf819d5d592c7a85

Download Submit
C:\Windows\System\ioqFpFY.exe

Filesize
1.7MB

MD5
c545b213ad1619ecc00487a35738f7f3

SHA1
da44c3bf628ac27454930815e814d9209debb53b

SHA256
910596a28c7659c555df2e1bc763b28f69a025726871dc0681cb3164260dbc9d

SHA512
795713e0909a52fe80cc9ea862954185bce2615656ccb7ecacc0d6687fba2c9276917f1c19e059d04f99d669f9fc871ec44f15d9f8c4372a14cff481a34c88dd

Download Submit
C:\Windows\System\jeiVrcc.exe

Filesize
1.7MB

MD5
480afe2a9d179563112e4e578938a1f4

SHA1
8d4b915eb184d33a7b6c219deb32be4f0f40c8a3

SHA256
03fb4ab5a27475c5f04767d18220e0c3781a1ee49d0871ced0c50a18e40af3a9

SHA512
c8201535266c654ff0964cc53a7608b70070dc987f1ab3937c64f0fe178311bad58c60821634d0f67766fd0b2d83ecf25219764edaf40d486c898b0e189a10e7

Download Submit
C:\Windows\System\juPCxEF.exe

Filesize
1.7MB

MD5
04c08ca05aac5f30289e9fd548568b93

SHA1
aad70f9bfdb1234174344b6aa20b96ac54c17735

SHA256
f59e9a6554dcebf3017e3f14ea82e06ee68775a6211a1262dd73379ed1a99b6e

SHA512
099fc921567b063560cd4e81e26011f5f2f37de8705120e52b5694c8a42a17a56b02a0cdcc4e22604d42a51fa0120b2cb7c268605f59999501bed33dae69a184

Download Submit
C:\Windows\System\lofsaRf.exe

Filesize
1.6MB

MD5
d45bcc1769d761fdea40a4e5336415ee

SHA1
6112e1898ff85e2c5bb09af2daa9cb6d8227e8a1

SHA256
e7b83d8db4a58155f099a916e8efc8f335b2831e1c2196365ae9213188fb9d6f

SHA512
10fe7796f192b25c6ee8cecae90c72222dff5c9404e1def8d49bee48e886ba048b4bebbfb327c8aace76cc5919133cf60fe11ca8e9ad7459dee67900a64375d5

Download Submit
C:\Windows\System\mbmiXxt.exe

Filesize
1.6MB

MD5
daa194bd8ad4b98ec637f4b018fe399c

SHA1
231810a69604b742140ff3abdc32fafd3e11ba28

SHA256
5d7d057aa04de5b636da78804af4f00f94ba27930e2b4d815ec4568927da6b0b

SHA512
d5b3973487f5faaa81f4fe913a1e5ef2dc0724175a0044a308078fcfe7872cd384babf694eaca248eab44c3611c31952aded512ab853f4d009da5e4c36a08a2a

Download Submit
C:\Windows\System\nOoOcIq.exe

Filesize
1.7MB

MD5
0d3e962934e7ef664d476b9148f7a955

SHA1
8cd7244fee8c0cfa4e86b984e4589b7fc4d336a0

SHA256
43df9590b74cdc6480093963ae28fc15c01d190a62e6dbc8cdea3830a7a71f07

SHA512
fdcc2f410482ca3750e1d383e5d034a38dc707eeded005d1b321012bcf5441c612f99a6dea2444f3fa0ee9713459991fa2537b9e283732ab5a24fb1d7e08c7d8

Download Submit
C:\Windows\System\nmsIAeI.exe

Filesize
1.7MB

MD5
d51cacf8564977a5e5fe56dbd51158e8

SHA1
70a8f3af5f297c55b313099c0609938fb6a06691

SHA256
324dd6f86e1d76bdd827db8bbc010bebdac69e6a4bcce70f3f7462f8555adc31

SHA512
bc3c0958d7961a59f65e6ca17197344ffb84987171dba32580d0194f058c2e0271cc47ea4a69f624094409f712c2fd20fea442e288e9d542a4b7e782c384d75f

Download Submit
C:\Windows\System\uJyxSIH.exe

Filesize
1.7MB

MD5
c5c02747810961f47eea21f4b2c81242

SHA1
0ef948c2152214a446a58e3b43f7eab401ddaf17

SHA256
d735db34d1926f17b2e4de77c856a8607c09fcea0abf0634a87816b578069dd7

SHA512
026c1e308b66ef2f9fffc922eb09f6cd340bfea49accb4262d4d6b619c1b8b8a9145b3e92abd94a807f9dc017b5da2cb76160c0bbb6081a38f85fc6009de125c

Download Submit
C:\Windows\System\uUEdzmJ.exe

Filesize
1.7MB

MD5
52b32f475a851c556b962a6e695651a8

SHA1
86b4c2fd214cd528ed637d090ac287e48e6dc7e0

SHA256
580c6b259d5a7455c6d016c5ca1332329edb386ebe78f69af644e7d5209fb471

SHA512
92d6a66053fa76468f06a8bd694dc5792a3a81058385b8ca5b2fd6971fb32015b38e43692c92cd562de47aaaaa29ee0bff8bb6b63397cc58767e1ff3b3faea9f

Download Submit
C:\Windows\System\vwOedKi.exe

Filesize
1.7MB

MD5
f5905f7d92de927b2a896d9b46126916

SHA1
4537edadd130495d21e78e85b39668398b2de515

SHA256
4e8526cb1d15f4f9f31faf070434b4f3ca686b91270124472a6ee754b0bd0f0e

SHA512
959e51c574621f6e7e690dcf240031a525916a4cde03b6acbe70997e37b1d5c23ddefb13fbf5de8b385876ba455a2f4e85ac45f829f9474e66c192c05552cafd

Download Submit
C:\Windows\System\weSgKbP.exe

Filesize
1.6MB

MD5
ec8383b9719e4a9fc2e8594523882bc1

SHA1
5fed42104ec731f02a63803e960480bf52f840b4

SHA256
3d976add6ea00ef84932df6ebc7011f482f3836d306322cb428a85e8d2451a3e

SHA512
923c7dd7f7cd1eb3ce71878ca7f817e34c97e93777e7416e8a718141b2884d8186fbfdb32a4828ee65f36ef796757714b37b81123c6aa21542b5f1d121a97f89

Download Submit
C:\Windows\System\xORpqlX.exe

Filesize
1.7MB

MD5
34ee3c4b3287b54d1a0d24170aa33e2c

SHA1
cf37177a992ea9e71865f31698a9b6f9f50c6f7e

SHA256
0f66c62f204cf8d2eb9e84b9b34b2a1e5fa4c3f55c4b35882a4fda39fa0e6b00

SHA512
2720e53c7db85850e553361d18db2deb0423a2e39024ddae3ffc7b1d3eb07a8735a527e9d0d2b787d07e1ab85c769653a808a7e34cf8d3821a097779356e04ad

Download Submit
memory/8-1758-0x00007FF6750B0000-0x00007FF6754A2000-memory.dmp

Filesize
3.9MB

Download
memory/8-135-0x00007FF6750B0000-0x00007FF6754A2000-memory.dmp

Filesize
3.9MB

Download
memory/380-145-0x00007FF602D80000-0x00007FF603172000-memory.dmp

Filesize
3.9MB

Download
memory/380-1822-0x00007FF602D80000-0x00007FF603172000-memory.dmp

Filesize
3.9MB

Download
memory/408-1712-0x00007FF649590000-0x00007FF649982000-memory.dmp

Filesize
3.9MB

Download
memory/408-9-0x00007FF649590000-0x00007FF649982000-memory.dmp

Filesize
3.9MB

Download
memory/444-16-0x00007FF6E8080000-0x00007FF6E8472000-memory.dmp

Filesize
3.9MB

Download
memory/444-1715-0x00007FF6E8080000-0x00007FF6E8472000-memory.dmp

Filesize
3.9MB

Download
memory/684-1775-0x00007FF7F9920000-0x00007FF7F9D12000-memory.dmp

Filesize
3.9MB

Download
memory/684-139-0x00007FF7F9920000-0x00007FF7F9D12000-memory.dmp

Filesize
3.9MB

Download
memory/788-143-0x00007FF70F100000-0x00007FF70F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/788-1909-0x00007FF70F100000-0x00007FF70F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/980-1755-0x00007FF63B680000-0x00007FF63BA72000-memory.dmp

Filesize
3.9MB

Download
memory/980-122-0x00007FF63B680000-0x00007FF63BA72000-memory.dmp

Filesize
3.9MB

Download
memory/1664-141-0x00007FF76EB50000-0x00007FF76EF42000-memory.dmp

Filesize
3.9MB

Download
memory/1664-1843-0x00007FF76EB50000-0x00007FF76EF42000-memory.dmp

Filesize
3.9MB

Download
memory/2012-136-0x00007FF77DB90000-0x00007FF77DF82000-memory.dmp

Filesize
3.9MB

Download
memory/2012-1779-0x00007FF77DB90000-0x00007FF77DF82000-memory.dmp

Filesize
3.9MB

Download
memory/2072-137-0x00007FF6B3BB0000-0x00007FF6B3FA2000-memory.dmp

Filesize
3.9MB

Download
memory/2072-1780-0x00007FF6B3BB0000-0x00007FF6B3FA2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-80-0x00007FF72C4C0000-0x00007FF72C8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-1756-0x00007FF72C4C0000-0x00007FF72C8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2428-1897-0x00007FF6CF030000-0x00007FF6CF422000-memory.dmp

Filesize
3.9MB

Download
memory/2428-140-0x00007FF6CF030000-0x00007FF6CF422000-memory.dmp

Filesize
3.9MB

Download
memory/2816-1910-0x00007FF747190000-0x00007FF747582000-memory.dmp

Filesize
3.9MB

Download
memory/2816-142-0x00007FF747190000-0x00007FF747582000-memory.dmp

Filesize
3.9MB

Download
memory/3212-1771-0x00007FF63E200000-0x00007FF63E5F2000-memory.dmp

Filesize
3.9MB

Download
memory/3212-93-0x00007FF63E200000-0x00007FF63E5F2000-memory.dmp

Filesize
3.9MB

Download
memory/3904-1767-0x00007FF62B160000-0x00007FF62B552000-memory.dmp

Filesize
3.9MB

Download
memory/3904-138-0x00007FF62B160000-0x00007FF62B552000-memory.dmp

Filesize
3.9MB

Download
memory/3992-134-0x00007FF7F1570000-0x00007FF7F1962000-memory.dmp

Filesize
3.9MB

Download
memory/3992-1770-0x00007FF7F1570000-0x00007FF7F1962000-memory.dmp

Filesize
3.9MB

Download
memory/4028-1894-0x00007FF6F9B00000-0x00007FF6F9EF2000-memory.dmp

Filesize
3.9MB

Download
memory/4028-146-0x00007FF6F9B00000-0x00007FF6F9EF2000-memory.dmp

Filesize
3.9MB

Download
memory/4208-1759-0x00007FF7916A0000-0x00007FF791A92000-memory.dmp

Filesize
3.9MB

Download
memory/4208-103-0x00007FF7916A0000-0x00007FF791A92000-memory.dmp

Filesize
3.9MB

Download
memory/4544-0-0x00007FF690090000-0x00007FF690482000-memory.dmp

Filesize
3.9MB

Download
memory/4544-1-0x00000231ACC60000-0x00000231ACC70000-memory.dmp

Filesize
64KB

Download
memory/4696-1711-0x00007FF779C60000-0x00007FF77A052000-memory.dmp

Filesize
3.9MB

Download
memory/4696-18-0x00007FF779C60000-0x00007FF77A052000-memory.dmp

Filesize
3.9MB

Download
memory/4752-94-0x00000284EB570000-0x00000284EB580000-memory.dmp

Filesize
64KB

Download
memory/4752-127-0x00000284ED5F0000-0x00000284ED612000-memory.dmp

Filesize
136KB

Download
memory/4752-72-0x00007FF9D5CB0000-0x00007FF9D6771000-memory.dmp

Filesize
10.8MB

Download
memory/4752-2301-0x00000284EE270000-0x00000284EEA16000-memory.dmp

Filesize
7.6MB

Download
memory/4908-144-0x00007FF7DDF50000-0x00007FF7DE342000-memory.dmp

Filesize
3.9MB

Download
memory/4908-1891-0x00007FF7DDF50000-0x00007FF7DE342000-memory.dmp

Filesize
3.9MB

Download
memory/5028-1766-0x00007FF7AAAA0000-0x00007FF7AAE92000-memory.dmp

Filesize
3.9MB

Download
memory/5028-133-0x00007FF7AAAA0000-0x00007FF7AAE92000-memory.dmp

Filesize
3.9MB

Download