xmrig | 7823e3d1cef1230eff3bcb2932d6bb53e07d5a8994393569f8ecc3c09706cc2e

Analysis

max time kernel
147s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 08:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
Size

2.2MB
MD5

097a89dd4e8c54f94904e9858f2f4d42
SHA1

13012c892ce30d31568d7d7a26746e4af419417b
SHA256

7823e3d1cef1230eff3bcb2932d6bb53e07d5a8994393569f8ecc3c09706cc2e
SHA512

8b5153e7839a1cc2efe3c35ab74bc999424bd4c18762b0ee2f24b74c27e2beaf3f2f690c2e679734d5bac705c102fb8bc8d56cf019a2b27cf0becb856638654d
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrf8:NABx

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 37 IoCs

miner

resource	yara_rule
behavioral2/memory/5096-276-0x00007FF69E7E0000-0x00007FF69EBD2000-memory.dmp	xmrig
behavioral2/memory/2864-290-0x00007FF657AD0000-0x00007FF657EC2000-memory.dmp	xmrig
behavioral2/memory/1840-294-0x00007FF6E34E0000-0x00007FF6E38D2000-memory.dmp	xmrig
behavioral2/memory/3084-297-0x00007FF7E2860000-0x00007FF7E2C52000-memory.dmp	xmrig
behavioral2/memory/2280-296-0x00007FF7C6240000-0x00007FF7C6632000-memory.dmp	xmrig
behavioral2/memory/4148-295-0x00007FF72B3B0000-0x00007FF72B7A2000-memory.dmp	xmrig
behavioral2/memory/1596-293-0x00007FF77A220000-0x00007FF77A612000-memory.dmp	xmrig
behavioral2/memory/1724-292-0x00007FF66A510000-0x00007FF66A902000-memory.dmp	xmrig
behavioral2/memory/2888-291-0x00007FF6047B0000-0x00007FF604BA2000-memory.dmp	xmrig
behavioral2/memory/4496-289-0x00007FF682460000-0x00007FF682852000-memory.dmp	xmrig
behavioral2/memory/4792-288-0x00007FF7AC400000-0x00007FF7AC7F2000-memory.dmp	xmrig
behavioral2/memory/2620-287-0x00007FF736440000-0x00007FF736832000-memory.dmp	xmrig
behavioral2/memory/4300-286-0x00007FF669140000-0x00007FF669532000-memory.dmp	xmrig
behavioral2/memory/3896-285-0x00007FF7BA950000-0x00007FF7BAD42000-memory.dmp	xmrig
behavioral2/memory/5000-279-0x00007FF6FF810000-0x00007FF6FFC02000-memory.dmp	xmrig
behavioral2/memory/4136-252-0x00007FF72E280000-0x00007FF72E672000-memory.dmp	xmrig
behavioral2/memory/5032-224-0x00007FF6A3690000-0x00007FF6A3A82000-memory.dmp	xmrig
behavioral2/memory/1488-201-0x00007FF7E4010000-0x00007FF7E4402000-memory.dmp	xmrig
behavioral2/memory/1684-143-0x00007FF7477C0000-0x00007FF747BB2000-memory.dmp	xmrig
behavioral2/memory/3364-109-0x00007FF6C4BA0000-0x00007FF6C4F92000-memory.dmp	xmrig
behavioral2/memory/2280-4366-0x00007FF7C6240000-0x00007FF7C6632000-memory.dmp	xmrig
behavioral2/memory/3896-4450-0x00007FF7BA950000-0x00007FF7BAD42000-memory.dmp	xmrig
behavioral2/memory/4136-4423-0x00007FF72E280000-0x00007FF72E672000-memory.dmp	xmrig
behavioral2/memory/2864-4383-0x00007FF657AD0000-0x00007FF657EC2000-memory.dmp	xmrig
behavioral2/memory/3364-4372-0x00007FF6C4BA0000-0x00007FF6C4F92000-memory.dmp	xmrig
behavioral2/memory/1488-4363-0x00007FF7E4010000-0x00007FF7E4402000-memory.dmp	xmrig
behavioral2/memory/1684-4368-0x00007FF7477C0000-0x00007FF747BB2000-memory.dmp	xmrig
behavioral2/memory/2888-4474-0x00007FF6047B0000-0x00007FF604BA2000-memory.dmp	xmrig
behavioral2/memory/1596-4486-0x00007FF77A220000-0x00007FF77A612000-memory.dmp	xmrig
behavioral2/memory/5000-4483-0x00007FF6FF810000-0x00007FF6FFC02000-memory.dmp	xmrig
behavioral2/memory/4792-4503-0x00007FF7AC400000-0x00007FF7AC7F2000-memory.dmp	xmrig
behavioral2/memory/1840-4492-0x00007FF6E34E0000-0x00007FF6E38D2000-memory.dmp	xmrig
behavioral2/memory/1724-4491-0x00007FF66A510000-0x00007FF66A902000-memory.dmp	xmrig
behavioral2/memory/3084-4504-0x00007FF7E2860000-0x00007FF7E2C52000-memory.dmp	xmrig
behavioral2/memory/2620-4502-0x00007FF736440000-0x00007FF736832000-memory.dmp	xmrig
behavioral2/memory/4300-4516-0x00007FF669140000-0x00007FF669532000-memory.dmp	xmrig
behavioral2/memory/4496-4542-0x00007FF682460000-0x00007FF682852000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1008	zaRoGHI.exe
4148	pgGWeQO.exe
2280	mvluWAp.exe
3364	mtklcrk.exe
1684	NdjhBuo.exe
1488	rdnorxM.exe
5032	SmxAAFC.exe
4136	MAGnifT.exe
5096	SpnjkCh.exe
5000	LFYCRuM.exe
3896	VyABBre.exe
4300	FSteMTK.exe
2620	PpbTqxu.exe
4792	rvaSpFd.exe
4496	MiXhKMw.exe
2864	poPDPRL.exe
3084	NXDCrgz.exe
2888	rWpAqhg.exe
1724	ezOPelU.exe
1596	WWBqvMb.exe
1840	wexjzHS.exe
2588	bGCVkxv.exe
2476	ExbVuCp.exe
2036	ejkYizZ.exe
2204	zfpwQLQ.exe
4908	yXgbKUN.exe
2000	izgDVZR.exe
3940	BPBXXKN.exe
3664	BQcqaSR.exe
3020	qtuixsY.exe
1076	Lvbwzgy.exe
464	KXRDOkz.exe
1512	IksOXEu.exe
4620	jzTlMps.exe
2100	loAwKfR.exe
4916	hbSYERt.exe
4412	TXHZvrP.exe
1496	uDxOXlk.exe
4756	AopQkHA.exe
4568	jynwfne.exe
1044	ATjIjqC.exe
4048	xzMOQLe.exe
4152	czBzgmA.exe
4920	DjVqEcU.exe
3632	keOBVKf.exe
4360	Fochxdc.exe
3172	haSpzSn.exe
4840	mnoyNWo.exe
4260	zSNBAsP.exe
4292	JQafeZI.exe
3188	BZqgMQc.exe
1936	CKGgJwm.exe
3644	byVJnWl.exe
1808	rgNlJrU.exe
3928	WmBGUPR.exe
3772	eCCGeBp.exe
4820	GuaDDtp.exe
2304	cbhBmHd.exe
4904	kXQOdtS.exe
1664	gaUywRt.exe
2172	lkXzCiS.exe
3752	YaAVzGd.exe
3464	NqdHXVC.exe
4644	RDixZlJ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1696-0-0x00007FF7DCFB0000-0x00007FF7DD3A2000-memory.dmp	upx
behavioral2/files/0x000c000000023baa-5.dat	upx
behavioral2/files/0x000a000000023bac-8.dat	upx
behavioral2/files/0x000a000000023bad-31.dat	upx
behavioral2/files/0x000a000000023bb4-60.dat	upx
behavioral2/files/0x000a000000023baf-53.dat	upx
behavioral2/files/0x000a000000023bc1-105.dat	upx
behavioral2/files/0x000a000000023bc6-140.dat	upx
behavioral2/memory/5096-276-0x00007FF69E7E0000-0x00007FF69EBD2000-memory.dmp	upx
behavioral2/memory/2864-290-0x00007FF657AD0000-0x00007FF657EC2000-memory.dmp	upx
behavioral2/memory/1840-294-0x00007FF6E34E0000-0x00007FF6E38D2000-memory.dmp	upx
behavioral2/memory/3084-297-0x00007FF7E2860000-0x00007FF7E2C52000-memory.dmp	upx
behavioral2/memory/2280-296-0x00007FF7C6240000-0x00007FF7C6632000-memory.dmp	upx
behavioral2/memory/4148-295-0x00007FF72B3B0000-0x00007FF72B7A2000-memory.dmp	upx
behavioral2/memory/1596-293-0x00007FF77A220000-0x00007FF77A612000-memory.dmp	upx
behavioral2/memory/1724-292-0x00007FF66A510000-0x00007FF66A902000-memory.dmp	upx
behavioral2/memory/2888-291-0x00007FF6047B0000-0x00007FF604BA2000-memory.dmp	upx
behavioral2/memory/4496-289-0x00007FF682460000-0x00007FF682852000-memory.dmp	upx
behavioral2/memory/4792-288-0x00007FF7AC400000-0x00007FF7AC7F2000-memory.dmp	upx
behavioral2/memory/2620-287-0x00007FF736440000-0x00007FF736832000-memory.dmp	upx
behavioral2/memory/4300-286-0x00007FF669140000-0x00007FF669532000-memory.dmp	upx
behavioral2/memory/3896-285-0x00007FF7BA950000-0x00007FF7BAD42000-memory.dmp	upx
behavioral2/memory/5000-279-0x00007FF6FF810000-0x00007FF6FFC02000-memory.dmp	upx
behavioral2/memory/4136-252-0x00007FF72E280000-0x00007FF72E672000-memory.dmp	upx
behavioral2/memory/5032-224-0x00007FF6A3690000-0x00007FF6A3A82000-memory.dmp	upx
behavioral2/memory/1488-201-0x00007FF7E4010000-0x00007FF7E4402000-memory.dmp	upx
behavioral2/files/0x000a000000023bd0-196.dat	upx
behavioral2/files/0x000a000000023bcf-191.dat	upx
behavioral2/files/0x000a000000023bc5-190.dat	upx
behavioral2/files/0x000a000000023bce-189.dat	upx
behavioral2/files/0x000a000000023bcd-188.dat	upx
behavioral2/files/0x000a000000023bc0-183.dat	upx
behavioral2/files/0x0031000000023bbf-179.dat	upx
behavioral2/files/0x0031000000023bbe-176.dat	upx
behavioral2/files/0x000a000000023bca-175.dat	upx
behavioral2/files/0x000a000000023bc9-171.dat	upx
behavioral2/files/0x0031000000023bbd-166.dat	upx
behavioral2/files/0x000a000000023bc8-165.dat	upx
behavioral2/files/0x000a000000023bbc-160.dat	upx
behavioral2/files/0x000a000000023bc7-150.dat	upx
behavioral2/files/0x000a000000023bb5-149.dat	upx
behavioral2/files/0x000a000000023bbb-146.dat	upx
behavioral2/memory/1684-143-0x00007FF7477C0000-0x00007FF747BB2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb9-134.dat	upx
behavioral2/files/0x000a000000023bb6-157.dat	upx
behavioral2/files/0x000a000000023bc4-116.dat	upx
behavioral2/files/0x000a000000023bc3-115.dat	upx
behavioral2/files/0x000a000000023bc2-114.dat	upx
behavioral2/files/0x000a000000023bb1-85.dat	upx
behavioral2/memory/3364-109-0x00007FF6C4BA0000-0x00007FF6C4F92000-memory.dmp	upx
behavioral2/files/0x000a000000023bb8-126.dat	upx
behavioral2/files/0x000a000000023bb7-120.dat	upx
behavioral2/files/0x000a000000023bb3-119.dat	upx
behavioral2/files/0x000a000000023bb0-90.dat	upx
behavioral2/files/0x000a000000023bb2-87.dat	upx
behavioral2/files/0x000a000000023bba-77.dat	upx
behavioral2/files/0x000a000000023bae-50.dat	upx
behavioral2/files/0x000b000000023bab-22.dat	upx
behavioral2/memory/1008-18-0x00007FF69E870000-0x00007FF69EC62000-memory.dmp	upx
behavioral2/memory/2280-4366-0x00007FF7C6240000-0x00007FF7C6632000-memory.dmp	upx
behavioral2/memory/3896-4450-0x00007FF7BA950000-0x00007FF7BAD42000-memory.dmp	upx
behavioral2/memory/4136-4423-0x00007FF72E280000-0x00007FF72E672000-memory.dmp	upx
behavioral2/memory/2864-4383-0x00007FF657AD0000-0x00007FF657EC2000-memory.dmp	upx
behavioral2/memory/3364-4372-0x00007FF6C4BA0000-0x00007FF6C4F92000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xvbxOVA.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\PJETCSz.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\OLLvtdy.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\wKnQgeN.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\HxzbBsG.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\nlOXkmk.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\IQtBiZp.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\DdxorWd.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\avxildD.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\hndHvTO.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\MKNPHRx.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\idbUwzA.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\jDIlwYB.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\sQsROri.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\XsdvNin.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\lcoBsNP.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\ugSINRH.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\YLEDIWB.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\oPLqSVB.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\LUWOEgB.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\FeWAdac.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\YGQfFef.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\avOspjM.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\DdgqyJd.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\btCAoBV.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\qJCXKcb.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\kBFmCwY.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\QVaVIbU.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\uegCAES.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\EiTyJkB.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\zUkgTzC.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\xbMudgN.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\ZKNgLxV.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\nykDHEv.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\XAPvOoC.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\xpIfehx.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\xRnvIHq.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\fglnljW.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\SPLzoxk.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\CGMReFm.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\bHPJAHV.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\ANNMdib.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\CIqivSI.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\ZTwIqdm.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\TWwyCuF.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\OFKuZwL.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\fHpPFHy.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\xqzCIFf.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\LrCYmnM.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\vqGtDbM.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\pdajFQL.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\rLVivpN.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\MsAUIwL.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\BYSIdUP.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\VnXBfuk.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\LrFmhlP.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\sUvAsEC.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\HNZvEkG.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\PCVAYoQ.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\gomsNXq.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\fjNiUOv.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\qvsjwrM.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\WlMDtck.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
File created	C:\Windows\System\rLoeiDU.exe	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
584	powershell.exe
584	powershell.exe
584	powershell.exe
584	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
Token: SeDebugPrivilege	584	powershell.exe
Token: SeCreateGlobalPrivilege	14004	dwm.exe
Token: SeChangeNotifyPrivilege	14004	dwm.exe
Token: 33	14004	dwm.exe
Token: SeIncBasePriorityPrivilege	14004	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 584	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	86
PID 1696 wrote to memory of 584	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	86
PID 1696 wrote to memory of 1008	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	87
PID 1696 wrote to memory of 1008	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	87
PID 1696 wrote to memory of 4148	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	88
PID 1696 wrote to memory of 4148	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	88
PID 1696 wrote to memory of 2280	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	89
PID 1696 wrote to memory of 2280	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	89
PID 1696 wrote to memory of 3364	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	90
PID 1696 wrote to memory of 3364	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	90
PID 1696 wrote to memory of 1684	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	91
PID 1696 wrote to memory of 1684	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	91
PID 1696 wrote to memory of 1488	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	92
PID 1696 wrote to memory of 1488	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	92
PID 1696 wrote to memory of 5032	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	93
PID 1696 wrote to memory of 5032	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	93
PID 1696 wrote to memory of 4136	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	94
PID 1696 wrote to memory of 4136	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	94
PID 1696 wrote to memory of 5096	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	95
PID 1696 wrote to memory of 5096	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	95
PID 1696 wrote to memory of 5000	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	96
PID 1696 wrote to memory of 5000	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	96
PID 1696 wrote to memory of 3896	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	97
PID 1696 wrote to memory of 3896	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	97
PID 1696 wrote to memory of 2888	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	98
PID 1696 wrote to memory of 2888	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	98
PID 1696 wrote to memory of 4300	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	99
PID 1696 wrote to memory of 4300	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	99
PID 1696 wrote to memory of 2620	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	100
PID 1696 wrote to memory of 2620	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	100
PID 1696 wrote to memory of 4792	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	101
PID 1696 wrote to memory of 4792	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	101
PID 1696 wrote to memory of 4496	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	102
PID 1696 wrote to memory of 4496	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	102
PID 1696 wrote to memory of 2864	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	103
PID 1696 wrote to memory of 2864	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	103
PID 1696 wrote to memory of 3084	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	104
PID 1696 wrote to memory of 3084	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	104
PID 1696 wrote to memory of 1724	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	105
PID 1696 wrote to memory of 1724	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	105
PID 1696 wrote to memory of 1596	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	106
PID 1696 wrote to memory of 1596	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	106
PID 1696 wrote to memory of 1840	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	107
PID 1696 wrote to memory of 1840	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	107
PID 1696 wrote to memory of 2588	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	108
PID 1696 wrote to memory of 2588	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	108
PID 1696 wrote to memory of 2476	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	109
PID 1696 wrote to memory of 2476	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	109
PID 1696 wrote to memory of 2036	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	110
PID 1696 wrote to memory of 2036	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	110
PID 1696 wrote to memory of 2204	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	111
PID 1696 wrote to memory of 2204	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	111
PID 1696 wrote to memory of 4908	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	112
PID 1696 wrote to memory of 4908	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	112
PID 1696 wrote to memory of 2000	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	113
PID 1696 wrote to memory of 2000	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	113
PID 1696 wrote to memory of 2100	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	114
PID 1696 wrote to memory of 2100	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	114
PID 1696 wrote to memory of 3940	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	115
PID 1696 wrote to memory of 3940	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	115
PID 1696 wrote to memory of 3664	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	116
PID 1696 wrote to memory of 3664	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	116
PID 1696 wrote to memory of 3020	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	117
PID 1696 wrote to memory of 3020	1696	097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe	117

C:\Users\Admin\AppData\Local\Temp\097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\097a89dd4e8c54f94904e9858f2f4d42_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:584
- C:\Windows\System\zaRoGHI.exe
  C:\Windows\System\zaRoGHI.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\pgGWeQO.exe
  C:\Windows\System\pgGWeQO.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\mvluWAp.exe
  C:\Windows\System\mvluWAp.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\mtklcrk.exe
  C:\Windows\System\mtklcrk.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\NdjhBuo.exe
  C:\Windows\System\NdjhBuo.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\rdnorxM.exe
  C:\Windows\System\rdnorxM.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\SmxAAFC.exe
  C:\Windows\System\SmxAAFC.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\MAGnifT.exe
  C:\Windows\System\MAGnifT.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\SpnjkCh.exe
  C:\Windows\System\SpnjkCh.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\LFYCRuM.exe
  C:\Windows\System\LFYCRuM.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\VyABBre.exe
  C:\Windows\System\VyABBre.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\rWpAqhg.exe
  C:\Windows\System\rWpAqhg.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\FSteMTK.exe
  C:\Windows\System\FSteMTK.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\PpbTqxu.exe
  C:\Windows\System\PpbTqxu.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\rvaSpFd.exe
  C:\Windows\System\rvaSpFd.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\MiXhKMw.exe
  C:\Windows\System\MiXhKMw.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\poPDPRL.exe
  C:\Windows\System\poPDPRL.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\NXDCrgz.exe
  C:\Windows\System\NXDCrgz.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\ezOPelU.exe
  C:\Windows\System\ezOPelU.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\WWBqvMb.exe
  C:\Windows\System\WWBqvMb.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\wexjzHS.exe
  C:\Windows\System\wexjzHS.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\bGCVkxv.exe
  C:\Windows\System\bGCVkxv.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\ExbVuCp.exe
  C:\Windows\System\ExbVuCp.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\ejkYizZ.exe
  C:\Windows\System\ejkYizZ.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\zfpwQLQ.exe
  C:\Windows\System\zfpwQLQ.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\yXgbKUN.exe
  C:\Windows\System\yXgbKUN.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\izgDVZR.exe
  C:\Windows\System\izgDVZR.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\loAwKfR.exe
  C:\Windows\System\loAwKfR.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\BPBXXKN.exe
  C:\Windows\System\BPBXXKN.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\BQcqaSR.exe
  C:\Windows\System\BQcqaSR.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\qtuixsY.exe
  C:\Windows\System\qtuixsY.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\Lvbwzgy.exe
  C:\Windows\System\Lvbwzgy.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\KXRDOkz.exe
  C:\Windows\System\KXRDOkz.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\IksOXEu.exe
  C:\Windows\System\IksOXEu.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\jzTlMps.exe
  C:\Windows\System\jzTlMps.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\hbSYERt.exe
  C:\Windows\System\hbSYERt.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\TXHZvrP.exe
  C:\Windows\System\TXHZvrP.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\uDxOXlk.exe
  C:\Windows\System\uDxOXlk.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\AopQkHA.exe
  C:\Windows\System\AopQkHA.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\jynwfne.exe
  C:\Windows\System\jynwfne.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\ATjIjqC.exe
  C:\Windows\System\ATjIjqC.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\xzMOQLe.exe
  C:\Windows\System\xzMOQLe.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\czBzgmA.exe
  C:\Windows\System\czBzgmA.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\DjVqEcU.exe
  C:\Windows\System\DjVqEcU.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\keOBVKf.exe
  C:\Windows\System\keOBVKf.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\Fochxdc.exe
  C:\Windows\System\Fochxdc.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\haSpzSn.exe
  C:\Windows\System\haSpzSn.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\mnoyNWo.exe
  C:\Windows\System\mnoyNWo.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\zSNBAsP.exe
  C:\Windows\System\zSNBAsP.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\JQafeZI.exe
  C:\Windows\System\JQafeZI.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\BZqgMQc.exe
  C:\Windows\System\BZqgMQc.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\CKGgJwm.exe
  C:\Windows\System\CKGgJwm.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\byVJnWl.exe
  C:\Windows\System\byVJnWl.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\rgNlJrU.exe
  C:\Windows\System\rgNlJrU.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\WmBGUPR.exe
  C:\Windows\System\WmBGUPR.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\eCCGeBp.exe
  C:\Windows\System\eCCGeBp.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\GuaDDtp.exe
  C:\Windows\System\GuaDDtp.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\cbhBmHd.exe
  C:\Windows\System\cbhBmHd.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\kXQOdtS.exe
  C:\Windows\System\kXQOdtS.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\gaUywRt.exe
  C:\Windows\System\gaUywRt.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\lkXzCiS.exe
  C:\Windows\System\lkXzCiS.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\YaAVzGd.exe
  C:\Windows\System\YaAVzGd.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\FGzDwHH.exe
  C:\Windows\System\FGzDwHH.exe
  2⤵
  PID:4068
- C:\Windows\System\NqdHXVC.exe
  C:\Windows\System\NqdHXVC.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\RDixZlJ.exe
  C:\Windows\System\RDixZlJ.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\aqqExmg.exe
  C:\Windows\System\aqqExmg.exe
  2⤵
  PID:4232
- C:\Windows\System\MOwTUlI.exe
  C:\Windows\System\MOwTUlI.exe
  2⤵
  PID:5212
- C:\Windows\System\BIohPKG.exe
  C:\Windows\System\BIohPKG.exe
  2⤵
  PID:5228
- C:\Windows\System\kidLxxT.exe
  C:\Windows\System\kidLxxT.exe
  2⤵
  PID:5248
- C:\Windows\System\rvDueRM.exe
  C:\Windows\System\rvDueRM.exe
  2⤵
  PID:5276
- C:\Windows\System\xPxRzeM.exe
  C:\Windows\System\xPxRzeM.exe
  2⤵
  PID:5296
- C:\Windows\System\TlOuggG.exe
  C:\Windows\System\TlOuggG.exe
  2⤵
  PID:5348
- C:\Windows\System\TbSIeaU.exe
  C:\Windows\System\TbSIeaU.exe
  2⤵
  PID:5376
- C:\Windows\System\jhJGZdn.exe
  C:\Windows\System\jhJGZdn.exe
  2⤵
  PID:5540
- C:\Windows\System\BDNOPnn.exe
  C:\Windows\System\BDNOPnn.exe
  2⤵
  PID:5564
- C:\Windows\System\raAxcWH.exe
  C:\Windows\System\raAxcWH.exe
  2⤵
  PID:5588
- C:\Windows\System\WVLyAoN.exe
  C:\Windows\System\WVLyAoN.exe
  2⤵
  PID:5612
- C:\Windows\System\oSYtMBO.exe
  C:\Windows\System\oSYtMBO.exe
  2⤵
  PID:5872
- C:\Windows\System\yGIIqlS.exe
  C:\Windows\System\yGIIqlS.exe
  2⤵
  PID:5888
- C:\Windows\System\AQeCClK.exe
  C:\Windows\System\AQeCClK.exe
  2⤵
  PID:5908
- C:\Windows\System\INOKiHN.exe
  C:\Windows\System\INOKiHN.exe
  2⤵
  PID:5924
- C:\Windows\System\iZzvEvb.exe
  C:\Windows\System\iZzvEvb.exe
  2⤵
  PID:5948
- C:\Windows\System\tgTBFFQ.exe
  C:\Windows\System\tgTBFFQ.exe
  2⤵
  PID:5972
- C:\Windows\System\oeFzwNv.exe
  C:\Windows\System\oeFzwNv.exe
  2⤵
  PID:5996
- C:\Windows\System\mqCfElL.exe
  C:\Windows\System\mqCfElL.exe
  2⤵
  PID:6016
- C:\Windows\System\VTcyXNS.exe
  C:\Windows\System\VTcyXNS.exe
  2⤵
  PID:6040
- C:\Windows\System\eiSJecV.exe
  C:\Windows\System\eiSJecV.exe
  2⤵
  PID:6072
- C:\Windows\System\wYgTiVb.exe
  C:\Windows\System\wYgTiVb.exe
  2⤵
  PID:6096
- C:\Windows\System\FpzEfnY.exe
  C:\Windows\System\FpzEfnY.exe
  2⤵
  PID:6116
- C:\Windows\System\YEHbZRr.exe
  C:\Windows\System\YEHbZRr.exe
  2⤵
  PID:6140
- C:\Windows\System\LGFkLaG.exe
  C:\Windows\System\LGFkLaG.exe
  2⤵
  PID:2412
- C:\Windows\System\sQdqWOe.exe
  C:\Windows\System\sQdqWOe.exe
  2⤵
  PID:4988
- C:\Windows\System\uNvDtLC.exe
  C:\Windows\System\uNvDtLC.exe
  2⤵
  PID:3484
- C:\Windows\System\NlocJDD.exe
  C:\Windows\System\NlocJDD.exe
  2⤵
  PID:3468
- C:\Windows\System\QMlzWQi.exe
  C:\Windows\System\QMlzWQi.exe
  2⤵
  PID:4788
- C:\Windows\System\WLFfgNK.exe
  C:\Windows\System\WLFfgNK.exe
  2⤵
  PID:3016
- C:\Windows\System\RaYrXtP.exe
  C:\Windows\System\RaYrXtP.exe
  2⤵
  PID:3700
- C:\Windows\System\XYrModf.exe
  C:\Windows\System\XYrModf.exe
  2⤵
  PID:2552
- C:\Windows\System\bAsTBxb.exe
  C:\Windows\System\bAsTBxb.exe
  2⤵
  PID:2820
- C:\Windows\System\ZSsPFeS.exe
  C:\Windows\System\ZSsPFeS.exe
  2⤵
  PID:3052
- C:\Windows\System\vkRlgfD.exe
  C:\Windows\System\vkRlgfD.exe
  2⤵
  PID:4860
- C:\Windows\System\kJGUYvG.exe
  C:\Windows\System\kJGUYvG.exe
  2⤵
  PID:5184
- C:\Windows\System\WIdSrwz.exe
  C:\Windows\System\WIdSrwz.exe
  2⤵
  PID:5356
- C:\Windows\System\ABVosjq.exe
  C:\Windows\System\ABVosjq.exe
  2⤵
  PID:5224
- C:\Windows\System\bjGGCxG.exe
  C:\Windows\System\bjGGCxG.exe
  2⤵
  PID:5312
- C:\Windows\System\WezoUnm.exe
  C:\Windows\System\WezoUnm.exe
  2⤵
  PID:5484
- C:\Windows\System\Fkaenzi.exe
  C:\Windows\System\Fkaenzi.exe
  2⤵
  PID:5516
- C:\Windows\System\TqfBjqY.exe
  C:\Windows\System\TqfBjqY.exe
  2⤵
  PID:5572
- C:\Windows\System\IaDhYpl.exe
  C:\Windows\System\IaDhYpl.exe
  2⤵
  PID:5620
- C:\Windows\System\BgFYHxV.exe
  C:\Windows\System\BgFYHxV.exe
  2⤵
  PID:5720
- C:\Windows\System\OzcTWcn.exe
  C:\Windows\System\OzcTWcn.exe
  2⤵
  PID:5788
- C:\Windows\System\eMoymJb.exe
  C:\Windows\System\eMoymJb.exe
  2⤵
  PID:4368
- C:\Windows\System\jQRTJAX.exe
  C:\Windows\System\jQRTJAX.exe
  2⤵
  PID:736
- C:\Windows\System\sIJgaeX.exe
  C:\Windows\System\sIJgaeX.exe
  2⤵
  PID:1424
- C:\Windows\System\HIiidTI.exe
  C:\Windows\System\HIiidTI.exe
  2⤵
  PID:4196
- C:\Windows\System\pyEMZTd.exe
  C:\Windows\System\pyEMZTd.exe
  2⤵
  PID:2720
- C:\Windows\System\hJnrlln.exe
  C:\Windows\System\hJnrlln.exe
  2⤵
  PID:4552
- C:\Windows\System\ZiAGXgW.exe
  C:\Windows\System\ZiAGXgW.exe
  2⤵
  PID:2160
- C:\Windows\System\TeQboZV.exe
  C:\Windows\System\TeQboZV.exe
  2⤵
  PID:3392
- C:\Windows\System\eNoNRNH.exe
  C:\Windows\System\eNoNRNH.exe
  2⤵
  PID:4724
- C:\Windows\System\gjkZqAt.exe
  C:\Windows\System\gjkZqAt.exe
  2⤵
  PID:3408
- C:\Windows\System\WHknOFd.exe
  C:\Windows\System\WHknOFd.exe
  2⤵
  PID:3504
- C:\Windows\System\ORvVvbQ.exe
  C:\Windows\System\ORvVvbQ.exe
  2⤵
  PID:5308
- C:\Windows\System\uqBwwXi.exe
  C:\Windows\System\uqBwwXi.exe
  2⤵
  PID:4004
- C:\Windows\System\lsgXzeP.exe
  C:\Windows\System\lsgXzeP.exe
  2⤵
  PID:5432
- C:\Windows\System\LyfHqqn.exe
  C:\Windows\System\LyfHqqn.exe
  2⤵
  PID:5464
- C:\Windows\System\HqAwLoo.exe
  C:\Windows\System\HqAwLoo.exe
  2⤵
  PID:5904
- C:\Windows\System\wrjpyTX.exe
  C:\Windows\System\wrjpyTX.exe
  2⤵
  PID:5992
- C:\Windows\System\lOCMEzL.exe
  C:\Windows\System\lOCMEzL.exe
  2⤵
  PID:5964
- C:\Windows\System\TUneNCw.exe
  C:\Windows\System\TUneNCw.exe
  2⤵
  PID:6080
- C:\Windows\System\BlYQUoP.exe
  C:\Windows\System\BlYQUoP.exe
  2⤵
  PID:6112
- C:\Windows\System\dwsDrxN.exe
  C:\Windows\System\dwsDrxN.exe
  2⤵
  PID:2664
- C:\Windows\System\jHwJPqN.exe
  C:\Windows\System\jHwJPqN.exe
  2⤵
  PID:4132
- C:\Windows\System\NqeIxYE.exe
  C:\Windows\System\NqeIxYE.exe
  2⤵
  PID:4224
- C:\Windows\System\WGdgCTj.exe
  C:\Windows\System\WGdgCTj.exe
  2⤵
  PID:3332
- C:\Windows\System\CeOqzjF.exe
  C:\Windows\System\CeOqzjF.exe
  2⤵
  PID:4720
- C:\Windows\System\tKAHZoE.exe
  C:\Windows\System\tKAHZoE.exe
  2⤵
  PID:5932
- C:\Windows\System\oTwWKBF.exe
  C:\Windows\System\oTwWKBF.exe
  2⤵
  PID:1484
- C:\Windows\System\CUCvHdG.exe
  C:\Windows\System\CUCvHdG.exe
  2⤵
  PID:1928
- C:\Windows\System\mUKVnrg.exe
  C:\Windows\System\mUKVnrg.exe
  2⤵
  PID:5052
- C:\Windows\System\MKWDJym.exe
  C:\Windows\System\MKWDJym.exe
  2⤵
  PID:1860
- C:\Windows\System\wcwSWAo.exe
  C:\Windows\System\wcwSWAo.exe
  2⤵
  PID:5556
- C:\Windows\System\gkQNzQJ.exe
  C:\Windows\System\gkQNzQJ.exe
  2⤵
  PID:3456
- C:\Windows\System\YpeQcJT.exe
  C:\Windows\System\YpeQcJT.exe
  2⤵
  PID:3476
- C:\Windows\System\pDDIthP.exe
  C:\Windows\System\pDDIthP.exe
  2⤵
  PID:3416
- C:\Windows\System\vYMxHHD.exe
  C:\Windows\System\vYMxHHD.exe
  2⤵
  PID:2996
- C:\Windows\System\hkqzlvo.exe
  C:\Windows\System\hkqzlvo.exe
  2⤵
  PID:4228
- C:\Windows\System\wbxiOZB.exe
  C:\Windows\System\wbxiOZB.exe
  2⤵
  PID:2444
- C:\Windows\System\odkjcev.exe
  C:\Windows\System\odkjcev.exe
  2⤵
  PID:4524
- C:\Windows\System\VFYWDIz.exe
  C:\Windows\System\VFYWDIz.exe
  2⤵
  PID:6064
- C:\Windows\System\xORAPRx.exe
  C:\Windows\System\xORAPRx.exe
  2⤵
  PID:2484
- C:\Windows\System\rJAGIRV.exe
  C:\Windows\System\rJAGIRV.exe
  2⤵
  PID:5456
- C:\Windows\System\aZQbffh.exe
  C:\Windows\System\aZQbffh.exe
  2⤵
  PID:1564
- C:\Windows\System\KvkQaXw.exe
  C:\Windows\System\KvkQaXw.exe
  2⤵
  PID:1040
- C:\Windows\System\lQIKLBl.exe
  C:\Windows\System\lQIKLBl.exe
  2⤵
  PID:5244
- C:\Windows\System\dDyeWYc.exe
  C:\Windows\System\dDyeWYc.exe
  2⤵
  PID:6152
- C:\Windows\System\knCrRef.exe
  C:\Windows\System\knCrRef.exe
  2⤵
  PID:6172
- C:\Windows\System\cgHAUnq.exe
  C:\Windows\System\cgHAUnq.exe
  2⤵
  PID:6192
- C:\Windows\System\jdrncPJ.exe
  C:\Windows\System\jdrncPJ.exe
  2⤵
  PID:6212
- C:\Windows\System\pkgrQgB.exe
  C:\Windows\System\pkgrQgB.exe
  2⤵
  PID:6240
- C:\Windows\System\axxaoAY.exe
  C:\Windows\System\axxaoAY.exe
  2⤵
  PID:6260
- C:\Windows\System\msOmwjf.exe
  C:\Windows\System\msOmwjf.exe
  2⤵
  PID:6280
- C:\Windows\System\asHtUTB.exe
  C:\Windows\System\asHtUTB.exe
  2⤵
  PID:6308
- C:\Windows\System\KnVBHOH.exe
  C:\Windows\System\KnVBHOH.exe
  2⤵
  PID:6324
- C:\Windows\System\yoVOXUj.exe
  C:\Windows\System\yoVOXUj.exe
  2⤵
  PID:6344
- C:\Windows\System\DBeVeNq.exe
  C:\Windows\System\DBeVeNq.exe
  2⤵
  PID:6372
- C:\Windows\System\aNROvcy.exe
  C:\Windows\System\aNROvcy.exe
  2⤵
  PID:6388
- C:\Windows\System\lcsYKRY.exe
  C:\Windows\System\lcsYKRY.exe
  2⤵
  PID:6416
- C:\Windows\System\sdsPkga.exe
  C:\Windows\System\sdsPkga.exe
  2⤵
  PID:6440
- C:\Windows\System\HpGrDMB.exe
  C:\Windows\System\HpGrDMB.exe
  2⤵
  PID:6456
- C:\Windows\System\plVyMdj.exe
  C:\Windows\System\plVyMdj.exe
  2⤵
  PID:6484
- C:\Windows\System\cPEeWCx.exe
  C:\Windows\System\cPEeWCx.exe
  2⤵
  PID:6508
- C:\Windows\System\jusDkGa.exe
  C:\Windows\System\jusDkGa.exe
  2⤵
  PID:6528
- C:\Windows\System\sBJaisf.exe
  C:\Windows\System\sBJaisf.exe
  2⤵
  PID:6552
- C:\Windows\System\ddCzNlJ.exe
  C:\Windows\System\ddCzNlJ.exe
  2⤵
  PID:6576
- C:\Windows\System\aWsKJRO.exe
  C:\Windows\System\aWsKJRO.exe
  2⤵
  PID:6600
- C:\Windows\System\afcoWvl.exe
  C:\Windows\System\afcoWvl.exe
  2⤵
  PID:6620
- C:\Windows\System\XwZKQNG.exe
  C:\Windows\System\XwZKQNG.exe
  2⤵
  PID:6648
- C:\Windows\System\cOPJofv.exe
  C:\Windows\System\cOPJofv.exe
  2⤵
  PID:6672
- C:\Windows\System\KdIfAtp.exe
  C:\Windows\System\KdIfAtp.exe
  2⤵
  PID:6696
- C:\Windows\System\HdlKhix.exe
  C:\Windows\System\HdlKhix.exe
  2⤵
  PID:6720
- C:\Windows\System\GFCGkyi.exe
  C:\Windows\System\GFCGkyi.exe
  2⤵
  PID:6740
- C:\Windows\System\mZXPpCR.exe
  C:\Windows\System\mZXPpCR.exe
  2⤵
  PID:6760
- C:\Windows\System\XUMZqbE.exe
  C:\Windows\System\XUMZqbE.exe
  2⤵
  PID:6784
- C:\Windows\System\kJRtaMT.exe
  C:\Windows\System\kJRtaMT.exe
  2⤵
  PID:6800
- C:\Windows\System\QyhCUTI.exe
  C:\Windows\System\QyhCUTI.exe
  2⤵
  PID:6828
- C:\Windows\System\reSpcjl.exe
  C:\Windows\System\reSpcjl.exe
  2⤵
  PID:6852
- C:\Windows\System\KvJqoUp.exe
  C:\Windows\System\KvJqoUp.exe
  2⤵
  PID:6872
- C:\Windows\System\cDizOfD.exe
  C:\Windows\System\cDizOfD.exe
  2⤵
  PID:6896
- C:\Windows\System\ADaFhib.exe
  C:\Windows\System\ADaFhib.exe
  2⤵
  PID:6916
- C:\Windows\System\vzHfXpC.exe
  C:\Windows\System\vzHfXpC.exe
  2⤵
  PID:6936
- C:\Windows\System\fyjzGTY.exe
  C:\Windows\System\fyjzGTY.exe
  2⤵
  PID:6964
- C:\Windows\System\vrFqDNH.exe
  C:\Windows\System\vrFqDNH.exe
  2⤵
  PID:6980
- C:\Windows\System\kGRBcnQ.exe
  C:\Windows\System\kGRBcnQ.exe
  2⤵
  PID:7008
- C:\Windows\System\evhbaFF.exe
  C:\Windows\System\evhbaFF.exe
  2⤵
  PID:7028
- C:\Windows\System\cJjVunp.exe
  C:\Windows\System\cJjVunp.exe
  2⤵
  PID:7052
- C:\Windows\System\vfEAjJy.exe
  C:\Windows\System\vfEAjJy.exe
  2⤵
  PID:7076
- C:\Windows\System\dmnUVkW.exe
  C:\Windows\System\dmnUVkW.exe
  2⤵
  PID:7092
- C:\Windows\System\lGUmyfw.exe
  C:\Windows\System\lGUmyfw.exe
  2⤵
  PID:7124
- C:\Windows\System\pDUfVAO.exe
  C:\Windows\System\pDUfVAO.exe
  2⤵
  PID:7152
- C:\Windows\System\RPKBkTd.exe
  C:\Windows\System\RPKBkTd.exe
  2⤵
  PID:5012
- C:\Windows\System\xeYEaDN.exe
  C:\Windows\System\xeYEaDN.exe
  2⤵
  PID:5816
- C:\Windows\System\HYlxyEZ.exe
  C:\Windows\System\HYlxyEZ.exe
  2⤵
  PID:6008
- C:\Windows\System\mHLAmYV.exe
  C:\Windows\System\mHLAmYV.exe
  2⤵
  PID:5960
- C:\Windows\System\iwmdoun.exe
  C:\Windows\System\iwmdoun.exe
  2⤵
  PID:5256
- C:\Windows\System\iQQlJXv.exe
  C:\Windows\System\iQQlJXv.exe
  2⤵
  PID:6232
- C:\Windows\System\AbENpzB.exe
  C:\Windows\System\AbENpzB.exe
  2⤵
  PID:3144
- C:\Windows\System\JOTmJiY.exe
  C:\Windows\System\JOTmJiY.exe
  2⤵
  PID:424
- C:\Windows\System\xPAwYvP.exe
  C:\Windows\System\xPAwYvP.exe
  2⤵
  PID:4268
- C:\Windows\System\tlDrERB.exe
  C:\Windows\System\tlDrERB.exe
  2⤵
  PID:6432
- C:\Windows\System\opqnvez.exe
  C:\Windows\System\opqnvez.exe
  2⤵
  PID:5420
- C:\Windows\System\yCjsQGP.exe
  C:\Windows\System\yCjsQGP.exe
  2⤵
  PID:6520
- C:\Windows\System\rcjMdId.exe
  C:\Windows\System\rcjMdId.exe
  2⤵
  PID:3356
- C:\Windows\System\ydwNqQK.exe
  C:\Windows\System\ydwNqQK.exe
  2⤵
  PID:6276
- C:\Windows\System\vjCxDCC.exe
  C:\Windows\System\vjCxDCC.exe
  2⤵
  PID:6716
- C:\Windows\System\ylGKNOh.exe
  C:\Windows\System\ylGKNOh.exe
  2⤵
  PID:6752
- C:\Windows\System\RnZBjyE.exe
  C:\Windows\System\RnZBjyE.exe
  2⤵
  PID:6808
- C:\Windows\System\IHJSayl.exe
  C:\Windows\System\IHJSayl.exe
  2⤵
  PID:6864
- C:\Windows\System\SxUoBSv.exe
  C:\Windows\System\SxUoBSv.exe
  2⤵
  PID:6976
- C:\Windows\System\gONUCdG.exe
  C:\Windows\System\gONUCdG.exe
  2⤵
  PID:6564
- C:\Windows\System\mkbUrSO.exe
  C:\Windows\System\mkbUrSO.exe
  2⤵
  PID:6168
- C:\Windows\System\UIxbjfS.exe
  C:\Windows\System\UIxbjfS.exe
  2⤵
  PID:4980
- C:\Windows\System\QjlJdSZ.exe
  C:\Windows\System\QjlJdSZ.exe
  2⤵
  PID:6612
- C:\Windows\System\MrYEhlv.exe
  C:\Windows\System\MrYEhlv.exe
  2⤵
  PID:6660
- C:\Windows\System\tjJPlMC.exe
  C:\Windows\System\tjJPlMC.exe
  2⤵
  PID:2140
- C:\Windows\System\dDLuKrS.exe
  C:\Windows\System\dDLuKrS.exe
  2⤵
  PID:3584
- C:\Windows\System\ptfTNvz.exe
  C:\Windows\System\ptfTNvz.exe
  2⤵
  PID:7184
- C:\Windows\System\SmByVTe.exe
  C:\Windows\System\SmByVTe.exe
  2⤵
  PID:7208
- C:\Windows\System\ZcpTQwC.exe
  C:\Windows\System\ZcpTQwC.exe
  2⤵
  PID:7224
- C:\Windows\System\YyWgHui.exe
  C:\Windows\System\YyWgHui.exe
  2⤵
  PID:7244
- C:\Windows\System\wRrRKwL.exe
  C:\Windows\System\wRrRKwL.exe
  2⤵
  PID:7264
- C:\Windows\System\uqNhLYt.exe
  C:\Windows\System\uqNhLYt.exe
  2⤵
  PID:7284
- C:\Windows\System\oFRubWs.exe
  C:\Windows\System\oFRubWs.exe
  2⤵
  PID:7308
- C:\Windows\System\cnXnwvM.exe
  C:\Windows\System\cnXnwvM.exe
  2⤵
  PID:7324
- C:\Windows\System\SqsCARf.exe
  C:\Windows\System\SqsCARf.exe
  2⤵
  PID:7348
- C:\Windows\System\AxtHRDI.exe
  C:\Windows\System\AxtHRDI.exe
  2⤵
  PID:7372
- C:\Windows\System\HJPJnZO.exe
  C:\Windows\System\HJPJnZO.exe
  2⤵
  PID:7396
- C:\Windows\System\NMQCweK.exe
  C:\Windows\System\NMQCweK.exe
  2⤵
  PID:7416
- C:\Windows\System\OxQeViH.exe
  C:\Windows\System\OxQeViH.exe
  2⤵
  PID:7440
- C:\Windows\System\fqGCmPk.exe
  C:\Windows\System\fqGCmPk.exe
  2⤵
  PID:7460
- C:\Windows\System\fAmYvfz.exe
  C:\Windows\System\fAmYvfz.exe
  2⤵
  PID:7484
- C:\Windows\System\vfmIouI.exe
  C:\Windows\System\vfmIouI.exe
  2⤵
  PID:7504
- C:\Windows\System\xIdBqmK.exe
  C:\Windows\System\xIdBqmK.exe
  2⤵
  PID:7532
- C:\Windows\System\dMJwovu.exe
  C:\Windows\System\dMJwovu.exe
  2⤵
  PID:7556
- C:\Windows\System\mAdJoFZ.exe
  C:\Windows\System\mAdJoFZ.exe
  2⤵
  PID:7584
- C:\Windows\System\BWcYmev.exe
  C:\Windows\System\BWcYmev.exe
  2⤵
  PID:7612
- C:\Windows\System\OkImJzH.exe
  C:\Windows\System\OkImJzH.exe
  2⤵
  PID:7632
- C:\Windows\System\saIxtXg.exe
  C:\Windows\System\saIxtXg.exe
  2⤵
  PID:7656
- C:\Windows\System\GlEQSzH.exe
  C:\Windows\System\GlEQSzH.exe
  2⤵
  PID:7676
- C:\Windows\System\SJjqEUi.exe
  C:\Windows\System\SJjqEUi.exe
  2⤵
  PID:7696
- C:\Windows\System\hcPWzVx.exe
  C:\Windows\System\hcPWzVx.exe
  2⤵
  PID:7720
- C:\Windows\System\IewtUyw.exe
  C:\Windows\System\IewtUyw.exe
  2⤵
  PID:7744
- C:\Windows\System\sWJEbna.exe
  C:\Windows\System\sWJEbna.exe
  2⤵
  PID:7764
- C:\Windows\System\YHQpESr.exe
  C:\Windows\System\YHQpESr.exe
  2⤵
  PID:7784
- C:\Windows\System\aeyxqNN.exe
  C:\Windows\System\aeyxqNN.exe
  2⤵
  PID:7808
- C:\Windows\System\rCcqtkf.exe
  C:\Windows\System\rCcqtkf.exe
  2⤵
  PID:7828
- C:\Windows\System\XxfqCmP.exe
  C:\Windows\System\XxfqCmP.exe
  2⤵
  PID:7852
- C:\Windows\System\VkooNaL.exe
  C:\Windows\System\VkooNaL.exe
  2⤵
  PID:7872
- C:\Windows\System\QZYqyku.exe
  C:\Windows\System\QZYqyku.exe
  2⤵
  PID:7892
- C:\Windows\System\lwRBuRn.exe
  C:\Windows\System\lwRBuRn.exe
  2⤵
  PID:7924
- C:\Windows\System\CHZLBdO.exe
  C:\Windows\System\CHZLBdO.exe
  2⤵
  PID:7944
- C:\Windows\System\gQwDEXp.exe
  C:\Windows\System\gQwDEXp.exe
  2⤵
  PID:7968
- C:\Windows\System\PViOdfx.exe
  C:\Windows\System\PViOdfx.exe
  2⤵
  PID:7992
- C:\Windows\System\MnPkwWP.exe
  C:\Windows\System\MnPkwWP.exe
  2⤵
  PID:8016
- C:\Windows\System\QiDKfNs.exe
  C:\Windows\System\QiDKfNs.exe
  2⤵
  PID:8036
- C:\Windows\System\iEGVkDh.exe
  C:\Windows\System\iEGVkDh.exe
  2⤵
  PID:8064
- C:\Windows\System\zxVcehH.exe
  C:\Windows\System\zxVcehH.exe
  2⤵
  PID:8092
- C:\Windows\System\VtvatoM.exe
  C:\Windows\System\VtvatoM.exe
  2⤵
  PID:8116
- C:\Windows\System\LhrLKgv.exe
  C:\Windows\System\LhrLKgv.exe
  2⤵
  PID:8144
- C:\Windows\System\Weiznub.exe
  C:\Windows\System\Weiznub.exe
  2⤵
  PID:8164
- C:\Windows\System\WLGbSJv.exe
  C:\Windows\System\WLGbSJv.exe
  2⤵
  PID:8184
- C:\Windows\System\xqtavAb.exe
  C:\Windows\System\xqtavAb.exe
  2⤵
  PID:6464
- C:\Windows\System\zNsQLwQ.exe
  C:\Windows\System\zNsQLwQ.exe
  2⤵
  PID:7072
- C:\Windows\System\KvTdkEP.exe
  C:\Windows\System\KvTdkEP.exe
  2⤵
  PID:2420
- C:\Windows\System\UZOXELB.exe
  C:\Windows\System\UZOXELB.exe
  2⤵
  PID:6796
- C:\Windows\System\vHtAKCv.exe
  C:\Windows\System\vHtAKCv.exe
  2⤵
  PID:6592
- C:\Windows\System\hDLqNXr.exe
  C:\Windows\System\hDLqNXr.exe
  2⤵
  PID:6684
- C:\Windows\System\efWymmp.exe
  C:\Windows\System\efWymmp.exe
  2⤵
  PID:6824
- C:\Windows\System\jJHBMvp.exe
  C:\Windows\System\jJHBMvp.exe
  2⤵
  PID:7192
- C:\Windows\System\tZpGbEB.exe
  C:\Windows\System\tZpGbEB.exe
  2⤵
  PID:6220
- C:\Windows\System\iiIZPBc.exe
  C:\Windows\System\iiIZPBc.exe
  2⤵
  PID:7252
- C:\Windows\System\SGTwTEV.exe
  C:\Windows\System\SGTwTEV.exe
  2⤵
  PID:2776
- C:\Windows\System\UeWTVAt.exe
  C:\Windows\System\UeWTVAt.exe
  2⤵
  PID:7344
- C:\Windows\System\ekAleCa.exe
  C:\Windows\System\ekAleCa.exe
  2⤵
  PID:7408
- C:\Windows\System\AZJJfwF.exe
  C:\Windows\System\AZJJfwF.exe
  2⤵
  PID:7476
- C:\Windows\System\DGOQLuf.exe
  C:\Windows\System\DGOQLuf.exe
  2⤵
  PID:7048
- C:\Windows\System\IPhOCMD.exe
  C:\Windows\System\IPhOCMD.exe
  2⤵
  PID:7564
- C:\Windows\System\TratNbw.exe
  C:\Windows\System\TratNbw.exe
  2⤵
  PID:6644
- C:\Windows\System\aGdfSbl.exe
  C:\Windows\System\aGdfSbl.exe
  2⤵
  PID:7004
- C:\Windows\System\xPRlRtB.exe
  C:\Windows\System\xPRlRtB.exe
  2⤵
  PID:7688
- C:\Windows\System\VwcSYMc.exe
  C:\Windows\System\VwcSYMc.exe
  2⤵
  PID:7740
- C:\Windows\System\EidtfqK.exe
  C:\Windows\System\EidtfqK.exe
  2⤵
  PID:6188
- C:\Windows\System\xQnRzAP.exe
  C:\Windows\System\xQnRzAP.exe
  2⤵
  PID:8212
- C:\Windows\System\IdIypGM.exe
  C:\Windows\System\IdIypGM.exe
  2⤵
  PID:8232
- C:\Windows\System\xqZzezh.exe
  C:\Windows\System\xqZzezh.exe
  2⤵
  PID:8256
- C:\Windows\System\PFyfuBd.exe
  C:\Windows\System\PFyfuBd.exe
  2⤵
  PID:8280
- C:\Windows\System\yuOoOoL.exe
  C:\Windows\System\yuOoOoL.exe
  2⤵
  PID:8304
- C:\Windows\System\lJhjjgR.exe
  C:\Windows\System\lJhjjgR.exe
  2⤵
  PID:8332
- C:\Windows\System\nWUnxTb.exe
  C:\Windows\System\nWUnxTb.exe
  2⤵
  PID:8348
- C:\Windows\System\uZYlALr.exe
  C:\Windows\System\uZYlALr.exe
  2⤵
  PID:8372
- C:\Windows\System\DQXXDRR.exe
  C:\Windows\System\DQXXDRR.exe
  2⤵
  PID:8396
- C:\Windows\System\YkmZyZP.exe
  C:\Windows\System\YkmZyZP.exe
  2⤵
  PID:8420
- C:\Windows\System\dGosgyz.exe
  C:\Windows\System\dGosgyz.exe
  2⤵
  PID:8444
- C:\Windows\System\XWUIeKN.exe
  C:\Windows\System\XWUIeKN.exe
  2⤵
  PID:8472
- C:\Windows\System\JqAPciK.exe
  C:\Windows\System\JqAPciK.exe
  2⤵
  PID:8492
- C:\Windows\System\yHQDHYF.exe
  C:\Windows\System\yHQDHYF.exe
  2⤵
  PID:8512
- C:\Windows\System\zeRtdJH.exe
  C:\Windows\System\zeRtdJH.exe
  2⤵
  PID:8540
- C:\Windows\System\XusMMhs.exe
  C:\Windows\System\XusMMhs.exe
  2⤵
  PID:8564
- C:\Windows\System\xmGxJhs.exe
  C:\Windows\System\xmGxJhs.exe
  2⤵
  PID:8588
- C:\Windows\System\SEMAPHI.exe
  C:\Windows\System\SEMAPHI.exe
  2⤵
  PID:8612
- C:\Windows\System\lmMLqPy.exe
  C:\Windows\System\lmMLqPy.exe
  2⤵
  PID:8636
- C:\Windows\System\SAqBKFr.exe
  C:\Windows\System\SAqBKFr.exe
  2⤵
  PID:8664
- C:\Windows\System\WjrCCmH.exe
  C:\Windows\System\WjrCCmH.exe
  2⤵
  PID:8688
- C:\Windows\System\QEyOrKU.exe
  C:\Windows\System\QEyOrKU.exe
  2⤵
  PID:8712
- C:\Windows\System\DktXUME.exe
  C:\Windows\System\DktXUME.exe
  2⤵
  PID:8744
- C:\Windows\System\NGSwwXZ.exe
  C:\Windows\System\NGSwwXZ.exe
  2⤵
  PID:8764
- C:\Windows\System\gRVmCfo.exe
  C:\Windows\System\gRVmCfo.exe
  2⤵
  PID:8788
- C:\Windows\System\VgNsYpl.exe
  C:\Windows\System\VgNsYpl.exe
  2⤵
  PID:8812
- C:\Windows\System\KTIVhGZ.exe
  C:\Windows\System\KTIVhGZ.exe
  2⤵
  PID:8832
- C:\Windows\System\ONWlqjq.exe
  C:\Windows\System\ONWlqjq.exe
  2⤵
  PID:8864
- C:\Windows\System\xFcRlTx.exe
  C:\Windows\System\xFcRlTx.exe
  2⤵
  PID:8884
- C:\Windows\System\PdFpYrR.exe
  C:\Windows\System\PdFpYrR.exe
  2⤵
  PID:8908
- C:\Windows\System\VPYZgAr.exe
  C:\Windows\System\VPYZgAr.exe
  2⤵
  PID:8932
- C:\Windows\System\XFOnWPh.exe
  C:\Windows\System\XFOnWPh.exe
  2⤵
  PID:8956
- C:\Windows\System\iyrLpPV.exe
  C:\Windows\System\iyrLpPV.exe
  2⤵
  PID:8976
- C:\Windows\System\YskAwtt.exe
  C:\Windows\System\YskAwtt.exe
  2⤵
  PID:8996
- C:\Windows\System\yknpVuT.exe
  C:\Windows\System\yknpVuT.exe
  2⤵
  PID:9020
- C:\Windows\System\nvniuGr.exe
  C:\Windows\System\nvniuGr.exe
  2⤵
  PID:9044
- C:\Windows\System\pieZKGf.exe
  C:\Windows\System\pieZKGf.exe
  2⤵
  PID:9068
- C:\Windows\System\QqUkEhQ.exe
  C:\Windows\System\QqUkEhQ.exe
  2⤵
  PID:9096
- C:\Windows\System\ogabRwf.exe
  C:\Windows\System\ogabRwf.exe
  2⤵
  PID:9120
- C:\Windows\System\SbiORAI.exe
  C:\Windows\System\SbiORAI.exe
  2⤵
  PID:9140
- C:\Windows\System\pNKCyrW.exe
  C:\Windows\System\pNKCyrW.exe
  2⤵
  PID:9164
- C:\Windows\System\oNsvlME.exe
  C:\Windows\System\oNsvlME.exe
  2⤵
  PID:9188
- C:\Windows\System\euIUXTd.exe
  C:\Windows\System\euIUXTd.exe
  2⤵
  PID:9208
- C:\Windows\System\ZikpnFe.exe
  C:\Windows\System\ZikpnFe.exe
  2⤵
  PID:7236
- C:\Windows\System\yEutady.exe
  C:\Windows\System\yEutady.exe
  2⤵
  PID:7368
- C:\Windows\System\LDHNZFv.exe
  C:\Windows\System\LDHNZFv.exe
  2⤵
  PID:8152
- C:\Windows\System\HkEHHRm.exe
  C:\Windows\System\HkEHHRm.exe
  2⤵
  PID:2540
- C:\Windows\System\ZJScAJH.exe
  C:\Windows\System\ZJScAJH.exe
  2⤵
  PID:5736
- C:\Windows\System\UVpYzUk.exe
  C:\Windows\System\UVpYzUk.exe
  2⤵
  PID:6536
- C:\Windows\System\gWseepF.exe
  C:\Windows\System\gWseepF.exe
  2⤵
  PID:7644
- C:\Windows\System\lxjsgjs.exe
  C:\Windows\System\lxjsgjs.exe
  2⤵
  PID:7716
- C:\Windows\System\xBWPfEf.exe
  C:\Windows\System\xBWPfEf.exe
  2⤵
  PID:7548
- C:\Windows\System\SKngHog.exe
  C:\Windows\System\SKngHog.exe
  2⤵
  PID:6640
- C:\Windows\System\kcPCrzf.exe
  C:\Windows\System\kcPCrzf.exe
  2⤵
  PID:2796
- C:\Windows\System\aHgCnAx.exe
  C:\Windows\System\aHgCnAx.exe
  2⤵
  PID:6380
- C:\Windows\System\VLqZevI.exe
  C:\Windows\System\VLqZevI.exe
  2⤵
  PID:7804
- C:\Windows\System\yqvfRky.exe
  C:\Windows\System\yqvfRky.exe
  2⤵
  PID:8288
- C:\Windows\System\XSTMGGN.exe
  C:\Windows\System\XSTMGGN.exe
  2⤵
  PID:7304
- C:\Windows\System\BFtGMuV.exe
  C:\Windows\System\BFtGMuV.exe
  2⤵
  PID:8320
- C:\Windows\System\ryonfyN.exe
  C:\Windows\System\ryonfyN.exe
  2⤵
  PID:8048
- C:\Windows\System\NmgdHWd.exe
  C:\Windows\System\NmgdHWd.exe
  2⤵
  PID:8404
- C:\Windows\System\IdcSYkG.exe
  C:\Windows\System\IdcSYkG.exe
  2⤵
  PID:8140
- C:\Windows\System\NUOaBTU.exe
  C:\Windows\System\NUOaBTU.exe
  2⤵
  PID:8548
- C:\Windows\System\YXbjpCj.exe
  C:\Windows\System\YXbjpCj.exe
  2⤵
  PID:9228
- C:\Windows\System\pjVHoHM.exe
  C:\Windows\System\pjVHoHM.exe
  2⤵
  PID:9264
- C:\Windows\System\JCGnSrS.exe
  C:\Windows\System\JCGnSrS.exe
  2⤵
  PID:9284
- C:\Windows\System\kwqjGjo.exe
  C:\Windows\System\kwqjGjo.exe
  2⤵
  PID:9308
- C:\Windows\System\IOQtnMV.exe
  C:\Windows\System\IOQtnMV.exe
  2⤵
  PID:9324
- C:\Windows\System\RyxwRBD.exe
  C:\Windows\System\RyxwRBD.exe
  2⤵
  PID:9348
- C:\Windows\System\mKEokOK.exe
  C:\Windows\System\mKEokOK.exe
  2⤵
  PID:9376
- C:\Windows\System\YZWRRjl.exe
  C:\Windows\System\YZWRRjl.exe
  2⤵
  PID:9396
- C:\Windows\System\GbXvzDH.exe
  C:\Windows\System\GbXvzDH.exe
  2⤵
  PID:9416
- C:\Windows\System\PaIDOHk.exe
  C:\Windows\System\PaIDOHk.exe
  2⤵
  PID:9436
- C:\Windows\System\hKYPBrN.exe
  C:\Windows\System\hKYPBrN.exe
  2⤵
  PID:9460
- C:\Windows\System\qZrkgyQ.exe
  C:\Windows\System\qZrkgyQ.exe
  2⤵
  PID:9480
- C:\Windows\System\MCIiLvJ.exe
  C:\Windows\System\MCIiLvJ.exe
  2⤵
  PID:9508
- C:\Windows\System\eeAMJtz.exe
  C:\Windows\System\eeAMJtz.exe
  2⤵
  PID:9528
- C:\Windows\System\SJsXLLl.exe
  C:\Windows\System\SJsXLLl.exe
  2⤵
  PID:9552
- C:\Windows\System\NLBGnjo.exe
  C:\Windows\System\NLBGnjo.exe
  2⤵
  PID:9572
- C:\Windows\System\GdqTMOI.exe
  C:\Windows\System\GdqTMOI.exe
  2⤵
  PID:9596
- C:\Windows\System\HoISwbz.exe
  C:\Windows\System\HoISwbz.exe
  2⤵
  PID:9624
- C:\Windows\System\JcLrFDv.exe
  C:\Windows\System\JcLrFDv.exe
  2⤵
  PID:9644
- C:\Windows\System\PlwDTbv.exe
  C:\Windows\System\PlwDTbv.exe
  2⤵
  PID:9664
- C:\Windows\System\PlxjKsO.exe
  C:\Windows\System\PlxjKsO.exe
  2⤵
  PID:7780
- C:\Windows\System\xziuicw.exe
  C:\Windows\System\xziuicw.exe
  2⤵
  PID:8972
- C:\Windows\System\iDCjTCU.exe
  C:\Windows\System\iDCjTCU.exe
  2⤵
  PID:9028
- C:\Windows\System\NNQkUxG.exe
  C:\Windows\System\NNQkUxG.exe
  2⤵
  PID:7916
- C:\Windows\System\nUcBAbj.exe
  C:\Windows\System\nUcBAbj.exe
  2⤵
  PID:9156
- C:\Windows\System\svrtXGV.exe
  C:\Windows\System\svrtXGV.exe
  2⤵
  PID:7640
- C:\Windows\System\NalpXUE.exe
  C:\Windows\System\NalpXUE.exe
  2⤵
  PID:6792
- C:\Windows\System\tyCUZFG.exe
  C:\Windows\System\tyCUZFG.exe
  2⤵
  PID:9244
- C:\Windows\System\aIlmxEQ.exe
  C:\Windows\System\aIlmxEQ.exe
  2⤵
  PID:9292
- C:\Windows\System\iOkHsgg.exe
  C:\Windows\System\iOkHsgg.exe
  2⤵
  PID:8756
- C:\Windows\System\JVGFFlu.exe
  C:\Windows\System\JVGFFlu.exe
  2⤵
  PID:7332
- C:\Windows\System\vgxdgty.exe
  C:\Windows\System\vgxdgty.exe
  2⤵
  PID:9456
- C:\Windows\System\cIWoWgZ.exe
  C:\Windows\System\cIWoWgZ.exe
  2⤵
  PID:8964
- C:\Windows\System\GWeQYqA.exe
  C:\Windows\System\GWeQYqA.exe
  2⤵
  PID:9588
- C:\Windows\System\vpYUsjb.exe
  C:\Windows\System\vpYUsjb.exe
  2⤵
  PID:8204
- C:\Windows\System\cykexRj.exe
  C:\Windows\System\cykexRj.exe
  2⤵
  PID:6300
- C:\Windows\System\quQACTS.exe
  C:\Windows\System\quQACTS.exe
  2⤵
  PID:6868
- C:\Windows\System\AEZTtgU.exe
  C:\Windows\System\AEZTtgU.exe
  2⤵
  PID:8508
- C:\Windows\System\FHbrekO.exe
  C:\Windows\System\FHbrekO.exe
  2⤵
  PID:7452
- C:\Windows\System\FkoviMI.exe
  C:\Windows\System\FkoviMI.exe
  2⤵
  PID:8684
- C:\Windows\System\FsABATd.exe
  C:\Windows\System\FsABATd.exe
  2⤵
  PID:9332
- C:\Windows\System\fSatQUA.exe
  C:\Windows\System\fSatQUA.exe
  2⤵
  PID:9444
- C:\Windows\System\EiBSImK.exe
  C:\Windows\System\EiBSImK.exe
  2⤵
  PID:9492
- C:\Windows\System\khpwlBw.exe
  C:\Windows\System\khpwlBw.exe
  2⤵
  PID:9012
- C:\Windows\System\CSgWmbM.exe
  C:\Windows\System\CSgWmbM.exe
  2⤵
  PID:9080
- C:\Windows\System\YlQuZBR.exe
  C:\Windows\System\YlQuZBR.exe
  2⤵
  PID:10044
- C:\Windows\System\dcxdZrT.exe
  C:\Windows\System\dcxdZrT.exe
  2⤵
  PID:7448
- C:\Windows\System\DvEdDJy.exe
  C:\Windows\System\DvEdDJy.exe
  2⤵
  PID:7596
- C:\Windows\System\eNpRuEJ.exe
  C:\Windows\System\eNpRuEJ.exe
  2⤵
  PID:7820
- C:\Windows\System\rrXbTLR.exe
  C:\Windows\System\rrXbTLR.exe
  2⤵
  PID:7888
- C:\Windows\System\BHZYNvf.exe
  C:\Windows\System\BHZYNvf.exe
  2⤵
  PID:7964
- C:\Windows\System\KPKFJHF.exe
  C:\Windows\System\KPKFJHF.exe
  2⤵
  PID:8388
- C:\Windows\System\kZbBqml.exe
  C:\Windows\System\kZbBqml.exe
  2⤵
  PID:9304
- C:\Windows\System\HxoVLOG.exe
  C:\Windows\System\HxoVLOG.exe
  2⤵
  PID:8800
- C:\Windows\System\PbImAjZ.exe
  C:\Windows\System\PbImAjZ.exe
  2⤵
  PID:10264
- C:\Windows\System\AHUWnWF.exe
  C:\Windows\System\AHUWnWF.exe
  2⤵
  PID:10292
- C:\Windows\System\rQnvCES.exe
  C:\Windows\System\rQnvCES.exe
  2⤵
  PID:10316
- C:\Windows\System\QqPeNxn.exe
  C:\Windows\System\QqPeNxn.exe
  2⤵
  PID:10336
- C:\Windows\System\GPuTqEl.exe
  C:\Windows\System\GPuTqEl.exe
  2⤵
  PID:10360
- C:\Windows\System\hofcNMF.exe
  C:\Windows\System\hofcNMF.exe
  2⤵
  PID:10388
- C:\Windows\System\usItzAo.exe
  C:\Windows\System\usItzAo.exe
  2⤵
  PID:10408
- C:\Windows\System\LwVasAy.exe
  C:\Windows\System\LwVasAy.exe
  2⤵
  PID:10440
- C:\Windows\System\AoQjwtX.exe
  C:\Windows\System\AoQjwtX.exe
  2⤵
  PID:10468
- C:\Windows\System\MjuywLG.exe
  C:\Windows\System\MjuywLG.exe
  2⤵
  PID:10484
- C:\Windows\System\SGZvjpl.exe
  C:\Windows\System\SGZvjpl.exe
  2⤵
  PID:10512
- C:\Windows\System\ZmdmIDs.exe
  C:\Windows\System\ZmdmIDs.exe
  2⤵
  PID:10532
- C:\Windows\System\dgWeUyK.exe
  C:\Windows\System\dgWeUyK.exe
  2⤵
  PID:10552
- C:\Windows\System\ABFmOdw.exe
  C:\Windows\System\ABFmOdw.exe
  2⤵
  PID:10576
- C:\Windows\System\GMMECgQ.exe
  C:\Windows\System\GMMECgQ.exe
  2⤵
  PID:10604
- C:\Windows\System\HyDAgaA.exe
  C:\Windows\System\HyDAgaA.exe
  2⤵
  PID:10624
- C:\Windows\System\YocBPee.exe
  C:\Windows\System\YocBPee.exe
  2⤵
  PID:10640
- C:\Windows\System\pkFLzAv.exe
  C:\Windows\System\pkFLzAv.exe
  2⤵
  PID:10656
- C:\Windows\System\kSJbDKN.exe
  C:\Windows\System\kSJbDKN.exe
  2⤵
  PID:10672
- C:\Windows\System\vgiubXq.exe
  C:\Windows\System\vgiubXq.exe
  2⤵
  PID:10688
- C:\Windows\System\waoLjYD.exe
  C:\Windows\System\waoLjYD.exe
  2⤵
  PID:10708
- C:\Windows\System\pmujfxa.exe
  C:\Windows\System\pmujfxa.exe
  2⤵
  PID:10724
- C:\Windows\System\kOFozSh.exe
  C:\Windows\System\kOFozSh.exe
  2⤵
  PID:10748
- C:\Windows\System\tEsfevM.exe
  C:\Windows\System\tEsfevM.exe
  2⤵
  PID:10772
- C:\Windows\System\ecwTuJR.exe
  C:\Windows\System\ecwTuJR.exe
  2⤵
  PID:10800
- C:\Windows\System\zcHQLBY.exe
  C:\Windows\System\zcHQLBY.exe
  2⤵
  PID:10836
- C:\Windows\System\cekEEPg.exe
  C:\Windows\System\cekEEPg.exe
  2⤵
  PID:10856
- C:\Windows\System\uGbPwrt.exe
  C:\Windows\System\uGbPwrt.exe
  2⤵
  PID:10876
- C:\Windows\System\zqCBLrw.exe
  C:\Windows\System\zqCBLrw.exe
  2⤵
  PID:10904
- C:\Windows\System\epmKYbc.exe
  C:\Windows\System\epmKYbc.exe
  2⤵
  PID:10932
- C:\Windows\System\wHYtbUj.exe
  C:\Windows\System\wHYtbUj.exe
  2⤵
  PID:10948
- C:\Windows\System\Bwvtuav.exe
  C:\Windows\System\Bwvtuav.exe
  2⤵
  PID:10972
- C:\Windows\System\plIxGbf.exe
  C:\Windows\System\plIxGbf.exe
  2⤵
  PID:11000
- C:\Windows\System\TNkndvf.exe
  C:\Windows\System\TNkndvf.exe
  2⤵
  PID:11028
- C:\Windows\System\cQMVYsV.exe
  C:\Windows\System\cQMVYsV.exe
  2⤵
  PID:11060
- C:\Windows\System\cJRMvad.exe
  C:\Windows\System\cJRMvad.exe
  2⤵
  PID:11088
- C:\Windows\System\fykpHCc.exe
  C:\Windows\System\fykpHCc.exe
  2⤵
  PID:11108
- C:\Windows\System\uiuKdRk.exe
  C:\Windows\System\uiuKdRk.exe
  2⤵
  PID:11132
- C:\Windows\System\letuuGd.exe
  C:\Windows\System\letuuGd.exe
  2⤵
  PID:11156
- C:\Windows\System\sloDssM.exe
  C:\Windows\System\sloDssM.exe
  2⤵
  PID:11180
- C:\Windows\System\uWpTAdS.exe
  C:\Windows\System\uWpTAdS.exe
  2⤵
  PID:11200
- C:\Windows\System\xtKeehx.exe
  C:\Windows\System\xtKeehx.exe
  2⤵
  PID:11232
- C:\Windows\System\UMxsaBR.exe
  C:\Windows\System\UMxsaBR.exe
  2⤵
  PID:11252
- C:\Windows\System\iQPRYLx.exe
  C:\Windows\System\iQPRYLx.exe
  2⤵
  PID:8896
- C:\Windows\System\gJmmstB.exe
  C:\Windows\System\gJmmstB.exe
  2⤵
  PID:7988
- C:\Windows\System\oRfLhYL.exe
  C:\Windows\System\oRfLhYL.exe
  2⤵
  PID:9612
- C:\Windows\System\aemvkOV.exe
  C:\Windows\System\aemvkOV.exe
  2⤵
  PID:8696
- C:\Windows\System\xwnfQtu.exe
  C:\Windows\System\xwnfQtu.exe
  2⤵
  PID:9660
- C:\Windows\System\nskvedM.exe
  C:\Windows\System\nskvedM.exe
  2⤵
  PID:10012
- C:\Windows\System\ebEMRiv.exe
  C:\Windows\System\ebEMRiv.exe
  2⤵
  PID:10092
- C:\Windows\System\GWJmnCb.exe
  C:\Windows\System\GWJmnCb.exe
  2⤵
  PID:10136
- C:\Windows\System\KumSguB.exe
  C:\Windows\System\KumSguB.exe
  2⤵
  PID:9344
- C:\Windows\System\idZoTPx.exe
  C:\Windows\System\idZoTPx.exe
  2⤵
  PID:9848
- C:\Windows\System\VPRGPGF.exe
  C:\Windows\System\VPRGPGF.exe
  2⤵
  PID:10172
- C:\Windows\System\PBqaSuA.exe
  C:\Windows\System\PBqaSuA.exe
  2⤵
  PID:10256
- C:\Windows\System\gDWJVht.exe
  C:\Windows\System\gDWJVht.exe
  2⤵
  PID:10348
- C:\Windows\System\HEkljsi.exe
  C:\Windows\System\HEkljsi.exe
  2⤵
  PID:10436
- C:\Windows\System\PKAnCPZ.exe
  C:\Windows\System\PKAnCPZ.exe
  2⤵
  PID:10024
- C:\Windows\System\gLQOofs.exe
  C:\Windows\System\gLQOofs.exe
  2⤵
  PID:10584
- C:\Windows\System\qVbiZPc.exe
  C:\Windows\System\qVbiZPc.exe
  2⤵
  PID:9580
- C:\Windows\System\LNFiRci.exe
  C:\Windows\System\LNFiRci.exe
  2⤵
  PID:9176
- C:\Windows\System\ITUNanb.exe
  C:\Windows\System\ITUNanb.exe
  2⤵
  PID:10756
- C:\Windows\System\MIlPmGe.exe
  C:\Windows\System\MIlPmGe.exe
  2⤵
  PID:11284
- C:\Windows\System\DwZBvAR.exe
  C:\Windows\System\DwZBvAR.exe
  2⤵
  PID:11308
- C:\Windows\System\JsmxMxO.exe
  C:\Windows\System\JsmxMxO.exe
  2⤵
  PID:11328
- C:\Windows\System\KLAPOVY.exe
  C:\Windows\System\KLAPOVY.exe
  2⤵
  PID:11348
- C:\Windows\System\abncTYx.exe
  C:\Windows\System\abncTYx.exe
  2⤵
  PID:11368
- C:\Windows\System\uyMFYAv.exe
  C:\Windows\System\uyMFYAv.exe
  2⤵
  PID:11388
- C:\Windows\System\niJUmzV.exe
  C:\Windows\System\niJUmzV.exe
  2⤵
  PID:11412
- C:\Windows\System\nVtRHBi.exe
  C:\Windows\System\nVtRHBi.exe
  2⤵
  PID:11440
- C:\Windows\System\umFcdrT.exe
  C:\Windows\System\umFcdrT.exe
  2⤵
  PID:11464
- C:\Windows\System\moKKSWt.exe
  C:\Windows\System\moKKSWt.exe
  2⤵
  PID:11488
- C:\Windows\System\UiZRWIW.exe
  C:\Windows\System\UiZRWIW.exe
  2⤵
  PID:11508
- C:\Windows\System\oyOXGyV.exe
  C:\Windows\System\oyOXGyV.exe
  2⤵
  PID:11528
- C:\Windows\System\iTyWlUl.exe
  C:\Windows\System\iTyWlUl.exe
  2⤵
  PID:11552
- C:\Windows\System\BsCudtf.exe
  C:\Windows\System\BsCudtf.exe
  2⤵
  PID:11580
- C:\Windows\System\PcuQaWb.exe
  C:\Windows\System\PcuQaWb.exe
  2⤵
  PID:11596
- C:\Windows\System\HqcgeQF.exe
  C:\Windows\System\HqcgeQF.exe
  2⤵
  PID:11612
- C:\Windows\System\vwdbPaN.exe
  C:\Windows\System\vwdbPaN.exe
  2⤵
  PID:11632
- C:\Windows\System\zNJlLDb.exe
  C:\Windows\System\zNJlLDb.exe
  2⤵
  PID:11648
- C:\Windows\System\dIBPwIY.exe
  C:\Windows\System\dIBPwIY.exe
  2⤵
  PID:11664
- C:\Windows\System\GzNCvuz.exe
  C:\Windows\System\GzNCvuz.exe
  2⤵
  PID:11684
- C:\Windows\System\cbCmGhI.exe
  C:\Windows\System\cbCmGhI.exe
  2⤵
  PID:11704
- C:\Windows\System\fqanyYu.exe
  C:\Windows\System\fqanyYu.exe
  2⤵
  PID:11728
- C:\Windows\System\GvXWGWv.exe
  C:\Windows\System\GvXWGWv.exe
  2⤵
  PID:11748
- C:\Windows\System\rEfFLEx.exe
  C:\Windows\System\rEfFLEx.exe
  2⤵
  PID:11776
- C:\Windows\System\BJbQFXj.exe
  C:\Windows\System\BJbQFXj.exe
  2⤵
  PID:11800
- C:\Windows\System\mvWSQtP.exe
  C:\Windows\System\mvWSQtP.exe
  2⤵
  PID:11828
- C:\Windows\System\FOpEXwP.exe
  C:\Windows\System\FOpEXwP.exe
  2⤵
  PID:11848
- C:\Windows\System\lNKSNiq.exe
  C:\Windows\System\lNKSNiq.exe
  2⤵
  PID:11868
- C:\Windows\System\AEgIBAO.exe
  C:\Windows\System\AEgIBAO.exe
  2⤵
  PID:11892
- C:\Windows\System\xMTFAce.exe
  C:\Windows\System\xMTFAce.exe
  2⤵
  PID:11916
- C:\Windows\System\CBUaVeV.exe
  C:\Windows\System\CBUaVeV.exe
  2⤵
  PID:11940
- C:\Windows\System\fzAfFqn.exe
  C:\Windows\System\fzAfFqn.exe
  2⤵
  PID:11960
- C:\Windows\System\SslPPDg.exe
  C:\Windows\System\SslPPDg.exe
  2⤵
  PID:11984
- C:\Windows\System\curWSoe.exe
  C:\Windows\System\curWSoe.exe
  2⤵
  PID:12004
- C:\Windows\System\UyWjPmC.exe
  C:\Windows\System\UyWjPmC.exe
  2⤵
  PID:12020
- C:\Windows\System\JdlORfY.exe
  C:\Windows\System\JdlORfY.exe
  2⤵
  PID:12044
- C:\Windows\System\KZUDpzF.exe
  C:\Windows\System\KZUDpzF.exe
  2⤵
  PID:12068
- C:\Windows\System\ULxrdQZ.exe
  C:\Windows\System\ULxrdQZ.exe
  2⤵
  PID:12088
- C:\Windows\System\OAaLjlp.exe
  C:\Windows\System\OAaLjlp.exe
  2⤵
  PID:12112
- C:\Windows\System\VvFKJEj.exe
  C:\Windows\System\VvFKJEj.exe
  2⤵
  PID:12128
- C:\Windows\System\RszAZay.exe
  C:\Windows\System\RszAZay.exe
  2⤵
  PID:12152
- C:\Windows\System\huKqzIt.exe
  C:\Windows\System\huKqzIt.exe
  2⤵
  PID:12176
- C:\Windows\System\gptJBSt.exe
  C:\Windows\System\gptJBSt.exe
  2⤵
  PID:12192
- C:\Windows\System\PBibHie.exe
  C:\Windows\System\PBibHie.exe
  2⤵
  PID:12212
- C:\Windows\System\xFHuPVv.exe
  C:\Windows\System\xFHuPVv.exe
  2⤵
  PID:12232
- C:\Windows\System\SPwrzee.exe
  C:\Windows\System\SPwrzee.exe
  2⤵
  PID:12248
- C:\Windows\System\HxbLQOh.exe
  C:\Windows\System\HxbLQOh.exe
  2⤵
  PID:12268
- C:\Windows\System\SlGhtyV.exe
  C:\Windows\System\SlGhtyV.exe
  2⤵
  PID:10792
- C:\Windows\System\NEFbBvG.exe
  C:\Windows\System\NEFbBvG.exe
  2⤵
  PID:10152
- C:\Windows\System\MdEyPVQ.exe
  C:\Windows\System\MdEyPVQ.exe
  2⤵
  PID:10844
- C:\Windows\System\kJebhPw.exe
  C:\Windows\System\kJebhPw.exe
  2⤵
  PID:10868
- C:\Windows\System\wWEBuRt.exe
  C:\Windows\System\wWEBuRt.exe
  2⤵
  PID:10940
- C:\Windows\System\ZmWubdy.exe
  C:\Windows\System\ZmWubdy.exe
  2⤵
  PID:11008
- C:\Windows\System\wtguyqB.exe
  C:\Windows\System\wtguyqB.exe
  2⤵
  PID:9136
- C:\Windows\System\bNQUCst.exe
  C:\Windows\System\bNQUCst.exe
  2⤵
  PID:7384
- C:\Windows\System\bGADNHu.exe
  C:\Windows\System\bGADNHu.exe
  2⤵
  PID:4408
- C:\Windows\System\AABQJfk.exe
  C:\Windows\System\AABQJfk.exe
  2⤵
  PID:11116
- C:\Windows\System\GrKWUNu.exe
  C:\Windows\System\GrKWUNu.exe
  2⤵
  PID:8248
- C:\Windows\System\RAsrjFs.exe
  C:\Windows\System\RAsrjFs.exe
  2⤵
  PID:9860
- C:\Windows\System\fEBNLGo.exe
  C:\Windows\System\fEBNLGo.exe
  2⤵
  PID:11220
- C:\Windows\System\RufZKCI.exe
  C:\Windows\System\RufZKCI.exe
  2⤵
  PID:11244
- C:\Windows\System\hywyphS.exe
  C:\Windows\System\hywyphS.exe
  2⤵
  PID:9036
- C:\Windows\System\gVZtRuJ.exe
  C:\Windows\System\gVZtRuJ.exe
  2⤵
  PID:9476
- C:\Windows\System\cAWrPGu.exe
  C:\Windows\System\cAWrPGu.exe
  2⤵
  PID:10368
- C:\Windows\System\XGtSVPD.exe
  C:\Windows\System\XGtSVPD.exe
  2⤵
  PID:8604
- C:\Windows\System\UapELxe.exe
  C:\Windows\System\UapELxe.exe
  2⤵
  PID:9772
- C:\Windows\System\cCBOOZD.exe
  C:\Windows\System\cCBOOZD.exe
  2⤵
  PID:10492
- C:\Windows\System\BnKEuWe.exe
  C:\Windows\System\BnKEuWe.exe
  2⤵
  PID:8708
- C:\Windows\System\cDXcLDy.exe
  C:\Windows\System\cDXcLDy.exe
  2⤵
  PID:10520
- C:\Windows\System\kBrJJoO.exe
  C:\Windows\System\kBrJJoO.exe
  2⤵
  PID:10480
- C:\Windows\System\qPTwCQr.exe
  C:\Windows\System\qPTwCQr.exe
  2⤵
  PID:10680
- C:\Windows\System\bkaIxuk.exe
  C:\Windows\System\bkaIxuk.exe
  2⤵
  PID:10740
- C:\Windows\System\GsXsiPx.exe
  C:\Windows\System\GsXsiPx.exe
  2⤵
  PID:8596
- C:\Windows\System\gmuUkUI.exe
  C:\Windows\System\gmuUkUI.exe
  2⤵
  PID:10920
- C:\Windows\System\AoAvOwR.exe
  C:\Windows\System\AoAvOwR.exe
  2⤵
  PID:11344
- C:\Windows\System\kkgZhJe.exe
  C:\Windows\System\kkgZhJe.exe
  2⤵
  PID:9656
- C:\Windows\System\EyCEfKt.exe
  C:\Windows\System\EyCEfKt.exe
  2⤵
  PID:11400
- C:\Windows\System\VvYeBEB.exe
  C:\Windows\System\VvYeBEB.exe
  2⤵
  PID:11476
- C:\Windows\System\HdlcktN.exe
  C:\Windows\System\HdlcktN.exe
  2⤵
  PID:11540
- C:\Windows\System\kaDIeKD.exe
  C:\Windows\System\kaDIeKD.exe
  2⤵
  PID:11620
- C:\Windows\System\ttKveKm.exe
  C:\Windows\System\ttKveKm.exe
  2⤵
  PID:9636
- C:\Windows\System\GMGaXDu.exe
  C:\Windows\System\GMGaXDu.exe
  2⤵
  PID:11836
- C:\Windows\System\jBvOMTu.exe
  C:\Windows\System\jBvOMTu.exe
  2⤵
  PID:10416
- C:\Windows\System\zmyVtqf.exe
  C:\Windows\System\zmyVtqf.exe
  2⤵
  PID:11888
- C:\Windows\System\SFqHiXj.exe
  C:\Windows\System\SFqHiXj.exe
  2⤵
  PID:10124
- C:\Windows\System\ILWgfLO.exe
  C:\Windows\System\ILWgfLO.exe
  2⤵
  PID:12296
- C:\Windows\System\FeWAdac.exe
  C:\Windows\System\FeWAdac.exe
  2⤵
  PID:12320
- C:\Windows\System\WwQZXTZ.exe
  C:\Windows\System\WwQZXTZ.exe
  2⤵
  PID:12344
- C:\Windows\System\SgqcUNZ.exe
  C:\Windows\System\SgqcUNZ.exe
  2⤵
  PID:12364
- C:\Windows\System\FYAbyKn.exe
  C:\Windows\System\FYAbyKn.exe
  2⤵
  PID:12384
- C:\Windows\System\NzkxyIl.exe
  C:\Windows\System\NzkxyIl.exe
  2⤵
  PID:12412
- C:\Windows\System\HZGhhUc.exe
  C:\Windows\System\HZGhhUc.exe
  2⤵
  PID:12436
- C:\Windows\System\FQEqZYo.exe
  C:\Windows\System\FQEqZYo.exe
  2⤵
  PID:12460
- C:\Windows\System\ktUndTi.exe
  C:\Windows\System\ktUndTi.exe
  2⤵
  PID:12476
- C:\Windows\System\YCcRbhv.exe
  C:\Windows\System\YCcRbhv.exe
  2⤵
  PID:12496
- C:\Windows\System\vHtCGhu.exe
  C:\Windows\System\vHtCGhu.exe
  2⤵
  PID:12524
- C:\Windows\System\YgfvtHb.exe
  C:\Windows\System\YgfvtHb.exe
  2⤵
  PID:12552
- C:\Windows\System\kzjaWtL.exe
  C:\Windows\System\kzjaWtL.exe
  2⤵
  PID:12568
- C:\Windows\System\GItqCHU.exe
  C:\Windows\System\GItqCHU.exe
  2⤵
  PID:12596
- C:\Windows\System\gELhKFz.exe
  C:\Windows\System\gELhKFz.exe
  2⤵
  PID:12616
- C:\Windows\System\rQXISjT.exe
  C:\Windows\System\rQXISjT.exe
  2⤵
  PID:12640
- C:\Windows\System\FguvMjz.exe
  C:\Windows\System\FguvMjz.exe
  2⤵
  PID:12660
- C:\Windows\System\AHgFCyT.exe
  C:\Windows\System\AHgFCyT.exe
  2⤵
  PID:12680
- C:\Windows\System\eLgNQHM.exe
  C:\Windows\System\eLgNQHM.exe
  2⤵
  PID:12704
- C:\Windows\System\VmtCDDh.exe
  C:\Windows\System\VmtCDDh.exe
  2⤵
  PID:12728
- C:\Windows\System\zEkkbrP.exe
  C:\Windows\System\zEkkbrP.exe
  2⤵
  PID:12752
- C:\Windows\System\GduQhBT.exe
  C:\Windows\System\GduQhBT.exe
  2⤵
  PID:12776
- C:\Windows\System\lRCpqMX.exe
  C:\Windows\System\lRCpqMX.exe
  2⤵
  PID:12800
- C:\Windows\System\glhQDqO.exe
  C:\Windows\System\glhQDqO.exe
  2⤵
  PID:12816
- C:\Windows\System\WVnGPmq.exe
  C:\Windows\System\WVnGPmq.exe
  2⤵
  PID:12840
- C:\Windows\System\EQAvAXx.exe
  C:\Windows\System\EQAvAXx.exe
  2⤵
  PID:12864
- C:\Windows\System\SQPzVMM.exe
  C:\Windows\System\SQPzVMM.exe
  2⤵
  PID:12888
- C:\Windows\System\VLlLHFn.exe
  C:\Windows\System\VLlLHFn.exe
  2⤵
  PID:12916
- C:\Windows\System\BwlIrRw.exe
  C:\Windows\System\BwlIrRw.exe
  2⤵
  PID:12940
- C:\Windows\System\WlVYBnz.exe
  C:\Windows\System\WlVYBnz.exe
  2⤵
  PID:12964
- C:\Windows\System\ZIerBSy.exe
  C:\Windows\System\ZIerBSy.exe
  2⤵
  PID:12984
- C:\Windows\System\bPyEzPr.exe
  C:\Windows\System\bPyEzPr.exe
  2⤵
  PID:13004
- C:\Windows\System\eMrEGUx.exe
  C:\Windows\System\eMrEGUx.exe
  2⤵
  PID:13028
- C:\Windows\System\tDerMJj.exe
  C:\Windows\System\tDerMJj.exe
  2⤵
  PID:13052
- C:\Windows\System\IHLPTgZ.exe
  C:\Windows\System\IHLPTgZ.exe
  2⤵
  PID:13076
- C:\Windows\System\dDEuCuU.exe
  C:\Windows\System\dDEuCuU.exe
  2⤵
  PID:13104
- C:\Windows\System\zlRHMFB.exe
  C:\Windows\System\zlRHMFB.exe
  2⤵
  PID:13124
- C:\Windows\System\znxodtl.exe
  C:\Windows\System\znxodtl.exe
  2⤵
  PID:13144
- C:\Windows\System\DqAkiLJ.exe
  C:\Windows\System\DqAkiLJ.exe
  2⤵
  PID:13172
- C:\Windows\System\suUPFci.exe
  C:\Windows\System\suUPFci.exe
  2⤵
  PID:13192
- C:\Windows\System\XfLoSAd.exe
  C:\Windows\System\XfLoSAd.exe
  2⤵
  PID:11784
- C:\Windows\System\LgHaKID.exe
  C:\Windows\System\LgHaKID.exe
  2⤵
  PID:13064
- C:\Windows\System\itxyFKc.exe
  C:\Windows\System\itxyFKc.exe
  2⤵
  PID:13116
- C:\Windows\System\JKqmCni.exe
  C:\Windows\System\JKqmCni.exe
  2⤵
  PID:13256
- C:\Windows\System\vwPbHSB.exe
  C:\Windows\System\vwPbHSB.exe
  2⤵
  PID:5064
- C:\Windows\System\WdlwyuE.exe
  C:\Windows\System\WdlwyuE.exe
  2⤵
  PID:12064
- C:\Windows\System\PRHkDoj.exe
  C:\Windows\System\PRHkDoj.exe
  2⤵
  PID:3000
- C:\Windows\System\cKLgdvH.exe
  C:\Windows\System\cKLgdvH.exe
  2⤵
  PID:12144
- C:\Windows\System\yFMyHUU.exe
  C:\Windows\System\yFMyHUU.exe
  2⤵
  PID:13204
- C:\Windows\System\RkjclKa.exe
  C:\Windows\System\RkjclKa.exe
  2⤵
  PID:9536
- C:\Windows\System\vyiPVVx.exe
  C:\Windows\System\vyiPVVx.exe
  2⤵
  PID:3136
- C:\Windows\System\cLeVmAH.exe
  C:\Windows\System\cLeVmAH.exe
  2⤵
  PID:3228
- C:\Windows\System\MqjSqBG.exe
  C:\Windows\System\MqjSqBG.exe
  2⤵
  PID:13236
- C:\Windows\System\hLvmUpK.exe
  C:\Windows\System\hLvmUpK.exe
  2⤵
  PID:12360
- C:\Windows\System\CSnRvZA.exe
  C:\Windows\System\CSnRvZA.exe
  2⤵
  PID:12676
- C:\Windows\System\pYCgPmP.exe
  C:\Windows\System\pYCgPmP.exe
  2⤵
  PID:11536
- C:\Windows\System\NpSNKvy.exe
  C:\Windows\System\NpSNKvy.exe
  2⤵
  PID:13096
- C:\Windows\System\QWEOrZv.exe
  C:\Windows\System\QWEOrZv.exe
  2⤵
  PID:12880
- C:\Windows\System\qaoIhSB.exe
  C:\Windows\System\qaoIhSB.exe
  2⤵
  PID:12788
- C:\Windows\System\ERCzwNa.exe
  C:\Windows\System\ERCzwNa.exe
  2⤵
  PID:11660
- C:\Windows\System\hFzEMEk.exe
  C:\Windows\System\hFzEMEk.exe
  2⤵
  PID:12036
- C:\Windows\System\GBteIPG.exe
  C:\Windows\System\GBteIPG.exe
  2⤵
  PID:12240
- C:\Windows\System\iYrfpor.exe
  C:\Windows\System\iYrfpor.exe
  2⤵
  PID:12228
- C:\Windows\System\ccCMjDN.exe
  C:\Windows\System\ccCMjDN.exe
  2⤵
  PID:13184
- C:\Windows\System\rGeSfVo.exe
  C:\Windows\System\rGeSfVo.exe
  2⤵
  PID:11676
- C:\Windows\System\TEYlDrX.exe
  C:\Windows\System\TEYlDrX.exe
  2⤵
  PID:4852
- C:\Windows\System\liZwDIh.exe
  C:\Windows\System\liZwDIh.exe
  2⤵
  PID:10568
- C:\Windows\System\cOhYIqU.exe
  C:\Windows\System\cOhYIqU.exe
  2⤵
  PID:3604
- C:\Windows\System\QrbGTBa.exe
  C:\Windows\System\QrbGTBa.exe
  2⤵
  PID:1628
- C:\Windows\System\YtVfMIT.exe
  C:\Windows\System\YtVfMIT.exe
  2⤵
  PID:11768
- C:\Windows\System\hxAelcx.exe
  C:\Windows\System\hxAelcx.exe
  2⤵
  PID:5088
- C:\Windows\System\GuzTdga.exe
  C:\Windows\System\GuzTdga.exe
  2⤵
  PID:11724
- C:\Windows\System\nWpgqpe.exe
  C:\Windows\System\nWpgqpe.exe
  2⤵
  PID:12172
- C:\Windows\System\vOFVZVY.exe
  C:\Windows\System\vOFVZVY.exe
  2⤵
  PID:6428
- C:\Windows\System\iTCkQdC.exe
  C:\Windows\System\iTCkQdC.exe
  2⤵
  PID:376
- C:\Windows\System\ZlVtqxX.exe
  C:\Windows\System\ZlVtqxX.exe
  2⤵
  PID:8992
- C:\Windows\System\WTslmhE.exe
  C:\Windows\System\WTslmhE.exe
  2⤵
  PID:11700
- C:\Windows\System\JlzJgls.exe
  C:\Windows\System\JlzJgls.exe
  2⤵
  PID:12016
- C:\Windows\System\vXbqXBG.exe
  C:\Windows\System\vXbqXBG.exe
  2⤵
  PID:13320
- C:\Windows\System\HtMgAEA.exe
  C:\Windows\System\HtMgAEA.exe
  2⤵
  PID:13572
- C:\Windows\System\IwxwNck.exe
  C:\Windows\System\IwxwNck.exe
  2⤵
  PID:13608
- C:\Windows\System\zMgsNFg.exe
  C:\Windows\System\zMgsNFg.exe
  2⤵
  PID:13644
- C:\Windows\System\XFEBdcz.exe
  C:\Windows\System\XFEBdcz.exe
  2⤵
  PID:13728
- C:\Windows\System\lehtPeV.exe
  C:\Windows\System\lehtPeV.exe
  2⤵
  PID:13824
- C:\Windows\System\fbMWxPE.exe
  C:\Windows\System\fbMWxPE.exe
  2⤵
  PID:13848
- C:\Windows\System\nZXgEuD.exe
  C:\Windows\System\nZXgEuD.exe
  2⤵
  PID:13880
- C:\Windows\System\oVVuJCl.exe
  C:\Windows\System\oVVuJCl.exe
  2⤵
  PID:13900
- C:\Windows\System\peyOKIE.exe
  C:\Windows\System\peyOKIE.exe
  2⤵
  PID:13948
- C:\Windows\System\xWXNXMi.exe
  C:\Windows\System\xWXNXMi.exe
  2⤵
  PID:13964
- C:\Windows\System\kArckCJ.exe
  C:\Windows\System\kArckCJ.exe
  2⤵
  PID:13988
- C:\Windows\System\goDxXbk.exe
  C:\Windows\System\goDxXbk.exe
  2⤵
  PID:14016
- C:\Windows\System\yyXrQFL.exe
  C:\Windows\System\yyXrQFL.exe
  2⤵
  PID:14036
- C:\Windows\System\viJhjQR.exe
  C:\Windows\System\viJhjQR.exe
  2⤵
  PID:14060
- C:\Windows\System\BdnnOFE.exe
  C:\Windows\System\BdnnOFE.exe
  2⤵
  PID:14088
- C:\Windows\System\pWqRZyh.exe
  C:\Windows\System\pWqRZyh.exe
  2⤵
  PID:14112
- C:\Windows\System\tGIstvu.exe
  C:\Windows\System\tGIstvu.exe
  2⤵
  PID:14136
- C:\Windows\System\jEOciTI.exe
  C:\Windows\System\jEOciTI.exe
  2⤵
  PID:14156
- C:\Windows\System\YaTkzPe.exe
  C:\Windows\System\YaTkzPe.exe
  2⤵
  PID:14184
- C:\Windows\System\gtYcaPy.exe
  C:\Windows\System\gtYcaPy.exe
  2⤵
  PID:14208
- C:\Windows\System\HykPTXR.exe
  C:\Windows\System\HykPTXR.exe
  2⤵
  PID:14228
- C:\Windows\System\qtLPkAY.exe
  C:\Windows\System\qtLPkAY.exe
  2⤵
  PID:13620
- C:\Windows\System\WonOrTJ.exe
  C:\Windows\System\WonOrTJ.exe
  2⤵
  PID:14148
- C:\Windows\System\GbhFFDu.exe
  C:\Windows\System\GbhFFDu.exe
  2⤵
  PID:14104
- C:\Windows\System\whGQegI.exe
  C:\Windows\System\whGQegI.exe
  2⤵
  PID:14224
- C:\Windows\System\aufrkzp.exe
  C:\Windows\System\aufrkzp.exe
  2⤵
  PID:14264
- C:\Windows\System\VkBjIHK.exe
  C:\Windows\System\VkBjIHK.exe
  2⤵
  PID:11456
- C:\Windows\System\OJAJQOy.exe
  C:\Windows\System\OJAJQOy.exe
  2⤵
  PID:4652
- C:\Windows\System\WyWxsgR.exe
  C:\Windows\System\WyWxsgR.exe
  2⤵
  PID:13544
- C:\Windows\System\XKiTXBg.exe
  C:\Windows\System\XKiTXBg.exe
  2⤵
  PID:13704
- C:\Windows\System\Toywfhc.exe
  C:\Windows\System\Toywfhc.exe
  2⤵
  PID:10528
- C:\Windows\System\LAXVdwE.exe
  C:\Windows\System\LAXVdwE.exe
  2⤵
  PID:14120
- C:\Windows\System\fjUcBFP.exe
  C:\Windows\System\fjUcBFP.exe
  2⤵
  PID:13472
- C:\Windows\System\sdbWhhI.exe
  C:\Windows\System\sdbWhhI.exe
  2⤵
  PID:13488
- C:\Windows\System\QpHNhms.exe
  C:\Windows\System\QpHNhms.exe
  2⤵
  PID:13300
- C:\Windows\System\EShoFoK.exe
  C:\Windows\System\EShoFoK.exe
  2⤵
  PID:8124
- C:\Windows\System\WOJqrhr.exe
  C:\Windows\System\WOJqrhr.exe
  2⤵
  PID:12584
- C:\Windows\System\XFJUsvw.exe
  C:\Windows\System\XFJUsvw.exe
  2⤵
  PID:3240
- C:\Windows\System\sadTvyA.exe
  C:\Windows\System\sadTvyA.exe
  2⤵
  PID:13700
- C:\Windows\System\LUotZsu.exe
  C:\Windows\System\LUotZsu.exe
  2⤵
  PID:13896
- C:\Windows\System\UMZZYEW.exe
  C:\Windows\System\UMZZYEW.exe
  2⤵
  PID:13804
- C:\Windows\System\ijjNMtr.exe
  C:\Windows\System\ijjNMtr.exe
  2⤵
  PID:13624
- C:\Windows\System\jkySvZa.exe
  C:\Windows\System\jkySvZa.exe
  2⤵
  PID:4428
- C:\Windows\System\BfiCqVX.exe
  C:\Windows\System\BfiCqVX.exe
  2⤵
  PID:5824
- C:\Windows\System\eoZAvEf.exe
  C:\Windows\System\eoZAvEf.exe
  2⤵
  PID:5832
- C:\Windows\System\SwheqEW.exe
  C:\Windows\System\SwheqEW.exe
  2⤵
  PID:14028
- C:\Windows\System\XvXFsoP.exe
  C:\Windows\System\XvXFsoP.exe
  2⤵
  PID:1256
- C:\Windows\System\bkcvTnh.exe
  C:\Windows\System\bkcvTnh.exe
  2⤵
  PID:14256
- C:\Windows\System\OgJawCG.exe
  C:\Windows\System\OgJawCG.exe
  2⤵
  PID:1888
- C:\Windows\System\BfPpGzM.exe
  C:\Windows\System\BfPpGzM.exe
  2⤵
  PID:13264
- C:\Windows\System\MIzSdJI.exe
  C:\Windows\System\MIzSdJI.exe
  2⤵
  PID:2972
- C:\Windows\System\MInzoJF.exe
  C:\Windows\System\MInzoJF.exe
  2⤵
  PID:3992
- C:\Windows\System\vfVfCXU.exe
  C:\Windows\System\vfVfCXU.exe
  2⤵
  PID:4032
- C:\Windows\System\lRXjcTZ.exe
  C:\Windows\System\lRXjcTZ.exe
  2⤵
  PID:3440
- C:\Windows\System\MkzQZmK.exe
  C:\Windows\System\MkzQZmK.exe
  2⤵
  PID:4016
- C:\Windows\System\XolxPez.exe
  C:\Windows\System\XolxPez.exe
  2⤵
  PID:4212
- C:\Windows\System\NRRzBuD.exe
  C:\Windows\System\NRRzBuD.exe
  2⤵
  PID:13640
- C:\Windows\System\tfoGWOb.exe
  C:\Windows\System\tfoGWOb.exe
  2⤵
  PID:14252
- C:\Windows\System\jpKMhAq.exe
  C:\Windows\System\jpKMhAq.exe
  2⤵
  PID:13368
- C:\Windows\System\hfudwOS.exe
  C:\Windows\System\hfudwOS.exe
  2⤵
  PID:13440
- C:\Windows\System\NszbbmF.exe
  C:\Windows\System\NszbbmF.exe
  2⤵
  PID:10600
- C:\Windows\System\tluzISD.exe
  C:\Windows\System\tluzISD.exe
  2⤵
  PID:3260
- C:\Windows\System\nUgWCHO.exe
  C:\Windows\System\nUgWCHO.exe
  2⤵
  PID:13404
- C:\Windows\System\sgboJOJ.exe
  C:\Windows\System\sgboJOJ.exe
  2⤵
  PID:5008
- C:\Windows\System\HNnhXPi.exe
  C:\Windows\System\HNnhXPi.exe
  2⤵
  PID:13868
- C:\Windows\System\KovtzQo.exe
  C:\Windows\System\KovtzQo.exe
  2⤵
  PID:13664
- C:\Windows\System\BBXxNQY.exe
  C:\Windows\System\BBXxNQY.exe
  2⤵
  PID:13584
- C:\Windows\System\POOdgrH.exe
  C:\Windows\System\POOdgrH.exe
  2⤵
  PID:4848
- C:\Windows\System\zmsOCmV.exe
  C:\Windows\System\zmsOCmV.exe
  2⤵
  PID:964
- C:\Windows\System\apAFVCA.exe
  C:\Windows\System\apAFVCA.exe
  2⤵
  PID:3012
- C:\Windows\System\BMmkmoe.exe
  C:\Windows\System\BMmkmoe.exe
  2⤵
  PID:540
- C:\Windows\System\EoinnFA.exe
  C:\Windows\System\EoinnFA.exe
  2⤵
  PID:13492
- C:\Windows\System\RoFviYQ.exe
  C:\Windows\System\RoFviYQ.exe
  2⤵
  PID:708
- C:\Windows\System\gJGBYZS.exe
  C:\Windows\System\gJGBYZS.exe
  2⤵
  PID:1428
- C:\Windows\System\YnEhQsD.exe
  C:\Windows\System\YnEhQsD.exe
  2⤵
  PID:13456
- C:\Windows\System\slobKBr.exe
  C:\Windows\System\slobKBr.exe
  2⤵
  PID:13956
- C:\Windows\System\aJHQVmA.exe
  C:\Windows\System\aJHQVmA.exe
  2⤵
  PID:1612
- C:\Windows\System\pTQfggW.exe
  C:\Windows\System\pTQfggW.exe
  2⤵
  PID:1660
- C:\Windows\System\mAIavvi.exe
  C:\Windows\System\mAIavvi.exe
  2⤵
  PID:14220
- C:\Windows\System\TNboHtk.exe
  C:\Windows\System\TNboHtk.exe
  2⤵
  PID:1944
- C:\Windows\System\NpHAVTM.exe
  C:\Windows\System\NpHAVTM.exe
  2⤵
  PID:3520
- C:\Windows\System\qajUakM.exe
  C:\Windows\System\qajUakM.exe
  2⤵
  PID:4964
- C:\Windows\System\kvrpTYf.exe
  C:\Windows\System\kvrpTYf.exe
  2⤵
  PID:13784
- C:\Windows\System\miKSDFJ.exe
  C:\Windows\System\miKSDFJ.exe
  2⤵
  PID:4180
- C:\Windows\System\NhnBmMt.exe
  C:\Windows\System\NhnBmMt.exe
  2⤵
  PID:4204
- C:\Windows\System\mwfTQjR.exe
  C:\Windows\System\mwfTQjR.exe
  2⤵
  PID:828
- C:\Windows\System\NCFWCEu.exe
  C:\Windows\System\NCFWCEu.exe
  2⤵
  PID:2196
- C:\Windows\System\WngBcWC.exe
  C:\Windows\System\WngBcWC.exe
  2⤵
  PID:6408
- C:\Windows\System\GhcaRia.exe
  C:\Windows\System\GhcaRia.exe
  2⤵
  PID:13756
- C:\Windows\System\bYoDxyo.exe
  C:\Windows\System\bYoDxyo.exe
  2⤵
  PID:3852
- C:\Windows\System\dtMCIyR.exe
  C:\Windows\System\dtMCIyR.exe
  2⤵
  PID:1676
- C:\Windows\System\YpYtWyp.exe
  C:\Windows\System\YpYtWyp.exe
  2⤵
  PID:1820
- C:\Windows\System\iFrEdKg.exe
  C:\Windows\System\iFrEdKg.exe
  2⤵
  PID:4080
- C:\Windows\System\sByrqxp.exe
  C:\Windows\System\sByrqxp.exe
  2⤵
  PID:5128
- C:\Windows\System\uRehmnN.exe
  C:\Windows\System\uRehmnN.exe
  2⤵
  PID:1408
- C:\Windows\System\MMjMJRG.exe
  C:\Windows\System\MMjMJRG.exe
  2⤵
  PID:928
- C:\Windows\System\tXYYqUD.exe
  C:\Windows\System\tXYYqUD.exe
  2⤵
  PID:14200
- C:\Windows\System\CbljBcj.exe
  C:\Windows\System\CbljBcj.exe
  2⤵
  PID:1508
- C:\Windows\System\jHAqozS.exe
  C:\Windows\System\jHAqozS.exe
  2⤵
  PID:1440
- C:\Windows\System\FPhmzey.exe
  C:\Windows\System\FPhmzey.exe
  2⤵
  PID:13376
- C:\Windows\System\tkcVxzO.exe
  C:\Windows\System\tkcVxzO.exe
  2⤵
  PID:4392
- C:\Windows\System\IuJYkbY.exe
  C:\Windows\System\IuJYkbY.exe
  2⤵
  PID:5124
- C:\Windows\System\clewEgj.exe
  C:\Windows\System\clewEgj.exe
  2⤵
  PID:3156
- C:\Windows\System\dAqBtbX.exe
  C:\Windows\System\dAqBtbX.exe
  2⤵
  PID:13316
- C:\Windows\System\pgrrnNG.exe
  C:\Windows\System\pgrrnNG.exe
  2⤵
  PID:5624
- C:\Windows\System\wkFdmUS.exe
  C:\Windows\System\wkFdmUS.exe
  2⤵
  PID:13564
- C:\Windows\System\LpZPuQB.exe
  C:\Windows\System\LpZPuQB.exe
  2⤵
  PID:5640
- C:\Windows\System\LVTcYdE.exe
  C:\Windows\System\LVTcYdE.exe
  2⤵
  PID:13736
- C:\Windows\System\imReZJO.exe
  C:\Windows\System\imReZJO.exe
  2⤵
  PID:13616
- C:\Windows\System\LkJrUmO.exe
  C:\Windows\System\LkJrUmO.exe
  2⤵
  PID:1268
- C:\Windows\System\ASmXMEn.exe
  C:\Windows\System\ASmXMEn.exe
  2⤵
  PID:5536
- C:\Windows\System\NVhxHzx.exe
  C:\Windows\System\NVhxHzx.exe
  2⤵
  PID:13920
- C:\Windows\System\DGlhBAu.exe
  C:\Windows\System\DGlhBAu.exe
  2⤵
  PID:5368
- C:\Windows\System\qGTKDwW.exe
  C:\Windows\System\qGTKDwW.exe
  2⤵
  PID:4892
- C:\Windows\System\BlMtLCw.exe
  C:\Windows\System\BlMtLCw.exe
  2⤵
  PID:5668
- C:\Windows\System\TbTWMAt.exe
  C:\Windows\System\TbTWMAt.exe
  2⤵
  PID:5708
- C:\Windows\System\WzyNVQc.exe
  C:\Windows\System\WzyNVQc.exe
  2⤵
  PID:5748
- C:\Windows\System\OloygXV.exe
  C:\Windows\System\OloygXV.exe
  2⤵
  PID:5772
- C:\Windows\System\vwaVDEe.exe
  C:\Windows\System\vwaVDEe.exe
  2⤵
  PID:512
- C:\Windows\System\nlBKLRC.exe
  C:\Windows\System\nlBKLRC.exe
  2⤵
  PID:12924
- C:\Windows\System\yHVFZzM.exe
  C:\Windows\System\yHVFZzM.exe
  2⤵
  PID:4216
- C:\Windows\System\vAapMAL.exe
  C:\Windows\System\vAapMAL.exe
  2⤵
  PID:5412
- C:\Windows\System\uFJiFKk.exe
  C:\Windows\System\uFJiFKk.exe
  2⤵
  PID:5676
- C:\Windows\System\dxhdCxb.exe
  C:\Windows\System\dxhdCxb.exe
  2⤵
  PID:4896
- C:\Windows\System\NUqBwPi.exe
  C:\Windows\System\NUqBwPi.exe
  2⤵
  PID:4140
- C:\Windows\System\JRRKmmK.exe
  C:\Windows\System\JRRKmmK.exe
  2⤵
  PID:13720
- C:\Windows\System\YwOLODH.exe
  C:\Windows\System\YwOLODH.exe
  2⤵
  PID:13856
- C:\Windows\System\TBbChVy.exe
  C:\Windows\System\TBbChVy.exe
  2⤵
  PID:5936
- C:\Windows\System\IDFKFNg.exe
  C:\Windows\System\IDFKFNg.exe
  2⤵
  PID:5400
- C:\Windows\System\UPmSYIK.exe
  C:\Windows\System\UPmSYIK.exe
  2⤵
  PID:5744
- C:\Windows\System\OFwAtkF.exe
  C:\Windows\System\OFwAtkF.exe
  2⤵
  PID:6028
- C:\Windows\System\ylBoOBI.exe
  C:\Windows\System\ylBoOBI.exe
  2⤵
  PID:4056
- C:\Windows\System\EnlSmVS.exe
  C:\Windows\System\EnlSmVS.exe
  2⤵
  PID:5656
- C:\Windows\System\zvKmPUo.exe
  C:\Windows\System\zvKmPUo.exe
  2⤵
  PID:13540
- C:\Windows\System\ZQzMeWf.exe
  C:\Windows\System\ZQzMeWf.exe
  2⤵
  PID:428
- C:\Windows\System\BMTQZny.exe
  C:\Windows\System\BMTQZny.exe
  2⤵
  PID:5808
- C:\Windows\System\yhmLeqQ.exe
  C:\Windows\System\yhmLeqQ.exe
  2⤵
  PID:4520
- C:\Windows\System\nVHYiwG.exe
  C:\Windows\System\nVHYiwG.exe
  2⤵
  PID:5968
- C:\Windows\System\pRVDtcg.exe
  C:\Windows\System\pRVDtcg.exe
  2⤵
  PID:5272
- C:\Windows\System\cwPRmvs.exe
  C:\Windows\System\cwPRmvs.exe
  2⤵
  PID:3284
- C:\Windows\System\WYDMewy.exe
  C:\Windows\System\WYDMewy.exe
  2⤵
  PID:5520
- C:\Windows\System\eUMAFud.exe
  C:\Windows\System\eUMAFud.exe
  2⤵
  PID:5208
- C:\Windows\System\xpDQiyo.exe
  C:\Windows\System\xpDQiyo.exe
  2⤵
  PID:5480
- C:\Windows\System\IjdgXln.exe
  C:\Windows\System\IjdgXln.exe
  2⤵
  PID:6068
- C:\Windows\System\lmTiXMS.exe
  C:\Windows\System\lmTiXMS.exe
  2⤵
  PID:13780
- C:\Windows\System\weKHvKH.exe
  C:\Windows\System\weKHvKH.exe
  2⤵
  PID:4280
- C:\Windows\System\PVehUTe.exe
  C:\Windows\System\PVehUTe.exe
  2⤵
  PID:2284
- C:\Windows\System\bjHXQxk.exe
  C:\Windows\System\bjHXQxk.exe
  2⤵
  PID:2860
- C:\Windows\System\qJpXcYr.exe
  C:\Windows\System\qJpXcYr.exe
  2⤵
  PID:5068
- C:\Windows\System\wWLZHrx.exe
  C:\Windows\System\wWLZHrx.exe
  2⤵
  PID:5384
- C:\Windows\System\oXyRDjZ.exe
  C:\Windows\System\oXyRDjZ.exe
  2⤵
  PID:12688
- C:\Windows\System\rIvfpDs.exe
  C:\Windows\System\rIvfpDs.exe
  2⤵
  PID:2388
- C:\Windows\System\rcWgnHT.exe
  C:\Windows\System\rcWgnHT.exe
  2⤵
  PID:2496
- C:\Windows\System\geZtcql.exe
  C:\Windows\System\geZtcql.exe
  2⤵
  PID:1784
- C:\Windows\System\nKAUVRx.exe
  C:\Windows\System\nKAUVRx.exe
  2⤵
  PID:5180
- C:\Windows\System\gRXWmHx.exe
  C:\Windows\System\gRXWmHx.exe
  2⤵
  PID:5324
- C:\Windows\System\OOjkJfa.exe
  C:\Windows\System\OOjkJfa.exe
  2⤵
  PID:5880
- C:\Windows\System\MjBPiZl.exe
  C:\Windows\System\MjBPiZl.exe
  2⤵
  PID:5712
- C:\Windows\System\OdqrHFy.exe
  C:\Windows\System\OdqrHFy.exe
  2⤵
  PID:5680
- C:\Windows\System\JPezeeW.exe
  C:\Windows\System\JPezeeW.exe
  2⤵
  PID:1392
- C:\Windows\System\xzdOpil.exe
  C:\Windows\System\xzdOpil.exe
  2⤵
  PID:6568
- C:\Windows\System\wnHennK.exe
  C:\Windows\System\wnHennK.exe
  2⤵
  PID:3216
- C:\Windows\System\prjvTpt.exe
  C:\Windows\System\prjvTpt.exe
  2⤵
  PID:6332
- C:\Windows\System\GByKDMQ.exe
  C:\Windows\System\GByKDMQ.exe
  2⤵
  PID:2896
- C:\Windows\System\OSGojKy.exe
  C:\Windows\System\OSGojKy.exe
  2⤵
  PID:2116
- C:\Windows\System\YzdQHJa.exe
  C:\Windows\System\YzdQHJa.exe
  2⤵
  PID:5596
- C:\Windows\System\LpDsBDk.exe
  C:\Windows\System\LpDsBDk.exe
  2⤵
  PID:6148
- C:\Windows\System\ELHgFKx.exe
  C:\Windows\System\ELHgFKx.exe
  2⤵
  PID:4824
- C:\Windows\System\oYpXMIb.exe
  C:\Windows\System\oYpXMIb.exe
  2⤵
  PID:6960
- C:\Windows\System\CeEzViw.exe
  C:\Windows\System\CeEzViw.exe
  2⤵
  PID:4844
- C:\Windows\System\veBZbAr.exe
  C:\Windows\System\veBZbAr.exe
  2⤵
  PID:6480
- C:\Windows\System\RkBQyRc.exe
  C:\Windows\System\RkBQyRc.exe
  2⤵
  PID:1324
- C:\Windows\System\whSEQHQ.exe
  C:\Windows\System\whSEQHQ.exe
  2⤵
  PID:7164
- C:\Windows\System\jmNrkdd.exe
  C:\Windows\System\jmNrkdd.exe
  2⤵
  PID:5268
- C:\Windows\System\XYHQXKj.exe
  C:\Windows\System\XYHQXKj.exe
  2⤵
  PID:1464
- C:\Windows\System\JALyGyM.exe
  C:\Windows\System\JALyGyM.exe
  2⤵
  PID:6400
- C:\Windows\System\KyZUgpa.exe
  C:\Windows\System\KyZUgpa.exe
  2⤵
  PID:6708
- C:\Windows\System\mVyRknu.exe
  C:\Windows\System\mVyRknu.exe
  2⤵
  PID:6772
- C:\Windows\System\onSDYSu.exe
  C:\Windows\System\onSDYSu.exe
  2⤵
  PID:3480
- C:\Windows\System\JWTmGwc.exe
  C:\Windows\System\JWTmGwc.exe
  2⤵
  PID:6200
- C:\Windows\System\JRNGMFC.exe
  C:\Windows\System\JRNGMFC.exe
  2⤵
  PID:6288
- C:\Windows\System\nlTqpOO.exe
  C:\Windows\System\nlTqpOO.exe
  2⤵
  PID:5036
- C:\Windows\System\JoOYggj.exe
  C:\Windows\System\JoOYggj.exe
  2⤵
  PID:6012
- C:\Windows\System\JpVODew.exe
  C:\Windows\System\JpVODew.exe
  2⤵
  PID:6104
- C:\Windows\System\frPyqHl.exe
  C:\Windows\System\frPyqHl.exe
  2⤵
  PID:7068
- C:\Windows\System\hnXbhno.exe
  C:\Windows\System\hnXbhno.exe
  2⤵
  PID:6596
- C:\Windows\System\qxSTBxy.exe
  C:\Windows\System\qxSTBxy.exe
  2⤵
  PID:7608
- C:\Windows\System\BLbYjaD.exe
  C:\Windows\System\BLbYjaD.exe
  2⤵
  PID:2644
- C:\Windows\System\FOaqmUv.exe
  C:\Windows\System\FOaqmUv.exe
  2⤵
  PID:7960
- C:\Windows\System\xGqwdPH.exe
  C:\Windows\System\xGqwdPH.exe
  2⤵
  PID:6132
- C:\Windows\System\JrBfclB.exe
  C:\Windows\System\JrBfclB.exe
  2⤵
  PID:7388
- C:\Windows\System\xRLrZcI.exe
  C:\Windows\System\xRLrZcI.exe
  2⤵
  PID:7172
- C:\Windows\System\GYaHnNc.exe
  C:\Windows\System\GYaHnNc.exe
  2⤵
  PID:5476
- C:\Windows\System\bOreLUT.exe
  C:\Windows\System\bOreLUT.exe
  2⤵
  PID:6888
- C:\Windows\System\fIRTdfm.exe
  C:\Windows\System\fIRTdfm.exe
  2⤵
  PID:14332
- C:\Windows\System\YDvCtwl.exe
  C:\Windows\System\YDvCtwl.exe
  2⤵
  PID:6228
- C:\Windows\System\nVDdrHQ.exe
  C:\Windows\System\nVDdrHQ.exe
  2⤵
  PID:7232
- C:\Windows\System\DWrwdiQ.exe
  C:\Windows\System\DWrwdiQ.exe
  2⤵
  PID:7044
- C:\Windows\System\kebsEGk.exe
  C:\Windows\System\kebsEGk.exe
  2⤵
  PID:6836
- C:\Windows\System\TBdVihu.exe
  C:\Windows\System\TBdVihu.exe
  2⤵
  PID:8556
- C:\Windows\System\DpusUmW.exe
  C:\Windows\System\DpusUmW.exe
  2⤵
  PID:7848
- C:\Windows\System\SrUfCrk.exe
  C:\Windows\System\SrUfCrk.exe
  2⤵
  PID:8008
- C:\Windows\System\PjZYjfN.exe
  C:\Windows\System\PjZYjfN.exe
  2⤵
  PID:7200
- C:\Windows\System\KKRZuSj.exe
  C:\Windows\System\KKRZuSj.exe
  2⤵
  PID:8860
- C:\Windows\System\innVlzJ.exe
  C:\Windows\System\innVlzJ.exe
  2⤵
  PID:8844
- C:\Windows\System\tAvyNrn.exe
  C:\Windows\System\tAvyNrn.exe
  2⤵
  PID:7980
- C:\Windows\System\FyPEgaA.exe
  C:\Windows\System\FyPEgaA.exe
  2⤵
  PID:8468
- C:\Windows\System\OEOuaff.exe
  C:\Windows\System\OEOuaff.exe
  2⤵
  PID:7500
- C:\Windows\System\xYJQQKc.exe
  C:\Windows\System\xYJQQKc.exe
  2⤵
  PID:8300
- C:\Windows\System\GYIluHh.exe
  C:\Windows\System\GYIluHh.exe
  2⤵
  PID:9092
- C:\Windows\System\EotJfiZ.exe
  C:\Windows\System\EotJfiZ.exe
  2⤵
  PID:7836
- C:\Windows\System\IjhWMoy.exe
  C:\Windows\System\IjhWMoy.exe
  2⤵
  PID:4512
- C:\Windows\System\GtYkjqX.exe
  C:\Windows\System\GtYkjqX.exe
  2⤵
  PID:9088
- C:\Windows\System\brbiBih.exe
  C:\Windows\System\brbiBih.exe
  2⤵
  PID:6732
- C:\Windows\System\uTanwFq.exe
  C:\Windows\System\uTanwFq.exe
  2⤵
  PID:7276
- C:\Windows\System\DtTwABH.exe
  C:\Windows\System\DtTwABH.exe
  2⤵
  PID:7952
- C:\Windows\System\bABuCDL.exe
  C:\Windows\System\bABuCDL.exe
  2⤵
  PID:14108
- C:\Windows\System\mLZEEUf.exe
  C:\Windows\System\mLZEEUf.exe
  2⤵
  PID:6884
- C:\Windows\System\bRgrpyQ.exe
  C:\Windows\System\bRgrpyQ.exe
  2⤵
  PID:9032
- C:\Windows\System\xsyMLtK.exe
  C:\Windows\System\xsyMLtK.exe
  2⤵
  PID:14364
- C:\Windows\System\yIElxlZ.exe
  C:\Windows\System\yIElxlZ.exe
  2⤵
  PID:14388
- C:\Windows\System\OmXpdng.exe
  C:\Windows\System\OmXpdng.exe
  2⤵
  PID:14412
- C:\Windows\System\ytJnZZk.exe
  C:\Windows\System\ytJnZZk.exe
  2⤵
  PID:14440
- C:\Windows\System\ebGaoSI.exe
  C:\Windows\System\ebGaoSI.exe
  2⤵
  PID:14476
- C:\Windows\System\VNgaJPg.exe
  C:\Windows\System\VNgaJPg.exe
  2⤵
  PID:14500
- C:\Windows\System\NbabrDW.exe
  C:\Windows\System\NbabrDW.exe
  2⤵
  PID:14528
- C:\Windows\System\lqdTxox.exe
  C:\Windows\System\lqdTxox.exe
  2⤵
  PID:14648
- C:\Windows\System\ofAzmSu.exe
  C:\Windows\System\ofAzmSu.exe
  2⤵
  PID:14676
- C:\Windows\System\ZlhMXYd.exe
  C:\Windows\System\ZlhMXYd.exe
  2⤵
  PID:14704
- C:\Windows\System\tGeSfnm.exe
  C:\Windows\System\tGeSfnm.exe
  2⤵
  PID:14744
- C:\Windows\System\BrFLMxn.exe
  C:\Windows\System\BrFLMxn.exe
  2⤵
  PID:14768
- C:\Windows\System\icjVFbQ.exe
  C:\Windows\System\icjVFbQ.exe
  2⤵
  PID:14796
- C:\Windows\System\LAPVCof.exe
  C:\Windows\System\LAPVCof.exe
  2⤵
  PID:14820
- C:\Windows\System\QrYjhQu.exe
  C:\Windows\System\QrYjhQu.exe
  2⤵
  PID:14844
- C:\Windows\System\tUejVRY.exe
  C:\Windows\System\tUejVRY.exe
  2⤵
  PID:14864
- C:\Windows\System\CiHHnIr.exe
  C:\Windows\System\CiHHnIr.exe
  2⤵
  PID:14888
- C:\Windows\System\reydTLS.exe
  C:\Windows\System\reydTLS.exe
  2⤵
  PID:14916
- C:\Windows\System\YCkYGAu.exe
  C:\Windows\System\YCkYGAu.exe
  2⤵
  PID:14936
- C:\Windows\System\YGTtWAL.exe
  C:\Windows\System\YGTtWAL.exe
  2⤵
  PID:14960
- C:\Windows\System\OdFwkHd.exe
  C:\Windows\System\OdFwkHd.exe
  2⤵
  PID:14988
- C:\Windows\System\EeGNCaj.exe
  C:\Windows\System\EeGNCaj.exe
  2⤵
  PID:15012
- C:\Windows\System\xEUFbbA.exe
  C:\Windows\System\xEUFbbA.exe
  2⤵
  PID:15044
- C:\Windows\System\dTbVvYw.exe
  C:\Windows\System\dTbVvYw.exe
  2⤵
  PID:15076
- C:\Windows\System\SIRZQKA.exe
  C:\Windows\System\SIRZQKA.exe
  2⤵
  PID:15188
- C:\Windows\System\AQkDgAV.exe
  C:\Windows\System\AQkDgAV.exe
  2⤵
  PID:15216
- C:\Windows\System\TzskZiw.exe
  C:\Windows\System\TzskZiw.exe
  2⤵
  PID:15244
- C:\Windows\System\yHfTzvG.exe
  C:\Windows\System\yHfTzvG.exe
  2⤵
  PID:15284
- C:\Windows\System\jtbwxjC.exe
  C:\Windows\System\jtbwxjC.exe
  2⤵
  PID:15312
- C:\Windows\System\cfTbzgk.exe
  C:\Windows\System\cfTbzgk.exe
  2⤵
  PID:15344
- C:\Windows\System\IlkvniG.exe
  C:\Windows\System\IlkvniG.exe
  2⤵
  PID:9404
- C:\Windows\System\Nxugnxu.exe
  C:\Windows\System\Nxugnxu.exe
  2⤵
  PID:8700
- C:\Windows\System\WVFdRzU.exe
  C:\Windows\System\WVFdRzU.exe
  2⤵
  PID:9496
- C:\Windows\System\KKIOigB.exe
  C:\Windows\System\KKIOigB.exe
  2⤵
  PID:7984
- C:\Windows\System\skEPxPm.exe
  C:\Windows\System\skEPxPm.exe
  2⤵
  PID:9372
- C:\Windows\System\lnpTYYt.exe
  C:\Windows\System\lnpTYYt.exe
  2⤵
  PID:9620
- C:\Windows\System\XakDtcI.exe
  C:\Windows\System\XakDtcI.exe
  2⤵
  PID:14568
- C:\Windows\System\mBGuFdO.exe
  C:\Windows\System\mBGuFdO.exe
  2⤵
  PID:13352
- C:\Windows\System\wnxWbOm.exe
  C:\Windows\System\wnxWbOm.exe
  2⤵
  PID:14604
- C:\Windows\System\FKwyzdD.exe
  C:\Windows\System\FKwyzdD.exe
  2⤵
  PID:9196
- C:\Windows\System\yazRBNa.exe
  C:\Windows\System\yazRBNa.exe
  2⤵
  PID:7728
- C:\Windows\System\ZPABWwo.exe
  C:\Windows\System\ZPABWwo.exe
  2⤵
  PID:14384
- C:\Windows\System\AhEOmyi.exe
  C:\Windows\System\AhEOmyi.exe
  2⤵
  PID:14672
- C:\Windows\System\DFgqiMb.exe
  C:\Windows\System\DFgqiMb.exe
  2⤵
  PID:9824
- C:\Windows\System\tVzOMBh.exe
  C:\Windows\System\tVzOMBh.exe
  2⤵
  PID:9768
- C:\Windows\System\yEggSQs.exe
  C:\Windows\System\yEggSQs.exe
  2⤵
  PID:14696
- C:\Windows\System\QOBgHSG.exe
  C:\Windows\System\QOBgHSG.exe
  2⤵
  PID:9792
- C:\Windows\System\MpoAlSU.exe
  C:\Windows\System\MpoAlSU.exe
  2⤵
  PID:9152
- C:\Windows\System\xqsEsSt.exe
  C:\Windows\System\xqsEsSt.exe
  2⤵
  PID:14928
- C:\Windows\System\HOPBAwK.exe
  C:\Windows\System\HOPBAwK.exe
  2⤵
  PID:8560
- C:\Windows\System\nysXHKO.exe
  C:\Windows\System\nysXHKO.exe
  2⤵
  PID:14832
- C:\Windows\System\qWnPkgp.exe
  C:\Windows\System\qWnPkgp.exe
  2⤵
  PID:9516
- C:\Windows\System\zoLbUxn.exe
  C:\Windows\System\zoLbUxn.exe
  2⤵
  PID:14884
- C:\Windows\System\bJTOVqS.exe
  C:\Windows\System\bJTOVqS.exe
  2⤵
  PID:15040
- C:\Windows\System\qKUYFwU.exe
  C:\Windows\System\qKUYFwU.exe
  2⤵
  PID:14792
- C:\Windows\System\rdNOnXU.exe
  C:\Windows\System\rdNOnXU.exe
  2⤵
  PID:9752
- C:\Windows\System\YVQDgqV.exe
  C:\Windows\System\YVQDgqV.exe
  2⤵
  PID:14840
- C:\Windows\System\DhDImva.exe
  C:\Windows\System\DhDImva.exe
  2⤵
  PID:9560
- C:\Windows\System\dhnZsrO.exe
  C:\Windows\System\dhnZsrO.exe
  2⤵
  PID:8728
- C:\Windows\System\EamoyGd.exe
  C:\Windows\System\EamoyGd.exe
  2⤵
  PID:15156
- C:\Windows\System\BgFyrar.exe
  C:\Windows\System\BgFyrar.exe
  2⤵
  PID:9468
- C:\Windows\System\XEzddpK.exe
  C:\Windows\System\XEzddpK.exe
  2⤵
  PID:15256
- C:\Windows\System\JDXcePx.exe
  C:\Windows\System\JDXcePx.exe
  2⤵
  PID:15136
- C:\Windows\System\NuykMhH.exe
  C:\Windows\System\NuykMhH.exe
  2⤵
  PID:10200
- C:\Windows\System\YskmtgH.exe
  C:\Windows\System\YskmtgH.exe
  2⤵
  PID:15024
- C:\Windows\System\QiYitkC.exe
  C:\Windows\System\QiYitkC.exe
  2⤵
  PID:15056
- C:\Windows\System\MKjTvmX.exe
  C:\Windows\System\MKjTvmX.exe
  2⤵
  PID:15168
- C:\Windows\System\eATQxZP.exe
  C:\Windows\System\eATQxZP.exe
  2⤵
  PID:6256
- C:\Windows\System\suoOoCG.exe
  C:\Windows\System\suoOoCG.exe
  2⤵
  PID:10180
- C:\Windows\System\lxbswMT.exe
  C:\Windows\System\lxbswMT.exe
  2⤵
  PID:14492
- C:\Windows\System\tOaouLp.exe
  C:\Windows\System\tOaouLp.exe
  2⤵
  PID:14508
- C:\Windows\System\jaMcoBf.exe
  C:\Windows\System\jaMcoBf.exe
  2⤵
  PID:10036
- C:\Windows\System\abHwvon.exe
  C:\Windows\System\abHwvon.exe
  2⤵
  PID:10072
- C:\Windows\System\DslaxvF.exe
  C:\Windows\System\DslaxvF.exe
  2⤵
  PID:4588
- C:\Windows\System\xJUccIK.exe
  C:\Windows\System\xJUccIK.exe
  2⤵
  PID:8572
- C:\Windows\System\akaBpjn.exe
  C:\Windows\System\akaBpjn.exe
  2⤵
  PID:14524
- C:\Windows\System\zHyqwza.exe
  C:\Windows\System\zHyqwza.exe
  2⤵
  PID:14932
- C:\Windows\System\loreJkl.exe
  C:\Windows\System\loreJkl.exe
  2⤵
  PID:9108
- C:\Windows\System\qvXRbEz.exe
  C:\Windows\System\qvXRbEz.exe
  2⤵
  PID:10060
- C:\Windows\System\NySreAa.exe
  C:\Windows\System\NySreAa.exe
  2⤵
  PID:10384
- C:\Windows\System\bJqucLm.exe
  C:\Windows\System\bJqucLm.exe
  2⤵
  PID:14584
- C:\Windows\System\TdXceyS.exe
  C:\Windows\System\TdXceyS.exe
  2⤵
  PID:6692
- C:\Windows\System\XdMTlhm.exe
  C:\Windows\System\XdMTlhm.exe
  2⤵
  PID:15036
- C:\Windows\System\JbuVLYX.exe
  C:\Windows\System\JbuVLYX.exe
  2⤵
  PID:9828
- C:\Windows\System\EhhzQMh.exe
  C:\Windows\System\EhhzQMh.exe
  2⤵
  PID:9844
- C:\Windows\System\nNcaaZp.exe
  C:\Windows\System\nNcaaZp.exe
  2⤵
  PID:10228
- C:\Windows\System\LVNeMod.exe
  C:\Windows\System\LVNeMod.exe
  2⤵
  PID:15204
- C:\Windows\System\FLSMwYv.exe
  C:\Windows\System\FLSMwYv.exe
  2⤵
  PID:9364
- C:\Windows\System\jPGzUBG.exe
  C:\Windows\System\jPGzUBG.exe
  2⤵
  PID:10300
- C:\Windows\System\adfaNXA.exe
  C:\Windows\System\adfaNXA.exe
  2⤵
  PID:9412
- C:\Windows\System\QxZvPZU.exe
  C:\Windows\System\QxZvPZU.exe
  2⤵
  PID:9360
- C:\Windows\System\mRDvoHS.exe
  C:\Windows\System\mRDvoHS.exe
  2⤵
  PID:10996
- C:\Windows\System\AvTawsg.exe
  C:\Windows\System\AvTawsg.exe
  2⤵
  PID:10008
- C:\Windows\System\QPDYDsW.exe
  C:\Windows\System\QPDYDsW.exe
  2⤵
  PID:10232
- C:\Windows\System\SyEwiKE.exe
  C:\Windows\System\SyEwiKE.exe
  2⤵
  PID:14468
- C:\Windows\System\yRhhFVk.exe
  C:\Windows\System\yRhhFVk.exe
  2⤵
  PID:8344
- C:\Windows\System\aUnauCT.exe
  C:\Windows\System\aUnauCT.exe
  2⤵
  PID:10760
- C:\Windows\System\zPBfubR.exe
  C:\Windows\System\zPBfubR.exe
  2⤵
  PID:15308
- C:\Windows\System\OxrClsd.exe
  C:\Windows\System\OxrClsd.exe
  2⤵
  PID:8952
- C:\Windows\System\ZYSlUnQ.exe
  C:\Windows\System\ZYSlUnQ.exe
  2⤵
  PID:8988
- C:\Windows\System\GvZYTLV.exe
  C:\Windows\System\GvZYTLV.exe
  2⤵
  PID:11424
- C:\Windows\System\kLejzVf.exe
  C:\Windows\System\kLejzVf.exe
  2⤵
  PID:9604
- C:\Windows\System\NoZvMeD.exe
  C:\Windows\System\NoZvMeD.exe
  2⤵
  PID:14360
- C:\Windows\System\oXptUVV.exe
  C:\Windows\System\oXptUVV.exe
  2⤵
  PID:7816
- C:\Windows\System\bbAfjMt.exe
  C:\Windows\System\bbAfjMt.exe
  2⤵
  PID:9980
- C:\Windows\System\QvgmaZs.exe
  C:\Windows\System\QvgmaZs.exe
  2⤵
  PID:9280
- C:\Windows\System\YsYYrIY.exe
  C:\Windows\System\YsYYrIY.exe
  2⤵
  PID:8032
- C:\Windows\System\lBUDhRk.exe
  C:\Windows\System\lBUDhRk.exe
  2⤵
  PID:8644
- C:\Windows\System\sMkrXKZ.exe
  C:\Windows\System\sMkrXKZ.exe
  2⤵
  PID:8660
- C:\Windows\System\ooNydSZ.exe
  C:\Windows\System\ooNydSZ.exe
  2⤵
  PID:14720
- C:\Windows\System\BabWBoa.exe
  C:\Windows\System\BabWBoa.exe
  2⤵
  PID:11404
- C:\Windows\System\Abpwidg.exe
  C:\Windows\System\Abpwidg.exe
  2⤵
  PID:14740
- C:\Windows\System\LHXtfGq.exe
  C:\Windows\System\LHXtfGq.exe
  2⤵
  PID:14976
- C:\Windows\System\CJuszPA.exe
  C:\Windows\System\CJuszPA.exe
  2⤵
  PID:9796
- C:\Windows\System\XrAdRJP.exe
  C:\Windows\System\XrAdRJP.exe
  2⤵
  PID:9956
- C:\Windows\System\rQYpeCB.exe
  C:\Windows\System\rQYpeCB.exe
  2⤵
  PID:11736
- C:\Windows\System\hGHleYM.exe
  C:\Windows\System\hGHleYM.exe
  2⤵
  PID:11164
- C:\Windows\System\FLyxoFq.exe
  C:\Windows\System\FLyxoFq.exe
  2⤵
  PID:12052
- C:\Windows\System\ltRcVcb.exe
  C:\Windows\System\ltRcVcb.exe
  2⤵
  PID:11628
- C:\Windows\System\gbbryRr.exe
  C:\Windows\System\gbbryRr.exe
  2⤵
  PID:15212
- C:\Windows\System\xNTalMn.exe
  C:\Windows\System\xNTalMn.exe
  2⤵
  PID:9652
- C:\Windows\System\yLWxahu.exe
  C:\Windows\System\yLWxahu.exe
  2⤵
  PID:8252
- C:\Windows\System\hGWsGCB.exe
  C:\Windows\System\hGWsGCB.exe
  2⤵
  PID:14816
- C:\Windows\System\TnCLiGG.exe
  C:\Windows\System\TnCLiGG.exe
  2⤵
  PID:10104
- C:\Windows\System\xapJfFX.exe
  C:\Windows\System\xapJfFX.exe
  2⤵
  PID:8324
- C:\Windows\System\OxVbGPg.exe
  C:\Windows\System\OxVbGPg.exe
  2⤵
  PID:9336
- C:\Windows\System\bZdziJK.exe
  C:\Windows\System\bZdziJK.exe
  2⤵
  PID:11080
- C:\Windows\System\daHRWmQ.exe
  C:\Windows\System\daHRWmQ.exe
  2⤵
  PID:9584
- C:\Windows\System\CtHhQCY.exe
  C:\Windows\System\CtHhQCY.exe
  2⤵
  PID:10504
- C:\Windows\System\jneOJos.exe
  C:\Windows\System\jneOJos.exe
  2⤵
  PID:13220
- C:\Windows\System\DZFkpFm.exe
  C:\Windows\System\DZFkpFm.exe
  2⤵
  PID:14344
- C:\Windows\System\ipeWepK.exe
  C:\Windows\System\ipeWepK.exe
  2⤵
  PID:8224
- C:\Windows\System\DkQBwYH.exe
  C:\Windows\System\DkQBwYH.exe
  2⤵
  PID:9060
- C:\Windows\System\dtDgdMZ.exe
  C:\Windows\System\dtDgdMZ.exe
  2⤵
  PID:10744
- C:\Windows\System\oxfPOGv.exe
  C:\Windows\System\oxfPOGv.exe
  2⤵
  PID:15104
- C:\Windows\System\DZhVbMl.exe
  C:\Windows\System\DZhVbMl.exe
  2⤵
  PID:13280
- C:\Windows\System\vkCettF.exe
  C:\Windows\System\vkCettF.exe
  2⤵
  PID:10888
- C:\Windows\System\gjoBWnl.exe
  C:\Windows\System\gjoBWnl.exe
  2⤵
  PID:10736
- C:\Windows\System\EuNlZmO.exe
  C:\Windows\System\EuNlZmO.exe
  2⤵
  PID:11212
- C:\Windows\System\GLjxbkG.exe
  C:\Windows\System\GLjxbkG.exe
  2⤵
  PID:12244
- C:\Windows\System\NuxkGNw.exe
  C:\Windows\System\NuxkGNw.exe
  2⤵
  PID:14520
- C:\Windows\System\wcLNdHZ.exe
  C:\Windows\System\wcLNdHZ.exe
  2⤵
  PID:10208
- C:\Windows\System\TMXEKgX.exe
  C:\Windows\System\TMXEKgX.exe
  2⤵
  PID:14484
- C:\Windows\System\bPIbsoU.exe
  C:\Windows\System\bPIbsoU.exe
  2⤵
  PID:10148
- C:\Windows\System\vgzyyyU.exe
  C:\Windows\System\vgzyyyU.exe
  2⤵
  PID:12872
- C:\Windows\System\ZSzkRBq.exe
  C:\Windows\System\ZSzkRBq.exe
  2⤵
  PID:6296
- C:\Windows\System\DcXfBPj.exe
  C:\Windows\System\DcXfBPj.exe
  2⤵
  PID:7860
- C:\Windows\System\FRdzdkq.exe
  C:\Windows\System\FRdzdkq.exe
  2⤵
  PID:10076
- C:\Windows\System\bdEvEOq.exe
  C:\Windows\System\bdEvEOq.exe
  2⤵
  PID:940
- C:\Windows\System\bWzwfQa.exe
  C:\Windows\System\bWzwfQa.exe
  2⤵
  PID:7756
- C:\Windows\System\oTGavEJ.exe
  C:\Windows\System\oTGavEJ.exe
  2⤵
  PID:14616
- C:\Windows\System\PdIatcT.exe
  C:\Windows\System\PdIatcT.exe
  2⤵
  PID:15008
- C:\Windows\System\HfPbuMo.exe
  C:\Windows\System\HfPbuMo.exe
  2⤵
  PID:12432
- C:\Windows\System\iowxGck.exe
  C:\Windows\System\iowxGck.exe
  2⤵
  PID:9448
- C:\Windows\System\CqGxIAg.exe
  C:\Windows\System\CqGxIAg.exe
  2⤵
  PID:5852
- C:\Windows\System\uEXtPbt.exe
  C:\Windows\System\uEXtPbt.exe
  2⤵
  PID:13100
- C:\Windows\System\DlVZvrG.exe
  C:\Windows\System\DlVZvrG.exe
  2⤵
  PID:12932
- C:\Windows\System\PZHKQTP.exe
  C:\Windows\System\PZHKQTP.exe
  2⤵
  PID:11020
- C:\Windows\System\NUIwueY.exe
  C:\Windows\System\NUIwueY.exe
  2⤵
  PID:10852
- C:\Windows\System\kpPOfia.exe
  C:\Windows\System\kpPOfia.exe
  2⤵
  PID:10108
- C:\Windows\System\ffTwQPN.exe
  C:\Windows\System\ffTwQPN.exe
  2⤵
  PID:12908
- C:\Windows\System\xEIwqTt.exe
  C:\Windows\System\xEIwqTt.exe
  2⤵
  PID:15356
- C:\Windows\System\CBdagSl.exe
  C:\Windows\System\CBdagSl.exe
  2⤵
  PID:15272
- C:\Windows\System\NNfheAZ.exe
  C:\Windows\System\NNfheAZ.exe
  2⤵
  PID:15264
- C:\Windows\System\uGheAbD.exe
  C:\Windows\System\uGheAbD.exe
  2⤵
  PID:11496
- C:\Windows\System\NySvvRd.exe
  C:\Windows\System\NySvvRd.exe
  2⤵
  PID:7796

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:14004

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:13408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pfqlofh1.fo2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BPBXXKN.exe

Filesize
2.2MB

MD5
b5ca53d9c63594112cf403871876fa6b

SHA1
0941cccb9f3375c68996e70610f2eba1a49e7204

SHA256
e0280fd0ae588f5567285ee9e6892ad7e95706edece9a2bb1f253d09ba5c2b2a

SHA512
d12f7d040ad6f5a514848df49d91cbdeb000c4d883a5aff9f66404fad9ab81fa495b1f5f4fb1d5b0441018252ddb2748b294a987767ed8e68a72dcca508787f4

Download Submit
C:\Windows\System\BQcqaSR.exe

Filesize
2.2MB

MD5
d9f05b9f0921e16cc59f9d1ae6c55106

SHA1
aa340158851d4fa2b12d6d08fcb3b2bc169fc884

SHA256
c60dfb614cc6be2b84ba4b9f4d66bb3073b75c46d95c922d3cfd902d62186065

SHA512
d0328d782464511e8aaa9be6085f2c097c215037f7570e897ee777a7dda5e8c86f789eb064f32aceddf94cdfa720db72a458b207f035472493c9045e125b44d5

Download Submit
C:\Windows\System\ExbVuCp.exe

Filesize
2.2MB

MD5
959798ef8774e24bfb2725add054bf27

SHA1
5c123f5de83d886c4f7c6a3ea3d754c24ea5c398

SHA256
6fff5d62a453463f2bfe1e1da7a380672ca389e686cea5c2d50055268752c336

SHA512
45e4c727a1f92cdaec1198d65ac4877dc1239660343d28b2239890509073a4e0a2891acb160391293b7b1bcfeb6e4936430007670dd41caf9bf460e7a2ae0b0f

Download Submit
C:\Windows\System\FSteMTK.exe

Filesize
2.2MB

MD5
efea910556a765e7e296a310403b0626

SHA1
40fdfe64bce97dd9b22635f9500f95dfae8c68c8

SHA256
c688a4a438385894619b17fc13cfedc992fc208d405ffdf66c198601da71236f

SHA512
7272d04bcaf591151f381529896cd4ecbb0974d0a0097a2ada3a19d23a3582561d08df1f0a3b98c70ab2991c7460db15ef443e0236664938ce85c302fca575d7

Download Submit
C:\Windows\System\IksOXEu.exe

Filesize
2.2MB

MD5
bd3286b3049d2c823963db41289c8433

SHA1
461b42575831b79ef2fc6b1d3a970ec30dbcdee7

SHA256
60c9992a3cf30d72c5da1650557027a0f845249e1d95a0e23bbd0624765fcf2e

SHA512
ef1e77a6417a78559cbb16b99af9013af11895e0fb0968db4033935710d6a441f27f7e20f4d07bd5313cd6b1a186586d8aca983c4e426f94198f1177dca83832

Download Submit
C:\Windows\System\KXRDOkz.exe

Filesize
2.2MB

MD5
98afdb5ef0362be054614c0cf393dfc7

SHA1
52127cf5c22a8ea90e04da8b1b2834abf52433af

SHA256
be38d7fabbd0d64eac2bad3d709f90f32d54fe85b2901a537f69da9781642a51

SHA512
400ad858b3a903a7c38199be9f9c42d0381303684426ef680a1d9913abeb21d901b9f4f4f7340ab037a8a9063d2d6d8de3febbce424c74378f2d2b64bb4dab65

Download Submit
C:\Windows\System\LFYCRuM.exe

Filesize
2.2MB

MD5
efae0d535ff011c151dd88209e21bdd9

SHA1
3a28df734db155040cb4830157e8f17d54a72251

SHA256
130953547986e0a3723fbd9e2e2b2b0be27212ff82e4b3d1bc090a3ffc3e0a03

SHA512
3e9c1b974a0434292bfa8678677b1db60771af0d2c9d333cd5f8c6945970071abfd03fb8bd0e155b7d9c5169e036e86fd386c02be707757b8e0947aa85aff5cb

Download Submit
C:\Windows\System\Lvbwzgy.exe

Filesize
2.2MB

MD5
afddb5564f4cc2b1cb298fae265c2c59

SHA1
7e3c2419251242e6a98ffb33ce2fdfeeb8aa65c4

SHA256
a45b1c7fa28a2b20af807b4dd46b2874583986e27c02995622adc943df518d15

SHA512
a34be97d2426a8aa55ad893a99523966714c99ab6f5ed0be079e6652edd85091403ee7980b11dd6a3a79b872332155305f8e4f4cf9989376e2e04797556bb74d

Download Submit
C:\Windows\System\MAGnifT.exe

Filesize
2.2MB

MD5
2349d9392f1d68f6af26211c4dabb671

SHA1
6e3b2bcb35a00b737efed6ab6f3fd147069efa56

SHA256
398718714f63fc8427bf2f6e35ee98600fe04c71e7367d3cede316a07b9f2a6a

SHA512
e95c73f55700fd3eeb11812984cf93195149c6d390f4f210a78d92a8c8da4a8a79a8116dc404f2471f8dd9dc5beeecc052879869d7d526611940d8ed552f0bd3

Download Submit
C:\Windows\System\MiXhKMw.exe

Filesize
2.2MB

MD5
0267f3b18d6aa77a9b94a26827f2d323

SHA1
af06d4f8aad7a35e3b532466e646ed28d8489a41

SHA256
dbf7ea998043d5fa991834325d5248eda63e9d0161cda15b29d212b1b0dbe6c7

SHA512
b57a2626d1310a139a1252b63b3985622374870404ccf37da987b49d5dd516b80f54899cb24a2b2b12ab34bab88dc0c40e2d1bd4fe639cf92c9537449ff958a8

Download Submit
C:\Windows\System\NXDCrgz.exe

Filesize
2.2MB

MD5
ed6b0eaef8b57bad5c9538eef44db9f7

SHA1
f81a63360c94c576b3ae75e8527ab148df404af1

SHA256
7b360cec9277b835ce2101a427e5a855c2509c0ded35a33525bc426bc168e405

SHA512
e5e060e81e3787da25c82b30acfd16849db839dff859bb6573aff0e345060b1f9a8c96f9c6dc19be59ce80524fd2abf6c7f7e12bf013d0071ff5441251fce550

Download Submit
C:\Windows\System\NdjhBuo.exe

Filesize
2.2MB

MD5
770bc234e7db324b07aa8b90773fe38b

SHA1
3d086e82fc920a4b6aa831f8ce95754953c77cec

SHA256
b236fc18160dacb587bb58b79d1c376bb7ecb1ebb679393ae3098179d7649e57

SHA512
61696d65d967ee2b26388b423818348fe843e90fb9d96e85aa12c6482963008dd60282f8d4923d337e82c29ff01570e0aa66f4b846e2f46e49eae6117c59ddfd

Download Submit
C:\Windows\System\PpbTqxu.exe

Filesize
2.2MB

MD5
aefef018730c0752e3bda8b47ca04df4

SHA1
1fc32a88179629f87154da19371436c2703424c0

SHA256
67bf3178ef57055ae62812f56a88c897e6cd06ee28b137d5dc523137add88adb

SHA512
e4110ff554b0243d698ebfc1739879efa2b76252406f1bb7b9c86f88acb550778fb60227fc2b30699cabc1988bdfc79e933b044c39b6b832db9ed76d22b45465

Download Submit
C:\Windows\System\SmxAAFC.exe

Filesize
2.2MB

MD5
b0920d20fc0dc53fddc6add1ec3e7048

SHA1
b70ce9187eec8786f7fe863ad87bf395d04a36e4

SHA256
2093829d2736971f7b16624ce0ef39b102cb25bb1b5243902fc34bf9f07659f6

SHA512
7dd2a0ab63cc043013a6bfe1e23ecf5fb150d9ac138d1edd3afaebb32d721931b2b13b1ac68b278b19a50653dee1434818bc690bff64050785f5daac54063e54

Download Submit
C:\Windows\System\SpnjkCh.exe

Filesize
2.2MB

MD5
8b66877173a05c3a3b962c1d4c102f7a

SHA1
79ff01c6bd9afb760b484f8de6baa0a212502308

SHA256
405b3e242acfa6f0fafeb458b7eb9179479e9d17772ba0168361cbc2d0542be9

SHA512
92472e3a57a3e5215e012da1a99d1e222c3cea515535b9a1a4305b28131121acaf1b27ff71b30b069e78177ae0de22a8670ae37b52c72b8bc4de03bc169dde8b

Download Submit
C:\Windows\System\SynxWzT.exe

Filesize
18B

MD5
35bde48c57b79a5e0ea0718733e62371

SHA1
41d2e344c30d7af2c472ba7a6ded43f0a9d6d4c2

SHA256
407b155a736cda52f1eb2b18d7fea9e028f3f4f796230535df591f3124a679c0

SHA512
a6c519b6e0f42a0f961fc4c0161e01dfb018e01d40d6b50a2a61a6cfeffa9e0fa78a3d1bb24269ec827e815cd0942de8d545ba7f93aa13de1bab78f87b543dba

Download Submit
C:\Windows\System\TXHZvrP.exe

Filesize
2.2MB

MD5
c515ee31f4176486bc05a3e14d875f32

SHA1
ef0149cb2ad1852e8eeb312dccb99caf485aec71

SHA256
5daca8de0484ab242867d1d992f3cab0c41c6e97f4b573f9c56927c12cd3de96

SHA512
3976331afbe712471dacbdea9b2b77bd171b917c2c2c9a939b12c8c954d65545fda60e5bf266f6bb75cb0f6844f2922cc4ce702e59cd12a1ee8513e7a4a95fe8

Download Submit
C:\Windows\System\VyABBre.exe

Filesize
2.2MB

MD5
310aff5f73dec982ba4bc34f0902109a

SHA1
3c71286b6572416f37fdf5dcfd239a1f4ab5a31f

SHA256
fe824bfcc3071ca0e7ae3cf67e6d36862aeb2d5eff193e4a73f7ee58c63844e2

SHA512
ea388afab4c0c3fd13564dfa8a7cb9e6b12103610d1a1edab3f308ef0c3277815f67ae9a22d414dea7256e58711ebc2fdfd85479bc0d6efbe02db32066bc8470

Download Submit
C:\Windows\System\WWBqvMb.exe

Filesize
2.2MB

MD5
e2df5ad7d340aaccbff56f3eccf38e6f

SHA1
507f32593a3730a29a9cd94e8de98990de937993

SHA256
961784b5ef3f2d515aedc0320bed992da8bc8e5eb5cd4db5c398cfc9afe76e8a

SHA512
b40215665449c7624db7304e363a76a88f133e909d2e4c62f2414f62ae01a18100463faa45fd00ba0bdc77acfa43125506874f0b517d2bc4b4d11c632bc92583

Download Submit
C:\Windows\System\bGCVkxv.exe

Filesize
2.2MB

MD5
328434c8562b90fa3ad148fe6320e324

SHA1
45e51c5f1d4822f340ff9a34c938dedb0ce2cb24

SHA256
5571af2f4154e452692b29ddcb583abc1513da19a9f5b706903b40c7d756995a

SHA512
5e2d471a28721be2750e21c5e5ea18e2d9877198a09d713b33c566a29e5478165cb9f66ff02cf367829d59b7571e91edefb6c5a2b42adc4f9fa437f5c7974a98

Download Submit
C:\Windows\System\ejkYizZ.exe

Filesize
2.2MB

MD5
8155b2c0e88ad80084c595286bfe7eb6

SHA1
1c27946f90e9682f067daf272601e50d0c1d2307

SHA256
8ba59b7816d105fbe61eed59173be6cfe609d2260d870f3ede9e6744f3028b06

SHA512
5d204504c5938ea9d4c299ecd6df4251c4a6a18e3830c81dca73cb3cceab00f2c6ea4e7e12b14d00c82ca4c2decfaae2b9a383a93cc987fcae27c3197e1b9d08

Download Submit
C:\Windows\System\ezOPelU.exe

Filesize
2.2MB

MD5
3dd9bd0bd798989ba5114eae4ddef1f5

SHA1
37751a83e89afccbf0f8b793817b66d7825b8023

SHA256
a06782be70c350e1cd618e9c5f65987151564875b6d166b702826ffbe391a356

SHA512
1fb48dad8767c4717f3759a70d6fed860fbf95fd3fc12f97e98935e5e1552782b7c16de3dd9a9bac25533ccfbfc83bf6cd2629e68b272f45c4b7a54284ada88a

Download Submit
C:\Windows\System\hbSYERt.exe

Filesize
2.2MB

MD5
d1c2b4c4a299840f70803d3a4d8abd90

SHA1
8a60ec7dd1fb8eb44741aaae691fc8d5c99f0829

SHA256
60a78050e2388b2f4fffb2f0f58ce755a8a34195ddeee6ea1cef50fbd7304f51

SHA512
a31dbba5cce9a95b651d367100e9f123ac870ca7a1c54986b182cebbb980f4262ff33ac02231f4dd5f381c99d64d06a2958c5e61495254c6184179828160cd15

Download Submit
C:\Windows\System\izgDVZR.exe

Filesize
2.2MB

MD5
5e8834804f8f5b0a385ebb8de70c0f3e

SHA1
a4645b6e9b23897fd9aed9671543ff07ce1432ab

SHA256
57dbefcd71b8903a7414545db978f35fa5fc94c3eb54e5b23bf164a0e83ddf0d

SHA512
b88bc700d293ee4d55961ec283c9dbe83d3e6b1f1944068988caa74f928792a370a26b402af71fe7387ef5fdbf285b7a0659e754acd917b64a06b5e0457a5635

Download Submit
C:\Windows\System\jzTlMps.exe

Filesize
2.2MB

MD5
d0f066b76090d1fa2951f964c659721a

SHA1
13ff397193b6c28882d31d05964f697ae45c3047

SHA256
1ff965a97b5110d9da9de56434709566c2c2527a5bd693bb30bfaa4464cdf8de

SHA512
e70f6680333fd9089ce6b1ec01c35841b8a0e3f084d49adbc9532b9661294834a2d95288f1e0444f25c549e2c2c0d26f1a1dea2f0d990fd476b28e68d4c9155e

Download Submit
C:\Windows\System\loAwKfR.exe

Filesize
2.2MB

MD5
84ef228cf066b8b0dc93aec04d92245f

SHA1
5069c6f3886ad36d8efaab1b494ac79f876c9c61

SHA256
41699d4aa58ac2bf1b2a181ceee4a4131a214ebe5c7d09d91fe224edf9eaa28e

SHA512
79c126534019390991c7e47b8669fe928d5624b18c75b73fd7e1697d336be0acf7b50f775fe5d57ba79e8020c5247624dd1a5cecf921c3d5782abf00d5875eae

Download Submit
C:\Windows\System\mtklcrk.exe

Filesize
2.2MB

MD5
c06d8ac17edb59dfe78aff63be22e490

SHA1
0ea1eeafc097d9a164630349e8b9de84999c9c64

SHA256
453a6b1e28d0471cbec38d436bbd54b10ec71cf0a55fd752061f275990bb9166

SHA512
e3251429b71eb68638467648b6fd65819d74e08f342f2d4c1dd4bd2c764395230bcf78e658cd3422cc8f0cb3423e38bac15a70873c9a21fecda21e3b47e92b19

Download Submit
C:\Windows\System\mvluWAp.exe

Filesize
2.2MB

MD5
c4ab8f3ddb24fa57f84c67a7d599f864

SHA1
1b96f34760a709f56ea36484c466b6bf5ef394bf

SHA256
2ab3b9c36dd26b3e71804af214ff117583028cd48d716b9e17d3f9993d0f59e3

SHA512
4a9b2accc180b5bed5789a52aad976852dacb1e0d0a8ffa59b96578dc62f4846ccdf7b54d1d6f0bee535f4ca1932bd7e6d43f7957d42de56649a0994308ae1a6

Download Submit
C:\Windows\System\pgGWeQO.exe

Filesize
2.2MB

MD5
94b858bf9448b75090b8db4a09c4371c

SHA1
63ed9ab7c6e9e6481c11bd6452c0a363ad718898

SHA256
4dc166dd3ea59b8052b66d48f4161a56751e8b721dd3392a1b29d9d179e22c9e

SHA512
8bf89b4cd23da06b1bd3983f8074467ac601b2255df09e983718248c35c37598e2d61d1a4d41b41b1cf7bbc580a5b5b5196922f80b326893ff8f3fcc29a331b3

Download Submit
C:\Windows\System\poPDPRL.exe

Filesize
2.2MB

MD5
81e32495bf19e4e3a60ba6dd449352af

SHA1
b678bddc62d1758cc78818ebb0fc8e312ef33194

SHA256
9f53673e2634e39ee83ca07ac7d84112f907be00d400ac4d47f31028fc6f2e00

SHA512
8c1daee474a9d99d55d802d16d257f716a36d74ac1e334076bfe7faaf6727d5cdcfbe0759e04c080cf45a8b63f6e23d143b3b06acb01f4f08e56911fc357fde7

Download Submit
C:\Windows\System\qtuixsY.exe

Filesize
2.2MB

MD5
224fb230428f92945c316564b834243f

SHA1
d09216874204b03e06e1a9adb6843547015a271e

SHA256
b465dcbee3c734ec1573dc2e9e798fe5f14f5a6cc34e9e8eed4335764bc9a58a

SHA512
c5877ab35f26a1891103313dabd1d5094f413810bf1d81c3b870dd9b8e67e44c89f4c819b4af8ca981afe2156fe8784fc5b85e30b5cc2766d3833d5f1c6c36be

Download Submit
C:\Windows\System\rWpAqhg.exe

Filesize
2.2MB

MD5
5f73f69e01072497005c833d5dfdd3c9

SHA1
1f7d208e7dec218793bb321ca04b94c5854d0cb5

SHA256
ce6388a88650386a631b667d839472fb5266e56ec69cec7ed5928743f1a984bf

SHA512
28c186831e677990ee6210e9630ebea56d0d1f883b19bf9be5d888f0ea6c21ef4e2a39c6580a83437cb969950b8913665a03d3a2cc60a715aded52906bcdb1ed

Download Submit
C:\Windows\System\rdnorxM.exe

Filesize
2.2MB

MD5
2d769ac8bdc6f2d2d8c716a3d31aae94

SHA1
7a9e5191263fff61f9eb82997f84c63fb5e851ae

SHA256
243eb11778e41740e3533bde28088ca3dbbfb91226e89f2d3f1b5a2090e0a202

SHA512
6ec9a4f7f617cd8f48d1636dfc264ee51fe1bf69159f605c69298e80256733ad820f5f0ac7cc2a205758397a929b0fa516d3d7484a8600d03895cb4879672c1d

Download Submit
C:\Windows\System\rvaSpFd.exe

Filesize
2.2MB

MD5
cb3421ae92f7546553d7faf281549222

SHA1
a0c6cc1e7f51e1536dc62cadaad38c3cece5f2d3

SHA256
c06168b6570a18c462d36bc1bb8c972355428be4bb3c8e50b9b246db7c9e6806

SHA512
9d08c366fe7c1b57d7d5ff2d2e049452f95f6b5d5898ffe4b7f9b652a19f58ae85fb331c9e376ca670c77cd07486587763836c1cd9d2f3c44332235a6949eedb

Download Submit
C:\Windows\System\wexjzHS.exe

Filesize
2.2MB

MD5
4f30dbf4d44375e3aeda61e88a5a5304

SHA1
d8cb136aa2eba22a17e06b36f961bd339493549c

SHA256
943edac648c7a58b72f59377c3fddc9ce1325cdca51c08ab6086d30ff4246428

SHA512
5decb88e04e615783ecd41761d07cb9459093f27d70fbc992d1113538f3bb06c0456ca343713f4ffe4da48134fc9cb182d67db93a590217600b123f79b556d5e

Download Submit
C:\Windows\System\yXgbKUN.exe

Filesize
2.2MB

MD5
47a92bc9a438f66861ed49c67b204642

SHA1
4b45021d37b24863c6fed3d7dcdc6f24b21c513d

SHA256
3d35f1e1b1926f7a2873483ebebb40f0e5d379ec4ec7f2157a365ea3454bbd4b

SHA512
62308ff4cec66b766b3b5057b8ed743813f69735f93ba0896c840fbce65d26bdee5274169eab921fa1489a9c2c791d4477091c8be82e56d79f63c3d40417fef4

Download Submit
C:\Windows\System\zaRoGHI.exe

Filesize
2.2MB

MD5
aca31c2fb344b8d5622ca1a85809e004

SHA1
72da772e66bb348e020260decfdb258f9f8749d6

SHA256
86d6cca2420de0c4e63103e16b2cc127aed4977cbc78e969a518cd243e025c8f

SHA512
eb327702b489535c0189d9d5aef964318a229f95170f0c2549da34f69db9bd083bf6019dac5543ece28b75bec9e99e26179bb54ceb9b8eff7d67f085b5e95e6c

Download Submit
C:\Windows\System\zfpwQLQ.exe

Filesize
2.2MB

MD5
d1b7a90f7206ba647fffe1e796f39a04

SHA1
0a4a0d99877f4b7e8b71135eb1bd5d870ba20c41

SHA256
01bfa30ea073581f333a6e2248a8489a33d22fecc86d84cae26671b74f5eea9f

SHA512
0a602b0ad5da61ab47dfa61024dbe8bf8c61e8b2a82d5a1f0845b08d59b410fcaa6fcfc2080743a2c92f6271ff07765511faaa092513539d73f07755918f397a

Download Submit
memory/584-81-0x000001EC6AFE0000-0x000001EC6AFF0000-memory.dmp

Filesize
64KB

Download
memory/584-76-0x00007FFF6CD40000-0x00007FFF6D801000-memory.dmp

Filesize
10.8MB

Download
memory/584-82-0x000001EC6AFE0000-0x000001EC6AFF0000-memory.dmp

Filesize
64KB

Download
memory/584-260-0x000001EC6AFA0000-0x000001EC6AFC2000-memory.dmp

Filesize
136KB

Download
memory/1008-18-0x00007FF69E870000-0x00007FF69EC62000-memory.dmp

Filesize
3.9MB

Download
memory/1488-4363-0x00007FF7E4010000-0x00007FF7E4402000-memory.dmp

Filesize
3.9MB

Download
memory/1488-201-0x00007FF7E4010000-0x00007FF7E4402000-memory.dmp

Filesize
3.9MB

Download
memory/1596-4486-0x00007FF77A220000-0x00007FF77A612000-memory.dmp

Filesize
3.9MB

Download
memory/1596-293-0x00007FF77A220000-0x00007FF77A612000-memory.dmp

Filesize
3.9MB

Download
memory/1684-143-0x00007FF7477C0000-0x00007FF747BB2000-memory.dmp

Filesize
3.9MB

Download
memory/1684-4368-0x00007FF7477C0000-0x00007FF747BB2000-memory.dmp

Filesize
3.9MB

Download
memory/1696-0-0x00007FF7DCFB0000-0x00007FF7DD3A2000-memory.dmp

Filesize
3.9MB

Download
memory/1696-1-0x000002748C7F0000-0x000002748C800000-memory.dmp

Filesize
64KB

Download
memory/1724-4491-0x00007FF66A510000-0x00007FF66A902000-memory.dmp

Filesize
3.9MB

Download
memory/1724-292-0x00007FF66A510000-0x00007FF66A902000-memory.dmp

Filesize
3.9MB

Download
memory/1840-294-0x00007FF6E34E0000-0x00007FF6E38D2000-memory.dmp

Filesize
3.9MB

Download
memory/1840-4492-0x00007FF6E34E0000-0x00007FF6E38D2000-memory.dmp

Filesize
3.9MB

Download
memory/2280-296-0x00007FF7C6240000-0x00007FF7C6632000-memory.dmp

Filesize
3.9MB

Download
memory/2280-4366-0x00007FF7C6240000-0x00007FF7C6632000-memory.dmp

Filesize
3.9MB

Download
memory/2620-287-0x00007FF736440000-0x00007FF736832000-memory.dmp

Filesize
3.9MB

Download
memory/2620-4502-0x00007FF736440000-0x00007FF736832000-memory.dmp

Filesize
3.9MB

Download
memory/2864-290-0x00007FF657AD0000-0x00007FF657EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-4383-0x00007FF657AD0000-0x00007FF657EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2888-291-0x00007FF6047B0000-0x00007FF604BA2000-memory.dmp

Filesize
3.9MB

Download
memory/2888-4474-0x00007FF6047B0000-0x00007FF604BA2000-memory.dmp

Filesize
3.9MB

Download
memory/3084-297-0x00007FF7E2860000-0x00007FF7E2C52000-memory.dmp

Filesize
3.9MB

Download
memory/3084-4504-0x00007FF7E2860000-0x00007FF7E2C52000-memory.dmp

Filesize
3.9MB

Download
memory/3364-109-0x00007FF6C4BA0000-0x00007FF6C4F92000-memory.dmp

Filesize
3.9MB

Download
memory/3364-4372-0x00007FF6C4BA0000-0x00007FF6C4F92000-memory.dmp

Filesize
3.9MB

Download
memory/3896-4450-0x00007FF7BA950000-0x00007FF7BAD42000-memory.dmp

Filesize
3.9MB

Download
memory/3896-285-0x00007FF7BA950000-0x00007FF7BAD42000-memory.dmp

Filesize
3.9MB

Download
memory/4136-252-0x00007FF72E280000-0x00007FF72E672000-memory.dmp

Filesize
3.9MB

Download
memory/4136-4423-0x00007FF72E280000-0x00007FF72E672000-memory.dmp

Filesize
3.9MB

Download
memory/4148-295-0x00007FF72B3B0000-0x00007FF72B7A2000-memory.dmp

Filesize
3.9MB

Download
memory/4300-286-0x00007FF669140000-0x00007FF669532000-memory.dmp

Filesize
3.9MB

Download
memory/4300-4516-0x00007FF669140000-0x00007FF669532000-memory.dmp

Filesize
3.9MB

Download
memory/4496-4542-0x00007FF682460000-0x00007FF682852000-memory.dmp

Filesize
3.9MB

Download
memory/4496-289-0x00007FF682460000-0x00007FF682852000-memory.dmp

Filesize
3.9MB

Download
memory/4792-4503-0x00007FF7AC400000-0x00007FF7AC7F2000-memory.dmp

Filesize
3.9MB

Download
memory/4792-288-0x00007FF7AC400000-0x00007FF7AC7F2000-memory.dmp

Filesize
3.9MB

Download
memory/5000-4483-0x00007FF6FF810000-0x00007FF6FFC02000-memory.dmp

Filesize
3.9MB

Download
memory/5000-279-0x00007FF6FF810000-0x00007FF6FFC02000-memory.dmp

Filesize
3.9MB

Download
memory/5032-224-0x00007FF6A3690000-0x00007FF6A3A82000-memory.dmp

Filesize
3.9MB

Download
memory/5096-276-0x00007FF69E7E0000-0x00007FF69EBD2000-memory.dmp

Filesize
3.9MB

Download