xmrig | 40ff4511f21d942351ec84bbd58ab93031ebceff24895c4ded471b2bccd88e3e

Analysis

max time kernel
138s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
Size

2.3MB
MD5

099afeb55ae7d1d3e728ab46d93e3b71
SHA1

ceddd02f71a1de5e5f656cc80fddc0553382a96a
SHA256

40ff4511f21d942351ec84bbd58ab93031ebceff24895c4ded471b2bccd88e3e
SHA512

e7f5bb48a6cafbf456514204375b7c1d559437d9649ae5b0b73c6d864ab16ac7e3c6d1c7f82ca0f31f26b6c54e811601185188f93a0e791b9c54cc9456742e21
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDisy:NAB5

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/memory/4008-47-0x00007FF7DD370000-0x00007FF7DD762000-memory.dmp	xmrig
behavioral2/memory/1992-407-0x00007FF7780B0000-0x00007FF7784A2000-memory.dmp	xmrig
behavioral2/memory/1284-487-0x00007FF7B84F0000-0x00007FF7B88E2000-memory.dmp	xmrig
behavioral2/memory/4204-491-0x00007FF634820000-0x00007FF634C12000-memory.dmp	xmrig
behavioral2/memory/4556-490-0x00007FF706EE0000-0x00007FF7072D2000-memory.dmp	xmrig
behavioral2/memory/4020-489-0x00007FF70F590000-0x00007FF70F982000-memory.dmp	xmrig
behavioral2/memory/4508-488-0x00007FF6EA170000-0x00007FF6EA562000-memory.dmp	xmrig
behavioral2/memory/3980-451-0x00007FF670050000-0x00007FF670442000-memory.dmp	xmrig
behavioral2/memory/808-381-0x00007FF6A5550000-0x00007FF6A5942000-memory.dmp	xmrig
behavioral2/memory/2976-370-0x00007FF6C7B30000-0x00007FF6C7F22000-memory.dmp	xmrig
behavioral2/memory/1984-369-0x00007FF60B0E0000-0x00007FF60B4D2000-memory.dmp	xmrig
behavioral2/memory/3268-319-0x00007FF61A960000-0x00007FF61AD52000-memory.dmp	xmrig
behavioral2/memory/2084-291-0x00007FF7D1F90000-0x00007FF7D2382000-memory.dmp	xmrig
behavioral2/memory/4488-272-0x00007FF645950000-0x00007FF645D42000-memory.dmp	xmrig
behavioral2/memory/4180-228-0x00007FF6C0FB0000-0x00007FF6C13A2000-memory.dmp	xmrig
behavioral2/memory/4740-227-0x00007FF6BE980000-0x00007FF6BED72000-memory.dmp	xmrig
behavioral2/memory/4696-206-0x00007FF6A1890000-0x00007FF6A1C82000-memory.dmp	xmrig
behavioral2/memory/4408-172-0x00007FF69CDA0000-0x00007FF69D192000-memory.dmp	xmrig
behavioral2/memory/3648-12-0x00007FF772FE0000-0x00007FF7733D2000-memory.dmp	xmrig
behavioral2/memory/1080-5347-0x00007FF70C270000-0x00007FF70C662000-memory.dmp	xmrig
behavioral2/memory/4020-5352-0x00007FF70F590000-0x00007FF70F982000-memory.dmp	xmrig
behavioral2/memory/4272-5358-0x00007FF7E6BB0000-0x00007FF7E6FA2000-memory.dmp	xmrig
behavioral2/memory/4696-5367-0x00007FF6A1890000-0x00007FF6A1C82000-memory.dmp	xmrig
behavioral2/memory/4556-5393-0x00007FF706EE0000-0x00007FF7072D2000-memory.dmp	xmrig
behavioral2/memory/808-5437-0x00007FF6A5550000-0x00007FF6A5942000-memory.dmp	xmrig
behavioral2/memory/1284-5465-0x00007FF7B84F0000-0x00007FF7B88E2000-memory.dmp	xmrig
behavioral2/memory/4508-5472-0x00007FF6EA170000-0x00007FF6EA562000-memory.dmp	xmrig
behavioral2/memory/3980-5448-0x00007FF670050000-0x00007FF670442000-memory.dmp	xmrig
behavioral2/memory/1992-5439-0x00007FF7780B0000-0x00007FF7784A2000-memory.dmp	xmrig
behavioral2/memory/4740-5436-0x00007FF6BE980000-0x00007FF6BED72000-memory.dmp	xmrig
behavioral2/memory/4204-5429-0x00007FF634820000-0x00007FF634C12000-memory.dmp	xmrig
behavioral2/memory/4408-5428-0x00007FF69CDA0000-0x00007FF69D192000-memory.dmp	xmrig
behavioral2/memory/1984-5426-0x00007FF60B0E0000-0x00007FF60B4D2000-memory.dmp	xmrig
behavioral2/memory/3268-5423-0x00007FF61A960000-0x00007FF61AD52000-memory.dmp	xmrig
behavioral2/memory/2976-5432-0x00007FF6C7B30000-0x00007FF6C7F22000-memory.dmp	xmrig
behavioral2/memory/2084-5387-0x00007FF7D1F90000-0x00007FF7D2382000-memory.dmp	xmrig
behavioral2/memory/4488-5384-0x00007FF645950000-0x00007FF645D42000-memory.dmp	xmrig
behavioral2/memory/4180-5374-0x00007FF6C0FB0000-0x00007FF6C13A2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3648	gREtpWq.exe
4272	aBsuuiv.exe
1080	CUDBQAU.exe
4008	OALeKXg.exe
4020	AVAFcdW.exe
4556	uHmmrZy.exe
4408	FafPXhS.exe
4696	nldveJE.exe
4740	tTGAVUv.exe
4180	kYAPTMr.exe
4488	VSWUmRk.exe
2084	GhRAPKY.exe
3268	ojtmueX.exe
1984	KnfIhmP.exe
4204	JuqSGeY.exe
2976	ajDHxmP.exe
808	KlxFLax.exe
1992	IcFEDCz.exe
3980	GmTjxfG.exe
1284	kodiPaz.exe
4508	TjlqPvS.exe
1460	qiNDczM.exe
4780	wMsyqse.exe
3700	FjsLdPI.exe
744	ZPEKkru.exe
2312	jpnfrVu.exe
840	WxsVPAd.exe
4924	knIFhhE.exe
4988	gsMOJLW.exe
4504	mfRzwfv.exe
2220	tHcSWRL.exe
3840	TQezKRz.exe
5076	ZsJvjMT.exe
4708	dMTxYNU.exe
1900	MzzCWQc.exe
4144	vuplqBx.exe
4080	pgWYUEg.exe
812	dTIqkHg.exe
932	DLioLOr.exe
3416	ezQfFwe.exe
4544	WpDGYpI.exe
3480	ZqUvMqO.exe
624	pzhZsjZ.exe
264	lhArcID.exe
2544	vCUOlTY.exe
2732	evbUZtt.exe
4276	ZWvzQFv.exe
5032	GlmLivL.exe
3448	wHZroSD.exe
4468	qaklRaM.exe
852	OCLAwuW.exe
5080	QxcoUaC.exe
836	HIBFzGZ.exe
4540	oWhRlhN.exe
2888	VAtWQvQ.exe
2488	bKnKUGm.exe
4928	cObpapP.exe
3204	KwegYod.exe
4896	RGFtTgm.exe
2936	ikzSsbN.exe
1644	YRyivti.exe
3660	YWgsNdl.exe
3688	vpPZlHX.exe
4208	mgEOQXw.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4888-0-0x00007FF7B5770000-0x00007FF7B5B62000-memory.dmp	upx
behavioral2/files/0x000a000000023b72-8.dat	upx
behavioral2/files/0x000b000000023b6d-5.dat	upx
behavioral2/memory/4272-22-0x00007FF7E6BB0000-0x00007FF7E6FA2000-memory.dmp	upx
behavioral2/files/0x000a000000023b77-50.dat	upx
behavioral2/memory/4008-47-0x00007FF7DD370000-0x00007FF7DD762000-memory.dmp	upx
behavioral2/files/0x000a000000023b74-42.dat	upx
behavioral2/memory/1080-40-0x00007FF70C270000-0x00007FF70C662000-memory.dmp	upx
behavioral2/files/0x000a000000023b73-29.dat	upx
behavioral2/files/0x000a000000023b79-70.dat	upx
behavioral2/files/0x000a000000023b7d-99.dat	upx
behavioral2/files/0x000a000000023b7f-124.dat	upx
behavioral2/files/0x000a000000023b8b-189.dat	upx
behavioral2/memory/1992-407-0x00007FF7780B0000-0x00007FF7784A2000-memory.dmp	upx
behavioral2/memory/1284-487-0x00007FF7B84F0000-0x00007FF7B88E2000-memory.dmp	upx
behavioral2/memory/4204-491-0x00007FF634820000-0x00007FF634C12000-memory.dmp	upx
behavioral2/memory/4556-490-0x00007FF706EE0000-0x00007FF7072D2000-memory.dmp	upx
behavioral2/memory/4020-489-0x00007FF70F590000-0x00007FF70F982000-memory.dmp	upx
behavioral2/memory/4508-488-0x00007FF6EA170000-0x00007FF6EA562000-memory.dmp	upx
behavioral2/memory/3980-451-0x00007FF670050000-0x00007FF670442000-memory.dmp	upx
behavioral2/memory/808-381-0x00007FF6A5550000-0x00007FF6A5942000-memory.dmp	upx
behavioral2/memory/2976-370-0x00007FF6C7B30000-0x00007FF6C7F22000-memory.dmp	upx
behavioral2/memory/1984-369-0x00007FF60B0E0000-0x00007FF60B4D2000-memory.dmp	upx
behavioral2/memory/3268-319-0x00007FF61A960000-0x00007FF61AD52000-memory.dmp	upx
behavioral2/memory/2084-291-0x00007FF7D1F90000-0x00007FF7D2382000-memory.dmp	upx
behavioral2/memory/4488-272-0x00007FF645950000-0x00007FF645D42000-memory.dmp	upx
behavioral2/memory/4180-228-0x00007FF6C0FB0000-0x00007FF6C13A2000-memory.dmp	upx
behavioral2/memory/4740-227-0x00007FF6BE980000-0x00007FF6BED72000-memory.dmp	upx
behavioral2/memory/4696-206-0x00007FF6A1890000-0x00007FF6A1C82000-memory.dmp	upx
behavioral2/files/0x000a000000023b93-193.dat	upx
behavioral2/files/0x000a000000023b92-192.dat	upx
behavioral2/files/0x000a000000023b91-191.dat	upx
behavioral2/files/0x000a000000023b88-182.dat	upx
behavioral2/files/0x000a000000023b87-178.dat	upx
behavioral2/memory/4408-172-0x00007FF69CDA0000-0x00007FF69D192000-memory.dmp	upx
behavioral2/files/0x000a000000023b85-167.dat	upx
behavioral2/files/0x000a000000023b84-164.dat	upx
behavioral2/files/0x000a000000023b83-161.dat	upx
behavioral2/files/0x000a000000023b8f-160.dat	upx
behavioral2/files/0x000a000000023b8e-157.dat	upx
behavioral2/files/0x000a000000023b8c-151.dat	upx
behavioral2/files/0x000a000000023b82-145.dat	upx
behavioral2/files/0x000a000000023b89-185.dat	upx
behavioral2/files/0x000b000000023b6e-175.dat	upx
behavioral2/files/0x000a000000023b81-138.dat	upx
behavioral2/files/0x000a000000023b8d-132.dat	upx
behavioral2/files/0x000a000000023b80-127.dat	upx
behavioral2/files/0x000a000000023b8a-123.dat	upx
behavioral2/files/0x000a000000023b86-119.dat	upx
behavioral2/files/0x000a000000023b7c-93.dat	upx
behavioral2/files/0x000a000000023b7e-90.dat	upx
behavioral2/files/0x000a000000023b7b-82.dat	upx
behavioral2/files/0x000a000000023b7a-78.dat	upx
behavioral2/files/0x000a000000023b75-77.dat	upx
behavioral2/files/0x000a000000023b76-67.dat	upx
behavioral2/files/0x000a000000023b78-61.dat	upx
behavioral2/files/0x000a000000023b71-26.dat	upx
behavioral2/memory/3648-12-0x00007FF772FE0000-0x00007FF7733D2000-memory.dmp	upx
behavioral2/memory/1080-5347-0x00007FF70C270000-0x00007FF70C662000-memory.dmp	upx
behavioral2/memory/4020-5352-0x00007FF70F590000-0x00007FF70F982000-memory.dmp	upx
behavioral2/memory/4272-5358-0x00007FF7E6BB0000-0x00007FF7E6FA2000-memory.dmp	upx
behavioral2/memory/4696-5367-0x00007FF6A1890000-0x00007FF6A1C82000-memory.dmp	upx
behavioral2/memory/4556-5393-0x00007FF706EE0000-0x00007FF7072D2000-memory.dmp	upx
behavioral2/memory/808-5437-0x00007FF6A5550000-0x00007FF6A5942000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oOpOcVN.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\pOxZcAG.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\jfcwzHr.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\XyyhNca.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\RezxrUh.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\KDWoyEZ.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\xEFyaPi.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\IkGzNDY.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\pQhuHmQ.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\GrCQSHd.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\NRyIyof.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\DKlOrOl.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\OXKCdsz.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\zGktvCD.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\cnAkXbY.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\mwIvpXe.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\dCmnWSF.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\EwVggXj.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\NTiIrwy.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\VVnLBDO.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\hNhXcEG.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\sTZLbBz.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\xhGvlLC.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\CMLEakG.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\nqWsAjc.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\kzFNoJs.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\YlEmWmv.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\UlONQiB.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\JKpgNVx.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\oiPAsjs.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\UedKeVd.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\FpQBosI.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\fiyWuxt.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\jOIkABR.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\lpucZPQ.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\XXlycQW.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\zeoSsPK.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\YLNjHyE.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\SumUdRB.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\CfPuPvZ.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\obBHQgT.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\ysnxDqI.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\jkdfPQO.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\oCRKRkt.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\ttjAabu.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\PsWjjgx.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\forDWgM.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\rAZlpSo.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\eNGnkIo.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\WeiBECW.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\GdAolUI.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\kWqMalg.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\QhAnlbX.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\yDxJdHE.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\YAhgceW.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\SMChWgG.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\xjbYEDi.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\ZziEokE.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\KynwEeX.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\eTiMNxg.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\fFbKHxN.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\wzpqgEe.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\FOGAorP.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\kcVfyvM.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4308	powershell.exe
4308	powershell.exe
4308	powershell.exe
4308	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
Token: SeDebugPrivilege	4308	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4308	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	84
PID 4888 wrote to memory of 4308	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	84
PID 4888 wrote to memory of 3648	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	85
PID 4888 wrote to memory of 3648	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	85
PID 4888 wrote to memory of 4272	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	86
PID 4888 wrote to memory of 4272	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	86
PID 4888 wrote to memory of 1080	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	87
PID 4888 wrote to memory of 1080	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	87
PID 4888 wrote to memory of 4008	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	88
PID 4888 wrote to memory of 4008	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	88
PID 4888 wrote to memory of 4020	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	89
PID 4888 wrote to memory of 4020	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	89
PID 4888 wrote to memory of 4180	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	90
PID 4888 wrote to memory of 4180	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	90
PID 4888 wrote to memory of 4556	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	91
PID 4888 wrote to memory of 4556	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	91
PID 4888 wrote to memory of 4408	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	92
PID 4888 wrote to memory of 4408	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	92
PID 4888 wrote to memory of 4696	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	93
PID 4888 wrote to memory of 4696	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	93
PID 4888 wrote to memory of 4740	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	94
PID 4888 wrote to memory of 4740	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	94
PID 4888 wrote to memory of 4488	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	95
PID 4888 wrote to memory of 4488	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	95
PID 4888 wrote to memory of 2084	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	96
PID 4888 wrote to memory of 2084	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	96
PID 4888 wrote to memory of 3268	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	97
PID 4888 wrote to memory of 3268	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	97
PID 4888 wrote to memory of 1984	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	98
PID 4888 wrote to memory of 1984	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	98
PID 4888 wrote to memory of 4204	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	99
PID 4888 wrote to memory of 4204	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	99
PID 4888 wrote to memory of 2976	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	100
PID 4888 wrote to memory of 2976	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	100
PID 4888 wrote to memory of 808	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	101
PID 4888 wrote to memory of 808	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	101
PID 4888 wrote to memory of 1992	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	102
PID 4888 wrote to memory of 1992	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	102
PID 4888 wrote to memory of 3980	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	103
PID 4888 wrote to memory of 3980	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	103
PID 4888 wrote to memory of 1284	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	104
PID 4888 wrote to memory of 1284	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	104
PID 4888 wrote to memory of 4508	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	105
PID 4888 wrote to memory of 4508	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	105
PID 4888 wrote to memory of 1460	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	106
PID 4888 wrote to memory of 1460	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	106
PID 4888 wrote to memory of 4780	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	107
PID 4888 wrote to memory of 4780	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	107
PID 4888 wrote to memory of 3700	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	108
PID 4888 wrote to memory of 3700	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	108
PID 4888 wrote to memory of 744	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	109
PID 4888 wrote to memory of 744	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	109
PID 4888 wrote to memory of 2312	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	110
PID 4888 wrote to memory of 2312	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	110
PID 4888 wrote to memory of 840	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	111
PID 4888 wrote to memory of 840	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	111
PID 4888 wrote to memory of 4924	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	112
PID 4888 wrote to memory of 4924	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	112
PID 4888 wrote to memory of 4988	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	113
PID 4888 wrote to memory of 4988	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	113
PID 4888 wrote to memory of 4504	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	114
PID 4888 wrote to memory of 4504	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	114
PID 4888 wrote to memory of 2220	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	115
PID 4888 wrote to memory of 2220	4888	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4308
- C:\Windows\System\gREtpWq.exe
  C:\Windows\System\gREtpWq.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\aBsuuiv.exe
  C:\Windows\System\aBsuuiv.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\CUDBQAU.exe
  C:\Windows\System\CUDBQAU.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\OALeKXg.exe
  C:\Windows\System\OALeKXg.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\AVAFcdW.exe
  C:\Windows\System\AVAFcdW.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\kYAPTMr.exe
  C:\Windows\System\kYAPTMr.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\uHmmrZy.exe
  C:\Windows\System\uHmmrZy.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\FafPXhS.exe
  C:\Windows\System\FafPXhS.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\nldveJE.exe
  C:\Windows\System\nldveJE.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\tTGAVUv.exe
  C:\Windows\System\tTGAVUv.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\VSWUmRk.exe
  C:\Windows\System\VSWUmRk.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\GhRAPKY.exe
  C:\Windows\System\GhRAPKY.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\ojtmueX.exe
  C:\Windows\System\ojtmueX.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\KnfIhmP.exe
  C:\Windows\System\KnfIhmP.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\JuqSGeY.exe
  C:\Windows\System\JuqSGeY.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\ajDHxmP.exe
  C:\Windows\System\ajDHxmP.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\KlxFLax.exe
  C:\Windows\System\KlxFLax.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\IcFEDCz.exe
  C:\Windows\System\IcFEDCz.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\GmTjxfG.exe
  C:\Windows\System\GmTjxfG.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\kodiPaz.exe
  C:\Windows\System\kodiPaz.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\TjlqPvS.exe
  C:\Windows\System\TjlqPvS.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\qiNDczM.exe
  C:\Windows\System\qiNDczM.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\wMsyqse.exe
  C:\Windows\System\wMsyqse.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\FjsLdPI.exe
  C:\Windows\System\FjsLdPI.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\ZPEKkru.exe
  C:\Windows\System\ZPEKkru.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\jpnfrVu.exe
  C:\Windows\System\jpnfrVu.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\WxsVPAd.exe
  C:\Windows\System\WxsVPAd.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\knIFhhE.exe
  C:\Windows\System\knIFhhE.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\gsMOJLW.exe
  C:\Windows\System\gsMOJLW.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\mfRzwfv.exe
  C:\Windows\System\mfRzwfv.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\tHcSWRL.exe
  C:\Windows\System\tHcSWRL.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\TQezKRz.exe
  C:\Windows\System\TQezKRz.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\WpDGYpI.exe
  C:\Windows\System\WpDGYpI.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\ZsJvjMT.exe
  C:\Windows\System\ZsJvjMT.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\dMTxYNU.exe
  C:\Windows\System\dMTxYNU.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\MzzCWQc.exe
  C:\Windows\System\MzzCWQc.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\vuplqBx.exe
  C:\Windows\System\vuplqBx.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\pgWYUEg.exe
  C:\Windows\System\pgWYUEg.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\dTIqkHg.exe
  C:\Windows\System\dTIqkHg.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\DLioLOr.exe
  C:\Windows\System\DLioLOr.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\ezQfFwe.exe
  C:\Windows\System\ezQfFwe.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\ZqUvMqO.exe
  C:\Windows\System\ZqUvMqO.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\pzhZsjZ.exe
  C:\Windows\System\pzhZsjZ.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\lhArcID.exe
  C:\Windows\System\lhArcID.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\OCLAwuW.exe
  C:\Windows\System\OCLAwuW.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\vCUOlTY.exe
  C:\Windows\System\vCUOlTY.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\evbUZtt.exe
  C:\Windows\System\evbUZtt.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\ZWvzQFv.exe
  C:\Windows\System\ZWvzQFv.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\GlmLivL.exe
  C:\Windows\System\GlmLivL.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\wHZroSD.exe
  C:\Windows\System\wHZroSD.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\qaklRaM.exe
  C:\Windows\System\qaklRaM.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\QxcoUaC.exe
  C:\Windows\System\QxcoUaC.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\HIBFzGZ.exe
  C:\Windows\System\HIBFzGZ.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\oWhRlhN.exe
  C:\Windows\System\oWhRlhN.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\VAtWQvQ.exe
  C:\Windows\System\VAtWQvQ.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\bKnKUGm.exe
  C:\Windows\System\bKnKUGm.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\cObpapP.exe
  C:\Windows\System\cObpapP.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\KwegYod.exe
  C:\Windows\System\KwegYod.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\RGFtTgm.exe
  C:\Windows\System\RGFtTgm.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\ikzSsbN.exe
  C:\Windows\System\ikzSsbN.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\YRyivti.exe
  C:\Windows\System\YRyivti.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\YWgsNdl.exe
  C:\Windows\System\YWgsNdl.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\vpPZlHX.exe
  C:\Windows\System\vpPZlHX.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\mgEOQXw.exe
  C:\Windows\System\mgEOQXw.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\QvnCBXC.exe
  C:\Windows\System\QvnCBXC.exe
  2⤵
  PID:2800
- C:\Windows\System\vXmNNGF.exe
  C:\Windows\System\vXmNNGF.exe
  2⤵
  PID:3976
- C:\Windows\System\unTcACy.exe
  C:\Windows\System\unTcACy.exe
  2⤵
  PID:4324
- C:\Windows\System\tRkagbj.exe
  C:\Windows\System\tRkagbj.exe
  2⤵
  PID:1204
- C:\Windows\System\kwEHKLh.exe
  C:\Windows\System\kwEHKLh.exe
  2⤵
  PID:5060
- C:\Windows\System\Rxpjbqq.exe
  C:\Windows\System\Rxpjbqq.exe
  2⤵
  PID:232
- C:\Windows\System\mJXZKTJ.exe
  C:\Windows\System\mJXZKTJ.exe
  2⤵
  PID:1252
- C:\Windows\System\IorvZxJ.exe
  C:\Windows\System\IorvZxJ.exe
  2⤵
  PID:5132
- C:\Windows\System\ltKESad.exe
  C:\Windows\System\ltKESad.exe
  2⤵
  PID:5164
- C:\Windows\System\rpfIsDx.exe
  C:\Windows\System\rpfIsDx.exe
  2⤵
  PID:5184
- C:\Windows\System\BPwxybJ.exe
  C:\Windows\System\BPwxybJ.exe
  2⤵
  PID:5212
- C:\Windows\System\WWbuSsh.exe
  C:\Windows\System\WWbuSsh.exe
  2⤵
  PID:5232
- C:\Windows\System\TLiSzyV.exe
  C:\Windows\System\TLiSzyV.exe
  2⤵
  PID:5264
- C:\Windows\System\ghUkJPn.exe
  C:\Windows\System\ghUkJPn.exe
  2⤵
  PID:5288
- C:\Windows\System\RoWcAyb.exe
  C:\Windows\System\RoWcAyb.exe
  2⤵
  PID:5312
- C:\Windows\System\nhTghpL.exe
  C:\Windows\System\nhTghpL.exe
  2⤵
  PID:5328
- C:\Windows\System\nyHylaa.exe
  C:\Windows\System\nyHylaa.exe
  2⤵
  PID:5380
- C:\Windows\System\gKcwDjF.exe
  C:\Windows\System\gKcwDjF.exe
  2⤵
  PID:5396
- C:\Windows\System\jLWwkzO.exe
  C:\Windows\System\jLWwkzO.exe
  2⤵
  PID:5412
- C:\Windows\System\tWqAlck.exe
  C:\Windows\System\tWqAlck.exe
  2⤵
  PID:5428
- C:\Windows\System\tQVQpsw.exe
  C:\Windows\System\tQVQpsw.exe
  2⤵
  PID:5444
- C:\Windows\System\PqEsXcY.exe
  C:\Windows\System\PqEsXcY.exe
  2⤵
  PID:5460
- C:\Windows\System\KnsDtSf.exe
  C:\Windows\System\KnsDtSf.exe
  2⤵
  PID:5476
- C:\Windows\System\ytGAIHr.exe
  C:\Windows\System\ytGAIHr.exe
  2⤵
  PID:5492
- C:\Windows\System\pXghMlO.exe
  C:\Windows\System\pXghMlO.exe
  2⤵
  PID:5520
- C:\Windows\System\FMtthah.exe
  C:\Windows\System\FMtthah.exe
  2⤵
  PID:5536
- C:\Windows\System\unMpNAS.exe
  C:\Windows\System\unMpNAS.exe
  2⤵
  PID:5556
- C:\Windows\System\NYhIPFi.exe
  C:\Windows\System\NYhIPFi.exe
  2⤵
  PID:5576
- C:\Windows\System\zfaHXUj.exe
  C:\Windows\System\zfaHXUj.exe
  2⤵
  PID:5604
- C:\Windows\System\xJpUjhx.exe
  C:\Windows\System\xJpUjhx.exe
  2⤵
  PID:5620
- C:\Windows\System\hlvATtD.exe
  C:\Windows\System\hlvATtD.exe
  2⤵
  PID:5644
- C:\Windows\System\yxeMSuX.exe
  C:\Windows\System\yxeMSuX.exe
  2⤵
  PID:5660
- C:\Windows\System\tbxxfbY.exe
  C:\Windows\System\tbxxfbY.exe
  2⤵
  PID:5684
- C:\Windows\System\SrfGPre.exe
  C:\Windows\System\SrfGPre.exe
  2⤵
  PID:5700
- C:\Windows\System\AMrfhCT.exe
  C:\Windows\System\AMrfhCT.exe
  2⤵
  PID:5720
- C:\Windows\System\VtvQwBG.exe
  C:\Windows\System\VtvQwBG.exe
  2⤵
  PID:5744
- C:\Windows\System\hEXZWvU.exe
  C:\Windows\System\hEXZWvU.exe
  2⤵
  PID:5768
- C:\Windows\System\BJFiXTT.exe
  C:\Windows\System\BJFiXTT.exe
  2⤵
  PID:5792
- C:\Windows\System\NQSmZxw.exe
  C:\Windows\System\NQSmZxw.exe
  2⤵
  PID:5808
- C:\Windows\System\lDnYtMw.exe
  C:\Windows\System\lDnYtMw.exe
  2⤵
  PID:5832
- C:\Windows\System\cKyOzEO.exe
  C:\Windows\System\cKyOzEO.exe
  2⤵
  PID:5868
- C:\Windows\System\FwKBeNr.exe
  C:\Windows\System\FwKBeNr.exe
  2⤵
  PID:5892
- C:\Windows\System\nItYPmx.exe
  C:\Windows\System\nItYPmx.exe
  2⤵
  PID:5940
- C:\Windows\System\CcySsyZ.exe
  C:\Windows\System\CcySsyZ.exe
  2⤵
  PID:5972
- C:\Windows\System\afEURKZ.exe
  C:\Windows\System\afEURKZ.exe
  2⤵
  PID:6080
- C:\Windows\System\OLKHXUy.exe
  C:\Windows\System\OLKHXUy.exe
  2⤵
  PID:6096
- C:\Windows\System\RmWRHDr.exe
  C:\Windows\System\RmWRHDr.exe
  2⤵
  PID:6112
- C:\Windows\System\IQVWeUb.exe
  C:\Windows\System\IQVWeUb.exe
  2⤵
  PID:6136
- C:\Windows\System\ZGreEdL.exe
  C:\Windows\System\ZGreEdL.exe
  2⤵
  PID:4016
- C:\Windows\System\vGsmpBq.exe
  C:\Windows\System\vGsmpBq.exe
  2⤵
  PID:3040
- C:\Windows\System\XQLGdNE.exe
  C:\Windows\System\XQLGdNE.exe
  2⤵
  PID:4280
- C:\Windows\System\ovAdKiU.exe
  C:\Windows\System\ovAdKiU.exe
  2⤵
  PID:4652
- C:\Windows\System\OsnlgHj.exe
  C:\Windows\System\OsnlgHj.exe
  2⤵
  PID:976
- C:\Windows\System\YLbMEQR.exe
  C:\Windows\System\YLbMEQR.exe
  2⤵
  PID:2172
- C:\Windows\System\LNiUoRz.exe
  C:\Windows\System\LNiUoRz.exe
  2⤵
  PID:1212
- C:\Windows\System\AWcrwka.exe
  C:\Windows\System\AWcrwka.exe
  2⤵
  PID:536
- C:\Windows\System\wJMkHqp.exe
  C:\Windows\System\wJMkHqp.exe
  2⤵
  PID:2600
- C:\Windows\System\eezMkRO.exe
  C:\Windows\System\eezMkRO.exe
  2⤵
  PID:3400
- C:\Windows\System\PnbOAYy.exe
  C:\Windows\System\PnbOAYy.exe
  2⤵
  PID:1416
- C:\Windows\System\wbdiwKB.exe
  C:\Windows\System\wbdiwKB.exe
  2⤵
  PID:1436
- C:\Windows\System\GSAqFwp.exe
  C:\Windows\System\GSAqFwp.exe
  2⤵
  PID:5572
- C:\Windows\System\wCVueDU.exe
  C:\Windows\System\wCVueDU.exe
  2⤵
  PID:5628
- C:\Windows\System\unhPqhH.exe
  C:\Windows\System\unhPqhH.exe
  2⤵
  PID:5140
- C:\Windows\System\rwStfwD.exe
  C:\Windows\System\rwStfwD.exe
  2⤵
  PID:5192
- C:\Windows\System\udxIPOy.exe
  C:\Windows\System\udxIPOy.exe
  2⤵
  PID:5224
- C:\Windows\System\vbYrRXm.exe
  C:\Windows\System\vbYrRXm.exe
  2⤵
  PID:5276
- C:\Windows\System\BAzjlRa.exe
  C:\Windows\System\BAzjlRa.exe
  2⤵
  PID:5320
- C:\Windows\System\hjLfFWq.exe
  C:\Windows\System\hjLfFWq.exe
  2⤵
  PID:5388
- C:\Windows\System\biApdVH.exe
  C:\Windows\System\biApdVH.exe
  2⤵
  PID:5420
- C:\Windows\System\YTvtGaU.exe
  C:\Windows\System\YTvtGaU.exe
  2⤵
  PID:5568
- C:\Windows\System\DMqmwwz.exe
  C:\Windows\System\DMqmwwz.exe
  2⤵
  PID:2216
- C:\Windows\System\pFobEFj.exe
  C:\Windows\System\pFobEFj.exe
  2⤵
  PID:5736
- C:\Windows\System\kGsvWxz.exe
  C:\Windows\System\kGsvWxz.exe
  2⤵
  PID:5784
- C:\Windows\System\RiDrZbd.exe
  C:\Windows\System\RiDrZbd.exe
  2⤵
  PID:5840
- C:\Windows\System\limOHvj.exe
  C:\Windows\System\limOHvj.exe
  2⤵
  PID:5888
- C:\Windows\System\wnqJHFN.exe
  C:\Windows\System\wnqJHFN.exe
  2⤵
  PID:5928
- C:\Windows\System\KqfSsMl.exe
  C:\Windows\System\KqfSsMl.exe
  2⤵
  PID:5100
- C:\Windows\System\okimgrf.exe
  C:\Windows\System\okimgrf.exe
  2⤵
  PID:4600
- C:\Windows\System\qEREBxu.exe
  C:\Windows\System\qEREBxu.exe
  2⤵
  PID:6164
- C:\Windows\System\Hawppjq.exe
  C:\Windows\System\Hawppjq.exe
  2⤵
  PID:6188
- C:\Windows\System\AnzIiIn.exe
  C:\Windows\System\AnzIiIn.exe
  2⤵
  PID:6224
- C:\Windows\System\bCXPBUt.exe
  C:\Windows\System\bCXPBUt.exe
  2⤵
  PID:6328
- C:\Windows\System\WyRicEn.exe
  C:\Windows\System\WyRicEn.exe
  2⤵
  PID:6344
- C:\Windows\System\jxarXgO.exe
  C:\Windows\System\jxarXgO.exe
  2⤵
  PID:6360
- C:\Windows\System\eYCaIBF.exe
  C:\Windows\System\eYCaIBF.exe
  2⤵
  PID:6376
- C:\Windows\System\ybNJAAH.exe
  C:\Windows\System\ybNJAAH.exe
  2⤵
  PID:6392
- C:\Windows\System\QCXhWwk.exe
  C:\Windows\System\QCXhWwk.exe
  2⤵
  PID:6408
- C:\Windows\System\fZPFkkU.exe
  C:\Windows\System\fZPFkkU.exe
  2⤵
  PID:6424
- C:\Windows\System\NQixodu.exe
  C:\Windows\System\NQixodu.exe
  2⤵
  PID:6440
- C:\Windows\System\rakafWN.exe
  C:\Windows\System\rakafWN.exe
  2⤵
  PID:6456
- C:\Windows\System\GDQocwR.exe
  C:\Windows\System\GDQocwR.exe
  2⤵
  PID:6472
- C:\Windows\System\IWQAQqp.exe
  C:\Windows\System\IWQAQqp.exe
  2⤵
  PID:6488
- C:\Windows\System\YucICZn.exe
  C:\Windows\System\YucICZn.exe
  2⤵
  PID:6504
- C:\Windows\System\WAfPmif.exe
  C:\Windows\System\WAfPmif.exe
  2⤵
  PID:6520
- C:\Windows\System\iscJekf.exe
  C:\Windows\System\iscJekf.exe
  2⤵
  PID:6536
- C:\Windows\System\QleNboE.exe
  C:\Windows\System\QleNboE.exe
  2⤵
  PID:6552
- C:\Windows\System\tiiuprv.exe
  C:\Windows\System\tiiuprv.exe
  2⤵
  PID:6568
- C:\Windows\System\SliwYWU.exe
  C:\Windows\System\SliwYWU.exe
  2⤵
  PID:6592
- C:\Windows\System\rnvumnX.exe
  C:\Windows\System\rnvumnX.exe
  2⤵
  PID:6616
- C:\Windows\System\PzVcomN.exe
  C:\Windows\System\PzVcomN.exe
  2⤵
  PID:6640
- C:\Windows\System\ZxFsDph.exe
  C:\Windows\System\ZxFsDph.exe
  2⤵
  PID:6660
- C:\Windows\System\uXTPmRN.exe
  C:\Windows\System\uXTPmRN.exe
  2⤵
  PID:6684
- C:\Windows\System\vlykotJ.exe
  C:\Windows\System\vlykotJ.exe
  2⤵
  PID:6700
- C:\Windows\System\eBfMZbr.exe
  C:\Windows\System\eBfMZbr.exe
  2⤵
  PID:6724
- C:\Windows\System\YhdVIni.exe
  C:\Windows\System\YhdVIni.exe
  2⤵
  PID:6748
- C:\Windows\System\EExTpJT.exe
  C:\Windows\System\EExTpJT.exe
  2⤵
  PID:6768
- C:\Windows\System\MGJzHVr.exe
  C:\Windows\System\MGJzHVr.exe
  2⤵
  PID:6788
- C:\Windows\System\QYXuLiE.exe
  C:\Windows\System\QYXuLiE.exe
  2⤵
  PID:6812
- C:\Windows\System\MLhUEZy.exe
  C:\Windows\System\MLhUEZy.exe
  2⤵
  PID:6832
- C:\Windows\System\aAhxojc.exe
  C:\Windows\System\aAhxojc.exe
  2⤵
  PID:6856
- C:\Windows\System\AKHEHYS.exe
  C:\Windows\System\AKHEHYS.exe
  2⤵
  PID:6876
- C:\Windows\System\WwPRGPJ.exe
  C:\Windows\System\WwPRGPJ.exe
  2⤵
  PID:6892
- C:\Windows\System\JkyMoYE.exe
  C:\Windows\System\JkyMoYE.exe
  2⤵
  PID:6916
- C:\Windows\System\WHomLYs.exe
  C:\Windows\System\WHomLYs.exe
  2⤵
  PID:6940
- C:\Windows\System\CVGniEa.exe
  C:\Windows\System\CVGniEa.exe
  2⤵
  PID:6964
- C:\Windows\System\AanLAcW.exe
  C:\Windows\System\AanLAcW.exe
  2⤵
  PID:6980
- C:\Windows\System\cUVAZkO.exe
  C:\Windows\System\cUVAZkO.exe
  2⤵
  PID:7056
- C:\Windows\System\WkbwJlk.exe
  C:\Windows\System\WkbwJlk.exe
  2⤵
  PID:7072
- C:\Windows\System\CWyHnmt.exe
  C:\Windows\System\CWyHnmt.exe
  2⤵
  PID:7088
- C:\Windows\System\MQqMNHF.exe
  C:\Windows\System\MQqMNHF.exe
  2⤵
  PID:7112
- C:\Windows\System\VEbhktv.exe
  C:\Windows\System\VEbhktv.exe
  2⤵
  PID:7132
- C:\Windows\System\kPIbGGi.exe
  C:\Windows\System\kPIbGGi.exe
  2⤵
  PID:7156
- C:\Windows\System\nKFjWEI.exe
  C:\Windows\System\nKFjWEI.exe
  2⤵
  PID:3260
- C:\Windows\System\XDVzHHi.exe
  C:\Windows\System\XDVzHHi.exe
  2⤵
  PID:3504
- C:\Windows\System\XeKXJgt.exe
  C:\Windows\System\XeKXJgt.exe
  2⤵
  PID:6056
- C:\Windows\System\yMJqXfk.exe
  C:\Windows\System\yMJqXfk.exe
  2⤵
  PID:4584
- C:\Windows\System\SKASBRT.exe
  C:\Windows\System\SKASBRT.exe
  2⤵
  PID:4856
- C:\Windows\System\mbJcvbX.exe
  C:\Windows\System\mbJcvbX.exe
  2⤵
  PID:1452
- C:\Windows\System\kEoXZzt.exe
  C:\Windows\System\kEoXZzt.exe
  2⤵
  PID:5616
- C:\Windows\System\zWzZjBZ.exe
  C:\Windows\System\zWzZjBZ.exe
  2⤵
  PID:5208
- C:\Windows\System\jEDhwRU.exe
  C:\Windows\System\jEDhwRU.exe
  2⤵
  PID:5452
- C:\Windows\System\ahUZpAY.exe
  C:\Windows\System\ahUZpAY.exe
  2⤵
  PID:5988
- C:\Windows\System\dKdzVgA.exe
  C:\Windows\System\dKdzVgA.exe
  2⤵
  PID:5544
- C:\Windows\System\chwoMRT.exe
  C:\Windows\System\chwoMRT.exe
  2⤵
  PID:6252
- C:\Windows\System\tILhNTm.exe
  C:\Windows\System\tILhNTm.exe
  2⤵
  PID:656
- C:\Windows\System\SxobwmP.exe
  C:\Windows\System\SxobwmP.exe
  2⤵
  PID:5356
- C:\Windows\System\FzhMVcZ.exe
  C:\Windows\System\FzhMVcZ.exe
  2⤵
  PID:5712
- C:\Windows\System\tKcPOsT.exe
  C:\Windows\System\tKcPOsT.exe
  2⤵
  PID:4116
- C:\Windows\System\kYPrliw.exe
  C:\Windows\System\kYPrliw.exe
  2⤵
  PID:6180
- C:\Windows\System\WBIqYdm.exe
  C:\Windows\System\WBIqYdm.exe
  2⤵
  PID:7188
- C:\Windows\System\sbYBXOD.exe
  C:\Windows\System\sbYBXOD.exe
  2⤵
  PID:7212
- C:\Windows\System\ckPJKqO.exe
  C:\Windows\System\ckPJKqO.exe
  2⤵
  PID:7236
- C:\Windows\System\EANZdDx.exe
  C:\Windows\System\EANZdDx.exe
  2⤵
  PID:7272
- C:\Windows\System\fWktTXH.exe
  C:\Windows\System\fWktTXH.exe
  2⤵
  PID:7296
- C:\Windows\System\fVlMbZg.exe
  C:\Windows\System\fVlMbZg.exe
  2⤵
  PID:7316
- C:\Windows\System\lVnWbWj.exe
  C:\Windows\System\lVnWbWj.exe
  2⤵
  PID:7336
- C:\Windows\System\FYQbOam.exe
  C:\Windows\System\FYQbOam.exe
  2⤵
  PID:7356
- C:\Windows\System\LULQQok.exe
  C:\Windows\System\LULQQok.exe
  2⤵
  PID:7380
- C:\Windows\System\mbqgcrP.exe
  C:\Windows\System\mbqgcrP.exe
  2⤵
  PID:7404
- C:\Windows\System\ecAJtnj.exe
  C:\Windows\System\ecAJtnj.exe
  2⤵
  PID:7424
- C:\Windows\System\MWsZrMw.exe
  C:\Windows\System\MWsZrMw.exe
  2⤵
  PID:7444
- C:\Windows\System\OVhWdto.exe
  C:\Windows\System\OVhWdto.exe
  2⤵
  PID:7468
- C:\Windows\System\TxSrisS.exe
  C:\Windows\System\TxSrisS.exe
  2⤵
  PID:7492
- C:\Windows\System\LyzDXQU.exe
  C:\Windows\System\LyzDXQU.exe
  2⤵
  PID:7552
- C:\Windows\System\QKYydJv.exe
  C:\Windows\System\QKYydJv.exe
  2⤵
  PID:7584
- C:\Windows\System\YUtfRTH.exe
  C:\Windows\System\YUtfRTH.exe
  2⤵
  PID:7608
- C:\Windows\System\liCIyoN.exe
  C:\Windows\System\liCIyoN.exe
  2⤵
  PID:7632
- C:\Windows\System\AoHLgdl.exe
  C:\Windows\System\AoHLgdl.exe
  2⤵
  PID:7648
- C:\Windows\System\svnKpBH.exe
  C:\Windows\System\svnKpBH.exe
  2⤵
  PID:7672
- C:\Windows\System\JXyNBXM.exe
  C:\Windows\System\JXyNBXM.exe
  2⤵
  PID:7696
- C:\Windows\System\aFsAyCP.exe
  C:\Windows\System\aFsAyCP.exe
  2⤵
  PID:7724
- C:\Windows\System\FBQKCmg.exe
  C:\Windows\System\FBQKCmg.exe
  2⤵
  PID:7740
- C:\Windows\System\dEzPJdK.exe
  C:\Windows\System\dEzPJdK.exe
  2⤵
  PID:7760
- C:\Windows\System\TFJRwZs.exe
  C:\Windows\System\TFJRwZs.exe
  2⤵
  PID:7792
- C:\Windows\System\VQXYiwg.exe
  C:\Windows\System\VQXYiwg.exe
  2⤵
  PID:7816
- C:\Windows\System\sWfYExU.exe
  C:\Windows\System\sWfYExU.exe
  2⤵
  PID:7840
- C:\Windows\System\WfdrHTu.exe
  C:\Windows\System\WfdrHTu.exe
  2⤵
  PID:7856
- C:\Windows\System\eiwgePY.exe
  C:\Windows\System\eiwgePY.exe
  2⤵
  PID:7884
- C:\Windows\System\xgzTwwO.exe
  C:\Windows\System\xgzTwwO.exe
  2⤵
  PID:7908
- C:\Windows\System\CbEkdmA.exe
  C:\Windows\System\CbEkdmA.exe
  2⤵
  PID:7928
- C:\Windows\System\EwBKDCv.exe
  C:\Windows\System\EwBKDCv.exe
  2⤵
  PID:7952
- C:\Windows\System\PIpgFJm.exe
  C:\Windows\System\PIpgFJm.exe
  2⤵
  PID:7968
- C:\Windows\System\ddKPnGC.exe
  C:\Windows\System\ddKPnGC.exe
  2⤵
  PID:7984
- C:\Windows\System\vKTZoVi.exe
  C:\Windows\System\vKTZoVi.exe
  2⤵
  PID:8008
- C:\Windows\System\NmzMPDx.exe
  C:\Windows\System\NmzMPDx.exe
  2⤵
  PID:8032
- C:\Windows\System\erazWHZ.exe
  C:\Windows\System\erazWHZ.exe
  2⤵
  PID:8052
- C:\Windows\System\yCnagDh.exe
  C:\Windows\System\yCnagDh.exe
  2⤵
  PID:8072
- C:\Windows\System\snbIWYb.exe
  C:\Windows\System\snbIWYb.exe
  2⤵
  PID:8096
- C:\Windows\System\ZAdwkYb.exe
  C:\Windows\System\ZAdwkYb.exe
  2⤵
  PID:8120
- C:\Windows\System\qOLHcUo.exe
  C:\Windows\System\qOLHcUo.exe
  2⤵
  PID:8144
- C:\Windows\System\eOsAczg.exe
  C:\Windows\System\eOsAczg.exe
  2⤵
  PID:8160
- C:\Windows\System\cBNfuVA.exe
  C:\Windows\System\cBNfuVA.exe
  2⤵
  PID:8184
- C:\Windows\System\SAgPmJE.exe
  C:\Windows\System\SAgPmJE.exe
  2⤵
  PID:6368
- C:\Windows\System\yIYgivR.exe
  C:\Windows\System\yIYgivR.exe
  2⤵
  PID:6404
- C:\Windows\System\brtwFgp.exe
  C:\Windows\System\brtwFgp.exe
  2⤵
  PID:6464
- C:\Windows\System\mntWwAA.exe
  C:\Windows\System\mntWwAA.exe
  2⤵
  PID:6528
- C:\Windows\System\ERTblyV.exe
  C:\Windows\System\ERTblyV.exe
  2⤵
  PID:6564
- C:\Windows\System\wYrDVKS.exe
  C:\Windows\System\wYrDVKS.exe
  2⤵
  PID:6612
- C:\Windows\System\jwUbFls.exe
  C:\Windows\System\jwUbFls.exe
  2⤵
  PID:6652
- C:\Windows\System\gqKrjZI.exe
  C:\Windows\System\gqKrjZI.exe
  2⤵
  PID:6732
- C:\Windows\System\jmOWQMD.exe
  C:\Windows\System\jmOWQMD.exe
  2⤵
  PID:6784
- C:\Windows\System\pJHeQGm.exe
  C:\Windows\System\pJHeQGm.exe
  2⤵
  PID:6848
- C:\Windows\System\kcatqHB.exe
  C:\Windows\System\kcatqHB.exe
  2⤵
  PID:6076
- C:\Windows\System\xghTBTB.exe
  C:\Windows\System\xghTBTB.exe
  2⤵
  PID:7232
- C:\Windows\System\EbTeflY.exe
  C:\Windows\System\EbTeflY.exe
  2⤵
  PID:7436
- C:\Windows\System\YrPJccf.exe
  C:\Windows\System\YrPJccf.exe
  2⤵
  PID:7068
- C:\Windows\System\yMhMGTG.exe
  C:\Windows\System\yMhMGTG.exe
  2⤵
  PID:8208
- C:\Windows\System\IQvQpvC.exe
  C:\Windows\System\IQvQpvC.exe
  2⤵
  PID:8228
- C:\Windows\System\pUPJZJZ.exe
  C:\Windows\System\pUPJZJZ.exe
  2⤵
  PID:8252
- C:\Windows\System\SfVnpst.exe
  C:\Windows\System\SfVnpst.exe
  2⤵
  PID:8280
- C:\Windows\System\OJAGvUQ.exe
  C:\Windows\System\OJAGvUQ.exe
  2⤵
  PID:8300
- C:\Windows\System\VghiFxg.exe
  C:\Windows\System\VghiFxg.exe
  2⤵
  PID:8328
- C:\Windows\System\mVVIxTX.exe
  C:\Windows\System\mVVIxTX.exe
  2⤵
  PID:8352
- C:\Windows\System\GkTkPnS.exe
  C:\Windows\System\GkTkPnS.exe
  2⤵
  PID:8372
- C:\Windows\System\QGlIfNT.exe
  C:\Windows\System\QGlIfNT.exe
  2⤵
  PID:8396
- C:\Windows\System\aAKpYfr.exe
  C:\Windows\System\aAKpYfr.exe
  2⤵
  PID:8420
- C:\Windows\System\nVMAZoI.exe
  C:\Windows\System\nVMAZoI.exe
  2⤵
  PID:8444
- C:\Windows\System\ZwEFDjX.exe
  C:\Windows\System\ZwEFDjX.exe
  2⤵
  PID:8464
- C:\Windows\System\zkpmmNN.exe
  C:\Windows\System\zkpmmNN.exe
  2⤵
  PID:8488
- C:\Windows\System\eeqRPUv.exe
  C:\Windows\System\eeqRPUv.exe
  2⤵
  PID:8508
- C:\Windows\System\LcUXdks.exe
  C:\Windows\System\LcUXdks.exe
  2⤵
  PID:8536
- C:\Windows\System\LAjrIVm.exe
  C:\Windows\System\LAjrIVm.exe
  2⤵
  PID:8560
- C:\Windows\System\xsaJJeQ.exe
  C:\Windows\System\xsaJJeQ.exe
  2⤵
  PID:8648
- C:\Windows\System\rmaWVUP.exe
  C:\Windows\System\rmaWVUP.exe
  2⤵
  PID:8680
- C:\Windows\System\wGLuTmF.exe
  C:\Windows\System\wGLuTmF.exe
  2⤵
  PID:8708
- C:\Windows\System\FbmaQzB.exe
  C:\Windows\System\FbmaQzB.exe
  2⤵
  PID:8736
- C:\Windows\System\ezwLAJD.exe
  C:\Windows\System\ezwLAJD.exe
  2⤵
  PID:8756
- C:\Windows\System\vZOkFuN.exe
  C:\Windows\System\vZOkFuN.exe
  2⤵
  PID:8780
- C:\Windows\System\OPENSzK.exe
  C:\Windows\System\OPENSzK.exe
  2⤵
  PID:8808
- C:\Windows\System\wfgTENC.exe
  C:\Windows\System\wfgTENC.exe
  2⤵
  PID:8832
- C:\Windows\System\NSAXfbA.exe
  C:\Windows\System\NSAXfbA.exe
  2⤵
  PID:8852
- C:\Windows\System\XgiVSnb.exe
  C:\Windows\System\XgiVSnb.exe
  2⤵
  PID:8868
- C:\Windows\System\YDEakJv.exe
  C:\Windows\System\YDEakJv.exe
  2⤵
  PID:8896
- C:\Windows\System\NgfpVuJ.exe
  C:\Windows\System\NgfpVuJ.exe
  2⤵
  PID:8924
- C:\Windows\System\lxlEHvP.exe
  C:\Windows\System\lxlEHvP.exe
  2⤵
  PID:8948
- C:\Windows\System\zsvkdjW.exe
  C:\Windows\System\zsvkdjW.exe
  2⤵
  PID:8968
- C:\Windows\System\iUvZlYv.exe
  C:\Windows\System\iUvZlYv.exe
  2⤵
  PID:8988
- C:\Windows\System\oQHMWqP.exe
  C:\Windows\System\oQHMWqP.exe
  2⤵
  PID:9012
- C:\Windows\System\ouanRYN.exe
  C:\Windows\System\ouanRYN.exe
  2⤵
  PID:9036
- C:\Windows\System\IJdwxYb.exe
  C:\Windows\System\IJdwxYb.exe
  2⤵
  PID:9052
- C:\Windows\System\impItYH.exe
  C:\Windows\System\impItYH.exe
  2⤵
  PID:9068
- C:\Windows\System\NdpvzTn.exe
  C:\Windows\System\NdpvzTn.exe
  2⤵
  PID:9084
- C:\Windows\System\HVrGEMK.exe
  C:\Windows\System\HVrGEMK.exe
  2⤵
  PID:9100
- C:\Windows\System\bZTkXnv.exe
  C:\Windows\System\bZTkXnv.exe
  2⤵
  PID:9116
- C:\Windows\System\IEZAJuV.exe
  C:\Windows\System\IEZAJuV.exe
  2⤵
  PID:9132
- C:\Windows\System\LBSnqvR.exe
  C:\Windows\System\LBSnqvR.exe
  2⤵
  PID:9152
- C:\Windows\System\GCMJfvH.exe
  C:\Windows\System\GCMJfvH.exe
  2⤵
  PID:9176
- C:\Windows\System\NNviXBs.exe
  C:\Windows\System\NNviXBs.exe
  2⤵
  PID:9200
- C:\Windows\System\rvwyixA.exe
  C:\Windows\System\rvwyixA.exe
  2⤵
  PID:8080
- C:\Windows\System\WVIBMnT.exe
  C:\Windows\System\WVIBMnT.exe
  2⤵
  PID:7084
- C:\Windows\System\JhDbkgK.exe
  C:\Windows\System\JhDbkgK.exe
  2⤵
  PID:7124
- C:\Windows\System\dtXrmpc.exe
  C:\Windows\System\dtXrmpc.exe
  2⤵
  PID:2124
- C:\Windows\System\aBwlQtK.exe
  C:\Windows\System\aBwlQtK.exe
  2⤵
  PID:5764
- C:\Windows\System\pmCkvnS.exe
  C:\Windows\System\pmCkvnS.exe
  2⤵
  PID:7460
- C:\Windows\System\SzevIBQ.exe
  C:\Windows\System\SzevIBQ.exe
  2⤵
  PID:4476
- C:\Windows\System\cgmnpPg.exe
  C:\Windows\System\cgmnpPg.exe
  2⤵
  PID:5180
- C:\Windows\System\vzcaXjf.exe
  C:\Windows\System\vzcaXjf.exe
  2⤵
  PID:8236
- C:\Windows\System\RrdcmHM.exe
  C:\Windows\System\RrdcmHM.exe
  2⤵
  PID:8104
- C:\Windows\System\bYoEUET.exe
  C:\Windows\System\bYoEUET.exe
  2⤵
  PID:8296
- C:\Windows\System\MZiporg.exe
  C:\Windows\System\MZiporg.exe
  2⤵
  PID:8168
- C:\Windows\System\PltfRUn.exe
  C:\Windows\System\PltfRUn.exe
  2⤵
  PID:8380
- C:\Windows\System\RBoLKUH.exe
  C:\Windows\System\RBoLKUH.exe
  2⤵
  PID:6352
- C:\Windows\System\iMWqLaN.exe
  C:\Windows\System\iMWqLaN.exe
  2⤵
  PID:5816
- C:\Windows\System\ocCSead.exe
  C:\Windows\System\ocCSead.exe
  2⤵
  PID:6452
- C:\Windows\System\FuidlhT.exe
  C:\Windows\System\FuidlhT.exe
  2⤵
  PID:7172
- C:\Windows\System\upWoZZu.exe
  C:\Windows\System\upWoZZu.exe
  2⤵
  PID:6960
- C:\Windows\System\pAykpeV.exe
  C:\Windows\System\pAykpeV.exe
  2⤵
  PID:7284
- C:\Windows\System\TEkktWs.exe
  C:\Windows\System\TEkktWs.exe
  2⤵
  PID:7352
- C:\Windows\System\dwjIIiC.exe
  C:\Windows\System\dwjIIiC.exe
  2⤵
  PID:7500
- C:\Windows\System\HzMLCrK.exe
  C:\Windows\System\HzMLCrK.exe
  2⤵
  PID:7536
- C:\Windows\System\bmmdIvO.exe
  C:\Windows\System\bmmdIvO.exe
  2⤵
  PID:7572
- C:\Windows\System\WAIfSfg.exe
  C:\Windows\System\WAIfSfg.exe
  2⤵
  PID:7708
- C:\Windows\System\lJAahVA.exe
  C:\Windows\System\lJAahVA.exe
  2⤵
  PID:7644
- C:\Windows\System\gguKMre.exe
  C:\Windows\System\gguKMre.exe
  2⤵
  PID:7748
- C:\Windows\System\hPBCcIu.exe
  C:\Windows\System\hPBCcIu.exe
  2⤵
  PID:7808
- C:\Windows\System\MBeABei.exe
  C:\Windows\System\MBeABei.exe
  2⤵
  PID:7852
- C:\Windows\System\HBYkBMs.exe
  C:\Windows\System\HBYkBMs.exe
  2⤵
  PID:7900
- C:\Windows\System\jvNdywT.exe
  C:\Windows\System\jvNdywT.exe
  2⤵
  PID:7960
- C:\Windows\System\URaqUkB.exe
  C:\Windows\System\URaqUkB.exe
  2⤵
  PID:8000
- C:\Windows\System\ZdrUUTf.exe
  C:\Windows\System\ZdrUUTf.exe
  2⤵
  PID:8048
- C:\Windows\System\wKMJvXj.exe
  C:\Windows\System\wKMJvXj.exe
  2⤵
  PID:8864
- C:\Windows\System\GpZRHAA.exe
  C:\Windows\System\GpZRHAA.exe
  2⤵
  PID:8440
- C:\Windows\System\YTPxpkO.exe
  C:\Windows\System\YTPxpkO.exe
  2⤵
  PID:8964
- C:\Windows\System\fmKvMDe.exe
  C:\Windows\System\fmKvMDe.exe
  2⤵
  PID:9224
- C:\Windows\System\NTbAhzA.exe
  C:\Windows\System\NTbAhzA.exe
  2⤵
  PID:9248
- C:\Windows\System\ZwJHrSM.exe
  C:\Windows\System\ZwJHrSM.exe
  2⤵
  PID:9268
- C:\Windows\System\PofJENz.exe
  C:\Windows\System\PofJENz.exe
  2⤵
  PID:9296
- C:\Windows\System\OJeJJsz.exe
  C:\Windows\System\OJeJJsz.exe
  2⤵
  PID:9324
- C:\Windows\System\GzkaGbS.exe
  C:\Windows\System\GzkaGbS.exe
  2⤵
  PID:9348
- C:\Windows\System\ePcusuN.exe
  C:\Windows\System\ePcusuN.exe
  2⤵
  PID:9364
- C:\Windows\System\uGFUlpf.exe
  C:\Windows\System\uGFUlpf.exe
  2⤵
  PID:9384
- C:\Windows\System\ZfphzFU.exe
  C:\Windows\System\ZfphzFU.exe
  2⤵
  PID:9408
- C:\Windows\System\rbkLNlc.exe
  C:\Windows\System\rbkLNlc.exe
  2⤵
  PID:9436
- C:\Windows\System\aWGALzJ.exe
  C:\Windows\System\aWGALzJ.exe
  2⤵
  PID:9460
- C:\Windows\System\TcWbxCa.exe
  C:\Windows\System\TcWbxCa.exe
  2⤵
  PID:9484
- C:\Windows\System\TxOFqrh.exe
  C:\Windows\System\TxOFqrh.exe
  2⤵
  PID:9508
- C:\Windows\System\BDXPtMr.exe
  C:\Windows\System\BDXPtMr.exe
  2⤵
  PID:9528
- C:\Windows\System\QkclxSV.exe
  C:\Windows\System\QkclxSV.exe
  2⤵
  PID:9552
- C:\Windows\System\clEquTj.exe
  C:\Windows\System\clEquTj.exe
  2⤵
  PID:9580
- C:\Windows\System\FOSNNgO.exe
  C:\Windows\System\FOSNNgO.exe
  2⤵
  PID:9600
- C:\Windows\System\FbAiKzD.exe
  C:\Windows\System\FbAiKzD.exe
  2⤵
  PID:9632
- C:\Windows\System\qsjRoeC.exe
  C:\Windows\System\qsjRoeC.exe
  2⤵
  PID:9648
- C:\Windows\System\uHpxeMR.exe
  C:\Windows\System\uHpxeMR.exe
  2⤵
  PID:9672
- C:\Windows\System\slNhxdy.exe
  C:\Windows\System\slNhxdy.exe
  2⤵
  PID:9692
- C:\Windows\System\nxIbWYM.exe
  C:\Windows\System\nxIbWYM.exe
  2⤵
  PID:9728
- C:\Windows\System\MMlyqcp.exe
  C:\Windows\System\MMlyqcp.exe
  2⤵
  PID:9752
- C:\Windows\System\KhpmvXr.exe
  C:\Windows\System\KhpmvXr.exe
  2⤵
  PID:9776
- C:\Windows\System\YludRxl.exe
  C:\Windows\System\YludRxl.exe
  2⤵
  PID:9812
- C:\Windows\System\uPFWUQd.exe
  C:\Windows\System\uPFWUQd.exe
  2⤵
  PID:9832
- C:\Windows\System\kXBwLrY.exe
  C:\Windows\System\kXBwLrY.exe
  2⤵
  PID:9860
- C:\Windows\System\pyBIxdW.exe
  C:\Windows\System\pyBIxdW.exe
  2⤵
  PID:9876
- C:\Windows\System\JwRyxcu.exe
  C:\Windows\System\JwRyxcu.exe
  2⤵
  PID:9892
- C:\Windows\System\GtMegpQ.exe
  C:\Windows\System\GtMegpQ.exe
  2⤵
  PID:9908
- C:\Windows\System\xFnSvEo.exe
  C:\Windows\System\xFnSvEo.exe
  2⤵
  PID:9964
- C:\Windows\System\MtYNasz.exe
  C:\Windows\System\MtYNasz.exe
  2⤵
  PID:9984
- C:\Windows\System\VffFsKE.exe
  C:\Windows\System\VffFsKE.exe
  2⤵
  PID:10008
- C:\Windows\System\nOINIeW.exe
  C:\Windows\System\nOINIeW.exe
  2⤵
  PID:10040
- C:\Windows\System\CvLDehY.exe
  C:\Windows\System\CvLDehY.exe
  2⤵
  PID:10060
- C:\Windows\System\SiZZpZa.exe
  C:\Windows\System\SiZZpZa.exe
  2⤵
  PID:10088
- C:\Windows\System\NvZUkFg.exe
  C:\Windows\System\NvZUkFg.exe
  2⤵
  PID:10108
- C:\Windows\System\FTimsjW.exe
  C:\Windows\System\FTimsjW.exe
  2⤵
  PID:10132
- C:\Windows\System\uVXseMp.exe
  C:\Windows\System\uVXseMp.exe
  2⤵
  PID:10148
- C:\Windows\System\XdmSSkK.exe
  C:\Windows\System\XdmSSkK.exe
  2⤵
  PID:10172
- C:\Windows\System\ouLLpOG.exe
  C:\Windows\System\ouLLpOG.exe
  2⤵
  PID:10188
- C:\Windows\System\JxXTWag.exe
  C:\Windows\System\JxXTWag.exe
  2⤵
  PID:10212
- C:\Windows\System\cauiGBw.exe
  C:\Windows\System\cauiGBw.exe
  2⤵
  PID:10232
- C:\Windows\System\YEJxCkI.exe
  C:\Windows\System\YEJxCkI.exe
  2⤵
  PID:9024
- C:\Windows\System\VQXOnih.exe
  C:\Windows\System\VQXOnih.exe
  2⤵
  PID:9092
- C:\Windows\System\gHhBqNr.exe
  C:\Windows\System\gHhBqNr.exe
  2⤵
  PID:8552
- C:\Windows\System\TwgBVZV.exe
  C:\Windows\System\TwgBVZV.exe
  2⤵
  PID:8112
- C:\Windows\System\eRoYdoO.exe
  C:\Windows\System\eRoYdoO.exe
  2⤵
  PID:2580
- C:\Windows\System\crXplld.exe
  C:\Windows\System\crXplld.exe
  2⤵
  PID:6680
- C:\Windows\System\oUsJJjC.exe
  C:\Windows\System\oUsJJjC.exe
  2⤵
  PID:4404
- C:\Windows\System\UPYSIoB.exe
  C:\Windows\System\UPYSIoB.exe
  2⤵
  PID:7948
- C:\Windows\System\SOmFPcF.exe
  C:\Windows\System\SOmFPcF.exe
  2⤵
  PID:8392
- C:\Windows\System\KwTvtmD.exe
  C:\Windows\System\KwTvtmD.exe
  2⤵
  PID:9244
- C:\Windows\System\vrwKfxP.exe
  C:\Windows\System\vrwKfxP.exe
  2⤵
  PID:9044
- C:\Windows\System\WEPgrOw.exe
  C:\Windows\System\WEPgrOw.exe
  2⤵
  PID:9336
- C:\Windows\System\MjsHQut.exe
  C:\Windows\System\MjsHQut.exe
  2⤵
  PID:9476
- C:\Windows\System\KAfCadL.exe
  C:\Windows\System\KAfCadL.exe
  2⤵
  PID:9332
- C:\Windows\System\HjqjzaY.exe
  C:\Windows\System\HjqjzaY.exe
  2⤵
  PID:9472
- C:\Windows\System\wfBmQTw.exe
  C:\Windows\System\wfBmQTw.exe
  2⤵
  PID:6340
- C:\Windows\System\YaAVSky.exe
  C:\Windows\System\YaAVSky.exe
  2⤵
  PID:4620
- C:\Windows\System\heCUIZD.exe
  C:\Windows\System\heCUIZD.exe
  2⤵
  PID:8608
- C:\Windows\System\FovDZMm.exe
  C:\Windows\System\FovDZMm.exe
  2⤵
  PID:8668
- C:\Windows\System\vZGtQFv.exe
  C:\Windows\System\vZGtQFv.exe
  2⤵
  PID:8716
- C:\Windows\System\KjEujtj.exe
  C:\Windows\System\KjEujtj.exe
  2⤵
  PID:8748
- C:\Windows\System\DcCJyvz.exe
  C:\Windows\System\DcCJyvz.exe
  2⤵
  PID:9840
- C:\Windows\System\RhLXyrV.exe
  C:\Windows\System\RhLXyrV.exe
  2⤵
  PID:7756
- C:\Windows\System\QSxNBhi.exe
  C:\Windows\System\QSxNBhi.exe
  2⤵
  PID:10056
- C:\Windows\System\gHsGHNo.exe
  C:\Windows\System\gHsGHNo.exe
  2⤵
  PID:8796
- C:\Windows\System\JEPtPWn.exe
  C:\Windows\System\JEPtPWn.exe
  2⤵
  PID:10140
- C:\Windows\System\NNTWRDv.exe
  C:\Windows\System\NNTWRDv.exe
  2⤵
  PID:10252
- C:\Windows\System\jWiusZL.exe
  C:\Windows\System\jWiusZL.exe
  2⤵
  PID:10280
- C:\Windows\System\XtnDdcw.exe
  C:\Windows\System\XtnDdcw.exe
  2⤵
  PID:10296
- C:\Windows\System\DTsBqdp.exe
  C:\Windows\System\DTsBqdp.exe
  2⤵
  PID:10316
- C:\Windows\System\LeoEZYk.exe
  C:\Windows\System\LeoEZYk.exe
  2⤵
  PID:10332
- C:\Windows\System\yCpwQzk.exe
  C:\Windows\System\yCpwQzk.exe
  2⤵
  PID:10356
- C:\Windows\System\ZUlmhWe.exe
  C:\Windows\System\ZUlmhWe.exe
  2⤵
  PID:10372
- C:\Windows\System\YvdSaCE.exe
  C:\Windows\System\YvdSaCE.exe
  2⤵
  PID:10400
- C:\Windows\System\iMAihtD.exe
  C:\Windows\System\iMAihtD.exe
  2⤵
  PID:10420
- C:\Windows\System\fCIIfXD.exe
  C:\Windows\System\fCIIfXD.exe
  2⤵
  PID:10448
- C:\Windows\System\QXpdNOs.exe
  C:\Windows\System\QXpdNOs.exe
  2⤵
  PID:10468
- C:\Windows\System\tKkSOaw.exe
  C:\Windows\System\tKkSOaw.exe
  2⤵
  PID:10488
- C:\Windows\System\ZIkzJOU.exe
  C:\Windows\System\ZIkzJOU.exe
  2⤵
  PID:10536
- C:\Windows\System\ZkeDdxR.exe
  C:\Windows\System\ZkeDdxR.exe
  2⤵
  PID:10564
- C:\Windows\System\HirQEZO.exe
  C:\Windows\System\HirQEZO.exe
  2⤵
  PID:10588
- C:\Windows\System\ixLIIZN.exe
  C:\Windows\System\ixLIIZN.exe
  2⤵
  PID:10620
- C:\Windows\System\Jtxfmvt.exe
  C:\Windows\System\Jtxfmvt.exe
  2⤵
  PID:10656
- C:\Windows\System\BQiAudQ.exe
  C:\Windows\System\BQiAudQ.exe
  2⤵
  PID:10680
- C:\Windows\System\PnRtkof.exe
  C:\Windows\System\PnRtkof.exe
  2⤵
  PID:10708
- C:\Windows\System\XAZpxIh.exe
  C:\Windows\System\XAZpxIh.exe
  2⤵
  PID:10728
- C:\Windows\System\ogWnVOM.exe
  C:\Windows\System\ogWnVOM.exe
  2⤵
  PID:10744
- C:\Windows\System\btyHOyj.exe
  C:\Windows\System\btyHOyj.exe
  2⤵
  PID:10760
- C:\Windows\System\ggmCsTg.exe
  C:\Windows\System\ggmCsTg.exe
  2⤵
  PID:10788
- C:\Windows\System\RvWGWWV.exe
  C:\Windows\System\RvWGWWV.exe
  2⤵
  PID:10804
- C:\Windows\System\qjiDtEz.exe
  C:\Windows\System\qjiDtEz.exe
  2⤵
  PID:10836
- C:\Windows\System\ooeczey.exe
  C:\Windows\System\ooeczey.exe
  2⤵
  PID:10852
- C:\Windows\System\BFMVriZ.exe
  C:\Windows\System\BFMVriZ.exe
  2⤵
  PID:10880
- C:\Windows\System\MzvGyAe.exe
  C:\Windows\System\MzvGyAe.exe
  2⤵
  PID:10904
- C:\Windows\System\npMYqgh.exe
  C:\Windows\System\npMYqgh.exe
  2⤵
  PID:10928
- C:\Windows\System\jMaEQSK.exe
  C:\Windows\System\jMaEQSK.exe
  2⤵
  PID:10944
- C:\Windows\System\NIwfzRK.exe
  C:\Windows\System\NIwfzRK.exe
  2⤵
  PID:10960
- C:\Windows\System\HiFwiUY.exe
  C:\Windows\System\HiFwiUY.exe
  2⤵
  PID:10980
- C:\Windows\System\JzbXYLh.exe
  C:\Windows\System\JzbXYLh.exe
  2⤵
  PID:11000
- C:\Windows\System\mKBsHpc.exe
  C:\Windows\System\mKBsHpc.exe
  2⤵
  PID:11024
- C:\Windows\System\VKhCwGQ.exe
  C:\Windows\System\VKhCwGQ.exe
  2⤵
  PID:11048
- C:\Windows\System\zJAFbKm.exe
  C:\Windows\System\zJAFbKm.exe
  2⤵
  PID:11068
- C:\Windows\System\nHmOFRr.exe
  C:\Windows\System\nHmOFRr.exe
  2⤵
  PID:11092
- C:\Windows\System\EByaitN.exe
  C:\Windows\System\EByaitN.exe
  2⤵
  PID:11116
- C:\Windows\System\qKHQCKJ.exe
  C:\Windows\System\qKHQCKJ.exe
  2⤵
  PID:11140
- C:\Windows\System\zUDkgkh.exe
  C:\Windows\System\zUDkgkh.exe
  2⤵
  PID:11160
- C:\Windows\System\UAZqeUM.exe
  C:\Windows\System\UAZqeUM.exe
  2⤵
  PID:11184
- C:\Windows\System\rGfKNSW.exe
  C:\Windows\System\rGfKNSW.exe
  2⤵
  PID:11208
- C:\Windows\System\lqwGHYW.exe
  C:\Windows\System\lqwGHYW.exe
  2⤵
  PID:11232
- C:\Windows\System\osKebtV.exe
  C:\Windows\System\osKebtV.exe
  2⤵
  PID:11256
- C:\Windows\System\rbNNAhU.exe
  C:\Windows\System\rbNNAhU.exe
  2⤵
  PID:10228
- C:\Windows\System\JEhfEwF.exe
  C:\Windows\System\JEhfEwF.exe
  2⤵
  PID:8040
- C:\Windows\System\xczhIFJ.exe
  C:\Windows\System\xczhIFJ.exe
  2⤵
  PID:9196
- C:\Windows\System\ycxIUrj.exe
  C:\Windows\System\ycxIUrj.exe
  2⤵
  PID:7164
- C:\Windows\System\uNinJaC.exe
  C:\Windows\System\uNinJaC.exe
  2⤵
  PID:7924
- C:\Windows\System\gOkjcZo.exe
  C:\Windows\System\gOkjcZo.exe
  2⤵
  PID:9316
- C:\Windows\System\BaNajqb.exe
  C:\Windows\System\BaNajqb.exe
  2⤵
  PID:8472
- C:\Windows\System\TaccMYu.exe
  C:\Windows\System\TaccMYu.exe
  2⤵
  PID:9184
- C:\Windows\System\qvYOiwZ.exe
  C:\Windows\System\qvYOiwZ.exe
  2⤵
  PID:5508
- C:\Windows\System\fsfCRGp.exe
  C:\Windows\System\fsfCRGp.exe
  2⤵
  PID:9448
- C:\Windows\System\GFZmylN.exe
  C:\Windows\System\GFZmylN.exe
  2⤵
  PID:8504
- C:\Windows\System\WMEVbiL.exe
  C:\Windows\System\WMEVbiL.exe
  2⤵
  PID:2652
- C:\Windows\System\sCcXFNy.exe
  C:\Windows\System\sCcXFNy.exe
  2⤵
  PID:6692
- C:\Windows\System\rTLQvLh.exe
  C:\Windows\System\rTLQvLh.exe
  2⤵
  PID:7328
- C:\Windows\System\agLxcpw.exe
  C:\Windows\System\agLxcpw.exe
  2⤵
  PID:7416
- C:\Windows\System\BRieRbd.exe
  C:\Windows\System\BRieRbd.exe
  2⤵
  PID:7560
- C:\Windows\System\sJSTsDh.exe
  C:\Windows\System\sJSTsDh.exe
  2⤵
  PID:9884
- C:\Windows\System\gjXsGjU.exe
  C:\Windows\System\gjXsGjU.exe
  2⤵
  PID:10120
- C:\Windows\System\JAdeMBb.exe
  C:\Windows\System\JAdeMBb.exe
  2⤵
  PID:10096
- C:\Windows\System\uUHzpvT.exe
  C:\Windows\System\uUHzpvT.exe
  2⤵
  PID:10208
- C:\Windows\System\xPJliOl.exe
  C:\Windows\System\xPJliOl.exe
  2⤵
  PID:10364
- C:\Windows\System\vIUpqVb.exe
  C:\Windows\System\vIUpqVb.exe
  2⤵
  PID:10496
- C:\Windows\System\VVQYQFI.exe
  C:\Windows\System\VVQYQFI.exe
  2⤵
  PID:8292
- C:\Windows\System\sJfgrBw.exe
  C:\Windows\System\sJfgrBw.exe
  2⤵
  PID:10528
- C:\Windows\System\afhReHe.exe
  C:\Windows\System\afhReHe.exe
  2⤵
  PID:11284
- C:\Windows\System\mfXddSr.exe
  C:\Windows\System\mfXddSr.exe
  2⤵
  PID:11312
- C:\Windows\System\uYbQpXF.exe
  C:\Windows\System\uYbQpXF.exe
  2⤵
  PID:11336
- C:\Windows\System\PNepEcK.exe
  C:\Windows\System\PNepEcK.exe
  2⤵
  PID:11356
- C:\Windows\System\BCXiVBY.exe
  C:\Windows\System\BCXiVBY.exe
  2⤵
  PID:11380
- C:\Windows\System\cvdDiIH.exe
  C:\Windows\System\cvdDiIH.exe
  2⤵
  PID:11404
- C:\Windows\System\qUEyKIw.exe
  C:\Windows\System\qUEyKIw.exe
  2⤵
  PID:11432
- C:\Windows\System\lVbaQUo.exe
  C:\Windows\System\lVbaQUo.exe
  2⤵
  PID:11456
- C:\Windows\System\bINbcfP.exe
  C:\Windows\System\bINbcfP.exe
  2⤵
  PID:11480
- C:\Windows\System\pJKXNaQ.exe
  C:\Windows\System\pJKXNaQ.exe
  2⤵
  PID:11504
- C:\Windows\System\rcCxXbu.exe
  C:\Windows\System\rcCxXbu.exe
  2⤵
  PID:11524
- C:\Windows\System\teLAyYQ.exe
  C:\Windows\System\teLAyYQ.exe
  2⤵
  PID:11548
- C:\Windows\System\lCcxtEO.exe
  C:\Windows\System\lCcxtEO.exe
  2⤵
  PID:11572
- C:\Windows\System\ygkjIzq.exe
  C:\Windows\System\ygkjIzq.exe
  2⤵
  PID:11592
- C:\Windows\System\MRrQZgo.exe
  C:\Windows\System\MRrQZgo.exe
  2⤵
  PID:11616
- C:\Windows\System\CFAMGnm.exe
  C:\Windows\System\CFAMGnm.exe
  2⤵
  PID:11648
- C:\Windows\System\Jgmsmgk.exe
  C:\Windows\System\Jgmsmgk.exe
  2⤵
  PID:11668
- C:\Windows\System\GIxntvW.exe
  C:\Windows\System\GIxntvW.exe
  2⤵
  PID:11688
- C:\Windows\System\aFMjQik.exe
  C:\Windows\System\aFMjQik.exe
  2⤵
  PID:11704
- C:\Windows\System\XQsRHCD.exe
  C:\Windows\System\XQsRHCD.exe
  2⤵
  PID:11724
- C:\Windows\System\nSBVdiP.exe
  C:\Windows\System\nSBVdiP.exe
  2⤵
  PID:11740
- C:\Windows\System\VqZEUMv.exe
  C:\Windows\System\VqZEUMv.exe
  2⤵
  PID:11764
- C:\Windows\System\zSxKwHO.exe
  C:\Windows\System\zSxKwHO.exe
  2⤵
  PID:11788
- C:\Windows\System\OpTIejp.exe
  C:\Windows\System\OpTIejp.exe
  2⤵
  PID:11812
- C:\Windows\System\uuHvsPq.exe
  C:\Windows\System\uuHvsPq.exe
  2⤵
  PID:11836
- C:\Windows\System\JjXGUhV.exe
  C:\Windows\System\JjXGUhV.exe
  2⤵
  PID:11860
- C:\Windows\System\LwPFuqM.exe
  C:\Windows\System\LwPFuqM.exe
  2⤵
  PID:11880
- C:\Windows\System\iuwALXs.exe
  C:\Windows\System\iuwALXs.exe
  2⤵
  PID:11908
- C:\Windows\System\GjpiHUl.exe
  C:\Windows\System\GjpiHUl.exe
  2⤵
  PID:11928
- C:\Windows\System\uRXPWzJ.exe
  C:\Windows\System\uRXPWzJ.exe
  2⤵
  PID:11948
- C:\Windows\System\YZjHkiz.exe
  C:\Windows\System\YZjHkiz.exe
  2⤵
  PID:11972
- C:\Windows\System\OfJvmyA.exe
  C:\Windows\System\OfJvmyA.exe
  2⤵
  PID:12008
- C:\Windows\System\TAQZMlA.exe
  C:\Windows\System\TAQZMlA.exe
  2⤵
  PID:12028
- C:\Windows\System\YwdkwHu.exe
  C:\Windows\System\YwdkwHu.exe
  2⤵
  PID:12052
- C:\Windows\System\HmuPHZU.exe
  C:\Windows\System\HmuPHZU.exe
  2⤵
  PID:12072
- C:\Windows\System\eQdUVRq.exe
  C:\Windows\System\eQdUVRq.exe
  2⤵
  PID:12092
- C:\Windows\System\CaPxBVs.exe
  C:\Windows\System\CaPxBVs.exe
  2⤵
  PID:12108
- C:\Windows\System\WqqriAh.exe
  C:\Windows\System\WqqriAh.exe
  2⤵
  PID:12128
- C:\Windows\System\ygmyoei.exe
  C:\Windows\System\ygmyoei.exe
  2⤵
  PID:12144
- C:\Windows\System\XsVumqe.exe
  C:\Windows\System\XsVumqe.exe
  2⤵
  PID:12160
- C:\Windows\System\AwRxIwh.exe
  C:\Windows\System\AwRxIwh.exe
  2⤵
  PID:12176
- C:\Windows\System\chtacHk.exe
  C:\Windows\System\chtacHk.exe
  2⤵
  PID:12196
- C:\Windows\System\yFoNJzA.exe
  C:\Windows\System\yFoNJzA.exe
  2⤵
  PID:12224
- C:\Windows\System\TGIkioy.exe
  C:\Windows\System\TGIkioy.exe
  2⤵
  PID:12244
- C:\Windows\System\qQSBBHl.exe
  C:\Windows\System\qQSBBHl.exe
  2⤵
  PID:12268
- C:\Windows\System\onJkqmr.exe
  C:\Windows\System\onJkqmr.exe
  2⤵
  PID:10560
- C:\Windows\System\vLEnqqK.exe
  C:\Windows\System\vLEnqqK.exe
  2⤵
  PID:10604
- C:\Windows\System\DHWJQnz.exe
  C:\Windows\System\DHWJQnz.exe
  2⤵
  PID:9380
- C:\Windows\System\YrvNFXR.exe
  C:\Windows\System\YrvNFXR.exe
  2⤵
  PID:9416
- C:\Windows\System\wRnXmCy.exe
  C:\Windows\System\wRnXmCy.exe
  2⤵
  PID:9596
- C:\Windows\System\XQjAmOR.exe
  C:\Windows\System\XQjAmOR.exe
  2⤵
  PID:10844
- C:\Windows\System\EnboVyg.exe
  C:\Windows\System\EnboVyg.exe
  2⤵
  PID:10892
- C:\Windows\System\nGHdRgi.exe
  C:\Windows\System\nGHdRgi.exe
  2⤵
  PID:10940
- C:\Windows\System\yckWiyQ.exe
  C:\Windows\System\yckWiyQ.exe
  2⤵
  PID:10996
- C:\Windows\System\KBTlUfm.exe
  C:\Windows\System\KBTlUfm.exe
  2⤵
  PID:11084
- C:\Windows\System\XZyzdEW.exe
  C:\Windows\System\XZyzdEW.exe
  2⤵
  PID:11132
- C:\Windows\System\nUSuLkz.exe
  C:\Windows\System\nUSuLkz.exe
  2⤵
  PID:11196
- C:\Windows\System\VKPlSfv.exe
  C:\Windows\System\VKPlSfv.exe
  2⤵
  PID:9924
- C:\Windows\System\gICpyuN.exe
  C:\Windows\System\gICpyuN.exe
  2⤵
  PID:9980
- C:\Windows\System\PJFHdPg.exe
  C:\Windows\System\PJFHdPg.exe
  2⤵
  PID:9684
- C:\Windows\System\eKoZyHm.exe
  C:\Windows\System\eKoZyHm.exe
  2⤵
  PID:12308
- C:\Windows\System\uETkFJZ.exe
  C:\Windows\System\uETkFJZ.exe
  2⤵
  PID:12328
- C:\Windows\System\QKTCOxd.exe
  C:\Windows\System\QKTCOxd.exe
  2⤵
  PID:12348
- C:\Windows\System\AHqgYhG.exe
  C:\Windows\System\AHqgYhG.exe
  2⤵
  PID:12376
- C:\Windows\System\UzRKcjm.exe
  C:\Windows\System\UzRKcjm.exe
  2⤵
  PID:12396
- C:\Windows\System\PcavNze.exe
  C:\Windows\System\PcavNze.exe
  2⤵
  PID:12428
- C:\Windows\System\TiOHnEt.exe
  C:\Windows\System\TiOHnEt.exe
  2⤵
  PID:12444
- C:\Windows\System\iIxiqkp.exe
  C:\Windows\System\iIxiqkp.exe
  2⤵
  PID:12468
- C:\Windows\System\VQBEbUZ.exe
  C:\Windows\System\VQBEbUZ.exe
  2⤵
  PID:12492
- C:\Windows\System\dPiSemR.exe
  C:\Windows\System\dPiSemR.exe
  2⤵
  PID:12520
- C:\Windows\System\ZDyBngZ.exe
  C:\Windows\System\ZDyBngZ.exe
  2⤵
  PID:12540
- C:\Windows\System\zqruYva.exe
  C:\Windows\System\zqruYva.exe
  2⤵
  PID:12560
- C:\Windows\System\MDmHQYZ.exe
  C:\Windows\System\MDmHQYZ.exe
  2⤵
  PID:12584
- C:\Windows\System\WndcYaM.exe
  C:\Windows\System\WndcYaM.exe
  2⤵
  PID:12612
- C:\Windows\System\nthvDZI.exe
  C:\Windows\System\nthvDZI.exe
  2⤵
  PID:12636
- C:\Windows\System\pMWeLWY.exe
  C:\Windows\System\pMWeLWY.exe
  2⤵
  PID:12656
- C:\Windows\System\VnlMbvE.exe
  C:\Windows\System\VnlMbvE.exe
  2⤵
  PID:12676
- C:\Windows\System\GmdoyCl.exe
  C:\Windows\System\GmdoyCl.exe
  2⤵
  PID:12696
- C:\Windows\System\nsXaVzp.exe
  C:\Windows\System\nsXaVzp.exe
  2⤵
  PID:12736
- C:\Windows\System\YhoQfHK.exe
  C:\Windows\System\YhoQfHK.exe
  2⤵
  PID:12752
- C:\Windows\System\JTbBAUP.exe
  C:\Windows\System\JTbBAUP.exe
  2⤵
  PID:12776
- C:\Windows\System\rbqdrXy.exe
  C:\Windows\System\rbqdrXy.exe
  2⤵
  PID:12796
- C:\Windows\System\PRScFhS.exe
  C:\Windows\System\PRScFhS.exe
  2⤵
  PID:12820
- C:\Windows\System\iRttGdq.exe
  C:\Windows\System\iRttGdq.exe
  2⤵
  PID:12840
- C:\Windows\System\NpoaZiy.exe
  C:\Windows\System\NpoaZiy.exe
  2⤵
  PID:12864
- C:\Windows\System\JyYRaHV.exe
  C:\Windows\System\JyYRaHV.exe
  2⤵
  PID:12888
- C:\Windows\System\iodpjTk.exe
  C:\Windows\System\iodpjTk.exe
  2⤵
  PID:12916
- C:\Windows\System\sajJjaz.exe
  C:\Windows\System\sajJjaz.exe
  2⤵
  PID:12936
- C:\Windows\System\QSTaIOF.exe
  C:\Windows\System\QSTaIOF.exe
  2⤵
  PID:12952
- C:\Windows\System\BNaiAWr.exe
  C:\Windows\System\BNaiAWr.exe
  2⤵
  PID:12968
- C:\Windows\System\YXqGfrh.exe
  C:\Windows\System\YXqGfrh.exe
  2⤵
  PID:12984
- C:\Windows\System\CTZDTcB.exe
  C:\Windows\System\CTZDTcB.exe
  2⤵
  PID:13000
- C:\Windows\System\TlyLBxY.exe
  C:\Windows\System\TlyLBxY.exe
  2⤵
  PID:13020
- C:\Windows\System\MnSFZaE.exe
  C:\Windows\System\MnSFZaE.exe
  2⤵
  PID:13040
- C:\Windows\System\DUvWspi.exe
  C:\Windows\System\DUvWspi.exe
  2⤵
  PID:13060
- C:\Windows\System\bErsezp.exe
  C:\Windows\System\bErsezp.exe
  2⤵
  PID:13076
- C:\Windows\System\rLPQliX.exe
  C:\Windows\System\rLPQliX.exe
  2⤵
  PID:13104
- C:\Windows\System\GLOzWEL.exe
  C:\Windows\System\GLOzWEL.exe
  2⤵
  PID:13124
- C:\Windows\System\yOhJhVW.exe
  C:\Windows\System\yOhJhVW.exe
  2⤵
  PID:13144
- C:\Windows\System\GdtGwBe.exe
  C:\Windows\System\GdtGwBe.exe
  2⤵
  PID:13160
- C:\Windows\System\YtsGvJN.exe
  C:\Windows\System\YtsGvJN.exe
  2⤵
  PID:13180
- C:\Windows\System\YJpLBGD.exe
  C:\Windows\System\YJpLBGD.exe
  2⤵
  PID:13196
- C:\Windows\System\Xrnrwkj.exe
  C:\Windows\System\Xrnrwkj.exe
  2⤵
  PID:13220
- C:\Windows\System\JbQaKXx.exe
  C:\Windows\System\JbQaKXx.exe
  2⤵
  PID:13236
- C:\Windows\System\RMedNDY.exe
  C:\Windows\System\RMedNDY.exe
  2⤵
  PID:13256
- C:\Windows\System\IfbOeUc.exe
  C:\Windows\System\IfbOeUc.exe
  2⤵
  PID:13276
- C:\Windows\System\vNNAcZl.exe
  C:\Windows\System\vNNAcZl.exe
  2⤵
  PID:13292
- C:\Windows\System\uYBpfmB.exe
  C:\Windows\System\uYBpfmB.exe
  2⤵
  PID:9764
- C:\Windows\System\HLkOlOh.exe
  C:\Windows\System\HLkOlOh.exe
  2⤵
  PID:10196
- C:\Windows\System\fmLWcvI.exe
  C:\Windows\System\fmLWcvI.exe
  2⤵
  PID:10276
- C:\Windows\System\PXtNOKG.exe
  C:\Windows\System\PXtNOKG.exe
  2⤵
  PID:8600
- C:\Windows\System\MpnWTLP.exe
  C:\Windows\System\MpnWTLP.exe
  2⤵
  PID:7268
- C:\Windows\System\bsWsHPJ.exe
  C:\Windows\System\bsWsHPJ.exe
  2⤵
  PID:10032
- C:\Windows\System\ZLPOsJn.exe
  C:\Windows\System\ZLPOsJn.exe
  2⤵
  PID:6756
- C:\Windows\System\WRRXKMD.exe
  C:\Windows\System\WRRXKMD.exe
  2⤵
  PID:11444
- C:\Windows\System\SlgNiJv.exe
  C:\Windows\System\SlgNiJv.exe
  2⤵
  PID:11536
- C:\Windows\System\CwAYMsy.exe
  C:\Windows\System\CwAYMsy.exe
  2⤵
  PID:11644
- C:\Windows\System\atRCTNj.exe
  C:\Windows\System\atRCTNj.exe
  2⤵
  PID:11780
- C:\Windows\System\hMHpJAn.exe
  C:\Windows\System\hMHpJAn.exe
  2⤵
  PID:11848
- C:\Windows\System\juKlKaI.exe
  C:\Windows\System\juKlKaI.exe
  2⤵
  PID:11892
- C:\Windows\System\hZblnHP.exe
  C:\Windows\System\hZblnHP.exe
  2⤵
  PID:12044
- C:\Windows\System\oIkLWIW.exe
  C:\Windows\System\oIkLWIW.exe
  2⤵
  PID:12172
- C:\Windows\System\DACjKnj.exe
  C:\Windows\System\DACjKnj.exe
  2⤵
  PID:11696
- C:\Windows\System\phNyVtI.exe
  C:\Windows\System\phNyVtI.exe
  2⤵
  PID:10920
- C:\Windows\System\BarWLSM.exe
  C:\Windows\System\BarWLSM.exe
  2⤵
  PID:11772
- C:\Windows\System\fKxQWWC.exe
  C:\Windows\System\fKxQWWC.exe
  2⤵
  PID:12184
- C:\Windows\System\VyzTsLh.exe
  C:\Windows\System\VyzTsLh.exe
  2⤵
  PID:5908
- C:\Windows\System\IIGLrVy.exe
  C:\Windows\System\IIGLrVy.exe
  2⤵
  PID:9656
- C:\Windows\System\tVUMYpO.exe
  C:\Windows\System\tVUMYpO.exe
  2⤵
  PID:10444
- C:\Windows\System\YToMxkJ.exe
  C:\Windows\System\YToMxkJ.exe
  2⤵
  PID:9468
- C:\Windows\System\WrkayNF.exe
  C:\Windows\System\WrkayNF.exe
  2⤵
  PID:10596
- C:\Windows\System\QipcBxo.exe
  C:\Windows\System\QipcBxo.exe
  2⤵
  PID:9524
- C:\Windows\System\IoFMuUa.exe
  C:\Windows\System\IoFMuUa.exe
  2⤵
  PID:10976
- C:\Windows\System\JANXPwA.exe
  C:\Windows\System\JANXPwA.exe
  2⤵
  PID:7992
- C:\Windows\System\oLZUhwb.exe
  C:\Windows\System\oLZUhwb.exe
  2⤵
  PID:2740
- C:\Windows\System\fTwZFzY.exe
  C:\Windows\System\fTwZFzY.exe
  2⤵
  PID:12292
- C:\Windows\System\Tbqouyq.exe
  C:\Windows\System\Tbqouyq.exe
  2⤵
  PID:12356
- C:\Windows\System\MjxghMT.exe
  C:\Windows\System\MjxghMT.exe
  2⤵
  PID:12452
- C:\Windows\System\Gsylojp.exe
  C:\Windows\System\Gsylojp.exe
  2⤵
  PID:12500
- C:\Windows\System\CDmuQqA.exe
  C:\Windows\System\CDmuQqA.exe
  2⤵
  PID:12580
- C:\Windows\System\wKptNkD.exe
  C:\Windows\System\wKptNkD.exe
  2⤵
  PID:12652
- C:\Windows\System\lmwIXBf.exe
  C:\Windows\System\lmwIXBf.exe
  2⤵
  PID:12708
- C:\Windows\System\jzMmkvJ.exe
  C:\Windows\System\jzMmkvJ.exe
  2⤵
  PID:12792
- C:\Windows\System\bySADCp.exe
  C:\Windows\System\bySADCp.exe
  2⤵
  PID:12908
- C:\Windows\System\yaPbzPU.exe
  C:\Windows\System\yaPbzPU.exe
  2⤵
  PID:12996
- C:\Windows\System\jdQqmOS.exe
  C:\Windows\System\jdQqmOS.exe
  2⤵
  PID:13120
- C:\Windows\System\kwgjOdf.exe
  C:\Windows\System\kwgjOdf.exe
  2⤵
  PID:13216
- C:\Windows\System\PdbQcnf.exe
  C:\Windows\System\PdbQcnf.exe
  2⤵
  PID:10160
- C:\Windows\System\spJOOKH.exe
  C:\Windows\System\spJOOKH.exe
  2⤵
  PID:7824
- C:\Windows\System\dDgeAkO.exe
  C:\Windows\System\dDgeAkO.exe
  2⤵
  PID:9544
- C:\Windows\System\jklHqvP.exe
  C:\Windows\System\jklHqvP.exe
  2⤵
  PID:8980
- C:\Windows\System\jCXGSjz.exe
  C:\Windows\System\jCXGSjz.exe
  2⤵
  PID:4212
- C:\Windows\System\FUKhgGd.exe
  C:\Windows\System\FUKhgGd.exe
  2⤵
  PID:4864
- C:\Windows\System\RijFhAm.exe
  C:\Windows\System\RijFhAm.exe
  2⤵
  PID:1948
- C:\Windows\System\iCvPxmx.exe
  C:\Windows\System\iCvPxmx.exe
  2⤵
  PID:404
- C:\Windows\System\wfsqRIG.exe
  C:\Windows\System\wfsqRIG.exe
  2⤵
  PID:3884
- C:\Windows\System\GmALbLs.exe
  C:\Windows\System\GmALbLs.exe
  2⤵
  PID:3540
- C:\Windows\System\NZfLHcM.exe
  C:\Windows\System\NZfLHcM.exe
  2⤵
  PID:2616
- C:\Windows\System\fEfOKTb.exe
  C:\Windows\System\fEfOKTb.exe
  2⤵
  PID:1056
- C:\Windows\System\PVIQlID.exe
  C:\Windows\System\PVIQlID.exe
  2⤵
  PID:5916
- C:\Windows\System\sshXyHM.exe
  C:\Windows\System\sshXyHM.exe
  2⤵
  PID:6256
- C:\Windows\System\EYXedeg.exe
  C:\Windows\System\EYXedeg.exe
  2⤵
  PID:10720
- C:\Windows\System\zsxaKUF.exe
  C:\Windows\System\zsxaKUF.exe
  2⤵
  PID:11292
- C:\Windows\System\qYYzOpg.exe
  C:\Windows\System\qYYzOpg.exe
  2⤵
  PID:12252
- C:\Windows\System\BMaRNYp.exe
  C:\Windows\System\BMaRNYp.exe
  2⤵
  PID:12152
- C:\Windows\System\SZSrlQe.exe
  C:\Windows\System\SZSrlQe.exe
  2⤵
  PID:4860
- C:\Windows\System\fNIBKme.exe
  C:\Windows\System\fNIBKme.exe
  2⤵
  PID:8996
- C:\Windows\System\SGNNbup.exe
  C:\Windows\System\SGNNbup.exe
  2⤵
  PID:4972
- C:\Windows\System\SmjPDCK.exe
  C:\Windows\System\SmjPDCK.exe
  2⤵
  PID:1624
- C:\Windows\System\nHYaHXL.exe
  C:\Windows\System\nHYaHXL.exe
  2⤵
  PID:11020
- C:\Windows\System\LwgSTaH.exe
  C:\Windows\System\LwgSTaH.exe
  2⤵
  PID:9284
- C:\Windows\System\RuMDGBM.exe
  C:\Windows\System\RuMDGBM.exe
  2⤵
  PID:9064
- C:\Windows\System\PzAPWvX.exe
  C:\Windows\System\PzAPWvX.exe
  2⤵
  PID:13272
- C:\Windows\System\tkvahhD.exe
  C:\Windows\System\tkvahhD.exe
  2⤵
  PID:11216
- C:\Windows\System\OeXqSwY.exe
  C:\Windows\System\OeXqSwY.exe
  2⤵
  PID:3364
- C:\Windows\System\OsWzSeW.exe
  C:\Windows\System\OsWzSeW.exe
  2⤵
  PID:12236
- C:\Windows\System\BlhDQaB.exe
  C:\Windows\System\BlhDQaB.exe
  2⤵
  PID:4040
- C:\Windows\System\rzQXrOo.exe
  C:\Windows\System\rzQXrOo.exe
  2⤵
  PID:13336
- C:\Windows\System\qMywFIr.exe
  C:\Windows\System\qMywFIr.exe
  2⤵
  PID:13372
- C:\Windows\System\lvPmWuy.exe
  C:\Windows\System\lvPmWuy.exe
  2⤵
  PID:13400
- C:\Windows\System\JBtMyiQ.exe
  C:\Windows\System\JBtMyiQ.exe
  2⤵
  PID:13424
- C:\Windows\System\FqwBadd.exe
  C:\Windows\System\FqwBadd.exe
  2⤵
  PID:13452
- C:\Windows\System\zUyVuts.exe
  C:\Windows\System\zUyVuts.exe
  2⤵
  PID:13480
- C:\Windows\System\PAWzdUF.exe
  C:\Windows\System\PAWzdUF.exe
  2⤵
  PID:13516
- C:\Windows\System\iYPGPEZ.exe
  C:\Windows\System\iYPGPEZ.exe
  2⤵
  PID:13588
- C:\Windows\System\ZhxXRwo.exe
  C:\Windows\System\ZhxXRwo.exe
  2⤵
  PID:13608
- C:\Windows\System\PHZPcJn.exe
  C:\Windows\System\PHZPcJn.exe
  2⤵
  PID:13628
- C:\Windows\System\lJjMlOX.exe
  C:\Windows\System\lJjMlOX.exe
  2⤵
  PID:13652
- C:\Windows\System\yaPwHjb.exe
  C:\Windows\System\yaPwHjb.exe
  2⤵
  PID:13696
- C:\Windows\System\zwOorhn.exe
  C:\Windows\System\zwOorhn.exe
  2⤵
  PID:13764
- C:\Windows\System\TLqbCnJ.exe
  C:\Windows\System\TLqbCnJ.exe
  2⤵
  PID:13792
- C:\Windows\System\KNnJUqs.exe
  C:\Windows\System\KNnJUqs.exe
  2⤵
  PID:13920
- C:\Windows\System\ZeenNzZ.exe
  C:\Windows\System\ZeenNzZ.exe
  2⤵
  PID:14020
- C:\Windows\System\ahSKUJZ.exe
  C:\Windows\System\ahSKUJZ.exe
  2⤵
  PID:14136
- C:\Windows\System\xkAwxgU.exe
  C:\Windows\System\xkAwxgU.exe
  2⤵
  PID:14176
- C:\Windows\System\nuQGBeK.exe
  C:\Windows\System\nuQGBeK.exe
  2⤵
  PID:14192
- C:\Windows\System\AXMhMtc.exe
  C:\Windows\System\AXMhMtc.exe
  2⤵
  PID:14276
- C:\Windows\System\oJaOsAK.exe
  C:\Windows\System\oJaOsAK.exe
  2⤵
  PID:14296
- C:\Windows\System\IFtASnI.exe
  C:\Windows\System\IFtASnI.exe
  2⤵
  PID:10972
- C:\Windows\System\KCfNjco.exe
  C:\Windows\System\KCfNjco.exe
  2⤵
  PID:13016
- C:\Windows\System\WicBwXI.exe
  C:\Windows\System\WicBwXI.exe
  2⤵
  PID:13568
- C:\Windows\System\jMSHMvs.exe
  C:\Windows\System\jMSHMvs.exe
  2⤵
  PID:13548
- C:\Windows\System\baOyWzq.exe
  C:\Windows\System\baOyWzq.exe
  2⤵
  PID:13856
- C:\Windows\System\ttwWnEh.exe
  C:\Windows\System\ttwWnEh.exe
  2⤵
  PID:13928
- C:\Windows\System\zeIJJGV.exe
  C:\Windows\System\zeIJJGV.exe
  2⤵
  PID:13980
- C:\Windows\System\UCkbEZw.exe
  C:\Windows\System\UCkbEZw.exe
  2⤵
  PID:13948
- C:\Windows\System\liHGKqw.exe
  C:\Windows\System\liHGKqw.exe
  2⤵
  PID:13904
- C:\Windows\System\LMhZUex.exe
  C:\Windows\System\LMhZUex.exe
  2⤵
  PID:14144
- C:\Windows\System\AhgloMD.exe
  C:\Windows\System\AhgloMD.exe
  2⤵
  PID:14084
- C:\Windows\System\mfyGDyx.exe
  C:\Windows\System\mfyGDyx.exe
  2⤵
  PID:13804
- C:\Windows\System\yGAylRh.exe
  C:\Windows\System\yGAylRh.exe
  2⤵
  PID:13192
- C:\Windows\System\GPXwhqc.exe
  C:\Windows\System\GPXwhqc.exe
  2⤵
  PID:12192
- C:\Windows\System\IaZorpr.exe
  C:\Windows\System\IaZorpr.exe
  2⤵
  PID:12672
- C:\Windows\System\yKtVhwZ.exe
  C:\Windows\System\yKtVhwZ.exe
  2⤵
  PID:4536
- C:\Windows\System\aLOtoLf.exe
  C:\Windows\System\aLOtoLf.exe
  2⤵
  PID:12416
- C:\Windows\System\KrCGdYP.exe
  C:\Windows\System\KrCGdYP.exe
  2⤵
  PID:14324
- C:\Windows\System\rlrMCCA.exe
  C:\Windows\System\rlrMCCA.exe
  2⤵
  PID:4512
- C:\Windows\System\vgrIlDB.exe
  C:\Windows\System\vgrIlDB.exe
  2⤵
  PID:14128
- C:\Windows\System\HnfVQPZ.exe
  C:\Windows\System\HnfVQPZ.exe
  2⤵
  PID:14032
- C:\Windows\System\OujxdzL.exe
  C:\Windows\System\OujxdzL.exe
  2⤵
  PID:9400
- C:\Windows\System\fFDbvOz.exe
  C:\Windows\System\fFDbvOz.exe
  2⤵
  PID:4088
- C:\Windows\System\jdQhAxQ.exe
  C:\Windows\System\jdQhAxQ.exe
  2⤵
  PID:13352
- C:\Windows\System\PJVkSOz.exe
  C:\Windows\System\PJVkSOz.exe
  2⤵
  PID:11580
- C:\Windows\System\vmnMQsW.exe
  C:\Windows\System\vmnMQsW.exe
  2⤵
  PID:10388
- C:\Windows\System\QrsGsip.exe
  C:\Windows\System\QrsGsip.exe
  2⤵
  PID:13880
- C:\Windows\System\vQrkuky.exe
  C:\Windows\System\vQrkuky.exe
  2⤵
  PID:5016
- C:\Windows\System\UbljDdF.exe
  C:\Windows\System\UbljDdF.exe
  2⤵
  PID:13320
- C:\Windows\System\fReFrsJ.exe
  C:\Windows\System\fReFrsJ.exe
  2⤵
  PID:14316
- C:\Windows\System\XMzSaeM.exe
  C:\Windows\System\XMzSaeM.exe
  2⤵
  PID:13364
- C:\Windows\System\cCemEAp.exe
  C:\Windows\System\cCemEAp.exe
  2⤵
  PID:8064
- C:\Windows\System\MtMCWlz.exe
  C:\Windows\System\MtMCWlz.exe
  2⤵
  PID:1852
- C:\Windows\System\JWkgbNU.exe
  C:\Windows\System\JWkgbNU.exe
  2⤵
  PID:13728
- C:\Windows\System\lSBEbmz.exe
  C:\Windows\System\lSBEbmz.exe
  2⤵
  PID:8340
- C:\Windows\System\TLslLks.exe
  C:\Windows\System\TLslLks.exe
  2⤵
  PID:13388
- C:\Windows\System\GYzawAl.exe
  C:\Windows\System\GYzawAl.exe
  2⤵
  PID:10888
- C:\Windows\System\wAUAWmx.exe
  C:\Windows\System\wAUAWmx.exe
  2⤵
  PID:3468
- C:\Windows\System\NwtEFlg.exe
  C:\Windows\System\NwtEFlg.exe
  2⤵
  PID:13648
- C:\Windows\System\RuTOBCO.exe
  C:\Windows\System\RuTOBCO.exe
  2⤵
  PID:14080
- C:\Windows\System\wlVYXGQ.exe
  C:\Windows\System\wlVYXGQ.exe
  2⤵
  PID:3132
- C:\Windows\System\dNETRWE.exe
  C:\Windows\System\dNETRWE.exe
  2⤵
  PID:11844
- C:\Windows\System\WSHzgUc.exe
  C:\Windows\System\WSHzgUc.exe
  2⤵
  PID:220
- C:\Windows\System\naxheBs.exe
  C:\Windows\System\naxheBs.exe
  2⤵
  PID:3224
- C:\Windows\System\GFjpYJp.exe
  C:\Windows\System\GFjpYJp.exe
  2⤵
  PID:1180
- C:\Windows\System\MKlcScw.exe
  C:\Windows\System\MKlcScw.exe
  2⤵
  PID:14116
- C:\Windows\System\anuttdk.exe
  C:\Windows\System\anuttdk.exe
  2⤵
  PID:13616
- C:\Windows\System\kptIboG.exe
  C:\Windows\System\kptIboG.exe
  2⤵
  PID:11328
- C:\Windows\System\LerylIi.exe
  C:\Windows\System\LerylIi.exe
  2⤵
  PID:14188
- C:\Windows\System\uvCBkWa.exe
  C:\Windows\System\uvCBkWa.exe
  2⤵
  PID:436
- C:\Windows\System\wUkvFQR.exe
  C:\Windows\System\wUkvFQR.exe
  2⤵
  PID:2912
- C:\Windows\System\aRbMDpQ.exe
  C:\Windows\System\aRbMDpQ.exe
  2⤵
  PID:12532
- C:\Windows\System\iHenFNA.exe
  C:\Windows\System\iHenFNA.exe
  2⤵
  PID:12556
- C:\Windows\System\JbLSXYH.exe
  C:\Windows\System\JbLSXYH.exe
  2⤵
  PID:1064
- C:\Windows\System\IZIfeun.exe
  C:\Windows\System\IZIfeun.exe
  2⤵
  PID:13884
- C:\Windows\System\iwggBgt.exe
  C:\Windows\System\iwggBgt.exe
  2⤵
  PID:10028
- C:\Windows\System\JYPMspq.exe
  C:\Windows\System\JYPMspq.exe
  2⤵
  PID:3276
- C:\Windows\System\WyhpYvz.exe
  C:\Windows\System\WyhpYvz.exe
  2⤵
  PID:13644
- C:\Windows\System\uDIijEc.exe
  C:\Windows\System\uDIijEc.exe
  2⤵
  PID:10180
- C:\Windows\System\RuPepln.exe
  C:\Windows\System\RuPepln.exe
  2⤵
  PID:3656
- C:\Windows\System\FUiLJRp.exe
  C:\Windows\System\FUiLJRp.exe
  2⤵
  PID:14216
- C:\Windows\System\mYtyXsA.exe
  C:\Windows\System\mYtyXsA.exe
  2⤵
  PID:1840
- C:\Windows\System\WbEvbaS.exe
  C:\Windows\System\WbEvbaS.exe
  2⤵
  PID:3924
- C:\Windows\System\yTJdKjl.exe
  C:\Windows\System\yTJdKjl.exe
  2⤵
  PID:1792
- C:\Windows\System\HtFyXFf.exe
  C:\Windows\System\HtFyXFf.exe
  2⤵
  PID:4252
- C:\Windows\System\eKcPgQW.exe
  C:\Windows\System\eKcPgQW.exe
  2⤵
  PID:2368
- C:\Windows\System\aSCADkr.exe
  C:\Windows\System\aSCADkr.exe
  2⤵
  PID:684
- C:\Windows\System\cNvTNJI.exe
  C:\Windows\System\cNvTNJI.exe
  2⤵
  PID:13748
- C:\Windows\System\SFHYXci.exe
  C:\Windows\System\SFHYXci.exe
  2⤵
  PID:12156
- C:\Windows\System\VNtkOcS.exe
  C:\Windows\System\VNtkOcS.exe
  2⤵
  PID:11352
- C:\Windows\System\UNIiiXm.exe
  C:\Windows\System\UNIiiXm.exe
  2⤵
  PID:4848
- C:\Windows\System\XfQZBaY.exe
  C:\Windows\System\XfQZBaY.exe
  2⤵
  PID:14220
- C:\Windows\System\KTMODPp.exe
  C:\Windows\System\KTMODPp.exe
  2⤵
  PID:10584
- C:\Windows\System\duLmwGe.exe
  C:\Windows\System\duLmwGe.exe
  2⤵
  PID:3908
- C:\Windows\System\BUeDunZ.exe
  C:\Windows\System\BUeDunZ.exe
  2⤵
  PID:1692
- C:\Windows\System\aDlRKfQ.exe
  C:\Windows\System\aDlRKfQ.exe
  2⤵
  PID:3600
- C:\Windows\System\nTJDDXU.exe
  C:\Windows\System\nTJDDXU.exe
  2⤵
  PID:13972
- C:\Windows\System\aOUiiBt.exe
  C:\Windows\System\aOUiiBt.exe
  2⤵
  PID:1944
- C:\Windows\System\QunkLly.exe
  C:\Windows\System\QunkLly.exe
  2⤵
  PID:2256
- C:\Windows\System\LLGHiwC.exe
  C:\Windows\System\LLGHiwC.exe
  2⤵
  PID:4884
- C:\Windows\System\MWofJpn.exe
  C:\Windows\System\MWofJpn.exe
  2⤵
  PID:7688
- C:\Windows\System\bzEwdUn.exe
  C:\Windows\System\bzEwdUn.exe
  2⤵
  PID:5348
- C:\Windows\System\olMXWyN.exe
  C:\Windows\System\olMXWyN.exe
  2⤵
  PID:4892
- C:\Windows\System\ZGHJEhZ.exe
  C:\Windows\System\ZGHJEhZ.exe
  2⤵
  PID:5376
- C:\Windows\System\tSvNepG.exe
  C:\Windows\System\tSvNepG.exe
  2⤵
  PID:5112
- C:\Windows\System\WOEtkmk.exe
  C:\Windows\System\WOEtkmk.exe
  2⤵
  PID:13384
- C:\Windows\System\qSHDPDp.exe
  C:\Windows\System\qSHDPDp.exe
  2⤵
  PID:4692
- C:\Windows\System\noxziim.exe
  C:\Windows\System\noxziim.exe
  2⤵
  PID:5680
- C:\Windows\System\IXwHwlO.exe
  C:\Windows\System\IXwHwlO.exe
  2⤵
  PID:5968
- C:\Windows\System\RrUdTMZ.exe
  C:\Windows\System\RrUdTMZ.exe
  2⤵
  PID:4072
- C:\Windows\System\wzcQuUl.exe
  C:\Windows\System\wzcQuUl.exe
  2⤵
  PID:3548
- C:\Windows\System\kSqfoyv.exe
  C:\Windows\System\kSqfoyv.exe
  2⤵
  PID:3120
- C:\Windows\System\zXnTGnT.exe
  C:\Windows\System\zXnTGnT.exe
  2⤵
  PID:6012
- C:\Windows\System\DsGvjwc.exe
  C:\Windows\System\DsGvjwc.exe
  2⤵
  PID:2244
- C:\Windows\System\ppssKQb.exe
  C:\Windows\System\ppssKQb.exe
  2⤵
  PID:14044
- C:\Windows\System\OxhKWcU.exe
  C:\Windows\System\OxhKWcU.exe
  2⤵
  PID:12116
- C:\Windows\System\JqQsWTI.exe
  C:\Windows\System\JqQsWTI.exe
  2⤵
  PID:3004
- C:\Windows\System\fkNKTio.exe
  C:\Windows\System\fkNKTio.exe
  2⤵
  PID:1456
- C:\Windows\System\bRJRIdG.exe
  C:\Windows\System\bRJRIdG.exe
  2⤵
  PID:5144
- C:\Windows\System\ExUqTQa.exe
  C:\Windows\System\ExUqTQa.exe
  2⤵
  PID:4232
- C:\Windows\System\BBCUqez.exe
  C:\Windows\System\BBCUqez.exe
  2⤵
  PID:2452
- C:\Windows\System\xUQzdYV.exe
  C:\Windows\System\xUQzdYV.exe
  2⤵
  PID:4980
- C:\Windows\System\xFDcGZI.exe
  C:\Windows\System\xFDcGZI.exe
  2⤵
  PID:5948
- C:\Windows\System\DBNezzY.exe
  C:\Windows\System\DBNezzY.exe
  2⤵
  PID:1264
- C:\Windows\System\ZUpoSrR.exe
  C:\Windows\System\ZUpoSrR.exe
  2⤵
  PID:5992
- C:\Windows\System\utXHXQf.exe
  C:\Windows\System\utXHXQf.exe
  2⤵
  PID:4460
- C:\Windows\System\rTVMvXL.exe
  C:\Windows\System\rTVMvXL.exe
  2⤵
  PID:6036
- C:\Windows\System\aELpHNg.exe
  C:\Windows\System\aELpHNg.exe
  2⤵
  PID:5876
- C:\Windows\System\fbsAJUf.exe
  C:\Windows\System\fbsAJUf.exe
  2⤵
  PID:5820
- C:\Windows\System\cIEVaMu.exe
  C:\Windows\System\cIEVaMu.exe
  2⤵
  PID:5856
- C:\Windows\System\cpnOQGL.exe
  C:\Windows\System\cpnOQGL.exe
  2⤵
  PID:876
- C:\Windows\System\ENXozct.exe
  C:\Windows\System\ENXozct.exe
  2⤵
  PID:6060
- C:\Windows\System\gHeZfrl.exe
  C:\Windows\System\gHeZfrl.exe
  2⤵
  PID:5352
- C:\Windows\System\zXGLdYy.exe
  C:\Windows\System\zXGLdYy.exe
  2⤵
  PID:10608
- C:\Windows\System\LVNfVhz.exe
  C:\Windows\System\LVNfVhz.exe
  2⤵
  PID:10084
- C:\Windows\System\aqulaMy.exe
  C:\Windows\System\aqulaMy.exe
  2⤵
  PID:3440
- C:\Windows\System\ZUHaafN.exe
  C:\Windows\System\ZUHaafN.exe
  2⤵
  PID:2284
- C:\Windows\System\FcrgIHg.exe
  C:\Windows\System\FcrgIHg.exe
  2⤵
  PID:6284
- C:\Windows\System\ujGaFvh.exe
  C:\Windows\System\ujGaFvh.exe
  2⤵
  PID:6288
- C:\Windows\System\EmyKwoM.exe
  C:\Windows\System\EmyKwoM.exe
  2⤵
  PID:5468
- C:\Windows\System\PgaLpIr.exe
  C:\Windows\System\PgaLpIr.exe
  2⤵
  PID:5488
- C:\Windows\System\ZRyEIAO.exe
  C:\Windows\System\ZRyEIAO.exe
  2⤵
  PID:5788
- C:\Windows\System\EEtZMUx.exe
  C:\Windows\System\EEtZMUx.exe
  2⤵
  PID:3412
- C:\Windows\System\iUUwniM.exe
  C:\Windows\System\iUUwniM.exe
  2⤵
  PID:5516
- C:\Windows\System\xwATuXJ.exe
  C:\Windows\System\xwATuXJ.exe
  2⤵
  PID:6260
- C:\Windows\System\USTYOTT.exe
  C:\Windows\System\USTYOTT.exe
  2⤵
  PID:5532
- C:\Windows\System\bdoosdU.exe
  C:\Windows\System\bdoosdU.exe
  2⤵
  PID:3960
- C:\Windows\System\QIibDXo.exe
  C:\Windows\System\QIibDXo.exe
  2⤵
  PID:14004
- C:\Windows\System\yJKotkm.exe
  C:\Windows\System\yJKotkm.exe
  2⤵
  PID:6296
- C:\Windows\System\FMLPbfM.exe
  C:\Windows\System\FMLPbfM.exe
  2⤵
  PID:6304
- C:\Windows\System\qTFdRMA.exe
  C:\Windows\System\qTFdRMA.exe
  2⤵
  PID:6624
- C:\Windows\System\ayJzMhW.exe
  C:\Windows\System\ayJzMhW.exe
  2⤵
  PID:6676
- C:\Windows\System\kGsroKp.exe
  C:\Windows\System\kGsroKp.exe
  2⤵
  PID:5176
- C:\Windows\System\IxlPBXM.exe
  C:\Windows\System\IxlPBXM.exe
  2⤵
  PID:6016
- C:\Windows\System\PlBbJOM.exe
  C:\Windows\System\PlBbJOM.exe
  2⤵
  PID:5336
- C:\Windows\System\MRpPYar.exe
  C:\Windows\System\MRpPYar.exe
  2⤵
  PID:6844
- C:\Windows\System\hzZCfOt.exe
  C:\Windows\System\hzZCfOt.exe
  2⤵
  PID:5708
- C:\Windows\System\CfsNnmV.exe
  C:\Windows\System\CfsNnmV.exe
  2⤵
  PID:7008
- C:\Windows\System\MRCJFCd.exe
  C:\Windows\System\MRCJFCd.exe
  2⤵
  PID:2960
- C:\Windows\System\mootqjR.exe
  C:\Windows\System\mootqjR.exe
  2⤵
  PID:7032
- C:\Windows\System\hGjFHop.exe
  C:\Windows\System\hGjFHop.exe
  2⤵
  PID:6272
- C:\Windows\System\eYnJEPQ.exe
  C:\Windows\System\eYnJEPQ.exe
  2⤵
  PID:14364
- C:\Windows\System\rtNnfWv.exe
  C:\Windows\System\rtNnfWv.exe
  2⤵
  PID:14392
- C:\Windows\System\CFCsyqB.exe
  C:\Windows\System\CFCsyqB.exe
  2⤵
  PID:14424
- C:\Windows\System\btfJFlY.exe
  C:\Windows\System\btfJFlY.exe
  2⤵
  PID:14460
- C:\Windows\System\ApAgUaU.exe
  C:\Windows\System\ApAgUaU.exe
  2⤵
  PID:14492
- C:\Windows\System\WFDtZRo.exe
  C:\Windows\System\WFDtZRo.exe
  2⤵
  PID:14552
- C:\Windows\System\tTEqxii.exe
  C:\Windows\System\tTEqxii.exe
  2⤵
  PID:14624
- C:\Windows\System\jieWeMQ.exe
  C:\Windows\System\jieWeMQ.exe
  2⤵
  PID:14664
- C:\Windows\System\bRKtEQg.exe
  C:\Windows\System\bRKtEQg.exe
  2⤵
  PID:14700
- C:\Windows\System\aGWZObX.exe
  C:\Windows\System\aGWZObX.exe
  2⤵
  PID:14784
- C:\Windows\System\oLciejU.exe
  C:\Windows\System\oLciejU.exe
  2⤵
  PID:14832
- C:\Windows\System\CCmDAsv.exe
  C:\Windows\System\CCmDAsv.exe
  2⤵
  PID:14864
- C:\Windows\System\ZcmfbRD.exe
  C:\Windows\System\ZcmfbRD.exe
  2⤵
  PID:14884
- C:\Windows\System\WereTbe.exe
  C:\Windows\System\WereTbe.exe
  2⤵
  PID:14968
- C:\Windows\System\kdoblZr.exe
  C:\Windows\System\kdoblZr.exe
  2⤵
  PID:14996
- C:\Windows\System\rbpSIcz.exe
  C:\Windows\System\rbpSIcz.exe
  2⤵
  PID:15020
- C:\Windows\System\RwoPSPt.exe
  C:\Windows\System\RwoPSPt.exe
  2⤵
  PID:15056
- C:\Windows\System\xiNESQk.exe
  C:\Windows\System\xiNESQk.exe
  2⤵
  PID:15084
- C:\Windows\System\vTKJepo.exe
  C:\Windows\System\vTKJepo.exe
  2⤵
  PID:15160
- C:\Windows\System\CeObOTU.exe
  C:\Windows\System\CeObOTU.exe
  2⤵
  PID:15184
- C:\Windows\System\NhvGqOJ.exe
  C:\Windows\System\NhvGqOJ.exe
  2⤵
  PID:15204
- C:\Windows\System\RgQydrA.exe
  C:\Windows\System\RgQydrA.exe
  2⤵
  PID:15228
- C:\Windows\System\DNmjdJS.exe
  C:\Windows\System\DNmjdJS.exe
  2⤵
  PID:15252
- C:\Windows\System\dRVdraE.exe
  C:\Windows\System\dRVdraE.exe
  2⤵
  PID:15288
- C:\Windows\System\oMWvzLS.exe
  C:\Windows\System\oMWvzLS.exe
  2⤵
  PID:15308
- C:\Windows\System\avDOiMj.exe
  C:\Windows\System\avDOiMj.exe
  2⤵
  PID:15336
- C:\Windows\System\UHcstbC.exe
  C:\Windows\System\UHcstbC.exe
  2⤵
  PID:5300
- C:\Windows\System\vZtItDh.exe
  C:\Windows\System\vZtItDh.exe
  2⤵
  PID:6608
- C:\Windows\System\nciSPbA.exe
  C:\Windows\System\nciSPbA.exe
  2⤵
  PID:6244
- C:\Windows\System\OyLwRGE.exe
  C:\Windows\System\OyLwRGE.exe
  2⤵
  PID:7144
- C:\Windows\System\wCZsWBp.exe
  C:\Windows\System\wCZsWBp.exe
  2⤵
  PID:14468
- C:\Windows\System\TOBVHql.exe
  C:\Windows\System\TOBVHql.exe
  2⤵
  PID:14508
- C:\Windows\System\bquugxX.exe
  C:\Windows\System\bquugxX.exe
  2⤵
  PID:7004
- C:\Windows\System\XlcrhlJ.exe
  C:\Windows\System\XlcrhlJ.exe
  2⤵
  PID:6088
- C:\Windows\System\AGzBQLH.exe
  C:\Windows\System\AGzBQLH.exe
  2⤵
  PID:14532
- C:\Windows\System\UgzfKQk.exe
  C:\Windows\System\UgzfKQk.exe
  2⤵
  PID:14644
- C:\Windows\System\hjcZwIO.exe
  C:\Windows\System\hjcZwIO.exe
  2⤵
  PID:7100
- C:\Windows\System\jHsGeHj.exe
  C:\Windows\System\jHsGeHj.exe
  2⤵
  PID:14712
- C:\Windows\System\DXrupDa.exe
  C:\Windows\System\DXrupDa.exe
  2⤵
  PID:6196
- C:\Windows\System\OCMmWZr.exe
  C:\Windows\System\OCMmWZr.exe
  2⤵
  PID:14648
- C:\Windows\System\XxcZFAG.exe
  C:\Windows\System\XxcZFAG.exe
  2⤵
  PID:14808
- C:\Windows\System\LPnEFsZ.exe
  C:\Windows\System\LPnEFsZ.exe
  2⤵
  PID:14736
- C:\Windows\System\sPXrGIT.exe
  C:\Windows\System\sPXrGIT.exe
  2⤵
  PID:14848
- C:\Windows\System\UpZoEbj.exe
  C:\Windows\System\UpZoEbj.exe
  2⤵
  PID:6516
- C:\Windows\System\PkSebLW.exe
  C:\Windows\System\PkSebLW.exe
  2⤵
  PID:14984
- C:\Windows\System\FkXSYBN.exe
  C:\Windows\System\FkXSYBN.exe
  2⤵
  PID:14948
- C:\Windows\System\NzLIuQm.exe
  C:\Windows\System\NzLIuQm.exe
  2⤵
  PID:6120
- C:\Windows\System\dBDUyhG.exe
  C:\Windows\System\dBDUyhG.exe
  2⤵
  PID:7260
- C:\Windows\System\lRmIfhP.exe
  C:\Windows\System\lRmIfhP.exe
  2⤵
  PID:6356
- C:\Windows\System\PeETqqs.exe
  C:\Windows\System\PeETqqs.exe
  2⤵
  PID:14960
- C:\Windows\System\iujIPbf.exe
  C:\Windows\System\iujIPbf.exe
  2⤵
  PID:7504
- C:\Windows\System\YaLCqkG.exe
  C:\Windows\System\YaLCqkG.exe
  2⤵
  PID:15028
- C:\Windows\System\nUrjjgm.exe
  C:\Windows\System\nUrjjgm.exe
  2⤵
  PID:15128
- C:\Windows\System\dcPYShr.exe
  C:\Windows\System\dcPYShr.exe
  2⤵
  PID:15080
- C:\Windows\System\gnwJhGZ.exe
  C:\Windows\System\gnwJhGZ.exe
  2⤵
  PID:15104
- C:\Windows\System\JdcgCXL.exe
  C:\Windows\System\JdcgCXL.exe
  2⤵
  PID:15116
- C:\Windows\System\IJvxeAL.exe
  C:\Windows\System\IJvxeAL.exe
  2⤵
  PID:15236
- C:\Windows\System\laULRtA.exe
  C:\Windows\System\laULRtA.exe
  2⤵
  PID:3076
- C:\Windows\System\LmByLeM.exe
  C:\Windows\System\LmByLeM.exe
  2⤵
  PID:7832
- C:\Windows\System\BwvwdOB.exe
  C:\Windows\System\BwvwdOB.exe
  2⤵
  PID:3628
- C:\Windows\System\LCAOLLU.exe
  C:\Windows\System\LCAOLLU.exe
  2⤵
  PID:5864
- C:\Windows\System\jeojtEz.exe
  C:\Windows\System\jeojtEz.exe
  2⤵
  PID:10456
- C:\Windows\System\oZtWlhG.exe
  C:\Windows\System\oZtWlhG.exe
  2⤵
  PID:8084
- C:\Windows\System\xwDKMSD.exe
  C:\Windows\System\xwDKMSD.exe
  2⤵
  PID:3484
- C:\Windows\System\AZrQyRu.exe
  C:\Windows\System\AZrQyRu.exe
  2⤵
  PID:14420
- C:\Windows\System\iXfmNVy.exe
  C:\Windows\System\iXfmNVy.exe
  2⤵
  PID:8548
- C:\Windows\System\PaGhiOh.exe
  C:\Windows\System\PaGhiOh.exe
  2⤵
  PID:14612
- C:\Windows\System\TgebYYJ.exe
  C:\Windows\System\TgebYYJ.exe
  2⤵
  PID:14756
- C:\Windows\System\jUhsbrW.exe
  C:\Windows\System\jUhsbrW.exe
  2⤵
  PID:14816
- C:\Windows\System\EtKdkjG.exe
  C:\Windows\System\EtKdkjG.exe
  2⤵
  PID:7396
- C:\Windows\System\XvaRHgD.exe
  C:\Windows\System\XvaRHgD.exe
  2⤵
  PID:6780
- C:\Windows\System\HTFTjjx.exe
  C:\Windows\System\HTFTjjx.exe
  2⤵
  PID:6908
- C:\Windows\System\zAFKFYf.exe
  C:\Windows\System\zAFKFYf.exe
  2⤵
  PID:7528
- C:\Windows\System\EepAOPc.exe
  C:\Windows\System\EepAOPc.exe
  2⤵
  PID:7684
- C:\Windows\System\FaaOePU.exe
  C:\Windows\System\FaaOePU.exe
  2⤵
  PID:14932
- C:\Windows\System\uGzsTWV.exe
  C:\Windows\System\uGzsTWV.exe
  2⤵
  PID:8524
- C:\Windows\System\degUSfF.exe
  C:\Windows\System\degUSfF.exe
  2⤵
  PID:15196
- C:\Windows\System\NJCOhua.exe
  C:\Windows\System\NJCOhua.exe
  2⤵
  PID:8476
- C:\Windows\System\pSrxSsf.exe
  C:\Windows\System\pSrxSsf.exe
  2⤵
  PID:15240
- C:\Windows\System\WuOSWcL.exe
  C:\Windows\System\WuOSWcL.exe
  2⤵
  PID:15148
- C:\Windows\System\mFNFBef.exe
  C:\Windows\System\mFNFBef.exe
  2⤵
  PID:6584
- C:\Windows\System\ENJllys.exe
  C:\Windows\System\ENJllys.exe
  2⤵
  PID:15260
- C:\Windows\System\DcoYbLd.exe
  C:\Windows\System\DcoYbLd.exe
  2⤵
  PID:4428
- C:\Windows\System\FLnMaco.exe
  C:\Windows\System\FLnMaco.exe
  2⤵
  PID:7704
- C:\Windows\System\FNAQFCb.exe
  C:\Windows\System\FNAQFCb.exe
  2⤵
  PID:8880
- C:\Windows\System\ihXWfKo.exe
  C:\Windows\System\ihXWfKo.exe
  2⤵
  PID:14476
- C:\Windows\System\CRFAEGy.exe
  C:\Windows\System\CRFAEGy.exe
  2⤵
  PID:9432
- C:\Windows\System\yoHiRjY.exe
  C:\Windows\System\yoHiRjY.exe
  2⤵
  PID:14920
- C:\Windows\System\TwDgceR.exe
  C:\Windows\System\TwDgceR.exe
  2⤵
  PID:7540
- C:\Windows\System\xKpAJem.exe
  C:\Windows\System\xKpAJem.exe
  2⤵
  PID:8788
- C:\Windows\System\sUbOYeg.exe
  C:\Windows\System\sUbOYeg.exe
  2⤵
  PID:8792
- C:\Windows\System\yJNLADL.exe
  C:\Windows\System\yJNLADL.exe
  2⤵
  PID:8244
- C:\Windows\System\CQUQvJS.exe
  C:\Windows\System\CQUQvJS.exe
  2⤵
  PID:6092
- C:\Windows\System\LyjddEv.exe
  C:\Windows\System\LyjddEv.exe
  2⤵
  PID:14908
- C:\Windows\System\xkOJyYa.exe
  C:\Windows\System\xkOJyYa.exe
  2⤵
  PID:6760
- C:\Windows\System\lQxNUWc.exe
  C:\Windows\System\lQxNUWc.exe
  2⤵
  PID:6128
- C:\Windows\System\CnRZZTS.exe
  C:\Windows\System\CnRZZTS.exe
  2⤵
  PID:15216
- C:\Windows\System\uzzpLfO.exe
  C:\Windows\System\uzzpLfO.exe
  2⤵
  PID:14480
- C:\Windows\System\qpPQvgx.exe
  C:\Windows\System\qpPQvgx.exe
  2⤵
  PID:14440
- C:\Windows\System\jeLhKYN.exe
  C:\Windows\System\jeLhKYN.exe
  2⤵
  PID:14588
- C:\Windows\System\zNOBhes.exe
  C:\Windows\System\zNOBhes.exe
  2⤵
  PID:10168
- C:\Windows\System\WHKOdYI.exe
  C:\Windows\System\WHKOdYI.exe
  2⤵
  PID:9724
- C:\Windows\System\QureCpS.exe
  C:\Windows\System\QureCpS.exe
  2⤵
  PID:9856
- C:\Windows\System\fhjhwTJ.exe
  C:\Windows\System\fhjhwTJ.exe
  2⤵
  PID:8576
- C:\Windows\System\ZAWAjLY.exe
  C:\Windows\System\ZAWAjLY.exe
  2⤵
  PID:1880
- C:\Windows\System\ESsPLkM.exe
  C:\Windows\System\ESsPLkM.exe
  2⤵
  PID:8804
- C:\Windows\System\WIEDtAB.exe
  C:\Windows\System\WIEDtAB.exe
  2⤵
  PID:7280
- C:\Windows\System\anGolAg.exe
  C:\Windows\System\anGolAg.exe
  2⤵
  PID:8976
- C:\Windows\System\ZqjXICo.exe
  C:\Windows\System\ZqjXICo.exe
  2⤵
  PID:5436
- C:\Windows\System\XtxRMst.exe
  C:\Windows\System\XtxRMst.exe
  2⤵
  PID:9928
- C:\Windows\System\uFgYEOR.exe
  C:\Windows\System\uFgYEOR.exe
  2⤵
  PID:8824
- C:\Windows\System\sCsofbF.exe
  C:\Windows\System\sCsofbF.exe
  2⤵
  PID:8892
- C:\Windows\System\ssYjVbg.exe
  C:\Windows\System\ssYjVbg.exe
  2⤵
  PID:5592
- C:\Windows\System\haWWEJe.exe
  C:\Windows\System\haWWEJe.exe
  2⤵
  PID:7996
- C:\Windows\System\snSetsX.exe
  C:\Windows\System\snSetsX.exe
  2⤵
  PID:7628
- C:\Windows\System\IyoaZNw.exe
  C:\Windows\System\IyoaZNw.exe
  2⤵
  PID:14820
- C:\Windows\System\sVvWjAY.exe
  C:\Windows\System\sVvWjAY.exe
  2⤵
  PID:9996
- C:\Windows\System\BJOxCZE.exe
  C:\Windows\System\BJOxCZE.exe
  2⤵
  PID:7780
- C:\Windows\System\LbmigwB.exe
  C:\Windows\System\LbmigwB.exe
  2⤵
  PID:10220
- C:\Windows\System\lbzgTtU.exe
  C:\Windows\System\lbzgTtU.exe
  2⤵
  PID:2360
- C:\Windows\System\qzfKZzb.exe
  C:\Windows\System\qzfKZzb.exe
  2⤵
  PID:10068
- C:\Windows\System\WptcKJq.exe
  C:\Windows\System\WptcKJq.exe
  2⤵
  PID:6152
- C:\Windows\System\gDAwCko.exe
  C:\Windows\System\gDAwCko.exe
  2⤵
  PID:8452
- C:\Windows\System\BoWggpr.exe
  C:\Windows\System\BoWggpr.exe
  2⤵
  PID:7580
- C:\Windows\System\XOxxDcu.exe
  C:\Windows\System\XOxxDcu.exe
  2⤵
  PID:10704
- C:\Windows\System\fxqfxow.exe
  C:\Windows\System\fxqfxow.exe
  2⤵
  PID:7064
- C:\Windows\System\ZlmAmMD.exe
  C:\Windows\System\ZlmAmMD.exe
  2⤵
  PID:8220
- C:\Windows\System\hvIXjTm.exe
  C:\Windows\System\hvIXjTm.exe
  2⤵
  PID:8388
- C:\Windows\System\DCAhdlF.exe
  C:\Windows\System\DCAhdlF.exe
  2⤵
  PID:10876
- C:\Windows\System\lSqEXya.exe
  C:\Windows\System\lSqEXya.exe
  2⤵
  PID:10504
- C:\Windows\System\nqVFXxB.exe
  C:\Windows\System\nqVFXxB.exe
  2⤵
  PID:7152
- C:\Windows\System\RezxrUh.exe
  C:\Windows\System\RezxrUh.exe
  2⤵
  PID:9920
- C:\Windows\System\BvPcACG.exe
  C:\Windows\System\BvPcACG.exe
  2⤵
  PID:8724
- C:\Windows\System\AEHbjDD.exe
  C:\Windows\System\AEHbjDD.exe
  2⤵
  PID:11204
- C:\Windows\System\ufBtUwb.exe
  C:\Windows\System\ufBtUwb.exe
  2⤵
  PID:7464
- C:\Windows\System\jXcmxEN.exe
  C:\Windows\System\jXcmxEN.exe
  2⤵
  PID:10076
- C:\Windows\System\vLaDJJW.exe
  C:\Windows\System\vLaDJJW.exe
  2⤵
  PID:9096
- C:\Windows\System\ZZQxQiB.exe
  C:\Windows\System\ZZQxQiB.exe
  2⤵
  PID:14384
- C:\Windows\System\XEvsHJF.exe
  C:\Windows\System\XEvsHJF.exe
  2⤵
  PID:9796
- C:\Windows\System\UOterGs.exe
  C:\Windows\System\UOterGs.exe
  2⤵
  PID:8364
- C:\Windows\System\Pmzcltt.exe
  C:\Windows\System\Pmzcltt.exe
  2⤵
  PID:7456
- C:\Windows\System\VtWiRrD.exe
  C:\Windows\System\VtWiRrD.exe
  2⤵
  PID:5440
- C:\Windows\System\Sumejwb.exe
  C:\Windows\System\Sumejwb.exe
  2⤵
  PID:9708
- C:\Windows\System\WhSKUzs.exe
  C:\Windows\System\WhSKUzs.exe
  2⤵
  PID:10600
- C:\Windows\System\PLAMrEW.exe
  C:\Windows\System\PLAMrEW.exe
  2⤵
  PID:10696
- C:\Windows\System\ETBvXtb.exe
  C:\Windows\System\ETBvXtb.exe
  2⤵
  PID:14284
- C:\Windows\System\MbtUdHO.exe
  C:\Windows\System\MbtUdHO.exe
  2⤵
  PID:6496
- C:\Windows\System\WXQIAub.exe
  C:\Windows\System\WXQIAub.exe
  2⤵
  PID:10768
- C:\Windows\System\eacOmBp.exe
  C:\Windows\System\eacOmBp.exe
  2⤵
  PID:8216
- C:\Windows\System\GaoqDsi.exe
  C:\Windows\System\GaoqDsi.exe
  2⤵
  PID:8136
- C:\Windows\System\qLIYiBk.exe
  C:\Windows\System\qLIYiBk.exe
  2⤵
  PID:10516
- C:\Windows\System\acEkCoh.exe
  C:\Windows\System\acEkCoh.exe
  2⤵
  PID:11968
- C:\Windows\System\SlVvwyJ.exe
  C:\Windows\System\SlVvwyJ.exe
  2⤵
  PID:8416
- C:\Windows\System\OTrriWU.exe
  C:\Windows\System\OTrriWU.exe
  2⤵
  PID:10572
- C:\Windows\System\jawYnYa.exe
  C:\Windows\System\jawYnYa.exe
  2⤵
  PID:8604
- C:\Windows\System\HQjtlVQ.exe
  C:\Windows\System\HQjtlVQ.exe
  2⤵
  PID:9972
- C:\Windows\System\rAAoSVZ.exe
  C:\Windows\System\rAAoSVZ.exe
  2⤵
  PID:9424
- C:\Windows\System\SxJuinW.exe
  C:\Windows\System\SxJuinW.exe
  2⤵
  PID:5676
- C:\Windows\System\DseZzgc.exe
  C:\Windows\System\DseZzgc.exe
  2⤵
  PID:9572
- C:\Windows\System\ZfhZvgz.exe
  C:\Windows\System\ZfhZvgz.exe
  2⤵
  PID:10116
- C:\Windows\System\oluUJRP.exe
  C:\Windows\System\oluUJRP.exe
  2⤵
  PID:10416
- C:\Windows\System\ngrvxak.exe
  C:\Windows\System\ngrvxak.exe
  2⤵
  PID:7800
- C:\Windows\System\dbHnaNK.exe
  C:\Windows\System\dbHnaNK.exe
  2⤵
  PID:10104
- C:\Windows\System\hZtOMJX.exe
  C:\Windows\System\hZtOMJX.exe
  2⤵
  PID:12300
- C:\Windows\System\vrBzbrI.exe
  C:\Windows\System\vrBzbrI.exe
  2⤵
  PID:11464
- C:\Windows\System\GUUyCEq.exe
  C:\Windows\System\GUUyCEq.exe
  2⤵
  PID:10052
- C:\Windows\System\YQHquNP.exe
  C:\Windows\System\YQHquNP.exe
  2⤵
  PID:11452
- C:\Windows\System\HYKdnTt.exe
  C:\Windows\System\HYKdnTt.exe
  2⤵
  PID:9376
- C:\Windows\System\iwfxzWJ.exe
  C:\Windows\System\iwfxzWJ.exe
  2⤵
  PID:11760
- C:\Windows\System\ryLvDRQ.exe
  C:\Windows\System\ryLvDRQ.exe
  2⤵
  PID:14672
- C:\Windows\System\zWZTCsN.exe
  C:\Windows\System\zWZTCsN.exe
  2⤵
  PID:10816
- C:\Windows\System\GxerWML.exe
  C:\Windows\System\GxerWML.exe
  2⤵
  PID:9948
- C:\Windows\System\mUmSnqO.exe
  C:\Windows\System\mUmSnqO.exe
  2⤵
  PID:9720
- C:\Windows\System\WiavSbV.exe
  C:\Windows\System\WiavSbV.exe
  2⤵
  PID:4728
- C:\Windows\System\sezeptj.exe
  C:\Windows\System\sezeptj.exe
  2⤵
  PID:10700
- C:\Windows\System\pccpLxU.exe
  C:\Windows\System\pccpLxU.exe
  2⤵
  PID:9548
- C:\Windows\System\fjkFjpR.exe
  C:\Windows\System\fjkFjpR.exe
  2⤵
  PID:11936
- C:\Windows\System\PsWjjgx.exe
  C:\Windows\System\PsWjjgx.exe
  2⤵
  PID:2596
- C:\Windows\System\DwuqNbE.exe
  C:\Windows\System\DwuqNbE.exe
  2⤵
  PID:13940
- C:\Windows\System\xikOcKG.exe
  C:\Windows\System\xikOcKG.exe
  2⤵
  PID:13096
- C:\Windows\System\lumJqFk.exe
  C:\Windows\System\lumJqFk.exe
  2⤵
  PID:6600
- C:\Windows\System\kACqXJq.exe
  C:\Windows\System\kACqXJq.exe
  2⤵
  PID:11468
- C:\Windows\System\KtEITjI.exe
  C:\Windows\System\KtEITjI.exe
  2⤵
  PID:432
- C:\Windows\System\uWDyoLV.exe
  C:\Windows\System\uWDyoLV.exe
  2⤵
  PID:11632
- C:\Windows\System\xtxTHzx.exe
  C:\Windows\System\xtxTHzx.exe
  2⤵
  PID:11992
- C:\Windows\System\ZxfKKZZ.exe
  C:\Windows\System\ZxfKKZZ.exe
  2⤵
  PID:9668
- C:\Windows\System\MCMwvkv.exe
  C:\Windows\System\MCMwvkv.exe
  2⤵
  PID:13512
- C:\Windows\System\mbqnNNn.exe
  C:\Windows\System\mbqnNNn.exe
  2⤵
  PID:10520
- C:\Windows\System\lsxyIup.exe
  C:\Windows\System\lsxyIup.exe
  2⤵
  PID:3068
- C:\Windows\System\dUMXVjG.exe
  C:\Windows\System\dUMXVjG.exe
  2⤵
  PID:11588
- C:\Windows\System\edODGkS.exe
  C:\Windows\System\edODGkS.exe
  2⤵
  PID:8500
- C:\Windows\System\AWtTvts.exe
  C:\Windows\System\AWtTvts.exe
  2⤵
  PID:11152
- C:\Windows\System\VEOVGYe.exe
  C:\Windows\System\VEOVGYe.exe
  2⤵
  PID:11584
- C:\Windows\System\eTkOOyn.exe
  C:\Windows\System\eTkOOyn.exe
  2⤵
  PID:11984
- C:\Windows\System\dYCEXHs.exe
  C:\Windows\System\dYCEXHs.exe
  2⤵
  PID:10556
- C:\Windows\System\ksgZcNc.exe
  C:\Windows\System\ksgZcNc.exe
  2⤵
  PID:10484
- C:\Windows\System\MhHauPZ.exe
  C:\Windows\System\MhHauPZ.exe
  2⤵
  PID:13720
- C:\Windows\System\gvgmKat.exe
  C:\Windows\System\gvgmKat.exe
  2⤵
  PID:7420
- C:\Windows\System\fKjiVSD.exe
  C:\Windows\System\fKjiVSD.exe
  2⤵
  PID:11296
- C:\Windows\System\XPrkmCp.exe
  C:\Windows\System\XPrkmCp.exe
  2⤵
  PID:3968
- C:\Windows\System\mCjmDrM.exe
  C:\Windows\System\mCjmDrM.exe
  2⤵
  PID:2952
- C:\Windows\System\OITsnLj.exe
  C:\Windows\System\OITsnLj.exe
  2⤵
  PID:12316
- C:\Windows\System\cTDyeAe.exe
  C:\Windows\System\cTDyeAe.exe
  2⤵
  PID:9824
- C:\Windows\System\nsDXcYP.exe
  C:\Windows\System\nsDXcYP.exe
  2⤵
  PID:12764
- C:\Windows\System\lRpGdzb.exe
  C:\Windows\System\lRpGdzb.exe
  2⤵
  PID:11712
- C:\Windows\System\fSoYTER.exe
  C:\Windows\System\fSoYTER.exe
  2⤵
  PID:12404
- C:\Windows\System\OViEnKy.exe
  C:\Windows\System\OViEnKy.exe
  2⤵
  PID:11736
- C:\Windows\System\VyjmFyN.exe
  C:\Windows\System\VyjmFyN.exe
  2⤵
  PID:10648
- C:\Windows\System\tCGnCeT.exe
  C:\Windows\System\tCGnCeT.exe
  2⤵
  PID:15384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t3k4v4rl.jww.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AVAFcdW.exe

Filesize
2.3MB

MD5
3cc81a8e8a8f2813b8b671d45cc9e266

SHA1
01b7351cb51dbdf12675c8a90914ce131b137d71

SHA256
1b75a79d37bc1c8f98baecc53831560ef24046c3cffa77e4195e7d18ddb2a807

SHA512
7d65e323ed01b21d4bea5df550760e892d31b92fda60554cc3076f8e3b0055d2315fc36ec0af037594c9d2498afed604fede8c7ac33af84510dfcaa96d2fd54c

Download Submit
C:\Windows\System\CUDBQAU.exe

Filesize
2.3MB

MD5
7d36be5256b6225b8185b3b4a53ebb7e

SHA1
b5edcec26de45f9d0fb988540f75bb5d8602c74d

SHA256
810977559e30d3ba8771c10ccd7a42cb822e9a3b27056f772ec6eadf72be77d8

SHA512
0f7fdabe88e763b51b4cc27d4d1c8c6434e0b9f2992e74f1fe4c17aec808932bbcae40df70fc0044900f6f9716f9165d948c755e2b9de83aba92c33edb3bd80c

Download Submit
C:\Windows\System\FafPXhS.exe

Filesize
2.3MB

MD5
44e7401ca9310ae198857301856aea27

SHA1
5a5b61459ad65af7889f7809cd2df3cdc9c6d91d

SHA256
772adfb54f51e3537b34daaf0c5d30f2050a143d8c06b9ed34dd11dc477186b7

SHA512
e866231cbec601980f56ef74a2af4949f124f8faa342ca335819aa2939d651416e1c7c735966ab8ba2a1f83fcdec8af45df26cf50ffac1c551a06a11e14c48e8

Download Submit
C:\Windows\System\FjsLdPI.exe

Filesize
2.3MB

MD5
c797996a80ecfb559ac0ce2cfaeba665

SHA1
167d9e49975d9f4cf27c4f3eaed143c5d1a9eaf0

SHA256
ca4abe3d4701b98045963534024094ae3073cda810a81a018b2eec86fd1697a0

SHA512
76a42aeed518bf51f4c10d67ce89ee47638f1182e973f3c9a59937c342043362b463e47a1aff53f56e81093d4b9a3d552bb39ed1e243ac5765c7db8f7361345c

Download Submit
C:\Windows\System\GhRAPKY.exe

Filesize
2.3MB

MD5
d1cd7009072928a940f2359f8eb159a8

SHA1
fedcd5b3005cfbd293b5831fc8de73c658a4b2e5

SHA256
5b6157b78d1c53f144b09d503e08755afe88e84122e67c2ae6c2a03dd07169dd

SHA512
d33be3e38a2c4fecb5ff38bdec596ac94880c67fdd51370f0179d5ad092d5aba7d91bb70e92a1cfb1237a8da847bc78b69a84ae6985ba02fcfab1a9784a64e6b

Download Submit
C:\Windows\System\GmTjxfG.exe

Filesize
2.3MB

MD5
6f23ae5bb547a327845ac88e351a1e84

SHA1
7a877d0a588308cac68c8dab0a37549329289fe0

SHA256
8036eb9df62fdc4ac1240e561f3c0892bc43054324a69aa456b54921e1f4b889

SHA512
276ab6d8da3f55e698e4bf4552155538ba2ff3b96a3150a56d07ebfb5d3032f083c8fd83ffc8c193bd4db681d6534ad645b9e792db73da019756d4bd67646f0e

Download Submit
C:\Windows\System\IcFEDCz.exe

Filesize
2.3MB

MD5
33f606b766a4954186737f1f354f9d5f

SHA1
30838781b7a65f99b45bd1274293d94be9030578

SHA256
41c5a880ac1832574622cb4c562e30ae90d232981b66fc3c963a061c82284153

SHA512
5711dc983a4cdb2ac45576ec3877ed7a99bcf995c272406bd91c74bf431fef70635ad2baa1adcf952735b4b71b0fa8f1e467eb88ffbe7366e95f1e8334c1ef6e

Download Submit
C:\Windows\System\JuqSGeY.exe

Filesize
2.3MB

MD5
55d8110d4efe9eb8d6b0403124d0088d

SHA1
afcb176ff2385cd0dea53adf75f2a62d88201448

SHA256
6029975677390d29c84c44e31543cfd39008a4421f18b3be0da41b22e6143bd7

SHA512
8dfef02caadb96293685c4cff7e72aafc22423c2ae8a809f21d33f6726372fc455f1cb0a13bf16845734dcf4d17df640ab33ad7b84cb70bed91c8ed8f1462ff9

Download Submit
C:\Windows\System\KlxFLax.exe

Filesize
2.3MB

MD5
52095a70c453c8919e28620da315ceb4

SHA1
e6c08889496e84d69604ea8932f3a344183546f7

SHA256
8b42a2737bcd007a8ad824bb9c7cab69c9707a2543e897354e7719d1505a619a

SHA512
3ab4d0ce2c3bfeb7ff0fa86dc3c7f2a06032edcf3273c581871c035f56161d21313dc8dbbaa01a086ede19e2012ffac35a33af1ab89120fbab0ac08a2a4d2e4c

Download Submit
C:\Windows\System\KnfIhmP.exe

Filesize
2.3MB

MD5
306f1bdc0ba0ebbae2ae605aeb981d58

SHA1
f6c2e35118852aa2df23df126cd03b14e8ea0ebb

SHA256
d2f8d25d13467565328b347dd941fc494c1dfbba9188c4d76b4461e6a0dc1db7

SHA512
822fe05a85ddf3e0264430e8e9ead1ea429e552baa31d219af3ada70cf8a4901013e3c73ec3c58840bfe8b033363cf5065563a68e097ecd0ac68b462f09b4602

Download Submit
C:\Windows\System\MzzCWQc.exe

Filesize
2.3MB

MD5
9af0d531700c5a940849d1159eff8759

SHA1
0ba1ec903b762758b5d05b120f1b5037cd3d588a

SHA256
736d0ea48784fce7afb355a9f63297d6b2af255e670249f15abde5c350eebae2

SHA512
76fac230607ead3545741e9dfaaafd6d4cf831ab8fe7976f99ed3ff48ae206e2485ab60d063fa8ea8398ec98d431f1b8875c991a52d27ba87e260b89b6ef031d

Download Submit
C:\Windows\System\OALeKXg.exe

Filesize
2.3MB

MD5
1cd522eb6aa289155ed43c953ceddf49

SHA1
191f4612b894427b263356953740671866f0c74b

SHA256
3c9a92b33340e83121810d1139cb26463a1bac3f1afc3e193d924c73a21b5e78

SHA512
68b732502bf431e397ca30285f801a114ff7d562f43f860f6ba9d9ac2f421eb38c05a49a025ee676dc64435cf4e52911d098d80d24d3b4392851387457ac9552

Download Submit
C:\Windows\System\TQezKRz.exe

Filesize
2.3MB

MD5
b20747e3bb5b687ac967d1e5fa704ed8

SHA1
1bce32cb6aaa26b91ac6b7e4b8f2a61706759ea6

SHA256
1530d65889bb5613a0bdcfbf13ddfda266152f9fab60b1e23c4ce510f0b220b6

SHA512
e180b66aab680728bc2a5176292d3f4ac16854e787cc1203929453e163936d5c5c3f17cbaf12e268175aadacb92c9fbafc3698b85f7361506ab69c4c4f1716ef

Download Submit
C:\Windows\System\TjlqPvS.exe

Filesize
2.3MB

MD5
494f5ffb55f3ea803419fa884415ddae

SHA1
097f54bd93e23c49ed9957c3e9b23c28797dd89a

SHA256
9b289e58801c9e2b848b7d8a95c90bcf91f4d475137aaae86233494dd712a9ca

SHA512
5bb41bbdd0266dd3bb28fbe4375b0f4b2ff01d891887126b7d6aa32878f7fd9be93ab6d5c573b0d8272e5ce9542b4bd3975d1749bc73b94d635757e0baf8bdde

Download Submit
C:\Windows\System\VSWUmRk.exe

Filesize
2.3MB

MD5
9f2ca42c8ccb1966d92941ee97491c75

SHA1
10721617657bef447a9c065b7e730a3abe9f957b

SHA256
3a15782df54fa79c35fc5c5244bec3789906327c1f82a5a109b86d0c21b02d0a

SHA512
4565dd72ef6cf844e0eda9dd2aa5c63aae228dccc03693e35d1e5f7188367edf02b8da42fdd6996074674554a71f8f9c4beb2cd41b25b4aadea9339137af48e3

Download Submit
C:\Windows\System\WxsVPAd.exe

Filesize
2.3MB

MD5
759bf23cc89e19b67ce2be0157388f4d

SHA1
280fbbbac3f476efce96a0d5ac787fbded6ef5e4

SHA256
4bd557cb09569774c34cdac951fd3ce07b5381cf8e8e38daa199ff89647a2e60

SHA512
ccddcd7f145267cfea0c6d696ab3c11161a8d15dd0de2ec458ceae752b17d5f4aa46e7b70eda9617cdee87878e2af024917d9bdf88e8e320074b1218904434be

Download Submit
C:\Windows\System\ZPEKkru.exe

Filesize
2.3MB

MD5
99774d75884f3a42b5a2ba9cb65a7145

SHA1
fe2eb3ab8cbdbb574c658aacdd9d6dcdf3c655cc

SHA256
64ef238521d09e41f6b21ffb588822943a776dc9146a69e3a29d66c1f7c3507e

SHA512
5371b8b0be9257f74fc1e452c34baff2ce2a9aba885c0a62dc5b1e555eb7499bb018d363832a35567c541e27ea7a303ed50805d5aef4c1b7e4528785dbd3b954

Download Submit
C:\Windows\System\ZsJvjMT.exe

Filesize
2.3MB

MD5
f8caae27cd3e922ca23f074832f2af46

SHA1
8575ee53118caf7e91fa1a69c8ea17ae7e7ca1ca

SHA256
f19c8cfaa9f749e18d80398c045692151ec8dd55f9c8259557ba0460fc0c72c9

SHA512
4454bb6c5f5ab158c56b636fd0e0cd99b65f409d1893e41768da82b3cfdb82dc2d62a4826319b911004400704894fec65eff05b052f748211f3460952dfb7691

Download Submit
C:\Windows\System\aBsuuiv.exe

Filesize
2.3MB

MD5
36d76bfe5f4cbc52949e9704ceff716e

SHA1
33d842a207ffc2689cafffbe6cbc97f8e4bd91d0

SHA256
7ac4a309afd5190fcfad7d896bc3cad1b186cb853c23bc27cd9e79ae01d02081

SHA512
1e3453e29eee05d3528d742a960367f55167c3d834d7d6bb782b471051978561fde385630be26b17b0d96eff15566b9df4f6ceb13a1a05a7c70384c10476a950

Download Submit
C:\Windows\System\ajDHxmP.exe

Filesize
2.3MB

MD5
8fd423e9fbd757b7574359300eb77522

SHA1
93ef4e37e641a40b67395eba10a3e606afd83344

SHA256
6818afc3b8946954fef6f621a5695e70ae7daabd0cc49957f13431e0b9a6a530

SHA512
b73801ff616b7056608f5923062639bc8555a99bb19aafdf63a7b946982668fa085b7d47e56e5a0f59de08fef4cbd995184832a0661d1a3dfbfa9cd5fcdc907f

Download Submit
C:\Windows\System\dMTxYNU.exe

Filesize
2.3MB

MD5
6ad1777158de06663536adc4beb34f23

SHA1
9cabd7b027ac991b2208b9b08d82353290dfed41

SHA256
b18788419ed0241def75f941be06810b657e3e42bbcc357c9692f0478ab679c5

SHA512
db3230476aeaec65463ab0adaa832f7e395cd81604457650a01f9c361fd34e0d7a9ba65a55e3ce0ccf5febca7f53a0fdf04e44cd1add24ba88132ed1745b453c

Download Submit
C:\Windows\System\fLiUiUx.exe

Filesize
8B

MD5
92dce7fd7ec69f225baee909f1f20d27

SHA1
0fe748b20df273698767537e59de10e23a351a61

SHA256
3a8d52b801fd1c8bd120153342611f7386eb5ce0ad255d57304ec96ec9b31a84

SHA512
1e58e425b780ebf633a365e2d3edf8bb342f5bfe09e8d802b0d4dd60a53770b35758c32e598b9a4f78c23d6a0841ec0499f88be809f17838167d0c02b8f0c743

Download Submit
C:\Windows\System\gREtpWq.exe

Filesize
2.3MB

MD5
6b816ea35c8931355143f7bb0e9fed96

SHA1
e4526a5421c5611eabbf199eed9f23b1b830108d

SHA256
168d415494bb29dae9151ea1f06817a590692ded4f159614802127fdfb48df58

SHA512
175e1a5a5cf856ef96a81d33bb5cd14d981465cef8fe8e524894d63f2625952fc4089d95ccb5e9ad183c2eb1efde74274897d13a20f205223267bc4f106c60c1

Download Submit
C:\Windows\System\gsMOJLW.exe

Filesize
2.3MB

MD5
ee0e9408e0cd6238df3d3cf648138002

SHA1
c2a4c51d094da051538b3b7299c094afc1b4c040

SHA256
8f1bb55446b5b26e707c51c76c85fcadaca09c4885acc9c931e1b0e9e6d8290a

SHA512
8cb3ca17a49289abad57653bbf1c6c8c8fdc8dccf30df5989f89f989e7884d8b457be7826fcab29b93e6d49f7d62a67458b1bd12b999fcbd12ed51ea0d845c6c

Download Submit
C:\Windows\System\jpnfrVu.exe

Filesize
2.3MB

MD5
174a04aa30667f31b49f61eb38450f26

SHA1
41205acda40fa0fb1c477caef215fdcd3edb9efc

SHA256
0569eb7f76769086bf65543d1f6f3e9ef072e8fad91d329a4833c4b5760a0574

SHA512
a7f9c5350ab1ab5db038bcebe029ae9788ecb95d1a7dc00077229057b036bf09282a30ea19717fb9325b6a51283994299fe5b9f1615868e80eafa4443e427dd8

Download Submit
C:\Windows\System\kYAPTMr.exe

Filesize
2.3MB

MD5
837044c73442bd26a8e3aace970b6225

SHA1
2cef8c2ef07531b07e9fc02c21b08a9758bb9be6

SHA256
9dd3040de6a9fb1436be870c210e8d4e5580b97896307dcb6fb0084103e21faf

SHA512
5b957bfd46c94ffa6cd4ee40b67f6f49fa6a16b6f533d5f5bcd536c04118a31c8d2343d54e4ca8961978cb1ef79c5d5c26b1fe3111d4f4d307ae48d00a0d8a57

Download Submit
C:\Windows\System\knIFhhE.exe

Filesize
2.3MB

MD5
f66a5eda9df31ef4803fee863fc3fddd

SHA1
3a6745834ba50b0d6c23b350f0b5249cc86784c1

SHA256
7fece67978f30a0bec8184d8038857773872464e5bdc5e9a1e261a8f47329ea0

SHA512
b3983f758b4763a92967a9a7d640b1c904264c697290827138b1839be995ce684c322387a36df6856aa41652fefa95016bfe173ee165d163dbd1b49a778b4a35

Download Submit
C:\Windows\System\kodiPaz.exe

Filesize
2.3MB

MD5
5669ff66c57c6dfd6b787fa88e23aa4e

SHA1
f021141049f2900cec91f86acf4d4b344189d738

SHA256
fe2574972a738c6200f3ac92fef6c1c600dd784fc07aa0cfda9a154b93a2c0f2

SHA512
636fe4718bb36768d2a204680b6172f14b60546b351b561351075b70d89a3135f31d5745980f6ede049a4fa855fe38967544ebe9f32534f6aa356c990d503d0c

Download Submit
C:\Windows\System\mfRzwfv.exe

Filesize
2.3MB

MD5
65d3b362b755a11ef7fe8b873622b530

SHA1
91ee74b2d400751db307c4952bfe7185199b46cf

SHA256
ed978669c97be2b8fa186653d196cdeff6c11961b815f9392a6cdf1e21020743

SHA512
7cfc3080e26295158ded2abff75b3b2228c11910d1aeebc5f9777033588fbc83a0d94eed95cfb9b817fddf3bd0451faac636c2e373726f642bba650540091eda

Download Submit
C:\Windows\System\nldveJE.exe

Filesize
2.3MB

MD5
4e4e554f4b4a610eeeb6a51bbfbed5a4

SHA1
0666d652413ac013dea01d1c5b7de27b4fdec47b

SHA256
a630166395b104d48beab72f64e8401edfd76f53763200ef77e5c3fdf10ac0a4

SHA512
3842e38161a2f116f5007afa9fd3d0d95cee29bb6f2f9b282d0643c481dc6d4cfe47f23f54b73804878335ce55605e803522c97eaf2cb3e1da3fc5a82a174e44

Download Submit
C:\Windows\System\ojtmueX.exe

Filesize
2.3MB

MD5
8ece387c42838729389718afe827583b

SHA1
0d330bf628d338861aa1fbee9715e5ab9c606c39

SHA256
0874dff6365912ecd05ece49a7149796bb884434bb4cd6a33e4d81af5a62ed7e

SHA512
bf5cb099a02514c691f75da81175a89c4510d3427d5942eb2d7a14fc142e096c59e14916efb50042d86597fe05aa6efee3bdc880cff4c3ad2187ffb23dce4bbc

Download Submit
C:\Windows\System\qiNDczM.exe

Filesize
2.3MB

MD5
dc6b662074917fd9d12d4b51513c7e8f

SHA1
50498c440131db36c0a610f61667e45b442331ec

SHA256
d22174d73e89b81380fd77fdfac1d1312e3e2382f6648a37fa3cd3f223d98121

SHA512
489f84c2968583e5faf2b00a227649cd2faf828ca34bcaafbe1a8de805f1d6e0ab752b68d9785065f08d4bf62da2a75ecd50b8ec3c9ce6ffe815ea662a258acc

Download Submit
C:\Windows\System\rdRFyvs.exe

Filesize
18B

MD5
aa9b19bd76b278f575ef11895ddc2839

SHA1
f59244389c8ce9fcc6897b3455d31a70cb73ce7a

SHA256
fe421b0e0e55e116e3e0b47448adb31ad99c09631f55c49525549ec9ddcfeac6

SHA512
eb71ff98846e00073df75729bb0167629b63d3dadab26273f54670f22c8df5dda5951e3e07b231f597061979997c5b8ac4054ed7d66f1f66018bb6df6c2d7366

Download Submit
C:\Windows\System\tHcSWRL.exe

Filesize
2.3MB

MD5
11095b8496688f1c2908141647f50768

SHA1
db53ab94172fb36101d30064827822686d832a28

SHA256
69bf5c99ef7454a732158311fc205a576c222f41f6de15070a27749f134e337f

SHA512
a756ec67d8bd50083e2e442347cb13d6130f187e57542b56cd11cee8f929fe2548ba8d00fc06639ad6df859a547e6a638831962eecb337c7da1be9aa8a795d27

Download Submit
C:\Windows\System\tTGAVUv.exe

Filesize
2.3MB

MD5
5de623ac8625667ec9b0250d84d48a5f

SHA1
026a29af7d908cd9bd92e8d8f49a135fcaa74302

SHA256
6018901c2a668dc3181519d493f3aa40b25a490aad3733a4cc22ccd95fb06303

SHA512
b19483d62e5cdfface531bae76c699c90ea56153c12a1f9d64880950f8e1a44f7807148e3cacaa5ec66f60722bb5e56bbfec943493b789052ad159a865f440a2

Download Submit
C:\Windows\System\uHmmrZy.exe

Filesize
2.3MB

MD5
769f694ada111946dcf021db5eb641cd

SHA1
03a1ed4686aa729fb55d64243d48f8024253069e

SHA256
6555ae516e2f2cd93ef30de4beec8cc8955d4ad14af1124f0c947831e3fb0c7f

SHA512
8da3c154cd454a9dd76aa0a0df7e2ccd8b1d067479d6d05e69e5fff8ce99cbd362019eabe7530b28c73dd28eee6d3871674bd6db0215a9dc1aff7b08f02b7af5

Download Submit
C:\Windows\System\vuplqBx.exe

Filesize
2.3MB

MD5
64a32fa1e28c951c47b2cc05aa197c36

SHA1
5a4f02e58bdef9a1316afc512da8e46b144a44bd

SHA256
5814bebfc404096cf8f7e205496ac45c37e9b0654de5f1fa28cdcf04ab8ba5dc

SHA512
858bce76a2f353d6f3bc76e4650360789c4526fdb93391678bdf388c4dd31fdb0348a49a292a1fbdd29e24bf87523dbd4330d0c3dbfdf2153cb9b9360864ab25

Download Submit
C:\Windows\System\wMsyqse.exe

Filesize
2.3MB

MD5
5f296df98f4408ebb35ab46d3eaa7261

SHA1
52a0ef70a0ce2d9480e2d7c928036874729c5cb0

SHA256
9ac5f1cedd95916cd26c8bbb21b7d0d626a8429362013c0417a3f6088f349378

SHA512
5411488d361b9baad51798e6d8a3c3dc2e1c1831f8514e0c279d471f4c3e783cc519bd96873591afb04ccb690dbd03ed0c85072847480eae3b5d94a6e2dfba1e

Download Submit
memory/808-381-0x00007FF6A5550000-0x00007FF6A5942000-memory.dmp

Filesize
3.9MB

Download
memory/808-5437-0x00007FF6A5550000-0x00007FF6A5942000-memory.dmp

Filesize
3.9MB

Download
memory/1080-5347-0x00007FF70C270000-0x00007FF70C662000-memory.dmp

Filesize
3.9MB

Download
memory/1080-40-0x00007FF70C270000-0x00007FF70C662000-memory.dmp

Filesize
3.9MB

Download
memory/1284-5465-0x00007FF7B84F0000-0x00007FF7B88E2000-memory.dmp

Filesize
3.9MB

Download
memory/1284-487-0x00007FF7B84F0000-0x00007FF7B88E2000-memory.dmp

Filesize
3.9MB

Download
memory/1984-369-0x00007FF60B0E0000-0x00007FF60B4D2000-memory.dmp

Filesize
3.9MB

Download
memory/1984-5426-0x00007FF60B0E0000-0x00007FF60B4D2000-memory.dmp

Filesize
3.9MB

Download
memory/1992-407-0x00007FF7780B0000-0x00007FF7784A2000-memory.dmp

Filesize
3.9MB

Download
memory/1992-5439-0x00007FF7780B0000-0x00007FF7784A2000-memory.dmp

Filesize
3.9MB

Download
memory/2084-5387-0x00007FF7D1F90000-0x00007FF7D2382000-memory.dmp

Filesize
3.9MB

Download
memory/2084-291-0x00007FF7D1F90000-0x00007FF7D2382000-memory.dmp

Filesize
3.9MB

Download
memory/2976-5432-0x00007FF6C7B30000-0x00007FF6C7F22000-memory.dmp

Filesize
3.9MB

Download
memory/2976-370-0x00007FF6C7B30000-0x00007FF6C7F22000-memory.dmp

Filesize
3.9MB

Download
memory/3268-5423-0x00007FF61A960000-0x00007FF61AD52000-memory.dmp

Filesize
3.9MB

Download
memory/3268-319-0x00007FF61A960000-0x00007FF61AD52000-memory.dmp

Filesize
3.9MB

Download
memory/3648-12-0x00007FF772FE0000-0x00007FF7733D2000-memory.dmp

Filesize
3.9MB

Download
memory/3980-5448-0x00007FF670050000-0x00007FF670442000-memory.dmp

Filesize
3.9MB

Download
memory/3980-451-0x00007FF670050000-0x00007FF670442000-memory.dmp

Filesize
3.9MB

Download
memory/4008-47-0x00007FF7DD370000-0x00007FF7DD762000-memory.dmp

Filesize
3.9MB

Download
memory/4020-489-0x00007FF70F590000-0x00007FF70F982000-memory.dmp

Filesize
3.9MB

Download
memory/4020-5352-0x00007FF70F590000-0x00007FF70F982000-memory.dmp

Filesize
3.9MB

Download
memory/4180-5374-0x00007FF6C0FB0000-0x00007FF6C13A2000-memory.dmp

Filesize
3.9MB

Download
memory/4180-228-0x00007FF6C0FB0000-0x00007FF6C13A2000-memory.dmp

Filesize
3.9MB

Download
memory/4204-491-0x00007FF634820000-0x00007FF634C12000-memory.dmp

Filesize
3.9MB

Download
memory/4204-5429-0x00007FF634820000-0x00007FF634C12000-memory.dmp

Filesize
3.9MB

Download
memory/4272-5358-0x00007FF7E6BB0000-0x00007FF7E6FA2000-memory.dmp

Filesize
3.9MB

Download
memory/4272-22-0x00007FF7E6BB0000-0x00007FF7E6FA2000-memory.dmp

Filesize
3.9MB

Download
memory/4308-2473-0x00007FFE63E00000-0x00007FFE648C1000-memory.dmp

Filesize
10.8MB

Download
memory/4308-233-0x000001F2EEA80000-0x000001F2EEAA2000-memory.dmp

Filesize
136KB

Download
memory/4308-131-0x00007FFE63E00000-0x00007FFE648C1000-memory.dmp

Filesize
10.8MB

Download
memory/4308-139-0x000001F2D49F0000-0x000001F2D4A00000-memory.dmp

Filesize
64KB

Download
memory/4408-172-0x00007FF69CDA0000-0x00007FF69D192000-memory.dmp

Filesize
3.9MB

Download
memory/4408-5428-0x00007FF69CDA0000-0x00007FF69D192000-memory.dmp

Filesize
3.9MB

Download
memory/4488-272-0x00007FF645950000-0x00007FF645D42000-memory.dmp

Filesize
3.9MB

Download
memory/4488-5384-0x00007FF645950000-0x00007FF645D42000-memory.dmp

Filesize
3.9MB

Download
memory/4508-488-0x00007FF6EA170000-0x00007FF6EA562000-memory.dmp

Filesize
3.9MB

Download
memory/4508-5472-0x00007FF6EA170000-0x00007FF6EA562000-memory.dmp

Filesize
3.9MB

Download
memory/4556-5393-0x00007FF706EE0000-0x00007FF7072D2000-memory.dmp

Filesize
3.9MB

Download
memory/4556-490-0x00007FF706EE0000-0x00007FF7072D2000-memory.dmp

Filesize
3.9MB

Download
memory/4696-206-0x00007FF6A1890000-0x00007FF6A1C82000-memory.dmp

Filesize
3.9MB

Download
memory/4696-5367-0x00007FF6A1890000-0x00007FF6A1C82000-memory.dmp

Filesize
3.9MB

Download
memory/4740-227-0x00007FF6BE980000-0x00007FF6BED72000-memory.dmp

Filesize
3.9MB

Download
memory/4740-5436-0x00007FF6BE980000-0x00007FF6BED72000-memory.dmp

Filesize
3.9MB

Download
memory/4888-0-0x00007FF7B5770000-0x00007FF7B5B62000-memory.dmp

Filesize
3.9MB

Download
memory/4888-1-0x000001ECE5BA0000-0x000001ECE5BB0000-memory.dmp

Filesize
64KB

Download