xmrig | caee8a238145b44823e7fd57c86c42d526304dfa14d1a357f2c572380c13dd2c

Analysis

max time kernel
140s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
Size

1.9MB
MD5

09c22c40edd5615bcb33dba3ae904af8
SHA1

ec40d241623acf3b529b126c9f2d33c47adae9f1
SHA256

caee8a238145b44823e7fd57c86c42d526304dfa14d1a357f2c572380c13dd2c
SHA512

fb112189b0f57195fb7afb899a42174726e649618d7cc901e27eaeecd75bb7402465a25a34c49e1d5681f23741a1ff339cc27981ab30ad105320b2dc9d4b8eee
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+Uq:NABN

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 30 IoCs

miner

resource	yara_rule
behavioral2/memory/1656-103-0x00007FF77E4C0000-0x00007FF77E8B2000-memory.dmp	xmrig
behavioral2/memory/4124-124-0x00007FF7A2010000-0x00007FF7A2402000-memory.dmp	xmrig
behavioral2/memory/3800-134-0x00007FF7222C0000-0x00007FF7226B2000-memory.dmp	xmrig
behavioral2/memory/4860-140-0x00007FF62B1B0000-0x00007FF62B5A2000-memory.dmp	xmrig
behavioral2/memory/1268-149-0x00007FF787220000-0x00007FF787612000-memory.dmp	xmrig
behavioral2/memory/4416-166-0x00007FF761460000-0x00007FF761852000-memory.dmp	xmrig
behavioral2/memory/5012-173-0x00007FF76F890000-0x00007FF76FC82000-memory.dmp	xmrig
behavioral2/memory/4656-167-0x00007FF769720000-0x00007FF769B12000-memory.dmp	xmrig
behavioral2/memory/4620-160-0x00007FF61EEB0000-0x00007FF61F2A2000-memory.dmp	xmrig
behavioral2/memory/1600-154-0x00007FF63C9D0000-0x00007FF63CDC2000-memory.dmp	xmrig
behavioral2/memory/4224-153-0x00007FF6B4FB0000-0x00007FF6B53A2000-memory.dmp	xmrig
behavioral2/memory/2520-143-0x00007FF6AADB0000-0x00007FF6AB1A2000-memory.dmp	xmrig
behavioral2/memory/4964-139-0x00007FF764810000-0x00007FF764C02000-memory.dmp	xmrig
behavioral2/memory/3552-117-0x00007FF73DA80000-0x00007FF73DE72000-memory.dmp	xmrig
behavioral2/memory/4212-109-0x00007FF754F70000-0x00007FF755362000-memory.dmp	xmrig
behavioral2/memory/2180-104-0x00007FF78E400000-0x00007FF78E7F2000-memory.dmp	xmrig
behavioral2/memory/700-91-0x00007FF6E9480000-0x00007FF6E9872000-memory.dmp	xmrig
behavioral2/memory/436-83-0x00007FF7BF3D0000-0x00007FF7BF7C2000-memory.dmp	xmrig
behavioral2/memory/3632-70-0x00007FF6B5F30000-0x00007FF6B6322000-memory.dmp	xmrig
behavioral2/memory/2108-62-0x00007FF75F160000-0x00007FF75F552000-memory.dmp	xmrig
behavioral2/memory/4556-39-0x00007FF68D7F0000-0x00007FF68DBE2000-memory.dmp	xmrig
behavioral2/memory/2124-3677-0x00007FF6511D0000-0x00007FF6515C2000-memory.dmp	xmrig
behavioral2/memory/1656-3692-0x00007FF77E4C0000-0x00007FF77E8B2000-memory.dmp	xmrig
behavioral2/memory/3552-5891-0x00007FF73DA80000-0x00007FF73DE72000-memory.dmp	xmrig
behavioral2/memory/4124-5892-0x00007FF7A2010000-0x00007FF7A2402000-memory.dmp	xmrig
behavioral2/memory/2180-5894-0x00007FF78E400000-0x00007FF78E7F2000-memory.dmp	xmrig
behavioral2/memory/4964-5898-0x00007FF764810000-0x00007FF764C02000-memory.dmp	xmrig
behavioral2/memory/4860-5910-0x00007FF62B1B0000-0x00007FF62B5A2000-memory.dmp	xmrig
behavioral2/memory/2520-5902-0x00007FF6AADB0000-0x00007FF6AB1A2000-memory.dmp	xmrig
behavioral2/memory/4620-5984-0x00007FF61EEB0000-0x00007FF61F2A2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4556	XNxzoNS.exe
2108	QdVCNFB.exe
3632	usBBajq.exe
436	ZvHcoqp.exe
700	tHEJgud.exe
1268	gsbpEyi.exe
1656	DviEsND.exe
2180	dhvXaHU.exe
4212	jDlURWR.exe
3552	ltRYbhU.exe
4124	AHvIezt.exe
4224	uDpvUDk.exe
3800	klVPPWH.exe
4964	qUEsFnn.exe
1600	KcBrTrQ.exe
4860	GegrYje.exe
2520	KOxABOJ.exe
4620	zjnIKmS.exe
4416	PPEmUMf.exe
4656	XFsnDWS.exe
5012	ARiEOUp.exe
2908	jfmMSzm.exe
4848	icTcrZX.exe
1012	jQxpPpE.exe
2960	QnfKyCq.exe
2040	cDACLev.exe
1892	wPeMHVQ.exe
3172	ygQgqxC.exe
4228	wShhrRp.exe
540	eZOJoHv.exe
4504	NEEJfxp.exe
4568	vDuAlus.exe
3416	hAPGCGS.exe
3608	hFPUWSg.exe
1700	PUocMEI.exe
2608	EmxHoRk.exe
4840	ZWRxmEC.exe
4100	cBVjqHo.exe
4752	pYdaVqI.exe
1072	QYEtrgc.exe
3476	HNTNROB.exe
3700	lpylCVa.exe
3424	aqEroiR.exe
4264	FdvQZGq.exe
1840	kyNRMxM.exe
4876	cxHDnvu.exe
1360	ALXcUeJ.exe
2968	zmAjybl.exe
2572	bexzQxh.exe
3212	VKPRxfM.exe
3496	mTXRdXZ.exe
2020	ObFTpuZ.exe
4520	avGOHqY.exe
1300	MuONxnT.exe
2428	RELabRd.exe
1176	fGEGTGb.exe
3792	WVcJAgF.exe
1684	pEQplFY.exe
3408	LQHwEPV.exe
3440	rBOjbKv.exe
1284	tRQaPYV.exe
4940	tEDcNbb.exe
2820	QBZaVfN.exe
4084	lhjCHtc.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2124-0-0x00007FF6511D0000-0x00007FF6515C2000-memory.dmp	upx
behavioral2/files/0x000e000000023b8a-5.dat	upx
behavioral2/files/0x000a000000023b98-9.dat	upx
behavioral2/files/0x000a000000023b97-11.dat	upx
behavioral2/files/0x000a000000023b9e-56.dat	upx
behavioral2/files/0x000a000000023ba5-89.dat	upx
behavioral2/files/0x000a000000023ba4-87.dat	upx
behavioral2/memory/1656-103-0x00007FF77E4C0000-0x00007FF77E8B2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba8-106.dat	upx
behavioral2/files/0x000a000000023ba1-114.dat	upx
behavioral2/memory/4124-124-0x00007FF7A2010000-0x00007FF7A2402000-memory.dmp	upx
behavioral2/memory/3800-134-0x00007FF7222C0000-0x00007FF7226B2000-memory.dmp	upx
behavioral2/memory/4860-140-0x00007FF62B1B0000-0x00007FF62B5A2000-memory.dmp	upx
behavioral2/memory/1268-149-0x00007FF787220000-0x00007FF787612000-memory.dmp	upx
behavioral2/files/0x000a000000023bae-157.dat	upx
behavioral2/memory/4416-166-0x00007FF761460000-0x00007FF761852000-memory.dmp	upx
behavioral2/files/0x000a000000023baf-174.dat	upx
behavioral2/files/0x000a000000023bb5-196.dat	upx
behavioral2/files/0x000a000000023bb3-194.dat	upx
behavioral2/files/0x000a000000023bb4-191.dat	upx
behavioral2/files/0x000a000000023bb2-189.dat	upx
behavioral2/files/0x000a000000023bb1-184.dat	upx
behavioral2/files/0x000a000000023bb0-179.dat	upx
behavioral2/memory/5012-173-0x00007FF76F890000-0x00007FF76FC82000-memory.dmp	upx
behavioral2/memory/4656-167-0x00007FF769720000-0x00007FF769B12000-memory.dmp	upx
behavioral2/files/0x000a000000023bad-161.dat	upx
behavioral2/memory/4620-160-0x00007FF61EEB0000-0x00007FF61F2A2000-memory.dmp	upx
behavioral2/files/0x000a000000023bac-155.dat	upx
behavioral2/memory/1600-154-0x00007FF63C9D0000-0x00007FF63CDC2000-memory.dmp	upx
behavioral2/memory/4224-153-0x00007FF6B4FB0000-0x00007FF6B53A2000-memory.dmp	upx
behavioral2/files/0x000b000000023b94-145.dat	upx
behavioral2/memory/2520-143-0x00007FF6AADB0000-0x00007FF6AB1A2000-memory.dmp	upx
behavioral2/memory/4964-139-0x00007FF764810000-0x00007FF764C02000-memory.dmp	upx
behavioral2/files/0x000a000000023bab-137.dat	upx
behavioral2/files/0x000a000000023baa-129.dat	upx
behavioral2/files/0x000a000000023ba7-127.dat	upx
behavioral2/files/0x000a000000023ba9-125.dat	upx
behavioral2/memory/3552-117-0x00007FF73DA80000-0x00007FF73DE72000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-111.dat	upx
behavioral2/memory/4212-109-0x00007FF754F70000-0x00007FF755362000-memory.dmp	upx
behavioral2/memory/2180-104-0x00007FF78E400000-0x00007FF78E7F2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba2-97.dat	upx
behavioral2/memory/700-91-0x00007FF6E9480000-0x00007FF6E9872000-memory.dmp	upx
behavioral2/files/0x000a000000023ba3-100.dat	upx
behavioral2/memory/436-83-0x00007FF7BF3D0000-0x00007FF7BF7C2000-memory.dmp	upx
behavioral2/memory/3632-70-0x00007FF6B5F30000-0x00007FF6B6322000-memory.dmp	upx
behavioral2/files/0x000a000000023b9f-67.dat	upx
behavioral2/files/0x000a000000023ba0-66.dat	upx
behavioral2/files/0x000b000000023b9d-65.dat	upx
behavioral2/files/0x000b000000023b9c-64.dat	upx
behavioral2/memory/2108-62-0x00007FF75F160000-0x00007FF75F552000-memory.dmp	upx
behavioral2/files/0x000a000000023b99-57.dat	upx
behavioral2/files/0x000a000000023b9b-49.dat	upx
behavioral2/files/0x000a000000023b9a-43.dat	upx
behavioral2/memory/4556-39-0x00007FF68D7F0000-0x00007FF68DBE2000-memory.dmp	upx
behavioral2/memory/2124-3677-0x00007FF6511D0000-0x00007FF6515C2000-memory.dmp	upx
behavioral2/memory/1656-3692-0x00007FF77E4C0000-0x00007FF77E8B2000-memory.dmp	upx
behavioral2/memory/3552-5891-0x00007FF73DA80000-0x00007FF73DE72000-memory.dmp	upx
behavioral2/memory/4124-5892-0x00007FF7A2010000-0x00007FF7A2402000-memory.dmp	upx
behavioral2/memory/2180-5894-0x00007FF78E400000-0x00007FF78E7F2000-memory.dmp	upx
behavioral2/memory/4964-5898-0x00007FF764810000-0x00007FF764C02000-memory.dmp	upx
behavioral2/memory/4860-5910-0x00007FF62B1B0000-0x00007FF62B5A2000-memory.dmp	upx
behavioral2/memory/2520-5902-0x00007FF6AADB0000-0x00007FF6AB1A2000-memory.dmp	upx
behavioral2/memory/4620-5984-0x00007FF61EEB0000-0x00007FF61F2A2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vGmUgvf.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\LFXbDGs.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\opNisIZ.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\QbGIpJy.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\FOjsyzH.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\gxdXyrV.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\ltiNlFc.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\lyitezP.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\HJxCRYR.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\cYotRaG.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\EbLzbxR.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\MrlvCZs.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\cmjOtcZ.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\iFQnVxB.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\iAKINHf.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\ahwEIwM.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\NCUTIdL.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\upWsJNe.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\ACkEFZE.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\urLGscS.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\HriSFzH.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\slUHAlt.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\mKJQien.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\qmKYDpm.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\WtIMGrY.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\UbGajhn.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\ywcgZaI.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\lXTRVeL.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\vjmqcoQ.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\aFoazJt.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\gBOiLLO.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\eVoqlla.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\TZeKaLH.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\IZevzjn.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\YboZtbL.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\bVufKiG.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\YxqfuzS.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\IrTNdgB.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\cuAuaEG.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\xXPYoti.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\ugzTLQP.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\Vetzjpz.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\zFHrbTs.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\GDojqJr.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\IOApLIO.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\lQfkKcz.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\wuWpTmv.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\EBfCfBk.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\CoKcXMA.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\VheVjdB.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\sYRfded.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\bmOztEu.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\WNtplZu.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\tdfOhdW.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\Jujbpdx.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\TTfVvPB.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\NyVlpbi.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\MxNfJoE.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\TzFFckZ.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\eDicQgu.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\vGeJjjd.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\mnsmaxq.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\iGTaVQq.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
File created	C:\Windows\System\DhjGgHV.exe	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3876	powershell.exe
3876	powershell.exe
3876	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeLockMemoryPrivilege	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 3876	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	85
PID 2124 wrote to memory of 3876	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	85
PID 2124 wrote to memory of 4556	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	86
PID 2124 wrote to memory of 4556	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	86
PID 2124 wrote to memory of 2108	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	87
PID 2124 wrote to memory of 2108	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	87
PID 2124 wrote to memory of 3632	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	88
PID 2124 wrote to memory of 3632	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	88
PID 2124 wrote to memory of 436	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	89
PID 2124 wrote to memory of 436	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	89
PID 2124 wrote to memory of 700	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	90
PID 2124 wrote to memory of 700	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	90
PID 2124 wrote to memory of 1268	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	91
PID 2124 wrote to memory of 1268	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	91
PID 2124 wrote to memory of 1656	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	92
PID 2124 wrote to memory of 1656	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	92
PID 2124 wrote to memory of 2180	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	93
PID 2124 wrote to memory of 2180	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	93
PID 2124 wrote to memory of 4212	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	94
PID 2124 wrote to memory of 4212	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	94
PID 2124 wrote to memory of 3552	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	95
PID 2124 wrote to memory of 3552	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	95
PID 2124 wrote to memory of 4124	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	96
PID 2124 wrote to memory of 4124	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	96
PID 2124 wrote to memory of 4224	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	97
PID 2124 wrote to memory of 4224	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	97
PID 2124 wrote to memory of 3800	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	98
PID 2124 wrote to memory of 3800	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	98
PID 2124 wrote to memory of 4964	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	99
PID 2124 wrote to memory of 4964	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	99
PID 2124 wrote to memory of 1600	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	100
PID 2124 wrote to memory of 1600	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	100
PID 2124 wrote to memory of 4860	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	101
PID 2124 wrote to memory of 4860	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	101
PID 2124 wrote to memory of 2520	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	102
PID 2124 wrote to memory of 2520	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	102
PID 2124 wrote to memory of 4620	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	103
PID 2124 wrote to memory of 4620	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	103
PID 2124 wrote to memory of 4416	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	104
PID 2124 wrote to memory of 4416	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	104
PID 2124 wrote to memory of 4656	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	105
PID 2124 wrote to memory of 4656	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	105
PID 2124 wrote to memory of 5012	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	106
PID 2124 wrote to memory of 5012	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	106
PID 2124 wrote to memory of 2908	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	107
PID 2124 wrote to memory of 2908	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	107
PID 2124 wrote to memory of 4848	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	108
PID 2124 wrote to memory of 4848	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	108
PID 2124 wrote to memory of 1012	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	109
PID 2124 wrote to memory of 1012	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	109
PID 2124 wrote to memory of 2960	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	110
PID 2124 wrote to memory of 2960	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	110
PID 2124 wrote to memory of 2040	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	111
PID 2124 wrote to memory of 2040	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	111
PID 2124 wrote to memory of 1892	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	112
PID 2124 wrote to memory of 1892	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	112
PID 2124 wrote to memory of 3172	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	113
PID 2124 wrote to memory of 3172	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	113
PID 2124 wrote to memory of 4228	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	114
PID 2124 wrote to memory of 4228	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	114
PID 2124 wrote to memory of 540	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	115
PID 2124 wrote to memory of 540	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	115
PID 2124 wrote to memory of 4504	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	116
PID 2124 wrote to memory of 4504	2124	09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09c22c40edd5615bcb33dba3ae904af8_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3876
- C:\Windows\System\XNxzoNS.exe
  C:\Windows\System\XNxzoNS.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\QdVCNFB.exe
  C:\Windows\System\QdVCNFB.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\usBBajq.exe
  C:\Windows\System\usBBajq.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\ZvHcoqp.exe
  C:\Windows\System\ZvHcoqp.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\tHEJgud.exe
  C:\Windows\System\tHEJgud.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\gsbpEyi.exe
  C:\Windows\System\gsbpEyi.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\DviEsND.exe
  C:\Windows\System\DviEsND.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\dhvXaHU.exe
  C:\Windows\System\dhvXaHU.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\jDlURWR.exe
  C:\Windows\System\jDlURWR.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\ltRYbhU.exe
  C:\Windows\System\ltRYbhU.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\AHvIezt.exe
  C:\Windows\System\AHvIezt.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\uDpvUDk.exe
  C:\Windows\System\uDpvUDk.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\klVPPWH.exe
  C:\Windows\System\klVPPWH.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\qUEsFnn.exe
  C:\Windows\System\qUEsFnn.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\KcBrTrQ.exe
  C:\Windows\System\KcBrTrQ.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\GegrYje.exe
  C:\Windows\System\GegrYje.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\KOxABOJ.exe
  C:\Windows\System\KOxABOJ.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\zjnIKmS.exe
  C:\Windows\System\zjnIKmS.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\PPEmUMf.exe
  C:\Windows\System\PPEmUMf.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\XFsnDWS.exe
  C:\Windows\System\XFsnDWS.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\ARiEOUp.exe
  C:\Windows\System\ARiEOUp.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\jfmMSzm.exe
  C:\Windows\System\jfmMSzm.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\icTcrZX.exe
  C:\Windows\System\icTcrZX.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\jQxpPpE.exe
  C:\Windows\System\jQxpPpE.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\QnfKyCq.exe
  C:\Windows\System\QnfKyCq.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\cDACLev.exe
  C:\Windows\System\cDACLev.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\wPeMHVQ.exe
  C:\Windows\System\wPeMHVQ.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\ygQgqxC.exe
  C:\Windows\System\ygQgqxC.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\wShhrRp.exe
  C:\Windows\System\wShhrRp.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\eZOJoHv.exe
  C:\Windows\System\eZOJoHv.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\NEEJfxp.exe
  C:\Windows\System\NEEJfxp.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\vDuAlus.exe
  C:\Windows\System\vDuAlus.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\hAPGCGS.exe
  C:\Windows\System\hAPGCGS.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\hFPUWSg.exe
  C:\Windows\System\hFPUWSg.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\PUocMEI.exe
  C:\Windows\System\PUocMEI.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\EmxHoRk.exe
  C:\Windows\System\EmxHoRk.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\ZWRxmEC.exe
  C:\Windows\System\ZWRxmEC.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\cBVjqHo.exe
  C:\Windows\System\cBVjqHo.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\pYdaVqI.exe
  C:\Windows\System\pYdaVqI.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\QYEtrgc.exe
  C:\Windows\System\QYEtrgc.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\HNTNROB.exe
  C:\Windows\System\HNTNROB.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\lpylCVa.exe
  C:\Windows\System\lpylCVa.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\aqEroiR.exe
  C:\Windows\System\aqEroiR.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\FdvQZGq.exe
  C:\Windows\System\FdvQZGq.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\kyNRMxM.exe
  C:\Windows\System\kyNRMxM.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\cxHDnvu.exe
  C:\Windows\System\cxHDnvu.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\ALXcUeJ.exe
  C:\Windows\System\ALXcUeJ.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\zmAjybl.exe
  C:\Windows\System\zmAjybl.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\bexzQxh.exe
  C:\Windows\System\bexzQxh.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\VKPRxfM.exe
  C:\Windows\System\VKPRxfM.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\mTXRdXZ.exe
  C:\Windows\System\mTXRdXZ.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\ObFTpuZ.exe
  C:\Windows\System\ObFTpuZ.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\avGOHqY.exe
  C:\Windows\System\avGOHqY.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\MuONxnT.exe
  C:\Windows\System\MuONxnT.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\RELabRd.exe
  C:\Windows\System\RELabRd.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\fGEGTGb.exe
  C:\Windows\System\fGEGTGb.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\WVcJAgF.exe
  C:\Windows\System\WVcJAgF.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\pEQplFY.exe
  C:\Windows\System\pEQplFY.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\LQHwEPV.exe
  C:\Windows\System\LQHwEPV.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\rBOjbKv.exe
  C:\Windows\System\rBOjbKv.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\tRQaPYV.exe
  C:\Windows\System\tRQaPYV.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\tEDcNbb.exe
  C:\Windows\System\tEDcNbb.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\QBZaVfN.exe
  C:\Windows\System\QBZaVfN.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\lhjCHtc.exe
  C:\Windows\System\lhjCHtc.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\ZTjKVNu.exe
  C:\Windows\System\ZTjKVNu.exe
  2⤵
  PID:4256
- C:\Windows\System\wsrpxUZ.exe
  C:\Windows\System\wsrpxUZ.exe
  2⤵
  PID:5044
- C:\Windows\System\KvyNpvB.exe
  C:\Windows\System\KvyNpvB.exe
  2⤵
  PID:1992
- C:\Windows\System\RiRLvYb.exe
  C:\Windows\System\RiRLvYb.exe
  2⤵
  PID:4828
- C:\Windows\System\BfHaonq.exe
  C:\Windows\System\BfHaonq.exe
  2⤵
  PID:3992
- C:\Windows\System\RjNRWbl.exe
  C:\Windows\System\RjNRWbl.exe
  2⤵
  PID:2376
- C:\Windows\System\wNhzXBL.exe
  C:\Windows\System\wNhzXBL.exe
  2⤵
  PID:3168
- C:\Windows\System\LAVRthV.exe
  C:\Windows\System\LAVRthV.exe
  2⤵
  PID:4636
- C:\Windows\System\JRFPwHw.exe
  C:\Windows\System\JRFPwHw.exe
  2⤵
  PID:1520
- C:\Windows\System\DpWrILX.exe
  C:\Windows\System\DpWrILX.exe
  2⤵
  PID:884
- C:\Windows\System\YYLwiuF.exe
  C:\Windows\System\YYLwiuF.exe
  2⤵
  PID:5144
- C:\Windows\System\TGqBWDy.exe
  C:\Windows\System\TGqBWDy.exe
  2⤵
  PID:5172
- C:\Windows\System\qizykdg.exe
  C:\Windows\System\qizykdg.exe
  2⤵
  PID:5200
- C:\Windows\System\BiyMgMY.exe
  C:\Windows\System\BiyMgMY.exe
  2⤵
  PID:5228
- C:\Windows\System\BBVwyiY.exe
  C:\Windows\System\BBVwyiY.exe
  2⤵
  PID:5256
- C:\Windows\System\uSADXVJ.exe
  C:\Windows\System\uSADXVJ.exe
  2⤵
  PID:5284
- C:\Windows\System\uxuEmJN.exe
  C:\Windows\System\uxuEmJN.exe
  2⤵
  PID:5312
- C:\Windows\System\OiQDFjT.exe
  C:\Windows\System\OiQDFjT.exe
  2⤵
  PID:5340
- C:\Windows\System\IomVTxp.exe
  C:\Windows\System\IomVTxp.exe
  2⤵
  PID:5368
- C:\Windows\System\TTfVvPB.exe
  C:\Windows\System\TTfVvPB.exe
  2⤵
  PID:5396
- C:\Windows\System\mALgIPj.exe
  C:\Windows\System\mALgIPj.exe
  2⤵
  PID:5424
- C:\Windows\System\FLSVPox.exe
  C:\Windows\System\FLSVPox.exe
  2⤵
  PID:5452
- C:\Windows\System\edHFxGg.exe
  C:\Windows\System\edHFxGg.exe
  2⤵
  PID:5480
- C:\Windows\System\hYSLJdl.exe
  C:\Windows\System\hYSLJdl.exe
  2⤵
  PID:5508
- C:\Windows\System\BcbIyEa.exe
  C:\Windows\System\BcbIyEa.exe
  2⤵
  PID:5536
- C:\Windows\System\iIpbgkr.exe
  C:\Windows\System\iIpbgkr.exe
  2⤵
  PID:5564
- C:\Windows\System\wxjZkAG.exe
  C:\Windows\System\wxjZkAG.exe
  2⤵
  PID:5592
- C:\Windows\System\XhfBwat.exe
  C:\Windows\System\XhfBwat.exe
  2⤵
  PID:5620
- C:\Windows\System\tubUbCW.exe
  C:\Windows\System\tubUbCW.exe
  2⤵
  PID:5648
- C:\Windows\System\QmVjixZ.exe
  C:\Windows\System\QmVjixZ.exe
  2⤵
  PID:5676
- C:\Windows\System\ViEMJst.exe
  C:\Windows\System\ViEMJst.exe
  2⤵
  PID:5704
- C:\Windows\System\IxpPapj.exe
  C:\Windows\System\IxpPapj.exe
  2⤵
  PID:5732
- C:\Windows\System\mCxXTbA.exe
  C:\Windows\System\mCxXTbA.exe
  2⤵
  PID:5760
- C:\Windows\System\dqGFLsS.exe
  C:\Windows\System\dqGFLsS.exe
  2⤵
  PID:5792
- C:\Windows\System\DFyefEu.exe
  C:\Windows\System\DFyefEu.exe
  2⤵
  PID:5816
- C:\Windows\System\bCkPHSg.exe
  C:\Windows\System\bCkPHSg.exe
  2⤵
  PID:5844
- C:\Windows\System\iaHGgDB.exe
  C:\Windows\System\iaHGgDB.exe
  2⤵
  PID:5872
- C:\Windows\System\upLAUiU.exe
  C:\Windows\System\upLAUiU.exe
  2⤵
  PID:5896
- C:\Windows\System\mVXgSqQ.exe
  C:\Windows\System\mVXgSqQ.exe
  2⤵
  PID:5928
- C:\Windows\System\ymTSzVQ.exe
  C:\Windows\System\ymTSzVQ.exe
  2⤵
  PID:5956
- C:\Windows\System\FqCYKAD.exe
  C:\Windows\System\FqCYKAD.exe
  2⤵
  PID:5984
- C:\Windows\System\dtSpNkV.exe
  C:\Windows\System\dtSpNkV.exe
  2⤵
  PID:6008
- C:\Windows\System\TDsPqPK.exe
  C:\Windows\System\TDsPqPK.exe
  2⤵
  PID:6040
- C:\Windows\System\imjmNOs.exe
  C:\Windows\System\imjmNOs.exe
  2⤵
  PID:6068
- C:\Windows\System\mIEzlzQ.exe
  C:\Windows\System\mIEzlzQ.exe
  2⤵
  PID:6096
- C:\Windows\System\vqduoNC.exe
  C:\Windows\System\vqduoNC.exe
  2⤵
  PID:4608
- C:\Windows\System\xhcrvDE.exe
  C:\Windows\System\xhcrvDE.exe
  2⤵
  PID:3656
- C:\Windows\System\sFAHcCF.exe
  C:\Windows\System\sFAHcCF.exe
  2⤵
  PID:2028
- C:\Windows\System\xKfVnHK.exe
  C:\Windows\System\xKfVnHK.exe
  2⤵
  PID:1164
- C:\Windows\System\LHyHFQH.exe
  C:\Windows\System\LHyHFQH.exe
  2⤵
  PID:3756
- C:\Windows\System\SmvGxzW.exe
  C:\Windows\System\SmvGxzW.exe
  2⤵
  PID:5128
- C:\Windows\System\wSJbEdD.exe
  C:\Windows\System\wSJbEdD.exe
  2⤵
  PID:5188
- C:\Windows\System\ZGEzcGa.exe
  C:\Windows\System\ZGEzcGa.exe
  2⤵
  PID:5244
- C:\Windows\System\xPfshyA.exe
  C:\Windows\System\xPfshyA.exe
  2⤵
  PID:5304
- C:\Windows\System\JsmbjKq.exe
  C:\Windows\System\JsmbjKq.exe
  2⤵
  PID:5384
- C:\Windows\System\YMjvWVv.exe
  C:\Windows\System\YMjvWVv.exe
  2⤵
  PID:5444
- C:\Windows\System\YJYLNKc.exe
  C:\Windows\System\YJYLNKc.exe
  2⤵
  PID:5500
- C:\Windows\System\ACRmQEV.exe
  C:\Windows\System\ACRmQEV.exe
  2⤵
  PID:5576
- C:\Windows\System\MKcCnHP.exe
  C:\Windows\System\MKcCnHP.exe
  2⤵
  PID:5632
- C:\Windows\System\AKPsjXG.exe
  C:\Windows\System\AKPsjXG.exe
  2⤵
  PID:5692
- C:\Windows\System\eUfAjUl.exe
  C:\Windows\System\eUfAjUl.exe
  2⤵
  PID:5776
- C:\Windows\System\nQxOtmM.exe
  C:\Windows\System\nQxOtmM.exe
  2⤵
  PID:5864
- C:\Windows\System\LwJqGIU.exe
  C:\Windows\System\LwJqGIU.exe
  2⤵
  PID:6060
- C:\Windows\System\orFdLOw.exe
  C:\Windows\System\orFdLOw.exe
  2⤵
  PID:6112
- C:\Windows\System\wWSYGwx.exe
  C:\Windows\System\wWSYGwx.exe
  2⤵
  PID:4260
- C:\Windows\System\nDwheej.exe
  C:\Windows\System\nDwheej.exe
  2⤵
  PID:5052
- C:\Windows\System\xbdGkvm.exe
  C:\Windows\System\xbdGkvm.exe
  2⤵
  PID:4792
- C:\Windows\System\uSYQErw.exe
  C:\Windows\System\uSYQErw.exe
  2⤵
  PID:5160
- C:\Windows\System\cnBAMrK.exe
  C:\Windows\System\cnBAMrK.exe
  2⤵
  PID:5296
- C:\Windows\System\tgMUHwv.exe
  C:\Windows\System\tgMUHwv.exe
  2⤵
  PID:5040
- C:\Windows\System\NpSIZAO.exe
  C:\Windows\System\NpSIZAO.exe
  2⤵
  PID:2676
- C:\Windows\System\BxyANwT.exe
  C:\Windows\System\BxyANwT.exe
  2⤵
  PID:5724
- C:\Windows\System\YBnOvcf.exe
  C:\Windows\System\YBnOvcf.exe
  2⤵
  PID:4564
- C:\Windows\System\oORntHc.exe
  C:\Windows\System\oORntHc.exe
  2⤵
  PID:5828
- C:\Windows\System\DYLgfYa.exe
  C:\Windows\System\DYLgfYa.exe
  2⤵
  PID:5916
- C:\Windows\System\eWuvMnU.exe
  C:\Windows\System\eWuvMnU.exe
  2⤵
  PID:3008
- C:\Windows\System\gakXZuj.exe
  C:\Windows\System\gakXZuj.exe
  2⤵
  PID:3696
- C:\Windows\System\ELfqeuU.exe
  C:\Windows\System\ELfqeuU.exe
  2⤵
  PID:6088
- C:\Windows\System\AonEfBl.exe
  C:\Windows\System\AonEfBl.exe
  2⤵
  PID:1752
- C:\Windows\System\VtgbPBm.exe
  C:\Windows\System\VtgbPBm.exe
  2⤵
  PID:5084
- C:\Windows\System\MaNMZts.exe
  C:\Windows\System\MaNMZts.exe
  2⤵
  PID:4676
- C:\Windows\System\sRFQFbx.exe
  C:\Windows\System\sRFQFbx.exe
  2⤵
  PID:5360
- C:\Windows\System\MWAYsdd.exe
  C:\Windows\System\MWAYsdd.exe
  2⤵
  PID:5612
- C:\Windows\System\BLwOxcZ.exe
  C:\Windows\System\BLwOxcZ.exe
  2⤵
  PID:5812
- C:\Windows\System\vbMFGkx.exe
  C:\Windows\System\vbMFGkx.exe
  2⤵
  PID:548
- C:\Windows\System\IyZmbBj.exe
  C:\Windows\System\IyZmbBj.exe
  2⤵
  PID:1332
- C:\Windows\System\moEGnOI.exe
  C:\Windows\System\moEGnOI.exe
  2⤵
  PID:5492
- C:\Windows\System\UQQSgHs.exe
  C:\Windows\System\UQQSgHs.exe
  2⤵
  PID:60
- C:\Windows\System\rWmlobl.exe
  C:\Windows\System\rWmlobl.exe
  2⤵
  PID:3640
- C:\Windows\System\jWiEBcZ.exe
  C:\Windows\System\jWiEBcZ.exe
  2⤵
  PID:6152
- C:\Windows\System\GjMrxhN.exe
  C:\Windows\System\GjMrxhN.exe
  2⤵
  PID:6172
- C:\Windows\System\wUOFZvT.exe
  C:\Windows\System\wUOFZvT.exe
  2⤵
  PID:6204
- C:\Windows\System\dqoNXie.exe
  C:\Windows\System\dqoNXie.exe
  2⤵
  PID:6240
- C:\Windows\System\fZOxYwO.exe
  C:\Windows\System\fZOxYwO.exe
  2⤵
  PID:6260
- C:\Windows\System\TfkOZUt.exe
  C:\Windows\System\TfkOZUt.exe
  2⤵
  PID:6284
- C:\Windows\System\xvYfsHj.exe
  C:\Windows\System\xvYfsHj.exe
  2⤵
  PID:6304
- C:\Windows\System\fbOSSBe.exe
  C:\Windows\System\fbOSSBe.exe
  2⤵
  PID:6340
- C:\Windows\System\rexUYlT.exe
  C:\Windows\System\rexUYlT.exe
  2⤵
  PID:6360
- C:\Windows\System\JDsarmi.exe
  C:\Windows\System\JDsarmi.exe
  2⤵
  PID:6384
- C:\Windows\System\uPsenrj.exe
  C:\Windows\System\uPsenrj.exe
  2⤵
  PID:6416
- C:\Windows\System\COdhywh.exe
  C:\Windows\System\COdhywh.exe
  2⤵
  PID:6440
- C:\Windows\System\KHnNYRl.exe
  C:\Windows\System\KHnNYRl.exe
  2⤵
  PID:6480
- C:\Windows\System\UdHNQNT.exe
  C:\Windows\System\UdHNQNT.exe
  2⤵
  PID:6524
- C:\Windows\System\vgaMvgZ.exe
  C:\Windows\System\vgaMvgZ.exe
  2⤵
  PID:6576
- C:\Windows\System\IRXGmNu.exe
  C:\Windows\System\IRXGmNu.exe
  2⤵
  PID:6600
- C:\Windows\System\XShWEFb.exe
  C:\Windows\System\XShWEFb.exe
  2⤵
  PID:6620
- C:\Windows\System\LMUwSFd.exe
  C:\Windows\System\LMUwSFd.exe
  2⤵
  PID:6648
- C:\Windows\System\JqSvjed.exe
  C:\Windows\System\JqSvjed.exe
  2⤵
  PID:6676
- C:\Windows\System\njPGbnW.exe
  C:\Windows\System\njPGbnW.exe
  2⤵
  PID:6692
- C:\Windows\System\UFAonLW.exe
  C:\Windows\System\UFAonLW.exe
  2⤵
  PID:6716
- C:\Windows\System\ShmAkZm.exe
  C:\Windows\System\ShmAkZm.exe
  2⤵
  PID:6736
- C:\Windows\System\AFgsyXn.exe
  C:\Windows\System\AFgsyXn.exe
  2⤵
  PID:6760
- C:\Windows\System\ZtfeagQ.exe
  C:\Windows\System\ZtfeagQ.exe
  2⤵
  PID:6776
- C:\Windows\System\cIxyVqI.exe
  C:\Windows\System\cIxyVqI.exe
  2⤵
  PID:6864
- C:\Windows\System\hiCUaCF.exe
  C:\Windows\System\hiCUaCF.exe
  2⤵
  PID:6884
- C:\Windows\System\czvlxMI.exe
  C:\Windows\System\czvlxMI.exe
  2⤵
  PID:6908
- C:\Windows\System\LRkhgkS.exe
  C:\Windows\System\LRkhgkS.exe
  2⤵
  PID:6928
- C:\Windows\System\CrGTchc.exe
  C:\Windows\System\CrGTchc.exe
  2⤵
  PID:6956
- C:\Windows\System\ieCrZzW.exe
  C:\Windows\System\ieCrZzW.exe
  2⤵
  PID:6980
- C:\Windows\System\XePppzp.exe
  C:\Windows\System\XePppzp.exe
  2⤵
  PID:7000
- C:\Windows\System\qvtgEFj.exe
  C:\Windows\System\qvtgEFj.exe
  2⤵
  PID:7060
- C:\Windows\System\ColUQtw.exe
  C:\Windows\System\ColUQtw.exe
  2⤵
  PID:7092
- C:\Windows\System\jsdcelj.exe
  C:\Windows\System\jsdcelj.exe
  2⤵
  PID:7112
- C:\Windows\System\SkRoRwY.exe
  C:\Windows\System\SkRoRwY.exe
  2⤵
  PID:7156
- C:\Windows\System\pqmTkHU.exe
  C:\Windows\System\pqmTkHU.exe
  2⤵
  PID:752
- C:\Windows\System\PGNDAJB.exe
  C:\Windows\System\PGNDAJB.exe
  2⤵
  PID:6180
- C:\Windows\System\LCuueyq.exe
  C:\Windows\System\LCuueyq.exe
  2⤵
  PID:6220
- C:\Windows\System\iqAOPJh.exe
  C:\Windows\System\iqAOPJh.exe
  2⤵
  PID:6256
- C:\Windows\System\fsTRlEV.exe
  C:\Windows\System\fsTRlEV.exe
  2⤵
  PID:6296
- C:\Windows\System\tdRubli.exe
  C:\Windows\System\tdRubli.exe
  2⤵
  PID:6352
- C:\Windows\System\nqJRboJ.exe
  C:\Windows\System\nqJRboJ.exe
  2⤵
  PID:6492
- C:\Windows\System\TFZAcuJ.exe
  C:\Windows\System\TFZAcuJ.exe
  2⤵
  PID:6588
- C:\Windows\System\tHHLpdH.exe
  C:\Windows\System\tHHLpdH.exe
  2⤵
  PID:6616
- C:\Windows\System\LrkajZR.exe
  C:\Windows\System\LrkajZR.exe
  2⤵
  PID:6684
- C:\Windows\System\bYxVdIp.exe
  C:\Windows\System\bYxVdIp.exe
  2⤵
  PID:6756
- C:\Windows\System\YFPUqqD.exe
  C:\Windows\System\YFPUqqD.exe
  2⤵
  PID:6744
- C:\Windows\System\nTqMICx.exe
  C:\Windows\System\nTqMICx.exe
  2⤵
  PID:6860
- C:\Windows\System\QStEuuO.exe
  C:\Windows\System\QStEuuO.exe
  2⤵
  PID:6892
- C:\Windows\System\YxvyJIO.exe
  C:\Windows\System\YxvyJIO.exe
  2⤵
  PID:3180
- C:\Windows\System\pBrXjjB.exe
  C:\Windows\System\pBrXjjB.exe
  2⤵
  PID:6996
- C:\Windows\System\QPpAjxs.exe
  C:\Windows\System\QPpAjxs.exe
  2⤵
  PID:7084
- C:\Windows\System\VppUjgs.exe
  C:\Windows\System\VppUjgs.exe
  2⤵
  PID:7128
- C:\Windows\System\YZucstQ.exe
  C:\Windows\System\YZucstQ.exe
  2⤵
  PID:1416
- C:\Windows\System\mQrdkss.exe
  C:\Windows\System\mQrdkss.exe
  2⤵
  PID:6276
- C:\Windows\System\xixbOpg.exe
  C:\Windows\System\xixbOpg.exe
  2⤵
  PID:6508
- C:\Windows\System\UkSudho.exe
  C:\Windows\System\UkSudho.exe
  2⤵
  PID:6520
- C:\Windows\System\qbVdFLi.exe
  C:\Windows\System\qbVdFLi.exe
  2⤵
  PID:6644
- C:\Windows\System\GpCfqpr.exe
  C:\Windows\System\GpCfqpr.exe
  2⤵
  PID:3520
- C:\Windows\System\GThsFrW.exe
  C:\Windows\System\GThsFrW.exe
  2⤵
  PID:1496
- C:\Windows\System\kWsGVCZ.exe
  C:\Windows\System\kWsGVCZ.exe
  2⤵
  PID:6972
- C:\Windows\System\PtTJjnU.exe
  C:\Windows\System\PtTJjnU.exe
  2⤵
  PID:3328
- C:\Windows\System\DsxfAwN.exe
  C:\Windows\System\DsxfAwN.exe
  2⤵
  PID:2208
- C:\Windows\System\WjGSBxw.exe
  C:\Windows\System\WjGSBxw.exe
  2⤵
  PID:6632
- C:\Windows\System\enevXaF.exe
  C:\Windows\System\enevXaF.exe
  2⤵
  PID:3336
- C:\Windows\System\nZRePAS.exe
  C:\Windows\System\nZRePAS.exe
  2⤵
  PID:7100
- C:\Windows\System\SlkYYEx.exe
  C:\Windows\System\SlkYYEx.exe
  2⤵
  PID:6540
- C:\Windows\System\EHpPAcn.exe
  C:\Windows\System\EHpPAcn.exe
  2⤵
  PID:6712
- C:\Windows\System\CGEVMHT.exe
  C:\Windows\System\CGEVMHT.exe
  2⤵
  PID:7200
- C:\Windows\System\ZdLnIrd.exe
  C:\Windows\System\ZdLnIrd.exe
  2⤵
  PID:7228
- C:\Windows\System\YmqXzzF.exe
  C:\Windows\System\YmqXzzF.exe
  2⤵
  PID:7256
- C:\Windows\System\dSgJpTj.exe
  C:\Windows\System\dSgJpTj.exe
  2⤵
  PID:7280
- C:\Windows\System\gDbIVzl.exe
  C:\Windows\System\gDbIVzl.exe
  2⤵
  PID:7296
- C:\Windows\System\aRJfTjc.exe
  C:\Windows\System\aRJfTjc.exe
  2⤵
  PID:7340
- C:\Windows\System\GHmcPMh.exe
  C:\Windows\System\GHmcPMh.exe
  2⤵
  PID:7376
- C:\Windows\System\RSbYhXb.exe
  C:\Windows\System\RSbYhXb.exe
  2⤵
  PID:7400
- C:\Windows\System\dfQYzUp.exe
  C:\Windows\System\dfQYzUp.exe
  2⤵
  PID:7420
- C:\Windows\System\KXEhahi.exe
  C:\Windows\System\KXEhahi.exe
  2⤵
  PID:7444
- C:\Windows\System\WKByYUM.exe
  C:\Windows\System\WKByYUM.exe
  2⤵
  PID:7488
- C:\Windows\System\EThPIjn.exe
  C:\Windows\System\EThPIjn.exe
  2⤵
  PID:7512
- C:\Windows\System\kfArUpm.exe
  C:\Windows\System\kfArUpm.exe
  2⤵
  PID:7544
- C:\Windows\System\uVEediB.exe
  C:\Windows\System\uVEediB.exe
  2⤵
  PID:7588
- C:\Windows\System\YEBnkzm.exe
  C:\Windows\System\YEBnkzm.exe
  2⤵
  PID:7604
- C:\Windows\System\KJyuplZ.exe
  C:\Windows\System\KJyuplZ.exe
  2⤵
  PID:7628
- C:\Windows\System\ILZhxVG.exe
  C:\Windows\System\ILZhxVG.exe
  2⤵
  PID:7668
- C:\Windows\System\wQOlnuA.exe
  C:\Windows\System\wQOlnuA.exe
  2⤵
  PID:7700
- C:\Windows\System\TgnCsTO.exe
  C:\Windows\System\TgnCsTO.exe
  2⤵
  PID:7720
- C:\Windows\System\BZkHmiZ.exe
  C:\Windows\System\BZkHmiZ.exe
  2⤵
  PID:7740
- C:\Windows\System\HZnCeIK.exe
  C:\Windows\System\HZnCeIK.exe
  2⤵
  PID:7788
- C:\Windows\System\HKJjvfJ.exe
  C:\Windows\System\HKJjvfJ.exe
  2⤵
  PID:7812
- C:\Windows\System\AGKHGPs.exe
  C:\Windows\System\AGKHGPs.exe
  2⤵
  PID:7840
- C:\Windows\System\HolAWRD.exe
  C:\Windows\System\HolAWRD.exe
  2⤵
  PID:7860
- C:\Windows\System\MYDwZdM.exe
  C:\Windows\System\MYDwZdM.exe
  2⤵
  PID:7880
- C:\Windows\System\LuAKToi.exe
  C:\Windows\System\LuAKToi.exe
  2⤵
  PID:7924
- C:\Windows\System\ttRklqI.exe
  C:\Windows\System\ttRklqI.exe
  2⤵
  PID:7944
- C:\Windows\System\FPosOHO.exe
  C:\Windows\System\FPosOHO.exe
  2⤵
  PID:7968
- C:\Windows\System\nllXYEs.exe
  C:\Windows\System\nllXYEs.exe
  2⤵
  PID:7996
- C:\Windows\System\hWxHuhp.exe
  C:\Windows\System\hWxHuhp.exe
  2⤵
  PID:8044
- C:\Windows\System\sIZLqNu.exe
  C:\Windows\System\sIZLqNu.exe
  2⤵
  PID:8068
- C:\Windows\System\jhBgdIP.exe
  C:\Windows\System\jhBgdIP.exe
  2⤵
  PID:8096
- C:\Windows\System\qiKLFYC.exe
  C:\Windows\System\qiKLFYC.exe
  2⤵
  PID:8116
- C:\Windows\System\LlilsEr.exe
  C:\Windows\System\LlilsEr.exe
  2⤵
  PID:8156
- C:\Windows\System\ekSzkRo.exe
  C:\Windows\System\ekSzkRo.exe
  2⤵
  PID:8180
- C:\Windows\System\IEqCKEg.exe
  C:\Windows\System\IEqCKEg.exe
  2⤵
  PID:7180
- C:\Windows\System\BZVNVnv.exe
  C:\Windows\System\BZVNVnv.exe
  2⤵
  PID:7220
- C:\Windows\System\LqkMEHS.exe
  C:\Windows\System\LqkMEHS.exe
  2⤵
  PID:7248
- C:\Windows\System\CuEYPFp.exe
  C:\Windows\System\CuEYPFp.exe
  2⤵
  PID:7324
- C:\Windows\System\NzQoDdq.exe
  C:\Windows\System\NzQoDdq.exe
  2⤵
  PID:7432
- C:\Windows\System\lAuzVuv.exe
  C:\Windows\System\lAuzVuv.exe
  2⤵
  PID:7500
- C:\Windows\System\ZJtxAok.exe
  C:\Windows\System\ZJtxAok.exe
  2⤵
  PID:7564
- C:\Windows\System\jlEibaV.exe
  C:\Windows\System\jlEibaV.exe
  2⤵
  PID:7640
- C:\Windows\System\LcPFnYa.exe
  C:\Windows\System\LcPFnYa.exe
  2⤵
  PID:7712
- C:\Windows\System\aXcXRam.exe
  C:\Windows\System\aXcXRam.exe
  2⤵
  PID:7752
- C:\Windows\System\cqCRTBz.exe
  C:\Windows\System\cqCRTBz.exe
  2⤵
  PID:7848
- C:\Windows\System\wGdXuQB.exe
  C:\Windows\System\wGdXuQB.exe
  2⤵
  PID:7900
- C:\Windows\System\qTibxHO.exe
  C:\Windows\System\qTibxHO.exe
  2⤵
  PID:6476
- C:\Windows\System\aWMJiOk.exe
  C:\Windows\System\aWMJiOk.exe
  2⤵
  PID:8016
- C:\Windows\System\YYOOPtA.exe
  C:\Windows\System\YYOOPtA.exe
  2⤵
  PID:8104
- C:\Windows\System\icqItIZ.exe
  C:\Windows\System\icqItIZ.exe
  2⤵
  PID:8132
- C:\Windows\System\QHQZOZi.exe
  C:\Windows\System\QHQZOZi.exe
  2⤵
  PID:7288
- C:\Windows\System\vjCYmlS.exe
  C:\Windows\System\vjCYmlS.exe
  2⤵
  PID:7384
- C:\Windows\System\jNuqivR.exe
  C:\Windows\System\jNuqivR.exe
  2⤵
  PID:7520
- C:\Windows\System\ZaGONmi.exe
  C:\Windows\System\ZaGONmi.exe
  2⤵
  PID:7664
- C:\Windows\System\TyJElZQ.exe
  C:\Windows\System\TyJElZQ.exe
  2⤵
  PID:7800
- C:\Windows\System\IZaFqMv.exe
  C:\Windows\System\IZaFqMv.exe
  2⤵
  PID:7856
- C:\Windows\System\JlcMhYg.exe
  C:\Windows\System\JlcMhYg.exe
  2⤵
  PID:8004
- C:\Windows\System\cglFUqz.exe
  C:\Windows\System\cglFUqz.exe
  2⤵
  PID:8112
- C:\Windows\System\FyXaggO.exe
  C:\Windows\System\FyXaggO.exe
  2⤵
  PID:7212
- C:\Windows\System\gxaSCua.exe
  C:\Windows\System\gxaSCua.exe
  2⤵
  PID:7732
- C:\Windows\System\CPFOxNM.exe
  C:\Windows\System\CPFOxNM.exe
  2⤵
  PID:7316
- C:\Windows\System\pVrPyei.exe
  C:\Windows\System\pVrPyei.exe
  2⤵
  PID:8188
- C:\Windows\System\RkuuWEF.exe
  C:\Windows\System\RkuuWEF.exe
  2⤵
  PID:8212
- C:\Windows\System\blEtzur.exe
  C:\Windows\System\blEtzur.exe
  2⤵
  PID:8244
- C:\Windows\System\DSbXOTp.exe
  C:\Windows\System\DSbXOTp.exe
  2⤵
  PID:8308
- C:\Windows\System\NpECOFJ.exe
  C:\Windows\System\NpECOFJ.exe
  2⤵
  PID:8340
- C:\Windows\System\LDXLJtr.exe
  C:\Windows\System\LDXLJtr.exe
  2⤵
  PID:8364
- C:\Windows\System\ftBBkEw.exe
  C:\Windows\System\ftBBkEw.exe
  2⤵
  PID:8384
- C:\Windows\System\dfKBbZn.exe
  C:\Windows\System\dfKBbZn.exe
  2⤵
  PID:8408
- C:\Windows\System\mFJxxhI.exe
  C:\Windows\System\mFJxxhI.exe
  2⤵
  PID:8432
- C:\Windows\System\mnollwP.exe
  C:\Windows\System\mnollwP.exe
  2⤵
  PID:8456
- C:\Windows\System\ydvDEHU.exe
  C:\Windows\System\ydvDEHU.exe
  2⤵
  PID:8484
- C:\Windows\System\lfPRehR.exe
  C:\Windows\System\lfPRehR.exe
  2⤵
  PID:8508
- C:\Windows\System\EtcOCXU.exe
  C:\Windows\System\EtcOCXU.exe
  2⤵
  PID:8532
- C:\Windows\System\xapotZN.exe
  C:\Windows\System\xapotZN.exe
  2⤵
  PID:8568
- C:\Windows\System\PQbiRXm.exe
  C:\Windows\System\PQbiRXm.exe
  2⤵
  PID:8588
- C:\Windows\System\viTuudj.exe
  C:\Windows\System\viTuudj.exe
  2⤵
  PID:8632
- C:\Windows\System\sEfKkXb.exe
  C:\Windows\System\sEfKkXb.exe
  2⤵
  PID:8660
- C:\Windows\System\QMoTXKe.exe
  C:\Windows\System\QMoTXKe.exe
  2⤵
  PID:8760
- C:\Windows\System\lvTmZDB.exe
  C:\Windows\System\lvTmZDB.exe
  2⤵
  PID:8788
- C:\Windows\System\zoDmaMl.exe
  C:\Windows\System\zoDmaMl.exe
  2⤵
  PID:8860
- C:\Windows\System\cohmEEv.exe
  C:\Windows\System\cohmEEv.exe
  2⤵
  PID:8880
- C:\Windows\System\qMvveoR.exe
  C:\Windows\System\qMvveoR.exe
  2⤵
  PID:8948
- C:\Windows\System\qGCMjzO.exe
  C:\Windows\System\qGCMjzO.exe
  2⤵
  PID:9000
- C:\Windows\System\LCUXZye.exe
  C:\Windows\System\LCUXZye.exe
  2⤵
  PID:9020
- C:\Windows\System\NkngsWI.exe
  C:\Windows\System\NkngsWI.exe
  2⤵
  PID:9040
- C:\Windows\System\qsNwsDu.exe
  C:\Windows\System\qsNwsDu.exe
  2⤵
  PID:9072
- C:\Windows\System\TEhkxsn.exe
  C:\Windows\System\TEhkxsn.exe
  2⤵
  PID:9104
- C:\Windows\System\VwzcKle.exe
  C:\Windows\System\VwzcKle.exe
  2⤵
  PID:9120
- C:\Windows\System\pDgByEJ.exe
  C:\Windows\System\pDgByEJ.exe
  2⤵
  PID:9140
- C:\Windows\System\lRMLmGk.exe
  C:\Windows\System\lRMLmGk.exe
  2⤵
  PID:9160
- C:\Windows\System\aPpAAxS.exe
  C:\Windows\System\aPpAAxS.exe
  2⤵
  PID:9212
- C:\Windows\System\KsFMzYg.exe
  C:\Windows\System\KsFMzYg.exe
  2⤵
  PID:7620
- C:\Windows\System\rbDRJaz.exe
  C:\Windows\System\rbDRJaz.exe
  2⤵
  PID:8240
- C:\Windows\System\XrPxnnt.exe
  C:\Windows\System\XrPxnnt.exe
  2⤵
  PID:8328
- C:\Windows\System\bodylfG.exe
  C:\Windows\System\bodylfG.exe
  2⤵
  PID:8420
- C:\Windows\System\Effzpxp.exe
  C:\Windows\System\Effzpxp.exe
  2⤵
  PID:8472
- C:\Windows\System\RLfaNtI.exe
  C:\Windows\System\RLfaNtI.exe
  2⤵
  PID:8560
- C:\Windows\System\YKrhKcC.exe
  C:\Windows\System\YKrhKcC.exe
  2⤵
  PID:8640
- C:\Windows\System\AEhhIiZ.exe
  C:\Windows\System\AEhhIiZ.exe
  2⤵
  PID:8624
- C:\Windows\System\iezJRFY.exe
  C:\Windows\System\iezJRFY.exe
  2⤵
  PID:8716
- C:\Windows\System\cZojRYB.exe
  C:\Windows\System\cZojRYB.exe
  2⤵
  PID:8756
- C:\Windows\System\gkltBPe.exe
  C:\Windows\System\gkltBPe.exe
  2⤵
  PID:8776
- C:\Windows\System\kLKPxMc.exe
  C:\Windows\System\kLKPxMc.exe
  2⤵
  PID:8712
- C:\Windows\System\ZoHwVUT.exe
  C:\Windows\System\ZoHwVUT.exe
  2⤵
  PID:8836
- C:\Windows\System\gJwAJww.exe
  C:\Windows\System\gJwAJww.exe
  2⤵
  PID:8888
- C:\Windows\System\QWyhmlr.exe
  C:\Windows\System\QWyhmlr.exe
  2⤵
  PID:8972
- C:\Windows\System\jUGWEND.exe
  C:\Windows\System\jUGWEND.exe
  2⤵
  PID:5752
- C:\Windows\System\iYZJShR.exe
  C:\Windows\System\iYZJShR.exe
  2⤵
  PID:9016
- C:\Windows\System\kNeGTIe.exe
  C:\Windows\System\kNeGTIe.exe
  2⤵
  PID:9032
- C:\Windows\System\YAOzEiG.exe
  C:\Windows\System\YAOzEiG.exe
  2⤵
  PID:9092
- C:\Windows\System\fhJVEMD.exe
  C:\Windows\System\fhJVEMD.exe
  2⤵
  PID:9152
- C:\Windows\System\tuZYosX.exe
  C:\Windows\System\tuZYosX.exe
  2⤵
  PID:7708
- C:\Windows\System\JcRgWXi.exe
  C:\Windows\System\JcRgWXi.exe
  2⤵
  PID:8316
- C:\Windows\System\jLrDFxN.exe
  C:\Windows\System\jLrDFxN.exe
  2⤵
  PID:8416
- C:\Windows\System\EKWAIMA.exe
  C:\Windows\System\EKWAIMA.exe
  2⤵
  PID:8500
- C:\Windows\System\HbbZkVd.exe
  C:\Windows\System\HbbZkVd.exe
  2⤵
  PID:8584
- C:\Windows\System\QZAUbbc.exe
  C:\Windows\System\QZAUbbc.exe
  2⤵
  PID:8876
- C:\Windows\System\oZFERkI.exe
  C:\Windows\System\oZFERkI.exe
  2⤵
  PID:8916
- C:\Windows\System\VadvFZI.exe
  C:\Windows\System\VadvFZI.exe
  2⤵
  PID:748
- C:\Windows\System\vmGiiVr.exe
  C:\Windows\System\vmGiiVr.exe
  2⤵
  PID:9056
- C:\Windows\System\AptMNXO.exe
  C:\Windows\System\AptMNXO.exe
  2⤵
  PID:9172
- C:\Windows\System\tveRijY.exe
  C:\Windows\System\tveRijY.exe
  2⤵
  PID:8196
- C:\Windows\System\pbGnZAp.exe
  C:\Windows\System\pbGnZAp.exe
  2⤵
  PID:8452
- C:\Windows\System\ptZjAtE.exe
  C:\Windows\System\ptZjAtE.exe
  2⤵
  PID:8964
- C:\Windows\System\grvAvPU.exe
  C:\Windows\System\grvAvPU.exe
  2⤵
  PID:8872
- C:\Windows\System\RgSqsSF.exe
  C:\Windows\System\RgSqsSF.exe
  2⤵
  PID:8580
- C:\Windows\System\PnuTQlv.exe
  C:\Windows\System\PnuTQlv.exe
  2⤵
  PID:9236
- C:\Windows\System\SdlnWDI.exe
  C:\Windows\System\SdlnWDI.exe
  2⤵
  PID:9256
- C:\Windows\System\STplCNC.exe
  C:\Windows\System\STplCNC.exe
  2⤵
  PID:9280
- C:\Windows\System\rewYNXw.exe
  C:\Windows\System\rewYNXw.exe
  2⤵
  PID:9304
- C:\Windows\System\ZuvbKzi.exe
  C:\Windows\System\ZuvbKzi.exe
  2⤵
  PID:9320
- C:\Windows\System\YtCspmo.exe
  C:\Windows\System\YtCspmo.exe
  2⤵
  PID:9352
- C:\Windows\System\oaGliKW.exe
  C:\Windows\System\oaGliKW.exe
  2⤵
  PID:9372
- C:\Windows\System\CvlDybA.exe
  C:\Windows\System\CvlDybA.exe
  2⤵
  PID:9404
- C:\Windows\System\LirlEPX.exe
  C:\Windows\System\LirlEPX.exe
  2⤵
  PID:9424
- C:\Windows\System\kooHdxb.exe
  C:\Windows\System\kooHdxb.exe
  2⤵
  PID:9496
- C:\Windows\System\gzCgcxm.exe
  C:\Windows\System\gzCgcxm.exe
  2⤵
  PID:9560
- C:\Windows\System\VIvIlWG.exe
  C:\Windows\System\VIvIlWG.exe
  2⤵
  PID:9580
- C:\Windows\System\NRKCmqt.exe
  C:\Windows\System\NRKCmqt.exe
  2⤵
  PID:9628
- C:\Windows\System\ibRWbGi.exe
  C:\Windows\System\ibRWbGi.exe
  2⤵
  PID:9648
- C:\Windows\System\pyGtavH.exe
  C:\Windows\System\pyGtavH.exe
  2⤵
  PID:9664
- C:\Windows\System\BDvGXRF.exe
  C:\Windows\System\BDvGXRF.exe
  2⤵
  PID:9688
- C:\Windows\System\XgLtJdE.exe
  C:\Windows\System\XgLtJdE.exe
  2⤵
  PID:9728
- C:\Windows\System\LKClXae.exe
  C:\Windows\System\LKClXae.exe
  2⤵
  PID:9744
- C:\Windows\System\EHAyIgC.exe
  C:\Windows\System\EHAyIgC.exe
  2⤵
  PID:9764
- C:\Windows\System\jsQRseJ.exe
  C:\Windows\System\jsQRseJ.exe
  2⤵
  PID:9788
- C:\Windows\System\GDPKxwQ.exe
  C:\Windows\System\GDPKxwQ.exe
  2⤵
  PID:9832
- C:\Windows\System\OSaAgDu.exe
  C:\Windows\System\OSaAgDu.exe
  2⤵
  PID:9872
- C:\Windows\System\ywNIKVY.exe
  C:\Windows\System\ywNIKVY.exe
  2⤵
  PID:9892
- C:\Windows\System\AfptSca.exe
  C:\Windows\System\AfptSca.exe
  2⤵
  PID:9920
- C:\Windows\System\aWxwgLK.exe
  C:\Windows\System\aWxwgLK.exe
  2⤵
  PID:9944
- C:\Windows\System\MVklFaN.exe
  C:\Windows\System\MVklFaN.exe
  2⤵
  PID:9972
- C:\Windows\System\IeKqjPn.exe
  C:\Windows\System\IeKqjPn.exe
  2⤵
  PID:9996
- C:\Windows\System\RNCmKda.exe
  C:\Windows\System\RNCmKda.exe
  2⤵
  PID:10020
- C:\Windows\System\sBAReAq.exe
  C:\Windows\System\sBAReAq.exe
  2⤵
  PID:10036
- C:\Windows\System\GSgWksF.exe
  C:\Windows\System\GSgWksF.exe
  2⤵
  PID:10064
- C:\Windows\System\vwTejkY.exe
  C:\Windows\System\vwTejkY.exe
  2⤵
  PID:10088
- C:\Windows\System\LyZcVog.exe
  C:\Windows\System\LyZcVog.exe
  2⤵
  PID:10108
- C:\Windows\System\INVMAGW.exe
  C:\Windows\System\INVMAGW.exe
  2⤵
  PID:10128
- C:\Windows\System\GjVIJnq.exe
  C:\Windows\System\GjVIJnq.exe
  2⤵
  PID:10148
- C:\Windows\System\DCdavCq.exe
  C:\Windows\System\DCdavCq.exe
  2⤵
  PID:10200
- C:\Windows\System\qiNMhss.exe
  C:\Windows\System\qiNMhss.exe
  2⤵
  PID:10220
- C:\Windows\System\NTwhTIe.exe
  C:\Windows\System\NTwhTIe.exe
  2⤵
  PID:7624
- C:\Windows\System\bCZGnAE.exe
  C:\Windows\System\bCZGnAE.exe
  2⤵
  PID:8684
- C:\Windows\System\weSYxXB.exe
  C:\Windows\System\weSYxXB.exe
  2⤵
  PID:9128
- C:\Windows\System\VYyAonU.exe
  C:\Windows\System\VYyAonU.exe
  2⤵
  PID:9368
- C:\Windows\System\ThbbVhB.exe
  C:\Windows\System\ThbbVhB.exe
  2⤵
  PID:9348
- C:\Windows\System\UheKZEl.exe
  C:\Windows\System\UheKZEl.exe
  2⤵
  PID:9532
- C:\Windows\System\IOQALkJ.exe
  C:\Windows\System\IOQALkJ.exe
  2⤵
  PID:9552
- C:\Windows\System\ZnfQvjE.exe
  C:\Windows\System\ZnfQvjE.exe
  2⤵
  PID:9616
- C:\Windows\System\jZtvniK.exe
  C:\Windows\System\jZtvniK.exe
  2⤵
  PID:9720
- C:\Windows\System\Dtsadjy.exe
  C:\Windows\System\Dtsadjy.exe
  2⤵
  PID:9800
- C:\Windows\System\pbcoGVW.exe
  C:\Windows\System\pbcoGVW.exe
  2⤵
  PID:984
- C:\Windows\System\oVqwbgH.exe
  C:\Windows\System\oVqwbgH.exe
  2⤵
  PID:9964
- C:\Windows\System\NSQEUGp.exe
  C:\Windows\System\NSQEUGp.exe
  2⤵
  PID:10028
- C:\Windows\System\nFgUYIa.exe
  C:\Windows\System\nFgUYIa.exe
  2⤵
  PID:10104
- C:\Windows\System\qjzRMkO.exe
  C:\Windows\System\qjzRMkO.exe
  2⤵
  PID:10076
- C:\Windows\System\CIhPrNX.exe
  C:\Windows\System\CIhPrNX.exe
  2⤵
  PID:10228
- C:\Windows\System\YZRhvYx.exe
  C:\Windows\System\YZRhvYx.exe
  2⤵
  PID:8424
- C:\Windows\System\RdLZfho.exe
  C:\Windows\System\RdLZfho.exe
  2⤵
  PID:8924
- C:\Windows\System\XZXmAcx.exe
  C:\Windows\System\XZXmAcx.exe
  2⤵
  PID:9292
- C:\Windows\System\DFMiKqp.exe
  C:\Windows\System\DFMiKqp.exe
  2⤵
  PID:9600
- C:\Windows\System\nECAzzR.exe
  C:\Windows\System\nECAzzR.exe
  2⤵
  PID:9844
- C:\Windows\System\OVazqiu.exe
  C:\Windows\System\OVazqiu.exe
  2⤵
  PID:10120
- C:\Windows\System\qVhIPuY.exe
  C:\Windows\System\qVhIPuY.exe
  2⤵
  PID:10140
- C:\Windows\System\xCvzyCO.exe
  C:\Windows\System\xCvzyCO.exe
  2⤵
  PID:9464
- C:\Windows\System\ARRdYZR.exe
  C:\Windows\System\ARRdYZR.exe
  2⤵
  PID:9576
- C:\Windows\System\BngVknO.exe
  C:\Windows\System\BngVknO.exe
  2⤵
  PID:9940
- C:\Windows\System\seWxqZg.exe
  C:\Windows\System\seWxqZg.exe
  2⤵
  PID:10168
- C:\Windows\System\YRNXqWT.exe
  C:\Windows\System\YRNXqWT.exe
  2⤵
  PID:9736
- C:\Windows\System\FmlRplD.exe
  C:\Windows\System\FmlRplD.exe
  2⤵
  PID:10260
- C:\Windows\System\amUBdba.exe
  C:\Windows\System\amUBdba.exe
  2⤵
  PID:10300
- C:\Windows\System\leyZGvs.exe
  C:\Windows\System\leyZGvs.exe
  2⤵
  PID:10320
- C:\Windows\System\mPHwzhM.exe
  C:\Windows\System\mPHwzhM.exe
  2⤵
  PID:10348
- C:\Windows\System\arBnebV.exe
  C:\Windows\System\arBnebV.exe
  2⤵
  PID:10364
- C:\Windows\System\cPykPYz.exe
  C:\Windows\System\cPykPYz.exe
  2⤵
  PID:10388
- C:\Windows\System\RcBgNzr.exe
  C:\Windows\System\RcBgNzr.exe
  2⤵
  PID:10416
- C:\Windows\System\xkRXLcK.exe
  C:\Windows\System\xkRXLcK.exe
  2⤵
  PID:10468
- C:\Windows\System\pAymzue.exe
  C:\Windows\System\pAymzue.exe
  2⤵
  PID:10520
- C:\Windows\System\FlSdaBF.exe
  C:\Windows\System\FlSdaBF.exe
  2⤵
  PID:10540
- C:\Windows\System\bSoSyUK.exe
  C:\Windows\System\bSoSyUK.exe
  2⤵
  PID:10568
- C:\Windows\System\TgCKzgi.exe
  C:\Windows\System\TgCKzgi.exe
  2⤵
  PID:10612
- C:\Windows\System\WGwUQkw.exe
  C:\Windows\System\WGwUQkw.exe
  2⤵
  PID:10632
- C:\Windows\System\dBQoVVL.exe
  C:\Windows\System\dBQoVVL.exe
  2⤵
  PID:10660
- C:\Windows\System\CODazEq.exe
  C:\Windows\System\CODazEq.exe
  2⤵
  PID:10680
- C:\Windows\System\omotXFJ.exe
  C:\Windows\System\omotXFJ.exe
  2⤵
  PID:10696
- C:\Windows\System\agNwyLD.exe
  C:\Windows\System\agNwyLD.exe
  2⤵
  PID:10720
- C:\Windows\System\vLzLqUH.exe
  C:\Windows\System\vLzLqUH.exe
  2⤵
  PID:10740
- C:\Windows\System\KbGYUGS.exe
  C:\Windows\System\KbGYUGS.exe
  2⤵
  PID:10764
- C:\Windows\System\ZTqzBgd.exe
  C:\Windows\System\ZTqzBgd.exe
  2⤵
  PID:10784
- C:\Windows\System\extKgfr.exe
  C:\Windows\System\extKgfr.exe
  2⤵
  PID:10836
- C:\Windows\System\bOgnzyb.exe
  C:\Windows\System\bOgnzyb.exe
  2⤵
  PID:10880
- C:\Windows\System\sdJfKMA.exe
  C:\Windows\System\sdJfKMA.exe
  2⤵
  PID:10900
- C:\Windows\System\APMLiTw.exe
  C:\Windows\System\APMLiTw.exe
  2⤵
  PID:10924
- C:\Windows\System\iyvbpnx.exe
  C:\Windows\System\iyvbpnx.exe
  2⤵
  PID:10956
- C:\Windows\System\fwTOiLY.exe
  C:\Windows\System\fwTOiLY.exe
  2⤵
  PID:10980
- C:\Windows\System\OEfQFJb.exe
  C:\Windows\System\OEfQFJb.exe
  2⤵
  PID:11004
- C:\Windows\System\qLKjHEI.exe
  C:\Windows\System\qLKjHEI.exe
  2⤵
  PID:11044
- C:\Windows\System\QDjHwOT.exe
  C:\Windows\System\QDjHwOT.exe
  2⤵
  PID:11064
- C:\Windows\System\gRolSrn.exe
  C:\Windows\System\gRolSrn.exe
  2⤵
  PID:11084
- C:\Windows\System\zGYqIud.exe
  C:\Windows\System\zGYqIud.exe
  2⤵
  PID:11112
- C:\Windows\System\htjIoUc.exe
  C:\Windows\System\htjIoUc.exe
  2⤵
  PID:11132
- C:\Windows\System\mjjuuZZ.exe
  C:\Windows\System\mjjuuZZ.exe
  2⤵
  PID:11180
- C:\Windows\System\IZxQTlu.exe
  C:\Windows\System\IZxQTlu.exe
  2⤵
  PID:11200
- C:\Windows\System\zsNfOhJ.exe
  C:\Windows\System\zsNfOhJ.exe
  2⤵
  PID:11220
- C:\Windows\System\AFstfAW.exe
  C:\Windows\System\AFstfAW.exe
  2⤵
  PID:11256
- C:\Windows\System\VygHbkv.exe
  C:\Windows\System\VygHbkv.exe
  2⤵
  PID:10244
- C:\Windows\System\zmDhReF.exe
  C:\Windows\System\zmDhReF.exe
  2⤵
  PID:10344
- C:\Windows\System\gGidLPo.exe
  C:\Windows\System\gGidLPo.exe
  2⤵
  PID:10384
- C:\Windows\System\RNGEvFD.exe
  C:\Windows\System\RNGEvFD.exe
  2⤵
  PID:10444
- C:\Windows\System\vwitfPq.exe
  C:\Windows\System\vwitfPq.exe
  2⤵
  PID:10488
- C:\Windows\System\pUDLsRi.exe
  C:\Windows\System\pUDLsRi.exe
  2⤵
  PID:10536
- C:\Windows\System\CTYdaXQ.exe
  C:\Windows\System\CTYdaXQ.exe
  2⤵
  PID:10644
- C:\Windows\System\zWdumNV.exe
  C:\Windows\System\zWdumNV.exe
  2⤵
  PID:10760
- C:\Windows\System\RDLhPBP.exe
  C:\Windows\System\RDLhPBP.exe
  2⤵
  PID:10716
- C:\Windows\System\XuykeQb.exe
  C:\Windows\System\XuykeQb.exe
  2⤵
  PID:10780
- C:\Windows\System\CWbRRNZ.exe
  C:\Windows\System\CWbRRNZ.exe
  2⤵
  PID:10860
- C:\Windows\System\iyBKswe.exe
  C:\Windows\System\iyBKswe.exe
  2⤵
  PID:10896
- C:\Windows\System\EllarFY.exe
  C:\Windows\System\EllarFY.exe
  2⤵
  PID:11024
- C:\Windows\System\hnOIfMM.exe
  C:\Windows\System\hnOIfMM.exe
  2⤵
  PID:11096
- C:\Windows\System\SzJXrmX.exe
  C:\Windows\System\SzJXrmX.exe
  2⤵
  PID:11228
- C:\Windows\System\mUAGjNV.exe
  C:\Windows\System\mUAGjNV.exe
  2⤵
  PID:11248
- C:\Windows\System\PVlDuiT.exe
  C:\Windows\System\PVlDuiT.exe
  2⤵
  PID:10288
- C:\Windows\System\ewvyCzf.exe
  C:\Windows\System\ewvyCzf.exe
  2⤵
  PID:10456
- C:\Windows\System\vcEvzyP.exe
  C:\Windows\System\vcEvzyP.exe
  2⤵
  PID:10624
- C:\Windows\System\EpYZwuc.exe
  C:\Windows\System\EpYZwuc.exe
  2⤵
  PID:10728
- C:\Windows\System\dVwULcq.exe
  C:\Windows\System\dVwULcq.exe
  2⤵
  PID:10732
- C:\Windows\System\azDjoIp.exe
  C:\Windows\System\azDjoIp.exe
  2⤵
  PID:11040
- C:\Windows\System\nSVplWL.exe
  C:\Windows\System\nSVplWL.exe
  2⤵
  PID:11128
- C:\Windows\System\OAuQdlz.exe
  C:\Windows\System\OAuQdlz.exe
  2⤵
  PID:10500
- C:\Windows\System\yUUItTv.exe
  C:\Windows\System\yUUItTv.exe
  2⤵
  PID:10892
- C:\Windows\System\ViztwGx.exe
  C:\Windows\System\ViztwGx.exe
  2⤵
  PID:10736
- C:\Windows\System\ZwZpcmZ.exe
  C:\Windows\System\ZwZpcmZ.exe
  2⤵
  PID:10380
- C:\Windows\System\ZalGONP.exe
  C:\Windows\System\ZalGONP.exe
  2⤵
  PID:11268
- C:\Windows\System\voKWPQK.exe
  C:\Windows\System\voKWPQK.exe
  2⤵
  PID:11288
- C:\Windows\System\PFRfjvB.exe
  C:\Windows\System\PFRfjvB.exe
  2⤵
  PID:11308
- C:\Windows\System\OlvPfjV.exe
  C:\Windows\System\OlvPfjV.exe
  2⤵
  PID:11344
- C:\Windows\System\zrAfkTv.exe
  C:\Windows\System\zrAfkTv.exe
  2⤵
  PID:11368
- C:\Windows\System\RVqXGaZ.exe
  C:\Windows\System\RVqXGaZ.exe
  2⤵
  PID:11404
- C:\Windows\System\wZydlJT.exe
  C:\Windows\System\wZydlJT.exe
  2⤵
  PID:11444
- C:\Windows\System\MEVPnts.exe
  C:\Windows\System\MEVPnts.exe
  2⤵
  PID:11464
- C:\Windows\System\GVhDkHf.exe
  C:\Windows\System\GVhDkHf.exe
  2⤵
  PID:11504
- C:\Windows\System\LtFOMWV.exe
  C:\Windows\System\LtFOMWV.exe
  2⤵
  PID:11524
- C:\Windows\System\RDCKmum.exe
  C:\Windows\System\RDCKmum.exe
  2⤵
  PID:11556
- C:\Windows\System\YsFZmZz.exe
  C:\Windows\System\YsFZmZz.exe
  2⤵
  PID:11576
- C:\Windows\System\FGjMQCX.exe
  C:\Windows\System\FGjMQCX.exe
  2⤵
  PID:11596
- C:\Windows\System\ifVWmQy.exe
  C:\Windows\System\ifVWmQy.exe
  2⤵
  PID:11624
- C:\Windows\System\qeKqPrC.exe
  C:\Windows\System\qeKqPrC.exe
  2⤵
  PID:11644
- C:\Windows\System\PlNfnVe.exe
  C:\Windows\System\PlNfnVe.exe
  2⤵
  PID:11660
- C:\Windows\System\GZJKHUH.exe
  C:\Windows\System\GZJKHUH.exe
  2⤵
  PID:11716
- C:\Windows\System\pycarml.exe
  C:\Windows\System\pycarml.exe
  2⤵
  PID:11744
- C:\Windows\System\HWZUIan.exe
  C:\Windows\System\HWZUIan.exe
  2⤵
  PID:11764
- C:\Windows\System\ULHrGeY.exe
  C:\Windows\System\ULHrGeY.exe
  2⤵
  PID:11788
- C:\Windows\System\rMOAMLN.exe
  C:\Windows\System\rMOAMLN.exe
  2⤵
  PID:11812
- C:\Windows\System\YipKXNY.exe
  C:\Windows\System\YipKXNY.exe
  2⤵
  PID:11836
- C:\Windows\System\EuOWGLB.exe
  C:\Windows\System\EuOWGLB.exe
  2⤵
  PID:11856
- C:\Windows\System\KdjRxMn.exe
  C:\Windows\System\KdjRxMn.exe
  2⤵
  PID:11908
- C:\Windows\System\jjrPpQo.exe
  C:\Windows\System\jjrPpQo.exe
  2⤵
  PID:11932
- C:\Windows\System\OcORVXf.exe
  C:\Windows\System\OcORVXf.exe
  2⤵
  PID:11956
- C:\Windows\System\joThyIO.exe
  C:\Windows\System\joThyIO.exe
  2⤵
  PID:11972
- C:\Windows\System\azdAINR.exe
  C:\Windows\System\azdAINR.exe
  2⤵
  PID:12000
- C:\Windows\System\fsvwEDZ.exe
  C:\Windows\System\fsvwEDZ.exe
  2⤵
  PID:12016
- C:\Windows\System\reWrbJG.exe
  C:\Windows\System\reWrbJG.exe
  2⤵
  PID:12060
- C:\Windows\System\sniZZsT.exe
  C:\Windows\System\sniZZsT.exe
  2⤵
  PID:12084
- C:\Windows\System\gzzCfft.exe
  C:\Windows\System\gzzCfft.exe
  2⤵
  PID:12128
- C:\Windows\System\VEEZYdG.exe
  C:\Windows\System\VEEZYdG.exe
  2⤵
  PID:12180
- C:\Windows\System\AojuSJA.exe
  C:\Windows\System\AojuSJA.exe
  2⤵
  PID:12208
- C:\Windows\System\aqnbkfm.exe
  C:\Windows\System\aqnbkfm.exe
  2⤵
  PID:12236
- C:\Windows\System\KLWtSyL.exe
  C:\Windows\System\KLWtSyL.exe
  2⤵
  PID:12272
- C:\Windows\System\DhNKnNT.exe
  C:\Windows\System\DhNKnNT.exe
  2⤵
  PID:11276
- C:\Windows\System\gOWKUKL.exe
  C:\Windows\System\gOWKUKL.exe
  2⤵
  PID:11376
- C:\Windows\System\ubABEyE.exe
  C:\Windows\System\ubABEyE.exe
  2⤵
  PID:11384
- C:\Windows\System\lXTRVeL.exe
  C:\Windows\System\lXTRVeL.exe
  2⤵
  PID:11456
- C:\Windows\System\IyWEnah.exe
  C:\Windows\System\IyWEnah.exe
  2⤵
  PID:11620
- C:\Windows\System\USjLnFa.exe
  C:\Windows\System\USjLnFa.exe
  2⤵
  PID:11636
- C:\Windows\System\WRWwmhs.exe
  C:\Windows\System\WRWwmhs.exe
  2⤵
  PID:11724
- C:\Windows\System\vvvLGno.exe
  C:\Windows\System\vvvLGno.exe
  2⤵
  PID:11760
- C:\Windows\System\KzckArB.exe
  C:\Windows\System\KzckArB.exe
  2⤵
  PID:11820
- C:\Windows\System\JIMUAax.exe
  C:\Windows\System\JIMUAax.exe
  2⤵
  PID:11824
- C:\Windows\System\lQrbSOD.exe
  C:\Windows\System\lQrbSOD.exe
  2⤵
  PID:11920
- C:\Windows\System\MXQpmeg.exe
  C:\Windows\System\MXQpmeg.exe
  2⤵
  PID:12008
- C:\Windows\System\XXkBNar.exe
  C:\Windows\System\XXkBNar.exe
  2⤵
  PID:12072
- C:\Windows\System\YWfHdjC.exe
  C:\Windows\System\YWfHdjC.exe
  2⤵
  PID:12120
- C:\Windows\System\YPxzZoS.exe
  C:\Windows\System\YPxzZoS.exe
  2⤵
  PID:12200
- C:\Windows\System\obWLjfJ.exe
  C:\Windows\System\obWLjfJ.exe
  2⤵
  PID:12264
- C:\Windows\System\LugRZtq.exe
  C:\Windows\System\LugRZtq.exe
  2⤵
  PID:12284
- C:\Windows\System\ExnTBvP.exe
  C:\Windows\System\ExnTBvP.exe
  2⤵
  PID:11304
- C:\Windows\System\temQXzB.exe
  C:\Windows\System\temQXzB.exe
  2⤵
  PID:2272
- C:\Windows\System\IVmTZrg.exe
  C:\Windows\System\IVmTZrg.exe
  2⤵
  PID:11592
- C:\Windows\System\UVShKwB.exe
  C:\Windows\System\UVShKwB.exe
  2⤵
  PID:11604
- C:\Windows\System\rloIjGS.exe
  C:\Windows\System\rloIjGS.exe
  2⤵
  PID:11848
- C:\Windows\System\KrCmKtT.exe
  C:\Windows\System\KrCmKtT.exe
  2⤵
  PID:11988
- C:\Windows\System\GjYjsdX.exe
  C:\Windows\System\GjYjsdX.exe
  2⤵
  PID:3460
- C:\Windows\System\UHqYngI.exe
  C:\Windows\System\UHqYngI.exe
  2⤵
  PID:3204
- C:\Windows\System\mOeQCcD.exe
  C:\Windows\System\mOeQCcD.exe
  2⤵
  PID:11300
- C:\Windows\System\jcWNRsC.exe
  C:\Windows\System\jcWNRsC.exe
  2⤵
  PID:3196
- C:\Windows\System\OITkVAx.exe
  C:\Windows\System\OITkVAx.exe
  2⤵
  PID:11756
- C:\Windows\System\drUBytU.exe
  C:\Windows\System\drUBytU.exe
  2⤵
  PID:2064
- C:\Windows\System\NXpGpUp.exe
  C:\Windows\System\NXpGpUp.exe
  2⤵
  PID:11400
- C:\Windows\System\sHHgbfL.exe
  C:\Windows\System\sHHgbfL.exe
  2⤵
  PID:1616
- C:\Windows\System\qUbpFmX.exe
  C:\Windows\System\qUbpFmX.exe
  2⤵
  PID:12352
- C:\Windows\System\cMiCftT.exe
  C:\Windows\System\cMiCftT.exe
  2⤵
  PID:12368
- C:\Windows\System\LuaRPrz.exe
  C:\Windows\System\LuaRPrz.exe
  2⤵
  PID:12388
- C:\Windows\System\qbxsMsJ.exe
  C:\Windows\System\qbxsMsJ.exe
  2⤵
  PID:12416
- C:\Windows\System\TTrZoWJ.exe
  C:\Windows\System\TTrZoWJ.exe
  2⤵
  PID:12436
- C:\Windows\System\KWFcLBh.exe
  C:\Windows\System\KWFcLBh.exe
  2⤵
  PID:12456
- C:\Windows\System\GHHVwuL.exe
  C:\Windows\System\GHHVwuL.exe
  2⤵
  PID:12472
- C:\Windows\System\TXUGlKP.exe
  C:\Windows\System\TXUGlKP.exe
  2⤵
  PID:12492
- C:\Windows\System\VXOGmRi.exe
  C:\Windows\System\VXOGmRi.exe
  2⤵
  PID:12512
- C:\Windows\System\EipdnxT.exe
  C:\Windows\System\EipdnxT.exe
  2⤵
  PID:12532
- C:\Windows\System\YdHZFKR.exe
  C:\Windows\System\YdHZFKR.exe
  2⤵
  PID:12556
- C:\Windows\System\ZsrCGKu.exe
  C:\Windows\System\ZsrCGKu.exe
  2⤵
  PID:12596
- C:\Windows\System\yJpflVF.exe
  C:\Windows\System\yJpflVF.exe
  2⤵
  PID:12632
- C:\Windows\System\GMacABO.exe
  C:\Windows\System\GMacABO.exe
  2⤵
  PID:12692
- C:\Windows\System\JHZKGQb.exe
  C:\Windows\System\JHZKGQb.exe
  2⤵
  PID:12712
- C:\Windows\System\wiBdFIr.exe
  C:\Windows\System\wiBdFIr.exe
  2⤵
  PID:12756
- C:\Windows\System\XrAfbkj.exe
  C:\Windows\System\XrAfbkj.exe
  2⤵
  PID:12800
- C:\Windows\System\arLpmdk.exe
  C:\Windows\System\arLpmdk.exe
  2⤵
  PID:12828
- C:\Windows\System\EYeETUf.exe
  C:\Windows\System\EYeETUf.exe
  2⤵
  PID:12848
- C:\Windows\System\qzDTXre.exe
  C:\Windows\System\qzDTXre.exe
  2⤵
  PID:12868
- C:\Windows\System\pTWDqDd.exe
  C:\Windows\System\pTWDqDd.exe
  2⤵
  PID:12888
- C:\Windows\System\FjyAmbq.exe
  C:\Windows\System\FjyAmbq.exe
  2⤵
  PID:12948
- C:\Windows\System\UEjCwHV.exe
  C:\Windows\System\UEjCwHV.exe
  2⤵
  PID:12980
- C:\Windows\System\DjpYAKI.exe
  C:\Windows\System\DjpYAKI.exe
  2⤵
  PID:12996
- C:\Windows\System\pSiNHvd.exe
  C:\Windows\System\pSiNHvd.exe
  2⤵
  PID:13020
- C:\Windows\System\RyyAfaC.exe
  C:\Windows\System\RyyAfaC.exe
  2⤵
  PID:13036
- C:\Windows\System\hQUkqLC.exe
  C:\Windows\System\hQUkqLC.exe
  2⤵
  PID:13092
- C:\Windows\System\wGdSEzZ.exe
  C:\Windows\System\wGdSEzZ.exe
  2⤵
  PID:13120
- C:\Windows\System\aOLMZpV.exe
  C:\Windows\System\aOLMZpV.exe
  2⤵
  PID:13144
- C:\Windows\System\YAlHgty.exe
  C:\Windows\System\YAlHgty.exe
  2⤵
  PID:13172
- C:\Windows\System\bmQmQMb.exe
  C:\Windows\System\bmQmQMb.exe
  2⤵
  PID:13204
- C:\Windows\System\eoKRrWa.exe
  C:\Windows\System\eoKRrWa.exe
  2⤵
  PID:13228
- C:\Windows\System\rTugCKF.exe
  C:\Windows\System\rTugCKF.exe
  2⤵
  PID:13256
- C:\Windows\System\OwIqFVA.exe
  C:\Windows\System\OwIqFVA.exe
  2⤵
  PID:13272
- C:\Windows\System\BSVWpWU.exe
  C:\Windows\System\BSVWpWU.exe
  2⤵
  PID:13300
- C:\Windows\System\TblejoZ.exe
  C:\Windows\System\TblejoZ.exe
  2⤵
  PID:11808
- C:\Windows\System\yvOhBGy.exe
  C:\Windows\System\yvOhBGy.exe
  2⤵
  PID:12428
- C:\Windows\System\ZLeGUob.exe
  C:\Windows\System\ZLeGUob.exe
  2⤵
  PID:12488
- C:\Windows\System\RJlUfiW.exe
  C:\Windows\System\RJlUfiW.exe
  2⤵
  PID:12444
- C:\Windows\System\kdLbeOt.exe
  C:\Windows\System\kdLbeOt.exe
  2⤵
  PID:12528
- C:\Windows\System\esKeqyi.exe
  C:\Windows\System\esKeqyi.exe
  2⤵
  PID:12628
- C:\Windows\System\FuuAFmk.exe
  C:\Windows\System\FuuAFmk.exe
  2⤵
  PID:12724
- C:\Windows\System\FJxsSBt.exe
  C:\Windows\System\FJxsSBt.exe
  2⤵
  PID:12824
- C:\Windows\System\quBzYSw.exe
  C:\Windows\System\quBzYSw.exe
  2⤵
  PID:12864
- C:\Windows\System\PrfwNfD.exe
  C:\Windows\System\PrfwNfD.exe
  2⤵
  PID:12900
- C:\Windows\System\zobFCyd.exe
  C:\Windows\System\zobFCyd.exe
  2⤵
  PID:12944
- C:\Windows\System\sduvhif.exe
  C:\Windows\System\sduvhif.exe
  2⤵
  PID:12968
- C:\Windows\System\QxSeBNw.exe
  C:\Windows\System\QxSeBNw.exe
  2⤵
  PID:4880
- C:\Windows\System\xrDPDzl.exe
  C:\Windows\System\xrDPDzl.exe
  2⤵
  PID:5072
- C:\Windows\System\lmvbPqX.exe
  C:\Windows\System\lmvbPqX.exe
  2⤵
  PID:5112
- C:\Windows\System\wsezGCg.exe
  C:\Windows\System\wsezGCg.exe
  2⤵
  PID:13076
- C:\Windows\System\DsFXHyk.exe
  C:\Windows\System\DsFXHyk.exe
  2⤵
  PID:13128
- C:\Windows\System\MoXfUnT.exe
  C:\Windows\System\MoXfUnT.exe
  2⤵
  PID:2964
- C:\Windows\System\JBVEQRJ.exe
  C:\Windows\System\JBVEQRJ.exe
  2⤵
  PID:1604
- C:\Windows\System\cKLTBzE.exe
  C:\Windows\System\cKLTBzE.exe
  2⤵
  PID:5944
- C:\Windows\System\ZzeGpta.exe
  C:\Windows\System\ZzeGpta.exe
  2⤵
  PID:4756
- C:\Windows\System\vYkXQWg.exe
  C:\Windows\System\vYkXQWg.exe
  2⤵
  PID:13004
- C:\Windows\System\QnKtLhq.exe
  C:\Windows\System\QnKtLhq.exe
  2⤵
  PID:13112
- C:\Windows\System\yZafMfm.exe
  C:\Windows\System\yZafMfm.exe
  2⤵
  PID:13268
- C:\Windows\System\KliADpU.exe
  C:\Windows\System\KliADpU.exe
  2⤵
  PID:13292
- C:\Windows\System\MZlXOMx.exe
  C:\Windows\System\MZlXOMx.exe
  2⤵
  PID:1596
- C:\Windows\System\NnblHYg.exe
  C:\Windows\System\NnblHYg.exe
  2⤵
  PID:11828
- C:\Windows\System\sFIskFS.exe
  C:\Windows\System\sFIskFS.exe
  2⤵
  PID:12688
- C:\Windows\System\EHBPzuq.exe
  C:\Windows\System\EHBPzuq.exe
  2⤵
  PID:2356
- C:\Windows\System\MJaoAQB.exe
  C:\Windows\System\MJaoAQB.exe
  2⤵
  PID:6028
- C:\Windows\System\CZAdZxw.exe
  C:\Windows\System\CZAdZxw.exe
  2⤵
  PID:13236
- C:\Windows\System\PvSyTLa.exe
  C:\Windows\System\PvSyTLa.exe
  2⤵
  PID:4740
- C:\Windows\System\uPQKwzq.exe
  C:\Windows\System\uPQKwzq.exe
  2⤵
  PID:12976
- C:\Windows\System\JrypmkZ.exe
  C:\Windows\System\JrypmkZ.exe
  2⤵
  PID:3584
- C:\Windows\System\OqJAzfB.exe
  C:\Windows\System\OqJAzfB.exe
  2⤵
  PID:12860
- C:\Windows\System\AAeEVTp.exe
  C:\Windows\System\AAeEVTp.exe
  2⤵
  PID:3652
- C:\Windows\System\BDCjMLg.exe
  C:\Windows\System\BDCjMLg.exe
  2⤵
  PID:4508
- C:\Windows\System\XuCgsLq.exe
  C:\Windows\System\XuCgsLq.exe
  2⤵
  PID:12960
- C:\Windows\System\aDfNOsm.exe
  C:\Windows\System\aDfNOsm.exe
  2⤵
  PID:13108
- C:\Windows\System\VeSzYum.exe
  C:\Windows\System\VeSzYum.exe
  2⤵
  PID:12280
- C:\Windows\System\XnvmJZj.exe
  C:\Windows\System\XnvmJZj.exe
  2⤵
  PID:628
- C:\Windows\System\mSCeyUb.exe
  C:\Windows\System\mSCeyUb.exe
  2⤵
  PID:3236
- C:\Windows\System\dPDtDvR.exe
  C:\Windows\System\dPDtDvR.exe
  2⤵
  PID:5912
- C:\Windows\System\kkRasBA.exe
  C:\Windows\System\kkRasBA.exe
  2⤵
  PID:944
- C:\Windows\System\GBUdeob.exe
  C:\Windows\System\GBUdeob.exe
  2⤵
  PID:5280
- C:\Windows\System\lzODgsy.exe
  C:\Windows\System\lzODgsy.exe
  2⤵
  PID:6664
- C:\Windows\System\vCMbShI.exe
  C:\Windows\System\vCMbShI.exe
  2⤵
  PID:6832
- C:\Windows\System\btfABNW.exe
  C:\Windows\System\btfABNW.exe
  2⤵
  PID:6424
- C:\Windows\System\gSekkTJ.exe
  C:\Windows\System\gSekkTJ.exe
  2⤵
  PID:6988
- C:\Windows\System\vPsnjKM.exe
  C:\Windows\System\vPsnjKM.exe
  2⤵
  PID:7020
- C:\Windows\System\DuLguHp.exe
  C:\Windows\System\DuLguHp.exe
  2⤵
  PID:6108
- C:\Windows\System\yGIlwOl.exe
  C:\Windows\System\yGIlwOl.exe
  2⤵
  PID:7616
- C:\Windows\System\dbodRff.exe
  C:\Windows\System\dbodRff.exe
  2⤵
  PID:7396
- C:\Windows\System\XpBDdBY.exe
  C:\Windows\System\XpBDdBY.exe
  2⤵
  PID:6612
- C:\Windows\System\ulyeRLZ.exe
  C:\Windows\System\ulyeRLZ.exe
  2⤵
  PID:7760
- C:\Windows\System\xgMuegi.exe
  C:\Windows\System\xgMuegi.exe
  2⤵
  PID:7152
- C:\Windows\System\wuugxgF.exe
  C:\Windows\System\wuugxgF.exe
  2⤵
  PID:3864
- C:\Windows\System\IQIwRyu.exe
  C:\Windows\System\IQIwRyu.exe
  2⤵
  PID:524
- C:\Windows\System\VlBMdjt.exe
  C:\Windows\System\VlBMdjt.exe
  2⤵
  PID:8220
- C:\Windows\System\afycxlH.exe
  C:\Windows\System\afycxlH.exe
  2⤵
  PID:8324
- C:\Windows\System\RuSfsuj.exe
  C:\Windows\System\RuSfsuj.exe
  2⤵
  PID:7836
- C:\Windows\System\tyLilYT.exe
  C:\Windows\System\tyLilYT.exe
  2⤵
  PID:7896
- C:\Windows\System\hTQhJmo.exe
  C:\Windows\System\hTQhJmo.exe
  2⤵
  PID:7868
- C:\Windows\System\EMuHKNV.exe
  C:\Windows\System\EMuHKNV.exe
  2⤵
  PID:8564
- C:\Windows\System\tChcKUE.exe
  C:\Windows\System\tChcKUE.exe
  2⤵
  PID:8612
- C:\Windows\System\mgAjELf.exe
  C:\Windows\System\mgAjELf.exe
  2⤵
  PID:7584
- C:\Windows\System\IyNksgN.exe
  C:\Windows\System\IyNksgN.exe
  2⤵
  PID:6828
- C:\Windows\System\mctHcjr.exe
  C:\Windows\System\mctHcjr.exe
  2⤵
  PID:7540
- C:\Windows\System\mLUDsVD.exe
  C:\Windows\System\mLUDsVD.exe
  2⤵
  PID:4896
- C:\Windows\System\pajZIUY.exe
  C:\Windows\System\pajZIUY.exe
  2⤵
  PID:6004
- C:\Windows\System\sXnDnwI.exe
  C:\Windows\System\sXnDnwI.exe
  2⤵
  PID:2660
- C:\Windows\System\OIqLyBe.exe
  C:\Windows\System\OIqLyBe.exe
  2⤵
  PID:4232
- C:\Windows\System\xoxUOYM.exe
  C:\Windows\System\xoxUOYM.exe
  2⤵
  PID:7872
- C:\Windows\System\EbUUyPU.exe
  C:\Windows\System\EbUUyPU.exe
  2⤵
  PID:6348
- C:\Windows\System\jhLDElf.exe
  C:\Windows\System\jhLDElf.exe
  2⤵
  PID:6592
- C:\Windows\System\BlUYDLE.exe
  C:\Windows\System\BlUYDLE.exe
  2⤵
  PID:8944
- C:\Windows\System\dpDbZDU.exe
  C:\Windows\System\dpDbZDU.exe
  2⤵
  PID:1952
- C:\Windows\System\VuLSuSL.exe
  C:\Windows\System\VuLSuSL.exe
  2⤵
  PID:9184
- C:\Windows\System\TNTSTWB.exe
  C:\Windows\System\TNTSTWB.exe
  2⤵
  PID:8468
- C:\Windows\System\fiiEeON.exe
  C:\Windows\System\fiiEeON.exe
  2⤵
  PID:6896
- C:\Windows\System\hcEnghO.exe
  C:\Windows\System\hcEnghO.exe
  2⤵
  PID:8028
- C:\Windows\System\qaZtqMD.exe
  C:\Windows\System\qaZtqMD.exe
  2⤵
  PID:8480
- C:\Windows\System\qWSumAr.exe
  C:\Windows\System\qWSumAr.exe
  2⤵
  PID:8520
- C:\Windows\System\JjguDRA.exe
  C:\Windows\System\JjguDRA.exe
  2⤵
  PID:3124
- C:\Windows\System\ElJZbmo.exe
  C:\Windows\System\ElJZbmo.exe
  2⤵
  PID:7460
- C:\Windows\System\crILvoI.exe
  C:\Windows\System\crILvoI.exe
  2⤵
  PID:676
- C:\Windows\System\uxWSQek.exe
  C:\Windows\System\uxWSQek.exe
  2⤵
  PID:8740
- C:\Windows\System\nZAWOHr.exe
  C:\Windows\System\nZAWOHr.exe
  2⤵
  PID:7984
- C:\Windows\System\ZLDmMON.exe
  C:\Windows\System\ZLDmMON.exe
  2⤵
  PID:5972
- C:\Windows\System\khmXUHf.exe
  C:\Windows\System\khmXUHf.exe
  2⤵
  PID:4816
- C:\Windows\System\UVWcFHZ.exe
  C:\Windows\System\UVWcFHZ.exe
  2⤵
  PID:2484
- C:\Windows\System\iPeSHsD.exe
  C:\Windows\System\iPeSHsD.exe
  2⤵
  PID:8060
- C:\Windows\System\zJbXtfH.exe
  C:\Windows\System\zJbXtfH.exe
  2⤵
  PID:3248
- C:\Windows\System\BdZUHbE.exe
  C:\Windows\System\BdZUHbE.exe
  2⤵
  PID:8148
- C:\Windows\System\HGXbQFb.exe
  C:\Windows\System\HGXbQFb.exe
  2⤵
  PID:8272
- C:\Windows\System\EBVSCWC.exe
  C:\Windows\System\EBVSCWC.exe
  2⤵
  PID:9200
- C:\Windows\System\gVfYOVh.exe
  C:\Windows\System\gVfYOVh.exe
  2⤵
  PID:8356
- C:\Windows\System\pHUFbbO.exe
  C:\Windows\System\pHUFbbO.exe
  2⤵
  PID:2436
- C:\Windows\System\XtUBWEk.exe
  C:\Windows\System\XtUBWEk.exe
  2⤵
  PID:8668
- C:\Windows\System\nyaVNmQ.exe
  C:\Windows\System\nyaVNmQ.exe
  2⤵
  PID:1632
- C:\Windows\System\FNBGgLI.exe
  C:\Windows\System\FNBGgLI.exe
  2⤵
  PID:7276
- C:\Windows\System\wYmGvmz.exe
  C:\Windows\System\wYmGvmz.exe
  2⤵
  PID:2600
- C:\Windows\System\sQJBaVI.exe
  C:\Windows\System\sQJBaVI.exe
  2⤵
  PID:12544
- C:\Windows\System\nEzMcEF.exe
  C:\Windows\System\nEzMcEF.exe
  2⤵
  PID:3596
- C:\Windows\System\RDaQTOa.exe
  C:\Windows\System\RDaQTOa.exe
  2⤵
  PID:4008
- C:\Windows\System\pAyJdjJ.exe
  C:\Windows\System\pAyJdjJ.exe
  2⤵
  PID:8020
- C:\Windows\System\aSPuzay.exe
  C:\Windows\System\aSPuzay.exe
  2⤵
  PID:8988
- C:\Windows\System\wsJdDTg.exe
  C:\Windows\System\wsJdDTg.exe
  2⤵
  PID:5048
- C:\Windows\System\JfDSoCe.exe
  C:\Windows\System\JfDSoCe.exe
  2⤵
  PID:10052
- C:\Windows\System\LIMmBkh.exe
  C:\Windows\System\LIMmBkh.exe
  2⤵
  PID:10116
- C:\Windows\System\ENFedqp.exe
  C:\Windows\System\ENFedqp.exe
  2⤵
  PID:788
- C:\Windows\System\uawYLzV.exe
  C:\Windows\System\uawYLzV.exe
  2⤵
  PID:5196
- C:\Windows\System\peYsinY.exe
  C:\Windows\System\peYsinY.exe
  2⤵
  PID:828
- C:\Windows\System\ggaQplg.exe
  C:\Windows\System\ggaQplg.exe
  2⤵
  PID:10308
- C:\Windows\System\zlfrRZY.exe
  C:\Windows\System\zlfrRZY.exe
  2⤵
  PID:4720
- C:\Windows\System\hXGFSGl.exe
  C:\Windows\System\hXGFSGl.exe
  2⤵
  PID:9840
- C:\Windows\System\loJYhIQ.exe
  C:\Windows\System\loJYhIQ.exe
  2⤵
  PID:4156
- C:\Windows\System\ogWBztd.exe
  C:\Windows\System\ogWBztd.exe
  2⤵
  PID:8296
- C:\Windows\System\wMIqdtH.exe
  C:\Windows\System\wMIqdtH.exe
  2⤵
  PID:8428
- C:\Windows\System\UmODzTW.exe
  C:\Windows\System\UmODzTW.exe
  2⤵
  PID:10436
- C:\Windows\System\zlXArRG.exe
  C:\Windows\System\zlXArRG.exe
  2⤵
  PID:6400
- C:\Windows\System\JgQcDKQ.exe
  C:\Windows\System\JgQcDKQ.exe
  2⤵
  PID:9116
- C:\Windows\System\cZxmWGS.exe
  C:\Windows\System\cZxmWGS.exe
  2⤵
  PID:8540
- C:\Windows\System\xzOiFWF.exe
  C:\Windows\System\xzOiFWF.exe
  2⤵
  PID:5392
- C:\Windows\System\kLiLGCl.exe
  C:\Windows\System\kLiLGCl.exe
  2⤵
  PID:5516
- C:\Windows\System\UkpZPAS.exe
  C:\Windows\System\UkpZPAS.exe
  2⤵
  PID:5628
- C:\Windows\System\mVPMZiA.exe
  C:\Windows\System\mVPMZiA.exe
  2⤵
  PID:10276
- C:\Windows\System\puViSrk.exe
  C:\Windows\System\puViSrk.exe
  2⤵
  PID:10356
- C:\Windows\System\vHrhdPj.exe
  C:\Windows\System\vHrhdPj.exe
  2⤵
  PID:5824
- C:\Windows\System\MayBKQg.exe
  C:\Windows\System\MayBKQg.exe
  2⤵
  PID:11172
- C:\Windows\System\sZcScys.exe
  C:\Windows\System\sZcScys.exe
  2⤵
  PID:10876
- C:\Windows\System\PzgBfLO.exe
  C:\Windows\System\PzgBfLO.exe
  2⤵
  PID:1264
- C:\Windows\System\qEybxTt.exe
  C:\Windows\System\qEybxTt.exe
  2⤵
  PID:5432
- C:\Windows\System\eEGBadA.exe
  C:\Windows\System\eEGBadA.exe
  2⤵
  PID:6488
- C:\Windows\System\aZNdxeS.exe
  C:\Windows\System\aZNdxeS.exe
  2⤵
  PID:11316
- C:\Windows\System\GtLBSru.exe
  C:\Windows\System\GtLBSru.exe
  2⤵
  PID:6092
- C:\Windows\System\vUKFpkJ.exe
  C:\Windows\System\vUKFpkJ.exe
  2⤵
  PID:5560
- C:\Windows\System\DeXTiMh.exe
  C:\Windows\System\DeXTiMh.exe
  2⤵
  PID:9112
- C:\Windows\System\ZTtTsWp.exe
  C:\Windows\System\ZTtTsWp.exe
  2⤵
  PID:4164
- C:\Windows\System\dsvuhgd.exe
  C:\Windows\System\dsvuhgd.exe
  2⤵
  PID:11472
- C:\Windows\System\YMWwcLk.exe
  C:\Windows\System\YMWwcLk.exe
  2⤵
  PID:5488
- C:\Windows\System\hvTsOQH.exe
  C:\Windows\System\hvTsOQH.exe
  2⤵
  PID:2092
- C:\Windows\System\NiEKEsZ.exe
  C:\Windows\System\NiEKEsZ.exe
  2⤵
  PID:5740
- C:\Windows\System\slJOOib.exe
  C:\Windows\System\slJOOib.exe
  2⤵
  PID:8052
- C:\Windows\System\IHfvXSi.exe
  C:\Windows\System\IHfvXSi.exe
  2⤵
  PID:9224
- C:\Windows\System\MoWecoo.exe
  C:\Windows\System\MoWecoo.exe
  2⤵
  PID:9568
- C:\Windows\System\FmJgDvt.exe
  C:\Windows\System\FmJgDvt.exe
  2⤵
  PID:5328
- C:\Windows\System\ZVrFqkP.exe
  C:\Windows\System\ZVrFqkP.exe
  2⤵
  PID:7796
- C:\Windows\System\JGAjCKD.exe
  C:\Windows\System\JGAjCKD.exe
  2⤵
  PID:12092
- C:\Windows\System\wXdRVPA.exe
  C:\Windows\System\wXdRVPA.exe
  2⤵
  PID:6504
- C:\Windows\System\mzdIxWD.exe
  C:\Windows\System\mzdIxWD.exe
  2⤵
  PID:10272
- C:\Windows\System\tvyzUie.exe
  C:\Windows\System\tvyzUie.exe
  2⤵
  PID:8576
- C:\Windows\System\RZtrYpq.exe
  C:\Windows\System\RZtrYpq.exe
  2⤵
  PID:10376
- C:\Windows\System\YcrhCwo.exe
  C:\Windows\System\YcrhCwo.exe
  2⤵
  PID:9932
- C:\Windows\System\AqmizBa.exe
  C:\Windows\System\AqmizBa.exe
  2⤵
  PID:11572
- C:\Windows\System\QbGIpJy.exe
  C:\Windows\System\QbGIpJy.exe
  2⤵
  PID:5292
- C:\Windows\System\MzlNLRc.exe
  C:\Windows\System\MzlNLRc.exe
  2⤵
  PID:10476
- C:\Windows\System\ZOKSkoI.exe
  C:\Windows\System\ZOKSkoI.exe
  2⤵
  PID:5888
- C:\Windows\System\aVMszbV.exe
  C:\Windows\System\aVMszbV.exe
  2⤵
  PID:11244
- C:\Windows\System\gOALvij.exe
  C:\Windows\System\gOALvij.exe
  2⤵
  PID:5784
- C:\Windows\System\ADavUpS.exe
  C:\Windows\System\ADavUpS.exe
  2⤵
  PID:10012
- C:\Windows\System\PbJNEwy.exe
  C:\Windows\System\PbJNEwy.exe
  2⤵
  PID:4048
- C:\Windows\System\NQBpcSH.exe
  C:\Windows\System\NQBpcSH.exe
  2⤵
  PID:5420
- C:\Windows\System\BPPlNfv.exe
  C:\Windows\System\BPPlNfv.exe
  2⤵
  PID:5220
- C:\Windows\System\SelHfRl.exe
  C:\Windows\System\SelHfRl.exe
  2⤵
  PID:5700
- C:\Windows\System\yMKJQHe.exe
  C:\Windows\System\yMKJQHe.exe
  2⤵
  PID:8360
- C:\Windows\System\RgMneym.exe
  C:\Windows\System\RgMneym.exe
  2⤵
  PID:11512
- C:\Windows\System\DfAwMpW.exe
  C:\Windows\System\DfAwMpW.exe
  2⤵
  PID:5504
- C:\Windows\System\JWcKGCc.exe
  C:\Windows\System\JWcKGCc.exe
  2⤵
  PID:2444
- C:\Windows\System\AkabKwf.exe
  C:\Windows\System\AkabKwf.exe
  2⤵
  PID:3612
- C:\Windows\System\XphXfvo.exe
  C:\Windows\System\XphXfvo.exe
  2⤵
  PID:12776
- C:\Windows\System\bAJdnfC.exe
  C:\Windows\System\bAJdnfC.exe
  2⤵
  PID:5168
- C:\Windows\System\EocFlnR.exe
  C:\Windows\System\EocFlnR.exe
  2⤵
  PID:5528
- C:\Windows\System\qJIODlV.exe
  C:\Windows\System\qJIODlV.exe
  2⤵
  PID:4824
- C:\Windows\System\OFEyvYc.exe
  C:\Windows\System\OFEyvYc.exe
  2⤵
  PID:6412
- C:\Windows\System\CqEbmVg.exe
  C:\Windows\System\CqEbmVg.exe
  2⤵
  PID:5224
- C:\Windows\System\FJXqHpi.exe
  C:\Windows\System\FJXqHpi.exe
  2⤵
  PID:13048
- C:\Windows\System\imPfSEy.exe
  C:\Windows\System\imPfSEy.exe
  2⤵
  PID:2872
- C:\Windows\System\IxqyKuI.exe
  C:\Windows\System\IxqyKuI.exe
  2⤵
  PID:8692
- C:\Windows\System\WAZpklx.exe
  C:\Windows\System\WAZpklx.exe
  2⤵
  PID:8940
- C:\Windows\System\MsekXnX.exe
  C:\Windows\System\MsekXnX.exe
  2⤵
  PID:13152
- C:\Windows\System\XTWQatg.exe
  C:\Windows\System\XTWQatg.exe
  2⤵
  PID:4540
- C:\Windows\System\LfKYtFQ.exe
  C:\Windows\System\LfKYtFQ.exe
  2⤵
  PID:5920
- C:\Windows\System\LjiceFW.exe
  C:\Windows\System\LjiceFW.exe
  2⤵
  PID:1528
- C:\Windows\System\BdLpEYj.exe
  C:\Windows\System\BdLpEYj.exe
  2⤵
  PID:13308
- C:\Windows\System\tSiOqPd.exe
  C:\Windows\System\tSiOqPd.exe
  2⤵
  PID:220
- C:\Windows\System\VjTcvnI.exe
  C:\Windows\System\VjTcvnI.exe
  2⤵
  PID:6560
- C:\Windows\System\pNCePVI.exe
  C:\Windows\System\pNCePVI.exe
  2⤵
  PID:12176
- C:\Windows\System\hIpceJK.exe
  C:\Windows\System\hIpceJK.exe
  2⤵
  PID:10944
- C:\Windows\System\spXYXZY.exe
  C:\Windows\System\spXYXZY.exe
  2⤵
  PID:5216
- C:\Windows\System\IqprTDP.exe
  C:\Windows\System\IqprTDP.exe
  2⤵
  PID:12424
- C:\Windows\System\dFxOerv.exe
  C:\Windows\System\dFxOerv.exe
  2⤵
  PID:5348
- C:\Windows\System\lxUNnIW.exe
  C:\Windows\System\lxUNnIW.exe
  2⤵
  PID:12584
- C:\Windows\System\GWArHGP.exe
  C:\Windows\System\GWArHGP.exe
  2⤵
  PID:12684
- C:\Windows\System\bYUbPNl.exe
  C:\Windows\System\bYUbPNl.exe
  2⤵
  PID:8012
- C:\Windows\System\yXQKHIf.exe
  C:\Windows\System\yXQKHIf.exe
  2⤵
  PID:11536
- C:\Windows\System\niEzWjG.exe
  C:\Windows\System\niEzWjG.exe
  2⤵
  PID:4404
- C:\Windows\System\nTKjbDI.exe
  C:\Windows\System\nTKjbDI.exe
  2⤵
  PID:4668
- C:\Windows\System\atfqays.exe
  C:\Windows\System\atfqays.exe
  2⤵
  PID:7008
- C:\Windows\System\bujHMzE.exe
  C:\Windows\System\bujHMzE.exe
  2⤵
  PID:3484
- C:\Windows\System\hiGmvRv.exe
  C:\Windows\System\hiGmvRv.exe
  2⤵
  PID:12116
- C:\Windows\System\bJgYOxp.exe
  C:\Windows\System\bJgYOxp.exe
  2⤵
  PID:13088
- C:\Windows\System\EJJUDXx.exe
  C:\Windows\System\EJJUDXx.exe
  2⤵
  PID:6248
- C:\Windows\System\ZxRnWli.exe
  C:\Windows\System\ZxRnWli.exe
  2⤵
  PID:6700
- C:\Windows\System\TeqJyKx.exe
  C:\Windows\System\TeqJyKx.exe
  2⤵
  PID:11420
- C:\Windows\System\SDMsoHi.exe
  C:\Windows\System\SDMsoHi.exe
  2⤵
  PID:6336
- C:\Windows\System\FwvhheG.exe
  C:\Windows\System\FwvhheG.exe
  2⤵
  PID:6572
- C:\Windows\System\fRCdJJE.exe
  C:\Windows\System\fRCdJJE.exe
  2⤵
  PID:12056
- C:\Windows\System\hzezdIV.exe
  C:\Windows\System\hzezdIV.exe
  2⤵
  PID:6880
- C:\Windows\System\ZTaaxwx.exe
  C:\Windows\System\ZTaaxwx.exe
  2⤵
  PID:6812
- C:\Windows\System\cvLJuWW.exe
  C:\Windows\System\cvLJuWW.exe
  2⤵
  PID:6916
- C:\Windows\System\IIiQCrL.exe
  C:\Windows\System\IIiQCrL.exe
  2⤵
  PID:5684
- C:\Windows\System\awRCjdX.exe
  C:\Windows\System\awRCjdX.exe
  2⤵
  PID:11416
- C:\Windows\System\kAJXphG.exe
  C:\Windows\System\kAJXphG.exe
  2⤵
  PID:7208
- C:\Windows\System\xLmDCgI.exe
  C:\Windows\System\xLmDCgI.exe
  2⤵
  PID:12788
- C:\Windows\System\axhOder.exe
  C:\Windows\System\axhOder.exe
  2⤵
  PID:11584
- C:\Windows\System\ekPguFa.exe
  C:\Windows\System\ekPguFa.exe
  2⤵
  PID:6848
- C:\Windows\System\KxpSsqq.exe
  C:\Windows\System\KxpSsqq.exe
  2⤵
  PID:7028
- C:\Windows\System\zPdcInC.exe
  C:\Windows\System\zPdcInC.exe
  2⤵
  PID:7472
- C:\Windows\System\gFMZfGc.exe
  C:\Windows\System\gFMZfGc.exe
  2⤵
  PID:7312
- C:\Windows\System\VkrHoiB.exe
  C:\Windows\System\VkrHoiB.exe
  2⤵
  PID:6196
- C:\Windows\System\RrFBtlt.exe
  C:\Windows\System\RrFBtlt.exe
  2⤵
  PID:6732
- C:\Windows\System\uMemdDK.exe
  C:\Windows\System\uMemdDK.exe
  2⤵
  PID:13192
- C:\Windows\System\jIVbHOY.exe
  C:\Windows\System\jIVbHOY.exe
  2⤵
  PID:12972
- C:\Windows\System\rPNVMpC.exe
  C:\Windows\System\rPNVMpC.exe
  2⤵
  PID:11168
- C:\Windows\System\iQZIDQY.exe
  C:\Windows\System\iQZIDQY.exe
  2⤵
  PID:2144
- C:\Windows\System\sVcUJTx.exe
  C:\Windows\System\sVcUJTx.exe
  2⤵
  PID:3188
- C:\Windows\System\iNHJISB.exe
  C:\Windows\System\iNHJISB.exe
  2⤵
  PID:10972
- C:\Windows\System\MPHfCsv.exe
  C:\Windows\System\MPHfCsv.exe
  2⤵
  PID:7912
- C:\Windows\System\fZGxncW.exe
  C:\Windows\System\fZGxncW.exe
  2⤵
  PID:5076
- C:\Windows\System\plseIcI.exe
  C:\Windows\System\plseIcI.exe
  2⤵
  PID:7252
- C:\Windows\System\tZklrIk.exe
  C:\Windows\System\tZklrIk.exe
  2⤵
  PID:12936
- C:\Windows\System\GwungrA.exe
  C:\Windows\System\GwungrA.exe
  2⤵
  PID:6904
- C:\Windows\System\yNceJcN.exe
  C:\Windows\System\yNceJcN.exe
  2⤵
  PID:4488
- C:\Windows\System\ZjTYDUe.exe
  C:\Windows\System\ZjTYDUe.exe
  2⤵
  PID:8
- C:\Windows\System\yaZghiz.exe
  C:\Windows\System\yaZghiz.exe
  2⤵
  PID:7480
- C:\Windows\System\qDrfTgN.exe
  C:\Windows\System\qDrfTgN.exe
  2⤵
  PID:3004
- C:\Windows\System\SUjygwW.exe
  C:\Windows\System\SUjygwW.exe
  2⤵
  PID:6184
- C:\Windows\System\jKYNvxi.exe
  C:\Windows\System\jKYNvxi.exe
  2⤵
  PID:7224
- C:\Windows\System\ruLPZoL.exe
  C:\Windows\System\ruLPZoL.exe
  2⤵
  PID:8056
- C:\Windows\System\YmKcXRF.exe
  C:\Windows\System\YmKcXRF.exe
  2⤵
  PID:6392
- C:\Windows\System\HOZRcCi.exe
  C:\Windows\System\HOZRcCi.exe
  2⤵
  PID:552
- C:\Windows\System\IgktXcg.exe
  C:\Windows\System\IgktXcg.exe
  2⤵
  PID:13320
- C:\Windows\System\beAnCor.exe
  C:\Windows\System\beAnCor.exe
  2⤵
  PID:13360
- C:\Windows\System\nMaeDQt.exe
  C:\Windows\System\nMaeDQt.exe
  2⤵
  PID:13392
- C:\Windows\System\TFtYcdX.exe
  C:\Windows\System\TFtYcdX.exe
  2⤵
  PID:13408
- C:\Windows\System\mDIdPZs.exe
  C:\Windows\System\mDIdPZs.exe
  2⤵
  PID:13432
- C:\Windows\System\AXkRhEE.exe
  C:\Windows\System\AXkRhEE.exe
  2⤵
  PID:13460
- C:\Windows\System\gnalCkl.exe
  C:\Windows\System\gnalCkl.exe
  2⤵
  PID:13484
- C:\Windows\System\FekKjwg.exe
  C:\Windows\System\FekKjwg.exe
  2⤵
  PID:13636
- C:\Windows\System\zXcSrGC.exe
  C:\Windows\System\zXcSrGC.exe
  2⤵
  PID:13696
- C:\Windows\System\dgrYqAZ.exe
  C:\Windows\System\dgrYqAZ.exe
  2⤵
  PID:13724
- C:\Windows\System\uuOXtkN.exe
  C:\Windows\System\uuOXtkN.exe
  2⤵
  PID:13768
- C:\Windows\System\jtbTgUf.exe
  C:\Windows\System\jtbTgUf.exe
  2⤵
  PID:13812
- C:\Windows\System\djAEHzV.exe
  C:\Windows\System\djAEHzV.exe
  2⤵
  PID:13836
- C:\Windows\System\XULTOLC.exe
  C:\Windows\System\XULTOLC.exe
  2⤵
  PID:13872
- C:\Windows\System\tXOxGja.exe
  C:\Windows\System\tXOxGja.exe
  2⤵
  PID:13904
- C:\Windows\System\BzucPIU.exe
  C:\Windows\System\BzucPIU.exe
  2⤵
  PID:13932
- C:\Windows\System\MPOICJv.exe
  C:\Windows\System\MPOICJv.exe
  2⤵
  PID:13960
- C:\Windows\System\xPkdwjm.exe
  C:\Windows\System\xPkdwjm.exe
  2⤵
  PID:13992
- C:\Windows\System\DduGERp.exe
  C:\Windows\System\DduGERp.exe
  2⤵
  PID:14020
- C:\Windows\System\shaszmY.exe
  C:\Windows\System\shaszmY.exe
  2⤵
  PID:14044
- C:\Windows\System\GfeqZGl.exe
  C:\Windows\System\GfeqZGl.exe
  2⤵
  PID:14076
- C:\Windows\System\FleiMsq.exe
  C:\Windows\System\FleiMsq.exe
  2⤵
  PID:14112
- C:\Windows\System\ZfwYNKQ.exe
  C:\Windows\System\ZfwYNKQ.exe
  2⤵
  PID:14316
- C:\Windows\System\TBSWzMX.exe
  C:\Windows\System\TBSWzMX.exe
  2⤵
  PID:7560
- C:\Windows\System\VijpXVZ.exe
  C:\Windows\System\VijpXVZ.exe
  2⤵
  PID:8892
- C:\Windows\System\ELIvAli.exe
  C:\Windows\System\ELIvAli.exe
  2⤵
  PID:2320
- C:\Windows\System\YpPHpop.exe
  C:\Windows\System\YpPHpop.exe
  2⤵
  PID:6976
- C:\Windows\System\NzsQNqd.exe
  C:\Windows\System\NzsQNqd.exe
  2⤵
  PID:7068
- C:\Windows\System\IQzaYba.exe
  C:\Windows\System\IQzaYba.exe
  2⤵
  PID:8688
- C:\Windows\System\nYaxkRt.exe
  C:\Windows\System\nYaxkRt.exe
  2⤵
  PID:13376
- C:\Windows\System\ZWTDvqs.exe
  C:\Windows\System\ZWTDvqs.exe
  2⤵
  PID:13388
- C:\Windows\System\qPmAAMh.exe
  C:\Windows\System\qPmAAMh.exe
  2⤵
  PID:8280
- C:\Windows\System\oTcigfb.exe
  C:\Windows\System\oTcigfb.exe
  2⤵
  PID:8204
- C:\Windows\System\CxCOkRG.exe
  C:\Windows\System\CxCOkRG.exe
  2⤵
  PID:13328
- C:\Windows\System\PQmbWae.exe
  C:\Windows\System\PQmbWae.exe
  2⤵
  PID:13584
- C:\Windows\System\dwWhpVC.exe
  C:\Windows\System\dwWhpVC.exe
  2⤵
  PID:13468
- C:\Windows\System\PzTlsJr.exe
  C:\Windows\System\PzTlsJr.exe
  2⤵
  PID:13720
- C:\Windows\System\ALOduPg.exe
  C:\Windows\System\ALOduPg.exe
  2⤵
  PID:14084
- C:\Windows\System\oSDgvey.exe
  C:\Windows\System\oSDgvey.exe
  2⤵
  PID:14156
- C:\Windows\System\kUYZkaf.exe
  C:\Windows\System\kUYZkaf.exe
  2⤵
  PID:9180
- C:\Windows\System\VvXaAXv.exe
  C:\Windows\System\VvXaAXv.exe
  2⤵
  PID:14216
- C:\Windows\System\cFvIzDJ.exe
  C:\Windows\System\cFvIzDJ.exe
  2⤵
  PID:9516
- C:\Windows\System\ZzujjaE.exe
  C:\Windows\System\ZzujjaE.exe
  2⤵
  PID:9672
- C:\Windows\System\Wzastgi.exe
  C:\Windows\System\Wzastgi.exe
  2⤵
  PID:14244
- C:\Windows\System\NDpOYrZ.exe
  C:\Windows\System\NDpOYrZ.exe
  2⤵
  PID:9548
- C:\Windows\System\guJAjrS.exe
  C:\Windows\System\guJAjrS.exe
  2⤵
  PID:9384
- C:\Windows\System\LFrzQOa.exe
  C:\Windows\System\LFrzQOa.exe
  2⤵
  PID:9596
- C:\Windows\System\cKymjvQ.exe
  C:\Windows\System\cKymjvQ.exe
  2⤵
  PID:14148
- C:\Windows\System\mlKcNOj.exe
  C:\Windows\System\mlKcNOj.exe
  2⤵
  PID:14192
- C:\Windows\System\iIzSgRG.exe
  C:\Windows\System\iIzSgRG.exe
  2⤵
  PID:13968
- C:\Windows\System\TAxBTyw.exe
  C:\Windows\System\TAxBTyw.exe
  2⤵
  PID:14220
- C:\Windows\System\CMlxNta.exe
  C:\Windows\System\CMlxNta.exe
  2⤵
  PID:9544
- C:\Windows\System\oTyjQYr.exe
  C:\Windows\System\oTyjQYr.exe
  2⤵
  PID:14260
- C:\Windows\System\wGWGZkS.exe
  C:\Windows\System\wGWGZkS.exe
  2⤵
  PID:6468
- C:\Windows\System\INlIjlA.exe
  C:\Windows\System\INlIjlA.exe
  2⤵
  PID:14256
- C:\Windows\System\PkSYxfd.exe
  C:\Windows\System\PkSYxfd.exe
  2⤵
  PID:9828
- C:\Windows\System\lnCFKjA.exe
  C:\Windows\System\lnCFKjA.exe
  2⤵
  PID:10016
- C:\Windows\System\xNOhgoe.exe
  C:\Windows\System\xNOhgoe.exe
  2⤵
  PID:6460
- C:\Windows\System\fjaicwN.exe
  C:\Windows\System\fjaicwN.exe
  2⤵
  PID:8800
- C:\Windows\System\PTkeCcz.exe
  C:\Windows\System\PTkeCcz.exe
  2⤵
  PID:9868
- C:\Windows\System\cQEVsan.exe
  C:\Windows\System\cQEVsan.exe
  2⤵
  PID:5852
- C:\Windows\System\GlkfvZn.exe
  C:\Windows\System\GlkfvZn.exe
  2⤵
  PID:13452
- C:\Windows\System\sbiefqp.exe
  C:\Windows\System\sbiefqp.exe
  2⤵
  PID:8348
- C:\Windows\System\gPkofKZ.exe
  C:\Windows\System\gPkofKZ.exe
  2⤵
  PID:13796
- C:\Windows\System\guolLnO.exe
  C:\Windows\System\guolLnO.exe
  2⤵
  PID:13404
- C:\Windows\System\bBLjjZr.exe
  C:\Windows\System\bBLjjZr.exe
  2⤵
  PID:9252
- C:\Windows\System\RCYmAll.exe
  C:\Windows\System\RCYmAll.exe
  2⤵
  PID:9264
- C:\Windows\System\tTOcGjr.exe
  C:\Windows\System\tTOcGjr.exe
  2⤵
  PID:8748
- C:\Windows\System\dIsranW.exe
  C:\Windows\System\dIsranW.exe
  2⤵
  PID:10292
- C:\Windows\System\rKxaXsh.exe
  C:\Windows\System\rKxaXsh.exe
  2⤵
  PID:13868
- C:\Windows\System\ptclPif.exe
  C:\Windows\System\ptclPif.exe
  2⤵
  PID:9636
- C:\Windows\System\YbjwyEq.exe
  C:\Windows\System\YbjwyEq.exe
  2⤵
  PID:14236
- C:\Windows\System\YPDAHes.exe
  C:\Windows\System\YPDAHes.exe
  2⤵
  PID:9988
- C:\Windows\System\dswJuyd.exe
  C:\Windows\System\dswJuyd.exe
  2⤵
  PID:9656
- C:\Windows\System\vNLQwtb.exe
  C:\Windows\System\vNLQwtb.exe
  2⤵
  PID:14136
- C:\Windows\System\PlKewTG.exe
  C:\Windows\System\PlKewTG.exe
  2⤵
  PID:14184
- C:\Windows\System\VFnXljh.exe
  C:\Windows\System\VFnXljh.exe
  2⤵
  PID:14308
- C:\Windows\System\KxcntZa.exe
  C:\Windows\System\KxcntZa.exe
  2⤵
  PID:14016
- C:\Windows\System\mjEWDyi.exe
  C:\Windows\System\mjEWDyi.exe
  2⤵
  PID:14176
- C:\Windows\System\SdpHckA.exe
  C:\Windows\System\SdpHckA.exe
  2⤵
  PID:9572
- C:\Windows\System\mZPiUyd.exe
  C:\Windows\System\mZPiUyd.exe
  2⤵
  PID:10872
- C:\Windows\System\LVFmjJY.exe
  C:\Windows\System\LVFmjJY.exe
  2⤵
  PID:9956
- C:\Windows\System\DJwPXTb.exe
  C:\Windows\System\DJwPXTb.exe
  2⤵
  PID:13400
- C:\Windows\System\kqDKvKp.exe
  C:\Windows\System\kqDKvKp.exe
  2⤵
  PID:13540
- C:\Windows\System\BhaQmQc.exe
  C:\Windows\System\BhaQmQc.exe
  2⤵
  PID:8896
- C:\Windows\System\KMrNpWB.exe
  C:\Windows\System\KMrNpWB.exe
  2⤵
  PID:11016
- C:\Windows\System\KIJJfJz.exe
  C:\Windows\System\KIJJfJz.exe
  2⤵
  PID:10852
- C:\Windows\System\XWUTOzZ.exe
  C:\Windows\System\XWUTOzZ.exe
  2⤵
  PID:11144
- C:\Windows\System\UDUCWJe.exe
  C:\Windows\System\UDUCWJe.exe
  2⤵
  PID:11152
- C:\Windows\System\Tjrtklp.exe
  C:\Windows\System\Tjrtklp.exe
  2⤵
  PID:14312
- C:\Windows\System\atgjmGc.exe
  C:\Windows\System\atgjmGc.exe
  2⤵
  PID:10328
- C:\Windows\System\RNSIqXZ.exe
  C:\Windows\System\RNSIqXZ.exe
  2⤵
  PID:10332
- C:\Windows\System\WkDiszM.exe
  C:\Windows\System\WkDiszM.exe
  2⤵
  PID:14120
- C:\Windows\System\EjVtiqs.exe
  C:\Windows\System\EjVtiqs.exe
  2⤵
  PID:10604
- C:\Windows\System\ZkjcFKH.exe
  C:\Windows\System\ZkjcFKH.exe
  2⤵
  PID:9156
- C:\Windows\System\DlXQsuD.exe
  C:\Windows\System\DlXQsuD.exe
  2⤵
  PID:10828
- C:\Windows\System\lXQEnox.exe
  C:\Windows\System\lXQEnox.exe
  2⤵
  PID:14128
- C:\Windows\System\QzWtYuA.exe
  C:\Windows\System\QzWtYuA.exe
  2⤵
  PID:13756
- C:\Windows\System\Psgbqyv.exe
  C:\Windows\System\Psgbqyv.exe
  2⤵
  PID:9776
- C:\Windows\System\gfDTFRu.exe
  C:\Windows\System\gfDTFRu.exe
  2⤵
  PID:14032
- C:\Windows\System\uVMYQRN.exe
  C:\Windows\System\uVMYQRN.exe
  2⤵
  PID:11212
- C:\Windows\System\vzHguGC.exe
  C:\Windows\System\vzHguGC.exe
  2⤵
  PID:10996
- C:\Windows\System\ALtBksy.exe
  C:\Windows\System\ALtBksy.exe
  2⤵
  PID:14188
- C:\Windows\System\izjrByO.exe
  C:\Windows\System\izjrByO.exe
  2⤵
  PID:9916
- C:\Windows\System\MvcIMXU.exe
  C:\Windows\System\MvcIMXU.exe
  2⤵
  PID:10504
- C:\Windows\System\cCCBcOU.exe
  C:\Windows\System\cCCBcOU.exe
  2⤵
  PID:13988
- C:\Windows\System\meCdIJV.exe
  C:\Windows\System\meCdIJV.exe
  2⤵
  PID:11340
- C:\Windows\System\pOGLhsw.exe
  C:\Windows\System\pOGLhsw.exe
  2⤵
  PID:13924
- C:\Windows\System\rghMgmX.exe
  C:\Windows\System\rghMgmX.exe
  2⤵
  PID:8856
- C:\Windows\System\OofNqxc.exe
  C:\Windows\System\OofNqxc.exe
  2⤵
  PID:11672
- C:\Windows\System\lvAtHAb.exe
  C:\Windows\System\lvAtHAb.exe
  2⤵
  PID:11728
- C:\Windows\System\dozCxRT.exe
  C:\Windows\System\dozCxRT.exe
  2⤵
  PID:2240
- C:\Windows\System\NZafWiK.exe
  C:\Windows\System\NZafWiK.exe
  2⤵
  PID:10452
- C:\Windows\System\esUGiDh.exe
  C:\Windows\System\esUGiDh.exe
  2⤵
  PID:13860
- C:\Windows\System\NHQJBPL.exe
  C:\Windows\System\NHQJBPL.exe
  2⤵
  PID:14052
- C:\Windows\System\iHalqcv.exe
  C:\Windows\System\iHalqcv.exe
  2⤵
  PID:9360
- C:\Windows\System\jZTuycS.exe
  C:\Windows\System\jZTuycS.exe
  2⤵
  PID:9476
- C:\Windows\System\JSLrTYy.exe
  C:\Windows\System\JSLrTYy.exe
  2⤵
  PID:12232
- C:\Windows\System\gdMGIVh.exe
  C:\Windows\System\gdMGIVh.exe
  2⤵
  PID:11440
- C:\Windows\System\NnYUOJv.exe
  C:\Windows\System\NnYUOJv.exe
  2⤵
  PID:10988
- C:\Windows\System\eEpOVfT.exe
  C:\Windows\System\eEpOVfT.exe
  2⤵
  PID:10284
- C:\Windows\System\oRzzdVQ.exe
  C:\Windows\System\oRzzdVQ.exe
  2⤵
  PID:10584
- C:\Windows\System\AoJYWuj.exe
  C:\Windows\System\AoJYWuj.exe
  2⤵
  PID:4580
- C:\Windows\System\CpoaqiR.exe
  C:\Windows\System\CpoaqiR.exe
  2⤵
  PID:13944
- C:\Windows\System\MsoITyX.exe
  C:\Windows\System\MsoITyX.exe
  2⤵
  PID:12108
- C:\Windows\System\uKkrlbL.exe
  C:\Windows\System\uKkrlbL.exe
  2⤵
  PID:12172
- C:\Windows\System\lKGkGZR.exe
  C:\Windows\System\lKGkGZR.exe
  2⤵
  PID:440
- C:\Windows\System\wxfpEyr.exe
  C:\Windows\System\wxfpEyr.exe
  2⤵
  PID:12216
- C:\Windows\System\PXbIrro.exe
  C:\Windows\System\PXbIrro.exe
  2⤵
  PID:11380
- C:\Windows\System\OyMeVKy.exe
  C:\Windows\System\OyMeVKy.exe
  2⤵
  PID:11868
- C:\Windows\System\bluZPRI.exe
  C:\Windows\System\bluZPRI.exe
  2⤵
  PID:6188
- C:\Windows\System\RTSknKz.exe
  C:\Windows\System\RTSknKz.exe
  2⤵
  PID:9784
- C:\Windows\System\XaIobhH.exe
  C:\Windows\System\XaIobhH.exe
  2⤵
  PID:14012
- C:\Windows\System\EMAjCpU.exe
  C:\Windows\System\EMAjCpU.exe
  2⤵
  PID:11708
- C:\Windows\System\sCsezsa.exe
  C:\Windows\System\sCsezsa.exe
  2⤵
  PID:4892
- C:\Windows\System\UFLNqTe.exe
  C:\Windows\System\UFLNqTe.exe
  2⤵
  PID:12412
- C:\Windows\System\qiJGPjo.exe
  C:\Windows\System\qiJGPjo.exe
  2⤵
  PID:10464
- C:\Windows\System\ldVbcHc.exe
  C:\Windows\System\ldVbcHc.exe
  2⤵
  PID:12964
- C:\Windows\System\bihzOmg.exe
  C:\Windows\System\bihzOmg.exe
  2⤵
  PID:12564
- C:\Windows\System\UgvGwrX.exe
  C:\Windows\System\UgvGwrX.exe
  2⤵
  PID:11424
- C:\Windows\System\CdXMJVt.exe
  C:\Windows\System\CdXMJVt.exe
  2⤵
  PID:12640
- C:\Windows\System\nSrcswf.exe
  C:\Windows\System\nSrcswf.exe
  2⤵
  PID:12672
- C:\Windows\System\JuwmVuY.exe
  C:\Windows\System\JuwmVuY.exe
  2⤵
  PID:12296
- C:\Windows\System\gQEouku.exe
  C:\Windows\System\gQEouku.exe
  2⤵
  PID:12612
- C:\Windows\System\SWffytZ.exe
  C:\Windows\System\SWffytZ.exe
  2⤵
  PID:11984
- C:\Windows\System\cPyoArl.exe
  C:\Windows\System\cPyoArl.exe
  2⤵
  PID:9448
- C:\Windows\System\jefKwbv.exe
  C:\Windows\System\jefKwbv.exe
  2⤵
  PID:12676
- C:\Windows\System\lbgEGTW.exe
  C:\Windows\System\lbgEGTW.exe
  2⤵
  PID:13564
- C:\Windows\System\gYKwUGJ.exe
  C:\Windows\System\gYKwUGJ.exe
  2⤵
  PID:11804
- C:\Windows\System\reAspqk.exe
  C:\Windows\System\reAspqk.exe
  2⤵
  PID:10188
- C:\Windows\System\BcZbdpS.exe
  C:\Windows\System\BcZbdpS.exe
  2⤵
  PID:12520
- C:\Windows\System\uoLKSNN.exe
  C:\Windows\System\uoLKSNN.exe
  2⤵
  PID:13012
- C:\Windows\System\AmobRVI.exe
  C:\Windows\System\AmobRVI.exe
  2⤵
  PID:12720
- C:\Windows\System\FTTBmAO.exe
  C:\Windows\System\FTTBmAO.exe
  2⤵
  PID:12552
- C:\Windows\System\XvGOtOq.exe
  C:\Windows\System\XvGOtOq.exe
  2⤵
  PID:12728
- C:\Windows\System\bTjMfxh.exe
  C:\Windows\System\bTjMfxh.exe
  2⤵
  PID:13200
- C:\Windows\System\tOInuKh.exe
  C:\Windows\System\tOInuKh.exe
  2⤵
  PID:13044
- C:\Windows\System\UYCZMoa.exe
  C:\Windows\System\UYCZMoa.exe
  2⤵
  PID:12608
- C:\Windows\System\spykefk.exe
  C:\Windows\System\spykefk.exe
  2⤵
  PID:11928
- C:\Windows\System\TXRrOfc.exe
  C:\Windows\System\TXRrOfc.exe
  2⤵
  PID:14372
- C:\Windows\System\NyyJpnz.exe
  C:\Windows\System\NyyJpnz.exe
  2⤵
  PID:14408
- C:\Windows\System\SuGSZCJ.exe
  C:\Windows\System\SuGSZCJ.exe
  2⤵
  PID:14424
- C:\Windows\System\OtSBniP.exe
  C:\Windows\System\OtSBniP.exe
  2⤵
  PID:14464
- C:\Windows\System\AFKhwvy.exe
  C:\Windows\System\AFKhwvy.exe
  2⤵
  PID:14492
- C:\Windows\System\wPbuaMl.exe
  C:\Windows\System\wPbuaMl.exe
  2⤵
  PID:14508
- C:\Windows\System\BLtnaxR.exe
  C:\Windows\System\BLtnaxR.exe
  2⤵
  PID:14540
- C:\Windows\System\BkmBdXT.exe
  C:\Windows\System\BkmBdXT.exe
  2⤵
  PID:14576
- C:\Windows\System\bcbqYgj.exe
  C:\Windows\System\bcbqYgj.exe
  2⤵
  PID:14612
- C:\Windows\System\RhPOoBp.exe
  C:\Windows\System\RhPOoBp.exe
  2⤵
  PID:14632
- C:\Windows\System\PHONjQO.exe
  C:\Windows\System\PHONjQO.exe
  2⤵
  PID:14648
- C:\Windows\System\GLGpiLN.exe
  C:\Windows\System\GLGpiLN.exe
  2⤵
  PID:14692
- C:\Windows\System\xFpuQxS.exe
  C:\Windows\System\xFpuQxS.exe
  2⤵
  PID:14720
- C:\Windows\System\hbpYmIf.exe
  C:\Windows\System\hbpYmIf.exe
  2⤵
  PID:14744
- C:\Windows\System\JAMGANv.exe
  C:\Windows\System\JAMGANv.exe
  2⤵
  PID:14772
- C:\Windows\System\BgfAPbV.exe
  C:\Windows\System\BgfAPbV.exe
  2⤵
  PID:14808
- C:\Windows\System\awpQwOt.exe
  C:\Windows\System\awpQwOt.exe
  2⤵
  PID:14836
- C:\Windows\System\aLRfZDB.exe
  C:\Windows\System\aLRfZDB.exe
  2⤵
  PID:14864
- C:\Windows\System\lpeoJxL.exe
  C:\Windows\System\lpeoJxL.exe
  2⤵
  PID:14896
- C:\Windows\System\SGrbVTV.exe
  C:\Windows\System\SGrbVTV.exe
  2⤵
  PID:14924
- C:\Windows\System\sFKZzUB.exe
  C:\Windows\System\sFKZzUB.exe
  2⤵
  PID:14944
- C:\Windows\System\SlynhgP.exe
  C:\Windows\System\SlynhgP.exe
  2⤵
  PID:14980
- C:\Windows\System\wiWJZqp.exe
  C:\Windows\System\wiWJZqp.exe
  2⤵
  PID:15008
- C:\Windows\System\KAQAmtu.exe
  C:\Windows\System\KAQAmtu.exe
  2⤵
  PID:15032
- C:\Windows\System\KAHGemd.exe
  C:\Windows\System\KAHGemd.exe
  2⤵
  PID:15056
- C:\Windows\System\FDyUYsn.exe
  C:\Windows\System\FDyUYsn.exe
  2⤵
  PID:15092
- C:\Windows\System\GOikDlJ.exe
  C:\Windows\System\GOikDlJ.exe
  2⤵
  PID:15108
- C:\Windows\System\xaanZYE.exe
  C:\Windows\System\xaanZYE.exe
  2⤵
  PID:15128
- C:\Windows\System\TumvTIc.exe
  C:\Windows\System\TumvTIc.exe
  2⤵
  PID:15180
- C:\Windows\System\oMCQTwV.exe
  C:\Windows\System\oMCQTwV.exe
  2⤵
  PID:15200
- C:\Windows\System\lPOnKKs.exe
  C:\Windows\System\lPOnKKs.exe
  2⤵
  PID:15228
- C:\Windows\System\xhcDdkd.exe
  C:\Windows\System\xhcDdkd.exe
  2⤵
  PID:15252
- C:\Windows\System\ksvlzhD.exe
  C:\Windows\System\ksvlzhD.exe
  2⤵
  PID:15280
- C:\Windows\System\XPdMTYi.exe
  C:\Windows\System\XPdMTYi.exe
  2⤵
  PID:15312
- C:\Windows\System\WzNulCM.exe
  C:\Windows\System\WzNulCM.exe
  2⤵
  PID:15348
- C:\Windows\System\VNMmPoJ.exe
  C:\Windows\System\VNMmPoJ.exe
  2⤵
  PID:11800
- C:\Windows\System\ibsQETI.exe
  C:\Windows\System\ibsQETI.exe
  2⤵
  PID:14420
- C:\Windows\System\EZYyFen.exe
  C:\Windows\System\EZYyFen.exe
  2⤵
  PID:14456
- C:\Windows\System\iZGAbvO.exe
  C:\Windows\System\iZGAbvO.exe
  2⤵
  PID:14532
- C:\Windows\System\QuSHIkq.exe
  C:\Windows\System\QuSHIkq.exe
  2⤵
  PID:14604
- C:\Windows\System\KUrPHJJ.exe
  C:\Windows\System\KUrPHJJ.exe
  2⤵
  PID:14644
- C:\Windows\System\VUOwjRc.exe
  C:\Windows\System\VUOwjRc.exe
  2⤵
  PID:14708
- C:\Windows\System\YYoIcnV.exe
  C:\Windows\System\YYoIcnV.exe
  2⤵
  PID:14736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5d5rmcpc.vcp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AHvIezt.exe

Filesize
1.9MB

MD5
5d16802c53ac8930a9e2b17c8180b8fa

SHA1
4a960661eb0f351862cdfcd7bdf23ad87354f8b2

SHA256
6a4c9f349aab466714472e81e2954b23b32e41bb4b4c3686ae6cfeb8f1685ed7

SHA512
2a796adfcf79f2e316fd3e87fd64fd3fd4301b5102da48fe5f65df727faa540238f470d351a67189d1d8fefaab1591c3e8e13766e087540716fa47d911a7f8aa

Download Submit
C:\Windows\System\ARiEOUp.exe

Filesize
1.9MB

MD5
9edd3a09b5ae52ba7a74ac183cb7aa79

SHA1
bc92f544bdf31cc8c49f6256315a249020db0451

SHA256
826f2b26dafafc7932a7306f9b5224792530beefe16d06527c17d50b97cf772e

SHA512
5124e509691cdbca9f3fbebf7f1aeb2d03b36b9edbcc794da50f928c8cd96511bdad562b33e2aa2d6fd165b8c53fcd9fcd7f1b499ad7b63f2667fe3070f79407

Download Submit
C:\Windows\System\DviEsND.exe

Filesize
1.9MB

MD5
f4259374853b841f2774caf7fbd9e974

SHA1
52b0cd10dd723f064179f9048efdce990a36ea41

SHA256
9242d1da4720b4ae8e439616c7ac3b394efe2993a891edfaf9a340a7ae981a31

SHA512
f2dc7ca04b96a1e09109b3cd2013dcdcf675ab2c009fe44317a268597f8d3eaf3866b2cc1661cc95e8d68b9d4824a01349c192e567c94b2fede1ebe5f32a0486

Download Submit
C:\Windows\System\GegrYje.exe

Filesize
1.9MB

MD5
9066359c3580fa6a912a4f28d0bf513f

SHA1
ca0d63b98ed57f6503fe38b110acd561b2eafb93

SHA256
d740df4a03779e959cc89863bb45797bd56d8dec0a0503572c86b59d0102e90c

SHA512
d6d125939087de53a0718b699c0ffc1e4d2f78660034a9bc6ab51524a81eeb5ff6609ef280229e9bad68621ae7af0e374c68b16fa358c9929752bacced7a3dcf

Download Submit
C:\Windows\System\KOxABOJ.exe

Filesize
1.9MB

MD5
c8ae1b8809ab74741ca1559c40fb3414

SHA1
62899979cf50ed6fc0922a81c33006c88028d0be

SHA256
eed5155b32218238699538340df90b8a4836f93eb21d86279fc63bea1fc69d6c

SHA512
cb5a73fe1122b09c74637f3c6e5787a4f80cf6bef8ed9d0105ba1d15a5e4a316855690ec90bd69d4c6615348656839a7d14f2ecedddca8ef6468cf24e0824a2d

Download Submit
C:\Windows\System\KcBrTrQ.exe

Filesize
1.9MB

MD5
f3ef2889ee8a3c167ea071d1685a15a0

SHA1
e99a457c54d4f76bfb62a6d315304a6ac3e36021

SHA256
91e0f4ee50bd0d710d011dca54fdc6d75982506710b4723a623cdfa15124ab23

SHA512
c18a15b33e368e8162be338cc7ec78e7deb97ce68dc979f76b2d380e9f76937744a34f2ae5d1f465659daec47cf160bc4360795398a5546a7af0ede69c9bbad1

Download Submit
C:\Windows\System\NEEJfxp.exe

Filesize
1.9MB

MD5
55e9f4c8b734a49eadaf00f135d00514

SHA1
864fe7f6f53ff9cc071a231babfedb3cf341a4da

SHA256
0ec69ca65005c244a2dbe0862dedddf059321cdbc3d37c10c72b8bcd4e2cb02e

SHA512
8d5a95e33116334afe6e97845a02666a738a34f9ec46741a6e891850996a360d06f8d1ede7b11cf3d783a86639e7c056b9b23d796b20ffe990548af1219d4d70

Download Submit
C:\Windows\System\PPEmUMf.exe

Filesize
1.9MB

MD5
3c8bf319154002dd9539976de2503437

SHA1
8b8639f1eb5836d50b3245475e128a314d072145

SHA256
22eae25a68061559d8c40ae35c8de4f7d22f38d62d86614939ad72fd2889e90f

SHA512
095ba49a3d1e177d1518b93cb6850dfd43001757170dc4ee35394e45501cee27ae2e4970a86bd2c01170e73e7b827536955d92395f6f12747af1d2c281961dff

Download Submit
C:\Windows\System\QdVCNFB.exe

Filesize
1.9MB

MD5
e78d9c44270b2f42a12f9b6acb28ed9a

SHA1
8806c353a783555eea814442bc851b5c1ebc133f

SHA256
5697b14a38af7e1ea8aad0f7c185a7c0b17bda06d0ba06aa1460eef5a43af617

SHA512
29c7332ca4f01277d662b9cd1d75c9360a2e8bd7f3f40a2323e5af760e4d069787395b545f573f1195520388f61cf47dc9c70065cdb5b10c8a961ce7a49e780d

Download Submit
C:\Windows\System\QnfKyCq.exe

Filesize
1.9MB

MD5
a4dac6c16a70542af32180219eb1a102

SHA1
af6f7fcd017998746298bfc42cfa05346ac1e69b

SHA256
4ab4d4775a502adbd5d316d367f4f5cdb9f3f0ef0f69fa2783563097948d65fb

SHA512
9aae245b4ba097cbdb5d03dc99badaca37cc30ea10c4849f84085f16407609d061ff8ec1b9fce9b96bcfe9803a7e77858212db1b7c577dd3097fdfb93bda1d60

Download Submit
C:\Windows\System\RIzMudP.exe

Filesize
8B

MD5
a8f2921c80c15a3d426e5fdff8a56196

SHA1
4dc21bf95e22427a9dafcd4930e81b62e77d5fda

SHA256
7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1

SHA512
996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802

Download Submit
C:\Windows\System\XFsnDWS.exe

Filesize
1.9MB

MD5
4d81b0a348a45c7fe68131476ea55ed1

SHA1
0e7c7e5dabbd99d294e307d9406abcbd7b40ee38

SHA256
be32ebbc2723ac8ec1e70a671e71c50ed8bfc35cb7097e2a3261528ce50983a3

SHA512
4d84fc687d454936b5efd5ac4e32fa7f548746e860a5180ee05ceb06b1c78265473883aa39327a26fed318bea6cb1db1c80c2541f1b72dfef58e7e7f4266770a

Download Submit
C:\Windows\System\XNxzoNS.exe

Filesize
1.9MB

MD5
37a6d2d0dd56e54936371931c1e77c1e

SHA1
cc262e69d05305257bd6c2bc1b46f6dd6aad69e1

SHA256
f53b58101734c52605b01dae55d6213e5299482bfdffefafaeb76b1c69c8c90c

SHA512
2f725bcdd101b338b8be84bdc1036123a7b4dc2191d228379b2a8cfc3e779b29cc53b0289c86dd938218e32f60ab397874591319b4f033b915dced0a6154d00f

Download Submit
C:\Windows\System\ZvHcoqp.exe

Filesize
1.9MB

MD5
3159552a9c09e12f1df5a612ccc614e5

SHA1
e32b0b05b9375a01213e12300c0c3328f0ba1421

SHA256
9c9ffd5ae2f7b6f54e9c54f39298ce1c4ad48699f8e780e67c421064799bb09b

SHA512
aa423027761fc805330ab444aaa47ad210f968968a8b7caf4eb84b680888f009497d1f9b8c30e5d8312ed96123cab8534800a6ccff34abb2bc424ed1ace5e34a

Download Submit
C:\Windows\System\bxgIxGZ.exe

Filesize
18B

MD5
5db3df0964e5c695675f39e99d1f288b

SHA1
84b597ea47f1f6b13b223cbb576a55e47a79cfaa

SHA256
15f5f6f9d4846d3bfaf7f8740e9c849aebfecfea6fc86fee82eb18d6ec03fd9f

SHA512
f71b3480e977c4ca4affaaec3f3bd31e3598fdd986ea7bafee42b5d6a8676e69449256bbab19fc0cc61412a454871e6b79cebb0c5e3610b9e98c4f089888aa18

Download Submit
C:\Windows\System\cDACLev.exe

Filesize
1.9MB

MD5
7460904ef768778202197771794b5625

SHA1
7816f4350293af6781a75d856a39d909721dbf11

SHA256
9a0987d123d28f56c04c57ca0daeb7d1489da4130190ecb39a3db693069c541a

SHA512
7f3b26108e5a07ddfcd36c8860d2b12fca75bfb947a8aadb25a07c75b78edb77ca0a61cdc9569d8413a5f083d7624f6e91cd965a4e26984056dcecff14d53acc

Download Submit
C:\Windows\System\dhvXaHU.exe

Filesize
1.9MB

MD5
5164e759e8fd4f90841db2a7ec4985ff

SHA1
e3297987ddde72a046b8bfb159c063f0acabfda2

SHA256
96f47da0e66862d27f09c2fa9d469c0b7975c0af201f48f7770a1c43309667ce

SHA512
79403e7418cb3750e638168bd499674164ec32df78959f2636b016ebbb3824d655a9742a0eababf1236f2a00082b80827f4cdb55dab53fe1432905559df2a6d3

Download Submit
C:\Windows\System\eZOJoHv.exe

Filesize
1.9MB

MD5
e9d3f1babf46a24507508b7a95049a3b

SHA1
720912070bc0c87e2b626c76093eef937da43519

SHA256
e17c61f217ba03e6946c2f0c11f7f60a90ce6b87b674dac1fc8f40c6046acf82

SHA512
ac50e80384c38e60bf606a85a71a53394514086c12556cb13f1927593885e88fca4fe50fe1b9ec55d88838654dec01408adb8530c9df8f118d4f09bdf0a68104

Download Submit
C:\Windows\System\gsbpEyi.exe

Filesize
1.9MB

MD5
e822e76b0b937ef939d2e05f4cce0d41

SHA1
6eddaeb89401464eb19eabdc1d898d2a8144cd81

SHA256
3260cee5411f5264da057be877247e4351e3e0915f28150a7bf8fa0c1a7a34be

SHA512
ab0c607305c853b3643b0c1d589733f69fec7587d737f7bd8fe04fd8d3589d921ac39d78eb9c2c3d3de4230bff43ec1af613bb5de801d2c01448a3d94e3dd896

Download Submit
C:\Windows\System\hAPGCGS.exe

Filesize
1.9MB

MD5
177f7b3e5a013ca70a1d2b74a8eff953

SHA1
2f469e9415102b7f953db96c198e95677b5ea6bf

SHA256
0ab2900670c18cae2c942cfb3962aac537f5a33b619da7a8f8679da7c9d0fcab

SHA512
f5ce50b784c6c0c4136485562337ded131f8eaf63a08fbdf5ec09452ea2183033cd63bc6e28de8d29574b96803e74b54bc0ca37ad0336527825299f93dc312d2

Download Submit
C:\Windows\System\icTcrZX.exe

Filesize
1.9MB

MD5
fff68362db0fe8f1d3388d2081d0873b

SHA1
a407bb2f3708ae6093868362bb6e619711ddd13a

SHA256
81d753ea0334550d849b24f1fad62b8795f80866777e838010619e90c21c8c75

SHA512
0705070280519a9f6ca8d7485d22e1808418d150adc715b4bd4f30aaa387338414645ed6e8d766a3bc7ab16aab3e309efd37b0439882349b81973862e659317e

Download Submit
C:\Windows\System\jDlURWR.exe

Filesize
1.9MB

MD5
432feccadc09f9693744dd14ea3fe6e9

SHA1
34452d5acb45f27f51c236e35e1ab04af1d32d18

SHA256
fc054f39b5e2e89383ed9f647beb86a2c0ff8714d61dc7bfb337250a5c7c7843

SHA512
f45fbdccd3ccf26c7c1c829055a5ed12da893c1b378c13732b895318f96c689e1da35873a9fedd4cd7f7e28ba27599755f9209db8fc7409d9c21f980aed6760c

Download Submit
C:\Windows\System\jQxpPpE.exe

Filesize
1.9MB

MD5
2aa809980c167f1ed5fcc7338505cc41

SHA1
d1a9483daaa47faffcdac052c08b6f144d45f899

SHA256
61c8b73c9becad016b52351082a2336cb23de88a26b187b9fc8de7e8192ba102

SHA512
fc98010c7387ce374b243133a637d940e7ef04ae708501f6a953c8af08d882a1242c50bac927c30557b35ae79a21b6cd658a004592a5bcc6683f97d3e4ea8113

Download Submit
C:\Windows\System\jfmMSzm.exe

Filesize
1.9MB

MD5
6a2baac7543ec1231fba57db923232a2

SHA1
da584caa20dd1b906d068667ef1a6fbe85987417

SHA256
69cf848565f17619438a2513bf4649829916372690d0205cb88e5f75956ebf00

SHA512
77eac3af3159930b432f1c0b7007d81352a9a378311977cf7ea2242a727541e7525153c777883e0ccdb30fc865840d24aaace5c8a02d7ac4ba88a5f32d518a18

Download Submit
C:\Windows\System\klVPPWH.exe

Filesize
1.9MB

MD5
8f30bd438c77d175716a27f2baec3df0

SHA1
45e8a729a59a970063e5be3dab88aa49fc35fdf7

SHA256
3441783d7e301c8c5bfdd4595eb6bee5eb88923a090156766c4dfaf09ca8a824

SHA512
0f0c0fb8c611e576cef0880dbbcff299cf98f3234266b8fd5bda36312b9f9cb52ac8f64e35cd97d53a88e99a6729435804703c675e515cd2843b2a5cb1f845d8

Download Submit
C:\Windows\System\ltRYbhU.exe

Filesize
1.9MB

MD5
9a83e3ac1bf05a4cefe5a4ece896b0e3

SHA1
ca99e9015b26b627e0f7dc80398519e0415ab84a

SHA256
480bb09a8a523f2d0939523b0899eec34d16f539ffb55734f4f13634290b6083

SHA512
c582093e3db7b6381c6e0dd77d553afa35a2281c2d0e1af159f167cd07e86ed814332e6872742c125876c6a00057e0cd9506f3994aa04dd9a4f7e71be22152ad

Download Submit
C:\Windows\System\qUEsFnn.exe

Filesize
1.9MB

MD5
c5c1fb667def6ab5d5e09fd544815f2b

SHA1
c2791a2295fab38435a6d1fb22b4d6932d0d60c0

SHA256
b71488065f538d4ae605aa22ba6a0a8911d18e01cb2dbbbc1c1809dd201db421

SHA512
ff76a357daa325461066da169bc9b48160a4bf899a490c6bc893a496cd42a0867b14d99114a9d75e5805926a5858dcb19e93775ca63cc8e25c7ae144cd8a29d2

Download Submit
C:\Windows\System\tHEJgud.exe

Filesize
1.9MB

MD5
49d9a81750e37c714ae0e0c075bce04a

SHA1
574662d3801f5ca7956bde7868305dc7ca36074b

SHA256
bf9f7eb4778ef30f4e2b321d5a01ec4e81616d9e811cc983947a180483f3eead

SHA512
5e7b21ff627314843a39453faa7f7887aeef2d45b6aaefd4309976716980164859ab24a022add653fb7391ed03a0fe950afe18caaea5e6fc10e466efafed01be

Download Submit
C:\Windows\System\uDpvUDk.exe

Filesize
1.9MB

MD5
ad674bd92f9ea4d19a25dcb14be34703

SHA1
6632fcaa24ced3a9f100dbeba5b67d31020eea7b

SHA256
5023b052aa55cc71da67072333df86d0ec2707d059db249755f759ebda964b4d

SHA512
ee7ec4dfa71f52865f7734e2782c56986f2a7307b9afb796531bbe92c59722ca415ecb763ead4504daddae138c6496c335feba103c4a0c7415fed9c2793c3164

Download Submit
C:\Windows\System\usBBajq.exe

Filesize
1.9MB

MD5
6d1767603bf022e28e9105732b4600c7

SHA1
d308b282757b99a1261538916f83bf16effd43e9

SHA256
eb4360e4dbb5061f2114d9244249e98597a1d5e58f3053ce6216d8522c1f9895

SHA512
681af34dc37c0d6e643516275fcd9d7ce8ea64f7ab039de2a6586dd9b543765c65126e63fdff3c4ef4ecc3983f048b9caa7ccc182aafe5bfbce47333e57719e4

Download Submit
C:\Windows\System\vDuAlus.exe

Filesize
1.9MB

MD5
72ed94b561ff74e50c3e4379273cfbf8

SHA1
bcef4fb65b8b9dc3240073ed801a33dd390dd6d6

SHA256
bd0e7600dd2312912342282793ff74a56a795334b8fe478f05326d0058dd6e8b

SHA512
dbb25c2a8318db47c669d98aff5ff9133afd5540c9590ad0d2b995d26ec18b9484452ce9fc1e9a79314ce85e6fb36e39d992c4c55035efe647b1d01e43757d9b

Download Submit
C:\Windows\System\wPeMHVQ.exe

Filesize
1.9MB

MD5
eec7f01b7a1ab7bdfafb5334f604a78a

SHA1
ce134e5a5cb76b33f70b5c55cd7847dbe5c56bb6

SHA256
b5993605f9197e162e481296eb2ac57d9e08e8aa463d04e0755470e8c34ff830

SHA512
444e40fe7b8b5ec3c6b6163e53c1e30f49b3dfa4b69e4903ca920569b8cf18e47592b4faa04fba99d64e6fb1ddf032132185a6459a29afdedfdd8b2aedf8c318

Download Submit
C:\Windows\System\wShhrRp.exe

Filesize
1.9MB

MD5
20dccd8a820ca9f7d71481ff84e93d95

SHA1
a9af860e02646c0def4b912d4457f4359b477a0e

SHA256
bede17f13f8bd115c2de61e7627adb9c1ef4df6d14c434943d18db18258356b7

SHA512
be51aea61696a7e76867f2cd4de5dffef3eda0a0aa422eea5f2e80a423399788f48aad54776e8a72022de57ae7849e5c7ae0c5f26684ab733ff889ca88184afc

Download Submit
C:\Windows\System\ygQgqxC.exe

Filesize
1.9MB

MD5
1256af18f6a699afd564bc739525336b

SHA1
7d9a05e028162d38a8406c4ff21ec4cf0b08b8ea

SHA256
d314e6afdfc91d73212fd6f52ac983f9a2e6242edf80e9281136ed7a3e29d791

SHA512
91107bfff5b973d7e1b8f7dce352926c52d99ba5af0c0f7be4eab7151f0d7639d1967b8224414628e42f32d72a499ab8c7745a4e114f9e586af37edcc5bc13bf

Download Submit
C:\Windows\System\zjnIKmS.exe

Filesize
1.9MB

MD5
b9cf99b07f3bc53d62845dd590f349e3

SHA1
58279096c12d72a9d983ec462f1631827dc452ac

SHA256
ef42d67b254cfb8add7b6512d51923779a3b0c9b60c8af1b28d6f26ce1ca0d7f

SHA512
3ca93c0078c3b36081db374eaf1925b23abdaba03473a2a5ccb0a396a331a95391809cdb4e9aaab140bc3c2aeb0bc728694715e3d674e67ab01260881c66a375

Download Submit
memory/436-83-0x00007FF7BF3D0000-0x00007FF7BF7C2000-memory.dmp

Filesize
3.9MB

Download
memory/700-91-0x00007FF6E9480000-0x00007FF6E9872000-memory.dmp

Filesize
3.9MB

Download
memory/1268-149-0x00007FF787220000-0x00007FF787612000-memory.dmp

Filesize
3.9MB

Download
memory/1600-154-0x00007FF63C9D0000-0x00007FF63CDC2000-memory.dmp

Filesize
3.9MB

Download
memory/1656-103-0x00007FF77E4C0000-0x00007FF77E8B2000-memory.dmp

Filesize
3.9MB

Download
memory/1656-3692-0x00007FF77E4C0000-0x00007FF77E8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2108-62-0x00007FF75F160000-0x00007FF75F552000-memory.dmp

Filesize
3.9MB

Download
memory/2124-0-0x00007FF6511D0000-0x00007FF6515C2000-memory.dmp

Filesize
3.9MB

Download
memory/2124-1-0x000001E38ABD0000-0x000001E38ABE0000-memory.dmp

Filesize
64KB

Download
memory/2124-3677-0x00007FF6511D0000-0x00007FF6515C2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-104-0x00007FF78E400000-0x00007FF78E7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2180-5894-0x00007FF78E400000-0x00007FF78E7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-5902-0x00007FF6AADB0000-0x00007FF6AB1A2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-143-0x00007FF6AADB0000-0x00007FF6AB1A2000-memory.dmp

Filesize
3.9MB

Download
memory/3552-117-0x00007FF73DA80000-0x00007FF73DE72000-memory.dmp

Filesize
3.9MB

Download
memory/3552-5891-0x00007FF73DA80000-0x00007FF73DE72000-memory.dmp

Filesize
3.9MB

Download
memory/3632-70-0x00007FF6B5F30000-0x00007FF6B6322000-memory.dmp

Filesize
3.9MB

Download
memory/3800-134-0x00007FF7222C0000-0x00007FF7226B2000-memory.dmp

Filesize
3.9MB

Download
memory/3876-31-0x000001DB388E0000-0x000001DB38902000-memory.dmp

Filesize
136KB

Download
memory/3876-36-0x00007FFAFE3C0000-0x00007FFAFEE81000-memory.dmp

Filesize
10.8MB

Download
memory/3876-1829-0x00007FFAFE3C0000-0x00007FFAFEE81000-memory.dmp

Filesize
10.8MB

Download
memory/3876-41-0x000001DB38930000-0x000001DB38940000-memory.dmp

Filesize
64KB

Download
memory/4124-5892-0x00007FF7A2010000-0x00007FF7A2402000-memory.dmp

Filesize
3.9MB

Download
memory/4124-124-0x00007FF7A2010000-0x00007FF7A2402000-memory.dmp

Filesize
3.9MB

Download
memory/4212-109-0x00007FF754F70000-0x00007FF755362000-memory.dmp

Filesize
3.9MB

Download
memory/4224-153-0x00007FF6B4FB0000-0x00007FF6B53A2000-memory.dmp

Filesize
3.9MB

Download
memory/4416-166-0x00007FF761460000-0x00007FF761852000-memory.dmp

Filesize
3.9MB

Download
memory/4556-39-0x00007FF68D7F0000-0x00007FF68DBE2000-memory.dmp

Filesize
3.9MB

Download
memory/4620-5984-0x00007FF61EEB0000-0x00007FF61F2A2000-memory.dmp

Filesize
3.9MB

Download
memory/4620-160-0x00007FF61EEB0000-0x00007FF61F2A2000-memory.dmp

Filesize
3.9MB

Download
memory/4656-167-0x00007FF769720000-0x00007FF769B12000-memory.dmp

Filesize
3.9MB

Download
memory/4860-5910-0x00007FF62B1B0000-0x00007FF62B5A2000-memory.dmp

Filesize
3.9MB

Download
memory/4860-140-0x00007FF62B1B0000-0x00007FF62B5A2000-memory.dmp

Filesize
3.9MB

Download
memory/4964-139-0x00007FF764810000-0x00007FF764C02000-memory.dmp

Filesize
3.9MB

Download
memory/4964-5898-0x00007FF764810000-0x00007FF764C02000-memory.dmp

Filesize
3.9MB

Download
memory/5012-173-0x00007FF76F890000-0x00007FF76FC82000-memory.dmp

Filesize
3.9MB

Download