xmrig | d6d39cd62712a85faaa181d1f66a748764d96ae0bdf09e74ccdf4431445cba47

Analysis

max time kernel
144s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
Size

2.1MB
MD5

0b0df83670739b620f6b43c7d4a516a7
SHA1

4e8a2e78b21cbedeb1060036788c358ee0c1ddba
SHA256

d6d39cd62712a85faaa181d1f66a748764d96ae0bdf09e74ccdf4431445cba47
SHA512

82c66144e5a3b1538f4606cd2c8bac95246e6c701f1ec44641f276026be1c91f81167a48b2947f2ef9fe8a6fc18621cbc23b23a56ff60be19dfd357654668845
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrGk:NABk

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/memory/4468-229-0x00007FF6E9060000-0x00007FF6E9452000-memory.dmp	xmrig
behavioral2/memory/4040-227-0x00007FF6E7190000-0x00007FF6E7582000-memory.dmp	xmrig
behavioral2/memory/4128-222-0x00007FF777EF0000-0x00007FF7782E2000-memory.dmp	xmrig
behavioral2/memory/1156-170-0x00007FF7A4140000-0x00007FF7A4532000-memory.dmp	xmrig
behavioral2/memory/628-251-0x00007FF65CFD0000-0x00007FF65D3C2000-memory.dmp	xmrig
behavioral2/memory/4752-293-0x00007FF6CEA30000-0x00007FF6CEE22000-memory.dmp	xmrig
behavioral2/memory/3700-341-0x00007FF7FEFE0000-0x00007FF7FF3D2000-memory.dmp	xmrig
behavioral2/memory/1448-1237-0x00007FF6659E0000-0x00007FF665DD2000-memory.dmp	xmrig
behavioral2/memory/3080-1058-0x00007FF6AC300000-0x00007FF6AC6F2000-memory.dmp	xmrig
behavioral2/memory/3064-1057-0x00007FF7ABA60000-0x00007FF7ABE52000-memory.dmp	xmrig
behavioral2/memory/4832-1034-0x00007FF7FD200000-0x00007FF7FD5F2000-memory.dmp	xmrig
behavioral2/memory/5084-1032-0x00007FF71E5F0000-0x00007FF71E9E2000-memory.dmp	xmrig
behavioral2/memory/5084-4261-0x00007FF71E5F0000-0x00007FF71E9E2000-memory.dmp	xmrig
behavioral2/memory/1268-4264-0x00007FF757210000-0x00007FF757602000-memory.dmp	xmrig
behavioral2/memory/1472-4269-0x00007FF7449A0000-0x00007FF744D92000-memory.dmp	xmrig
behavioral2/memory/3064-4272-0x00007FF7ABA60000-0x00007FF7ABE52000-memory.dmp	xmrig
behavioral2/memory/512-4267-0x00007FF74AFC0000-0x00007FF74B3B2000-memory.dmp	xmrig
behavioral2/memory/1952-4280-0x00007FF7EE090000-0x00007FF7EE482000-memory.dmp	xmrig
behavioral2/memory/3684-4277-0x00007FF747A00000-0x00007FF747DF2000-memory.dmp	xmrig
behavioral2/memory/1448-4289-0x00007FF6659E0000-0x00007FF665DD2000-memory.dmp	xmrig
behavioral2/memory/4832-4293-0x00007FF7FD200000-0x00007FF7FD5F2000-memory.dmp	xmrig
behavioral2/memory/3080-4285-0x00007FF6AC300000-0x00007FF6AC6F2000-memory.dmp	xmrig
behavioral2/memory/4468-4301-0x00007FF6E9060000-0x00007FF6E9452000-memory.dmp	xmrig
behavioral2/memory/1360-4297-0x00007FF7CAF50000-0x00007FF7CB342000-memory.dmp	xmrig
behavioral2/memory/4972-4303-0x00007FF691130000-0x00007FF691522000-memory.dmp	xmrig
behavioral2/memory/4040-4328-0x00007FF6E7190000-0x00007FF6E7582000-memory.dmp	xmrig
behavioral2/memory/4128-4321-0x00007FF777EF0000-0x00007FF7782E2000-memory.dmp	xmrig
behavioral2/memory/1816-4313-0x00007FF752B50000-0x00007FF752F42000-memory.dmp	xmrig
behavioral2/memory/1156-4316-0x00007FF7A4140000-0x00007FF7A4532000-memory.dmp	xmrig
behavioral2/memory/3700-4385-0x00007FF7FEFE0000-0x00007FF7FF3D2000-memory.dmp	xmrig
behavioral2/memory/4752-4345-0x00007FF6CEA30000-0x00007FF6CEE22000-memory.dmp	xmrig
behavioral2/memory/628-4341-0x00007FF65CFD0000-0x00007FF65D3C2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4604	vItPxsq.exe
1268	EXGFOjA.exe
512	NXxvYpN.exe
1472	TvgjNek.exe
5084	FxDaFif.exe
4832	hvbhrit.exe
3684	UTvTlvF.exe
1952	LrAylmc.exe
3064	ToXJoYC.exe
1360	wGHVKjV.exe
4972	PPgGioD.exe
3080	iyIOGKE.exe
1816	hnexfVD.exe
1156	ifuGyYq.exe
4128	LMfbgty.exe
4040	NjHmOlV.exe
4468	fOpPKnV.exe
1448	GoKQEqJ.exe
628	mMZIzxx.exe
4752	nFYmidB.exe
3700	kOgxOrI.exe
456	EFZUsTv.exe
4496	YImeMZb.exe
2136	uczAcOz.exe
4492	ReJOIeL.exe
2852	MqxiJvt.exe
2932	NRbQEzM.exe
184	qPkLeyb.exe
2020	XPfHLnO.exe
1612	iLmvEzL.exe
2180	fwdFIaL.exe
4368	GdcwPst.exe
4728	HqCvQGk.exe
2188	BoLEjnu.exe
4148	mgoMiUk.exe
1776	YCVObKk.exe
4332	eLiRjzB.exe
1560	yEOrvXr.exe
5100	xpvlMeg.exe
2288	xeBkOJe.exe
2376	AqnVZZr.exe
4444	SMWtIPj.exe
1940	kjvULDm.exe
3592	kaoKYvM.exe
4508	isjViPB.exe
5080	vJsjkCT.exe
3340	qrgYwEu.exe
536	aWpZyix.exe
1880	focsNQu.exe
4352	ZvJjrhr.exe
4284	qdbQELw.exe
3100	DmEODoh.exe
4448	FlRCIgI.exe
3300	BRPsUzD.exe
3308	QsKdotR.exe
4072	UnSWCBm.exe
4860	kXKqIXF.exe
1688	BMKoXXm.exe
2816	xsKsxNL.exe
1972	aOWqCHV.exe
2828	xfisvMy.exe
3712	LBMVjzW.exe
5116	NSlFcgG.exe
1416	TlAdtGz.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3204-0-0x00007FF7982A0000-0x00007FF798692000-memory.dmp	upx
behavioral2/files/0x000b000000023b85-5.dat	upx
behavioral2/files/0x000a000000023b89-10.dat	upx
behavioral2/files/0x000a000000023b8d-36.dat	upx
behavioral2/files/0x000a000000023b8a-18.dat	upx
behavioral2/memory/512-28-0x00007FF74AFC0000-0x00007FF74B3B2000-memory.dmp	upx
behavioral2/memory/4604-13-0x00007FF763D90000-0x00007FF764182000-memory.dmp	upx
behavioral2/files/0x000a000000023b8b-48.dat	upx
behavioral2/files/0x000a000000023b8e-73.dat	upx
behavioral2/files/0x000a000000023b9a-98.dat	upx
behavioral2/files/0x000a000000023b96-134.dat	upx
behavioral2/files/0x000a000000023ba9-176.dat	upx
behavioral2/memory/4468-229-0x00007FF6E9060000-0x00007FF6E9452000-memory.dmp	upx
behavioral2/memory/4040-227-0x00007FF6E7190000-0x00007FF6E7582000-memory.dmp	upx
behavioral2/memory/4128-222-0x00007FF777EF0000-0x00007FF7782E2000-memory.dmp	upx
behavioral2/files/0x000a000000023bac-189.dat	upx
behavioral2/files/0x000a000000023ba2-183.dat	upx
behavioral2/files/0x000a000000023ba1-180.dat	upx
behavioral2/files/0x000a000000023bab-175.dat	upx
behavioral2/files/0x000a000000023ba8-174.dat	upx
behavioral2/files/0x000b000000023b86-173.dat	upx
behavioral2/memory/1156-170-0x00007FF7A4140000-0x00007FF7A4532000-memory.dmp	upx
behavioral2/files/0x000a000000023b9b-165.dat	upx
behavioral2/files/0x000a000000023baa-162.dat	upx
behavioral2/files/0x000a000000023b9e-155.dat	upx
behavioral2/files/0x000a000000023ba7-154.dat	upx
behavioral2/files/0x000a000000023b9d-150.dat	upx
behavioral2/files/0x000a000000023b9f-171.dat	upx
behavioral2/memory/628-251-0x00007FF65CFD0000-0x00007FF65D3C2000-memory.dmp	upx
behavioral2/memory/1816-149-0x00007FF752B50000-0x00007FF752F42000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-148.dat	upx
behavioral2/files/0x000a000000023ba5-147.dat	upx
behavioral2/files/0x000a000000023ba4-146.dat	upx
behavioral2/files/0x000a000000023ba3-145.dat	upx
behavioral2/files/0x000a000000023b97-143.dat	upx
behavioral2/files/0x000a000000023ba0-138.dat	upx
behavioral2/files/0x000a000000023b95-129.dat	upx
behavioral2/files/0x000a000000023b94-126.dat	upx
behavioral2/memory/4972-121-0x00007FF691130000-0x00007FF691522000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-116.dat	upx
behavioral2/files/0x000a000000023b98-110.dat	upx
behavioral2/files/0x000a000000023b92-107.dat	upx
behavioral2/files/0x000a000000023b99-91.dat	upx
behavioral2/files/0x000a000000023b93-90.dat	upx
behavioral2/memory/1360-88-0x00007FF7CAF50000-0x00007FF7CB342000-memory.dmp	upx
behavioral2/files/0x000a000000023b8f-78.dat	upx
behavioral2/files/0x000a000000023b91-99.dat	upx
behavioral2/memory/3684-60-0x00007FF747A00000-0x00007FF747DF2000-memory.dmp	upx
behavioral2/files/0x000a000000023b90-65.dat	upx
behavioral2/memory/1952-64-0x00007FF7EE090000-0x00007FF7EE482000-memory.dmp	upx
behavioral2/memory/1472-41-0x00007FF7449A0000-0x00007FF744D92000-memory.dmp	upx
behavioral2/memory/4752-293-0x00007FF6CEA30000-0x00007FF6CEE22000-memory.dmp	upx
behavioral2/memory/3700-341-0x00007FF7FEFE0000-0x00007FF7FF3D2000-memory.dmp	upx
behavioral2/files/0x000a000000023b8c-25.dat	upx
behavioral2/memory/1268-21-0x00007FF757210000-0x00007FF757602000-memory.dmp	upx
behavioral2/memory/1448-1237-0x00007FF6659E0000-0x00007FF665DD2000-memory.dmp	upx
behavioral2/memory/3080-1058-0x00007FF6AC300000-0x00007FF6AC6F2000-memory.dmp	upx
behavioral2/memory/3064-1057-0x00007FF7ABA60000-0x00007FF7ABE52000-memory.dmp	upx
behavioral2/memory/4832-1034-0x00007FF7FD200000-0x00007FF7FD5F2000-memory.dmp	upx
behavioral2/memory/5084-1032-0x00007FF71E5F0000-0x00007FF71E9E2000-memory.dmp	upx
behavioral2/memory/5084-4261-0x00007FF71E5F0000-0x00007FF71E9E2000-memory.dmp	upx
behavioral2/memory/1268-4264-0x00007FF757210000-0x00007FF757602000-memory.dmp	upx
behavioral2/memory/1472-4269-0x00007FF7449A0000-0x00007FF744D92000-memory.dmp	upx
behavioral2/memory/3064-4272-0x00007FF7ABA60000-0x00007FF7ABE52000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GuEBBTy.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\YnbRpyO.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\gwevWiH.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\LLbNuHu.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\HZCKsXa.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\sRdwpSG.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\pXyXRcS.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\sxoNtUa.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\RQeOQXj.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\XKUluKg.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\aLSYVrp.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\GYjGOMs.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\kdmAmIf.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\HJPHYDK.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\MeOcwwp.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\jEbARWK.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\abIQPUT.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\DcFqckx.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\lovoZqv.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\QKfFqCf.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\NBtNOMU.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\tQbnvxG.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\WTDdPeV.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\MpuemEO.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\tVQogxg.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\gkGcAHL.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\WhcXWJs.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\KsztmkM.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\SqzCLnB.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\JcORmva.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\PJzdKSj.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\cEoTnSs.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\VrLjyXf.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\eBuRKDw.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\XvSrUVz.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\xHrevPH.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\VOLQolf.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\MuSphxY.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\qkMBDRw.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\VaGJtYt.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\hXmuuKk.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\EyPqXhk.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\spFNdbh.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\mDYyPIv.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\LHPcBXz.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\XFqKpne.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\qKFtxUw.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\GmfzgwY.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\TWhiZhX.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\gwBdMAG.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\nKmQnSG.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\ymGUuqn.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\JsBbFAq.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\WLjGDfS.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\eGgXPuE.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\jvunWqS.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\lbIkoml.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\anInfDU.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\RXaJYag.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\YkeytLC.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\BErqTzH.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\GCtlSSi.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\tcqFHuh.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
File created	C:\Windows\System\XMnEewr.exe	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4804	powershell.exe
4804	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
Token: SeDebugPrivilege	4804	powershell.exe
Token: SeLockMemoryPrivilege	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 4804	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	85
PID 3204 wrote to memory of 4804	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	85
PID 3204 wrote to memory of 4604	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	86
PID 3204 wrote to memory of 4604	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	86
PID 3204 wrote to memory of 1268	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	87
PID 3204 wrote to memory of 1268	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	87
PID 3204 wrote to memory of 512	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	88
PID 3204 wrote to memory of 512	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	88
PID 3204 wrote to memory of 1472	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	89
PID 3204 wrote to memory of 1472	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	89
PID 3204 wrote to memory of 5084	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	90
PID 3204 wrote to memory of 5084	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	90
PID 3204 wrote to memory of 4832	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	91
PID 3204 wrote to memory of 4832	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	91
PID 3204 wrote to memory of 3684	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	92
PID 3204 wrote to memory of 3684	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	92
PID 3204 wrote to memory of 1952	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	93
PID 3204 wrote to memory of 1952	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	93
PID 3204 wrote to memory of 3064	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	94
PID 3204 wrote to memory of 3064	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	94
PID 3204 wrote to memory of 1360	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	95
PID 3204 wrote to memory of 1360	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	95
PID 3204 wrote to memory of 4972	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	96
PID 3204 wrote to memory of 4972	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	96
PID 3204 wrote to memory of 3080	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	97
PID 3204 wrote to memory of 3080	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	97
PID 3204 wrote to memory of 1816	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	98
PID 3204 wrote to memory of 1816	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	98
PID 3204 wrote to memory of 1156	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	99
PID 3204 wrote to memory of 1156	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	99
PID 3204 wrote to memory of 4128	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	100
PID 3204 wrote to memory of 4128	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	100
PID 3204 wrote to memory of 4040	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	101
PID 3204 wrote to memory of 4040	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	101
PID 3204 wrote to memory of 4468	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	102
PID 3204 wrote to memory of 4468	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	102
PID 3204 wrote to memory of 1448	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	103
PID 3204 wrote to memory of 1448	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	103
PID 3204 wrote to memory of 628	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	104
PID 3204 wrote to memory of 628	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	104
PID 3204 wrote to memory of 4752	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	105
PID 3204 wrote to memory of 4752	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	105
PID 3204 wrote to memory of 3700	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	106
PID 3204 wrote to memory of 3700	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	106
PID 3204 wrote to memory of 456	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	107
PID 3204 wrote to memory of 456	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	107
PID 3204 wrote to memory of 4496	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	108
PID 3204 wrote to memory of 4496	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	108
PID 3204 wrote to memory of 2136	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	109
PID 3204 wrote to memory of 2136	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	109
PID 3204 wrote to memory of 4492	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	110
PID 3204 wrote to memory of 4492	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	110
PID 3204 wrote to memory of 2852	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	111
PID 3204 wrote to memory of 2852	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	111
PID 3204 wrote to memory of 2932	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	112
PID 3204 wrote to memory of 2932	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	112
PID 3204 wrote to memory of 184	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	113
PID 3204 wrote to memory of 184	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	113
PID 3204 wrote to memory of 2020	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	114
PID 3204 wrote to memory of 2020	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	114
PID 3204 wrote to memory of 1612	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	115
PID 3204 wrote to memory of 1612	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	115
PID 3204 wrote to memory of 2180	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	116
PID 3204 wrote to memory of 2180	3204	0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe	116

C:\Users\Admin\AppData\Local\Temp\0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b0df83670739b620f6b43c7d4a516a7_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4804
- C:\Windows\System\vItPxsq.exe
  C:\Windows\System\vItPxsq.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\EXGFOjA.exe
  C:\Windows\System\EXGFOjA.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\NXxvYpN.exe
  C:\Windows\System\NXxvYpN.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\TvgjNek.exe
  C:\Windows\System\TvgjNek.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\FxDaFif.exe
  C:\Windows\System\FxDaFif.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\hvbhrit.exe
  C:\Windows\System\hvbhrit.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\UTvTlvF.exe
  C:\Windows\System\UTvTlvF.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\LrAylmc.exe
  C:\Windows\System\LrAylmc.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\ToXJoYC.exe
  C:\Windows\System\ToXJoYC.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\wGHVKjV.exe
  C:\Windows\System\wGHVKjV.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\PPgGioD.exe
  C:\Windows\System\PPgGioD.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\iyIOGKE.exe
  C:\Windows\System\iyIOGKE.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\hnexfVD.exe
  C:\Windows\System\hnexfVD.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\ifuGyYq.exe
  C:\Windows\System\ifuGyYq.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\LMfbgty.exe
  C:\Windows\System\LMfbgty.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\NjHmOlV.exe
  C:\Windows\System\NjHmOlV.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\fOpPKnV.exe
  C:\Windows\System\fOpPKnV.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\GoKQEqJ.exe
  C:\Windows\System\GoKQEqJ.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\mMZIzxx.exe
  C:\Windows\System\mMZIzxx.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\nFYmidB.exe
  C:\Windows\System\nFYmidB.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\kOgxOrI.exe
  C:\Windows\System\kOgxOrI.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\EFZUsTv.exe
  C:\Windows\System\EFZUsTv.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\YImeMZb.exe
  C:\Windows\System\YImeMZb.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\uczAcOz.exe
  C:\Windows\System\uczAcOz.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\ReJOIeL.exe
  C:\Windows\System\ReJOIeL.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\MqxiJvt.exe
  C:\Windows\System\MqxiJvt.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\NRbQEzM.exe
  C:\Windows\System\NRbQEzM.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\qPkLeyb.exe
  C:\Windows\System\qPkLeyb.exe
  2⤵
  - Executes dropped EXE
  PID:184
- C:\Windows\System\XPfHLnO.exe
  C:\Windows\System\XPfHLnO.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\iLmvEzL.exe
  C:\Windows\System\iLmvEzL.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\fwdFIaL.exe
  C:\Windows\System\fwdFIaL.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\GdcwPst.exe
  C:\Windows\System\GdcwPst.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\YCVObKk.exe
  C:\Windows\System\YCVObKk.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\HqCvQGk.exe
  C:\Windows\System\HqCvQGk.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\BoLEjnu.exe
  C:\Windows\System\BoLEjnu.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\mgoMiUk.exe
  C:\Windows\System\mgoMiUk.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\eLiRjzB.exe
  C:\Windows\System\eLiRjzB.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\yEOrvXr.exe
  C:\Windows\System\yEOrvXr.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\xpvlMeg.exe
  C:\Windows\System\xpvlMeg.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\xeBkOJe.exe
  C:\Windows\System\xeBkOJe.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\AqnVZZr.exe
  C:\Windows\System\AqnVZZr.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\SMWtIPj.exe
  C:\Windows\System\SMWtIPj.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\kjvULDm.exe
  C:\Windows\System\kjvULDm.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\kaoKYvM.exe
  C:\Windows\System\kaoKYvM.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\isjViPB.exe
  C:\Windows\System\isjViPB.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\vJsjkCT.exe
  C:\Windows\System\vJsjkCT.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\qrgYwEu.exe
  C:\Windows\System\qrgYwEu.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\aWpZyix.exe
  C:\Windows\System\aWpZyix.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\focsNQu.exe
  C:\Windows\System\focsNQu.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\ZvJjrhr.exe
  C:\Windows\System\ZvJjrhr.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\qdbQELw.exe
  C:\Windows\System\qdbQELw.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\DmEODoh.exe
  C:\Windows\System\DmEODoh.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\FlRCIgI.exe
  C:\Windows\System\FlRCIgI.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\BRPsUzD.exe
  C:\Windows\System\BRPsUzD.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\QsKdotR.exe
  C:\Windows\System\QsKdotR.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\UnSWCBm.exe
  C:\Windows\System\UnSWCBm.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\kXKqIXF.exe
  C:\Windows\System\kXKqIXF.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\BMKoXXm.exe
  C:\Windows\System\BMKoXXm.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\xsKsxNL.exe
  C:\Windows\System\xsKsxNL.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\aOWqCHV.exe
  C:\Windows\System\aOWqCHV.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\xfisvMy.exe
  C:\Windows\System\xfisvMy.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\LBMVjzW.exe
  C:\Windows\System\LBMVjzW.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\NSlFcgG.exe
  C:\Windows\System\NSlFcgG.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\TlAdtGz.exe
  C:\Windows\System\TlAdtGz.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\TwxfXbf.exe
  C:\Windows\System\TwxfXbf.exe
  2⤵
  PID:3756
- C:\Windows\System\kZsvuNV.exe
  C:\Windows\System\kZsvuNV.exe
  2⤵
  PID:4056
- C:\Windows\System\ypAxiJP.exe
  C:\Windows\System\ypAxiJP.exe
  2⤵
  PID:3288
- C:\Windows\System\sIreniT.exe
  C:\Windows\System\sIreniT.exe
  2⤵
  PID:3680
- C:\Windows\System\UXhePvS.exe
  C:\Windows\System\UXhePvS.exe
  2⤵
  PID:4456
- C:\Windows\System\mQJKIQO.exe
  C:\Windows\System\mQJKIQO.exe
  2⤵
  PID:5148
- C:\Windows\System\jaNccqk.exe
  C:\Windows\System\jaNccqk.exe
  2⤵
  PID:5168
- C:\Windows\System\nnOqRni.exe
  C:\Windows\System\nnOqRni.exe
  2⤵
  PID:5192
- C:\Windows\System\JvbNtbv.exe
  C:\Windows\System\JvbNtbv.exe
  2⤵
  PID:5216
- C:\Windows\System\HKoGCAR.exe
  C:\Windows\System\HKoGCAR.exe
  2⤵
  PID:5232
- C:\Windows\System\dCCgkwr.exe
  C:\Windows\System\dCCgkwr.exe
  2⤵
  PID:5248
- C:\Windows\System\twyjPDh.exe
  C:\Windows\System\twyjPDh.exe
  2⤵
  PID:5264
- C:\Windows\System\hheDINL.exe
  C:\Windows\System\hheDINL.exe
  2⤵
  PID:5288
- C:\Windows\System\QuGCBxt.exe
  C:\Windows\System\QuGCBxt.exe
  2⤵
  PID:5304
- C:\Windows\System\KLbqDZH.exe
  C:\Windows\System\KLbqDZH.exe
  2⤵
  PID:5352
- C:\Windows\System\uSGMEUH.exe
  C:\Windows\System\uSGMEUH.exe
  2⤵
  PID:5368
- C:\Windows\System\ISJRnbu.exe
  C:\Windows\System\ISJRnbu.exe
  2⤵
  PID:5388
- C:\Windows\System\waLKEVn.exe
  C:\Windows\System\waLKEVn.exe
  2⤵
  PID:5404
- C:\Windows\System\uINQUbm.exe
  C:\Windows\System\uINQUbm.exe
  2⤵
  PID:5420
- C:\Windows\System\PAFSQEJ.exe
  C:\Windows\System\PAFSQEJ.exe
  2⤵
  PID:5436
- C:\Windows\System\UssfwTQ.exe
  C:\Windows\System\UssfwTQ.exe
  2⤵
  PID:5452
- C:\Windows\System\WuewTJj.exe
  C:\Windows\System\WuewTJj.exe
  2⤵
  PID:5468
- C:\Windows\System\ULyXSBH.exe
  C:\Windows\System\ULyXSBH.exe
  2⤵
  PID:5496
- C:\Windows\System\QBDfNbK.exe
  C:\Windows\System\QBDfNbK.exe
  2⤵
  PID:5516
- C:\Windows\System\xuWiVms.exe
  C:\Windows\System\xuWiVms.exe
  2⤵
  PID:5556
- C:\Windows\System\DwnYrmv.exe
  C:\Windows\System\DwnYrmv.exe
  2⤵
  PID:5572
- C:\Windows\System\zxQjEtq.exe
  C:\Windows\System\zxQjEtq.exe
  2⤵
  PID:5588
- C:\Windows\System\tBwUFcZ.exe
  C:\Windows\System\tBwUFcZ.exe
  2⤵
  PID:5616
- C:\Windows\System\WVZtQUz.exe
  C:\Windows\System\WVZtQUz.exe
  2⤵
  PID:5640
- C:\Windows\System\KWYondC.exe
  C:\Windows\System\KWYondC.exe
  2⤵
  PID:5660
- C:\Windows\System\yyVfaOL.exe
  C:\Windows\System\yyVfaOL.exe
  2⤵
  PID:5676
- C:\Windows\System\gzUwhDY.exe
  C:\Windows\System\gzUwhDY.exe
  2⤵
  PID:5692
- C:\Windows\System\eswWYIJ.exe
  C:\Windows\System\eswWYIJ.exe
  2⤵
  PID:5708
- C:\Windows\System\mjkCosa.exe
  C:\Windows\System\mjkCosa.exe
  2⤵
  PID:5780
- C:\Windows\System\wxeUlDc.exe
  C:\Windows\System\wxeUlDc.exe
  2⤵
  PID:5800
- C:\Windows\System\anefmrf.exe
  C:\Windows\System\anefmrf.exe
  2⤵
  PID:5824
- C:\Windows\System\WSBwDGn.exe
  C:\Windows\System\WSBwDGn.exe
  2⤵
  PID:5844
- C:\Windows\System\WvakDQH.exe
  C:\Windows\System\WvakDQH.exe
  2⤵
  PID:5864
- C:\Windows\System\AnFkQdh.exe
  C:\Windows\System\AnFkQdh.exe
  2⤵
  PID:5904
- C:\Windows\System\BxLhPyV.exe
  C:\Windows\System\BxLhPyV.exe
  2⤵
  PID:6036
- C:\Windows\System\LhDIEpm.exe
  C:\Windows\System\LhDIEpm.exe
  2⤵
  PID:6060
- C:\Windows\System\SptymmJ.exe
  C:\Windows\System\SptymmJ.exe
  2⤵
  PID:6084
- C:\Windows\System\LHaCMdk.exe
  C:\Windows\System\LHaCMdk.exe
  2⤵
  PID:6104
- C:\Windows\System\vbzBaxY.exe
  C:\Windows\System\vbzBaxY.exe
  2⤵
  PID:6124
- C:\Windows\System\OdThazB.exe
  C:\Windows\System\OdThazB.exe
  2⤵
  PID:4892
- C:\Windows\System\GXtFsnz.exe
  C:\Windows\System\GXtFsnz.exe
  2⤵
  PID:3424
- C:\Windows\System\fwqEqfH.exe
  C:\Windows\System\fwqEqfH.exe
  2⤵
  PID:2992
- C:\Windows\System\AKxSyDm.exe
  C:\Windows\System\AKxSyDm.exe
  2⤵
  PID:3992
- C:\Windows\System\ymKrRLe.exe
  C:\Windows\System\ymKrRLe.exe
  2⤵
  PID:1740
- C:\Windows\System\HAuCgEW.exe
  C:\Windows\System\HAuCgEW.exe
  2⤵
  PID:2164
- C:\Windows\System\OpCtihu.exe
  C:\Windows\System\OpCtihu.exe
  2⤵
  PID:4240
- C:\Windows\System\kHYfNVR.exe
  C:\Windows\System\kHYfNVR.exe
  2⤵
  PID:1936
- C:\Windows\System\izTMUTx.exe
  C:\Windows\System\izTMUTx.exe
  2⤵
  PID:4600
- C:\Windows\System\srjdiNz.exe
  C:\Windows\System\srjdiNz.exe
  2⤵
  PID:4160
- C:\Windows\System\oeWMbCb.exe
  C:\Windows\System\oeWMbCb.exe
  2⤵
  PID:5376
- C:\Windows\System\yPuzICL.exe
  C:\Windows\System\yPuzICL.exe
  2⤵
  PID:5212
- C:\Windows\System\onLoyAc.exe
  C:\Windows\System\onLoyAc.exe
  2⤵
  PID:5656
- C:\Windows\System\RTwGvoT.exe
  C:\Windows\System\RTwGvoT.exe
  2⤵
  PID:4756
- C:\Windows\System\MpRaLFQ.exe
  C:\Windows\System\MpRaLFQ.exe
  2⤵
  PID:1920
- C:\Windows\System\tAXhzKM.exe
  C:\Windows\System\tAXhzKM.exe
  2⤵
  PID:5364
- C:\Windows\System\fsNjcJv.exe
  C:\Windows\System\fsNjcJv.exe
  2⤵
  PID:5180
- C:\Windows\System\WJXMbVn.exe
  C:\Windows\System\WJXMbVn.exe
  2⤵
  PID:2532
- C:\Windows\System\eSUDefl.exe
  C:\Windows\System\eSUDefl.exe
  2⤵
  PID:4588
- C:\Windows\System\mcKxJTY.exe
  C:\Windows\System\mcKxJTY.exe
  2⤵
  PID:5200
- C:\Windows\System\YgmrzJk.exe
  C:\Windows\System\YgmrzJk.exe
  2⤵
  PID:2704
- C:\Windows\System\aApIqbz.exe
  C:\Windows\System\aApIqbz.exe
  2⤵
  PID:5240
- C:\Windows\System\scaBlsK.exe
  C:\Windows\System\scaBlsK.exe
  2⤵
  PID:5524
- C:\Windows\System\GRouTQt.exe
  C:\Windows\System\GRouTQt.exe
  2⤵
  PID:3548
- C:\Windows\System\RrrMODq.exe
  C:\Windows\System\RrrMODq.exe
  2⤵
  PID:4836
- C:\Windows\System\IgnbDcy.exe
  C:\Windows\System\IgnbDcy.exe
  2⤵
  PID:1772
- C:\Windows\System\OPgRQbH.exe
  C:\Windows\System\OPgRQbH.exe
  2⤵
  PID:4608
- C:\Windows\System\CVPlynO.exe
  C:\Windows\System\CVPlynO.exe
  2⤵
  PID:5300
- C:\Windows\System\UmHNprn.exe
  C:\Windows\System\UmHNprn.exe
  2⤵
  PID:5976
- C:\Windows\System\oxdaHZC.exe
  C:\Windows\System\oxdaHZC.exe
  2⤵
  PID:5464
- C:\Windows\System\qmGxqIU.exe
  C:\Windows\System\qmGxqIU.exe
  2⤵
  PID:5412
- C:\Windows\System\bpelxVj.exe
  C:\Windows\System\bpelxVj.exe
  2⤵
  PID:5428
- C:\Windows\System\oQBVBMM.exe
  C:\Windows\System\oQBVBMM.exe
  2⤵
  PID:5612
- C:\Windows\System\DwAPmSw.exe
  C:\Windows\System\DwAPmSw.exe
  2⤵
  PID:5872
- C:\Windows\System\QVYqhbX.exe
  C:\Windows\System\QVYqhbX.exe
  2⤵
  PID:5716
- C:\Windows\System\tyLgqDS.exe
  C:\Windows\System\tyLgqDS.exe
  2⤵
  PID:3888
- C:\Windows\System\ReCkSkB.exe
  C:\Windows\System\ReCkSkB.exe
  2⤵
  PID:920
- C:\Windows\System\legvRAz.exe
  C:\Windows\System\legvRAz.exe
  2⤵
  PID:2244
- C:\Windows\System\xCPWpBY.exe
  C:\Windows\System\xCPWpBY.exe
  2⤵
  PID:2320
- C:\Windows\System\KLgTtYI.exe
  C:\Windows\System\KLgTtYI.exe
  2⤵
  PID:1372
- C:\Windows\System\DTIIejQ.exe
  C:\Windows\System\DTIIejQ.exe
  2⤵
  PID:2312
- C:\Windows\System\UedlpFO.exe
  C:\Windows\System\UedlpFO.exe
  2⤵
  PID:1960
- C:\Windows\System\wqmoCPN.exe
  C:\Windows\System\wqmoCPN.exe
  2⤵
  PID:4820
- C:\Windows\System\xIbZvIr.exe
  C:\Windows\System\xIbZvIr.exe
  2⤵
  PID:4632
- C:\Windows\System\ktMPMwo.exe
  C:\Windows\System\ktMPMwo.exe
  2⤵
  PID:2316
- C:\Windows\System\QoDZihe.exe
  C:\Windows\System\QoDZihe.exe
  2⤵
  PID:3032
- C:\Windows\System\YqlhomC.exe
  C:\Windows\System\YqlhomC.exe
  2⤵
  PID:2468
- C:\Windows\System\FjWyDIm.exe
  C:\Windows\System\FjWyDIm.exe
  2⤵
  PID:4544
- C:\Windows\System\nJnCSlu.exe
  C:\Windows\System\nJnCSlu.exe
  2⤵
  PID:5960
- C:\Windows\System\RJvpEYc.exe
  C:\Windows\System\RJvpEYc.exe
  2⤵
  PID:6172
- C:\Windows\System\kJqyWsB.exe
  C:\Windows\System\kJqyWsB.exe
  2⤵
  PID:6196
- C:\Windows\System\hjYDsmn.exe
  C:\Windows\System\hjYDsmn.exe
  2⤵
  PID:6220
- C:\Windows\System\xSnWEoJ.exe
  C:\Windows\System\xSnWEoJ.exe
  2⤵
  PID:6240
- C:\Windows\System\bNRhICF.exe
  C:\Windows\System\bNRhICF.exe
  2⤵
  PID:6268
- C:\Windows\System\djbKExw.exe
  C:\Windows\System\djbKExw.exe
  2⤵
  PID:6292
- C:\Windows\System\FeVrRMV.exe
  C:\Windows\System\FeVrRMV.exe
  2⤵
  PID:6308
- C:\Windows\System\IXspHPC.exe
  C:\Windows\System\IXspHPC.exe
  2⤵
  PID:6336
- C:\Windows\System\ClEBhjD.exe
  C:\Windows\System\ClEBhjD.exe
  2⤵
  PID:6352
- C:\Windows\System\ntJQFju.exe
  C:\Windows\System\ntJQFju.exe
  2⤵
  PID:6380
- C:\Windows\System\SyQtzdh.exe
  C:\Windows\System\SyQtzdh.exe
  2⤵
  PID:6412
- C:\Windows\System\JbQagZX.exe
  C:\Windows\System\JbQagZX.exe
  2⤵
  PID:6444
- C:\Windows\System\UMfBspQ.exe
  C:\Windows\System\UMfBspQ.exe
  2⤵
  PID:6480
- C:\Windows\System\lPEasOg.exe
  C:\Windows\System\lPEasOg.exe
  2⤵
  PID:6500
- C:\Windows\System\iYYdJoG.exe
  C:\Windows\System\iYYdJoG.exe
  2⤵
  PID:6536
- C:\Windows\System\vLdTfGL.exe
  C:\Windows\System\vLdTfGL.exe
  2⤵
  PID:6552
- C:\Windows\System\MtPIaOf.exe
  C:\Windows\System\MtPIaOf.exe
  2⤵
  PID:6572
- C:\Windows\System\TUGcnjK.exe
  C:\Windows\System\TUGcnjK.exe
  2⤵
  PID:6592
- C:\Windows\System\ojsWPEE.exe
  C:\Windows\System\ojsWPEE.exe
  2⤵
  PID:6608
- C:\Windows\System\tjKKrPB.exe
  C:\Windows\System\tjKKrPB.exe
  2⤵
  PID:6640
- C:\Windows\System\SaFkteC.exe
  C:\Windows\System\SaFkteC.exe
  2⤵
  PID:6656
- C:\Windows\System\EVlhXDZ.exe
  C:\Windows\System\EVlhXDZ.exe
  2⤵
  PID:6688
- C:\Windows\System\OMaYIYQ.exe
  C:\Windows\System\OMaYIYQ.exe
  2⤵
  PID:6704
- C:\Windows\System\Crnkgkl.exe
  C:\Windows\System\Crnkgkl.exe
  2⤵
  PID:6720
- C:\Windows\System\ABdBnAR.exe
  C:\Windows\System\ABdBnAR.exe
  2⤵
  PID:6736
- C:\Windows\System\IJvDMJX.exe
  C:\Windows\System\IJvDMJX.exe
  2⤵
  PID:6752
- C:\Windows\System\iwKmJaA.exe
  C:\Windows\System\iwKmJaA.exe
  2⤵
  PID:6772
- C:\Windows\System\HeerKaB.exe
  C:\Windows\System\HeerKaB.exe
  2⤵
  PID:6792
- C:\Windows\System\joqljwo.exe
  C:\Windows\System\joqljwo.exe
  2⤵
  PID:6812
- C:\Windows\System\WfHLWtB.exe
  C:\Windows\System\WfHLWtB.exe
  2⤵
  PID:6828
- C:\Windows\System\NORZaCH.exe
  C:\Windows\System\NORZaCH.exe
  2⤵
  PID:6844
- C:\Windows\System\LWixKKi.exe
  C:\Windows\System\LWixKKi.exe
  2⤵
  PID:6860
- C:\Windows\System\uTWjZZu.exe
  C:\Windows\System\uTWjZZu.exe
  2⤵
  PID:6880
- C:\Windows\System\SaIeRQf.exe
  C:\Windows\System\SaIeRQf.exe
  2⤵
  PID:6900
- C:\Windows\System\ANrLxUy.exe
  C:\Windows\System\ANrLxUy.exe
  2⤵
  PID:6916
- C:\Windows\System\tzgsSLE.exe
  C:\Windows\System\tzgsSLE.exe
  2⤵
  PID:6936
- C:\Windows\System\aRmUGEX.exe
  C:\Windows\System\aRmUGEX.exe
  2⤵
  PID:6972
- C:\Windows\System\sCbRnrG.exe
  C:\Windows\System\sCbRnrG.exe
  2⤵
  PID:7000
- C:\Windows\System\nidjdvD.exe
  C:\Windows\System\nidjdvD.exe
  2⤵
  PID:7024
- C:\Windows\System\YAvVsbc.exe
  C:\Windows\System\YAvVsbc.exe
  2⤵
  PID:7044
- C:\Windows\System\OkrtZtO.exe
  C:\Windows\System\OkrtZtO.exe
  2⤵
  PID:7064
- C:\Windows\System\BVwrDtl.exe
  C:\Windows\System\BVwrDtl.exe
  2⤵
  PID:7088
- C:\Windows\System\KZYFvqy.exe
  C:\Windows\System\KZYFvqy.exe
  2⤵
  PID:7112
- C:\Windows\System\PoROuJS.exe
  C:\Windows\System\PoROuJS.exe
  2⤵
  PID:7132
- C:\Windows\System\bUIADuz.exe
  C:\Windows\System\bUIADuz.exe
  2⤵
  PID:7152
- C:\Windows\System\lzilRze.exe
  C:\Windows\System\lzilRze.exe
  2⤵
  PID:1376
- C:\Windows\System\eebrmFP.exe
  C:\Windows\System\eebrmFP.exe
  2⤵
  PID:5648
- C:\Windows\System\YlTgKkm.exe
  C:\Windows\System\YlTgKkm.exe
  2⤵
  PID:5796
- C:\Windows\System\lFaxBWF.exe
  C:\Windows\System\lFaxBWF.exe
  2⤵
  PID:5184
- C:\Windows\System\XvaetKu.exe
  C:\Windows\System\XvaetKu.exe
  2⤵
  PID:5900
- C:\Windows\System\uokfwpf.exe
  C:\Windows\System\uokfwpf.exe
  2⤵
  PID:5204
- C:\Windows\System\SFIoTcg.exe
  C:\Windows\System\SFIoTcg.exe
  2⤵
  PID:2696
- C:\Windows\System\ngTHKuI.exe
  C:\Windows\System\ngTHKuI.exe
  2⤵
  PID:4212
- C:\Windows\System\SOJfPno.exe
  C:\Windows\System\SOJfPno.exe
  2⤵
  PID:5448
- C:\Windows\System\axgRvaj.exe
  C:\Windows\System\axgRvaj.exe
  2⤵
  PID:5568
- C:\Windows\System\cUGYEzm.exe
  C:\Windows\System\cUGYEzm.exe
  2⤵
  PID:5924
- C:\Windows\System\KqmGpTc.exe
  C:\Windows\System\KqmGpTc.exe
  2⤵
  PID:4900
- C:\Windows\System\MIvmIfb.exe
  C:\Windows\System\MIvmIfb.exe
  2⤵
  PID:752
- C:\Windows\System\FQGCYhV.exe
  C:\Windows\System\FQGCYhV.exe
  2⤵
  PID:5000
- C:\Windows\System\sMDIFTT.exe
  C:\Windows\System\sMDIFTT.exe
  2⤵
  PID:1600
- C:\Windows\System\uhOgsve.exe
  C:\Windows\System\uhOgsve.exe
  2⤵
  PID:4092
- C:\Windows\System\WRwFwQq.exe
  C:\Windows\System\WRwFwQq.exe
  2⤵
  PID:6284
- C:\Windows\System\RdEIkZm.exe
  C:\Windows\System\RdEIkZm.exe
  2⤵
  PID:6368
- C:\Windows\System\CCchsth.exe
  C:\Windows\System\CCchsth.exe
  2⤵
  PID:6476
- C:\Windows\System\NffqHVp.exe
  C:\Windows\System\NffqHVp.exe
  2⤵
  PID:6532
- C:\Windows\System\bLRVlgH.exe
  C:\Windows\System\bLRVlgH.exe
  2⤵
  PID:6580
- C:\Windows\System\zhOVuok.exe
  C:\Windows\System\zhOVuok.exe
  2⤵
  PID:6624
- C:\Windows\System\svPXKaZ.exe
  C:\Windows\System\svPXKaZ.exe
  2⤵
  PID:6120
- C:\Windows\System\bUtOonx.exe
  C:\Windows\System\bUtOonx.exe
  2⤵
  PID:2412
- C:\Windows\System\RrAOqEN.exe
  C:\Windows\System\RrAOqEN.exe
  2⤵
  PID:5732
- C:\Windows\System\xExYHiC.exe
  C:\Windows\System\xExYHiC.exe
  2⤵
  PID:5668
- C:\Windows\System\QdzxkZt.exe
  C:\Windows\System\QdzxkZt.exe
  2⤵
  PID:4512
- C:\Windows\System\qbOYezy.exe
  C:\Windows\System\qbOYezy.exe
  2⤵
  PID:1364
- C:\Windows\System\CiqEVux.exe
  C:\Windows\System\CiqEVux.exe
  2⤵
  PID:7188
- C:\Windows\System\eljXUlW.exe
  C:\Windows\System\eljXUlW.exe
  2⤵
  PID:7208
- C:\Windows\System\glrZPYw.exe
  C:\Windows\System\glrZPYw.exe
  2⤵
  PID:7228
- C:\Windows\System\EVEbzfc.exe
  C:\Windows\System\EVEbzfc.exe
  2⤵
  PID:7252
- C:\Windows\System\NWJFkXs.exe
  C:\Windows\System\NWJFkXs.exe
  2⤵
  PID:7268
- C:\Windows\System\xRFSnAc.exe
  C:\Windows\System\xRFSnAc.exe
  2⤵
  PID:7284
- C:\Windows\System\zqvYwBW.exe
  C:\Windows\System\zqvYwBW.exe
  2⤵
  PID:7300
- C:\Windows\System\rmakTiq.exe
  C:\Windows\System\rmakTiq.exe
  2⤵
  PID:7316
- C:\Windows\System\QsfIyxZ.exe
  C:\Windows\System\QsfIyxZ.exe
  2⤵
  PID:7332
- C:\Windows\System\COfMXsH.exe
  C:\Windows\System\COfMXsH.exe
  2⤵
  PID:7348
- C:\Windows\System\QMfijJL.exe
  C:\Windows\System\QMfijJL.exe
  2⤵
  PID:7364
- C:\Windows\System\oGcdKEL.exe
  C:\Windows\System\oGcdKEL.exe
  2⤵
  PID:7392
- C:\Windows\System\gMmfpUR.exe
  C:\Windows\System\gMmfpUR.exe
  2⤵
  PID:7408
- C:\Windows\System\fswuyFZ.exe
  C:\Windows\System\fswuyFZ.exe
  2⤵
  PID:7424
- C:\Windows\System\UUzPNWd.exe
  C:\Windows\System\UUzPNWd.exe
  2⤵
  PID:7448
- C:\Windows\System\AjMniUT.exe
  C:\Windows\System\AjMniUT.exe
  2⤵
  PID:7468
- C:\Windows\System\IvlALVK.exe
  C:\Windows\System\IvlALVK.exe
  2⤵
  PID:7492
- C:\Windows\System\UXQsrjL.exe
  C:\Windows\System\UXQsrjL.exe
  2⤵
  PID:7512
- C:\Windows\System\nhOuxSy.exe
  C:\Windows\System\nhOuxSy.exe
  2⤵
  PID:7536
- C:\Windows\System\uCHUsND.exe
  C:\Windows\System\uCHUsND.exe
  2⤵
  PID:7556
- C:\Windows\System\JXICggQ.exe
  C:\Windows\System\JXICggQ.exe
  2⤵
  PID:7580
- C:\Windows\System\JcDOHIc.exe
  C:\Windows\System\JcDOHIc.exe
  2⤵
  PID:7608
- C:\Windows\System\BmLOVuq.exe
  C:\Windows\System\BmLOVuq.exe
  2⤵
  PID:7624
- C:\Windows\System\Weanpnx.exe
  C:\Windows\System\Weanpnx.exe
  2⤵
  PID:7648
- C:\Windows\System\vuByGCZ.exe
  C:\Windows\System\vuByGCZ.exe
  2⤵
  PID:7672
- C:\Windows\System\QHHAmQK.exe
  C:\Windows\System\QHHAmQK.exe
  2⤵
  PID:7696
- C:\Windows\System\KLzFfkY.exe
  C:\Windows\System\KLzFfkY.exe
  2⤵
  PID:7720
- C:\Windows\System\BryPCpz.exe
  C:\Windows\System\BryPCpz.exe
  2⤵
  PID:7740
- C:\Windows\System\rIrjOtE.exe
  C:\Windows\System\rIrjOtE.exe
  2⤵
  PID:7768
- C:\Windows\System\heUoVUY.exe
  C:\Windows\System\heUoVUY.exe
  2⤵
  PID:7784
- C:\Windows\System\ZrfoSqe.exe
  C:\Windows\System\ZrfoSqe.exe
  2⤵
  PID:7812
- C:\Windows\System\UsUwccQ.exe
  C:\Windows\System\UsUwccQ.exe
  2⤵
  PID:7828
- C:\Windows\System\QyWSQdu.exe
  C:\Windows\System\QyWSQdu.exe
  2⤵
  PID:7856
- C:\Windows\System\NyfJPZI.exe
  C:\Windows\System\NyfJPZI.exe
  2⤵
  PID:7876
- C:\Windows\System\yqQMqIh.exe
  C:\Windows\System\yqQMqIh.exe
  2⤵
  PID:7896
- C:\Windows\System\UurFfWS.exe
  C:\Windows\System\UurFfWS.exe
  2⤵
  PID:7928
- C:\Windows\System\Ordbrey.exe
  C:\Windows\System\Ordbrey.exe
  2⤵
  PID:7948
- C:\Windows\System\NyqqJai.exe
  C:\Windows\System\NyqqJai.exe
  2⤵
  PID:7972
- C:\Windows\System\LfdTLri.exe
  C:\Windows\System\LfdTLri.exe
  2⤵
  PID:7992
- C:\Windows\System\EbmzLnS.exe
  C:\Windows\System\EbmzLnS.exe
  2⤵
  PID:8012
- C:\Windows\System\aZBbzeE.exe
  C:\Windows\System\aZBbzeE.exe
  2⤵
  PID:8040
- C:\Windows\System\JwsVnbR.exe
  C:\Windows\System\JwsVnbR.exe
  2⤵
  PID:8060
- C:\Windows\System\jsXVOQO.exe
  C:\Windows\System\jsXVOQO.exe
  2⤵
  PID:8084
- C:\Windows\System\IzBNwgl.exe
  C:\Windows\System\IzBNwgl.exe
  2⤵
  PID:8104
- C:\Windows\System\ZHyfdUt.exe
  C:\Windows\System\ZHyfdUt.exe
  2⤵
  PID:8128
- C:\Windows\System\aUtjsBU.exe
  C:\Windows\System\aUtjsBU.exe
  2⤵
  PID:8152
- C:\Windows\System\qKXmnWt.exe
  C:\Windows\System\qKXmnWt.exe
  2⤵
  PID:8176
- C:\Windows\System\YBTQTTF.exe
  C:\Windows\System\YBTQTTF.exe
  2⤵
  PID:6784
- C:\Windows\System\AiyFpEQ.exe
  C:\Windows\System\AiyFpEQ.exe
  2⤵
  PID:548
- C:\Windows\System\miktSRc.exe
  C:\Windows\System\miktSRc.exe
  2⤵
  PID:3612
- C:\Windows\System\kTbdwwJ.exe
  C:\Windows\System\kTbdwwJ.exe
  2⤵
  PID:6856
- C:\Windows\System\nQppqdX.exe
  C:\Windows\System\nQppqdX.exe
  2⤵
  PID:5032
- C:\Windows\System\zWPHpBE.exe
  C:\Windows\System\zWPHpBE.exe
  2⤵
  PID:6924
- C:\Windows\System\RaTzWEx.exe
  C:\Windows\System\RaTzWEx.exe
  2⤵
  PID:6996
- C:\Windows\System\fNQjnZm.exe
  C:\Windows\System\fNQjnZm.exe
  2⤵
  PID:4280
- C:\Windows\System\JCMYonS.exe
  C:\Windows\System\JCMYonS.exe
  2⤵
  PID:852
- C:\Windows\System\CIwZxZQ.exe
  C:\Windows\System\CIwZxZQ.exe
  2⤵
  PID:6348
- C:\Windows\System\cgIdVmm.exe
  C:\Windows\System\cgIdVmm.exe
  2⤵
  PID:556
- C:\Windows\System\MYxhVBs.exe
  C:\Windows\System\MYxhVBs.exe
  2⤵
  PID:888
- C:\Windows\System\QCsWUIu.exe
  C:\Windows\System\QCsWUIu.exe
  2⤵
  PID:4748
- C:\Windows\System\utgeZSj.exe
  C:\Windows\System\utgeZSj.exe
  2⤵
  PID:2380
- C:\Windows\System\RqjKeVr.exe
  C:\Windows\System\RqjKeVr.exe
  2⤵
  PID:440
- C:\Windows\System\ecIMoWa.exe
  C:\Windows\System\ecIMoWa.exe
  2⤵
  PID:2504
- C:\Windows\System\OIyLcVE.exe
  C:\Windows\System\OIyLcVE.exe
  2⤵
  PID:6672
- C:\Windows\System\pLopbmw.exe
  C:\Windows\System\pLopbmw.exe
  2⤵
  PID:6096
- C:\Windows\System\EFGApwU.exe
  C:\Windows\System\EFGApwU.exe
  2⤵
  PID:8200
- C:\Windows\System\rTadsgw.exe
  C:\Windows\System\rTadsgw.exe
  2⤵
  PID:8224
- C:\Windows\System\rLZfRhG.exe
  C:\Windows\System\rLZfRhG.exe
  2⤵
  PID:8248
- C:\Windows\System\nySWNYi.exe
  C:\Windows\System\nySWNYi.exe
  2⤵
  PID:8268
- C:\Windows\System\AJcLvid.exe
  C:\Windows\System\AJcLvid.exe
  2⤵
  PID:8292
- C:\Windows\System\BLEguMO.exe
  C:\Windows\System\BLEguMO.exe
  2⤵
  PID:8316
- C:\Windows\System\KDjkJAk.exe
  C:\Windows\System\KDjkJAk.exe
  2⤵
  PID:8340
- C:\Windows\System\VTotLFr.exe
  C:\Windows\System\VTotLFr.exe
  2⤵
  PID:8360
- C:\Windows\System\SHktkkj.exe
  C:\Windows\System\SHktkkj.exe
  2⤵
  PID:8380
- C:\Windows\System\DFlTtJV.exe
  C:\Windows\System\DFlTtJV.exe
  2⤵
  PID:8400
- C:\Windows\System\YEOpLWe.exe
  C:\Windows\System\YEOpLWe.exe
  2⤵
  PID:8420
- C:\Windows\System\GwKYfhC.exe
  C:\Windows\System\GwKYfhC.exe
  2⤵
  PID:8440
- C:\Windows\System\pwMROHS.exe
  C:\Windows\System\pwMROHS.exe
  2⤵
  PID:8460
- C:\Windows\System\TkioBPO.exe
  C:\Windows\System\TkioBPO.exe
  2⤵
  PID:8480
- C:\Windows\System\EwfVXvv.exe
  C:\Windows\System\EwfVXvv.exe
  2⤵
  PID:8500
- C:\Windows\System\IFcFZDJ.exe
  C:\Windows\System\IFcFZDJ.exe
  2⤵
  PID:8520
- C:\Windows\System\VEmthXG.exe
  C:\Windows\System\VEmthXG.exe
  2⤵
  PID:8536
- C:\Windows\System\XjaStod.exe
  C:\Windows\System\XjaStod.exe
  2⤵
  PID:8556
- C:\Windows\System\YWftMZe.exe
  C:\Windows\System\YWftMZe.exe
  2⤵
  PID:8572
- C:\Windows\System\HVYoLLg.exe
  C:\Windows\System\HVYoLLg.exe
  2⤵
  PID:8596
- C:\Windows\System\xtEvzUx.exe
  C:\Windows\System\xtEvzUx.exe
  2⤵
  PID:8616
- C:\Windows\System\dcyNDuk.exe
  C:\Windows\System\dcyNDuk.exe
  2⤵
  PID:8640
- C:\Windows\System\irwbTCf.exe
  C:\Windows\System\irwbTCf.exe
  2⤵
  PID:8660
- C:\Windows\System\wCPnGiC.exe
  C:\Windows\System\wCPnGiC.exe
  2⤵
  PID:8680
- C:\Windows\System\BjqoeXu.exe
  C:\Windows\System\BjqoeXu.exe
  2⤵
  PID:8700
- C:\Windows\System\sFvvCOK.exe
  C:\Windows\System\sFvvCOK.exe
  2⤵
  PID:8720
- C:\Windows\System\ZksMmqx.exe
  C:\Windows\System\ZksMmqx.exe
  2⤵
  PID:8748
- C:\Windows\System\oFmnBjy.exe
  C:\Windows\System\oFmnBjy.exe
  2⤵
  PID:8772
- C:\Windows\System\bWMCgmX.exe
  C:\Windows\System\bWMCgmX.exe
  2⤵
  PID:8796
- C:\Windows\System\YAeuhdK.exe
  C:\Windows\System\YAeuhdK.exe
  2⤵
  PID:8820
- C:\Windows\System\ynmfyZu.exe
  C:\Windows\System\ynmfyZu.exe
  2⤵
  PID:8844
- C:\Windows\System\gzoxrGD.exe
  C:\Windows\System\gzoxrGD.exe
  2⤵
  PID:8864
- C:\Windows\System\CBpHAoH.exe
  C:\Windows\System\CBpHAoH.exe
  2⤵
  PID:8888
- C:\Windows\System\VzwiEZK.exe
  C:\Windows\System\VzwiEZK.exe
  2⤵
  PID:8908
- C:\Windows\System\chRFAOS.exe
  C:\Windows\System\chRFAOS.exe
  2⤵
  PID:8928
- C:\Windows\System\xzTbOty.exe
  C:\Windows\System\xzTbOty.exe
  2⤵
  PID:8944
- C:\Windows\System\RWpClVY.exe
  C:\Windows\System\RWpClVY.exe
  2⤵
  PID:8972
- C:\Windows\System\IbVooey.exe
  C:\Windows\System\IbVooey.exe
  2⤵
  PID:9000
- C:\Windows\System\XvfJGVt.exe
  C:\Windows\System\XvfJGVt.exe
  2⤵
  PID:9020
- C:\Windows\System\FntUHpO.exe
  C:\Windows\System\FntUHpO.exe
  2⤵
  PID:9048
- C:\Windows\System\GenhOxw.exe
  C:\Windows\System\GenhOxw.exe
  2⤵
  PID:9072
- C:\Windows\System\VPUufvn.exe
  C:\Windows\System\VPUufvn.exe
  2⤵
  PID:9096
- C:\Windows\System\rHTxhSg.exe
  C:\Windows\System\rHTxhSg.exe
  2⤵
  PID:9120
- C:\Windows\System\CCGBPVq.exe
  C:\Windows\System\CCGBPVq.exe
  2⤵
  PID:9144
- C:\Windows\System\ehjujmt.exe
  C:\Windows\System\ehjujmt.exe
  2⤵
  PID:9164
- C:\Windows\System\nGYuNBN.exe
  C:\Windows\System\nGYuNBN.exe
  2⤵
  PID:9188
- C:\Windows\System\uktSXAt.exe
  C:\Windows\System\uktSXAt.exe
  2⤵
  PID:9212
- C:\Windows\System\IMikrLI.exe
  C:\Windows\System\IMikrLI.exe
  2⤵
  PID:5580
- C:\Windows\System\VplPMYw.exe
  C:\Windows\System\VplPMYw.exe
  2⤵
  PID:6768
- C:\Windows\System\YWMsCWG.exe
  C:\Windows\System\YWMsCWG.exe
  2⤵
  PID:7204
- C:\Windows\System\OxniVnZ.exe
  C:\Windows\System\OxniVnZ.exe
  2⤵
  PID:6164
- C:\Windows\System\iQZdtNi.exe
  C:\Windows\System\iQZdtNi.exe
  2⤵
  PID:6952
- C:\Windows\System\pnMnaEj.exe
  C:\Windows\System\pnMnaEj.exe
  2⤵
  PID:7032
- C:\Windows\System\fREoFZM.exe
  C:\Windows\System\fREoFZM.exe
  2⤵
  PID:6192
- C:\Windows\System\lHGHjLl.exe
  C:\Windows\System\lHGHjLl.exe
  2⤵
  PID:6236
- C:\Windows\System\lWFOUcZ.exe
  C:\Windows\System\lWFOUcZ.exe
  2⤵
  PID:7504
- C:\Windows\System\PVpcLAh.exe
  C:\Windows\System\PVpcLAh.exe
  2⤵
  PID:7160
- C:\Windows\System\vZgDXmu.exe
  C:\Windows\System\vZgDXmu.exe
  2⤵
  PID:7632
- C:\Windows\System\jdacoAI.exe
  C:\Windows\System\jdacoAI.exe
  2⤵
  PID:7688
- C:\Windows\System\WIvjMwS.exe
  C:\Windows\System\WIvjMwS.exe
  2⤵
  PID:7752
- C:\Windows\System\RMVQDbS.exe
  C:\Windows\System\RMVQDbS.exe
  2⤵
  PID:5432
- C:\Windows\System\vmMdRjx.exe
  C:\Windows\System\vmMdRjx.exe
  2⤵
  PID:7904
- C:\Windows\System\uZCexwd.exe
  C:\Windows\System\uZCexwd.exe
  2⤵
  PID:3380
- C:\Windows\System\Agjyjpm.exe
  C:\Windows\System\Agjyjpm.exe
  2⤵
  PID:6564
- C:\Windows\System\QzcjCLU.exe
  C:\Windows\System\QzcjCLU.exe
  2⤵
  PID:7760
- C:\Windows\System\aojSHev.exe
  C:\Windows\System\aojSHev.exe
  2⤵
  PID:7868
- C:\Windows\System\rLkeYnU.exe
  C:\Windows\System\rLkeYnU.exe
  2⤵
  PID:7924
- C:\Windows\System\EztaBxJ.exe
  C:\Windows\System\EztaBxJ.exe
  2⤵
  PID:9172
- C:\Windows\System\bJMptyt.exe
  C:\Windows\System\bJMptyt.exe
  2⤵
  PID:7980
- C:\Windows\System\FKUWHzH.exe
  C:\Windows\System\FKUWHzH.exe
  2⤵
  PID:8052
- C:\Windows\System\pcoleDZ.exe
  C:\Windows\System\pcoleDZ.exe
  2⤵
  PID:8916
- C:\Windows\System\mfzzSOM.exe
  C:\Windows\System\mfzzSOM.exe
  2⤵
  PID:9228
- C:\Windows\System\xtphxTV.exe
  C:\Windows\System\xtphxTV.exe
  2⤵
  PID:9256
- C:\Windows\System\rSQZJaW.exe
  C:\Windows\System\rSQZJaW.exe
  2⤵
  PID:9280
- C:\Windows\System\qEDrBLx.exe
  C:\Windows\System\qEDrBLx.exe
  2⤵
  PID:9304
- C:\Windows\System\eNqvhmJ.exe
  C:\Windows\System\eNqvhmJ.exe
  2⤵
  PID:9328
- C:\Windows\System\jMBsgzb.exe
  C:\Windows\System\jMBsgzb.exe
  2⤵
  PID:9352
- C:\Windows\System\tgxoCsU.exe
  C:\Windows\System\tgxoCsU.exe
  2⤵
  PID:9380
- C:\Windows\System\sFgYuKr.exe
  C:\Windows\System\sFgYuKr.exe
  2⤵
  PID:9400
- C:\Windows\System\xeMaUHK.exe
  C:\Windows\System\xeMaUHK.exe
  2⤵
  PID:9424
- C:\Windows\System\PaLUHqT.exe
  C:\Windows\System\PaLUHqT.exe
  2⤵
  PID:9448
- C:\Windows\System\jmsDPnw.exe
  C:\Windows\System\jmsDPnw.exe
  2⤵
  PID:9472
- C:\Windows\System\kbPwBob.exe
  C:\Windows\System\kbPwBob.exe
  2⤵
  PID:9496
- C:\Windows\System\nIcRtli.exe
  C:\Windows\System\nIcRtli.exe
  2⤵
  PID:9528
- C:\Windows\System\RKBGUxh.exe
  C:\Windows\System\RKBGUxh.exe
  2⤵
  PID:9568
- C:\Windows\System\gHVPFVe.exe
  C:\Windows\System\gHVPFVe.exe
  2⤵
  PID:9592
- C:\Windows\System\SxDAjPk.exe
  C:\Windows\System\SxDAjPk.exe
  2⤵
  PID:9624
- C:\Windows\System\BtWDjIV.exe
  C:\Windows\System\BtWDjIV.exe
  2⤵
  PID:9656
- C:\Windows\System\JNwCffQ.exe
  C:\Windows\System\JNwCffQ.exe
  2⤵
  PID:9688
- C:\Windows\System\FYQReuz.exe
  C:\Windows\System\FYQReuz.exe
  2⤵
  PID:9708
- C:\Windows\System\IqSPCqQ.exe
  C:\Windows\System\IqSPCqQ.exe
  2⤵
  PID:9728
- C:\Windows\System\yfZOMdO.exe
  C:\Windows\System\yfZOMdO.exe
  2⤵
  PID:9752
- C:\Windows\System\xNxwMjm.exe
  C:\Windows\System\xNxwMjm.exe
  2⤵
  PID:9776
- C:\Windows\System\qqUTboz.exe
  C:\Windows\System\qqUTboz.exe
  2⤵
  PID:9796
- C:\Windows\System\EGpfqnC.exe
  C:\Windows\System\EGpfqnC.exe
  2⤵
  PID:9820
- C:\Windows\System\DnsZgVO.exe
  C:\Windows\System\DnsZgVO.exe
  2⤵
  PID:9844
- C:\Windows\System\NeXgBzz.exe
  C:\Windows\System\NeXgBzz.exe
  2⤵
  PID:9868
- C:\Windows\System\UBWdAUj.exe
  C:\Windows\System\UBWdAUj.exe
  2⤵
  PID:9892
- C:\Windows\System\liSzxhf.exe
  C:\Windows\System\liSzxhf.exe
  2⤵
  PID:9916
- C:\Windows\System\jCYKsHo.exe
  C:\Windows\System\jCYKsHo.exe
  2⤵
  PID:9936
- C:\Windows\System\sWBugqm.exe
  C:\Windows\System\sWBugqm.exe
  2⤵
  PID:9960
- C:\Windows\System\PJJUOwo.exe
  C:\Windows\System\PJJUOwo.exe
  2⤵
  PID:9996
- C:\Windows\System\iMZEcaE.exe
  C:\Windows\System\iMZEcaE.exe
  2⤵
  PID:10012
- C:\Windows\System\wgLeBdi.exe
  C:\Windows\System\wgLeBdi.exe
  2⤵
  PID:10032
- C:\Windows\System\iRVYouL.exe
  C:\Windows\System\iRVYouL.exe
  2⤵
  PID:10048
- C:\Windows\System\qNVjjbU.exe
  C:\Windows\System\qNVjjbU.exe
  2⤵
  PID:10072
- C:\Windows\System\YRkJiPo.exe
  C:\Windows\System\YRkJiPo.exe
  2⤵
  PID:10096
- C:\Windows\System\Cyaapdx.exe
  C:\Windows\System\Cyaapdx.exe
  2⤵
  PID:10124
- C:\Windows\System\KrbuYVQ.exe
  C:\Windows\System\KrbuYVQ.exe
  2⤵
  PID:10140
- C:\Windows\System\CDUqgTm.exe
  C:\Windows\System\CDUqgTm.exe
  2⤵
  PID:10164
- C:\Windows\System\krRpJKx.exe
  C:\Windows\System\krRpJKx.exe
  2⤵
  PID:10188
- C:\Windows\System\JxLIAbL.exe
  C:\Windows\System\JxLIAbL.exe
  2⤵
  PID:10212
- C:\Windows\System\PSurSMu.exe
  C:\Windows\System\PSurSMu.exe
  2⤵
  PID:10236
- C:\Windows\System\IcTLZiX.exe
  C:\Windows\System\IcTLZiX.exe
  2⤵
  PID:6544
- C:\Windows\System\HrIpwAt.exe
  C:\Windows\System\HrIpwAt.exe
  2⤵
  PID:8592
- C:\Windows\System\PYeFCCG.exe
  C:\Windows\System\PYeFCCG.exe
  2⤵
  PID:8312
- C:\Windows\System\CgqDhiV.exe
  C:\Windows\System\CgqDhiV.exe
  2⤵
  PID:8396
- C:\Windows\System\AzGTrEP.exe
  C:\Windows\System\AzGTrEP.exe
  2⤵
  PID:8580
- C:\Windows\System\BxePoBM.exe
  C:\Windows\System\BxePoBM.exe
  2⤵
  PID:8676
- C:\Windows\System\MvnPUkQ.exe
  C:\Windows\System\MvnPUkQ.exe
  2⤵
  PID:8756
- C:\Windows\System\YMBeStV.exe
  C:\Windows\System\YMBeStV.exe
  2⤵
  PID:8940
- C:\Windows\System\qhUqvpf.exe
  C:\Windows\System\qhUqvpf.exe
  2⤵
  PID:10248
- C:\Windows\System\dWgphQL.exe
  C:\Windows\System\dWgphQL.exe
  2⤵
  PID:10280
- C:\Windows\System\kBFMTlK.exe
  C:\Windows\System\kBFMTlK.exe
  2⤵
  PID:10324
- C:\Windows\System\xZtWvKw.exe
  C:\Windows\System\xZtWvKw.exe
  2⤵
  PID:10344
- C:\Windows\System\pNcVNfE.exe
  C:\Windows\System\pNcVNfE.exe
  2⤵
  PID:10376
- C:\Windows\System\yBIbcVl.exe
  C:\Windows\System\yBIbcVl.exe
  2⤵
  PID:10396
- C:\Windows\System\kovwqkL.exe
  C:\Windows\System\kovwqkL.exe
  2⤵
  PID:10416
- C:\Windows\System\KudlHJt.exe
  C:\Windows\System\KudlHJt.exe
  2⤵
  PID:10472
- C:\Windows\System\ZlZnEJp.exe
  C:\Windows\System\ZlZnEJp.exe
  2⤵
  PID:10504
- C:\Windows\System\GljYCkU.exe
  C:\Windows\System\GljYCkU.exe
  2⤵
  PID:10524
- C:\Windows\System\KTwpOVN.exe
  C:\Windows\System\KTwpOVN.exe
  2⤵
  PID:10544
- C:\Windows\System\PhpkBAY.exe
  C:\Windows\System\PhpkBAY.exe
  2⤵
  PID:10564
- C:\Windows\System\HjDLFFh.exe
  C:\Windows\System\HjDLFFh.exe
  2⤵
  PID:10604
- C:\Windows\System\kInXFou.exe
  C:\Windows\System\kInXFou.exe
  2⤵
  PID:10636
- C:\Windows\System\fpTGDJg.exe
  C:\Windows\System\fpTGDJg.exe
  2⤵
  PID:10664
- C:\Windows\System\dNNLNyv.exe
  C:\Windows\System\dNNLNyv.exe
  2⤵
  PID:10688
- C:\Windows\System\mWkvYFZ.exe
  C:\Windows\System\mWkvYFZ.exe
  2⤵
  PID:10728
- C:\Windows\System\alorGsC.exe
  C:\Windows\System\alorGsC.exe
  2⤵
  PID:10760
- C:\Windows\System\tgVZfDg.exe
  C:\Windows\System\tgVZfDg.exe
  2⤵
  PID:10780
- C:\Windows\System\tfGMYwy.exe
  C:\Windows\System\tfGMYwy.exe
  2⤵
  PID:10804
- C:\Windows\System\lXWzvEk.exe
  C:\Windows\System\lXWzvEk.exe
  2⤵
  PID:10824
- C:\Windows\System\RaGzIQm.exe
  C:\Windows\System\RaGzIQm.exe
  2⤵
  PID:10960
- C:\Windows\System\RTxhegf.exe
  C:\Windows\System\RTxhegf.exe
  2⤵
  PID:10980
- C:\Windows\System\kunmVhF.exe
  C:\Windows\System\kunmVhF.exe
  2⤵
  PID:11000
- C:\Windows\System\rXjIwQO.exe
  C:\Windows\System\rXjIwQO.exe
  2⤵
  PID:11020
- C:\Windows\System\aGxDKfd.exe
  C:\Windows\System\aGxDKfd.exe
  2⤵
  PID:11044
- C:\Windows\System\NYCIwTY.exe
  C:\Windows\System\NYCIwTY.exe
  2⤵
  PID:11072
- C:\Windows\System\aqHcsgf.exe
  C:\Windows\System\aqHcsgf.exe
  2⤵
  PID:11092
- C:\Windows\System\cYHgYsR.exe
  C:\Windows\System\cYHgYsR.exe
  2⤵
  PID:11116
- C:\Windows\System\uyXqxtU.exe
  C:\Windows\System\uyXqxtU.exe
  2⤵
  PID:11136
- C:\Windows\System\rgSBXTc.exe
  C:\Windows\System\rgSBXTc.exe
  2⤵
  PID:11160
- C:\Windows\System\HwuvkOv.exe
  C:\Windows\System\HwuvkOv.exe
  2⤵
  PID:11176
- C:\Windows\System\TuPwWTM.exe
  C:\Windows\System\TuPwWTM.exe
  2⤵
  PID:11200
- C:\Windows\System\EJnuvqY.exe
  C:\Windows\System\EJnuvqY.exe
  2⤵
  PID:11228
- C:\Windows\System\LSygPCH.exe
  C:\Windows\System\LSygPCH.exe
  2⤵
  PID:11248
- C:\Windows\System\LATLrwc.exe
  C:\Windows\System\LATLrwc.exe
  2⤵
  PID:9080
- C:\Windows\System\dKtSmqI.exe
  C:\Windows\System\dKtSmqI.exe
  2⤵
  PID:9196
- C:\Windows\System\rgiUcHa.exe
  C:\Windows\System\rgiUcHa.exe
  2⤵
  PID:7248
- C:\Windows\System\CjMBbil.exe
  C:\Windows\System\CjMBbil.exe
  2⤵
  PID:8712
- C:\Windows\System\esgoCls.exe
  C:\Windows\System\esgoCls.exe
  2⤵
  PID:7356
- C:\Windows\System\fZsMiIi.exe
  C:\Windows\System\fZsMiIi.exe
  2⤵
  PID:9132
- C:\Windows\System\tsXgVcG.exe
  C:\Windows\System\tsXgVcG.exe
  2⤵
  PID:8852
- C:\Windows\System\aWYUXBm.exe
  C:\Windows\System\aWYUXBm.exe
  2⤵
  PID:6228
- C:\Windows\System\rRvLJEr.exe
  C:\Windows\System\rRvLJEr.exe
  2⤵
  PID:9396
- C:\Windows\System\gUEGDuv.exe
  C:\Windows\System\gUEGDuv.exe
  2⤵
  PID:9492
- C:\Windows\System\pUVQMPy.exe
  C:\Windows\System\pUVQMPy.exe
  2⤵
  PID:6684
- C:\Windows\System\EMZVlqq.exe
  C:\Windows\System\EMZVlqq.exe
  2⤵
  PID:6908
- C:\Windows\System\zWvFrrh.exe
  C:\Windows\System\zWvFrrh.exe
  2⤵
  PID:9320
- C:\Windows\System\czAmVhX.exe
  C:\Windows\System\czAmVhX.exe
  2⤵
  PID:9608
- C:\Windows\System\ElrHgIJ.exe
  C:\Windows\System\ElrHgIJ.exe
  2⤵
  PID:9768
- C:\Windows\System\fkQhraF.exe
  C:\Windows\System\fkQhraF.exe
  2⤵
  PID:9840
- C:\Windows\System\GcbSDRH.exe
  C:\Windows\System\GcbSDRH.exe
  2⤵
  PID:9888
- C:\Windows\System\TfbHTdc.exe
  C:\Windows\System\TfbHTdc.exe
  2⤵
  PID:10108
- C:\Windows\System\rldtenr.exe
  C:\Windows\System\rldtenr.exe
  2⤵
  PID:6508
- C:\Windows\System\delBrJp.exe
  C:\Windows\System\delBrJp.exe
  2⤵
  PID:8740
- C:\Windows\System\elRPwno.exe
  C:\Windows\System\elRPwno.exe
  2⤵
  PID:10288
- C:\Windows\System\txSCHMC.exe
  C:\Windows\System\txSCHMC.exe
  2⤵
  PID:7824
- C:\Windows\System\izEiyRF.exe
  C:\Windows\System\izEiyRF.exe
  2⤵
  PID:8564
- C:\Windows\System\SpCLndD.exe
  C:\Windows\System\SpCLndD.exe
  2⤵
  PID:10588
- C:\Windows\System\WEdsBCF.exe
  C:\Windows\System\WEdsBCF.exe
  2⤵
  PID:11276
- C:\Windows\System\kTsRuzz.exe
  C:\Windows\System\kTsRuzz.exe
  2⤵
  PID:11300
- C:\Windows\System\hyizTER.exe
  C:\Windows\System\hyizTER.exe
  2⤵
  PID:11328
- C:\Windows\System\cjqBPeS.exe
  C:\Windows\System\cjqBPeS.exe
  2⤵
  PID:11344
- C:\Windows\System\ngEepZr.exe
  C:\Windows\System\ngEepZr.exe
  2⤵
  PID:11372
- C:\Windows\System\aBlNtZn.exe
  C:\Windows\System\aBlNtZn.exe
  2⤵
  PID:11396
- C:\Windows\System\pIJBZkM.exe
  C:\Windows\System\pIJBZkM.exe
  2⤵
  PID:11416
- C:\Windows\System\YjqbifA.exe
  C:\Windows\System\YjqbifA.exe
  2⤵
  PID:11440
- C:\Windows\System\xytaQuu.exe
  C:\Windows\System\xytaQuu.exe
  2⤵
  PID:11464
- C:\Windows\System\uRegubg.exe
  C:\Windows\System\uRegubg.exe
  2⤵
  PID:11488
- C:\Windows\System\DirHRkI.exe
  C:\Windows\System\DirHRkI.exe
  2⤵
  PID:11516
- C:\Windows\System\nYsDKmL.exe
  C:\Windows\System\nYsDKmL.exe
  2⤵
  PID:11536
- C:\Windows\System\KYyCgfi.exe
  C:\Windows\System\KYyCgfi.exe
  2⤵
  PID:11556
- C:\Windows\System\JGLhLbe.exe
  C:\Windows\System\JGLhLbe.exe
  2⤵
  PID:11584
- C:\Windows\System\rMVUNVF.exe
  C:\Windows\System\rMVUNVF.exe
  2⤵
  PID:11608
- C:\Windows\System\XQmGzBy.exe
  C:\Windows\System\XQmGzBy.exe
  2⤵
  PID:11628
- C:\Windows\System\qgLzPnm.exe
  C:\Windows\System\qgLzPnm.exe
  2⤵
  PID:11648
- C:\Windows\System\DlOjqLk.exe
  C:\Windows\System\DlOjqLk.exe
  2⤵
  PID:11672
- C:\Windows\System\rgTFyfB.exe
  C:\Windows\System\rgTFyfB.exe
  2⤵
  PID:11696
- C:\Windows\System\tolFrhX.exe
  C:\Windows\System\tolFrhX.exe
  2⤵
  PID:11716
- C:\Windows\System\QjTUWJn.exe
  C:\Windows\System\QjTUWJn.exe
  2⤵
  PID:11740
- C:\Windows\System\aaRlJWA.exe
  C:\Windows\System\aaRlJWA.exe
  2⤵
  PID:11764
- C:\Windows\System\sjnjUxf.exe
  C:\Windows\System\sjnjUxf.exe
  2⤵
  PID:11788
- C:\Windows\System\dZnWJSB.exe
  C:\Windows\System\dZnWJSB.exe
  2⤵
  PID:11812
- C:\Windows\System\EWJISzA.exe
  C:\Windows\System\EWJISzA.exe
  2⤵
  PID:11832
- C:\Windows\System\ALqQDAl.exe
  C:\Windows\System\ALqQDAl.exe
  2⤵
  PID:11848
- C:\Windows\System\tGxXfnE.exe
  C:\Windows\System\tGxXfnE.exe
  2⤵
  PID:11872
- C:\Windows\System\mQgICLr.exe
  C:\Windows\System\mQgICLr.exe
  2⤵
  PID:11900
- C:\Windows\System\CTGmzco.exe
  C:\Windows\System\CTGmzco.exe
  2⤵
  PID:11928
- C:\Windows\System\cxwWCCD.exe
  C:\Windows\System\cxwWCCD.exe
  2⤵
  PID:11944
- C:\Windows\System\Xbzjqyo.exe
  C:\Windows\System\Xbzjqyo.exe
  2⤵
  PID:11968
- C:\Windows\System\JDMujxU.exe
  C:\Windows\System\JDMujxU.exe
  2⤵
  PID:11992
- C:\Windows\System\KOqblEB.exe
  C:\Windows\System\KOqblEB.exe
  2⤵
  PID:12016
- C:\Windows\System\zLQjuvO.exe
  C:\Windows\System\zLQjuvO.exe
  2⤵
  PID:12032
- C:\Windows\System\qLUoOBn.exe
  C:\Windows\System\qLUoOBn.exe
  2⤵
  PID:12048
- C:\Windows\System\sugflsS.exe
  C:\Windows\System\sugflsS.exe
  2⤵
  PID:12064
- C:\Windows\System\ItPihAm.exe
  C:\Windows\System\ItPihAm.exe
  2⤵
  PID:12080
- C:\Windows\System\YvOEzeA.exe
  C:\Windows\System\YvOEzeA.exe
  2⤵
  PID:12096
- C:\Windows\System\PeonMCs.exe
  C:\Windows\System\PeonMCs.exe
  2⤵
  PID:12116
- C:\Windows\System\mAbRKHZ.exe
  C:\Windows\System\mAbRKHZ.exe
  2⤵
  PID:12140
- C:\Windows\System\ejDzzsp.exe
  C:\Windows\System\ejDzzsp.exe
  2⤵
  PID:12160
- C:\Windows\System\rvpUpgv.exe
  C:\Windows\System\rvpUpgv.exe
  2⤵
  PID:12188
- C:\Windows\System\BqrRkUF.exe
  C:\Windows\System\BqrRkUF.exe
  2⤵
  PID:12204
- C:\Windows\System\KueyBwK.exe
  C:\Windows\System\KueyBwK.exe
  2⤵
  PID:12224
- C:\Windows\System\lEbyEvj.exe
  C:\Windows\System\lEbyEvj.exe
  2⤵
  PID:12252
- C:\Windows\System\aCfQCqR.exe
  C:\Windows\System\aCfQCqR.exe
  2⤵
  PID:12272
- C:\Windows\System\bpKPufd.exe
  C:\Windows\System\bpKPufd.exe
  2⤵
  PID:10652
- C:\Windows\System\AUcFKTa.exe
  C:\Windows\System\AUcFKTa.exe
  2⤵
  PID:10708
- C:\Windows\System\jEqgJQO.exe
  C:\Windows\System\jEqgJQO.exe
  2⤵
  PID:6300
- C:\Windows\System\HxBPNvq.exe
  C:\Windows\System\HxBPNvq.exe
  2⤵
  PID:5108
- C:\Windows\System\IkRFmfr.exe
  C:\Windows\System\IkRFmfr.exe
  2⤵
  PID:4192
- C:\Windows\System\HNxwsKB.exe
  C:\Windows\System\HNxwsKB.exe
  2⤵
  PID:9060
- C:\Windows\System\nEnaWTr.exe
  C:\Windows\System\nEnaWTr.exe
  2⤵
  PID:8832
- C:\Windows\System\dxQVEMO.exe
  C:\Windows\System\dxQVEMO.exe
  2⤵
  PID:8652
- C:\Windows\System\xLWfWAU.exe
  C:\Windows\System\xLWfWAU.exe
  2⤵
  PID:8388
- C:\Windows\System\bMBgRpL.exe
  C:\Windows\System\bMBgRpL.exe
  2⤵
  PID:5284
- C:\Windows\System\qgljULN.exe
  C:\Windows\System\qgljULN.exe
  2⤵
  PID:9092
- C:\Windows\System\yDxcBzT.exe
  C:\Windows\System\yDxcBzT.exe
  2⤵
  PID:10788
- C:\Windows\System\FDfpcVl.exe
  C:\Windows\System\FDfpcVl.exe
  2⤵
  PID:9160
- C:\Windows\System\emYmEtj.exe
  C:\Windows\System\emYmEtj.exe
  2⤵
  PID:6852
- C:\Windows\System\AVYEKaY.exe
  C:\Windows\System\AVYEKaY.exe
  2⤵
  PID:9348
- C:\Windows\System\FOvDnjd.exe
  C:\Windows\System\FOvDnjd.exe
  2⤵
  PID:9468
- C:\Windows\System\IlzmRqr.exe
  C:\Windows\System\IlzmRqr.exe
  2⤵
  PID:6980
- C:\Windows\System\HYtUYlh.exe
  C:\Windows\System\HYtUYlh.exe
  2⤵
  PID:6388
- C:\Windows\System\XcoqMrh.exe
  C:\Windows\System\XcoqMrh.exe
  2⤵
  PID:9724
- C:\Windows\System\qEselJI.exe
  C:\Windows\System\qEselJI.exe
  2⤵
  PID:9804
- C:\Windows\System\Buobthy.exe
  C:\Windows\System\Buobthy.exe
  2⤵
  PID:9272
- C:\Windows\System\vjpswqo.exe
  C:\Windows\System\vjpswqo.exe
  2⤵
  PID:9864
- C:\Windows\System\MuyVMqV.exe
  C:\Windows\System\MuyVMqV.exe
  2⤵
  PID:11112
- C:\Windows\System\dprdymK.exe
  C:\Windows\System\dprdymK.exe
  2⤵
  PID:9992
- C:\Windows\System\LwMbijN.exe
  C:\Windows\System\LwMbijN.exe
  2⤵
  PID:10056
- C:\Windows\System\GzmBCHW.exe
  C:\Windows\System\GzmBCHW.exe
  2⤵
  PID:11236
- C:\Windows\System\JfjmAhD.exe
  C:\Windows\System\JfjmAhD.exe
  2⤵
  PID:8472
- C:\Windows\System\dwcVHvK.exe
  C:\Windows\System\dwcVHvK.exe
  2⤵
  PID:7436
- C:\Windows\System\ndvVsQH.exe
  C:\Windows\System\ndvVsQH.exe
  2⤵
  PID:5132
- C:\Windows\System\rPiSUFK.exe
  C:\Windows\System\rPiSUFK.exe
  2⤵
  PID:6212
- C:\Windows\System\oOtiBcp.exe
  C:\Windows\System\oOtiBcp.exe
  2⤵
  PID:9744
- C:\Windows\System\kqwTsBv.exe
  C:\Windows\System\kqwTsBv.exe
  2⤵
  PID:7200
- C:\Windows\System\epGnsif.exe
  C:\Windows\System\epGnsif.exe
  2⤵
  PID:10304
- C:\Windows\System\VKCaYAp.exe
  C:\Windows\System\VKCaYAp.exe
  2⤵
  PID:6280
- C:\Windows\System\WeqSDfM.exe
  C:\Windows\System\WeqSDfM.exe
  2⤵
  PID:10404
- C:\Windows\System\hIvlUgh.exe
  C:\Windows\System\hIvlUgh.exe
  2⤵
  PID:5652
- C:\Windows\System\KPzchPc.exe
  C:\Windows\System\KPzchPc.exe
  2⤵
  PID:7872
- C:\Windows\System\CaLcwDO.exe
  C:\Windows\System\CaLcwDO.exe
  2⤵
  PID:10492
- C:\Windows\System\xSNDLjU.exe
  C:\Windows\System\xSNDLjU.exe
  2⤵
  PID:10180
- C:\Windows\System\OpEQjAu.exe
  C:\Windows\System\OpEQjAu.exe
  2⤵
  PID:8964
- C:\Windows\System\JYaZyda.exe
  C:\Windows\System\JYaZyda.exe
  2⤵
  PID:9204
- C:\Windows\System\oEIGbuv.exe
  C:\Windows\System\oEIGbuv.exe
  2⤵
  PID:11272
- C:\Windows\System\WAupWkq.exe
  C:\Windows\System\WAupWkq.exe
  2⤵
  PID:10628
- C:\Windows\System\cEecQDf.exe
  C:\Windows\System\cEecQDf.exe
  2⤵
  PID:11408
- C:\Windows\System\yhOoBcN.exe
  C:\Windows\System\yhOoBcN.exe
  2⤵
  PID:11480
- C:\Windows\System\CoIHQnq.exe
  C:\Windows\System\CoIHQnq.exe
  2⤵
  PID:11532
- C:\Windows\System\zDIBiPE.exe
  C:\Windows\System\zDIBiPE.exe
  2⤵
  PID:7480
- C:\Windows\System\sSpZfmL.exe
  C:\Windows\System\sSpZfmL.exe
  2⤵
  PID:4388
- C:\Windows\System\thDzHBp.exe
  C:\Windows\System\thDzHBp.exe
  2⤵
  PID:4504
- C:\Windows\System\DTkqCqM.exe
  C:\Windows\System\DTkqCqM.exe
  2⤵
  PID:12300
- C:\Windows\System\ziHbJCv.exe
  C:\Windows\System\ziHbJCv.exe
  2⤵
  PID:12328
- C:\Windows\System\kvcJBBo.exe
  C:\Windows\System\kvcJBBo.exe
  2⤵
  PID:12348
- C:\Windows\System\OPKTEbm.exe
  C:\Windows\System\OPKTEbm.exe
  2⤵
  PID:12368
- C:\Windows\System\SommlOD.exe
  C:\Windows\System\SommlOD.exe
  2⤵
  PID:12392
- C:\Windows\System\mEiRKaz.exe
  C:\Windows\System\mEiRKaz.exe
  2⤵
  PID:12416
- C:\Windows\System\apDNOeb.exe
  C:\Windows\System\apDNOeb.exe
  2⤵
  PID:12440
- C:\Windows\System\gdXyEhb.exe
  C:\Windows\System\gdXyEhb.exe
  2⤵
  PID:12472
- C:\Windows\System\oDjYNTE.exe
  C:\Windows\System\oDjYNTE.exe
  2⤵
  PID:12492
- C:\Windows\System\YyTvOFu.exe
  C:\Windows\System\YyTvOFu.exe
  2⤵
  PID:12516
- C:\Windows\System\LisEMtQ.exe
  C:\Windows\System\LisEMtQ.exe
  2⤵
  PID:12540
- C:\Windows\System\cwSvaIr.exe
  C:\Windows\System\cwSvaIr.exe
  2⤵
  PID:12560
- C:\Windows\System\iyFEsob.exe
  C:\Windows\System\iyFEsob.exe
  2⤵
  PID:12580
- C:\Windows\System\fWqGRwO.exe
  C:\Windows\System\fWqGRwO.exe
  2⤵
  PID:12604
- C:\Windows\System\qCgtFdr.exe
  C:\Windows\System\qCgtFdr.exe
  2⤵
  PID:12628
- C:\Windows\System\TSoWzxV.exe
  C:\Windows\System\TSoWzxV.exe
  2⤵
  PID:12648
- C:\Windows\System\HLuQVob.exe
  C:\Windows\System\HLuQVob.exe
  2⤵
  PID:12664
- C:\Windows\System\uHZeuZh.exe
  C:\Windows\System\uHZeuZh.exe
  2⤵
  PID:12692
- C:\Windows\System\VfOODpL.exe
  C:\Windows\System\VfOODpL.exe
  2⤵
  PID:12720
- C:\Windows\System\onCuOsP.exe
  C:\Windows\System\onCuOsP.exe
  2⤵
  PID:12740
- C:\Windows\System\HgaQEye.exe
  C:\Windows\System\HgaQEye.exe
  2⤵
  PID:12768
- C:\Windows\System\lQfYNfm.exe
  C:\Windows\System\lQfYNfm.exe
  2⤵
  PID:13104
- C:\Windows\System\bOZUalr.exe
  C:\Windows\System\bOZUalr.exe
  2⤵
  PID:13128
- C:\Windows\System\kqNqnUP.exe
  C:\Windows\System\kqNqnUP.exe
  2⤵
  PID:13144
- C:\Windows\System\BJacbZt.exe
  C:\Windows\System\BJacbZt.exe
  2⤵
  PID:13164
- C:\Windows\System\nhEIIyu.exe
  C:\Windows\System\nhEIIyu.exe
  2⤵
  PID:13180
- C:\Windows\System\UiiHARP.exe
  C:\Windows\System\UiiHARP.exe
  2⤵
  PID:13196
- C:\Windows\System\DtnZTQt.exe
  C:\Windows\System\DtnZTQt.exe
  2⤵
  PID:12376
- C:\Windows\System\rrwvsry.exe
  C:\Windows\System\rrwvsry.exe
  2⤵
  PID:4312
- C:\Windows\System\FWzIMgF.exe
  C:\Windows\System\FWzIMgF.exe
  2⤵
  PID:12428
- C:\Windows\System\ThmRiZp.exe
  C:\Windows\System\ThmRiZp.exe
  2⤵
  PID:11708
- C:\Windows\System\JWmWWZE.exe
  C:\Windows\System\JWmWWZE.exe
  2⤵
  PID:12796
- C:\Windows\System\MRvkfKd.exe
  C:\Windows\System\MRvkfKd.exe
  2⤵
  PID:11144
- C:\Windows\System\rxFNFrk.exe
  C:\Windows\System\rxFNFrk.exe
  2⤵
  PID:3208
- C:\Windows\System\QnIkDDR.exe
  C:\Windows\System\QnIkDDR.exe
  2⤵
  PID:9444
- C:\Windows\System\qeFSwGR.exe
  C:\Windows\System\qeFSwGR.exe
  2⤵
  PID:12888
- C:\Windows\System\FuqGHDQ.exe
  C:\Windows\System\FuqGHDQ.exe
  2⤵
  PID:12284
- C:\Windows\System\XHrEftg.exe
  C:\Windows\System\XHrEftg.exe
  2⤵
  PID:7636
- C:\Windows\System\QPdHVEk.exe
  C:\Windows\System\QPdHVEk.exe
  2⤵
  PID:9108
- C:\Windows\System\dmfmCmr.exe
  C:\Windows\System\dmfmCmr.exe
  2⤵
  PID:8688
- C:\Windows\System\eZRDxgJ.exe
  C:\Windows\System\eZRDxgJ.exe
  2⤵
  PID:8212
- C:\Windows\System\yNbymQn.exe
  C:\Windows\System\yNbymQn.exe
  2⤵
  PID:10792
- C:\Windows\System\pyEABVv.exe
  C:\Windows\System\pyEABVv.exe
  2⤵
  PID:9324
- C:\Windows\System\JywIToK.exe
  C:\Windows\System\JywIToK.exe
  2⤵
  PID:3876
- C:\Windows\System\hxdTNjX.exe
  C:\Windows\System\hxdTNjX.exe
  2⤵
  PID:4320
- C:\Windows\System\xjUnUIP.exe
  C:\Windows\System\xjUnUIP.exe
  2⤵
  PID:13036
- C:\Windows\System\fUkLqpx.exe
  C:\Windows\System\fUkLqpx.exe
  2⤵
  PID:11840
- C:\Windows\System\ahjpGnd.exe
  C:\Windows\System\ahjpGnd.exe
  2⤵
  PID:12640
- C:\Windows\System\vDOkluA.exe
  C:\Windows\System\vDOkluA.exe
  2⤵
  PID:12732
- C:\Windows\System\zDOsFBp.exe
  C:\Windows\System\zDOsFBp.exe
  2⤵
  PID:13120
- C:\Windows\System\vbtNtwy.exe
  C:\Windows\System\vbtNtwy.exe
  2⤵
  PID:13292
- C:\Windows\System\PXiroVi.exe
  C:\Windows\System\PXiroVi.exe
  2⤵
  PID:13008
- C:\Windows\System\EZGdSvu.exe
  C:\Windows\System\EZGdSvu.exe
  2⤵
  PID:13152
- C:\Windows\System\ATQtGmm.exe
  C:\Windows\System\ATQtGmm.exe
  2⤵
  PID:8264
- C:\Windows\System\njUXfeL.exe
  C:\Windows\System\njUXfeL.exe
  2⤵
  PID:9736
- C:\Windows\System\GRqdBSq.exe
  C:\Windows\System\GRqdBSq.exe
  2⤵
  PID:13300
- C:\Windows\System\zbpTiHE.exe
  C:\Windows\System\zbpTiHE.exe
  2⤵
  PID:12152
- C:\Windows\System\LAJmlUs.exe
  C:\Windows\System\LAJmlUs.exe
  2⤵
  PID:1248
- C:\Windows\System\cBMAOfO.exe
  C:\Windows\System\cBMAOfO.exe
  2⤵
  PID:2404
- C:\Windows\System\pIUQrjV.exe
  C:\Windows\System\pIUQrjV.exe
  2⤵
  PID:10020
- C:\Windows\System\PpSYDHN.exe
  C:\Windows\System\PpSYDHN.exe
  2⤵
  PID:9176
- C:\Windows\System\YerYrFo.exe
  C:\Windows\System\YerYrFo.exe
  2⤵
  PID:9792
- C:\Windows\System\mCHhfJU.exe
  C:\Windows\System\mCHhfJU.exe
  2⤵
  PID:9612
- C:\Windows\System\shWJFfn.exe
  C:\Windows\System\shWJFfn.exe
  2⤵
  PID:12344
- C:\Windows\System\lFNtLCG.exe
  C:\Windows\System\lFNtLCG.exe
  2⤵
  PID:12448
- C:\Windows\System\LPCzsaR.exe
  C:\Windows\System\LPCzsaR.exe
  2⤵
  PID:12504
- C:\Windows\System\vbUDTJy.exe
  C:\Windows\System\vbUDTJy.exe
  2⤵
  PID:11808
- C:\Windows\System\fvDnqxr.exe
  C:\Windows\System\fvDnqxr.exe
  2⤵
  PID:9264
- C:\Windows\System\PqAglWi.exe
  C:\Windows\System\PqAglWi.exe
  2⤵
  PID:5460
- C:\Windows\System\jxBiwQV.exe
  C:\Windows\System\jxBiwQV.exe
  2⤵
  PID:11324
- C:\Windows\System\XxcafXt.exe
  C:\Windows\System\XxcafXt.exe
  2⤵
  PID:12360
- C:\Windows\System\RcWVzEf.exe
  C:\Windows\System\RcWVzEf.exe
  2⤵
  PID:11796
- C:\Windows\System\QZDhOAQ.exe
  C:\Windows\System\QZDhOAQ.exe
  2⤵
  PID:12536
- C:\Windows\System\xeXLbGV.exe
  C:\Windows\System\xeXLbGV.exe
  2⤵
  PID:12624
- C:\Windows\System\ZMAJSki.exe
  C:\Windows\System\ZMAJSki.exe
  2⤵
  PID:11032
- C:\Windows\System\kTrFEuY.exe
  C:\Windows\System\kTrFEuY.exe
  2⤵
  PID:8080
- C:\Windows\System\ZIaNPWn.exe
  C:\Windows\System\ZIaNPWn.exe
  2⤵
  PID:12592
- C:\Windows\System\ziSYXBn.exe
  C:\Windows\System\ziSYXBn.exe
  2⤵
  PID:12308
- C:\Windows\System\XrlDiOd.exe
  C:\Windows\System\XrlDiOd.exe
  2⤵
  PID:13280
- C:\Windows\System\lqXhqwa.exe
  C:\Windows\System\lqXhqwa.exe
  2⤵
  PID:13136
- C:\Windows\System\QNJfVNX.exe
  C:\Windows\System\QNJfVNX.exe
  2⤵
  PID:1224
- C:\Windows\System\GpKhfOx.exe
  C:\Windows\System\GpKhfOx.exe
  2⤵
  PID:11960
- C:\Windows\System\HdckYRL.exe
  C:\Windows\System\HdckYRL.exe
  2⤵
  PID:2892
- C:\Windows\System\vPkQTvO.exe
  C:\Windows\System\vPkQTvO.exe
  2⤵
  PID:11892
- C:\Windows\System\ZpAOMwf.exe
  C:\Windows\System\ZpAOMwf.exe
  2⤵
  PID:220
- C:\Windows\System\XgHWeGr.exe
  C:\Windows\System\XgHWeGr.exe
  2⤵
  PID:11244
- C:\Windows\System\LpFAZRD.exe
  C:\Windows\System\LpFAZRD.exe
  2⤵
  PID:8240
- C:\Windows\System\wOZRBHv.exe
  C:\Windows\System\wOZRBHv.exe
  2⤵
  PID:12260
- C:\Windows\System\oWZgBDB.exe
  C:\Windows\System\oWZgBDB.exe
  2⤵
  PID:7184
- C:\Windows\System\MnJJcVf.exe
  C:\Windows\System\MnJJcVf.exe
  2⤵
  PID:7780
- C:\Windows\System\FJgabDK.exe
  C:\Windows\System\FJgabDK.exe
  2⤵
  PID:10672
- C:\Windows\System\rvOhSHp.exe
  C:\Windows\System\rvOhSHp.exe
  2⤵
  PID:12400
- C:\Windows\System\NOpDacU.exe
  C:\Windows\System\NOpDacU.exe
  2⤵
  PID:13188
- C:\Windows\System\wCWbNwi.exe
  C:\Windows\System\wCWbNwi.exe
  2⤵
  PID:13328
- C:\Windows\System\kgbpyBL.exe
  C:\Windows\System\kgbpyBL.exe
  2⤵
  PID:13344
- C:\Windows\System\SpeJzfG.exe
  C:\Windows\System\SpeJzfG.exe
  2⤵
  PID:13364
- C:\Windows\System\GMQdghh.exe
  C:\Windows\System\GMQdghh.exe
  2⤵
  PID:13464
- C:\Windows\System\friIBiE.exe
  C:\Windows\System\friIBiE.exe
  2⤵
  PID:13552
- C:\Windows\System\QVvHhQP.exe
  C:\Windows\System\QVvHhQP.exe
  2⤵
  PID:13584
- C:\Windows\System\vYOTWaN.exe
  C:\Windows\System\vYOTWaN.exe
  2⤵
  PID:13612
- C:\Windows\System\xrpbpTe.exe
  C:\Windows\System\xrpbpTe.exe
  2⤵
  PID:13672
- C:\Windows\System\cVIXsTY.exe
  C:\Windows\System\cVIXsTY.exe
  2⤵
  PID:13696
- C:\Windows\System\TpuicGK.exe
  C:\Windows\System\TpuicGK.exe
  2⤵
  PID:13724
- C:\Windows\System\yqXvICU.exe
  C:\Windows\System\yqXvICU.exe
  2⤵
  PID:13740
- C:\Windows\System\zEYYejo.exe
  C:\Windows\System\zEYYejo.exe
  2⤵
  PID:13812
- C:\Windows\System\kAOnkZk.exe
  C:\Windows\System\kAOnkZk.exe
  2⤵
  PID:14208
- C:\Windows\System\wEvseYf.exe
  C:\Windows\System\wEvseYf.exe
  2⤵
  PID:14224
- C:\Windows\System\edzFJHb.exe
  C:\Windows\System\edzFJHb.exe
  2⤵
  PID:14244
- C:\Windows\System\IxWebli.exe
  C:\Windows\System\IxWebli.exe
  2⤵
  PID:14264
- C:\Windows\System\qVMshXA.exe
  C:\Windows\System\qVMshXA.exe
  2⤵
  PID:14292
- C:\Windows\System\jVUQTTM.exe
  C:\Windows\System\jVUQTTM.exe
  2⤵
  PID:13172
- C:\Windows\System\uJndRNK.exe
  C:\Windows\System\uJndRNK.exe
  2⤵
  PID:10388
- C:\Windows\System\qeMPPRH.exe
  C:\Windows\System\qeMPPRH.exe
  2⤵
  PID:13448
- C:\Windows\System\IaWzGmS.exe
  C:\Windows\System\IaWzGmS.exe
  2⤵
  PID:13540
- C:\Windows\System\CiBOqxj.exe
  C:\Windows\System\CiBOqxj.exe
  2⤵
  PID:14012
- C:\Windows\System\ewwxtQV.exe
  C:\Windows\System\ewwxtQV.exe
  2⤵
  PID:13704
- C:\Windows\System\zZZbEpR.exe
  C:\Windows\System\zZZbEpR.exe
  2⤵
  PID:14332
- C:\Windows\System\IRnkSlz.exe
  C:\Windows\System\IRnkSlz.exe
  2⤵
  PID:13920
- C:\Windows\System\ZSEdpSD.exe
  C:\Windows\System\ZSEdpSD.exe
  2⤵
  PID:13968
- C:\Windows\System\qUTYFMD.exe
  C:\Windows\System\qUTYFMD.exe
  2⤵
  PID:14260
- C:\Windows\System\xfZYfsO.exe
  C:\Windows\System\xfZYfsO.exe
  2⤵
  PID:14320
- C:\Windows\System\qOvibyT.exe
  C:\Windows\System\qOvibyT.exe
  2⤵
  PID:12672
- C:\Windows\System\BHsLYyk.exe
  C:\Windows\System\BHsLYyk.exe
  2⤵
  PID:11552
- C:\Windows\System\ODvqZjl.exe
  C:\Windows\System\ODvqZjl.exe
  2⤵
  PID:13412
- C:\Windows\System\ZTAepQE.exe
  C:\Windows\System\ZTAepQE.exe
  2⤵
  PID:8048
- C:\Windows\System\xcNbnsE.exe
  C:\Windows\System\xcNbnsE.exe
  2⤵
  PID:12572
- C:\Windows\System\xYBVkyr.exe
  C:\Windows\System\xYBVkyr.exe
  2⤵
  PID:13488
- C:\Windows\System\CcJTpFN.exe
  C:\Windows\System\CcJTpFN.exe
  2⤵
  PID:13776
- C:\Windows\System\jQIkgrd.exe
  C:\Windows\System\jQIkgrd.exe
  2⤵
  PID:13792
- C:\Windows\System\pIfUxjQ.exe
  C:\Windows\System\pIfUxjQ.exe
  2⤵
  PID:13772
- C:\Windows\System\grqyVXw.exe
  C:\Windows\System\grqyVXw.exe
  2⤵
  PID:13988
- C:\Windows\System\QExEDdx.exe
  C:\Windows\System\QExEDdx.exe
  2⤵
  PID:14020
- C:\Windows\System\klCSBsH.exe
  C:\Windows\System\klCSBsH.exe
  2⤵
  PID:14160
- C:\Windows\System\IqHtkPO.exe
  C:\Windows\System\IqHtkPO.exe
  2⤵
  PID:14284
- C:\Windows\System\rlgmTjk.exe
  C:\Windows\System\rlgmTjk.exe
  2⤵
  PID:11216
- C:\Windows\System\PpWNJMI.exe
  C:\Windows\System\PpWNJMI.exe
  2⤵
  PID:14304
- C:\Windows\System\qETGSDI.exe
  C:\Windows\System\qETGSDI.exe
  2⤵
  PID:9044
- C:\Windows\System\oKROUzw.exe
  C:\Windows\System\oKROUzw.exe
  2⤵
  PID:14036
- C:\Windows\System\ixCIdFV.exe
  C:\Windows\System\ixCIdFV.exe
  2⤵
  PID:14220
- C:\Windows\System\fGoDXtk.exe
  C:\Windows\System\fGoDXtk.exe
  2⤵
  PID:12004
- C:\Windows\System\gKzFAtZ.exe
  C:\Windows\System\gKzFAtZ.exe
  2⤵
  PID:11732
- C:\Windows\System\BudIsTa.exe
  C:\Windows\System\BudIsTa.exe
  2⤵
  PID:3616
- C:\Windows\System\rIQTLBC.exe
  C:\Windows\System\rIQTLBC.exe
  2⤵
  PID:4736
- C:\Windows\System\zGYOyVd.exe
  C:\Windows\System\zGYOyVd.exe
  2⤵
  PID:14064
- C:\Windows\System\icxQceX.exe
  C:\Windows\System\icxQceX.exe
  2⤵
  PID:3044
- C:\Windows\System\cBMzvjX.exe
  C:\Windows\System\cBMzvjX.exe
  2⤵
  PID:7328
- C:\Windows\System\okYtbtF.exe
  C:\Windows\System\okYtbtF.exe
  2⤵
  PID:4180
- C:\Windows\System\BwqhGhQ.exe
  C:\Windows\System\BwqhGhQ.exe
  2⤵
  PID:11804
- C:\Windows\System\yfueoEx.exe
  C:\Windows\System\yfueoEx.exe
  2⤵
  PID:13564
- C:\Windows\System\nTrOWMv.exe
  C:\Windows\System\nTrOWMv.exe
  2⤵
  PID:13276
- C:\Windows\System\jDoiCyx.exe
  C:\Windows\System\jDoiCyx.exe
  2⤵
  PID:13608
- C:\Windows\System\GmXRGEU.exe
  C:\Windows\System\GmXRGEU.exe
  2⤵
  PID:11984
- C:\Windows\System\GapMJyJ.exe
  C:\Windows\System\GapMJyJ.exe
  2⤵
  PID:13868
- C:\Windows\System\VbgwnNq.exe
  C:\Windows\System\VbgwnNq.exe
  2⤵
  PID:14056
- C:\Windows\System\DOtyGeb.exe
  C:\Windows\System\DOtyGeb.exe
  2⤵
  PID:8584
- C:\Windows\System\qOvTnoh.exe
  C:\Windows\System\qOvTnoh.exe
  2⤵
  PID:13460
- C:\Windows\System\oAxDJvk.exe
  C:\Windows\System\oAxDJvk.exe
  2⤵
  PID:13764
- C:\Windows\System\mxXGFBM.exe
  C:\Windows\System\mxXGFBM.exe
  2⤵
  PID:13656
- C:\Windows\System\jvsAHMN.exe
  C:\Windows\System\jvsAHMN.exe
  2⤵
  PID:12220
- C:\Windows\System\TBIFXpT.exe
  C:\Windows\System\TBIFXpT.exe
  2⤵
  PID:5928
- C:\Windows\System\YNPwslJ.exe
  C:\Windows\System\YNPwslJ.exe
  2⤵
  PID:12044
- C:\Windows\System\HoFHsIq.exe
  C:\Windows\System\HoFHsIq.exe
  2⤵
  PID:4808
- C:\Windows\System\vKdrujY.exe
  C:\Windows\System\vKdrujY.exe
  2⤵
  PID:14004
- C:\Windows\System\LKqkkjP.exe
  C:\Windows\System\LKqkkjP.exe
  2⤵
  PID:7732
- C:\Windows\System\sEOPJAS.exe
  C:\Windows\System\sEOPJAS.exe
  2⤵
  PID:4968
- C:\Windows\System\wAxmrWg.exe
  C:\Windows\System\wAxmrWg.exe
  2⤵
  PID:4708
- C:\Windows\System\cpdDIgM.exe
  C:\Windows\System\cpdDIgM.exe
  2⤵
  PID:5028
- C:\Windows\System\rUgDDJv.exe
  C:\Windows\System\rUgDDJv.exe
  2⤵
  PID:3968
- C:\Windows\System\ZLhQnPA.exe
  C:\Windows\System\ZLhQnPA.exe
  2⤵
  PID:5112
- C:\Windows\System\OGhJVsv.exe
  C:\Windows\System\OGhJVsv.exe
  2⤵
  PID:12820
- C:\Windows\System\pBvaCrx.exe
  C:\Windows\System\pBvaCrx.exe
  2⤵
  PID:1120
- C:\Windows\System\BekgqNf.exe
  C:\Windows\System\BekgqNf.exe
  2⤵
  PID:14192
- C:\Windows\System\AYTgRTX.exe
  C:\Windows\System\AYTgRTX.exe
  2⤵
  PID:14100
- C:\Windows\System\ttEYkJS.exe
  C:\Windows\System\ttEYkJS.exe
  2⤵
  PID:1964
- C:\Windows\System\jtsDREC.exe
  C:\Windows\System\jtsDREC.exe
  2⤵
  PID:4596
- C:\Windows\System\GAQmHfk.exe
  C:\Windows\System\GAQmHfk.exe
  2⤵
  PID:1504
- C:\Windows\System\ZHwoWEI.exe
  C:\Windows\System\ZHwoWEI.exe
  2⤵
  PID:13784
- C:\Windows\System\udelzjA.exe
  C:\Windows\System\udelzjA.exe
  2⤵
  PID:1412
- C:\Windows\System\GsakVzf.exe
  C:\Windows\System\GsakVzf.exe
  2⤵
  PID:13844
- C:\Windows\System\OgFlrbq.exe
  C:\Windows\System\OgFlrbq.exe
  2⤵
  PID:2552
- C:\Windows\System\pQWZDCz.exe
  C:\Windows\System\pQWZDCz.exe
  2⤵
  PID:11296
- C:\Windows\System\sUtIvVM.exe
  C:\Windows\System\sUtIvVM.exe
  2⤵
  PID:13944
- C:\Windows\System\wTRvtdb.exe
  C:\Windows\System\wTRvtdb.exe
  2⤵
  PID:228
- C:\Windows\System\uqkpFMK.exe
  C:\Windows\System\uqkpFMK.exe
  2⤵
  PID:10044
- C:\Windows\System\eVOUjiz.exe
  C:\Windows\System\eVOUjiz.exe
  2⤵
  PID:4316
- C:\Windows\System\GLzTykc.exe
  C:\Windows\System\GLzTykc.exe
  2⤵
  PID:14096
- C:\Windows\System\AgJMUiO.exe
  C:\Windows\System\AgJMUiO.exe
  2⤵
  PID:3972
- C:\Windows\System\VSRBhbD.exe
  C:\Windows\System\VSRBhbD.exe
  2⤵
  PID:14196
- C:\Windows\System\KIysFqP.exe
  C:\Windows\System\KIysFqP.exe
  2⤵
  PID:3248
- C:\Windows\System\BFbybee.exe
  C:\Windows\System\BFbybee.exe
  2⤵
  PID:13768
- C:\Windows\System\mTCBHdy.exe
  C:\Windows\System\mTCBHdy.exe
  2⤵
  PID:1696
- C:\Windows\System\pONvjKq.exe
  C:\Windows\System\pONvjKq.exe
  2⤵
  PID:1636
- C:\Windows\System\mpyWlja.exe
  C:\Windows\System\mpyWlja.exe
  2⤵
  PID:4884
- C:\Windows\System\xPAXqRU.exe
  C:\Windows\System\xPAXqRU.exe
  2⤵
  PID:5128
- C:\Windows\System\uHwVlaH.exe
  C:\Windows\System\uHwVlaH.exe
  2⤵
  PID:3656
- C:\Windows\System\WhGwkgL.exe
  C:\Windows\System\WhGwkgL.exe
  2⤵
  PID:5724
- C:\Windows\System\qUcoThn.exe
  C:\Windows\System\qUcoThn.exe
  2⤵
  PID:1680
- C:\Windows\System\eexsnlS.exe
  C:\Windows\System\eexsnlS.exe
  2⤵
  PID:5492
- C:\Windows\System\GScaYYk.exe
  C:\Windows\System\GScaYYk.exe
  2⤵
  PID:1548
- C:\Windows\System\tqdYWoA.exe
  C:\Windows\System\tqdYWoA.exe
  2⤵
  PID:1468
- C:\Windows\System\xLJSZkv.exe
  C:\Windows\System\xLJSZkv.exe
  2⤵
  PID:5940
- C:\Windows\System\TMaWTZZ.exe
  C:\Windows\System\TMaWTZZ.exe
  2⤵
  PID:8304
- C:\Windows\System\LHThoIP.exe
  C:\Windows\System\LHThoIP.exe
  2⤵
  PID:8708
- C:\Windows\System\iDbkvPL.exe
  C:\Windows\System\iDbkvPL.exe
  2⤵
  PID:12532
- C:\Windows\System\BrEybxu.exe
  C:\Windows\System\BrEybxu.exe
  2⤵
  PID:5324
- C:\Windows\System\kEEHFDQ.exe
  C:\Windows\System\kEEHFDQ.exe
  2⤵
  PID:5636
- C:\Windows\System\ZDNBOjf.exe
  C:\Windows\System\ZDNBOjf.exe
  2⤵
  PID:5608
- C:\Windows\System\xkPDLwy.exe
  C:\Windows\System\xkPDLwy.exe
  2⤵
  PID:13524
- C:\Windows\System\UpaJcLX.exe
  C:\Windows\System\UpaJcLX.exe
  2⤵
  PID:5332
- C:\Windows\System\OtYDYoJ.exe
  C:\Windows\System\OtYDYoJ.exe
  2⤵
  PID:1672
- C:\Windows\System\RVKhXeI.exe
  C:\Windows\System\RVKhXeI.exe
  2⤵
  PID:5548
- C:\Windows\System\AxOCbDj.exe
  C:\Windows\System\AxOCbDj.exe
  2⤵
  PID:4776
- C:\Windows\System\XeCtCWP.exe
  C:\Windows\System\XeCtCWP.exe
  2⤵
  PID:11780
- C:\Windows\System\KEnViZX.exe
  C:\Windows\System\KEnViZX.exe
  2⤵
  PID:5384
- C:\Windows\System\wTYXuHh.exe
  C:\Windows\System\wTYXuHh.exe
  2⤵
  PID:3944
- C:\Windows\System\ofGGZKt.exe
  C:\Windows\System\ofGGZKt.exe
  2⤵
  PID:8828
- C:\Windows\System\wmtmSDA.exe
  C:\Windows\System\wmtmSDA.exe
  2⤵
  PID:5820
- C:\Windows\System\YxzWdIK.exe
  C:\Windows\System\YxzWdIK.exe
  2⤵
  PID:2240
- C:\Windows\System\BrTCvMd.exe
  C:\Windows\System\BrTCvMd.exe
  2⤵
  PID:3940
- C:\Windows\System\PfHFFPV.exe
  C:\Windows\System\PfHFFPV.exe
  2⤵
  PID:1132
- C:\Windows\System\ZHSMsAP.exe
  C:\Windows\System\ZHSMsAP.exe
  2⤵
  PID:5532
- C:\Windows\System\lMpLrSh.exe
  C:\Windows\System\lMpLrSh.exe
  2⤵
  PID:10976
- C:\Windows\System\pVArUJk.exe
  C:\Windows\System\pVArUJk.exe
  2⤵
  PID:5980
- C:\Windows\System\oVXhDZZ.exe
  C:\Windows\System\oVXhDZZ.exe
  2⤵
  PID:8760
- C:\Windows\System\QHFPJuc.exe
  C:\Windows\System\QHFPJuc.exe
  2⤵
  PID:13888
- C:\Windows\System\gYULaZu.exe
  C:\Windows\System\gYULaZu.exe
  2⤵
  PID:6396
- C:\Windows\System\ILpAjyx.exe
  C:\Windows\System\ILpAjyx.exe
  2⤵
  PID:5832
- C:\Windows\System\yXrlUDC.exe
  C:\Windows\System\yXrlUDC.exe
  2⤵
  PID:5136
- C:\Windows\System\JOBtkcK.exe
  C:\Windows\System\JOBtkcK.exe
  2⤵
  PID:5156
- C:\Windows\System\YUDPMwV.exe
  C:\Windows\System\YUDPMwV.exe
  2⤵
  PID:14348
- C:\Windows\System\PbVWYKd.exe
  C:\Windows\System\PbVWYKd.exe
  2⤵
  PID:14568
- C:\Windows\System\bEqjnVt.exe
  C:\Windows\System\bEqjnVt.exe
  2⤵
  PID:14592
- C:\Windows\System\prTWmWd.exe
  C:\Windows\System\prTWmWd.exe
  2⤵
  PID:14616
- C:\Windows\System\DFYhbtr.exe
  C:\Windows\System\DFYhbtr.exe
  2⤵
  PID:14648
- C:\Windows\System\OwrAOUB.exe
  C:\Windows\System\OwrAOUB.exe
  2⤵
  PID:14680
- C:\Windows\System\pwmjEjv.exe
  C:\Windows\System\pwmjEjv.exe
  2⤵
  PID:14716
- C:\Windows\System\RruAIwM.exe
  C:\Windows\System\RruAIwM.exe
  2⤵
  PID:14740
- C:\Windows\System\KfIOiyA.exe
  C:\Windows\System\KfIOiyA.exe
  2⤵
  PID:14768
- C:\Windows\System\EsosxEC.exe
  C:\Windows\System\EsosxEC.exe
  2⤵
  PID:14800
- C:\Windows\System\ahEMZzL.exe
  C:\Windows\System\ahEMZzL.exe
  2⤵
  PID:14828
- C:\Windows\System\nqMOXBV.exe
  C:\Windows\System\nqMOXBV.exe
  2⤵
  PID:14856
- C:\Windows\System\xUXHciX.exe
  C:\Windows\System\xUXHciX.exe
  2⤵
  PID:14892
- C:\Windows\System\bEdfIAB.exe
  C:\Windows\System\bEdfIAB.exe
  2⤵
  PID:14916
- C:\Windows\System\CRuGJiZ.exe
  C:\Windows\System\CRuGJiZ.exe
  2⤵
  PID:14944
- C:\Windows\System\CuKFFek.exe
  C:\Windows\System\CuKFFek.exe
  2⤵
  PID:14968
- C:\Windows\System\ncfEUsL.exe
  C:\Windows\System\ncfEUsL.exe
  2⤵
  PID:15012
- C:\Windows\System\uXrzDtr.exe
  C:\Windows\System\uXrzDtr.exe
  2⤵
  PID:15048
- C:\Windows\System\xsHxWeA.exe
  C:\Windows\System\xsHxWeA.exe
  2⤵
  PID:15140
- C:\Windows\System\TskKQEc.exe
  C:\Windows\System\TskKQEc.exe
  2⤵
  PID:15192
- C:\Windows\System\NQRxprC.exe
  C:\Windows\System\NQRxprC.exe
  2⤵
  PID:15256
- C:\Windows\System\XPGuYfD.exe
  C:\Windows\System\XPGuYfD.exe
  2⤵
  PID:5160
- C:\Windows\System\XRKlodx.exe
  C:\Windows\System\XRKlodx.exe
  2⤵
  PID:6516
- C:\Windows\System\dBPDRMV.exe
  C:\Windows\System\dBPDRMV.exe
  2⤵
  PID:14416
- C:\Windows\System\ccAbtna.exe
  C:\Windows\System\ccAbtna.exe
  2⤵
  PID:14404
- C:\Windows\System\ClYpPeI.exe
  C:\Windows\System\ClYpPeI.exe
  2⤵
  PID:6436
- C:\Windows\System\NTImFyH.exe
  C:\Windows\System\NTImFyH.exe
  2⤵
  PID:6424
- C:\Windows\System\kVzkKcl.exe
  C:\Windows\System\kVzkKcl.exe
  2⤵
  PID:14516
- C:\Windows\System\mOhJqQV.exe
  C:\Windows\System\mOhJqQV.exe
  2⤵
  PID:14552
- C:\Windows\System\LXjHwVp.exe
  C:\Windows\System\LXjHwVp.exe
  2⤵
  PID:14600
- C:\Windows\System\qQyxfJa.exe
  C:\Windows\System\qQyxfJa.exe
  2⤵
  PID:5628
- C:\Windows\System\AunwQgT.exe
  C:\Windows\System\AunwQgT.exe
  2⤵
  PID:14688
- C:\Windows\System\RLexWRm.exe
  C:\Windows\System\RLexWRm.exe
  2⤵
  PID:6584
- C:\Windows\System\LuwrVRf.exe
  C:\Windows\System\LuwrVRf.exe
  2⤵
  PID:14812
- C:\Windows\System\NTYCDms.exe
  C:\Windows\System\NTYCDms.exe
  2⤵
  PID:14868
- C:\Windows\System\IVBLzjM.exe
  C:\Windows\System\IVBLzjM.exe
  2⤵
  PID:2408
- C:\Windows\System\fOAoGrb.exe
  C:\Windows\System\fOAoGrb.exe
  2⤵
  PID:15088
- C:\Windows\System\TXhxwvg.exe
  C:\Windows\System\TXhxwvg.exe
  2⤵
  PID:15108
- C:\Windows\System\pXYwjaL.exe
  C:\Windows\System\pXYwjaL.exe
  2⤵
  PID:15212
- C:\Windows\System\EpXCBYG.exe
  C:\Windows\System\EpXCBYG.exe
  2⤵
  PID:15264
- C:\Windows\System\ySNEPAo.exe
  C:\Windows\System\ySNEPAo.exe
  2⤵
  PID:15348
- C:\Windows\System\QqEvBwy.exe
  C:\Windows\System\QqEvBwy.exe
  2⤵
  PID:12784
- C:\Windows\System\vZDpPsM.exe
  C:\Windows\System\vZDpPsM.exe
  2⤵
  PID:7140
- C:\Windows\System\iEWHFCB.exe
  C:\Windows\System\iEWHFCB.exe
  2⤵
  PID:6460
- C:\Windows\System\MvAXpTb.exe
  C:\Windows\System\MvAXpTb.exe
  2⤵
  PID:14384
- C:\Windows\System\qfrTvDi.exe
  C:\Windows\System\qfrTvDi.exe
  2⤵
  PID:5512
- C:\Windows\System\WLKkrQO.exe
  C:\Windows\System\WLKkrQO.exe
  2⤵
  PID:7840
- C:\Windows\System\yNYpaCD.exe
  C:\Windows\System\yNYpaCD.exe
  2⤵
  PID:14656
- C:\Windows\System\RMnPpYg.exe
  C:\Windows\System\RMnPpYg.exe
  2⤵
  PID:6252
- C:\Windows\System\EEdyPVd.exe
  C:\Windows\System\EEdyPVd.exe
  2⤵
  PID:5276
- C:\Windows\System\icZDLzB.exe
  C:\Windows\System\icZDLzB.exe
  2⤵
  PID:8220
- C:\Windows\System\fAxtFHk.exe
  C:\Windows\System\fAxtFHk.exe
  2⤵
  PID:14884
- C:\Windows\System\TLIPuvh.exe
  C:\Windows\System\TLIPuvh.exe
  2⤵
  PID:2224
- C:\Windows\System\UaCMPYk.exe
  C:\Windows\System\UaCMPYk.exe
  2⤵
  PID:14964
- C:\Windows\System\MtenbHx.exe
  C:\Windows\System\MtenbHx.exe
  2⤵
  PID:15204
- C:\Windows\System\qulqCOO.exe
  C:\Windows\System\qulqCOO.exe
  2⤵
  PID:15232
- C:\Windows\System\wPnnqbr.exe
  C:\Windows\System\wPnnqbr.exe
  2⤵
  PID:7544
- C:\Windows\System\aMHqBWt.exe
  C:\Windows\System\aMHqBWt.exe
  2⤵
  PID:15292
- C:\Windows\System\IkQKarL.exe
  C:\Windows\System\IkQKarL.exe
  2⤵
  PID:15284
- C:\Windows\System\fmvOsIm.exe
  C:\Windows\System\fmvOsIm.exe
  2⤵
  PID:3108
- C:\Windows\System\jUzVIsD.exe
  C:\Windows\System\jUzVIsD.exe
  2⤵
  PID:7488
- C:\Windows\System\HfAFoWT.exe
  C:\Windows\System\HfAFoWT.exe
  2⤵
  PID:7728
- C:\Windows\System\PZGSKgs.exe
  C:\Windows\System\PZGSKgs.exe
  2⤵
  PID:5764
- C:\Windows\System\DyplVyW.exe
  C:\Windows\System\DyplVyW.exe
  2⤵
  PID:6012
- C:\Windows\System\CwpVDIt.exe
  C:\Windows\System\CwpVDIt.exe
  2⤵
  PID:14388
- C:\Windows\System\uuCisvf.exe
  C:\Windows\System\uuCisvf.exe
  2⤵
  PID:5400
- C:\Windows\System\IXlsJXx.exe
  C:\Windows\System\IXlsJXx.exe
  2⤵
  PID:14484
- C:\Windows\System\SvMZEkd.exe
  C:\Windows\System\SvMZEkd.exe
  2⤵
  PID:7884
- C:\Windows\System\oWmmdiz.exe
  C:\Windows\System\oWmmdiz.exe
  2⤵
  PID:14544
- C:\Windows\System\VTedBqu.exe
  C:\Windows\System\VTedBqu.exe
  2⤵
  PID:7908
- C:\Windows\System\pzUVRCH.exe
  C:\Windows\System\pzUVRCH.exe
  2⤵
  PID:14548
- C:\Windows\System\RFzozsu.exe
  C:\Windows\System\RFzozsu.exe
  2⤵
  PID:8028
- C:\Windows\System\KywwwkI.exe
  C:\Windows\System\KywwwkI.exe
  2⤵
  PID:7108
- C:\Windows\System\kuaOvVu.exe
  C:\Windows\System\kuaOvVu.exe
  2⤵
  PID:704
- C:\Windows\System\EWVpKyJ.exe
  C:\Windows\System\EWVpKyJ.exe
  2⤵
  PID:14756
- C:\Windows\System\OSbIDHa.exe
  C:\Windows\System\OSbIDHa.exe
  2⤵
  PID:8144
- C:\Windows\System\TCYjmsJ.exe
  C:\Windows\System\TCYjmsJ.exe
  2⤵
  PID:8284
- C:\Windows\System\sMaEoAO.exe
  C:\Windows\System\sMaEoAO.exe
  2⤵
  PID:7196
- C:\Windows\System\rcvEYFa.exe
  C:\Windows\System\rcvEYFa.exe
  2⤵
  PID:6804
- C:\Windows\System\ltZJsIN.exe
  C:\Windows\System\ltZJsIN.exe
  2⤵
  PID:6868
- C:\Windows\System\NovGrWj.exe
  C:\Windows\System\NovGrWj.exe
  2⤵
  PID:15076
- C:\Windows\System\yRjJCwq.exe
  C:\Windows\System\yRjJCwq.exe
  2⤵
  PID:15104
- C:\Windows\System\HZjtIgT.exe
  C:\Windows\System\HZjtIgT.exe
  2⤵
  PID:8004
- C:\Windows\System\MsveKiB.exe
  C:\Windows\System\MsveKiB.exe
  2⤵
  PID:6020
- C:\Windows\System\UvZngoC.exe
  C:\Windows\System\UvZngoC.exe
  2⤵
  PID:15176
- C:\Windows\System\JAGENMC.exe
  C:\Windows\System\JAGENMC.exe
  2⤵
  PID:7712
- C:\Windows\System\tUgMPvV.exe
  C:\Windows\System\tUgMPvV.exe
  2⤵
  PID:7096
- C:\Windows\System\rSkIKYs.exe
  C:\Windows\System\rSkIKYs.exe
  2⤵
  PID:5760
- C:\Windows\System\HsLKWqk.exe
  C:\Windows\System\HsLKWqk.exe
  2⤵
  PID:7164
- C:\Windows\System\dUtkTJZ.exe
  C:\Windows\System\dUtkTJZ.exe
  2⤵
  PID:8956
- C:\Windows\System\MjNraHL.exe
  C:\Windows\System\MjNraHL.exe
  2⤵
  PID:7716
- C:\Windows\System\BKJcDNh.exe
  C:\Windows\System\BKJcDNh.exe
  2⤵
  PID:9068
- C:\Windows\System\HwhXoBv.exe
  C:\Windows\System\HwhXoBv.exe
  2⤵
  PID:5996
- C:\Windows\System\sQSDEXj.exe
  C:\Windows\System\sQSDEXj.exe
  2⤵
  PID:8276
- C:\Windows\System\TccfBLO.exe
  C:\Windows\System\TccfBLO.exe
  2⤵
  PID:9184
- C:\Windows\System\zkIgyry.exe
  C:\Windows\System\zkIgyry.exe
  2⤵
  PID:7564
- C:\Windows\System\SMRrCvK.exe
  C:\Windows\System\SMRrCvK.exe
  2⤵
  PID:4772
- C:\Windows\System\NqfIeYt.exe
  C:\Windows\System\NqfIeYt.exe
  2⤵
  PID:7960
- C:\Windows\System\seFSpcp.exe
  C:\Windows\System\seFSpcp.exe
  2⤵
  PID:14764
- C:\Windows\System\RhhzkUC.exe
  C:\Windows\System\RhhzkUC.exe
  2⤵
  PID:7660
- C:\Windows\System\LfMbwrF.exe
  C:\Windows\System\LfMbwrF.exe
  2⤵
  PID:8856
- C:\Windows\System\tyeBtBG.exe
  C:\Windows\System\tyeBtBG.exe
  2⤵
  PID:8884
- C:\Windows\System\PouTMkV.exe
  C:\Windows\System\PouTMkV.exe
  2⤵
  PID:6316
- C:\Windows\System\QsiSjtj.exe
  C:\Windows\System\QsiSjtj.exe
  2⤵
  PID:14984
- C:\Windows\System\oSHGgif.exe
  C:\Windows\System\oSHGgif.exe
  2⤵
  PID:7680
- C:\Windows\System\PpuBqMA.exe
  C:\Windows\System\PpuBqMA.exe
  2⤵
  PID:6324
- C:\Windows\System\IQNcIlX.exe
  C:\Windows\System\IQNcIlX.exe
  2⤵
  PID:6680
- C:\Windows\System\uAAgbra.exe
  C:\Windows\System\uAAgbra.exe
  2⤵
  PID:7964
- C:\Windows\System\WgZSpoQ.exe
  C:\Windows\System\WgZSpoQ.exe
  2⤵
  PID:15328
- C:\Windows\System\qyOfKud.exe
  C:\Windows\System\qyOfKud.exe
  2⤵
  PID:9616
- C:\Windows\System\cpxXsrg.exe
  C:\Windows\System\cpxXsrg.exe
  2⤵
  PID:7656
- C:\Windows\System\zKwujOH.exe
  C:\Windows\System\zKwujOH.exe
  2⤵
  PID:15152
- C:\Windows\System\LndYNhp.exe
  C:\Windows\System\LndYNhp.exe
  2⤵
  PID:15356
- C:\Windows\System\sdtkNFg.exe
  C:\Windows\System\sdtkNFg.exe
  2⤵
  PID:9540
- C:\Windows\System\tyDUkkO.exe
  C:\Windows\System\tyDUkkO.exe
  2⤵
  PID:7344
- C:\Windows\System\kAIOIxy.exe
  C:\Windows\System\kAIOIxy.exe
  2⤵
  PID:15124
- C:\Windows\System\ZNEfGeQ.exe
  C:\Windows\System\ZNEfGeQ.exe
  2⤵
  PID:10436
- C:\Windows\System\eCsXEri.exe
  C:\Windows\System\eCsXEri.exe
  2⤵
  PID:10596
- C:\Windows\System\LdbVXoa.exe
  C:\Windows\System\LdbVXoa.exe
  2⤵
  PID:8096
- C:\Windows\System\mSXNvSs.exe
  C:\Windows\System\mSXNvSs.exe
  2⤵
  PID:10700
- C:\Windows\System\NHusbMP.exe
  C:\Windows\System\NHusbMP.exe
  2⤵
  PID:7476
- C:\Windows\System\mDUFxQi.exe
  C:\Windows\System\mDUFxQi.exe
  2⤵
  PID:8036
- C:\Windows\System\cnuBcAB.exe
  C:\Windows\System\cnuBcAB.exe
  2⤵
  PID:10740
- C:\Windows\System\jyEiaXL.exe
  C:\Windows\System\jyEiaXL.exe
  2⤵
  PID:5880
- C:\Windows\System\lSXbHWy.exe
  C:\Windows\System\lSXbHWy.exe
  2⤵
  PID:8428
- C:\Windows\System\cocgNTA.exe
  C:\Windows\System\cocgNTA.exe
  2⤵
  PID:14780
- C:\Windows\System\DjyDCmO.exe
  C:\Windows\System\DjyDCmO.exe
  2⤵
  PID:6112
- C:\Windows\System\dgdCScB.exe
  C:\Windows\System\dgdCScB.exe
  2⤵
  PID:5004
- C:\Windows\System\DoCFUuZ.exe
  C:\Windows\System\DoCFUuZ.exe
  2⤵
  PID:7836
- C:\Windows\System\DrUVuGc.exe
  C:\Windows\System\DrUVuGc.exe
  2⤵
  PID:10864
- C:\Windows\System\rgngbGq.exe
  C:\Windows\System\rgngbGq.exe
  2⤵
  PID:15008
- C:\Windows\System\oPeEygd.exe
  C:\Windows\System\oPeEygd.exe
  2⤵
  PID:7704
- C:\Windows\System\DLYXvUX.exe
  C:\Windows\System\DLYXvUX.exe
  2⤵
  PID:7684
- C:\Windows\System\YdCYkVd.exe
  C:\Windows\System\YdCYkVd.exe
  2⤵
  PID:10244
- C:\Windows\System\UgYadoZ.exe
  C:\Windows\System\UgYadoZ.exe
  2⤵
  PID:9412
- C:\Windows\System\nZLKZos.exe
  C:\Windows\System\nZLKZos.exe
  2⤵
  PID:1980
- C:\Windows\System\blEdTVe.exe
  C:\Windows\System\blEdTVe.exe
  2⤵
  PID:9128
- C:\Windows\System\WWqEsZc.exe
  C:\Windows\System\WWqEsZc.exe
  2⤵
  PID:14844
- C:\Windows\System\yGWVJwA.exe
  C:\Windows\System\yGWVJwA.exe
  2⤵
  PID:8816
- C:\Windows\System\GFdHMiV.exe
  C:\Windows\System\GFdHMiV.exe
  2⤵
  PID:14368
- C:\Windows\System\vOGoluA.exe
  C:\Windows\System\vOGoluA.exe
  2⤵
  PID:10116
- C:\Windows\System\aBvGwSN.exe
  C:\Windows\System\aBvGwSN.exe
  2⤵
  PID:6892
- C:\Windows\System\atiOhDp.exe
  C:\Windows\System\atiOhDp.exe
  2⤵
  PID:7440
- C:\Windows\System\IFaQMGP.exe
  C:\Windows\System\IFaQMGP.exe
  2⤵
  PID:10368
- C:\Windows\System\zJeakxg.exe
  C:\Windows\System\zJeakxg.exe
  2⤵
  PID:8112
- C:\Windows\System\GrEFKOB.exe
  C:\Windows\System\GrEFKOB.exe
  2⤵
  PID:4908
- C:\Windows\System\bZXMDnw.exe
  C:\Windows\System\bZXMDnw.exe
  2⤵
  PID:10656
- C:\Windows\System\xfsbWSn.exe
  C:\Windows\System\xfsbWSn.exe
  2⤵
  PID:9136
- C:\Windows\System\WoyUqfQ.exe
  C:\Windows\System\WoyUqfQ.exe
  2⤵
  PID:8236
- C:\Windows\System\ZTrHgAA.exe
  C:\Windows\System\ZTrHgAA.exe
  2⤵
  PID:12136
- C:\Windows\System\KorKfDn.exe
  C:\Windows\System\KorKfDn.exe
  2⤵
  PID:7708
- C:\Windows\System\UTgfeah.exe
  C:\Windows\System\UTgfeah.exe
  2⤵
  PID:8024
- C:\Windows\System\XRYwuhz.exe
  C:\Windows\System\XRYwuhz.exe
  2⤵
  PID:10632
- C:\Windows\System\YGpcjfK.exe
  C:\Windows\System\YGpcjfK.exe
  2⤵
  PID:8148
- C:\Windows\System\jBzkwUF.exe
  C:\Windows\System\jBzkwUF.exe
  2⤵
  PID:10884
- C:\Windows\System\uLpBdqw.exe
  C:\Windows\System\uLpBdqw.exe
  2⤵
  PID:15268
- C:\Windows\System\iGHoBFY.exe
  C:\Windows\System\iGHoBFY.exe
  2⤵
  PID:9316
- C:\Windows\System\ATqfknH.exe
  C:\Windows\System\ATqfknH.exe
  2⤵
  PID:9012
- C:\Windows\System\nekVGic.exe
  C:\Windows\System\nekVGic.exe
  2⤵
  PID:10372
- C:\Windows\System\FlAePeR.exe
  C:\Windows\System\FlAePeR.exe
  2⤵
  PID:7820
- C:\Windows\System\jsGhdRw.exe
  C:\Windows\System\jsGhdRw.exe
  2⤵
  PID:9576
- C:\Windows\System\DnzKSGM.exe
  C:\Windows\System\DnzKSGM.exe
  2⤵
  PID:6560
- C:\Windows\System\xztWelE.exe
  C:\Windows\System\xztWelE.exe
  2⤵
  PID:10856
- C:\Windows\System\jtLMKMT.exe
  C:\Windows\System\jtLMKMT.exe
  2⤵
  PID:9972
- C:\Windows\System\pXBiOEF.exe
  C:\Windows\System\pXBiOEF.exe
  2⤵
  PID:7460
- C:\Windows\System\rBuieBC.exe
  C:\Windows\System\rBuieBC.exe
  2⤵
  PID:7100
- C:\Windows\System\QPZAbda.exe
  C:\Windows\System\QPZAbda.exe
  2⤵
  PID:9836
- C:\Windows\System\XVMzvjo.exe
  C:\Windows\System\XVMzvjo.exe
  2⤵
  PID:9924
- C:\Windows\System\MedDOeB.exe
  C:\Windows\System\MedDOeB.exe
  2⤵
  PID:1216
- C:\Windows\System\MseorjC.exe
  C:\Windows\System\MseorjC.exe
  2⤵
  PID:10132
- C:\Windows\System\yfZIbqe.exe
  C:\Windows\System\yfZIbqe.exe
  2⤵
  PID:10612
- C:\Windows\System\YtBEzZR.exe
  C:\Windows\System\YtBEzZR.exe
  2⤵
  PID:8000
- C:\Windows\System\ehhdmgK.exe
  C:\Windows\System\ehhdmgK.exe
  2⤵
  PID:10160
- C:\Windows\System\CNSCVzA.exe
  C:\Windows\System\CNSCVzA.exe
  2⤵
  PID:9488
- C:\Windows\System\baNzDGA.exe
  C:\Windows\System\baNzDGA.exe
  2⤵
  PID:14440
- C:\Windows\System\xKhijPG.exe
  C:\Windows\System\xKhijPG.exe
  2⤵
  PID:8196
- C:\Windows\System\BogCDsP.exe
  C:\Windows\System\BogCDsP.exe
  2⤵
  PID:10576
- C:\Windows\System\xndnflJ.exe
  C:\Windows\System\xndnflJ.exe
  2⤵
  PID:9436
- C:\Windows\System\vzUmxBR.exe
  C:\Windows\System\vzUmxBR.exe
  2⤵
  PID:11868
- C:\Windows\System\IjyWsNV.exe
  C:\Windows\System\IjyWsNV.exe
  2⤵
  PID:7144
- C:\Windows\System\qtQtlpJ.exe
  C:\Windows\System\qtQtlpJ.exe
  2⤵
  PID:10752
- C:\Windows\System\VWtkAMf.exe
  C:\Windows\System\VWtkAMf.exe
  2⤵
  PID:10516
- C:\Windows\System\WDMEXsk.exe
  C:\Windows\System\WDMEXsk.exe
  2⤵
  PID:4372
- C:\Windows\System\UlozBGX.exe
  C:\Windows\System\UlozBGX.exe
  2⤵
  PID:12324
- C:\Windows\System\HpqOuaN.exe
  C:\Windows\System\HpqOuaN.exe
  2⤵
  PID:12512
- C:\Windows\System\DEMqlWz.exe
  C:\Windows\System\DEMqlWz.exe
  2⤵
  PID:4704
- C:\Windows\System\OYUrKFP.exe
  C:\Windows\System\OYUrKFP.exe
  2⤵
  PID:4268
- C:\Windows\System\esrvTXS.exe
  C:\Windows\System\esrvTXS.exe
  2⤵
  PID:12184
- C:\Windows\System\wRLDCLC.exe
  C:\Windows\System\wRLDCLC.exe
  2⤵
  PID:11152
- C:\Windows\System\GYSAJWQ.exe
  C:\Windows\System\GYSAJWQ.exe
  2⤵
  PID:6716
- C:\Windows\System\XsyPZmK.exe
  C:\Windows\System\XsyPZmK.exe
  2⤵
  PID:11288
- C:\Windows\System\mNdJjTG.exe
  C:\Windows\System\mNdJjTG.exe
  2⤵
  PID:10120
- C:\Windows\System\QkIFspt.exe
  C:\Windows\System\QkIFspt.exe
  2⤵
  PID:7264
- C:\Windows\System\tlljASd.exe
  C:\Windows\System\tlljASd.exe
  2⤵
  PID:12964
- C:\Windows\System\JnJzmQD.exe
  C:\Windows\System\JnJzmQD.exe
  2⤵
  PID:12944
- C:\Windows\System\aHdgeho.exe
  C:\Windows\System\aHdgeho.exe
  2⤵
  PID:6428
- C:\Windows\System\tCFvJBc.exe
  C:\Windows\System\tCFvJBc.exe
  2⤵
  PID:13020
- C:\Windows\System\WoTnCxn.exe
  C:\Windows\System\WoTnCxn.exe
  2⤵
  PID:12616
- C:\Windows\System\vNhZfAV.exe
  C:\Windows\System\vNhZfAV.exe
  2⤵
  PID:6044
- C:\Windows\System\PneGXMD.exe
  C:\Windows\System\PneGXMD.exe
  2⤵
  PID:9248
- C:\Windows\System\VEguVYb.exe
  C:\Windows\System\VEguVYb.exe
  2⤵
  PID:10812
- C:\Windows\System\WvxJUHy.exe
  C:\Windows\System\WvxJUHy.exe
  2⤵
  PID:13040
- C:\Windows\System\fTiSwNA.exe
  C:\Windows\System\fTiSwNA.exe
  2⤵
  PID:12524
- C:\Windows\System\twYHvHD.exe
  C:\Windows\System\twYHvHD.exe
  2⤵
  PID:13052
- C:\Windows\System\gVTLUTw.exe
  C:\Windows\System\gVTLUTw.exe
  2⤵
  PID:9908
- C:\Windows\System\rKtOyNX.exe
  C:\Windows\System\rKtOyNX.exe
  2⤵
  PID:9376
- C:\Windows\System\yNCdhHc.exe
  C:\Windows\System\yNCdhHc.exe
  2⤵
  PID:12788
- C:\Windows\System\xcnpcfD.exe
  C:\Windows\System\xcnpcfD.exe
  2⤵
  PID:11260
- C:\Windows\System\dddynan.exe
  C:\Windows\System\dddynan.exe
  2⤵
  PID:12108
- C:\Windows\System\wyxPWDN.exe
  C:\Windows\System\wyxPWDN.exe
  2⤵
  PID:12676
- C:\Windows\System\ivqqOJi.exe
  C:\Windows\System\ivqqOJi.exe
  2⤵
  PID:13072
- C:\Windows\System\aCfNLDE.exe
  C:\Windows\System\aCfNLDE.exe
  2⤵
  PID:13080
- C:\Windows\System\BbmnRhi.exe
  C:\Windows\System\BbmnRhi.exe
  2⤵
  PID:13084
- C:\Windows\System\QedGtiG.exe
  C:\Windows\System\QedGtiG.exe
  2⤵
  PID:2864
- C:\Windows\System\XCrGqGU.exe
  C:\Windows\System\XCrGqGU.exe
  2⤵
  PID:12972
- C:\Windows\System\fmPIOUy.exe
  C:\Windows\System\fmPIOUy.exe
  2⤵
  PID:12268
- C:\Windows\System\atLiDOR.exe
  C:\Windows\System\atLiDOR.exe
  2⤵
  PID:12984
- C:\Windows\System\IuNXzFA.exe
  C:\Windows\System\IuNXzFA.exe
  2⤵
  PID:12988
- C:\Windows\System\cJwbOUI.exe
  C:\Windows\System\cJwbOUI.exe
  2⤵
  PID:7308
- C:\Windows\System\QnbGINr.exe
  C:\Windows\System\QnbGINr.exe
  2⤵
  PID:10204
- C:\Windows\System\PicMCoj.exe
  C:\Windows\System\PicMCoj.exe
  2⤵
  PID:8120
- C:\Windows\System\YJCnrYO.exe
  C:\Windows\System\YJCnrYO.exe
  2⤵
  PID:5312
- C:\Windows\System\sDZwFfW.exe
  C:\Windows\System\sDZwFfW.exe
  2⤵
  PID:8332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3rken2fl.pk0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BoLEjnu.exe

Filesize
2.1MB

MD5
f6816d7bb758e37b48f7daecf87c4189

SHA1
51ae4b31ba8a5427a8d5f5a62568dc8c9e6ea4fc

SHA256
be8229e1f6ebd15b32cad5a79f073476b3285f285d07eccc0e94b156fc17df78

SHA512
be6f4d5c0f48319a2ba452210e6ea281287bdcb6c282b57c8ffe7a331338f694d3e673a6f259cc8eca0e3492b3ada33dc2d3e24d284140d5795afeb1bbdb70dc

Download Submit
C:\Windows\System\EFZUsTv.exe

Filesize
2.1MB

MD5
07cf35b36a9b84ec6fe916d0bdb5f54f

SHA1
e6622f6bbf44d482d13165e35f669bfaa04ea177

SHA256
9fd8e4d5b272e26e017951015c55835b358f0dda783228b4d2645055850df6e0

SHA512
d720cce0d42f230cef2fd38060ede022cb71ffded1dbea683675a13273f5cec861fe4b101595c7c7eb7d4c7def3ff4506ccce259d11767ec525b7373a59e4d75

Download Submit
C:\Windows\System\EXGFOjA.exe

Filesize
2.1MB

MD5
2ab4dca90bbf2ce549c8c3da9c10915e

SHA1
9976344d3b88a155ca52686a056df843cd482934

SHA256
1228f04afce4f020d8c8897f6d811b14b58fd45e831185ebd2d32ca02938ff5c

SHA512
63af6c5fb3a9fb4eecd81f9701de4812981771df1db9b45d1cf6f5593f536dca67f3e0f754b6a88fee8a3749edccf61ee9a310919a66d9c39d72c43049a1fd83

Download Submit
C:\Windows\System\FbLhIXD.exe

Filesize
18B

MD5
6fe0013890c63ded4f8ff8d16df87289

SHA1
289a7f6e7968aae7b8549ffdd9b978b9db978f87

SHA256
f199c68e43f0f5c8e50bcae2d18e89d3e5e39dfc93aaed12249762ab112691d0

SHA512
d134172fdc11063e45454e6619b8bda3721fc09f325a67b3b4cca8ebbee69cce74d83053e73b70efdb9a6a1fc832c4bc1df3f3d00e9ae3195b7ef87287e98e09

Download Submit
C:\Windows\System\FxDaFif.exe

Filesize
2.1MB

MD5
d72d965e2669cb1db606567eadb8a473

SHA1
ef1123e101e54822f3461447fb5db284acef1708

SHA256
b079c1d0563ead5367c1ae303149877bc4af013aa39e7f8169b139d08a5e30e7

SHA512
52cd13b3d813ddf5abe6d92468de933413435b6db20470e2845c2268f7068a3a27ca197e834717702a8c2923a10d05c2f6242f2bcf6abac4ad48cf817a976d32

Download Submit
C:\Windows\System\GdcwPst.exe

Filesize
2.1MB

MD5
1f9b826dc48167a28fc3e3bda062ce14

SHA1
312e41d279cbab782c74b7d7328ede4b110b3363

SHA256
81506ff5289c2132b81fe21c060d003ee4ca6221e6289ba95bba2d2664ceb8d8

SHA512
9c5ea51fde8da8999fa5b440305bb6055f83cb93439048a01e60fefacbb0ad70c80e279b224fbae25ca85fb0b0fb95f23cdefa03e1182c3fa0c24c86e57dda65

Download Submit
C:\Windows\System\GoKQEqJ.exe

Filesize
2.1MB

MD5
cf0c1ad2dbfd516d52fe0fb9e5cbf916

SHA1
0d0f4258b7b11e5c3b763da088d664d832253b84

SHA256
7c5836c714853034b20af87b78232daf9df39cf05a5cef8d24d19d0d4fecb7ff

SHA512
9b86fde1f8e4fb08fba6b6191bd5916cc0760c35b4356dbf228600ed0d3df9f3b79440c70b612067252828dca53c99771d2aed12e4ab16c4f51d27e1511deb64

Download Submit
C:\Windows\System\HqCvQGk.exe

Filesize
2.1MB

MD5
a67376ba986b4695d72bcf37c9a39002

SHA1
4b141b1ba37f8ce971afc5a5fc59c1b67bcff2c2

SHA256
ff30e706c85771a3081b5aabeac3bf6af4c42b8d4350326ad5b280c8a244f559

SHA512
fdc5de5cf634c57d4deec67685d81f50f0fa31def4f349adfa277342d0e18bc027a9e79ac71bdd15391294f8a1e0292b3f5ee4006b3fa4247f61917a16298bd1

Download Submit
C:\Windows\System\LMfbgty.exe

Filesize
2.1MB

MD5
43c489081df3bbee4180e7612271aec0

SHA1
984a29ebe0a94dc7f5b6508c14e974794e60e3a1

SHA256
5f4c7ad683c4ae56931b354010bc047ef1bdb3def8c7a3aa1ac030b551730808

SHA512
acd5f83c35a2cc306f05dcfae7f3fda583468898b07d752cd73fb6fabc6416a784ae380ff86b079b7edf8a74b42676e4060f67c61390ef3ea52ec6c2013d5a38

Download Submit
C:\Windows\System\LrAylmc.exe

Filesize
2.1MB

MD5
5529e6961a4c772ea539718113e609e0

SHA1
af8af6ecca89bf8ca21d1a5af99202fcaa4d5fff

SHA256
58b0d4d3cfe8402b21b3540d55126534b5e703b16a57f1593edaf9d6802b67cd

SHA512
5fdebc6aea3e17c27daaab5efdcd910ade3924f772e0ddd84a19b722f8c6d99a729536745d76979956e100cfbd176e4365e35ba9f23a4ab5f7479cf0bbca4d91

Download Submit
C:\Windows\System\MqxiJvt.exe

Filesize
2.1MB

MD5
485c28578a5ec32cc14bbbce6aa89abc

SHA1
0f378195904febbfc8f268a2c6ffb077f81469a6

SHA256
83a0d75ed91d7cf525eff414d61cfb8179bb37fe6c109f02baae0dd69ae240fb

SHA512
05f2cd4d59d3186fd70ab25aac8efefeee3f9a4803e62c39c77c49608a7ac00ca1454c0617f20e95542e8bec8957e1db9208bb2758b833cfee00411471eb3db4

Download Submit
C:\Windows\System\NRbQEzM.exe

Filesize
2.1MB

MD5
1f7483dee0e1abd9dc677efb440a0092

SHA1
24dd901ea7d97bd4538ead577649819309ca5f3b

SHA256
38e0c642f1c03834aad08382311be1896b19514c2b5ef9a9258c463df6a9d03d

SHA512
c917b34487e05f6879c470ac4cf597938a70b0604adb001f1cbd4070355893140e90dd146531269b8cf07f35eb81ee57986b9e4053ecb629df98640cf5e8bed2

Download Submit
C:\Windows\System\NXxvYpN.exe

Filesize
2.1MB

MD5
333d5c62a8eaf925e31617e683467ef2

SHA1
520dce2293b89d56dd27ef961316a0acd0e80594

SHA256
0f7f7b3ee9ae7d639976c71f6d3d16327b8f9e17b7df29841d57ce68fe22c75d

SHA512
0ef3580a0b2b3fdc10bd7cfb484ef6f3e57f83c9de55a3e2636506ed5a606d107317860d8bfc437216c7a7c9a2007144705a566327fc6bc647d70b98451a96f0

Download Submit
C:\Windows\System\NjHmOlV.exe

Filesize
2.1MB

MD5
fab641fc5be578ee479e2bf3233fcc26

SHA1
639f3ab2849a344a3060fddac41a8dedfe9a047c

SHA256
b61f091c0a3d14c6534b34ba2e861cc985b513a3165ed3a7d12f9d6dce78dba8

SHA512
5f5cfb436fbddd4938c0784857f39ee14089c11b79e907e308a6c74c65c489268cc17dcb074a0209c4994a789f8c68fd8737b53b4926f07f44ec1d54f518cdaf

Download Submit
C:\Windows\System\OXsrHmn.exe

Filesize
8B

MD5
408407fe49e2a1bd1de2fb4f4e1c1e4e

SHA1
6781f0ed16b9f9a0e8a861848782ae1a9b183885

SHA256
413c20c52ba69478c63daee39bcd70926f09cbc71ce3aa1577802440938b324a

SHA512
51204da6f17b6725f4e9b8b9381f34a7ed365926b3780a3bfe9e8d70ab81ec8caad96b3f0838e87a0f0c0c6baeed1ea2ea2f5c7ee1fa6a13b720a1ec69c3f3fd

Download Submit
C:\Windows\System\PPgGioD.exe

Filesize
2.1MB

MD5
d5301a8494550b22f2c36107e5a56505

SHA1
b8e9b741cd95709794ba55478a6243f8c44366bb

SHA256
f21faffb8d12f1156ef1432f1e3634051e8240de0dcd0b50125e69e53423868e

SHA512
532711561aa5173d0356b5db8dc879fcdb8bd60d1a57f3f4fd0de2c8e544364ea526ef89538b3bcaa76d7bd28d66696e3a51b7582c4334ac72c846add549cce9

Download Submit
C:\Windows\System\ReJOIeL.exe

Filesize
2.1MB

MD5
2aa4fe0059ac2219f51a7aa92558906e

SHA1
a8f302248b9c5a44d5435ee0605f6575378c1915

SHA256
9839e71fd6b0fa424a52d83b21216629b718138357ed8c0d4d603811332fb46d

SHA512
e93257fd227bd623e52a68c6c69437f64bdd2c763f0084e639a653075010f7ef3544ad55ec8bb245f65744179d4d96a32fe312cda8ec505ae4e6a4259c80dd2a

Download Submit
C:\Windows\System\ToXJoYC.exe

Filesize
2.1MB

MD5
72d00f7de0ca701d43bfc732ec12579f

SHA1
2f851e222b536e9d3710e4c5ed319d89bc483a24

SHA256
ece437948709b8ff594e11c5811f68ca2ab150535ce03e343d08070abadb73db

SHA512
d9d58ad65f07cfbea91f8cb15f14566d30a6df3b0385f98e9d7ffa2ae20e5b3cc6a9e8ae4fc52d8305a7363cd7c513ee23fc750b2d17425329369b5ba1ad8949

Download Submit
C:\Windows\System\TvgjNek.exe

Filesize
2.1MB

MD5
c457cc6a8889b117573348dbe6e21593

SHA1
b681d0cf2c7d1e1e3d40962a80ba9247f6a37230

SHA256
db26bea4d6e8f3c6c5baf2e4c57c13a12181f43176851783901d08fd1eb29f61

SHA512
e4103b7df009ed747ce6e063c4e7604f4f0d39a5c308e102698c7d97a5ffeb17175aa646115a0e99568899d756999ae11e272d1f001b965507e2e679be4391b8

Download Submit
C:\Windows\System\UTvTlvF.exe

Filesize
2.1MB

MD5
ea48d948cd15fa49f1668d1f45b37533

SHA1
9d80e38585fb4d4c19cbacc6e6d5e90a4c88d687

SHA256
ae25c28c6db6ab28791f648a2c6a419fd6a7abd51dd7bd6a1a5d4df78a4effc7

SHA512
04cfc0d6a17c6ec848fb26acef6f4fad33415d981ea96d75f53ac68034b03947f51345b3dc0b5b736cf776f0370abd593cf155b53c452c044958212872567a73

Download Submit
C:\Windows\System\XPfHLnO.exe

Filesize
2.1MB

MD5
f89a631c1e5adce14385c126cb74727b

SHA1
46cf685e1ff7bfbceabce5326b23ae6d081e674b

SHA256
81c183f1a00106504dc4b896b2ff3dbd0a33c68e87ad62d9c70545c47e2dcec4

SHA512
6f9b785425de73b6b05b3cd5b059fcab049e5eef7876945163ab7b1d3f037fe406b00cd1a8bc55e8585d2c43fe00acb4a2b97d980069d2b0ee86bc5379822747

Download Submit
C:\Windows\System\YCVObKk.exe

Filesize
2.1MB

MD5
5f95b5bf584b4b709d174bf539478d10

SHA1
3e76b56ac505e78c97ba7175817344c5eb1bc895

SHA256
cc8a089d1e26756ed6444789c67b1dd62ff41eb8fd893a765b9aaaa20ac86586

SHA512
33840db8a4e6b16add2f97c3404019e4d9b1d9f58a31b1b188b46787ad5a482729d2c4d8d8f9d7538bab3807850f2a68c8b933a381a9e64240a7d97ab7ca0455

Download Submit
C:\Windows\System\YImeMZb.exe

Filesize
2.1MB

MD5
3a31f5ec017e578302b88e5c33a59c75

SHA1
18cee06b6d5b0cf04ae4c22750ddae2dbc9dcc1b

SHA256
191b91fd534dd1c0895a8ca6a85917a9b3f857b5ee1c1fb31628bd813b2b215f

SHA512
014c81c20f9fd89916920bbee2ef67b45b108abca72f25862aaf73f61344d8af975c9badef6f39e68e154008b7ce5fed70a1a02eeac40cfa8815f5ee2317d90a

Download Submit
C:\Windows\System\eLiRjzB.exe

Filesize
2.1MB

MD5
0d58e997e17b2ee9b812eea1715b31c4

SHA1
3d7af3120420ef27cfb4475abc46343db7de56a9

SHA256
0072de998928ee4282aec4a86b434a4640a245c83bba7d351519bb811aae9448

SHA512
1c8fd85ad5d4d6d2fe19e188047b6ca846c7b678031b388c12bca29bdcda19c3b4bf617020431ddf3e02d6de1e6a3fcfb7f220bda12a16ccbdb239b63afc2016

Download Submit
C:\Windows\System\fOpPKnV.exe

Filesize
2.1MB

MD5
3deeb9e9fb5c51683aca77ce2f1ec546

SHA1
0dc6fb32caa6092ec7542462593ed2a859e3ee6e

SHA256
e387cf9d82a906da04cf175affe154346b695c3ed630ede20fbd8414d2d8ca67

SHA512
e4e5751dfd477ef7a6c50ad71dfc8ca38fe78c9de5fcf960b40fd1cedca7dc34608b3bc593d1bbe7d8d5f516066297a55f5360a7221cbb47175ab50e0c227626

Download Submit
C:\Windows\System\fwdFIaL.exe

Filesize
2.1MB

MD5
9ed851042e4900630a4499b36188ac21

SHA1
3a5189f04bcedaaa496d7cae9e3bc4363300b24c

SHA256
6f37f7807467ba0b00dc77bfc881577778616f0ad87735c7cc272b9793ccbeed

SHA512
c09f97fea74b4d3c41e5d648935830aa2db21c6debe283f45ebe7e03263af1d3a29cb0ab9065d2f50d36eadf37422b54aa2cdfc8a52b5ab4e5aaaff8b91a95e5

Download Submit
C:\Windows\System\hnexfVD.exe

Filesize
2.1MB

MD5
fe692b42cc2797173bbebc8b898a38a2

SHA1
1dee29d51068b3ac05255f1a5cdf6bc8d5c85509

SHA256
f53957dcbf6ba3513c10b53bac7ae8e67f440237189192fcf6ab5cc5233964de

SHA512
126fc6c17b6137e417fc2b33eab7ea9d1f12b172bbb9e8f59e9b88d419d15fd9d7e63e6d1f04629a3a71e453d8b1a2f34248ba9801187d78e0cf7bcf068dcbfe

Download Submit
C:\Windows\System\hvbhrit.exe

Filesize
2.1MB

MD5
b1dabe7d3e5310b8d2ee08ed9cfa01d5

SHA1
37d5f92c71ec5ab175194be66f668f2c0a2f89cd

SHA256
e17a906b9e3dbf9e48694aa6d5ec089a454130b587200d9703fb65635e038259

SHA512
b24d229ebf44daa87d4462cc54fa4a1b71d55694984fc7d12e196578a37cf03985ca787f14410ec7f04828ced1ab6916acf5c642c399dffb11222dc9a9479735

Download Submit
C:\Windows\System\iLmvEzL.exe

Filesize
2.1MB

MD5
1380e5a954942c3c74f13de0f57167e5

SHA1
48a69fd33aff014f86bcd7790edd13f61c343d9e

SHA256
2d46bb0856dd83de00c07daa2e2fa4bd7c0441aa89e5c93bbc035cbbdd050911

SHA512
f7f49676eebc4428e0f078d5ccc4546e7639e2fc7c4a9d280246eff3dabe5691406418bfbf9afbf143f0c6b6282b5f86723fcd1d8db0839ba1e573e0f9579055

Download Submit
C:\Windows\System\ifuGyYq.exe

Filesize
2.1MB

MD5
fbf6b1317157132d680d5428788ca91d

SHA1
8b502cadda0717147cf8cb1c319311a1eeae9aff

SHA256
7ea79bac4db6e9fd5f7dbe696d036c7745edab5395d8409dba53e0352bd0c582

SHA512
42d8ad826915e36b88baecf3139e64ddeb827f57c6cb397e9eafbe12222d9c691c9d2b78e59f21d2be63ab6b7116e3bd9e4955016e7119d84615503de210bcdf

Download Submit
C:\Windows\System\iyIOGKE.exe

Filesize
2.1MB

MD5
f62369215f16da70beef9ff77ad9b37b

SHA1
c22573b67e0e7e61ba771740b4342b0c9934c75e

SHA256
74f4577369880d80330276267f06acb2ea58490546a8c2b354dd1b61c0d33655

SHA512
75c152a3a99924e89e03fa10c6bc7f695976f7ba7aa861e1570433be00ab6cfb9b56a2661bb93977b555b690810416cc3876e52fa3f5141ec9b4023ac07c53a0

Download Submit
C:\Windows\System\kOgxOrI.exe

Filesize
2.1MB

MD5
46bd633f6bbd009771abed756e79d0de

SHA1
22452d4991cfaebf29aae713de51e260cfccdd22

SHA256
3dcbf57d84f10f767e8b4a1e871630af30e9713ce670d4fe34ab173f6d7e5582

SHA512
78e60b3f3818c7461d60e459fbab60756585c7bbabfccde3262270d01dd47b8f3f1f3971924b19562018dbb6e0816ad220d283a30b5f0a4c00ef135db248fdde

Download Submit
C:\Windows\System\mMZIzxx.exe

Filesize
2.1MB

MD5
4a96afe00a383a3318c9442247b071a9

SHA1
fc6d1d30f1928145ba1c0398ddc4e58052c32a41

SHA256
2e9d7194c58904133f4d81202a8ebc17ee70cb4fefabbc8771f7462543fdabf3

SHA512
6b27e36c55e779d60bd278308b8db1a7d182c07ce1f6ef7c3df99a1c3e245c87a84b0fa8323f626d793d0a1e306c2185ef5bf68001cf2c626540fb3153b64987

Download Submit
C:\Windows\System\mgoMiUk.exe

Filesize
2.1MB

MD5
d5a529faca7aa364e84e7d0bf0e90eb1

SHA1
dda6feb93623cd12852cd17107b7afd3f6d38b79

SHA256
c51979c7cb6e203ac578bcd5bb45fbe0a14f276cb0de594cceb946d19d0a5741

SHA512
e9f39e5c1b3bb35fecf85d7749d24099f0ec918f8a5ce6cdc0a19b8b4b0f7deda5cdea36888252751e48a249061b5671d0d8af565cf2f7a46f51959e05ac5fa1

Download Submit
C:\Windows\System\nFYmidB.exe

Filesize
2.1MB

MD5
1415979f9097922e5d837734382c5b40

SHA1
9c31e7881e9a7580eb1f780a193b823e0a23c575

SHA256
53ecc3e013272e6eb614adf8fcc7e389d0ae6e5bc75a9501956de3b8e822df81

SHA512
a77302a3be10390ccae78972338ed51bf70dac823fffcc5919e672f159416bdf0c4f8dfddc8799cbd053e3a11190aaca61be2e739e09294cb2d5b4fed86dabaa

Download Submit
C:\Windows\System\qPkLeyb.exe

Filesize
2.1MB

MD5
611ac7824062a2367d76a541303c061e

SHA1
4514ff8eccb0c16cdd2639cd037509d8417fc547

SHA256
268fe6bc26bb7e2532656e4dfb2a275097771ac2e9a9270b455030a1a68d62df

SHA512
6c3e2d6129687f1bef5d96844a7971f505e1d1d4b73023a69867628b4e94e8deb7fa768897629a382324b42432805fa1fbd0300fbb517d5f717e8d7c47b7be89

Download Submit
C:\Windows\System\uczAcOz.exe

Filesize
2.1MB

MD5
dd602fb87289917e6508fad6a5e82409

SHA1
2780367b15589db45c7270643c9cebcbb2930d82

SHA256
b9e90d5fa59f37b573aaac3423868c5a2efacd323ba12201a73fd674b5927ee2

SHA512
b5bf4889f5867b108e236648c217bcc5f2896f6fab81ec99fbb0927a44cdef43293da764f3146215a504790aeafa7859140340c9baca010ef16ae62eb2dc870d

Download Submit
C:\Windows\System\vItPxsq.exe

Filesize
2.1MB

MD5
e196c9123f12fa34c1c3cfbb20ef5232

SHA1
7babbf99e46f7c4eee52aa80231967a95e79462e

SHA256
05f2d262efbba77c5c86d516bb1af037cece7bdcacd5ed7e8240f45a5d931870

SHA512
1559cbc583f1045d10ed5dda0205131ae75aee2b74f1d2e29e2a967a14bd5cf92a72f049c0d06810a1d4c5792781e299faed2c37bed6d4243e486d5dbc24445c

Download Submit
C:\Windows\System\wGHVKjV.exe

Filesize
2.1MB

MD5
5c3f6bd5e2557051aa10c32dbc4d616d

SHA1
9f6a13f9696012de4418551349205d36301907fe

SHA256
62ffca9cb6e7567a6d2944575ad4dc95246db55ae2557dfbafca3588ae51d8f1

SHA512
fc0809afea9ed431241a7e45cfaaee3df3de7644f342694f77068532a2aec5101ae220f6703e2e01356a370eaf4436a48922559c0e5e2f7baff55ea6510bc35e

Download Submit
C:\Windows\System\yEOrvXr.exe

Filesize
2.1MB

MD5
57b932eb241b8931dcd274386faa2171

SHA1
cd1c2dc6a9e91c9bcb5e6f7f26249a436216a7f8

SHA256
41d8a2c57296036b506f1d711afc99a209fe6645a4d7fea0cb55e5fb8e7113da

SHA512
15f0f61635af62bff76a7446267dbcf33b12fe2b5fcc14d5ceb29756dd6204400600ea74a7c11665b1f22c16bca126a1057418102b141b461932d95cf544b1c3

Download Submit
memory/512-28-0x00007FF74AFC0000-0x00007FF74B3B2000-memory.dmp

Filesize
3.9MB

Download
memory/512-4267-0x00007FF74AFC0000-0x00007FF74B3B2000-memory.dmp

Filesize
3.9MB

Download
memory/628-4341-0x00007FF65CFD0000-0x00007FF65D3C2000-memory.dmp

Filesize
3.9MB

Download
memory/628-251-0x00007FF65CFD0000-0x00007FF65D3C2000-memory.dmp

Filesize
3.9MB

Download
memory/1156-4316-0x00007FF7A4140000-0x00007FF7A4532000-memory.dmp

Filesize
3.9MB

Download
memory/1156-170-0x00007FF7A4140000-0x00007FF7A4532000-memory.dmp

Filesize
3.9MB

Download
memory/1268-4264-0x00007FF757210000-0x00007FF757602000-memory.dmp

Filesize
3.9MB

Download
memory/1268-21-0x00007FF757210000-0x00007FF757602000-memory.dmp

Filesize
3.9MB

Download
memory/1360-88-0x00007FF7CAF50000-0x00007FF7CB342000-memory.dmp

Filesize
3.9MB

Download
memory/1360-4297-0x00007FF7CAF50000-0x00007FF7CB342000-memory.dmp

Filesize
3.9MB

Download
memory/1448-4289-0x00007FF6659E0000-0x00007FF665DD2000-memory.dmp

Filesize
3.9MB

Download
memory/1448-1237-0x00007FF6659E0000-0x00007FF665DD2000-memory.dmp

Filesize
3.9MB

Download
memory/1472-4269-0x00007FF7449A0000-0x00007FF744D92000-memory.dmp

Filesize
3.9MB

Download
memory/1472-41-0x00007FF7449A0000-0x00007FF744D92000-memory.dmp

Filesize
3.9MB

Download
memory/1816-4313-0x00007FF752B50000-0x00007FF752F42000-memory.dmp

Filesize
3.9MB

Download
memory/1816-149-0x00007FF752B50000-0x00007FF752F42000-memory.dmp

Filesize
3.9MB

Download
memory/1952-4280-0x00007FF7EE090000-0x00007FF7EE482000-memory.dmp

Filesize
3.9MB

Download
memory/1952-64-0x00007FF7EE090000-0x00007FF7EE482000-memory.dmp

Filesize
3.9MB

Download
memory/3064-4272-0x00007FF7ABA60000-0x00007FF7ABE52000-memory.dmp

Filesize
3.9MB

Download
memory/3064-1057-0x00007FF7ABA60000-0x00007FF7ABE52000-memory.dmp

Filesize
3.9MB

Download
memory/3080-4285-0x00007FF6AC300000-0x00007FF6AC6F2000-memory.dmp

Filesize
3.9MB

Download
memory/3080-1058-0x00007FF6AC300000-0x00007FF6AC6F2000-memory.dmp

Filesize
3.9MB

Download
memory/3204-0-0x00007FF7982A0000-0x00007FF798692000-memory.dmp

Filesize
3.9MB

Download
memory/3204-1-0x000001DE8E4C0000-0x000001DE8E4D0000-memory.dmp

Filesize
64KB

Download
memory/3684-60-0x00007FF747A00000-0x00007FF747DF2000-memory.dmp

Filesize
3.9MB

Download
memory/3684-4277-0x00007FF747A00000-0x00007FF747DF2000-memory.dmp

Filesize
3.9MB

Download
memory/3700-4385-0x00007FF7FEFE0000-0x00007FF7FF3D2000-memory.dmp

Filesize
3.9MB

Download
memory/3700-341-0x00007FF7FEFE0000-0x00007FF7FF3D2000-memory.dmp

Filesize
3.9MB

Download
memory/4040-227-0x00007FF6E7190000-0x00007FF6E7582000-memory.dmp

Filesize
3.9MB

Download
memory/4040-4328-0x00007FF6E7190000-0x00007FF6E7582000-memory.dmp

Filesize
3.9MB

Download
memory/4128-4321-0x00007FF777EF0000-0x00007FF7782E2000-memory.dmp

Filesize
3.9MB

Download
memory/4128-222-0x00007FF777EF0000-0x00007FF7782E2000-memory.dmp

Filesize
3.9MB

Download
memory/4468-4301-0x00007FF6E9060000-0x00007FF6E9452000-memory.dmp

Filesize
3.9MB

Download
memory/4468-229-0x00007FF6E9060000-0x00007FF6E9452000-memory.dmp

Filesize
3.9MB

Download
memory/4604-13-0x00007FF763D90000-0x00007FF764182000-memory.dmp

Filesize
3.9MB

Download
memory/4752-4345-0x00007FF6CEA30000-0x00007FF6CEE22000-memory.dmp

Filesize
3.9MB

Download
memory/4752-293-0x00007FF6CEA30000-0x00007FF6CEE22000-memory.dmp

Filesize
3.9MB

Download
memory/4804-14-0x00000227C17F0000-0x00000227C1800000-memory.dmp

Filesize
64KB

Download
memory/4804-2096-0x00007FFDBD4E0000-0x00007FFDBDFA1000-memory.dmp

Filesize
10.8MB

Download
memory/4804-924-0x00007FFDBD4E0000-0x00007FFDBDFA1000-memory.dmp

Filesize
10.8MB

Download
memory/4804-199-0x00000227C1720000-0x00000227C1742000-memory.dmp

Filesize
136KB

Download
memory/4832-1034-0x00007FF7FD200000-0x00007FF7FD5F2000-memory.dmp

Filesize
3.9MB

Download
memory/4832-4293-0x00007FF7FD200000-0x00007FF7FD5F2000-memory.dmp

Filesize
3.9MB

Download
memory/4972-4303-0x00007FF691130000-0x00007FF691522000-memory.dmp

Filesize
3.9MB

Download
memory/4972-121-0x00007FF691130000-0x00007FF691522000-memory.dmp

Filesize
3.9MB

Download
memory/5084-4261-0x00007FF71E5F0000-0x00007FF71E9E2000-memory.dmp

Filesize
3.9MB

Download
memory/5084-1032-0x00007FF71E5F0000-0x00007FF71E9E2000-memory.dmp

Filesize
3.9MB

Download