xmrig | 4899aeba7f8a001cdf8d7d386a51f71cf8a59e3f1e1d7d15d320802f6e602e5c

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
Size

1.9MB
MD5

0b63b4471859f9a530c952c4b4741407
SHA1

1cc2ee1127181bf23c11555a7a376844335ce0f5
SHA256

4899aeba7f8a001cdf8d7d386a51f71cf8a59e3f1e1d7d15d320802f6e602e5c
SHA512

74f40b2a4dc683d8e54a85e4cd56df7b8d1feb00923eceb1781a1580c80966ab20c3022d81faa29209c29ff5a5bb00204b9cb8bbeb3ead8d2f04b882368b659d
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1M:NABh

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/memory/1008-463-0x00007FF75D140000-0x00007FF75D532000-memory.dmp	xmrig
behavioral2/memory/1664-549-0x00007FF6DF260000-0x00007FF6DF652000-memory.dmp	xmrig
behavioral2/memory/3024-551-0x00007FF688280000-0x00007FF688672000-memory.dmp	xmrig
behavioral2/memory/3212-550-0x00007FF7022C0000-0x00007FF7026B2000-memory.dmp	xmrig
behavioral2/memory/3864-548-0x00007FF630A70000-0x00007FF630E62000-memory.dmp	xmrig
behavioral2/memory/1672-547-0x00007FF73C060000-0x00007FF73C452000-memory.dmp	xmrig
behavioral2/memory/4992-546-0x00007FF603140000-0x00007FF603532000-memory.dmp	xmrig
behavioral2/memory/4924-545-0x00007FF715B70000-0x00007FF715F62000-memory.dmp	xmrig
behavioral2/memory/4808-544-0x00007FF7A4280000-0x00007FF7A4672000-memory.dmp	xmrig
behavioral2/memory/2016-542-0x00007FF7BF360000-0x00007FF7BF752000-memory.dmp	xmrig
behavioral2/memory/888-393-0x00007FF610FB0000-0x00007FF6113A2000-memory.dmp	xmrig
behavioral2/memory/2880-392-0x00007FF757600000-0x00007FF7579F2000-memory.dmp	xmrig
behavioral2/memory/4912-331-0x00007FF695570000-0x00007FF695962000-memory.dmp	xmrig
behavioral2/memory/3824-307-0x00007FF7E75E0000-0x00007FF7E79D2000-memory.dmp	xmrig
behavioral2/memory/1292-254-0x00007FF7DAC30000-0x00007FF7DB022000-memory.dmp	xmrig
behavioral2/memory/3156-224-0x00007FF6CC850000-0x00007FF6CCC42000-memory.dmp	xmrig
behavioral2/memory/1872-223-0x00007FF64CF90000-0x00007FF64D382000-memory.dmp	xmrig
behavioral2/memory/556-148-0x00007FF796FC0000-0x00007FF7973B2000-memory.dmp	xmrig
behavioral2/memory/4608-138-0x00007FF645C20000-0x00007FF646012000-memory.dmp	xmrig
behavioral2/memory/4212-28-0x00007FF642700000-0x00007FF642AF2000-memory.dmp	xmrig
behavioral2/memory/3024-4769-0x00007FF688280000-0x00007FF688672000-memory.dmp	xmrig
behavioral2/memory/1872-4796-0x00007FF64CF90000-0x00007FF64D382000-memory.dmp	xmrig
behavioral2/memory/1292-4800-0x00007FF7DAC30000-0x00007FF7DB022000-memory.dmp	xmrig
behavioral2/memory/3156-4804-0x00007FF6CC850000-0x00007FF6CCC42000-memory.dmp	xmrig
behavioral2/memory/2016-4854-0x00007FF7BF360000-0x00007FF7BF752000-memory.dmp	xmrig
behavioral2/memory/3824-4815-0x00007FF7E75E0000-0x00007FF7E79D2000-memory.dmp	xmrig
behavioral2/memory/4924-4878-0x00007FF715B70000-0x00007FF715F62000-memory.dmp	xmrig
behavioral2/memory/1672-4873-0x00007FF73C060000-0x00007FF73C452000-memory.dmp	xmrig
behavioral2/memory/4992-4870-0x00007FF603140000-0x00007FF603532000-memory.dmp	xmrig
behavioral2/memory/4808-4880-0x00007FF7A4280000-0x00007FF7A4672000-memory.dmp	xmrig
behavioral2/memory/888-4875-0x00007FF610FB0000-0x00007FF6113A2000-memory.dmp	xmrig
behavioral2/memory/4912-4850-0x00007FF695570000-0x00007FF695962000-memory.dmp	xmrig
behavioral2/memory/1664-4883-0x00007FF6DF260000-0x00007FF6DF652000-memory.dmp	xmrig
behavioral2/memory/3212-4908-0x00007FF7022C0000-0x00007FF7026B2000-memory.dmp	xmrig
behavioral2/memory/3864-4899-0x00007FF630A70000-0x00007FF630E62000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3596	aSdiHlc.exe
4212	Lebzpld.exe
4608	AiSeRPs.exe
3024	sckOknQ.exe
556	PrtcMUJ.exe
1872	deJVukG.exe
3156	YupLbiG.exe
1292	YgJZsqj.exe
3824	etXNBKG.exe
4912	mqYVXSC.exe
2880	aeQmjaW.exe
888	ZbyedqP.exe
1008	tNwbgsS.exe
2016	RaMOAWh.exe
4808	MUYdCKa.exe
4924	GqshlyU.exe
4992	ZADqFhU.exe
1672	SjuhvJz.exe
3864	mCwihwN.exe
1664	DRecQNe.exe
3212	YiBtckN.exe
4404	QhGGLER.exe
2372	bVVvNNy.exe
2792	yqunZJd.exe
1808	jNGMVKz.exe
1596	hTQJdOp.exe
4596	ouaNlDy.exe
2532	cRwjvsv.exe
2892	BnJfInF.exe
4692	wsmKxfr.exe
4268	UcPmHbY.exe
1840	aInYzJe.exe
3488	SONuKtE.exe
4124	xAcIVNx.exe
3548	qhAdKnz.exe
216	dxIKHWX.exe
1864	FGSeSzy.exe
3308	QDdXBpR.exe
2956	iZUQXjS.exe
684	RDyYFIb.exe
3096	HZXLRmY.exe
4488	xwyJxYO.exe
4676	DRceego.exe
2764	xNiyQhE.exe
4424	axzDHtt.exe
2304	aUvYFUr.exe
3708	unCAJtl.exe
2404	mgrCOwc.exe
2904	ePArfJg.exe
4644	YXVlADY.exe
4896	cdqiuPJ.exe
4504	xMTSqVi.exe
4604	jTkZwiz.exe
4764	TiQMfaJ.exe
2888	UlTNzdw.exe
2676	kdIGNtE.exe
4032	rEqdOWW.exe
2192	chPphjJ.exe
2748	cpNFPhH.exe
876	UQZxWug.exe
3876	sKfxZSh.exe
592	BtClePV.exe
4592	pLBgIye.exe
1568	dExFfGK.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4956-0-0x00007FF7829B0000-0x00007FF782DA2000-memory.dmp	upx
behavioral2/files/0x000c000000023b9d-5.dat	upx
behavioral2/files/0x0031000000023bb7-47.dat	upx
behavioral2/files/0x000a000000023bbc-70.dat	upx
behavioral2/files/0x000a000000023bbb-87.dat	upx
behavioral2/memory/1008-463-0x00007FF75D140000-0x00007FF75D532000-memory.dmp	upx
behavioral2/memory/1664-549-0x00007FF6DF260000-0x00007FF6DF652000-memory.dmp	upx
behavioral2/memory/3024-551-0x00007FF688280000-0x00007FF688672000-memory.dmp	upx
behavioral2/memory/3212-550-0x00007FF7022C0000-0x00007FF7026B2000-memory.dmp	upx
behavioral2/memory/3864-548-0x00007FF630A70000-0x00007FF630E62000-memory.dmp	upx
behavioral2/memory/1672-547-0x00007FF73C060000-0x00007FF73C452000-memory.dmp	upx
behavioral2/memory/4992-546-0x00007FF603140000-0x00007FF603532000-memory.dmp	upx
behavioral2/memory/4924-545-0x00007FF715B70000-0x00007FF715F62000-memory.dmp	upx
behavioral2/memory/4808-544-0x00007FF7A4280000-0x00007FF7A4672000-memory.dmp	upx
behavioral2/memory/2016-542-0x00007FF7BF360000-0x00007FF7BF752000-memory.dmp	upx
behavioral2/memory/888-393-0x00007FF610FB0000-0x00007FF6113A2000-memory.dmp	upx
behavioral2/memory/2880-392-0x00007FF757600000-0x00007FF7579F2000-memory.dmp	upx
behavioral2/memory/4912-331-0x00007FF695570000-0x00007FF695962000-memory.dmp	upx
behavioral2/memory/3824-307-0x00007FF7E75E0000-0x00007FF7E79D2000-memory.dmp	upx
behavioral2/memory/1292-254-0x00007FF7DAC30000-0x00007FF7DB022000-memory.dmp	upx
behavioral2/memory/3156-224-0x00007FF6CC850000-0x00007FF6CCC42000-memory.dmp	upx
behavioral2/memory/1872-223-0x00007FF64CF90000-0x00007FF64D382000-memory.dmp	upx
behavioral2/files/0x000a000000023bd5-191.dat	upx
behavioral2/files/0x000a000000023bd4-190.dat	upx
behavioral2/files/0x000a000000023bd0-185.dat	upx
behavioral2/files/0x000a000000023bd3-184.dat	upx
behavioral2/files/0x000a000000023bd1-179.dat	upx
behavioral2/files/0x000a000000023bc4-166.dat	upx
behavioral2/files/0x000a000000023bc3-165.dat	upx
behavioral2/files/0x000a000000023bbd-159.dat	upx
behavioral2/files/0x000a000000023bc2-152.dat	upx
behavioral2/memory/556-148-0x00007FF796FC0000-0x00007FF7973B2000-memory.dmp	upx
behavioral2/files/0x000a000000023bcf-180.dat	upx
behavioral2/files/0x000a000000023bce-172.dat	upx
behavioral2/memory/4608-138-0x00007FF645C20000-0x00007FF646012000-memory.dmp	upx
behavioral2/files/0x000a000000023bc0-136.dat	upx
behavioral2/files/0x000a000000023bc7-167.dat	upx
behavioral2/files/0x000a000000023bbf-135.dat	upx
behavioral2/files/0x000a000000023bcd-134.dat	upx
behavioral2/files/0x000a000000023bcc-133.dat	upx
behavioral2/files/0x000a000000023bc6-132.dat	upx
behavioral2/files/0x000a000000023bcb-130.dat	upx
behavioral2/files/0x000a000000023bca-129.dat	upx
behavioral2/files/0x000a000000023bc9-128.dat	upx
behavioral2/files/0x000a000000023bc8-127.dat	upx
behavioral2/files/0x000a000000023bbe-123.dat	upx
behavioral2/files/0x000a000000023bc1-144.dat	upx
behavioral2/files/0x000a000000023bba-115.dat	upx
behavioral2/files/0x000a000000023bc5-104.dat	upx
behavioral2/files/0x000a000000023bb9-103.dat	upx
behavioral2/files/0x0031000000023bb8-97.dat	upx
behavioral2/files/0x000a000000023bb5-80.dat	upx
behavioral2/files/0x0031000000023bb6-62.dat	upx
behavioral2/files/0x000a000000023bb4-50.dat	upx
behavioral2/memory/4212-28-0x00007FF642700000-0x00007FF642AF2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb3-33.dat	upx
behavioral2/files/0x000a000000023bb2-24.dat	upx
behavioral2/files/0x000a000000023bb1-21.dat	upx
behavioral2/files/0x000a000000023bb0-13.dat	upx
behavioral2/memory/3596-8-0x00007FF6B58B0000-0x00007FF6B5CA2000-memory.dmp	upx
behavioral2/memory/3024-4769-0x00007FF688280000-0x00007FF688672000-memory.dmp	upx
behavioral2/memory/1872-4796-0x00007FF64CF90000-0x00007FF64D382000-memory.dmp	upx
behavioral2/memory/1292-4800-0x00007FF7DAC30000-0x00007FF7DB022000-memory.dmp	upx
behavioral2/memory/3156-4804-0x00007FF6CC850000-0x00007FF6CCC42000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pufXVvF.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\bosYaHT.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\vhqggce.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\goFgusR.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\sDHGJFn.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\sXsdvWo.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\huNJPTm.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\YiMJPai.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\VvAVavs.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\jjpPquR.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\eFUzHuV.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\ZRLcXFj.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\SrXxPog.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\OtQacwT.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\JielPoL.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\TtmZoEc.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\GYrKPed.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\TGuitVT.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\XeyDKiG.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\maWQXXq.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\lMbRwWh.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\uXVzayw.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\STPRpEN.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\KJBEaCe.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\FovvRUY.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\atpGfMm.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\swGQXnh.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\ISzGmeq.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\HszWUyT.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\oTIUcQZ.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\KOBcMYr.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\ZPSgLHe.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\ucPEEdr.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\MBYXluh.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\CWLaOvs.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\gbnntGx.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\ZrNZVzN.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\ekQPrwI.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\KvXFlPF.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\elhtEnL.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\sYMFnnH.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\JEQrqLm.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\jFJYgHg.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\YbhfizX.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\JQhKSdn.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\YFTzjLp.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\fncucVO.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\KxlzpkY.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\ILVwBRw.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\wVKOhKa.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\rCdJVMz.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\EyCWLQr.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\DOyIrhT.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\NnlfWVE.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\ODdpUaj.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\nElXvjs.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\dmVwZql.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\DLuJAxa.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\yDxbGDc.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\EsADRDd.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\wNdhcvd.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\tEbKpqE.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\qtbBtol.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\USoAKgW.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4064	powershell.exe
4064	powershell.exe
4064	powershell.exe
4064	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
Token: SeDebugPrivilege	4064	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 4064	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	84
PID 4956 wrote to memory of 4064	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	84
PID 4956 wrote to memory of 3596	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	85
PID 4956 wrote to memory of 3596	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	85
PID 4956 wrote to memory of 4212	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	86
PID 4956 wrote to memory of 4212	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	86
PID 4956 wrote to memory of 4608	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	87
PID 4956 wrote to memory of 4608	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	87
PID 4956 wrote to memory of 3024	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	88
PID 4956 wrote to memory of 3024	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	88
PID 4956 wrote to memory of 556	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	89
PID 4956 wrote to memory of 556	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	89
PID 4956 wrote to memory of 1872	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	90
PID 4956 wrote to memory of 1872	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	90
PID 4956 wrote to memory of 3156	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	91
PID 4956 wrote to memory of 3156	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	91
PID 4956 wrote to memory of 1292	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	92
PID 4956 wrote to memory of 1292	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	92
PID 4956 wrote to memory of 3824	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	93
PID 4956 wrote to memory of 3824	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	93
PID 4956 wrote to memory of 4912	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	94
PID 4956 wrote to memory of 4912	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	94
PID 4956 wrote to memory of 2880	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	95
PID 4956 wrote to memory of 2880	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	95
PID 4956 wrote to memory of 888	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	96
PID 4956 wrote to memory of 888	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	96
PID 4956 wrote to memory of 1672	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	97
PID 4956 wrote to memory of 1672	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	97
PID 4956 wrote to memory of 1008	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	98
PID 4956 wrote to memory of 1008	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	98
PID 4956 wrote to memory of 1664	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	99
PID 4956 wrote to memory of 1664	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	99
PID 4956 wrote to memory of 2016	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	100
PID 4956 wrote to memory of 2016	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	100
PID 4956 wrote to memory of 4808	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	101
PID 4956 wrote to memory of 4808	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	101
PID 4956 wrote to memory of 4924	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	102
PID 4956 wrote to memory of 4924	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	102
PID 4956 wrote to memory of 4992	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	103
PID 4956 wrote to memory of 4992	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	103
PID 4956 wrote to memory of 3864	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	104
PID 4956 wrote to memory of 3864	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	104
PID 4956 wrote to memory of 3212	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	105
PID 4956 wrote to memory of 3212	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	105
PID 4956 wrote to memory of 4404	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	106
PID 4956 wrote to memory of 4404	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	106
PID 4956 wrote to memory of 2372	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	107
PID 4956 wrote to memory of 2372	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	107
PID 4956 wrote to memory of 2892	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	108
PID 4956 wrote to memory of 2892	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	108
PID 4956 wrote to memory of 2792	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	109
PID 4956 wrote to memory of 2792	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	109
PID 4956 wrote to memory of 1808	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	110
PID 4956 wrote to memory of 1808	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	110
PID 4956 wrote to memory of 1596	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	111
PID 4956 wrote to memory of 1596	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	111
PID 4956 wrote to memory of 4596	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	112
PID 4956 wrote to memory of 4596	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	112
PID 4956 wrote to memory of 2532	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	113
PID 4956 wrote to memory of 2532	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	113
PID 4956 wrote to memory of 4692	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	114
PID 4956 wrote to memory of 4692	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	114
PID 4956 wrote to memory of 4268	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	115
PID 4956 wrote to memory of 4268	4956	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4064
- C:\Windows\System\aSdiHlc.exe
  C:\Windows\System\aSdiHlc.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\Lebzpld.exe
  C:\Windows\System\Lebzpld.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\AiSeRPs.exe
  C:\Windows\System\AiSeRPs.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\sckOknQ.exe
  C:\Windows\System\sckOknQ.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\PrtcMUJ.exe
  C:\Windows\System\PrtcMUJ.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\deJVukG.exe
  C:\Windows\System\deJVukG.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\YupLbiG.exe
  C:\Windows\System\YupLbiG.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\YgJZsqj.exe
  C:\Windows\System\YgJZsqj.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\etXNBKG.exe
  C:\Windows\System\etXNBKG.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\mqYVXSC.exe
  C:\Windows\System\mqYVXSC.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\aeQmjaW.exe
  C:\Windows\System\aeQmjaW.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\ZbyedqP.exe
  C:\Windows\System\ZbyedqP.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\SjuhvJz.exe
  C:\Windows\System\SjuhvJz.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\tNwbgsS.exe
  C:\Windows\System\tNwbgsS.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\DRecQNe.exe
  C:\Windows\System\DRecQNe.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\RaMOAWh.exe
  C:\Windows\System\RaMOAWh.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\MUYdCKa.exe
  C:\Windows\System\MUYdCKa.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\GqshlyU.exe
  C:\Windows\System\GqshlyU.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\ZADqFhU.exe
  C:\Windows\System\ZADqFhU.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\mCwihwN.exe
  C:\Windows\System\mCwihwN.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\YiBtckN.exe
  C:\Windows\System\YiBtckN.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\QhGGLER.exe
  C:\Windows\System\QhGGLER.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\bVVvNNy.exe
  C:\Windows\System\bVVvNNy.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\BnJfInF.exe
  C:\Windows\System\BnJfInF.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\yqunZJd.exe
  C:\Windows\System\yqunZJd.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\jNGMVKz.exe
  C:\Windows\System\jNGMVKz.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\hTQJdOp.exe
  C:\Windows\System\hTQJdOp.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\ouaNlDy.exe
  C:\Windows\System\ouaNlDy.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\cRwjvsv.exe
  C:\Windows\System\cRwjvsv.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\wsmKxfr.exe
  C:\Windows\System\wsmKxfr.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\UcPmHbY.exe
  C:\Windows\System\UcPmHbY.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\aInYzJe.exe
  C:\Windows\System\aInYzJe.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\qhAdKnz.exe
  C:\Windows\System\qhAdKnz.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\SONuKtE.exe
  C:\Windows\System\SONuKtE.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\xAcIVNx.exe
  C:\Windows\System\xAcIVNx.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\DRceego.exe
  C:\Windows\System\DRceego.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\xNiyQhE.exe
  C:\Windows\System\xNiyQhE.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\dxIKHWX.exe
  C:\Windows\System\dxIKHWX.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\FGSeSzy.exe
  C:\Windows\System\FGSeSzy.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\QDdXBpR.exe
  C:\Windows\System\QDdXBpR.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\iZUQXjS.exe
  C:\Windows\System\iZUQXjS.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\RDyYFIb.exe
  C:\Windows\System\RDyYFIb.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\HZXLRmY.exe
  C:\Windows\System\HZXLRmY.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\UlTNzdw.exe
  C:\Windows\System\UlTNzdw.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\xwyJxYO.exe
  C:\Windows\System\xwyJxYO.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\axzDHtt.exe
  C:\Windows\System\axzDHtt.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\aUvYFUr.exe
  C:\Windows\System\aUvYFUr.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\unCAJtl.exe
  C:\Windows\System\unCAJtl.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\mgrCOwc.exe
  C:\Windows\System\mgrCOwc.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\ePArfJg.exe
  C:\Windows\System\ePArfJg.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\YXVlADY.exe
  C:\Windows\System\YXVlADY.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\cdqiuPJ.exe
  C:\Windows\System\cdqiuPJ.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\xMTSqVi.exe
  C:\Windows\System\xMTSqVi.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\sKfxZSh.exe
  C:\Windows\System\sKfxZSh.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\jTkZwiz.exe
  C:\Windows\System\jTkZwiz.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\TiQMfaJ.exe
  C:\Windows\System\TiQMfaJ.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\kdIGNtE.exe
  C:\Windows\System\kdIGNtE.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\rEqdOWW.exe
  C:\Windows\System\rEqdOWW.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\chPphjJ.exe
  C:\Windows\System\chPphjJ.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\xUMNsYT.exe
  C:\Windows\System\xUMNsYT.exe
  2⤵
  PID:2944
- C:\Windows\System\wveaWiY.exe
  C:\Windows\System\wveaWiY.exe
  2⤵
  PID:1660
- C:\Windows\System\cpNFPhH.exe
  C:\Windows\System\cpNFPhH.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\UQZxWug.exe
  C:\Windows\System\UQZxWug.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\BtClePV.exe
  C:\Windows\System\BtClePV.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\pLBgIye.exe
  C:\Windows\System\pLBgIye.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\dExFfGK.exe
  C:\Windows\System\dExFfGK.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\uhRHdSu.exe
  C:\Windows\System\uhRHdSu.exe
  2⤵
  PID:1636
- C:\Windows\System\VybUsUH.exe
  C:\Windows\System\VybUsUH.exe
  2⤵
  PID:1048
- C:\Windows\System\OoeuqqA.exe
  C:\Windows\System\OoeuqqA.exe
  2⤵
  PID:4040
- C:\Windows\System\XEexEKk.exe
  C:\Windows\System\XEexEKk.exe
  2⤵
  PID:4512
- C:\Windows\System\DlAdUMM.exe
  C:\Windows\System\DlAdUMM.exe
  2⤵
  PID:5092
- C:\Windows\System\OJdeEDx.exe
  C:\Windows\System\OJdeEDx.exe
  2⤵
  PID:3344
- C:\Windows\System\GEtUWrd.exe
  C:\Windows\System\GEtUWrd.exe
  2⤵
  PID:4004
- C:\Windows\System\cCLIlDp.exe
  C:\Windows\System\cCLIlDp.exe
  2⤵
  PID:4876
- C:\Windows\System\mxRcihQ.exe
  C:\Windows\System\mxRcihQ.exe
  2⤵
  PID:2020
- C:\Windows\System\pSNIroX.exe
  C:\Windows\System\pSNIroX.exe
  2⤵
  PID:3960
- C:\Windows\System\TjglvyJ.exe
  C:\Windows\System\TjglvyJ.exe
  2⤵
  PID:4420
- C:\Windows\System\KkCeSto.exe
  C:\Windows\System\KkCeSto.exe
  2⤵
  PID:4824
- C:\Windows\System\xsYcYmO.exe
  C:\Windows\System\xsYcYmO.exe
  2⤵
  PID:4688
- C:\Windows\System\rXRPuRp.exe
  C:\Windows\System\rXRPuRp.exe
  2⤵
  PID:1696
- C:\Windows\System\wyOSKFX.exe
  C:\Windows\System\wyOSKFX.exe
  2⤵
  PID:3668
- C:\Windows\System\MDtfPXV.exe
  C:\Windows\System\MDtfPXV.exe
  2⤵
  PID:540
- C:\Windows\System\JTsyEzU.exe
  C:\Windows\System\JTsyEzU.exe
  2⤵
  PID:1108
- C:\Windows\System\uyIJPqN.exe
  C:\Windows\System\uyIJPqN.exe
  2⤵
  PID:5136
- C:\Windows\System\OcYwafD.exe
  C:\Windows\System\OcYwafD.exe
  2⤵
  PID:5152
- C:\Windows\System\eAzshsK.exe
  C:\Windows\System\eAzshsK.exe
  2⤵
  PID:5168
- C:\Windows\System\LhrRTiY.exe
  C:\Windows\System\LhrRTiY.exe
  2⤵
  PID:5192
- C:\Windows\System\krRyGtg.exe
  C:\Windows\System\krRyGtg.exe
  2⤵
  PID:5208
- C:\Windows\System\QawGEWQ.exe
  C:\Windows\System\QawGEWQ.exe
  2⤵
  PID:5228
- C:\Windows\System\nsdKRlz.exe
  C:\Windows\System\nsdKRlz.exe
  2⤵
  PID:5252
- C:\Windows\System\vmhlejw.exe
  C:\Windows\System\vmhlejw.exe
  2⤵
  PID:5268
- C:\Windows\System\hLFvoIP.exe
  C:\Windows\System\hLFvoIP.exe
  2⤵
  PID:5296
- C:\Windows\System\JEprcXa.exe
  C:\Windows\System\JEprcXa.exe
  2⤵
  PID:5312
- C:\Windows\System\alwxIgN.exe
  C:\Windows\System\alwxIgN.exe
  2⤵
  PID:5340
- C:\Windows\System\WXxhsCo.exe
  C:\Windows\System\WXxhsCo.exe
  2⤵
  PID:5368
- C:\Windows\System\HKGVggG.exe
  C:\Windows\System\HKGVggG.exe
  2⤵
  PID:5424
- C:\Windows\System\IcbWpKT.exe
  C:\Windows\System\IcbWpKT.exe
  2⤵
  PID:5448
- C:\Windows\System\PYoXLaz.exe
  C:\Windows\System\PYoXLaz.exe
  2⤵
  PID:5472
- C:\Windows\System\GHwxWoF.exe
  C:\Windows\System\GHwxWoF.exe
  2⤵
  PID:5540
- C:\Windows\System\XGEHdxE.exe
  C:\Windows\System\XGEHdxE.exe
  2⤵
  PID:5560
- C:\Windows\System\xbyGgCX.exe
  C:\Windows\System\xbyGgCX.exe
  2⤵
  PID:5584
- C:\Windows\System\ETSlAHP.exe
  C:\Windows\System\ETSlAHP.exe
  2⤵
  PID:5608
- C:\Windows\System\MVupciL.exe
  C:\Windows\System\MVupciL.exe
  2⤵
  PID:5628
- C:\Windows\System\JEzcezK.exe
  C:\Windows\System\JEzcezK.exe
  2⤵
  PID:5656
- C:\Windows\System\uMccxuE.exe
  C:\Windows\System\uMccxuE.exe
  2⤵
  PID:5676
- C:\Windows\System\wMACxfv.exe
  C:\Windows\System\wMACxfv.exe
  2⤵
  PID:5700
- C:\Windows\System\YGPoOrL.exe
  C:\Windows\System\YGPoOrL.exe
  2⤵
  PID:5724
- C:\Windows\System\wdYUVAk.exe
  C:\Windows\System\wdYUVAk.exe
  2⤵
  PID:5744
- C:\Windows\System\IQtZNhj.exe
  C:\Windows\System\IQtZNhj.exe
  2⤵
  PID:5780
- C:\Windows\System\LlEUikK.exe
  C:\Windows\System\LlEUikK.exe
  2⤵
  PID:5804
- C:\Windows\System\KpyUYoN.exe
  C:\Windows\System\KpyUYoN.exe
  2⤵
  PID:5824
- C:\Windows\System\RVisoSG.exe
  C:\Windows\System\RVisoSG.exe
  2⤵
  PID:5844
- C:\Windows\System\HouxNin.exe
  C:\Windows\System\HouxNin.exe
  2⤵
  PID:5876
- C:\Windows\System\DTLKlPH.exe
  C:\Windows\System\DTLKlPH.exe
  2⤵
  PID:5896
- C:\Windows\System\nqXtjlK.exe
  C:\Windows\System\nqXtjlK.exe
  2⤵
  PID:5912
- C:\Windows\System\BoDbicy.exe
  C:\Windows\System\BoDbicy.exe
  2⤵
  PID:5932
- C:\Windows\System\oQVzWSZ.exe
  C:\Windows\System\oQVzWSZ.exe
  2⤵
  PID:5956
- C:\Windows\System\YHLPexo.exe
  C:\Windows\System\YHLPexo.exe
  2⤵
  PID:5984
- C:\Windows\System\bfhrXBp.exe
  C:\Windows\System\bfhrXBp.exe
  2⤵
  PID:6000
- C:\Windows\System\cCNLAtq.exe
  C:\Windows\System\cCNLAtq.exe
  2⤵
  PID:6020
- C:\Windows\System\BOtiFca.exe
  C:\Windows\System\BOtiFca.exe
  2⤵
  PID:6044
- C:\Windows\System\QpJBYvz.exe
  C:\Windows\System\QpJBYvz.exe
  2⤵
  PID:6100
- C:\Windows\System\uCAnUrE.exe
  C:\Windows\System\uCAnUrE.exe
  2⤵
  PID:6120
- C:\Windows\System\xteIkTH.exe
  C:\Windows\System\xteIkTH.exe
  2⤵
  PID:6140
- C:\Windows\System\LmUjbdx.exe
  C:\Windows\System\LmUjbdx.exe
  2⤵
  PID:4068
- C:\Windows\System\aXuabsQ.exe
  C:\Windows\System\aXuabsQ.exe
  2⤵
  PID:3108
- C:\Windows\System\jZHHBhK.exe
  C:\Windows\System\jZHHBhK.exe
  2⤵
  PID:2652
- C:\Windows\System\koMMhpN.exe
  C:\Windows\System\koMMhpN.exe
  2⤵
  PID:3988
- C:\Windows\System\hFlddVr.exe
  C:\Windows\System\hFlddVr.exe
  2⤵
  PID:3332
- C:\Windows\System\YSeGjPP.exe
  C:\Windows\System\YSeGjPP.exe
  2⤵
  PID:4552
- C:\Windows\System\ummEaao.exe
  C:\Windows\System\ummEaao.exe
  2⤵
  PID:932
- C:\Windows\System\PtTApMQ.exe
  C:\Windows\System\PtTApMQ.exe
  2⤵
  PID:5352
- C:\Windows\System\modtMOM.exe
  C:\Windows\System\modtMOM.exe
  2⤵
  PID:5392
- C:\Windows\System\ckMfACk.exe
  C:\Windows\System\ckMfACk.exe
  2⤵
  PID:2324
- C:\Windows\System\OoetzNE.exe
  C:\Windows\System\OoetzNE.exe
  2⤵
  PID:1344
- C:\Windows\System\dmdslJk.exe
  C:\Windows\System\dmdslJk.exe
  2⤵
  PID:3644
- C:\Windows\System\CYvqloS.exe
  C:\Windows\System\CYvqloS.exe
  2⤵
  PID:3296
- C:\Windows\System\dpooLJR.exe
  C:\Windows\System\dpooLJR.exe
  2⤵
  PID:1068
- C:\Windows\System\kIAfhtD.exe
  C:\Windows\System\kIAfhtD.exe
  2⤵
  PID:3600
- C:\Windows\System\cHQJelG.exe
  C:\Windows\System\cHQJelG.exe
  2⤵
  PID:5684
- C:\Windows\System\YXocmBN.exe
  C:\Windows\System\YXocmBN.exe
  2⤵
  PID:5712
- C:\Windows\System\nxhomKY.exe
  C:\Windows\System\nxhomKY.exe
  2⤵
  PID:3124
- C:\Windows\System\LIIfqiR.exe
  C:\Windows\System\LIIfqiR.exe
  2⤵
  PID:4840
- C:\Windows\System\nOIZfdW.exe
  C:\Windows\System\nOIZfdW.exe
  2⤵
  PID:5144
- C:\Windows\System\zYyRZjo.exe
  C:\Windows\System\zYyRZjo.exe
  2⤵
  PID:6152
- C:\Windows\System\sPGSZaW.exe
  C:\Windows\System\sPGSZaW.exe
  2⤵
  PID:6172
- C:\Windows\System\jmPhzmN.exe
  C:\Windows\System\jmPhzmN.exe
  2⤵
  PID:6188
- C:\Windows\System\pQhRDnk.exe
  C:\Windows\System\pQhRDnk.exe
  2⤵
  PID:6212
- C:\Windows\System\KmePfbS.exe
  C:\Windows\System\KmePfbS.exe
  2⤵
  PID:6236
- C:\Windows\System\vYwRpLb.exe
  C:\Windows\System\vYwRpLb.exe
  2⤵
  PID:6252
- C:\Windows\System\rKKQrTt.exe
  C:\Windows\System\rKKQrTt.exe
  2⤵
  PID:6276
- C:\Windows\System\ECcNTVL.exe
  C:\Windows\System\ECcNTVL.exe
  2⤵
  PID:6308
- C:\Windows\System\NoiDMSe.exe
  C:\Windows\System\NoiDMSe.exe
  2⤵
  PID:6324
- C:\Windows\System\APbUhtA.exe
  C:\Windows\System\APbUhtA.exe
  2⤵
  PID:6344
- C:\Windows\System\ucFqPJd.exe
  C:\Windows\System\ucFqPJd.exe
  2⤵
  PID:6372
- C:\Windows\System\mVBzVJb.exe
  C:\Windows\System\mVBzVJb.exe
  2⤵
  PID:6388
- C:\Windows\System\rrZUAOG.exe
  C:\Windows\System\rrZUAOG.exe
  2⤵
  PID:6408
- C:\Windows\System\AvUzlIS.exe
  C:\Windows\System\AvUzlIS.exe
  2⤵
  PID:6428
- C:\Windows\System\LfHPaJu.exe
  C:\Windows\System\LfHPaJu.exe
  2⤵
  PID:6452
- C:\Windows\System\zXUjFhS.exe
  C:\Windows\System\zXUjFhS.exe
  2⤵
  PID:6480
- C:\Windows\System\thwBlZR.exe
  C:\Windows\System\thwBlZR.exe
  2⤵
  PID:6504
- C:\Windows\System\xtaJLMr.exe
  C:\Windows\System\xtaJLMr.exe
  2⤵
  PID:6524
- C:\Windows\System\pQKyiJS.exe
  C:\Windows\System\pQKyiJS.exe
  2⤵
  PID:6548
- C:\Windows\System\yIMHhIf.exe
  C:\Windows\System\yIMHhIf.exe
  2⤵
  PID:6572
- C:\Windows\System\yZRbTEH.exe
  C:\Windows\System\yZRbTEH.exe
  2⤵
  PID:6588
- C:\Windows\System\LRsSrHM.exe
  C:\Windows\System\LRsSrHM.exe
  2⤵
  PID:6620
- C:\Windows\System\uqcyTQD.exe
  C:\Windows\System\uqcyTQD.exe
  2⤵
  PID:6648
- C:\Windows\System\LUveqGj.exe
  C:\Windows\System\LUveqGj.exe
  2⤵
  PID:6664
- C:\Windows\System\WlpehAA.exe
  C:\Windows\System\WlpehAA.exe
  2⤵
  PID:6688
- C:\Windows\System\FkwARoT.exe
  C:\Windows\System\FkwARoT.exe
  2⤵
  PID:6704
- C:\Windows\System\Xuesrmq.exe
  C:\Windows\System\Xuesrmq.exe
  2⤵
  PID:6728
- C:\Windows\System\TqSCiGz.exe
  C:\Windows\System\TqSCiGz.exe
  2⤵
  PID:6756
- C:\Windows\System\ADSUEUd.exe
  C:\Windows\System\ADSUEUd.exe
  2⤵
  PID:6784
- C:\Windows\System\gKWXmqm.exe
  C:\Windows\System\gKWXmqm.exe
  2⤵
  PID:6808
- C:\Windows\System\pAVOJTZ.exe
  C:\Windows\System\pAVOJTZ.exe
  2⤵
  PID:6828
- C:\Windows\System\iGFTThH.exe
  C:\Windows\System\iGFTThH.exe
  2⤵
  PID:6848
- C:\Windows\System\UNevmsl.exe
  C:\Windows\System\UNevmsl.exe
  2⤵
  PID:6868
- C:\Windows\System\ejFAOvT.exe
  C:\Windows\System\ejFAOvT.exe
  2⤵
  PID:5276
- C:\Windows\System\EhjYeZV.exe
  C:\Windows\System\EhjYeZV.exe
  2⤵
  PID:6128
- C:\Windows\System\uEIftFe.exe
  C:\Windows\System\uEIftFe.exe
  2⤵
  PID:5620
- C:\Windows\System\MDuMpZc.exe
  C:\Windows\System\MDuMpZc.exe
  2⤵
  PID:5856
- C:\Windows\System\DelWNkS.exe
  C:\Windows\System\DelWNkS.exe
  2⤵
  PID:5924
- C:\Windows\System\TBuMILF.exe
  C:\Windows\System\TBuMILF.exe
  2⤵
  PID:5952
- C:\Windows\System\jxKSllL.exe
  C:\Windows\System\jxKSllL.exe
  2⤵
  PID:5492
- C:\Windows\System\iElApyz.exe
  C:\Windows\System\iElApyz.exe
  2⤵
  PID:6052
- C:\Windows\System\DNuFhic.exe
  C:\Windows\System\DNuFhic.exe
  2⤵
  PID:6096
- C:\Windows\System\nJbOfwl.exe
  C:\Windows\System\nJbOfwl.exe
  2⤵
  PID:3244
- C:\Windows\System\qkMFmhq.exe
  C:\Windows\System\qkMFmhq.exe
  2⤵
  PID:5064
- C:\Windows\System\YbKMTuf.exe
  C:\Windows\System\YbKMTuf.exe
  2⤵
  PID:6272
- C:\Windows\System\IRLMZOU.exe
  C:\Windows\System\IRLMZOU.exe
  2⤵
  PID:6336
- C:\Windows\System\HsaUKTS.exe
  C:\Windows\System\HsaUKTS.exe
  2⤵
  PID:6404
- C:\Windows\System\sbWIEUx.exe
  C:\Windows\System\sbWIEUx.exe
  2⤵
  PID:6468
- C:\Windows\System\wIBjlje.exe
  C:\Windows\System\wIBjlje.exe
  2⤵
  PID:6544
- C:\Windows\System\NmpEcuB.exe
  C:\Windows\System\NmpEcuB.exe
  2⤵
  PID:6596
- C:\Windows\System\XnuYNPo.exe
  C:\Windows\System\XnuYNPo.exe
  2⤵
  PID:6660
- C:\Windows\System\AifqETo.exe
  C:\Windows\System\AifqETo.exe
  2⤵
  PID:6700
- C:\Windows\System\AzTRZGN.exe
  C:\Windows\System\AzTRZGN.exe
  2⤵
  PID:6820
- C:\Windows\System\hpyzxpn.exe
  C:\Windows\System\hpyzxpn.exe
  2⤵
  PID:7212
- C:\Windows\System\RRKXDAz.exe
  C:\Windows\System\RRKXDAz.exe
  2⤵
  PID:7236
- C:\Windows\System\yqPOlFn.exe
  C:\Windows\System\yqPOlFn.exe
  2⤵
  PID:7256
- C:\Windows\System\OZuFpze.exe
  C:\Windows\System\OZuFpze.exe
  2⤵
  PID:7276
- C:\Windows\System\HzQowwi.exe
  C:\Windows\System\HzQowwi.exe
  2⤵
  PID:7292
- C:\Windows\System\YpyNQWH.exe
  C:\Windows\System\YpyNQWH.exe
  2⤵
  PID:7308
- C:\Windows\System\MEhokAI.exe
  C:\Windows\System\MEhokAI.exe
  2⤵
  PID:7332
- C:\Windows\System\chDshYA.exe
  C:\Windows\System\chDshYA.exe
  2⤵
  PID:7348
- C:\Windows\System\EHdknxr.exe
  C:\Windows\System\EHdknxr.exe
  2⤵
  PID:7364
- C:\Windows\System\ARPVxRa.exe
  C:\Windows\System\ARPVxRa.exe
  2⤵
  PID:7380
- C:\Windows\System\ttqXQGY.exe
  C:\Windows\System\ttqXQGY.exe
  2⤵
  PID:7396
- C:\Windows\System\igWxggr.exe
  C:\Windows\System\igWxggr.exe
  2⤵
  PID:7412
- C:\Windows\System\FPptWSQ.exe
  C:\Windows\System\FPptWSQ.exe
  2⤵
  PID:7428
- C:\Windows\System\bzwRCyj.exe
  C:\Windows\System\bzwRCyj.exe
  2⤵
  PID:7444
- C:\Windows\System\sKjskjh.exe
  C:\Windows\System\sKjskjh.exe
  2⤵
  PID:7460
- C:\Windows\System\zryqAsO.exe
  C:\Windows\System\zryqAsO.exe
  2⤵
  PID:7476
- C:\Windows\System\blqTztW.exe
  C:\Windows\System\blqTztW.exe
  2⤵
  PID:7492
- C:\Windows\System\zceuReh.exe
  C:\Windows\System\zceuReh.exe
  2⤵
  PID:7512
- C:\Windows\System\NJenoCu.exe
  C:\Windows\System\NJenoCu.exe
  2⤵
  PID:7528
- C:\Windows\System\RGiaOGf.exe
  C:\Windows\System\RGiaOGf.exe
  2⤵
  PID:7544
- C:\Windows\System\ItHaZOS.exe
  C:\Windows\System\ItHaZOS.exe
  2⤵
  PID:7564
- C:\Windows\System\XNMXLMF.exe
  C:\Windows\System\XNMXLMF.exe
  2⤵
  PID:7580
- C:\Windows\System\SoqxgwW.exe
  C:\Windows\System\SoqxgwW.exe
  2⤵
  PID:7600
- C:\Windows\System\DMLNMfK.exe
  C:\Windows\System\DMLNMfK.exe
  2⤵
  PID:7620
- C:\Windows\System\hqMegIp.exe
  C:\Windows\System\hqMegIp.exe
  2⤵
  PID:7640
- C:\Windows\System\NAuClLQ.exe
  C:\Windows\System\NAuClLQ.exe
  2⤵
  PID:7844
- C:\Windows\System\cotsGej.exe
  C:\Windows\System\cotsGej.exe
  2⤵
  PID:7876
- C:\Windows\System\SDtzHPN.exe
  C:\Windows\System\SDtzHPN.exe
  2⤵
  PID:7940
- C:\Windows\System\IWmzIzT.exe
  C:\Windows\System\IWmzIzT.exe
  2⤵
  PID:7964
- C:\Windows\System\xsYbVWY.exe
  C:\Windows\System\xsYbVWY.exe
  2⤵
  PID:7980
- C:\Windows\System\NzlYSfQ.exe
  C:\Windows\System\NzlYSfQ.exe
  2⤵
  PID:8008
- C:\Windows\System\JxyNygY.exe
  C:\Windows\System\JxyNygY.exe
  2⤵
  PID:8032
- C:\Windows\System\edndzSl.exe
  C:\Windows\System\edndzSl.exe
  2⤵
  PID:8048
- C:\Windows\System\dfRJpeJ.exe
  C:\Windows\System\dfRJpeJ.exe
  2⤵
  PID:8072
- C:\Windows\System\HUqcias.exe
  C:\Windows\System\HUqcias.exe
  2⤵
  PID:8092
- C:\Windows\System\SGabudb.exe
  C:\Windows\System\SGabudb.exe
  2⤵
  PID:8124
- C:\Windows\System\ckvCgdA.exe
  C:\Windows\System\ckvCgdA.exe
  2⤵
  PID:8140
- C:\Windows\System\ndLlvRq.exe
  C:\Windows\System\ndLlvRq.exe
  2⤵
  PID:8168
- C:\Windows\System\WRkSYQg.exe
  C:\Windows\System\WRkSYQg.exe
  2⤵
  PID:8188
- C:\Windows\System\OpTgzFP.exe
  C:\Windows\System\OpTgzFP.exe
  2⤵
  PID:6040
- C:\Windows\System\oZYoUbU.exe
  C:\Windows\System\oZYoUbU.exe
  2⤵
  PID:6112
- C:\Windows\System\YbaafKI.exe
  C:\Windows\System\YbaafKI.exe
  2⤵
  PID:6640
- C:\Windows\System\pyOHRlJ.exe
  C:\Windows\System\pyOHRlJ.exe
  2⤵
  PID:5328
- C:\Windows\System\ZfmvYgB.exe
  C:\Windows\System\ZfmvYgB.exe
  2⤵
  PID:5440
- C:\Windows\System\OyhTTzf.exe
  C:\Windows\System\OyhTTzf.exe
  2⤵
  PID:1468
- C:\Windows\System\riGEMqF.exe
  C:\Windows\System\riGEMqF.exe
  2⤵
  PID:5884
- C:\Windows\System\HKOxdEt.exe
  C:\Windows\System\HKOxdEt.exe
  2⤵
  PID:3608
- C:\Windows\System\yZeusQo.exe
  C:\Windows\System\yZeusQo.exe
  2⤵
  PID:7144
- C:\Windows\System\JiHEeiO.exe
  C:\Windows\System\JiHEeiO.exe
  2⤵
  PID:5176
- C:\Windows\System\eIIPegg.exe
  C:\Windows\System\eIIPegg.exe
  2⤵
  PID:3068
- C:\Windows\System\DnQRmWx.exe
  C:\Windows\System\DnQRmWx.exe
  2⤵
  PID:4148
- C:\Windows\System\HfbkwPL.exe
  C:\Windows\System\HfbkwPL.exe
  2⤵
  PID:5940
- C:\Windows\System\bdGpjqu.exe
  C:\Windows\System\bdGpjqu.exe
  2⤵
  PID:6224
- C:\Windows\System\VQVYpNu.exe
  C:\Windows\System\VQVYpNu.exe
  2⤵
  PID:6316
- C:\Windows\System\yfHICGs.exe
  C:\Windows\System\yfHICGs.exe
  2⤵
  PID:6424
- C:\Windows\System\PoGEvTV.exe
  C:\Windows\System\PoGEvTV.exe
  2⤵
  PID:6520
- C:\Windows\System\ZpSdpHv.exe
  C:\Windows\System\ZpSdpHv.exe
  2⤵
  PID:6580
- C:\Windows\System\KTNWQoc.exe
  C:\Windows\System\KTNWQoc.exe
  2⤵
  PID:3968
- C:\Windows\System\uRuAOEj.exe
  C:\Windows\System\uRuAOEj.exe
  2⤵
  PID:7224
- C:\Windows\System\TVrIuVY.exe
  C:\Windows\System\TVrIuVY.exe
  2⤵
  PID:7340
- C:\Windows\System\rSryjts.exe
  C:\Windows\System\rSryjts.exe
  2⤵
  PID:7388
- C:\Windows\System\yboJphg.exe
  C:\Windows\System\yboJphg.exe
  2⤵
  PID:7420
- C:\Windows\System\RrErEdC.exe
  C:\Windows\System\RrErEdC.exe
  2⤵
  PID:7500
- C:\Windows\System\wZfEKAq.exe
  C:\Windows\System\wZfEKAq.exe
  2⤵
  PID:7552
- C:\Windows\System\SvdVggl.exe
  C:\Windows\System\SvdVggl.exe
  2⤵
  PID:7608
- C:\Windows\System\vwSItXJ.exe
  C:\Windows\System\vwSItXJ.exe
  2⤵
  PID:7668
- C:\Windows\System\BVboJZD.exe
  C:\Windows\System\BVboJZD.exe
  2⤵
  PID:4060
- C:\Windows\System\egmbrCZ.exe
  C:\Windows\System\egmbrCZ.exe
  2⤵
  PID:4948
- C:\Windows\System\qYGcNwD.exe
  C:\Windows\System\qYGcNwD.exe
  2⤵
  PID:3376
- C:\Windows\System\BeGMyoz.exe
  C:\Windows\System\BeGMyoz.exe
  2⤵
  PID:1408
- C:\Windows\System\KzVVyDt.exe
  C:\Windows\System\KzVVyDt.exe
  2⤵
  PID:5012
- C:\Windows\System\pTZsgVd.exe
  C:\Windows\System\pTZsgVd.exe
  2⤵
  PID:3528
- C:\Windows\System\YeejOgQ.exe
  C:\Windows\System\YeejOgQ.exe
  2⤵
  PID:7872
- C:\Windows\System\ZTIIKrD.exe
  C:\Windows\System\ZTIIKrD.exe
  2⤵
  PID:4920
- C:\Windows\System\UimgIZn.exe
  C:\Windows\System\UimgIZn.exe
  2⤵
  PID:8020
- C:\Windows\System\toigyQQ.exe
  C:\Windows\System\toigyQQ.exe
  2⤵
  PID:5084
- C:\Windows\System\cKGIbvv.exe
  C:\Windows\System\cKGIbvv.exe
  2⤵
  PID:5436
- C:\Windows\System\QQkhgoB.exe
  C:\Windows\System\QQkhgoB.exe
  2⤵
  PID:7160
- C:\Windows\System\rKdJziZ.exe
  C:\Windows\System\rKdJziZ.exe
  2⤵
  PID:2668
- C:\Windows\System\eCpahmS.exe
  C:\Windows\System\eCpahmS.exe
  2⤵
  PID:6208
- C:\Windows\System\cMkcCGX.exe
  C:\Windows\System\cMkcCGX.exe
  2⤵
  PID:6364
- C:\Windows\System\yIGuUlX.exe
  C:\Windows\System\yIGuUlX.exe
  2⤵
  PID:6584
- C:\Windows\System\obeCozK.exe
  C:\Windows\System\obeCozK.exe
  2⤵
  PID:7372
- C:\Windows\System\aqtXRkS.exe
  C:\Windows\System\aqtXRkS.exe
  2⤵
  PID:8088
- C:\Windows\System\wVaAMMB.exe
  C:\Windows\System\wVaAMMB.exe
  2⤵
  PID:7888
- C:\Windows\System\SONDPsv.exe
  C:\Windows\System\SONDPsv.exe
  2⤵
  PID:5836
- C:\Windows\System\iAvKgPX.exe
  C:\Windows\System\iAvKgPX.exe
  2⤵
  PID:7924
- C:\Windows\System\cgIaPVy.exe
  C:\Windows\System\cgIaPVy.exe
  2⤵
  PID:7304
- C:\Windows\System\uyIwQaD.exe
  C:\Windows\System\uyIwQaD.exe
  2⤵
  PID:2328
- C:\Windows\System\FieMqMD.exe
  C:\Windows\System\FieMqMD.exe
  2⤵
  PID:3652
- C:\Windows\System\TvcWWFQ.exe
  C:\Windows\System\TvcWWFQ.exe
  2⤵
  PID:5640
- C:\Windows\System\KabiPkB.exe
  C:\Windows\System\KabiPkB.exe
  2⤵
  PID:8216
- C:\Windows\System\WliVrkY.exe
  C:\Windows\System\WliVrkY.exe
  2⤵
  PID:8236
- C:\Windows\System\KYncMVi.exe
  C:\Windows\System\KYncMVi.exe
  2⤵
  PID:8260
- C:\Windows\System\TjijRhk.exe
  C:\Windows\System\TjijRhk.exe
  2⤵
  PID:8284
- C:\Windows\System\tNKuNka.exe
  C:\Windows\System\tNKuNka.exe
  2⤵
  PID:8304
- C:\Windows\System\wBamxIk.exe
  C:\Windows\System\wBamxIk.exe
  2⤵
  PID:8324
- C:\Windows\System\jmImzqK.exe
  C:\Windows\System\jmImzqK.exe
  2⤵
  PID:8344
- C:\Windows\System\lGcClLb.exe
  C:\Windows\System\lGcClLb.exe
  2⤵
  PID:8364
- C:\Windows\System\pBIJgGl.exe
  C:\Windows\System\pBIJgGl.exe
  2⤵
  PID:8384
- C:\Windows\System\kGFsfAe.exe
  C:\Windows\System\kGFsfAe.exe
  2⤵
  PID:8412
- C:\Windows\System\tnjqbiO.exe
  C:\Windows\System\tnjqbiO.exe
  2⤵
  PID:8428
- C:\Windows\System\ZEAkHgE.exe
  C:\Windows\System\ZEAkHgE.exe
  2⤵
  PID:8452
- C:\Windows\System\eftEhSq.exe
  C:\Windows\System\eftEhSq.exe
  2⤵
  PID:8476
- C:\Windows\System\YEzzYgs.exe
  C:\Windows\System\YEzzYgs.exe
  2⤵
  PID:8500
- C:\Windows\System\TMiByoe.exe
  C:\Windows\System\TMiByoe.exe
  2⤵
  PID:8520
- C:\Windows\System\xpSbEyI.exe
  C:\Windows\System\xpSbEyI.exe
  2⤵
  PID:8544
- C:\Windows\System\GTnVBoQ.exe
  C:\Windows\System\GTnVBoQ.exe
  2⤵
  PID:8564
- C:\Windows\System\fNQqENM.exe
  C:\Windows\System\fNQqENM.exe
  2⤵
  PID:8588
- C:\Windows\System\reDlqwR.exe
  C:\Windows\System\reDlqwR.exe
  2⤵
  PID:8632
- C:\Windows\System\zwQVWvn.exe
  C:\Windows\System\zwQVWvn.exe
  2⤵
  PID:8648
- C:\Windows\System\uKsbvpZ.exe
  C:\Windows\System\uKsbvpZ.exe
  2⤵
  PID:8676
- C:\Windows\System\njxHYvV.exe
  C:\Windows\System\njxHYvV.exe
  2⤵
  PID:8692
- C:\Windows\System\lkDXGoW.exe
  C:\Windows\System\lkDXGoW.exe
  2⤵
  PID:8712
- C:\Windows\System\JEOIrRD.exe
  C:\Windows\System\JEOIrRD.exe
  2⤵
  PID:8740
- C:\Windows\System\njhaEbS.exe
  C:\Windows\System\njhaEbS.exe
  2⤵
  PID:8760
- C:\Windows\System\pPoNXDN.exe
  C:\Windows\System\pPoNXDN.exe
  2⤵
  PID:8780
- C:\Windows\System\EmVzrMk.exe
  C:\Windows\System\EmVzrMk.exe
  2⤵
  PID:8804
- C:\Windows\System\xsiKXbJ.exe
  C:\Windows\System\xsiKXbJ.exe
  2⤵
  PID:8828
- C:\Windows\System\nEoKqWg.exe
  C:\Windows\System\nEoKqWg.exe
  2⤵
  PID:8848
- C:\Windows\System\KmoEOrl.exe
  C:\Windows\System\KmoEOrl.exe
  2⤵
  PID:8872
- C:\Windows\System\YsJXoth.exe
  C:\Windows\System\YsJXoth.exe
  2⤵
  PID:8892
- C:\Windows\System\qSQHoho.exe
  C:\Windows\System\qSQHoho.exe
  2⤵
  PID:8916
- C:\Windows\System\pqteslU.exe
  C:\Windows\System\pqteslU.exe
  2⤵
  PID:8936
- C:\Windows\System\ERnUPSL.exe
  C:\Windows\System\ERnUPSL.exe
  2⤵
  PID:8956
- C:\Windows\System\mWVDwJc.exe
  C:\Windows\System\mWVDwJc.exe
  2⤵
  PID:8980
- C:\Windows\System\diGVqnk.exe
  C:\Windows\System\diGVqnk.exe
  2⤵
  PID:9004
- C:\Windows\System\dOWHPzw.exe
  C:\Windows\System\dOWHPzw.exe
  2⤵
  PID:9032
- C:\Windows\System\OTVFBGC.exe
  C:\Windows\System\OTVFBGC.exe
  2⤵
  PID:9052
- C:\Windows\System\UTTuYpp.exe
  C:\Windows\System\UTTuYpp.exe
  2⤵
  PID:9072
- C:\Windows\System\GnKKAro.exe
  C:\Windows\System\GnKKAro.exe
  2⤵
  PID:9092
- C:\Windows\System\pryCKQW.exe
  C:\Windows\System\pryCKQW.exe
  2⤵
  PID:9128
- C:\Windows\System\zQvNCJx.exe
  C:\Windows\System\zQvNCJx.exe
  2⤵
  PID:9144
- C:\Windows\System\geyHQvo.exe
  C:\Windows\System\geyHQvo.exe
  2⤵
  PID:9164
- C:\Windows\System\tnDwTic.exe
  C:\Windows\System\tnDwTic.exe
  2⤵
  PID:9184
- C:\Windows\System\jIZESTq.exe
  C:\Windows\System\jIZESTq.exe
  2⤵
  PID:9200
- C:\Windows\System\YKDDHGI.exe
  C:\Windows\System\YKDDHGI.exe
  2⤵
  PID:6516
- C:\Windows\System\ZOVRsEm.exe
  C:\Windows\System\ZOVRsEm.exe
  2⤵
  PID:7220
- C:\Windows\System\tvySEIa.exe
  C:\Windows\System\tvySEIa.exe
  2⤵
  PID:5408
- C:\Windows\System\vaTSBAE.exe
  C:\Windows\System\vaTSBAE.exe
  2⤵
  PID:4988
- C:\Windows\System\IjSPXJu.exe
  C:\Windows\System\IjSPXJu.exe
  2⤵
  PID:8160
- C:\Windows\System\fcbyaPr.exe
  C:\Windows\System\fcbyaPr.exe
  2⤵
  PID:6032
- C:\Windows\System\dPUkHQw.exe
  C:\Windows\System\dPUkHQw.exe
  2⤵
  PID:5756
- C:\Windows\System\KdflONT.exe
  C:\Windows\System\KdflONT.exe
  2⤵
  PID:1656
- C:\Windows\System\IvHXjPv.exe
  C:\Windows\System\IvHXjPv.exe
  2⤵
  PID:7900
- C:\Windows\System\MEvwFvY.exe
  C:\Windows\System\MEvwFvY.exe
  2⤵
  PID:436
- C:\Windows\System\BspFJyf.exe
  C:\Windows\System\BspFJyf.exe
  2⤵
  PID:8232
- C:\Windows\System\uKqyqOA.exe
  C:\Windows\System\uKqyqOA.exe
  2⤵
  PID:7376
- C:\Windows\System\vBoKKsU.exe
  C:\Windows\System\vBoKKsU.exe
  2⤵
  PID:8400
- C:\Windows\System\GhxgDOF.exe
  C:\Windows\System\GhxgDOF.exe
  2⤵
  PID:8444
- C:\Windows\System\BxgYShH.exe
  C:\Windows\System\BxgYShH.exe
  2⤵
  PID:8584
- C:\Windows\System\fkIvDoc.exe
  C:\Windows\System\fkIvDoc.exe
  2⤵
  PID:7408
- C:\Windows\System\bEKEywk.exe
  C:\Windows\System\bEKEywk.exe
  2⤵
  PID:8728
- C:\Windows\System\WiSsFQS.exe
  C:\Windows\System\WiSsFQS.exe
  2⤵
  PID:9220
- C:\Windows\System\nOasGFH.exe
  C:\Windows\System\nOasGFH.exe
  2⤵
  PID:9248
- C:\Windows\System\WyhkdMn.exe
  C:\Windows\System\WyhkdMn.exe
  2⤵
  PID:9268
- C:\Windows\System\pwLHDBd.exe
  C:\Windows\System\pwLHDBd.exe
  2⤵
  PID:9288
- C:\Windows\System\WDCFfBl.exe
  C:\Windows\System\WDCFfBl.exe
  2⤵
  PID:9312
- C:\Windows\System\lYMleOq.exe
  C:\Windows\System\lYMleOq.exe
  2⤵
  PID:9332
- C:\Windows\System\HwkLDBQ.exe
  C:\Windows\System\HwkLDBQ.exe
  2⤵
  PID:9352
- C:\Windows\System\uvuOoNy.exe
  C:\Windows\System\uvuOoNy.exe
  2⤵
  PID:9380
- C:\Windows\System\cynanGq.exe
  C:\Windows\System\cynanGq.exe
  2⤵
  PID:9400
- C:\Windows\System\cARUcNi.exe
  C:\Windows\System\cARUcNi.exe
  2⤵
  PID:9420
- C:\Windows\System\QhDuBBm.exe
  C:\Windows\System\QhDuBBm.exe
  2⤵
  PID:9448
- C:\Windows\System\qkRmiMI.exe
  C:\Windows\System\qkRmiMI.exe
  2⤵
  PID:9468
- C:\Windows\System\BRmPPko.exe
  C:\Windows\System\BRmPPko.exe
  2⤵
  PID:9488
- C:\Windows\System\XpjwVIO.exe
  C:\Windows\System\XpjwVIO.exe
  2⤵
  PID:9516
- C:\Windows\System\PnvYbMV.exe
  C:\Windows\System\PnvYbMV.exe
  2⤵
  PID:9540
- C:\Windows\System\QRONZHw.exe
  C:\Windows\System\QRONZHw.exe
  2⤵
  PID:9560
- C:\Windows\System\ZVQNjAS.exe
  C:\Windows\System\ZVQNjAS.exe
  2⤵
  PID:9584
- C:\Windows\System\yUtDtEv.exe
  C:\Windows\System\yUtDtEv.exe
  2⤵
  PID:9608
- C:\Windows\System\KXwNuHx.exe
  C:\Windows\System\KXwNuHx.exe
  2⤵
  PID:9640
- C:\Windows\System\XexBIHO.exe
  C:\Windows\System\XexBIHO.exe
  2⤵
  PID:9660
- C:\Windows\System\IGLhEvi.exe
  C:\Windows\System\IGLhEvi.exe
  2⤵
  PID:9680
- C:\Windows\System\LrUvBdH.exe
  C:\Windows\System\LrUvBdH.exe
  2⤵
  PID:9704
- C:\Windows\System\rDxEpHK.exe
  C:\Windows\System\rDxEpHK.exe
  2⤵
  PID:9724
- C:\Windows\System\ttUFkfK.exe
  C:\Windows\System\ttUFkfK.exe
  2⤵
  PID:9744
- C:\Windows\System\rpGOIAK.exe
  C:\Windows\System\rpGOIAK.exe
  2⤵
  PID:9764
- C:\Windows\System\xBKbfgu.exe
  C:\Windows\System\xBKbfgu.exe
  2⤵
  PID:9780
- C:\Windows\System\aoQSOab.exe
  C:\Windows\System\aoQSOab.exe
  2⤵
  PID:9808
- C:\Windows\System\sRBecZE.exe
  C:\Windows\System\sRBecZE.exe
  2⤵
  PID:9828
- C:\Windows\System\FzpCEwK.exe
  C:\Windows\System\FzpCEwK.exe
  2⤵
  PID:9848
- C:\Windows\System\JuaGRKI.exe
  C:\Windows\System\JuaGRKI.exe
  2⤵
  PID:9868
- C:\Windows\System\NfxHppA.exe
  C:\Windows\System\NfxHppA.exe
  2⤵
  PID:9892
- C:\Windows\System\qEQYVud.exe
  C:\Windows\System\qEQYVud.exe
  2⤵
  PID:9916
- C:\Windows\System\GmhOiMF.exe
  C:\Windows\System\GmhOiMF.exe
  2⤵
  PID:9948
- C:\Windows\System\vaRHCvb.exe
  C:\Windows\System\vaRHCvb.exe
  2⤵
  PID:9968
- C:\Windows\System\bxXHVFo.exe
  C:\Windows\System\bxXHVFo.exe
  2⤵
  PID:10000
- C:\Windows\System\tLieeEq.exe
  C:\Windows\System\tLieeEq.exe
  2⤵
  PID:10024
- C:\Windows\System\kNpcXVB.exe
  C:\Windows\System\kNpcXVB.exe
  2⤵
  PID:10048
- C:\Windows\System\NBQWObb.exe
  C:\Windows\System\NBQWObb.exe
  2⤵
  PID:10068
- C:\Windows\System\bGUmrbG.exe
  C:\Windows\System\bGUmrbG.exe
  2⤵
  PID:10088
- C:\Windows\System\BnFsjCF.exe
  C:\Windows\System\BnFsjCF.exe
  2⤵
  PID:10112
- C:\Windows\System\CHIyRvg.exe
  C:\Windows\System\CHIyRvg.exe
  2⤵
  PID:10128
- C:\Windows\System\MAIAvht.exe
  C:\Windows\System\MAIAvht.exe
  2⤵
  PID:10144
- C:\Windows\System\HgrEkBd.exe
  C:\Windows\System\HgrEkBd.exe
  2⤵
  PID:10164
- C:\Windows\System\CfrJLTX.exe
  C:\Windows\System\CfrJLTX.exe
  2⤵
  PID:10184
- C:\Windows\System\xNvOREp.exe
  C:\Windows\System\xNvOREp.exe
  2⤵
  PID:10204
- C:\Windows\System\bIVFBHe.exe
  C:\Windows\System\bIVFBHe.exe
  2⤵
  PID:10224
- C:\Windows\System\bgkZgOY.exe
  C:\Windows\System\bgkZgOY.exe
  2⤵
  PID:3636
- C:\Windows\System\fMgZdrb.exe
  C:\Windows\System\fMgZdrb.exe
  2⤵
  PID:8816
- C:\Windows\System\JKjFExP.exe
  C:\Windows\System\JKjFExP.exe
  2⤵
  PID:8256
- C:\Windows\System\QDjMYhp.exe
  C:\Windows\System\QDjMYhp.exe
  2⤵
  PID:8952
- C:\Windows\System\RltJdCn.exe
  C:\Windows\System\RltJdCn.exe
  2⤵
  PID:8312
- C:\Windows\System\vsNuHcy.exe
  C:\Windows\System\vsNuHcy.exe
  2⤵
  PID:3352
- C:\Windows\System\bnIaMKL.exe
  C:\Windows\System\bnIaMKL.exe
  2⤵
  PID:5736
- C:\Windows\System\ntDtlFG.exe
  C:\Windows\System\ntDtlFG.exe
  2⤵
  PID:7244
- C:\Windows\System\UfHIWNp.exe
  C:\Windows\System\UfHIWNp.exe
  2⤵
  PID:7184
- C:\Windows\System\PkuMmeu.exe
  C:\Windows\System\PkuMmeu.exe
  2⤵
  PID:8516
- C:\Windows\System\zWwYzIw.exe
  C:\Windows\System\zWwYzIw.exe
  2⤵
  PID:8576
- C:\Windows\System\QsOZBWF.exe
  C:\Windows\System\QsOZBWF.exe
  2⤵
  PID:7320
- C:\Windows\System\JULfQTI.exe
  C:\Windows\System\JULfQTI.exe
  2⤵
  PID:8640
- C:\Windows\System\jQUIRAf.exe
  C:\Windows\System\jQUIRAf.exe
  2⤵
  PID:8392
- C:\Windows\System\ckcBqEz.exe
  C:\Windows\System\ckcBqEz.exe
  2⤵
  PID:9256
- C:\Windows\System\MXDlFqt.exe
  C:\Windows\System\MXDlFqt.exe
  2⤵
  PID:9284
- C:\Windows\System\kXHwZcR.exe
  C:\Windows\System\kXHwZcR.exe
  2⤵
  PID:9360
- C:\Windows\System\PmTyeVH.exe
  C:\Windows\System\PmTyeVH.exe
  2⤵
  PID:10252
- C:\Windows\System\amjOeXv.exe
  C:\Windows\System\amjOeXv.exe
  2⤵
  PID:10276
- C:\Windows\System\BfaWFux.exe
  C:\Windows\System\BfaWFux.exe
  2⤵
  PID:10304
- C:\Windows\System\WHAIoIv.exe
  C:\Windows\System\WHAIoIv.exe
  2⤵
  PID:10324
- C:\Windows\System\lNYJCMj.exe
  C:\Windows\System\lNYJCMj.exe
  2⤵
  PID:10344
- C:\Windows\System\uMDveuN.exe
  C:\Windows\System\uMDveuN.exe
  2⤵
  PID:10372
- C:\Windows\System\PebxpCf.exe
  C:\Windows\System\PebxpCf.exe
  2⤵
  PID:10392
- C:\Windows\System\KNtlJMn.exe
  C:\Windows\System\KNtlJMn.exe
  2⤵
  PID:10416
- C:\Windows\System\wGnXFha.exe
  C:\Windows\System\wGnXFha.exe
  2⤵
  PID:10440
- C:\Windows\System\RziLloQ.exe
  C:\Windows\System\RziLloQ.exe
  2⤵
  PID:10464
- C:\Windows\System\tZwWrch.exe
  C:\Windows\System\tZwWrch.exe
  2⤵
  PID:10488
- C:\Windows\System\zmyRnjd.exe
  C:\Windows\System\zmyRnjd.exe
  2⤵
  PID:10508
- C:\Windows\System\KxYJwQD.exe
  C:\Windows\System\KxYJwQD.exe
  2⤵
  PID:10532
- C:\Windows\System\qZbwCDB.exe
  C:\Windows\System\qZbwCDB.exe
  2⤵
  PID:10548
- C:\Windows\System\ZOsOIrH.exe
  C:\Windows\System\ZOsOIrH.exe
  2⤵
  PID:10572
- C:\Windows\System\GCDlFop.exe
  C:\Windows\System\GCDlFop.exe
  2⤵
  PID:10592
- C:\Windows\System\vLyEAiG.exe
  C:\Windows\System\vLyEAiG.exe
  2⤵
  PID:10612
- C:\Windows\System\TsOgiMB.exe
  C:\Windows\System\TsOgiMB.exe
  2⤵
  PID:10636
- C:\Windows\System\Cdervzz.exe
  C:\Windows\System\Cdervzz.exe
  2⤵
  PID:10660
- C:\Windows\System\BUmoeJi.exe
  C:\Windows\System\BUmoeJi.exe
  2⤵
  PID:10684
- C:\Windows\System\wmlQkzw.exe
  C:\Windows\System\wmlQkzw.exe
  2⤵
  PID:10700
- C:\Windows\System\UsWhSEI.exe
  C:\Windows\System\UsWhSEI.exe
  2⤵
  PID:10720
- C:\Windows\System\PobPWeF.exe
  C:\Windows\System\PobPWeF.exe
  2⤵
  PID:10744
- C:\Windows\System\KbhePhA.exe
  C:\Windows\System\KbhePhA.exe
  2⤵
  PID:10772
- C:\Windows\System\XYgplmS.exe
  C:\Windows\System\XYgplmS.exe
  2⤵
  PID:10796
- C:\Windows\System\SLibvmd.exe
  C:\Windows\System\SLibvmd.exe
  2⤵
  PID:10816
- C:\Windows\System\espyeZO.exe
  C:\Windows\System\espyeZO.exe
  2⤵
  PID:10844
- C:\Windows\System\yvrltwj.exe
  C:\Windows\System\yvrltwj.exe
  2⤵
  PID:10860
- C:\Windows\System\plRqckI.exe
  C:\Windows\System\plRqckI.exe
  2⤵
  PID:10884
- C:\Windows\System\EAWdFih.exe
  C:\Windows\System\EAWdFih.exe
  2⤵
  PID:10908
- C:\Windows\System\nRyXylq.exe
  C:\Windows\System\nRyXylq.exe
  2⤵
  PID:10928
- C:\Windows\System\YqRcIeU.exe
  C:\Windows\System\YqRcIeU.exe
  2⤵
  PID:10952
- C:\Windows\System\CTgQtQX.exe
  C:\Windows\System\CTgQtQX.exe
  2⤵
  PID:10980
- C:\Windows\System\odqjBrI.exe
  C:\Windows\System\odqjBrI.exe
  2⤵
  PID:11004
- C:\Windows\System\yxNvELu.exe
  C:\Windows\System\yxNvELu.exe
  2⤵
  PID:11024
- C:\Windows\System\spyOaUF.exe
  C:\Windows\System\spyOaUF.exe
  2⤵
  PID:11044
- C:\Windows\System\xNggVvH.exe
  C:\Windows\System\xNggVvH.exe
  2⤵
  PID:11068
- C:\Windows\System\syXVBfz.exe
  C:\Windows\System\syXVBfz.exe
  2⤵
  PID:11092
- C:\Windows\System\QKnNbTS.exe
  C:\Windows\System\QKnNbTS.exe
  2⤵
  PID:11120
- C:\Windows\System\ktEWrcB.exe
  C:\Windows\System\ktEWrcB.exe
  2⤵
  PID:11136
- C:\Windows\System\FsegXqC.exe
  C:\Windows\System\FsegXqC.exe
  2⤵
  PID:11160
- C:\Windows\System\ndKNMnq.exe
  C:\Windows\System\ndKNMnq.exe
  2⤵
  PID:11176
- C:\Windows\System\rpgCtFP.exe
  C:\Windows\System\rpgCtFP.exe
  2⤵
  PID:11192
- C:\Windows\System\WhpQudU.exe
  C:\Windows\System\WhpQudU.exe
  2⤵
  PID:11212
- C:\Windows\System\mSdFPHr.exe
  C:\Windows\System\mSdFPHr.exe
  2⤵
  PID:11228
- C:\Windows\System\ffQdGBw.exe
  C:\Windows\System\ffQdGBw.exe
  2⤵
  PID:11244
- C:\Windows\System\trYApHC.exe
  C:\Windows\System\trYApHC.exe
  2⤵
  PID:9392
- C:\Windows\System\FHhVCaC.exe
  C:\Windows\System\FHhVCaC.exe
  2⤵
  PID:9464
- C:\Windows\System\WKLONPQ.exe
  C:\Windows\System\WKLONPQ.exe
  2⤵
  PID:9504
- C:\Windows\System\xUZiuUD.exe
  C:\Windows\System\xUZiuUD.exe
  2⤵
  PID:9576
- C:\Windows\System\sKUyjHh.exe
  C:\Windows\System\sKUyjHh.exe
  2⤵
  PID:9632
- C:\Windows\System\KpDyMUF.exe
  C:\Windows\System\KpDyMUF.exe
  2⤵
  PID:8996
- C:\Windows\System\fsupPwT.exe
  C:\Windows\System\fsupPwT.exe
  2⤵
  PID:9692
- C:\Windows\System\ZNUOxPT.exe
  C:\Windows\System\ZNUOxPT.exe
  2⤵
  PID:8352
- C:\Windows\System\IgXpJqi.exe
  C:\Windows\System\IgXpJqi.exe
  2⤵
  PID:8424
- C:\Windows\System\QtWMhbH.exe
  C:\Windows\System\QtWMhbH.exe
  2⤵
  PID:9876
- C:\Windows\System\vGSPmVL.exe
  C:\Windows\System\vGSPmVL.exe
  2⤵
  PID:9840
- C:\Windows\System\IRyuzMq.exe
  C:\Windows\System\IRyuzMq.exe
  2⤵
  PID:9964
- C:\Windows\System\EzucsDT.exe
  C:\Windows\System\EzucsDT.exe
  2⤵
  PID:1004
- C:\Windows\System\YHBHBin.exe
  C:\Windows\System\YHBHBin.exe
  2⤵
  PID:10060
- C:\Windows\System\ZPbHmuw.exe
  C:\Windows\System\ZPbHmuw.exe
  2⤵
  PID:2288
- C:\Windows\System\AGhHFQX.exe
  C:\Windows\System\AGhHFQX.exe
  2⤵
  PID:8660
- C:\Windows\System\XvNMOmi.exe
  C:\Windows\System\XvNMOmi.exe
  2⤵
  PID:4964
- C:\Windows\System\uUsKEiE.exe
  C:\Windows\System\uUsKEiE.exe
  2⤵
  PID:8532
- C:\Windows\System\bWCOHwR.exe
  C:\Windows\System\bWCOHwR.exe
  2⤵
  PID:8332
- C:\Windows\System\RQkyMZn.exe
  C:\Windows\System\RQkyMZn.exe
  2⤵
  PID:2648
- C:\Windows\System\VAOAVUl.exe
  C:\Windows\System\VAOAVUl.exe
  2⤵
  PID:4280
- C:\Windows\System\OWrCoKO.exe
  C:\Windows\System\OWrCoKO.exe
  2⤵
  PID:9280
- C:\Windows\System\ISTPkLi.exe
  C:\Windows\System\ISTPkLi.exe
  2⤵
  PID:8844
- C:\Windows\System\JdfwIkt.exe
  C:\Windows\System\JdfwIkt.exe
  2⤵
  PID:9444
- C:\Windows\System\wimqdSn.exe
  C:\Windows\System\wimqdSn.exe
  2⤵
  PID:10404
- C:\Windows\System\gSBiLka.exe
  C:\Windows\System\gSBiLka.exe
  2⤵
  PID:8928
- C:\Windows\System\JmsHUpF.exe
  C:\Windows\System\JmsHUpF.exe
  2⤵
  PID:11304
- C:\Windows\System\KZjjZix.exe
  C:\Windows\System\KZjjZix.exe
  2⤵
  PID:11328
- C:\Windows\System\TxSJepW.exe
  C:\Windows\System\TxSJepW.exe
  2⤵
  PID:11348
- C:\Windows\System\FdGqXJj.exe
  C:\Windows\System\FdGqXJj.exe
  2⤵
  PID:11372
- C:\Windows\System\vhSLqWK.exe
  C:\Windows\System\vhSLqWK.exe
  2⤵
  PID:11392
- C:\Windows\System\BdbFNLI.exe
  C:\Windows\System\BdbFNLI.exe
  2⤵
  PID:11420
- C:\Windows\System\rxteslT.exe
  C:\Windows\System\rxteslT.exe
  2⤵
  PID:11452
- C:\Windows\System\DpilOAu.exe
  C:\Windows\System\DpilOAu.exe
  2⤵
  PID:11508
- C:\Windows\System\eyvWVrm.exe
  C:\Windows\System\eyvWVrm.exe
  2⤵
  PID:11528
- C:\Windows\System\sIwIzzS.exe
  C:\Windows\System\sIwIzzS.exe
  2⤵
  PID:11552
- C:\Windows\System\XqGvETQ.exe
  C:\Windows\System\XqGvETQ.exe
  2⤵
  PID:11572
- C:\Windows\System\BzFYLvE.exe
  C:\Windows\System\BzFYLvE.exe
  2⤵
  PID:11596
- C:\Windows\System\XCIQAQf.exe
  C:\Windows\System\XCIQAQf.exe
  2⤵
  PID:11616
- C:\Windows\System\MqLiDFu.exe
  C:\Windows\System\MqLiDFu.exe
  2⤵
  PID:11644
- C:\Windows\System\WqwtZSi.exe
  C:\Windows\System\WqwtZSi.exe
  2⤵
  PID:11664
- C:\Windows\System\XhPvAlC.exe
  C:\Windows\System\XhPvAlC.exe
  2⤵
  PID:11692
- C:\Windows\System\UANQRoR.exe
  C:\Windows\System\UANQRoR.exe
  2⤵
  PID:11720
- C:\Windows\System\HnmjQgC.exe
  C:\Windows\System\HnmjQgC.exe
  2⤵
  PID:11736
- C:\Windows\System\pjimSiX.exe
  C:\Windows\System\pjimSiX.exe
  2⤵
  PID:11752
- C:\Windows\System\dmLZqZt.exe
  C:\Windows\System\dmLZqZt.exe
  2⤵
  PID:11772
- C:\Windows\System\XNjbsUx.exe
  C:\Windows\System\XNjbsUx.exe
  2⤵
  PID:11788
- C:\Windows\System\Ibzlywp.exe
  C:\Windows\System\Ibzlywp.exe
  2⤵
  PID:11812
- C:\Windows\System\mxMHQOy.exe
  C:\Windows\System\mxMHQOy.exe
  2⤵
  PID:11832
- C:\Windows\System\lbzBSER.exe
  C:\Windows\System\lbzBSER.exe
  2⤵
  PID:11852
- C:\Windows\System\GXBRjms.exe
  C:\Windows\System\GXBRjms.exe
  2⤵
  PID:11872
- C:\Windows\System\NmEGitF.exe
  C:\Windows\System\NmEGitF.exe
  2⤵
  PID:11896
- C:\Windows\System\CIwcNLu.exe
  C:\Windows\System\CIwcNLu.exe
  2⤵
  PID:11916
- C:\Windows\System\SWqjWmm.exe
  C:\Windows\System\SWqjWmm.exe
  2⤵
  PID:11940
- C:\Windows\System\mtELjTc.exe
  C:\Windows\System\mtELjTc.exe
  2⤵
  PID:11960
- C:\Windows\System\FyEvHJl.exe
  C:\Windows\System\FyEvHJl.exe
  2⤵
  PID:11976
- C:\Windows\System\cwrOKmm.exe
  C:\Windows\System\cwrOKmm.exe
  2⤵
  PID:11992
- C:\Windows\System\mAzeyux.exe
  C:\Windows\System\mAzeyux.exe
  2⤵
  PID:12008
- C:\Windows\System\YvYHcpP.exe
  C:\Windows\System\YvYHcpP.exe
  2⤵
  PID:12024
- C:\Windows\System\nzNyoqy.exe
  C:\Windows\System\nzNyoqy.exe
  2⤵
  PID:12044
- C:\Windows\System\lMbRwWh.exe
  C:\Windows\System\lMbRwWh.exe
  2⤵
  PID:12068
- C:\Windows\System\gEzaLAR.exe
  C:\Windows\System\gEzaLAR.exe
  2⤵
  PID:12088
- C:\Windows\System\onaOCfu.exe
  C:\Windows\System\onaOCfu.exe
  2⤵
  PID:12108
- C:\Windows\System\OkfUroy.exe
  C:\Windows\System\OkfUroy.exe
  2⤵
  PID:12128
- C:\Windows\System\GKzxefh.exe
  C:\Windows\System\GKzxefh.exe
  2⤵
  PID:12152
- C:\Windows\System\pRVhrbJ.exe
  C:\Windows\System\pRVhrbJ.exe
  2⤵
  PID:12180
- C:\Windows\System\RFGxOaU.exe
  C:\Windows\System\RFGxOaU.exe
  2⤵
  PID:12200
- C:\Windows\System\gmYixfy.exe
  C:\Windows\System\gmYixfy.exe
  2⤵
  PID:12220
- C:\Windows\System\GILsmxe.exe
  C:\Windows\System\GILsmxe.exe
  2⤵
  PID:12248
- C:\Windows\System\cSmiUxJ.exe
  C:\Windows\System\cSmiUxJ.exe
  2⤵
  PID:11236
- C:\Windows\System\IsvciiY.exe
  C:\Windows\System\IsvciiY.exe
  2⤵
  PID:3976
- C:\Windows\System\RurnuBL.exe
  C:\Windows\System\RurnuBL.exe
  2⤵
  PID:4664
- C:\Windows\System\xgcWKdY.exe
  C:\Windows\System\xgcWKdY.exe
  2⤵
  PID:9548
- C:\Windows\System\OVQQFla.exe
  C:\Windows\System\OVQQFla.exe
  2⤵
  PID:3728
- C:\Windows\System\VJzcEPr.exe
  C:\Windows\System\VJzcEPr.exe
  2⤵
  PID:9000
- C:\Windows\System\yZdWJDL.exe
  C:\Windows\System\yZdWJDL.exe
  2⤵
  PID:9676
- C:\Windows\System\GFJrbKK.exe
  C:\Windows\System\GFJrbKK.exe
  2⤵
  PID:804
- C:\Windows\System\DTvwXBJ.exe
  C:\Windows\System\DTvwXBJ.exe
  2⤵
  PID:7284
- C:\Windows\System\oIZGEBB.exe
  C:\Windows\System\oIZGEBB.exe
  2⤵
  PID:11076
- C:\Windows\System\hHAgERH.exe
  C:\Windows\System\hHAgERH.exe
  2⤵
  PID:10708
- C:\Windows\System\Jsxxxxi.exe
  C:\Windows\System\Jsxxxxi.exe
  2⤵
  PID:9320
- C:\Windows\System\WNzzeYj.exe
  C:\Windows\System\WNzzeYj.exe
  2⤵
  PID:9372
- C:\Windows\System\bThkaHe.exe
  C:\Windows\System\bThkaHe.exe
  2⤵
  PID:10320
- C:\Windows\System\MTCMECZ.exe
  C:\Windows\System\MTCMECZ.exe
  2⤵
  PID:10380
- C:\Windows\System\qoPmjft.exe
  C:\Windows\System\qoPmjft.exe
  2⤵
  PID:10456
- C:\Windows\System\pZrejYU.exe
  C:\Windows\System\pZrejYU.exe
  2⤵
  PID:10608
- C:\Windows\System\LaZOzAZ.exe
  C:\Windows\System\LaZOzAZ.exe
  2⤵
  PID:9752
- C:\Windows\System\dNFiWrB.exe
  C:\Windows\System\dNFiWrB.exe
  2⤵
  PID:10780
- C:\Windows\System\luWeLkV.exe
  C:\Windows\System\luWeLkV.exe
  2⤵
  PID:9884
- C:\Windows\System\SKPcUBK.exe
  C:\Windows\System\SKPcUBK.exe
  2⤵
  PID:8488
- C:\Windows\System\xzuVwYz.exe
  C:\Windows\System\xzuVwYz.exe
  2⤵
  PID:11340
- C:\Windows\System\rosdajA.exe
  C:\Windows\System\rosdajA.exe
  2⤵
  PID:11516
- C:\Windows\System\ocqfTey.exe
  C:\Windows\System\ocqfTey.exe
  2⤵
  PID:11020
- C:\Windows\System\ScTVseH.exe
  C:\Windows\System\ScTVseH.exe
  2⤵
  PID:11684
- C:\Windows\System\ywKyHuf.exe
  C:\Windows\System\ywKyHuf.exe
  2⤵
  PID:11172
- C:\Windows\System\yrlDPAD.exe
  C:\Windows\System\yrlDPAD.exe
  2⤵
  PID:10096
- C:\Windows\System\URXZSOp.exe
  C:\Windows\System\URXZSOp.exe
  2⤵
  PID:10136
- C:\Windows\System\dPjenyP.exe
  C:\Windows\System\dPjenyP.exe
  2⤵
  PID:11760
- C:\Windows\System\gSUevAJ.exe
  C:\Windows\System\gSUevAJ.exe
  2⤵
  PID:11804
- C:\Windows\System\RBrTNie.exe
  C:\Windows\System\RBrTNie.exe
  2⤵
  PID:8272
- C:\Windows\System\FhsTZBt.exe
  C:\Windows\System\FhsTZBt.exe
  2⤵
  PID:10200
- C:\Windows\System\bPULCzu.exe
  C:\Windows\System\bPULCzu.exe
  2⤵
  PID:11936
- C:\Windows\System\HdGDzCq.exe
  C:\Windows\System\HdGDzCq.exe
  2⤵
  PID:12292
- C:\Windows\System\HjHKDnp.exe
  C:\Windows\System\HjHKDnp.exe
  2⤵
  PID:12308
- C:\Windows\System\dZdaBxi.exe
  C:\Windows\System\dZdaBxi.exe
  2⤵
  PID:12328
- C:\Windows\System\BDgpiTJ.exe
  C:\Windows\System\BDgpiTJ.exe
  2⤵
  PID:12348
- C:\Windows\System\AqWMZiK.exe
  C:\Windows\System\AqWMZiK.exe
  2⤵
  PID:12364
- C:\Windows\System\BfjUPBz.exe
  C:\Windows\System\BfjUPBz.exe
  2⤵
  PID:12384
- C:\Windows\System\mRGZIJk.exe
  C:\Windows\System\mRGZIJk.exe
  2⤵
  PID:12408
- C:\Windows\System\PPUsFei.exe
  C:\Windows\System\PPUsFei.exe
  2⤵
  PID:12428
- C:\Windows\System\IwMbfpm.exe
  C:\Windows\System\IwMbfpm.exe
  2⤵
  PID:12448
- C:\Windows\System\yxCYCzV.exe
  C:\Windows\System\yxCYCzV.exe
  2⤵
  PID:12468
- C:\Windows\System\IuKNvHV.exe
  C:\Windows\System\IuKNvHV.exe
  2⤵
  PID:12492
- C:\Windows\System\QDknYLe.exe
  C:\Windows\System\QDknYLe.exe
  2⤵
  PID:12520
- C:\Windows\System\VhmkbCY.exe
  C:\Windows\System\VhmkbCY.exe
  2⤵
  PID:12544
- C:\Windows\System\mTXQhuI.exe
  C:\Windows\System\mTXQhuI.exe
  2⤵
  PID:12572
- C:\Windows\System\cxNERFO.exe
  C:\Windows\System\cxNERFO.exe
  2⤵
  PID:12592
- C:\Windows\System\nUraDrp.exe
  C:\Windows\System\nUraDrp.exe
  2⤵
  PID:12628
- C:\Windows\System\YpsZOFJ.exe
  C:\Windows\System\YpsZOFJ.exe
  2⤵
  PID:12656
- C:\Windows\System\ISMcIBc.exe
  C:\Windows\System\ISMcIBc.exe
  2⤵
  PID:12680
- C:\Windows\System\OrLVGwy.exe
  C:\Windows\System\OrLVGwy.exe
  2⤵
  PID:12708
- C:\Windows\System\hChOtaV.exe
  C:\Windows\System\hChOtaV.exe
  2⤵
  PID:12732
- C:\Windows\System\OnSQUIa.exe
  C:\Windows\System\OnSQUIa.exe
  2⤵
  PID:12764
- C:\Windows\System\gvaIOxr.exe
  C:\Windows\System\gvaIOxr.exe
  2⤵
  PID:9900
- C:\Windows\System\fQNPkbK.exe
  C:\Windows\System\fQNPkbK.exe
  2⤵
  PID:12016
- C:\Windows\System\cEfFMGw.exe
  C:\Windows\System\cEfFMGw.exe
  2⤵
  PID:8616
- C:\Windows\System\acOIXrg.exe
  C:\Windows\System\acOIXrg.exe
  2⤵
  PID:12876
- C:\Windows\System\XBEOvCb.exe
  C:\Windows\System\XBEOvCb.exe
  2⤵
  PID:11564
- C:\Windows\System\YMrIWgT.exe
  C:\Windows\System\YMrIWgT.exe
  2⤵
  PID:11728
- C:\Windows\System\ZaTxXXJ.exe
  C:\Windows\System\ZaTxXXJ.exe
  2⤵
  PID:11904
- C:\Windows\System\GTImTkO.exe
  C:\Windows\System\GTImTkO.exe
  2⤵
  PID:9388
- C:\Windows\System\GVJBgaF.exe
  C:\Windows\System\GVJBgaF.exe
  2⤵
  PID:12036
- C:\Windows\System\DFGVBVi.exe
  C:\Windows\System\DFGVBVi.exe
  2⤵
  PID:13184
- C:\Windows\System\rCPYCKm.exe
  C:\Windows\System\rCPYCKm.exe
  2⤵
  PID:13192
- C:\Windows\System\vITUqgH.exe
  C:\Windows\System\vITUqgH.exe
  2⤵
  PID:13200
- C:\Windows\System\BMIbyQe.exe
  C:\Windows\System\BMIbyQe.exe
  2⤵
  PID:12164
- C:\Windows\System\bnFyjOS.exe
  C:\Windows\System\bnFyjOS.exe
  2⤵
  PID:10588
- C:\Windows\System\BtnORXZ.exe
  C:\Windows\System\BtnORXZ.exe
  2⤵
  PID:12880
- C:\Windows\System\bRVuKoN.exe
  C:\Windows\System\bRVuKoN.exe
  2⤵
  PID:11828
- C:\Windows\System\KGhoxSk.exe
  C:\Windows\System\KGhoxSk.exe
  2⤵
  PID:13288
- C:\Windows\System\vNmEjhW.exe
  C:\Windows\System\vNmEjhW.exe
  2⤵
  PID:12676
- C:\Windows\System\pkhQwlR.exe
  C:\Windows\System\pkhQwlR.exe
  2⤵
  PID:12756
- C:\Windows\System\QUGidRu.exe
  C:\Windows\System\QUGidRu.exe
  2⤵
  PID:12940
- C:\Windows\System\CsIbLCl.exe
  C:\Windows\System\CsIbLCl.exe
  2⤵
  PID:4796
- C:\Windows\System\dKmSXdX.exe
  C:\Windows\System\dKmSXdX.exe
  2⤵
  PID:12020
- C:\Windows\System\qAzYxvo.exe
  C:\Windows\System\qAzYxvo.exe
  2⤵
  PID:13072
- C:\Windows\System\zmpQuPV.exe
  C:\Windows\System\zmpQuPV.exe
  2⤵
  PID:11988
- C:\Windows\System\ESHyfmY.exe
  C:\Windows\System\ESHyfmY.exe
  2⤵
  PID:12084
- C:\Windows\System\lCwsiUX.exe
  C:\Windows\System\lCwsiUX.exe
  2⤵
  PID:12172
- C:\Windows\System\alnDIQR.exe
  C:\Windows\System\alnDIQR.exe
  2⤵
  PID:12568
- C:\Windows\System\ezzwGZb.exe
  C:\Windows\System\ezzwGZb.exe
  2⤵
  PID:716
- C:\Windows\System\SgzZJfE.exe
  C:\Windows\System\SgzZJfE.exe
  2⤵
  PID:7436
- C:\Windows\System\oFteyJp.exe
  C:\Windows\System\oFteyJp.exe
  2⤵
  PID:11568
- C:\Windows\System\uOjrGNX.exe
  C:\Windows\System\uOjrGNX.exe
  2⤵
  PID:13064
- C:\Windows\System\XsifmMP.exe
  C:\Windows\System\XsifmMP.exe
  2⤵
  PID:12488
- C:\Windows\System\WvMPTxs.exe
  C:\Windows\System\WvMPTxs.exe
  2⤵
  PID:9240
- C:\Windows\System\UxtGbOb.exe
  C:\Windows\System\UxtGbOb.exe
  2⤵
  PID:11052
- C:\Windows\System\NEUrYmp.exe
  C:\Windows\System\NEUrYmp.exe
  2⤵
  PID:8688
- C:\Windows\System\LWIONkK.exe
  C:\Windows\System\LWIONkK.exe
  2⤵
  PID:10044
- C:\Windows\System\CEIKAUU.exe
  C:\Windows\System\CEIKAUU.exe
  2⤵
  PID:3756
- C:\Windows\System\IEDwQXi.exe
  C:\Windows\System\IEDwQXi.exe
  2⤵
  PID:2204
- C:\Windows\System\hKwXmXm.exe
  C:\Windows\System\hKwXmXm.exe
  2⤵
  PID:10740
- C:\Windows\System\xXDooFq.exe
  C:\Windows\System\xXDooFq.exe
  2⤵
  PID:9856
- C:\Windows\System\GmqmwHF.exe
  C:\Windows\System\GmqmwHF.exe
  2⤵
  PID:12096
- C:\Windows\System\umlrVUC.exe
  C:\Windows\System\umlrVUC.exe
  2⤵
  PID:12284
- C:\Windows\System\AwHrZfR.exe
  C:\Windows\System\AwHrZfR.exe
  2⤵
  PID:9740
- C:\Windows\System\rMETFzw.exe
  C:\Windows\System\rMETFzw.exe
  2⤵
  PID:13096
- C:\Windows\System\fSbaRse.exe
  C:\Windows\System\fSbaRse.exe
  2⤵
  PID:12780
- C:\Windows\System\hxuMlzg.exe
  C:\Windows\System\hxuMlzg.exe
  2⤵
  PID:5288
- C:\Windows\System\ltAZxkl.exe
  C:\Windows\System\ltAZxkl.exe
  2⤵
  PID:12228
- C:\Windows\System\CpJJeBG.exe
  C:\Windows\System\CpJJeBG.exe
  2⤵
  PID:1832
- C:\Windows\System\ojgfrHb.exe
  C:\Windows\System\ojgfrHb.exe
  2⤵
  PID:13168
- C:\Windows\System\CjZDwRE.exe
  C:\Windows\System\CjZDwRE.exe
  2⤵
  PID:2052
- C:\Windows\System\aFbHNmh.exe
  C:\Windows\System\aFbHNmh.exe
  2⤵
  PID:4860
- C:\Windows\System\eczMNQp.exe
  C:\Windows\System\eczMNQp.exe
  2⤵
  PID:11588
- C:\Windows\System\LlkWCej.exe
  C:\Windows\System\LlkWCej.exe
  2⤵
  PID:13148
- C:\Windows\System\xzqUUxn.exe
  C:\Windows\System\xzqUUxn.exe
  2⤵
  PID:11436
- C:\Windows\System\KtvTZwm.exe
  C:\Windows\System\KtvTZwm.exe
  2⤵
  PID:13156
- C:\Windows\System\fOusjLR.exe
  C:\Windows\System\fOusjLR.exe
  2⤵
  PID:12716
- C:\Windows\System\FCrIpov.exe
  C:\Windows\System\FCrIpov.exe
  2⤵
  PID:8704
- C:\Windows\System\bnJrMxX.exe
  C:\Windows\System\bnJrMxX.exe
  2⤵
  PID:3604
- C:\Windows\System\bBLcrFa.exe
  C:\Windows\System\bBLcrFa.exe
  2⤵
  PID:13016
- C:\Windows\System\rnBeRqJ.exe
  C:\Windows\System\rnBeRqJ.exe
  2⤵
  PID:10804
- C:\Windows\System\pzfYXrK.exe
  C:\Windows\System\pzfYXrK.exe
  2⤵
  PID:4352
- C:\Windows\System\dnwbAPd.exe
  C:\Windows\System\dnwbAPd.exe
  2⤵
  PID:12000
- C:\Windows\System\BkZiwbe.exe
  C:\Windows\System\BkZiwbe.exe
  2⤵
  PID:12564
- C:\Windows\System\JNDnrGA.exe
  C:\Windows\System\JNDnrGA.exe
  2⤵
  PID:10760
- C:\Windows\System\WzddXuK.exe
  C:\Windows\System\WzddXuK.exe
  2⤵
  PID:12868
- C:\Windows\System\cgYPWKg.exe
  C:\Windows\System\cgYPWKg.exe
  2⤵
  PID:13272
- C:\Windows\System\MkFUCLz.exe
  C:\Windows\System\MkFUCLz.exe
  2⤵
  PID:13116
- C:\Windows\System\DxCBCwQ.exe
  C:\Windows\System\DxCBCwQ.exe
  2⤵
  PID:10180
- C:\Windows\System\fMLumLT.exe
  C:\Windows\System\fMLumLT.exe
  2⤵
  PID:12840
- C:\Windows\System\uutzute.exe
  C:\Windows\System\uutzute.exe
  2⤵
  PID:12644
- C:\Windows\System\BdjKapr.exe
  C:\Windows\System\BdjKapr.exe
  2⤵
  PID:10712
- C:\Windows\System\IVRoqdB.exe
  C:\Windows\System\IVRoqdB.exe
  2⤵
  PID:4684
- C:\Windows\System\dIBhxJN.exe
  C:\Windows\System\dIBhxJN.exe
  2⤵
  PID:11744
- C:\Windows\System\aNyjTpb.exe
  C:\Windows\System\aNyjTpb.exe
  2⤵
  PID:12788
- C:\Windows\System\bWIVtIe.exe
  C:\Windows\System\bWIVtIe.exe
  2⤵
  PID:10892
- C:\Windows\System\xPzokHP.exe
  C:\Windows\System\xPzokHP.exe
  2⤵
  PID:1156
- C:\Windows\System\GHUtgjp.exe
  C:\Windows\System\GHUtgjp.exe
  2⤵
  PID:2820
- C:\Windows\System\PSqjVtB.exe
  C:\Windows\System\PSqjVtB.exe
  2⤵
  PID:6960
- C:\Windows\System\TInBZzT.exe
  C:\Windows\System\TInBZzT.exe
  2⤵
  PID:12976
- C:\Windows\System\xjjcwgU.exe
  C:\Windows\System\xjjcwgU.exe
  2⤵
  PID:9152
- C:\Windows\System\ezGPnQk.exe
  C:\Windows\System\ezGPnQk.exe
  2⤵
  PID:6968
- C:\Windows\System\eizuxHQ.exe
  C:\Windows\System\eizuxHQ.exe
  2⤵
  PID:6940
- C:\Windows\System\ACkqWkp.exe
  C:\Windows\System\ACkqWkp.exe
  2⤵
  PID:12264
- C:\Windows\System\UMUNOVK.exe
  C:\Windows\System\UMUNOVK.exe
  2⤵
  PID:10120
- C:\Windows\System\XiOKrQh.exe
  C:\Windows\System\XiOKrQh.exe
  2⤵
  PID:13152
- C:\Windows\System\eYsqWMj.exe
  C:\Windows\System\eYsqWMj.exe
  2⤵
  PID:13368
- C:\Windows\System\HvfQHeV.exe
  C:\Windows\System\HvfQHeV.exe
  2⤵
  PID:13592
- C:\Windows\System\lMJYcuw.exe
  C:\Windows\System\lMJYcuw.exe
  2⤵
  PID:13704
- C:\Windows\System\qGgusFw.exe
  C:\Windows\System\qGgusFw.exe
  2⤵
  PID:13792
- C:\Windows\System\IXISqCP.exe
  C:\Windows\System\IXISqCP.exe
  2⤵
  PID:13868
- C:\Windows\System\ilAzPQR.exe
  C:\Windows\System\ilAzPQR.exe
  2⤵
  PID:13888
- C:\Windows\System\mbQncom.exe
  C:\Windows\System\mbQncom.exe
  2⤵
  PID:13916
- C:\Windows\System\RoFSerL.exe
  C:\Windows\System\RoFSerL.exe
  2⤵
  PID:13932
- C:\Windows\System\GlgHUAz.exe
  C:\Windows\System\GlgHUAz.exe
  2⤵
  PID:13956
- C:\Windows\System\ffCLvhv.exe
  C:\Windows\System\ffCLvhv.exe
  2⤵
  PID:13972
- C:\Windows\System\kNzBCll.exe
  C:\Windows\System\kNzBCll.exe
  2⤵
  PID:13992
- C:\Windows\System\kbRagBk.exe
  C:\Windows\System\kbRagBk.exe
  2⤵
  PID:14008
- C:\Windows\System\xjzYmxI.exe
  C:\Windows\System\xjzYmxI.exe
  2⤵
  PID:14152
- C:\Windows\System\vMzGJsw.exe
  C:\Windows\System\vMzGJsw.exe
  2⤵
  PID:14172
- C:\Windows\System\jJPgUFM.exe
  C:\Windows\System\jJPgUFM.exe
  2⤵
  PID:14324
- C:\Windows\System\TivSSsN.exe
  C:\Windows\System\TivSSsN.exe
  2⤵
  PID:13408
- C:\Windows\System\iPdwwHy.exe
  C:\Windows\System\iPdwwHy.exe
  2⤵
  PID:10428
- C:\Windows\System\QbtAAGu.exe
  C:\Windows\System\QbtAAGu.exe
  2⤵
  PID:13416
- C:\Windows\System\FYberLi.exe
  C:\Windows\System\FYberLi.exe
  2⤵
  PID:13448
- C:\Windows\System\cOVbgHV.exe
  C:\Windows\System\cOVbgHV.exe
  2⤵
  PID:13492
- C:\Windows\System\WesXZrA.exe
  C:\Windows\System\WesXZrA.exe
  2⤵
  PID:13528
- C:\Windows\System\gFFFldG.exe
  C:\Windows\System\gFFFldG.exe
  2⤵
  PID:13352
- C:\Windows\System\iPhLMMj.exe
  C:\Windows\System\iPhLMMj.exe
  2⤵
  PID:2812
- C:\Windows\System\VBDrCzh.exe
  C:\Windows\System\VBDrCzh.exe
  2⤵
  PID:13672
- C:\Windows\System\YtykngD.exe
  C:\Windows\System\YtykngD.exe
  2⤵
  PID:232
- C:\Windows\System\EtpeBzM.exe
  C:\Windows\System\EtpeBzM.exe
  2⤵
  PID:13640
- C:\Windows\System\fOgjRuU.exe
  C:\Windows\System\fOgjRuU.exe
  2⤵
  PID:13692
- C:\Windows\System\OWDDEFL.exe
  C:\Windows\System\OWDDEFL.exe
  2⤵
  PID:4472
- C:\Windows\System\qzPnhZF.exe
  C:\Windows\System\qzPnhZF.exe
  2⤵
  PID:3420
- C:\Windows\System\SypwmVZ.exe
  C:\Windows\System\SypwmVZ.exe
  2⤵
  PID:13712
- C:\Windows\System\zXcHJCq.exe
  C:\Windows\System\zXcHJCq.exe
  2⤵
  PID:13652
- C:\Windows\System\prDdhfI.exe
  C:\Windows\System\prDdhfI.exe
  2⤵
  PID:13700
- C:\Windows\System\AZvuTRt.exe
  C:\Windows\System\AZvuTRt.exe
  2⤵
  PID:13884
- C:\Windows\System\tEncajn.exe
  C:\Windows\System\tEncajn.exe
  2⤵
  PID:13928
- C:\Windows\System\BsfkuAB.exe
  C:\Windows\System\BsfkuAB.exe
  2⤵
  PID:14036
- C:\Windows\System\VhernlZ.exe
  C:\Windows\System\VhernlZ.exe
  2⤵
  PID:14056
- C:\Windows\System\LPQDXrk.exe
  C:\Windows\System\LPQDXrk.exe
  2⤵
  PID:14096
- C:\Windows\System\eyGIckB.exe
  C:\Windows\System\eyGIckB.exe
  2⤵
  PID:14148
- C:\Windows\System\PWbzNNX.exe
  C:\Windows\System\PWbzNNX.exe
  2⤵
  PID:14180
- C:\Windows\System\NGZZyoW.exe
  C:\Windows\System\NGZZyoW.exe
  2⤵
  PID:14228
- C:\Windows\System\GEnrbbv.exe
  C:\Windows\System\GEnrbbv.exe
  2⤵
  PID:14240
- C:\Windows\System\zrVejcG.exe
  C:\Windows\System\zrVejcG.exe
  2⤵
  PID:14264
- C:\Windows\System\oKlcJUf.exe
  C:\Windows\System\oKlcJUf.exe
  2⤵
  PID:14232
- C:\Windows\System\zquNVLM.exe
  C:\Windows\System\zquNVLM.exe
  2⤵
  PID:10852
- C:\Windows\System\yQYPmyr.exe
  C:\Windows\System\yQYPmyr.exe
  2⤵
  PID:13436
- C:\Windows\System\tOWEYVk.exe
  C:\Windows\System\tOWEYVk.exe
  2⤵
  PID:6944
- C:\Windows\System\cMzPWOp.exe
  C:\Windows\System\cMzPWOp.exe
  2⤵
  PID:2716
- C:\Windows\System\JcMwljm.exe
  C:\Windows\System\JcMwljm.exe
  2⤵
  PID:2768
- C:\Windows\System\hFphgVl.exe
  C:\Windows\System\hFphgVl.exe
  2⤵
  PID:13452
- C:\Windows\System\IIuALeu.exe
  C:\Windows\System\IIuALeu.exe
  2⤵
  PID:13484
- C:\Windows\System\UAHvvfc.exe
  C:\Windows\System\UAHvvfc.exe
  2⤵
  PID:13548
- C:\Windows\System\OguBwnu.exe
  C:\Windows\System\OguBwnu.exe
  2⤵
  PID:3424
- C:\Windows\System\NDDKdLR.exe
  C:\Windows\System\NDDKdLR.exe
  2⤵
  PID:3396
- C:\Windows\System\anwTXqe.exe
  C:\Windows\System\anwTXqe.exe
  2⤵
  PID:5280
- C:\Windows\System\prpliQX.exe
  C:\Windows\System\prpliQX.exe
  2⤵
  PID:13600
- C:\Windows\System\wEUuCeJ.exe
  C:\Windows\System\wEUuCeJ.exe
  2⤵
  PID:3676
- C:\Windows\System\QmgCKUJ.exe
  C:\Windows\System\QmgCKUJ.exe
  2⤵
  PID:3920
- C:\Windows\System\xdQPPYK.exe
  C:\Windows\System\xdQPPYK.exe
  2⤵
  PID:13680
- C:\Windows\System\gnTmBys.exe
  C:\Windows\System\gnTmBys.exe
  2⤵
  PID:13696
- C:\Windows\System\EnLOAoC.exe
  C:\Windows\System\EnLOAoC.exe
  2⤵
  PID:13828
- C:\Windows\System\cvvEnld.exe
  C:\Windows\System\cvvEnld.exe
  2⤵
  PID:2936
- C:\Windows\System\dOEenuM.exe
  C:\Windows\System\dOEenuM.exe
  2⤵
  PID:14104
- C:\Windows\System\ChQlyDf.exe
  C:\Windows\System\ChQlyDf.exe
  2⤵
  PID:14188
- C:\Windows\System\fSYVjVu.exe
  C:\Windows\System\fSYVjVu.exe
  2⤵
  PID:14236
- C:\Windows\System\dfrLilP.exe
  C:\Windows\System\dfrLilP.exe
  2⤵
  PID:14284
- C:\Windows\System\FOnapDC.exe
  C:\Windows\System\FOnapDC.exe
  2⤵
  PID:1920
- C:\Windows\System\iZSVQFn.exe
  C:\Windows\System\iZSVQFn.exe
  2⤵
  PID:1476
- C:\Windows\System\fxHFWqN.exe
  C:\Windows\System\fxHFWqN.exe
  2⤵
  PID:3048
- C:\Windows\System\WtkEGsT.exe
  C:\Windows\System\WtkEGsT.exe
  2⤵
  PID:4544
- C:\Windows\System\mbqviiU.exe
  C:\Windows\System\mbqviiU.exe
  2⤵
  PID:13360
- C:\Windows\System\FHFbHnY.exe
  C:\Windows\System\FHFbHnY.exe
  2⤵
  PID:3328
- C:\Windows\System\DGTQJEP.exe
  C:\Windows\System\DGTQJEP.exe
  2⤵
  PID:4312
- C:\Windows\System\jxNYsdd.exe
  C:\Windows\System\jxNYsdd.exe
  2⤵
  PID:13724
- C:\Windows\System\HEpmiMr.exe
  C:\Windows\System\HEpmiMr.exe
  2⤵
  PID:13536
- C:\Windows\System\fujkzzD.exe
  C:\Windows\System\fujkzzD.exe
  2⤵
  PID:13300
- C:\Windows\System\JxsIwOK.exe
  C:\Windows\System\JxsIwOK.exe
  2⤵
  PID:13800
- C:\Windows\System\kMsOuCe.exe
  C:\Windows\System\kMsOuCe.exe
  2⤵
  PID:13820
- C:\Windows\System\GdNeHUB.exe
  C:\Windows\System\GdNeHUB.exe
  2⤵
  PID:4868
- C:\Windows\System\jsPqIzY.exe
  C:\Windows\System\jsPqIzY.exe
  2⤵
  PID:13980
- C:\Windows\System\XCpjJTC.exe
  C:\Windows\System\XCpjJTC.exe
  2⤵
  PID:1616
- C:\Windows\System\PouWxHF.exe
  C:\Windows\System\PouWxHF.exe
  2⤵
  PID:14080
- C:\Windows\System\QaCfYdx.exe
  C:\Windows\System\QaCfYdx.exe
  2⤵
  PID:1276
- C:\Windows\System\owFRlsX.exe
  C:\Windows\System\owFRlsX.exe
  2⤵
  PID:2396
- C:\Windows\System\UebLCbt.exe
  C:\Windows\System\UebLCbt.exe
  2⤵
  PID:4888
- C:\Windows\System\rXkGobI.exe
  C:\Windows\System\rXkGobI.exe
  2⤵
  PID:1804
- C:\Windows\System\OJMzEwh.exe
  C:\Windows\System\OJMzEwh.exe
  2⤵
  PID:5400
- C:\Windows\System\IlQhXSO.exe
  C:\Windows\System\IlQhXSO.exe
  2⤵
  PID:5536
- C:\Windows\System\SpPSleW.exe
  C:\Windows\System\SpPSleW.exe
  2⤵
  PID:5740
- C:\Windows\System\bMsOhjE.exe
  C:\Windows\System\bMsOhjE.exe
  2⤵
  PID:14280
- C:\Windows\System\xuGfjSJ.exe
  C:\Windows\System\xuGfjSJ.exe
  2⤵
  PID:5860
- C:\Windows\System\gIxadAM.exe
  C:\Windows\System\gIxadAM.exe
  2⤵
  PID:14116
- C:\Windows\System\SHEVaiV.exe
  C:\Windows\System\SHEVaiV.exe
  2⤵
  PID:10944
- C:\Windows\System\vpbOluo.exe
  C:\Windows\System\vpbOluo.exe
  2⤵
  PID:1388
- C:\Windows\System\mBcUNbc.exe
  C:\Windows\System\mBcUNbc.exe
  2⤵
  PID:13328
- C:\Windows\System\uYPhblY.exe
  C:\Windows\System\uYPhblY.exe
  2⤵
  PID:456
- C:\Windows\System\OOFBbUB.exe
  C:\Windows\System\OOFBbUB.exe
  2⤵
  PID:5768
- C:\Windows\System\UPAuBLO.exe
  C:\Windows\System\UPAuBLO.exe
  2⤵
  PID:13732
- C:\Windows\System\ikaBMlM.exe
  C:\Windows\System\ikaBMlM.exe
  2⤵
  PID:11184
- C:\Windows\System\etVtvGL.exe
  C:\Windows\System\etVtvGL.exe
  2⤵
  PID:13388
- C:\Windows\System\ilhXZum.exe
  C:\Windows\System\ilhXZum.exe
  2⤵
  PID:13616
- C:\Windows\System\HYdgMFJ.exe
  C:\Windows\System\HYdgMFJ.exe
  2⤵
  PID:10520
- C:\Windows\System\OwUZwut.exe
  C:\Windows\System\OwUZwut.exe
  2⤵
  PID:6068
- C:\Windows\System\pQLXrnP.exe
  C:\Windows\System\pQLXrnP.exe
  2⤵
  PID:3792
- C:\Windows\System\ygiTByj.exe
  C:\Windows\System\ygiTByj.exe
  2⤵
  PID:13464
- C:\Windows\System\JWOfCPY.exe
  C:\Windows\System\JWOfCPY.exe
  2⤵
  PID:3572
- C:\Windows\System\edKrosb.exe
  C:\Windows\System\edKrosb.exe
  2⤵
  PID:3060
- C:\Windows\System\MiretsC.exe
  C:\Windows\System\MiretsC.exe
  2⤵
  PID:13316
- C:\Windows\System\iXLPRJA.exe
  C:\Windows\System\iXLPRJA.exe
  2⤵
  PID:2172
- C:\Windows\System\OSXMSoW.exe
  C:\Windows\System\OSXMSoW.exe
  2⤵
  PID:5128
- C:\Windows\System\gsXWZGT.exe
  C:\Windows\System\gsXWZGT.exe
  2⤵
  PID:4112
- C:\Windows\System\iZYwqgf.exe
  C:\Windows\System\iZYwqgf.exe
  2⤵
  PID:10580
- C:\Windows\System\rjjWYNn.exe
  C:\Windows\System\rjjWYNn.exe
  2⤵
  PID:5500
- C:\Windows\System\ikDpMat.exe
  C:\Windows\System\ikDpMat.exe
  2⤵
  PID:6804
- C:\Windows\System\fXuRzTJ.exe
  C:\Windows\System\fXuRzTJ.exe
  2⤵
  PID:4928
- C:\Windows\System\aIgQISb.exe
  C:\Windows\System\aIgQISb.exe
  2⤵
  PID:6632
- C:\Windows\System\XXcFYku.exe
  C:\Windows\System\XXcFYku.exe
  2⤵
  PID:14252
- C:\Windows\System\qvJvrAM.exe
  C:\Windows\System\qvJvrAM.exe
  2⤵
  PID:6292
- C:\Windows\System\TDskuOH.exe
  C:\Windows\System\TDskuOH.exe
  2⤵
  PID:6440
- C:\Windows\System\PDLlhjj.exe
  C:\Windows\System\PDLlhjj.exe
  2⤵
  PID:6512
- C:\Windows\System\EZGxrOO.exe
  C:\Windows\System\EZGxrOO.exe
  2⤵
  PID:5364
- C:\Windows\System\ZCzedyq.exe
  C:\Windows\System\ZCzedyq.exe
  2⤵
  PID:4812
- C:\Windows\System\EWindeQ.exe
  C:\Windows\System\EWindeQ.exe
  2⤵
  PID:3516
- C:\Windows\System\ZLWytCr.exe
  C:\Windows\System\ZLWytCr.exe
  2⤵
  PID:6920
- C:\Windows\System\EcOnOCS.exe
  C:\Windows\System\EcOnOCS.exe
  2⤵
  PID:14004
- C:\Windows\System\fLZOaFs.exe
  C:\Windows\System\fLZOaFs.exe
  2⤵
  PID:2876
- C:\Windows\System\wTQYeNr.exe
  C:\Windows\System\wTQYeNr.exe
  2⤵
  PID:13380
- C:\Windows\System\jWpTQWX.exe
  C:\Windows\System\jWpTQWX.exe
  2⤵
  PID:5516
- C:\Windows\System\eXyVCkh.exe
  C:\Windows\System\eXyVCkh.exe
  2⤵
  PID:1712
- C:\Windows\System\tLnrFBT.exe
  C:\Windows\System\tLnrFBT.exe
  2⤵
  PID:14192
- C:\Windows\System\WZpHHxL.exe
  C:\Windows\System\WZpHHxL.exe
  2⤵
  PID:10876
- C:\Windows\System\rifstlj.exe
  C:\Windows\System\rifstlj.exe
  2⤵
  PID:7100
- C:\Windows\System\OATUBgg.exe
  C:\Windows\System\OATUBgg.exe
  2⤵
  PID:6300
- C:\Windows\System\wiXbRcS.exe
  C:\Windows\System\wiXbRcS.exe
  2⤵
  PID:6712
- C:\Windows\System\IzYshru.exe
  C:\Windows\System\IzYshru.exe
  2⤵
  PID:6980
- C:\Windows\System\pUmjYWD.exe
  C:\Windows\System\pUmjYWD.exe
  2⤵
  PID:6564
- C:\Windows\System\iLIoySt.exe
  C:\Windows\System\iLIoySt.exe
  2⤵
  PID:1888
- C:\Windows\System\zEldHfh.exe
  C:\Windows\System\zEldHfh.exe
  2⤵
  PID:7080
- C:\Windows\System\aekPjDi.exe
  C:\Windows\System\aekPjDi.exe
  2⤵
  PID:1880
- C:\Windows\System\KbXoQSM.exe
  C:\Windows\System\KbXoQSM.exe
  2⤵
  PID:7128
- C:\Windows\System\SkOJHYS.exe
  C:\Windows\System\SkOJHYS.exe
  2⤵
  PID:5944
- C:\Windows\System\PhAwCyr.exe
  C:\Windows\System\PhAwCyr.exe
  2⤵
  PID:6936
- C:\Windows\System\mOuKbWp.exe
  C:\Windows\System\mOuKbWp.exe
  2⤵
  PID:7020
- C:\Windows\System\rnSeMku.exe
  C:\Windows\System\rnSeMku.exe
  2⤵
  PID:7068
- C:\Windows\System\vfDeIPS.exe
  C:\Windows\System\vfDeIPS.exe
  2⤵
  PID:3208
- C:\Windows\System\DhggEyV.exe
  C:\Windows\System\DhggEyV.exe
  2⤵
  PID:7076
- C:\Windows\System\YSgbLQG.exe
  C:\Windows\System\YSgbLQG.exe
  2⤵
  PID:6988
- C:\Windows\System\qKWlwwO.exe
  C:\Windows\System\qKWlwwO.exe
  2⤵
  PID:7096
- C:\Windows\System\EWhwiem.exe
  C:\Windows\System\EWhwiem.exe
  2⤵
  PID:11412
- C:\Windows\System\eQeOLqe.exe
  C:\Windows\System\eQeOLqe.exe
  2⤵
  PID:3412
- C:\Windows\System\nRfAvIl.exe
  C:\Windows\System\nRfAvIl.exe
  2⤵
  PID:1496
- C:\Windows\System\SDuLknv.exe
  C:\Windows\System\SDuLknv.exe
  2⤵
  PID:14360
- C:\Windows\System\mBUJTae.exe
  C:\Windows\System\mBUJTae.exe
  2⤵
  PID:14392
- C:\Windows\System\hXzgBRO.exe
  C:\Windows\System\hXzgBRO.exe
  2⤵
  PID:14416
- C:\Windows\System\pSETmsT.exe
  C:\Windows\System\pSETmsT.exe
  2⤵
  PID:14440
- C:\Windows\System\jJByVNy.exe
  C:\Windows\System\jJByVNy.exe
  2⤵
  PID:14464
- C:\Windows\System\enFZzjI.exe
  C:\Windows\System\enFZzjI.exe
  2⤵
  PID:14488
- C:\Windows\System\ZVFUiiE.exe
  C:\Windows\System\ZVFUiiE.exe
  2⤵
  PID:14592
- C:\Windows\System\oUIZrlB.exe
  C:\Windows\System\oUIZrlB.exe
  2⤵
  PID:14616
- C:\Windows\System\FQIRMED.exe
  C:\Windows\System\FQIRMED.exe
  2⤵
  PID:14648
- C:\Windows\System\qoAPcsY.exe
  C:\Windows\System\qoAPcsY.exe
  2⤵
  PID:14672
- C:\Windows\System\kRHrBpV.exe
  C:\Windows\System\kRHrBpV.exe
  2⤵
  PID:14696
- C:\Windows\System\KraTFRZ.exe
  C:\Windows\System\KraTFRZ.exe
  2⤵
  PID:14732
- C:\Windows\System\ZelqPZs.exe
  C:\Windows\System\ZelqPZs.exe
  2⤵
  PID:14760
- C:\Windows\System\JdspCzU.exe
  C:\Windows\System\JdspCzU.exe
  2⤵
  PID:14952
- C:\Windows\System\PQfcqWK.exe
  C:\Windows\System\PQfcqWK.exe
  2⤵
  PID:14988
- C:\Windows\System\aPUlcku.exe
  C:\Windows\System\aPUlcku.exe
  2⤵
  PID:15052
- C:\Windows\System\UjAgulu.exe
  C:\Windows\System\UjAgulu.exe
  2⤵
  PID:15076
- C:\Windows\System\kNVaXZf.exe
  C:\Windows\System\kNVaXZf.exe
  2⤵
  PID:15100
- C:\Windows\System\LlusXPZ.exe
  C:\Windows\System\LlusXPZ.exe
  2⤵
  PID:15140
- C:\Windows\System\SeZttYB.exe
  C:\Windows\System\SeZttYB.exe
  2⤵
  PID:15172
- C:\Windows\System\oXGgYWx.exe
  C:\Windows\System\oXGgYWx.exe
  2⤵
  PID:15196
- C:\Windows\System\PFRFfAq.exe
  C:\Windows\System\PFRFfAq.exe
  2⤵
  PID:15216
- C:\Windows\System\PblLjjx.exe
  C:\Windows\System\PblLjjx.exe
  2⤵
  PID:15232
- C:\Windows\System\AqUzgGH.exe
  C:\Windows\System\AqUzgGH.exe
  2⤵
  PID:15256
- C:\Windows\System\swMXVZX.exe
  C:\Windows\System\swMXVZX.exe
  2⤵
  PID:3496
- C:\Windows\System\nYowOQQ.exe
  C:\Windows\System\nYowOQQ.exe
  2⤵
  PID:6084
- C:\Windows\System\ISKpILu.exe
  C:\Windows\System\ISKpILu.exe
  2⤵
  PID:448
- C:\Windows\System\VeaAMjU.exe
  C:\Windows\System\VeaAMjU.exe
  2⤵
  PID:6764
- C:\Windows\System\oLSTRMj.exe
  C:\Windows\System\oLSTRMj.exe
  2⤵
  PID:6720
- C:\Windows\System\hzoyRMb.exe
  C:\Windows\System\hzoyRMb.exe
  2⤵
  PID:1676
- C:\Windows\System\SWnuuAi.exe
  C:\Windows\System\SWnuuAi.exe
  2⤵
  PID:5460
- C:\Windows\System\zxghPyM.exe
  C:\Windows\System\zxghPyM.exe
  2⤵
  PID:14448
- C:\Windows\System\McLPmoy.exe
  C:\Windows\System\McLPmoy.exe
  2⤵
  PID:3888
- C:\Windows\System\QeDEFzm.exe
  C:\Windows\System\QeDEFzm.exe
  2⤵
  PID:14480
- C:\Windows\System\krQcuNE.exe
  C:\Windows\System\krQcuNE.exe
  2⤵
  PID:7180
- C:\Windows\System\npxrvUm.exe
  C:\Windows\System\npxrvUm.exe
  2⤵
  PID:7204
- C:\Windows\System\rxhFYGE.exe
  C:\Windows\System\rxhFYGE.exe
  2⤵
  PID:4872
- C:\Windows\System\xgCggMK.exe
  C:\Windows\System\xgCggMK.exe
  2⤵
  PID:14604
- C:\Windows\System\vTnnbQQ.exe
  C:\Windows\System\vTnnbQQ.exe
  2⤵
  PID:14668
- C:\Windows\System\cHDeQEG.exe
  C:\Windows\System\cHDeQEG.exe
  2⤵
  PID:14740
- C:\Windows\System\yvVylMy.exe
  C:\Windows\System\yvVylMy.exe
  2⤵
  PID:14584
- C:\Windows\System\HlkgkDd.exe
  C:\Windows\System\HlkgkDd.exe
  2⤵
  PID:14848
- C:\Windows\System\IesRPsU.exe
  C:\Windows\System\IesRPsU.exe
  2⤵
  PID:6464
- C:\Windows\System\uaIsEyc.exe
  C:\Windows\System\uaIsEyc.exe
  2⤵
  PID:14540
- C:\Windows\System\uIfpPAE.exe
  C:\Windows\System\uIfpPAE.exe
  2⤵
  PID:3612
- C:\Windows\System\eTGNhXN.exe
  C:\Windows\System\eTGNhXN.exe
  2⤵
  PID:14788
- C:\Windows\System\kefeYML.exe
  C:\Windows\System\kefeYML.exe
  2⤵
  PID:4152
- C:\Windows\System\vmNnPIH.exe
  C:\Windows\System\vmNnPIH.exe
  2⤵
  PID:7108
- C:\Windows\System\jTDelLI.exe
  C:\Windows\System\jTDelLI.exe
  2⤵
  PID:14820
- C:\Windows\System\QROZxLK.exe
  C:\Windows\System\QROZxLK.exe
  2⤵
  PID:14856
- C:\Windows\System\pJYbHlJ.exe
  C:\Windows\System\pJYbHlJ.exe
  2⤵
  PID:15252
- C:\Windows\System\RDdlxLg.exe
  C:\Windows\System\RDdlxLg.exe
  2⤵
  PID:15280
- C:\Windows\System\JuzhdPF.exe
  C:\Windows\System\JuzhdPF.exe
  2⤵
  PID:5668
- C:\Windows\System\saPvubG.exe
  C:\Windows\System\saPvubG.exe
  2⤵
  PID:15156
- C:\Windows\System\KFhxMwq.exe
  C:\Windows\System\KFhxMwq.exe
  2⤵
  PID:15328
- C:\Windows\System\ugHUTUY.exe
  C:\Windows\System\ugHUTUY.exe
  2⤵
  PID:15212
- C:\Windows\System\DehYZbd.exe
  C:\Windows\System\DehYZbd.exe
  2⤵
  PID:5260
- C:\Windows\System\wRPrHRR.exe
  C:\Windows\System\wRPrHRR.exe
  2⤵
  PID:5240
- C:\Windows\System\jMkRRVr.exe
  C:\Windows\System\jMkRRVr.exe
  2⤵
  PID:3216
- C:\Windows\System\vNIOzVd.exe
  C:\Windows\System\vNIOzVd.exe
  2⤵
  PID:5532
- C:\Windows\System\fJlKomN.exe
  C:\Windows\System\fJlKomN.exe
  2⤵
  PID:6500
- C:\Windows\System\lCjjdxd.exe
  C:\Windows\System\lCjjdxd.exe
  2⤵
  PID:4456
- C:\Windows\System\wAXHPbo.exe
  C:\Windows\System\wAXHPbo.exe
  2⤵
  PID:7192
- C:\Windows\System\JxvKqAp.exe
  C:\Windows\System\JxvKqAp.exe
  2⤵
  PID:14972
- C:\Windows\System\JeyObOJ.exe
  C:\Windows\System\JeyObOJ.exe
  2⤵
  PID:11316
- C:\Windows\System\BEOeXFv.exe
  C:\Windows\System\BEOeXFv.exe
  2⤵
  PID:11912
- C:\Windows\System\fycQMOx.exe
  C:\Windows\System\fycQMOx.exe
  2⤵
  PID:6488
- C:\Windows\System\TogOqyn.exe
  C:\Windows\System\TogOqyn.exe
  2⤵
  PID:2384
- C:\Windows\System\egqCJEi.exe
  C:\Windows\System\egqCJEi.exe
  2⤵
  PID:15072
- C:\Windows\System\cOXJAlB.exe
  C:\Windows\System\cOXJAlB.exe
  2⤵
  PID:14536
- C:\Windows\System\scGvHjR.exe
  C:\Windows\System\scGvHjR.exe
  2⤵
  PID:14840
- C:\Windows\System\FUXKCnh.exe
  C:\Windows\System\FUXKCnh.exe
  2⤵
  PID:6612
- C:\Windows\System\hfSKKgf.exe
  C:\Windows\System\hfSKKgf.exe
  2⤵
  PID:15336
- C:\Windows\System\CBJpSHc.exe
  C:\Windows\System\CBJpSHc.exe
  2⤵
  PID:3320
- C:\Windows\System\ZnHoHUZ.exe
  C:\Windows\System\ZnHoHUZ.exe
  2⤵
  PID:7228
- C:\Windows\System\MAIbpUl.exe
  C:\Windows\System\MAIbpUl.exe
  2⤵
  PID:15132
- C:\Windows\System\PRYlAbH.exe
  C:\Windows\System\PRYlAbH.exe
  2⤵
  PID:14964
- C:\Windows\System\cnGiNsD.exe
  C:\Windows\System\cnGiNsD.exe
  2⤵
  PID:6012
- C:\Windows\System\DhQoWxB.exe
  C:\Windows\System\DhQoWxB.exe
  2⤵
  PID:15204
- C:\Windows\System\hsKXXpu.exe
  C:\Windows\System\hsKXXpu.exe
  2⤵
  PID:7788
- C:\Windows\System\DACqpEv.exe
  C:\Windows\System\DACqpEv.exe
  2⤵
  PID:7776
- C:\Windows\System\lUfLcsx.exe
  C:\Windows\System\lUfLcsx.exe
  2⤵
  PID:14376
- C:\Windows\System\poMeQhC.exe
  C:\Windows\System\poMeQhC.exe
  2⤵
  PID:5380
- C:\Windows\System\qTvhpvc.exe
  C:\Windows\System\qTvhpvc.exe
  2⤵
  PID:7268
- C:\Windows\System\xChAcFU.exe
  C:\Windows\System\xChAcFU.exe
  2⤵
  PID:7996
- C:\Windows\System\hTOfnjE.exe
  C:\Windows\System\hTOfnjE.exe
  2⤵
  PID:6532
- C:\Windows\System\rvwploT.exe
  C:\Windows\System\rvwploT.exe
  2⤵
  PID:6992
- C:\Windows\System\FQjsBxY.exe
  C:\Windows\System\FQjsBxY.exe
  2⤵
  PID:7796
- C:\Windows\System\GIaQOpr.exe
  C:\Windows\System\GIaQOpr.exe
  2⤵
  PID:14708
- C:\Windows\System\GMmEEPH.exe
  C:\Windows\System\GMmEEPH.exe
  2⤵
  PID:7648
- C:\Windows\System\dAChZVk.exe
  C:\Windows\System\dAChZVk.exe
  2⤵
  PID:11312
- C:\Windows\System\SZjwLkV.exe
  C:\Windows\System\SZjwLkV.exe
  2⤵
  PID:6800
- C:\Windows\System\PeaFQVm.exe
  C:\Windows\System\PeaFQVm.exe
  2⤵
  PID:7052
- C:\Windows\System\GLYTMym.exe
  C:\Windows\System\GLYTMym.exe
  2⤵
  PID:10216
- C:\Windows\System\oChCkjy.exe
  C:\Windows\System\oChCkjy.exe
  2⤵
  PID:15124
- C:\Windows\System\VCzPoUF.exe
  C:\Windows\System\VCzPoUF.exe
  2⤵
  PID:15112
- C:\Windows\System\Enawypx.exe
  C:\Windows\System\Enawypx.exe
  2⤵
  PID:14032
- C:\Windows\System\aqgTdEi.exe
  C:\Windows\System\aqgTdEi.exe
  2⤵
  PID:15320
- C:\Windows\System\UPWRrBb.exe
  C:\Windows\System\UPWRrBb.exe
  2⤵
  PID:7976
- C:\Windows\System\oNlfAhB.exe
  C:\Windows\System\oNlfAhB.exe
  2⤵
  PID:7116
- C:\Windows\System\uzvGtEv.exe
  C:\Windows\System\uzvGtEv.exe
  2⤵
  PID:14748
- C:\Windows\System\FZtnSYe.exe
  C:\Windows\System\FZtnSYe.exe
  2⤵
  PID:6736
- C:\Windows\System\zBdsMhS.exe
  C:\Windows\System\zBdsMhS.exe
  2⤵
  PID:14224
- C:\Windows\System\InXVddW.exe
  C:\Windows\System\InXVddW.exe
  2⤵
  PID:8108
- C:\Windows\System\BtJkCcB.exe
  C:\Windows\System\BtJkCcB.exe
  2⤵
  PID:5332
- C:\Windows\System\IuGApZU.exe
  C:\Windows\System\IuGApZU.exe
  2⤵
  PID:7748
- C:\Windows\System\iCimAoS.exe
  C:\Windows\System\iCimAoS.exe
  2⤵
  PID:6948
- C:\Windows\System\OuFgWer.exe
  C:\Windows\System\OuFgWer.exe
  2⤵
  PID:14644
- C:\Windows\System\qhvXRpM.exe
  C:\Windows\System\qhvXRpM.exe
  2⤵
  PID:14664
- C:\Windows\System\rLVfPsG.exe
  C:\Windows\System\rLVfPsG.exe
  2⤵
  PID:7472
- C:\Windows\System\QVsJZkq.exe
  C:\Windows\System\QVsJZkq.exe
  2⤵
  PID:7692
- C:\Windows\System\KJEiQSl.exe
  C:\Windows\System\KJEiQSl.exe
  2⤵
  PID:9028
- C:\Windows\System\oVnqeGy.exe
  C:\Windows\System\oVnqeGy.exe
  2⤵
  PID:14780
- C:\Windows\System\QEjkywh.exe
  C:\Windows\System\QEjkywh.exe
  2⤵
  PID:8464
- C:\Windows\System\vTdfEkD.exe
  C:\Windows\System\vTdfEkD.exe
  2⤵
  PID:2064
- C:\Windows\System\zRhGgTm.exe
  C:\Windows\System\zRhGgTm.exe
  2⤵
  PID:2212
- C:\Windows\System\MAhWOUi.exe
  C:\Windows\System\MAhWOUi.exe
  2⤵
  PID:9436
- C:\Windows\System\ZxYzjLY.exe
  C:\Windows\System\ZxYzjLY.exe
  2⤵
  PID:1544
- C:\Windows\System\bjbPVkQ.exe
  C:\Windows\System\bjbPVkQ.exe
  2⤵
  PID:7656
- C:\Windows\System\RNWvUTp.exe
  C:\Windows\System\RNWvUTp.exe
  2⤵
  PID:8068
- C:\Windows\System\jiqBsCs.exe
  C:\Windows\System\jiqBsCs.exe
  2⤵
  PID:8248
- C:\Windows\System\iifYiNj.exe
  C:\Windows\System\iifYiNj.exe
  2⤵
  PID:5976
- C:\Windows\System\gmIGUZN.exe
  C:\Windows\System\gmIGUZN.exe
  2⤵
  PID:8180
- C:\Windows\System\amuQyft.exe
  C:\Windows\System\amuQyft.exe
  2⤵
  PID:6076
- C:\Windows\System\WazYmLj.exe
  C:\Windows\System\WazYmLj.exe
  2⤵
  PID:8408
- C:\Windows\System\ZAOGPGc.exe
  C:\Windows\System\ZAOGPGc.exe
  2⤵
  PID:7864
- C:\Windows\System\HgTNMCl.exe
  C:\Windows\System\HgTNMCl.exe
  2⤵
  PID:8212
- C:\Windows\System\NLJwXPK.exe
  C:\Windows\System\NLJwXPK.exe
  2⤵
  PID:8572
- C:\Windows\System\WGSBHve.exe
  C:\Windows\System\WGSBHve.exe
  2⤵
  PID:8748
- C:\Windows\System\KTNNGnP.exe
  C:\Windows\System\KTNNGnP.exe
  2⤵
  PID:14912
- C:\Windows\System\nOCuMXc.exe
  C:\Windows\System\nOCuMXc.exe
  2⤵
  PID:8152
- C:\Windows\System\gVSBKwj.exe
  C:\Windows\System\gVSBKwj.exe
  2⤵
  PID:4848
- C:\Windows\System\SNxvYub.exe
  C:\Windows\System\SNxvYub.exe
  2⤵
  PID:9244
- C:\Windows\System\pQpGyRM.exe
  C:\Windows\System\pQpGyRM.exe
  2⤵
  PID:8944
- C:\Windows\System\NnsdabT.exe
  C:\Windows\System\NnsdabT.exe
  2⤵
  PID:9532
- C:\Windows\System\wuKDiDh.exe
  C:\Windows\System\wuKDiDh.exe
  2⤵
  PID:5376
- C:\Windows\System\qlHQiXJ.exe
  C:\Windows\System\qlHQiXJ.exe
  2⤵
  PID:11000
- C:\Windows\System\YnVSZTU.exe
  C:\Windows\System\YnVSZTU.exe
  2⤵
  PID:9636
- C:\Windows\System\jMjlkee.exe
  C:\Windows\System\jMjlkee.exe
  2⤵
  PID:10436
- C:\Windows\System\lVeWfkw.exe
  C:\Windows\System\lVeWfkw.exe
  2⤵
  PID:10828
- C:\Windows\System\IDjxdTx.exe
  C:\Windows\System\IDjxdTx.exe
  2⤵
  PID:10036
- C:\Windows\System\stVDYpH.exe
  C:\Windows\System\stVDYpH.exe
  2⤵
  PID:7508
- C:\Windows\System\qOfKDpS.exe
  C:\Windows\System\qOfKDpS.exe
  2⤵
  PID:9596
- C:\Windows\System\YvJQriu.exe
  C:\Windows\System\YvJQriu.exe
  2⤵
  PID:8856
- C:\Windows\System\YQpEefQ.exe
  C:\Windows\System\YQpEefQ.exe
  2⤵
  PID:5968
- C:\Windows\System\EvWcyRh.exe
  C:\Windows\System\EvWcyRh.exe
  2⤵
  PID:9960
- C:\Windows\System\PFAhpbz.exe
  C:\Windows\System\PFAhpbz.exe
  2⤵
  PID:9688
- C:\Windows\System\gmlVYVd.exe
  C:\Windows\System\gmlVYVd.exe
  2⤵
  PID:8800
- C:\Windows\System\ZqFkyTF.exe
  C:\Windows\System\ZqFkyTF.exe
  2⤵
  PID:8972
- C:\Windows\System\eJojnsa.exe
  C:\Windows\System\eJojnsa.exe
  2⤵
  PID:9276
- C:\Windows\System\MjWWtZK.exe
  C:\Windows\System\MjWWtZK.exe
  2⤵
  PID:9340
- C:\Windows\System\mOHvQDF.exe
  C:\Windows\System\mOHvQDF.exe
  2⤵
  PID:14068
- C:\Windows\System\miHSgYJ.exe
  C:\Windows\System\miHSgYJ.exe
  2⤵
  PID:10260
- C:\Windows\System\DJnZOCc.exe
  C:\Windows\System\DJnZOCc.exe
  2⤵
  PID:7300
- C:\Windows\System\JsjqdNw.exe
  C:\Windows\System\JsjqdNw.exe
  2⤵
  PID:11380
- C:\Windows\System\kdEkkeE.exe
  C:\Windows\System\kdEkkeE.exe
  2⤵
  PID:11476
- C:\Windows\System\swYLgAu.exe
  C:\Windows\System\swYLgAu.exe
  2⤵
  PID:11404
- C:\Windows\System\AHOeSTZ.exe
  C:\Windows\System\AHOeSTZ.exe
  2⤵
  PID:11280
- C:\Windows\System\mlTqZWX.exe
  C:\Windows\System\mlTqZWX.exe
  2⤵
  PID:11480
- C:\Windows\System\wpSpxwR.exe
  C:\Windows\System\wpSpxwR.exe
  2⤵
  PID:10448
- C:\Windows\System\EHbvefU.exe
  C:\Windows\System\EHbvefU.exe
  2⤵
  PID:11768
- C:\Windows\System\RyvmqFm.exe
  C:\Windows\System\RyvmqFm.exe
  2⤵
  PID:11208
- C:\Windows\System\gCoiEoH.exe
  C:\Windows\System\gCoiEoH.exe
  2⤵
  PID:8904
- C:\Windows\System\xdUfHNR.exe
  C:\Windows\System\xdUfHNR.exe
  2⤵
  PID:12064
- C:\Windows\System\ENsppTI.exe
  C:\Windows\System\ENsppTI.exe
  2⤵
  PID:8976
- C:\Windows\System\bFhAhQQ.exe
  C:\Windows\System\bFhAhQQ.exe
  2⤵
  PID:9568
- C:\Windows\System\bKPebSS.exe
  C:\Windows\System\bKPebSS.exe
  2⤵
  PID:15240
- C:\Windows\System\MxjdnRd.exe
  C:\Windows\System\MxjdnRd.exe
  2⤵
  PID:8136
- C:\Windows\System\rFrwKeZ.exe
  C:\Windows\System\rFrwKeZ.exe
  2⤵
  PID:8756
- C:\Windows\System\wRTicol.exe
  C:\Windows\System\wRTicol.exe
  2⤵
  PID:10768
- C:\Windows\System\BJHyUPb.exe
  C:\Windows\System\BJHyUPb.exe
  2⤵
  PID:8376
- C:\Windows\System\gJqBnWQ.exe
  C:\Windows\System\gJqBnWQ.exe
  2⤵
  PID:5552
- C:\Windows\System\DrqejuW.exe
  C:\Windows\System\DrqejuW.exe
  2⤵
  PID:8620
- C:\Windows\System\voLARDd.exe
  C:\Windows\System\voLARDd.exe
  2⤵
  PID:9120
- C:\Windows\System\OWacaLP.exe
  C:\Windows\System\OWacaLP.exe
  2⤵
  PID:5548
- C:\Windows\System\BCrNozG.exe
  C:\Windows\System\BCrNozG.exe
  2⤵
  PID:6696
- C:\Windows\System\ywckvAa.exe
  C:\Windows\System\ywckvAa.exe
  2⤵
  PID:11224
- C:\Windows\System\oqTILtm.exe
  C:\Windows\System\oqTILtm.exe
  2⤵
  PID:10976
- C:\Windows\System\XsXARCC.exe
  C:\Windows\System\XsXARCC.exe
  2⤵
  PID:11484
- C:\Windows\System\EiBmKQy.exe
  C:\Windows\System\EiBmKQy.exe
  2⤵
  PID:10792
- C:\Windows\System\gXvpnIW.exe
  C:\Windows\System\gXvpnIW.exe
  2⤵
  PID:8724
- C:\Windows\System\eMuCBBE.exe
  C:\Windows\System\eMuCBBE.exe
  2⤵
  PID:10496
- C:\Windows\System\FOaRCxU.exe
  C:\Windows\System\FOaRCxU.exe
  2⤵
  PID:4364
- C:\Windows\System\SmqywSy.exe
  C:\Windows\System\SmqywSy.exe
  2⤵
  PID:11624
- C:\Windows\System\GEnIEch.exe
  C:\Windows\System\GEnIEch.exe
  2⤵
  PID:6304
- C:\Windows\System\GMilWZV.exe
  C:\Windows\System\GMilWZV.exe
  2⤵
  PID:7972
- C:\Windows\System\NrFpkUS.exe
  C:\Windows\System\NrFpkUS.exe
  2⤵
  PID:7072
- C:\Windows\System\lrXUfPv.exe
  C:\Windows\System\lrXUfPv.exe
  2⤵
  PID:11700
- C:\Windows\System\IRrNcMH.exe
  C:\Windows\System\IRrNcMH.exe
  2⤵
  PID:8000
- C:\Windows\System\MptuDIk.exe
  C:\Windows\System\MptuDIk.exe
  2⤵
  PID:11296
- C:\Windows\System\jqbjvWn.exe
  C:\Windows\System\jqbjvWn.exe
  2⤵
  PID:3436
- C:\Windows\System\cuYuLPc.exe
  C:\Windows\System\cuYuLPc.exe
  2⤵
  PID:10284
- C:\Windows\System\GhxCxeU.exe
  C:\Windows\System\GhxCxeU.exe
  2⤵
  PID:10656
- C:\Windows\System\qDtxKez.exe
  C:\Windows\System\qDtxKez.exe
  2⤵
  PID:9984
- C:\Windows\System\aaUKjZu.exe
  C:\Windows\System\aaUKjZu.exe
  2⤵
  PID:9496
- C:\Windows\System\YeudcYV.exe
  C:\Windows\System\YeudcYV.exe
  2⤵
  PID:11032
- C:\Windows\System\uFCRQHC.exe
  C:\Windows\System\uFCRQHC.exe
  2⤵
  PID:7884
- C:\Windows\System\fEzuWmD.exe
  C:\Windows\System\fEzuWmD.exe
  2⤵
  PID:7680
- C:\Windows\System\tujhykd.exe
  C:\Windows\System\tujhykd.exe
  2⤵
  PID:12560
- C:\Windows\System\IRLGUrf.exe
  C:\Windows\System\IRLGUrf.exe
  2⤵
  PID:12272
- C:\Windows\System\ZAOzLba.exe
  C:\Windows\System\ZAOzLba.exe
  2⤵
  PID:9156
- C:\Windows\System\eWSwAxd.exe
  C:\Windows\System\eWSwAxd.exe
  2⤵
  PID:12104
- C:\Windows\System\VVfjpnJ.exe
  C:\Windows\System\VVfjpnJ.exe
  2⤵
  PID:10212
- C:\Windows\System\xIINzgC.exe
  C:\Windows\System\xIINzgC.exe
  2⤵
  PID:12844
- C:\Windows\System\RBENajn.exe
  C:\Windows\System\RBENajn.exe
  2⤵
  PID:10972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x3q5w5fp.ord.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AiSeRPs.exe

Filesize
1.9MB

MD5
46d7fdf0e19972177e69aa4b3dc4846d

SHA1
ab7a284b2683a09f07faa59a64dec475a3dcef45

SHA256
f0924e5996e206ba6dd8385a862124605f8667db82d2f3d42c6bad718f542c6d

SHA512
e106f2e109b50957279056b153312657b7bdeba9eb25f28c997ab90ca78011ebcceb1d8b5c60185deaffd6acd18139e8a2a04c50015ca1f2278d68741bd64e41

Download Submit
C:\Windows\System\BnJfInF.exe

Filesize
1.9MB

MD5
f9a056de15da21aa3647cede0b3f5e4a

SHA1
9339179ee1f7d3c6143e17272565d57c5f2eb162

SHA256
c925c7c60d357cac442ec0367652a7e237f488dd5fc3e3ee227b7fa290062167

SHA512
1884a4609f558fd4cb0e24e03ce627a77d50220e72b50e45d08be3c750a573cbd187e5489805ab4d9f9e4999752c271633e557d1664b397e1cb75b2829e3d601

Download Submit
C:\Windows\System\DRecQNe.exe

Filesize
1.9MB

MD5
0fb6cef8405c15a401bfbb436bbe63f8

SHA1
6166de57093275dc1845178b4eb52762d70f83b8

SHA256
ceb7fe8ffa47dcea83f32257345878124faefea5aee103f328d2e62b0e74d936

SHA512
ddd925eaf6f4c37290fdbc3fc0af2b52c60194b86c1efd90d4ad151693b316e4770e2564bab7e09e59243696001b5f115e03eae863f42c77694d3720b3ad1a07

Download Submit
C:\Windows\System\FGSeSzy.exe

Filesize
1.9MB

MD5
eb7c48bf3790aebf79254f88f00e26b8

SHA1
235819834e2a092fa09bbf595eadb5623d8ed564

SHA256
3d3dd135dfdffdddd9f0223d58c75478f7c5096c17ee608194aa15e70fc1d73a

SHA512
5c959d8126ba66036f0e1dd0a37e0570d86faf7b5e075c9f3db3689b32987a6b6d6c74f2908ada5ff8ad9a0ceaace02093e24fe0f9623b41342712ec9aab5953

Download Submit
C:\Windows\System\GqshlyU.exe

Filesize
1.9MB

MD5
035d7ef1cd7b04f0bb0ae7864ef425c9

SHA1
138c6229fa22e5bb28726fcb938aa2ae8836b743

SHA256
32ab833ef5b5588739e17dc578e788247cd99726971d944206b341aa137fb3c3

SHA512
54ba4e00a046d1ac27b221074c2ef5f3f16b4fb55abebd666b8417fdf0dba6bcbfb6f60d8f960eeaf84fe74e49dd631bf1503b4daa0d283a516be7fb4aa0d58e

Download Submit
C:\Windows\System\Lebzpld.exe

Filesize
1.9MB

MD5
9e125cb52001b23c6df067ba758858fe

SHA1
12c3d20cc44a16397dc8aff9444e074d3c700284

SHA256
dbb8b6c12986006bf9590ddb11511bf2a5dbdefd1279249856ef7bd88acaaa0c

SHA512
a7efa5c77a35305b538a154408491b63bddacf91f2bd184c47ef49a7650cffab2e02d0c9f1e04e2e9c9893b70ce05b0e2d208fa0f46c9d97086a09452c7b0ff0

Download Submit
C:\Windows\System\MUYdCKa.exe

Filesize
1.9MB

MD5
b2c1675602598b65a979d88f275a9622

SHA1
4d17154417fca1ae4579d2d5feca344cfdc91e5d

SHA256
67579a16504f1083f96dd5a7404c547fafd85e93b65b2547479a235bd310b3f7

SHA512
abcc9524ca378d5a6495119c4981f810c793b19ca56d4835b627db06a211218a44466afdd0d90e02af58f5b32e6440de2bc54fffff7ae168a0b36e52cf221f4e

Download Submit
C:\Windows\System\NbfqhCA.exe

Filesize
18B

MD5
b5af15b91ef901dbbad280bf2ec97d3f

SHA1
b8fc44effcf94c604b3a330099fdd05d70ca2290

SHA256
4b241b0358bbe69bc40fb7c8558ef0dacf7a7dd595b9974e7ee1287f6f6a57a6

SHA512
77e9e1cd7604d29efe33ea37dfc85035465c8eb4a6b1edf396f009c9427a6171460e7b24fac454a276653572360ea48634eb43a059b68dd9d91460bd58c1ddf1

Download Submit
C:\Windows\System\PrtcMUJ.exe

Filesize
1.9MB

MD5
cdabc557eb2797ae965ccda936bf528c

SHA1
9bfc37a6facbcf9784deee397dd296db665183a8

SHA256
7c1fd9a756ac8df3a272fa7a1d829d178c33dc97f26feff7677f8d0bc2e2fce8

SHA512
61141cb155d2b782966af69bd9a87f1351f28c3bc3c7666ce4537abd29390059e5424aa470615efa798c120085dc529895aedf59cdd30731a6332e4c65ba0833

Download Submit
C:\Windows\System\QDdXBpR.exe

Filesize
1.9MB

MD5
c59b8a554a9106f3e4a38ee17d7ddc48

SHA1
1f22a68afde268ad9fbbfa4a2f066b6371ff61b4

SHA256
b9cdf1c62c107eed0809922cb161eaa842f8aa6af9e0918651323c04e0e83bf6

SHA512
7969a2d70ad6cbd7e3fdc2a13b34c11d6df54ecb460ce3414d38cc34cf03f830d2281af9a9b71d8c90ff4fe1b7022b9100d2f92f867b9764c6d8821dd508aa16

Download Submit
C:\Windows\System\QhGGLER.exe

Filesize
1.9MB

MD5
f14e692a314ec00afc279808c2b7d1fa

SHA1
e2de2bdba5478fc78d39888d49c57486ac1413a3

SHA256
cffc27c07bb5e4f1dd96d8c40f1a14bf9de59bd7303d8b703798ef9365143aff

SHA512
deec74dceb7f114c184814957dbfe7202579a1fdf1373b7aaf26e329611bffc7eaaf0da807e19e142d0a1ae6361b2c85b0cb67a12b09f01d4c7e5e47df2653a1

Download Submit
C:\Windows\System\RaMOAWh.exe

Filesize
1.9MB

MD5
0a202f6a0c634d9609f63045f84425c0

SHA1
fb5c4b30b84f89b5449633fd6ef44febb403adfe

SHA256
4963b50c8d311a0141f67c3fdac8e415f0b84ee85384e96ccd952580d4673120

SHA512
69fa8f58244db330d29c66be445b18b9e170c42b183ffc406e799cb33a4985363f0b83ecbcf8ebc8d829a317fa744d0aa280b70190b0bd1e96924e0ff3ac4af1

Download Submit
C:\Windows\System\SONuKtE.exe

Filesize
1.9MB

MD5
2bc36adf4076ed294f156cddc7b6eb37

SHA1
b25bfe97537c55249614aa3baa183be111d6fa3a

SHA256
5e14caf69bde0d4a5e9df65373a0c5ade20b1d6e7a204cbaa88eadfb5c8fea3e

SHA512
d55733886dddfc54737e7a3753e556ab1249cb743c27175ae89e19c2817f81e14a35d0e91f2226ae0ef1cb74aa2671c3cdf253a767fec3a804a622849b31aac7

Download Submit
C:\Windows\System\SjuhvJz.exe

Filesize
1.9MB

MD5
590372668c0a5033fb3d5513bcfae3ff

SHA1
79775429e36ce4de8eb9a5fbefd7760fa14cd8a6

SHA256
ff03939e4ff1a9c705a84c63f980d45dad8f0c4a0cf21179b941418b2c8f343e

SHA512
da00f1f84d09fb9b869fdca93d409785196979a2b83fac29e7bce91202c0bce8ed7a5f829368da252495d928905cf5996e9843c8c0e93a68e18a3e44ac752f67

Download Submit
C:\Windows\System\UcPmHbY.exe

Filesize
1.9MB

MD5
854a413d36e65543e0270c86e6a2307f

SHA1
ecf9ea131c07760b185b3a71f707f132c7370a08

SHA256
056e993d7610734b4914bdd83d5869614fbd8b7b3f4a666d970687c42a527eff

SHA512
e8d4c737297d21537a83379457d56d8bc6a6caf8d1cc7c8a0df9b862f15655135110b97c15e95a33bd67c7b5bede71e3e79be786b8c3d477f951ce3627f8aede

Download Submit
C:\Windows\System\YgJZsqj.exe

Filesize
1.9MB

MD5
470b9ae7495a6627c71fd1212b3b11b6

SHA1
e57d19b104f3531386da0e74d7d0e085acf35083

SHA256
0378fc818247ba0545fb0d31f2d7b9daecdce8fd42986928184efc3a22632583

SHA512
bb8924584f4c04a6ca8103042aff2ca539ae5fd35803e40eeaa06d9a7fe5927b2f05b8def691617e58ef4d344d2cea1af310c5790518f5b8673b4a5c5465afbe

Download Submit
C:\Windows\System\YiBtckN.exe

Filesize
1.9MB

MD5
f4f5eb9165b059c7e694448d958ccab6

SHA1
db7aca779fb0a1f635a4c4b3e9e09e93fffb89bc

SHA256
935c460ce625c356f4cff1105eb3996bd510e778d527048d83651ddf0e6c0aa0

SHA512
229e586e4c99af459c9fb06f8b31c70158105faadfd9d6e55f92a24ac8d697439cc00dfbc4e8b41f12d3ee3f8848afc65113295be7481f5156b8b1f1db32ea18

Download Submit
C:\Windows\System\YupLbiG.exe

Filesize
1.9MB

MD5
67ea31c4d1425e49375c2eb39c14f8af

SHA1
42e7c2dff930ad6a68bb710ac108177f7ae78bbe

SHA256
e4bc3c682c5861242baebdc883b12151b8b8d2e896affc99edef69d18d1b8621

SHA512
95c8d8a2dd20f987c58efb5e2d0448a167992ac1cc3f8b2fb2c7a5b558976729e05a9e8caa58ffb0a05c06e9b2796a369baaedc8a55d4f0e8e20ec26f6dfbfa2

Download Submit
C:\Windows\System\ZADqFhU.exe

Filesize
1.9MB

MD5
e19e929399a6fb54e1507763f21441d6

SHA1
13e10e494fde413ab03c7dad6e1af811abec66e0

SHA256
843b1000adc676d95fe9cbb55ac12113f6d46e7fc8a8e978f6225cc327804a9a

SHA512
12c2bf31f6f671a60e0f0a02fa952ad8b8e805200839b93dc615bb769986b6c081fb184e9d0d3d366e6377d9e8422ba3f4e97ec2f601b750713621c058e54d9e

Download Submit
C:\Windows\System\ZbyedqP.exe

Filesize
1.9MB

MD5
ba312755d3068983ae76226b7223d4f6

SHA1
cdec8c6f9ad90f18f2175758b0638725f82a651b

SHA256
719a2ea88d76049c2737014f35e85e87b99eb8201a918d7a87c712cea1db4bdb

SHA512
12502762fe85bb85ceae7f1c886a3a6c9fa2cd1eb0a01a76163e4cc9e2cf750d06aac1b320164a830f3e9996c7a4c22595b488464fdddb3c1cf39fca0dd765ae

Download Submit
C:\Windows\System\aInYzJe.exe

Filesize
1.9MB

MD5
e1eb4f1655d3438362223b2803655370

SHA1
92b28e875ba6d777dfa665abeab74563f90a4baa

SHA256
0584071bea4947369e449b34d8bb1514d4270bfba0aade2406bd331569ff8eb4

SHA512
8869acf97e9214ebf684e8e22237701b0dc1f5d16e1ddf9bdce6bcf91747798ef6092c84560bbd6500f906c703662be8096a8c29bcbc560a4902781416a31857

Download Submit
C:\Windows\System\aSdiHlc.exe

Filesize
1.9MB

MD5
933a568cd6a850a78f88a0a809909c20

SHA1
4a4b214e2b756ba3d4383fa0b96830e6d31a5afe

SHA256
9acc640f0a7f44b51149ce18e839d1a30435750aa215830aff928cbab5934485

SHA512
723f42a004e8ee3833e2ff2cb2d598bb80419c0bac6f0ed6618633eb8849ebcf5402a5d4d5326b8ed12cac321bd7b76f7f81bc582d383de099663f0dec430a74

Download Submit
C:\Windows\System\aeQmjaW.exe

Filesize
1.9MB

MD5
de26191ab4d3745641fb132b7ef6cd70

SHA1
f4fcd48501777da27d0c344f5d7348451d2a7985

SHA256
5fd5324cd6e064b0c18d43ed6c6517d53fb8cc29f975749b54e9d309ac1d7aba

SHA512
e3f2c666a6697833a0300d03d77d068853502974b8d6da927bb2eeaa74f6daf6ab4344d1aaf1507350043f89155e8b73cd4d1846f773a789435a255924eb7829

Download Submit
C:\Windows\System\bVVvNNy.exe

Filesize
1.9MB

MD5
0a0fee2037c46e39a7515f8b1ae07772

SHA1
0dea5ce2b2f13e9cc5126d3df0e523a49a8b6997

SHA256
05004ae4d2ef5c8a6202a87e1d630b3ff4b87e92c314e63317b193b370975181

SHA512
2d38f92c1f50eb7b2f29211b0cbda25799d0787e171825fb8c876db07aa24bda5f1954332ee91b2620d71ab4aa387fd4f8fca4951c73127eb0de6deccff6691c

Download Submit
C:\Windows\System\cRwjvsv.exe

Filesize
1.9MB

MD5
365918981b998f510ad4d6c31bd6567f

SHA1
bbbc4c363ff3a9421713daf32f2db84b676417e8

SHA256
31aa5b0fa17251799c4a1ffdd395d02d49d1970e2fd4829c9c2c9b7e04f69d57

SHA512
862c1438862c8fc81a93119dc035b86e9e35db7cee3b9d391c5286fcae01066e101296f92f934d99ee5c2687957a0fc146d6334dcf3e548d63cf52e491d1c165

Download Submit
C:\Windows\System\deJVukG.exe

Filesize
1.9MB

MD5
765d0c44d93889ef6cbefcef13020751

SHA1
d1f661845efa5564a6ceb8cdc9a966447372d33c

SHA256
6f64a6272002dbb1965aa2879585ec89d86a9b1f4a0fd69da829acebfad8509b

SHA512
f89a9a401b8e38d861bd3dd2e9a5e285a0e5f72507d52398ae072d02f1b9110648755813b87fa87440c496659e864e8dcb873a56d6fcc6279f55f0f43f28fa12

Download Submit
C:\Windows\System\dxIKHWX.exe

Filesize
1.9MB

MD5
895b4415a17fc7c4a3a130041448ee1f

SHA1
eb32607719e8226cc883165f8e82aa4dc03634a9

SHA256
b1be258e4760d87854d84e1fd5a1e90101e645574f7d0684f58150d590b6e6f5

SHA512
3056333dbd7b3dd62693d4e545e7cf2fcc6bae0aa062914d2e23cabfa45f26500092623ae4a357a5bca5d85f7f16e1da0233262972b3b078c1438ee4d66bb636

Download Submit
C:\Windows\System\etXNBKG.exe

Filesize
1.9MB

MD5
125ad863f13b53271907c8e1622a359c

SHA1
7a2841e53e27a16c0e7f34e8382cffe9b3462a69

SHA256
9884c865f0d45317041653dff0a31f0e766935756622a7e7af2ffdd0258f2649

SHA512
c29eb47cd08cb88ab1c4c79b2d043cce2ede5515e2c8cf823a1d482ac83759ecda3346f65817898e2a126f2d23f7be31e4686aba801e2503b89108cc7ad6d395

Download Submit
C:\Windows\System\hTQJdOp.exe

Filesize
1.9MB

MD5
0e7a8ff86d734935779d720374e4f421

SHA1
8312a020c4b18209db6e5d6db0148fe3d92a3e7f

SHA256
90e1415703683103caf2c103eb20d0e70e54d92dc5ff6514c401b8b243c077c9

SHA512
d1cbc7321e80a1018631b3905258b9eba259b9f1eef8b4185453c27f5cf059e8b2d0399360d4d15ea984b56e5eb61f7a22500b9e087581936423ab0f08923e97

Download Submit
C:\Windows\System\jNGMVKz.exe

Filesize
1.9MB

MD5
4357db0082bd65ada44a9b7bbad18ab9

SHA1
8067fc692545103aec9bada10ab085df552fac40

SHA256
44288fe46e4d1f933bbab277583da3e2ef477ae469bff2de669222496c592cbf

SHA512
1594a659adadfcfe535c7d2329f5ecbe1ffc836f10dc2132e7a784fbd48c6ea3bf3791b82bd0d51a3d3c173fed3f29106101ebfc1def73fe50b82ade243fa819

Download Submit
C:\Windows\System\mCwihwN.exe

Filesize
1.9MB

MD5
d7f16bfb10d01b05764edcefe4dafce6

SHA1
9819a4e07e8b5963d93b24eef16c06b6520a708b

SHA256
7eec57a4074338f5c74b90819d663848cc8d2b0f9cf24c34f3a530505557ed49

SHA512
c25617b9853bf07ba795e075baa1f6c78ed97908c47d18b506702555a9f47aa9021f8d3fdc3e4c67b05df0a1e081fce49551e841315cb28bdf9e8af1f41ad5ed

Download Submit
C:\Windows\System\mqYVXSC.exe

Filesize
1.9MB

MD5
747ef2ae7d3f1e2ed4a50288b4c5dce7

SHA1
84ff385183a0e4f990389c84452c3aa43a21cb3a

SHA256
50c37991678d538e0c466bb63fdae57a9229132ba8c52f7bbbe9b13bf1d894b8

SHA512
87a4c9f7762fe5ea554fcf59c2c8390e6399641aa96714d9e1982703eb34d465e8fd9b6030525640545c817c21246fd7a25df76e6a890ea7fa321556548e6791

Download Submit
C:\Windows\System\orRJkgI.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\ouaNlDy.exe

Filesize
1.9MB

MD5
2ddf77c4c85655a6cad3f25d7539a287

SHA1
92eb5fb4eaef14ee94ab1722763b86065aa94535

SHA256
eb24c2b8efd2b6624dc970003a907a692f7079e36f5feed21373f9663d1f7a14

SHA512
b023323c6b9381c0218a9d57ea5340c83988bee26885552daecfc3641a6313c46b9d7f445d02330895cbf6e835432d98d22634fde04b1012423d1750f759101f

Download Submit
C:\Windows\System\qhAdKnz.exe

Filesize
1.9MB

MD5
d3b950261714005b4fb49cb043c00199

SHA1
25d80a893ae0a61915b38b2823a75524d15ba1d5

SHA256
c069dca3cb200d6811af3af768d4115ff458d21a34790707f8adac75453c7693

SHA512
d37a4152e81d8bc30ec0938b0784cde18dfe02572134859288cbde180f92b878ceb0afc4bc6c9b8b0d6771dff79b57897f29560765eff4a51d001321e25de907

Download Submit
C:\Windows\System\sckOknQ.exe

Filesize
1.9MB

MD5
082666c2e4c1947df7d42211453e423d

SHA1
ac165b600c11f4f6e82565104d715cfebfe59cea

SHA256
f102f600b79205baa2b092843a5cf5f133caa57d54eac0d28de20c6556d3e2db

SHA512
551a64a73fbfb107ef8fc4a1f9e1a589e0588e826882008a5587f7c7c8fbd8586986f2823e24de8bda079f139b8cbf27e03f11b71d1b52ddb6f985a2689777db

Download Submit
C:\Windows\System\tNwbgsS.exe

Filesize
1.9MB

MD5
045ffc23a11a2a7d379bd3732343f567

SHA1
d616279f43ad114087f47815614c47429f99f7e2

SHA256
e15949e79d26d3e18be8a2f8f7ff8420fd0d95c43c54fee7bb53a52e22de5fa8

SHA512
c1b224a204072863616904a57f188b6165c1291d7d0690794bc5e15c7263c4f626586f3fb59e7b744e39f58918559f140316194f4c5dfef6e7f70faef070da35

Download Submit
C:\Windows\System\wsmKxfr.exe

Filesize
1.9MB

MD5
56ec0ac066a617ca1362f1200a299ffd

SHA1
c773df4a8194f232c4e00ab5b583e41557cad6f0

SHA256
51e5f943aba0156f06efd3222f82995891754d819c685a05d46499e7fe4586b2

SHA512
a575f50c806d95dfc537ecf0a9b924f6fb16335a8de146a21694a9b1f870da7a5b06707647b0df39748dfb5d0021e8f7a6e15e2758ff787049cdac742234dc13

Download Submit
C:\Windows\System\xAcIVNx.exe

Filesize
1.9MB

MD5
4c378997ade7a7963488875fbe1128f9

SHA1
da21691e112fe1deac019fbebe6e8f819180aef1

SHA256
c86b0a026c23365e3d50a2c0e7955fd82a5682e2a4ed5124563766b07acb7116

SHA512
cd11cdfd4a75a28f3ab76cc6a7759255ff6f94033b2a1f79894b9a0381dc6d829abebbe9978683eb142be4e455673105b7e1a485c0fdae260820b114f18a1b7a

Download Submit
C:\Windows\System\yqunZJd.exe

Filesize
1.9MB

MD5
5ec18a74004fc6eb5be9ed98385f4ff2

SHA1
9a25a1da9c47e9602b8c3b547570585d288e0ca3

SHA256
713427c2b0c4b06826357f4797bb10cadac3119d92429a1c90fd0e28d6a01e24

SHA512
a06a8f8469f18a5fc702127109b56a1cfa3d1e7b12157c6b6daa4cc42bfa1e4814ae8369fe3656508da5f1c0b78c349a269099da284dabf87f013d48976683d5

Download Submit
memory/556-148-0x00007FF796FC0000-0x00007FF7973B2000-memory.dmp

Filesize
3.9MB

Download
memory/888-393-0x00007FF610FB0000-0x00007FF6113A2000-memory.dmp

Filesize
3.9MB

Download
memory/888-4875-0x00007FF610FB0000-0x00007FF6113A2000-memory.dmp

Filesize
3.9MB

Download
memory/1008-463-0x00007FF75D140000-0x00007FF75D532000-memory.dmp

Filesize
3.9MB

Download
memory/1292-4800-0x00007FF7DAC30000-0x00007FF7DB022000-memory.dmp

Filesize
3.9MB

Download
memory/1292-254-0x00007FF7DAC30000-0x00007FF7DB022000-memory.dmp

Filesize
3.9MB

Download
memory/1664-549-0x00007FF6DF260000-0x00007FF6DF652000-memory.dmp

Filesize
3.9MB

Download
memory/1664-4883-0x00007FF6DF260000-0x00007FF6DF652000-memory.dmp

Filesize
3.9MB

Download
memory/1672-547-0x00007FF73C060000-0x00007FF73C452000-memory.dmp

Filesize
3.9MB

Download
memory/1672-4873-0x00007FF73C060000-0x00007FF73C452000-memory.dmp

Filesize
3.9MB

Download
memory/1872-4796-0x00007FF64CF90000-0x00007FF64D382000-memory.dmp

Filesize
3.9MB

Download
memory/1872-223-0x00007FF64CF90000-0x00007FF64D382000-memory.dmp

Filesize
3.9MB

Download
memory/2016-542-0x00007FF7BF360000-0x00007FF7BF752000-memory.dmp

Filesize
3.9MB

Download
memory/2016-4854-0x00007FF7BF360000-0x00007FF7BF752000-memory.dmp

Filesize
3.9MB

Download
memory/2880-392-0x00007FF757600000-0x00007FF7579F2000-memory.dmp

Filesize
3.9MB

Download
memory/3024-4769-0x00007FF688280000-0x00007FF688672000-memory.dmp

Filesize
3.9MB

Download
memory/3024-551-0x00007FF688280000-0x00007FF688672000-memory.dmp

Filesize
3.9MB

Download
memory/3156-4804-0x00007FF6CC850000-0x00007FF6CCC42000-memory.dmp

Filesize
3.9MB

Download
memory/3156-224-0x00007FF6CC850000-0x00007FF6CCC42000-memory.dmp

Filesize
3.9MB

Download
memory/3212-4908-0x00007FF7022C0000-0x00007FF7026B2000-memory.dmp

Filesize
3.9MB

Download
memory/3212-550-0x00007FF7022C0000-0x00007FF7026B2000-memory.dmp

Filesize
3.9MB

Download
memory/3596-8-0x00007FF6B58B0000-0x00007FF6B5CA2000-memory.dmp

Filesize
3.9MB

Download
memory/3824-307-0x00007FF7E75E0000-0x00007FF7E79D2000-memory.dmp

Filesize
3.9MB

Download
memory/3824-4815-0x00007FF7E75E0000-0x00007FF7E79D2000-memory.dmp

Filesize
3.9MB

Download
memory/3864-548-0x00007FF630A70000-0x00007FF630E62000-memory.dmp

Filesize
3.9MB

Download
memory/3864-4899-0x00007FF630A70000-0x00007FF630E62000-memory.dmp

Filesize
3.9MB

Download
memory/4064-112-0x00007FF8960B0000-0x00007FF896B71000-memory.dmp

Filesize
10.8MB

Download
memory/4064-269-0x000002155B380000-0x000002155B3A2000-memory.dmp

Filesize
136KB

Download
memory/4064-141-0x000002155B1D0000-0x000002155B1E0000-memory.dmp

Filesize
64KB

Download
memory/4064-2126-0x00007FF8960B0000-0x00007FF896B71000-memory.dmp

Filesize
10.8MB

Download
memory/4212-28-0x00007FF642700000-0x00007FF642AF2000-memory.dmp

Filesize
3.9MB

Download
memory/4608-138-0x00007FF645C20000-0x00007FF646012000-memory.dmp

Filesize
3.9MB

Download
memory/4808-544-0x00007FF7A4280000-0x00007FF7A4672000-memory.dmp

Filesize
3.9MB

Download
memory/4808-4880-0x00007FF7A4280000-0x00007FF7A4672000-memory.dmp

Filesize
3.9MB

Download
memory/4912-331-0x00007FF695570000-0x00007FF695962000-memory.dmp

Filesize
3.9MB

Download
memory/4912-4850-0x00007FF695570000-0x00007FF695962000-memory.dmp

Filesize
3.9MB

Download
memory/4924-4878-0x00007FF715B70000-0x00007FF715F62000-memory.dmp

Filesize
3.9MB

Download
memory/4924-545-0x00007FF715B70000-0x00007FF715F62000-memory.dmp

Filesize
3.9MB

Download
memory/4956-0-0x00007FF7829B0000-0x00007FF782DA2000-memory.dmp

Filesize
3.9MB

Download
memory/4956-1-0x000001DA2F260000-0x000001DA2F270000-memory.dmp

Filesize
64KB

Download
memory/4992-4870-0x00007FF603140000-0x00007FF603532000-memory.dmp

Filesize
3.9MB

Download
memory/4992-546-0x00007FF603140000-0x00007FF603532000-memory.dmp

Filesize
3.9MB

Download