xmrig | 768b7ac660525387f9fae14ba715eb1034b18eeb2dee143fc6fc6efafdb303a1

Analysis

max time kernel
126s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
Size

1.8MB
MD5

0bc09363c41adb1590e8df9593db4521
SHA1

3b4ca4bfef3c91bec76f16d4767f3a43d92e7bbe
SHA256

768b7ac660525387f9fae14ba715eb1034b18eeb2dee143fc6fc6efafdb303a1
SHA512

3060d2d99c9e2e46144401b70b3f31bb0e66d055d2ce636cef7e053bc53605c9a0be91739b67f9526be651b915ece4f579a528afbb1bb8a48cef33b3e6e1777e
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl/k:NABZ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 39 IoCs

miner

resource	yara_rule
behavioral2/memory/5348-283-0x00007FF76E770000-0x00007FF76EB62000-memory.dmp	xmrig
behavioral2/memory/1508-224-0x00007FF6B4020000-0x00007FF6B4412000-memory.dmp	xmrig
behavioral2/memory/1868-221-0x00007FF6046B0000-0x00007FF604AA2000-memory.dmp	xmrig
behavioral2/memory/1000-167-0x00007FF602C80000-0x00007FF603072000-memory.dmp	xmrig
behavioral2/memory/4712-157-0x00007FF670550000-0x00007FF670942000-memory.dmp	xmrig
behavioral2/memory/6044-135-0x00007FF6FB7D0000-0x00007FF6FBBC2000-memory.dmp	xmrig
behavioral2/memory/3844-132-0x00007FF764830000-0x00007FF764C22000-memory.dmp	xmrig
behavioral2/memory/6056-342-0x00007FF638030000-0x00007FF638422000-memory.dmp	xmrig
behavioral2/memory/5616-412-0x00007FF630930000-0x00007FF630D22000-memory.dmp	xmrig
behavioral2/memory/648-409-0x00007FF6EAFC0000-0x00007FF6EB3B2000-memory.dmp	xmrig
behavioral2/memory/3668-480-0x00007FF78D630000-0x00007FF78DA22000-memory.dmp	xmrig
behavioral2/memory/5620-566-0x00007FF7D1E00000-0x00007FF7D21F2000-memory.dmp	xmrig
behavioral2/memory/3836-668-0x00007FF70C9B0000-0x00007FF70CDA2000-memory.dmp	xmrig
behavioral2/memory/4888-670-0x00007FF67EF30000-0x00007FF67F322000-memory.dmp	xmrig
behavioral2/memory/64-669-0x00007FF656070000-0x00007FF656462000-memory.dmp	xmrig
behavioral2/memory/1964-667-0x00007FF734460000-0x00007FF734852000-memory.dmp	xmrig
behavioral2/memory/672-666-0x00007FF760360000-0x00007FF760752000-memory.dmp	xmrig
behavioral2/memory/6080-665-0x00007FF660980000-0x00007FF660D72000-memory.dmp	xmrig
behavioral2/memory/3128-664-0x00007FF61D1F0000-0x00007FF61D5E2000-memory.dmp	xmrig
behavioral2/memory/3272-563-0x00007FF7F6200000-0x00007FF7F65F2000-memory.dmp	xmrig
behavioral2/memory/64-6151-0x00007FF656070000-0x00007FF656462000-memory.dmp	xmrig
behavioral2/memory/6044-6156-0x00007FF6FB7D0000-0x00007FF6FBBC2000-memory.dmp	xmrig
behavioral2/memory/3668-6159-0x00007FF78D630000-0x00007FF78DA22000-memory.dmp	xmrig
behavioral2/memory/4712-6163-0x00007FF670550000-0x00007FF670942000-memory.dmp	xmrig
behavioral2/memory/5348-6167-0x00007FF76E770000-0x00007FF76EB62000-memory.dmp	xmrig
behavioral2/memory/5620-6171-0x00007FF7D1E00000-0x00007FF7D21F2000-memory.dmp	xmrig
behavioral2/memory/3128-6173-0x00007FF61D1F0000-0x00007FF61D5E2000-memory.dmp	xmrig
behavioral2/memory/3836-6208-0x00007FF70C9B0000-0x00007FF70CDA2000-memory.dmp	xmrig
behavioral2/memory/1964-6202-0x00007FF734460000-0x00007FF734852000-memory.dmp	xmrig
behavioral2/memory/6080-6199-0x00007FF660980000-0x00007FF660D72000-memory.dmp	xmrig
behavioral2/memory/4888-6185-0x00007FF67EF30000-0x00007FF67F322000-memory.dmp	xmrig
behavioral2/memory/1868-6184-0x00007FF6046B0000-0x00007FF604AA2000-memory.dmp	xmrig
behavioral2/memory/1000-6180-0x00007FF602C80000-0x00007FF603072000-memory.dmp	xmrig
behavioral2/memory/648-6178-0x00007FF6EAFC0000-0x00007FF6EB3B2000-memory.dmp	xmrig
behavioral2/memory/5616-6175-0x00007FF630930000-0x00007FF630D22000-memory.dmp	xmrig
behavioral2/memory/1508-6190-0x00007FF6B4020000-0x00007FF6B4412000-memory.dmp	xmrig
behavioral2/memory/6056-6188-0x00007FF638030000-0x00007FF638422000-memory.dmp	xmrig
behavioral2/memory/3272-6224-0x00007FF7F6200000-0x00007FF7F65F2000-memory.dmp	xmrig
behavioral2/memory/672-6227-0x00007FF760360000-0x00007FF760752000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1528	CfYdNsv.exe
64	qdbaeQk.exe
3844	DoUsokW.exe
6044	ddJHKPj.exe
4712	QxQnGCF.exe
1000	BthvIsT.exe
1868	VYLTXQe.exe
1508	vXTzgqM.exe
5348	YhKMLnI.exe
6056	xmgCPwZ.exe
648	ZjyeLlO.exe
5616	szVYZPa.exe
3668	YsElUUb.exe
3272	nndxLEu.exe
5620	VzeqoUi.exe
3128	pkSWdYF.exe
4888	fcBRmDg.exe
6080	MwIqCsV.exe
672	ktBDuqG.exe
1964	IvAWQCL.exe
3836	BgDxofM.exe
4920	lzuIJBe.exe
3116	ENeQfDc.exe
5536	XOwySpq.exe
5152	DNmrBow.exe
1440	mlPKiNT.exe
4152	qMRxoLS.exe
4996	pNbVlBL.exe
3684	ndiopfD.exe
3388	snuzYMN.exe
3780	vNWkTrl.exe
5596	McZHxXC.exe
5060	RJmpzIc.exe
4792	fUSkvPt.exe
884	OyGJICn.exe
5068	DqmfWja.exe
4992	tJiLGqo.exe
6088	SLzUjBl.exe
3436	AiHnJPw.exe
5756	adBrFdc.exe
572	EtWhSAN.exe
3632	OkskCEW.exe
4020	xPkSznw.exe
5728	ZTISwDa.exe
3424	ZZLzhrn.exe
5748	jpDPsKI.exe
3812	ElnbXSu.exe
1656	PRTFWgz.exe
4976	Mtyvvby.exe
3960	JYKXOMp.exe
1880	EPHKdfF.exe
1684	FmsyfZI.exe
3900	SGaIkwN.exe
4004	iMWKHgZ.exe
2768	fhlNjDm.exe
4480	dyfTpiN.exe
1488	CWTLNwV.exe
1976	nAgpIFi.exe
5992	YXObfAV.exe
4100	wAOHuQA.exe
456	gGdJxFF.exe
3280	KCtvmBe.exe
1816	NpEltdj.exe
2616	LDccHrY.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3160-0-0x00007FF6110A0000-0x00007FF611492000-memory.dmp	upx
behavioral2/files/0x0007000000023288-5.dat	upx
behavioral2/files/0x000700000002342c-50.dat	upx
behavioral2/files/0x0007000000023433-78.dat	upx
behavioral2/files/0x000700000002343c-150.dat	upx
behavioral2/memory/5348-283-0x00007FF76E770000-0x00007FF76EB62000-memory.dmp	upx
behavioral2/memory/1508-224-0x00007FF6B4020000-0x00007FF6B4412000-memory.dmp	upx
behavioral2/memory/1868-221-0x00007FF6046B0000-0x00007FF604AA2000-memory.dmp	upx
behavioral2/files/0x0007000000023448-200.dat	upx
behavioral2/files/0x000700000002344a-194.dat	upx
behavioral2/files/0x0007000000023434-187.dat	upx
behavioral2/files/0x0007000000023444-182.dat	upx
behavioral2/files/0x000700000002343a-181.dat	upx
behavioral2/files/0x000700000002343f-170.dat	upx
behavioral2/memory/1000-167-0x00007FF602C80000-0x00007FF603072000-memory.dmp	upx
behavioral2/files/0x0007000000023436-159.dat	upx
behavioral2/memory/4712-157-0x00007FF670550000-0x00007FF670942000-memory.dmp	upx
behavioral2/files/0x0007000000023447-155.dat	upx
behavioral2/files/0x000700000002343d-152.dat	upx
behavioral2/files/0x000700000002343b-149.dat	upx
behavioral2/files/0x0007000000023446-148.dat	upx
behavioral2/files/0x0007000000023439-176.dat	upx
behavioral2/files/0x0007000000023443-145.dat	upx
behavioral2/files/0x0007000000023442-144.dat	upx
behavioral2/files/0x0007000000023441-143.dat	upx
behavioral2/files/0x0007000000023438-172.dat	upx
behavioral2/files/0x000700000002343e-141.dat	upx
behavioral2/files/0x0007000000023449-164.dat	upx
behavioral2/files/0x0007000000023431-137.dat	upx
behavioral2/memory/6044-135-0x00007FF6FB7D0000-0x00007FF6FBBC2000-memory.dmp	upx
behavioral2/files/0x0007000000023432-117.dat	upx
behavioral2/files/0x0007000000023445-147.dat	upx
behavioral2/files/0x000700000002342f-106.dat	upx
behavioral2/files/0x000700000002342b-101.dat	upx
behavioral2/files/0x0007000000023440-142.dat	upx
behavioral2/files/0x000700000002342e-97.dat	upx
behavioral2/files/0x0007000000023437-96.dat	upx
behavioral2/memory/3844-132-0x00007FF764830000-0x00007FF764C22000-memory.dmp	upx
behavioral2/files/0x0007000000023435-88.dat	upx
behavioral2/files/0x000700000002342a-73.dat	upx
behavioral2/files/0x0007000000023429-70.dat	upx
behavioral2/memory/6056-342-0x00007FF638030000-0x00007FF638422000-memory.dmp	upx
behavioral2/files/0x000700000002342d-64.dat	upx
behavioral2/memory/5616-412-0x00007FF630930000-0x00007FF630D22000-memory.dmp	upx
behavioral2/memory/648-409-0x00007FF6EAFC0000-0x00007FF6EB3B2000-memory.dmp	upx
behavioral2/memory/3668-480-0x00007FF78D630000-0x00007FF78DA22000-memory.dmp	upx
behavioral2/memory/5620-566-0x00007FF7D1E00000-0x00007FF7D21F2000-memory.dmp	upx
behavioral2/memory/3836-668-0x00007FF70C9B0000-0x00007FF70CDA2000-memory.dmp	upx
behavioral2/memory/4888-670-0x00007FF67EF30000-0x00007FF67F322000-memory.dmp	upx
behavioral2/memory/64-669-0x00007FF656070000-0x00007FF656462000-memory.dmp	upx
behavioral2/memory/1964-667-0x00007FF734460000-0x00007FF734852000-memory.dmp	upx
behavioral2/memory/672-666-0x00007FF760360000-0x00007FF760752000-memory.dmp	upx
behavioral2/memory/6080-665-0x00007FF660980000-0x00007FF660D72000-memory.dmp	upx
behavioral2/memory/3128-664-0x00007FF61D1F0000-0x00007FF61D5E2000-memory.dmp	upx
behavioral2/memory/3272-563-0x00007FF7F6200000-0x00007FF7F65F2000-memory.dmp	upx
behavioral2/files/0x0007000000023430-58.dat	upx
behavioral2/files/0x0007000000023427-57.dat	upx
behavioral2/files/0x0007000000023428-49.dat	upx
behavioral2/files/0x0008000000023425-43.dat	upx
behavioral2/files/0x0007000000023426-36.dat	upx
behavioral2/memory/1528-20-0x00007FF77F380000-0x00007FF77F772000-memory.dmp	upx
behavioral2/memory/64-6151-0x00007FF656070000-0x00007FF656462000-memory.dmp	upx
behavioral2/memory/6044-6156-0x00007FF6FB7D0000-0x00007FF6FBBC2000-memory.dmp	upx
behavioral2/memory/3668-6159-0x00007FF78D630000-0x00007FF78DA22000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TbyQQaD.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\oQmpyJE.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\ltBMXcg.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\wBmuMwY.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\TleMnZR.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\QdSKWje.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\gDKdhIU.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\LeAMpsq.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\NAMwajM.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\iNOECSy.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\HteqthF.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\JyJSbyz.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\mYSVITD.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\leitvZf.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\sjKrJjr.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\XDDlweI.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\SLyfnSh.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\KcjOiHx.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\rrJgiHw.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\XkXTylz.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\HoRlSfH.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\AJehtxK.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\RmygxZN.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\EayYdCL.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\fpPfVup.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\EbLBCXP.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\oBxTGVQ.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\gseKfNy.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\KAEtdXd.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\MXtNCdL.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\RuCUDSk.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\yhxZTuF.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\sXgMNvH.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\qydldOy.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\sUqckEi.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\lOHKMJh.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\hSmInkW.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\uMQxMwU.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\PzSpUTc.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\ssvbvkZ.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\JoKNecb.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\veZKTtv.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\eHIRjQQ.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\fKASHKC.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\EIiQGuh.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\QrotOmd.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\yviFqqs.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\aOVoLxc.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\CNxGAuo.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\gQNdCWa.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\IWRTKUP.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\iwQOJcZ.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\smdaFvi.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\CFeZpZs.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\wIJtiHp.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\LXzQmMj.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\auSouyb.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\CxgGHRg.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\AhmZALo.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\IqtCitJ.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\PBSSoLM.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\LlobijB.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\ndVbUfw.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
File created	C:\Windows\System\UpDHxbJ.exe	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5196	powershell.exe
Token: SeLockMemoryPrivilege	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3160 wrote to memory of 5196	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	82
PID 3160 wrote to memory of 5196	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	82
PID 3160 wrote to memory of 1528	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	83
PID 3160 wrote to memory of 1528	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	83
PID 3160 wrote to memory of 3844	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	84
PID 3160 wrote to memory of 3844	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	84
PID 3160 wrote to memory of 64	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	85
PID 3160 wrote to memory of 64	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	85
PID 3160 wrote to memory of 4712	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	86
PID 3160 wrote to memory of 4712	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	86
PID 3160 wrote to memory of 6044	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	87
PID 3160 wrote to memory of 6044	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	87
PID 3160 wrote to memory of 1000	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	88
PID 3160 wrote to memory of 1000	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	88
PID 3160 wrote to memory of 1868	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	89
PID 3160 wrote to memory of 1868	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	89
PID 3160 wrote to memory of 1508	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	90
PID 3160 wrote to memory of 1508	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	90
PID 3160 wrote to memory of 5616	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	91
PID 3160 wrote to memory of 5616	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	91
PID 3160 wrote to memory of 5348	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	92
PID 3160 wrote to memory of 5348	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	92
PID 3160 wrote to memory of 6056	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	93
PID 3160 wrote to memory of 6056	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	93
PID 3160 wrote to memory of 648	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	94
PID 3160 wrote to memory of 648	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	94
PID 3160 wrote to memory of 3668	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	95
PID 3160 wrote to memory of 3668	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	95
PID 3160 wrote to memory of 3272	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	96
PID 3160 wrote to memory of 3272	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	96
PID 3160 wrote to memory of 5620	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	97
PID 3160 wrote to memory of 5620	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	97
PID 3160 wrote to memory of 3128	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	98
PID 3160 wrote to memory of 3128	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	98
PID 3160 wrote to memory of 3116	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	99
PID 3160 wrote to memory of 3116	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	99
PID 3160 wrote to memory of 4888	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	100
PID 3160 wrote to memory of 4888	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	100
PID 3160 wrote to memory of 6080	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	101
PID 3160 wrote to memory of 6080	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	101
PID 3160 wrote to memory of 672	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	102
PID 3160 wrote to memory of 672	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	102
PID 3160 wrote to memory of 1964	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	103
PID 3160 wrote to memory of 1964	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	103
PID 3160 wrote to memory of 3836	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	104
PID 3160 wrote to memory of 3836	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	104
PID 3160 wrote to memory of 4920	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	105
PID 3160 wrote to memory of 4920	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	105
PID 3160 wrote to memory of 5060	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	106
PID 3160 wrote to memory of 5060	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	106
PID 3160 wrote to memory of 5536	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	107
PID 3160 wrote to memory of 5536	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	107
PID 3160 wrote to memory of 4792	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	108
PID 3160 wrote to memory of 4792	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	108
PID 3160 wrote to memory of 5152	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	109
PID 3160 wrote to memory of 5152	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	109
PID 3160 wrote to memory of 6088	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	110
PID 3160 wrote to memory of 6088	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	110
PID 3160 wrote to memory of 1440	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	111
PID 3160 wrote to memory of 1440	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	111
PID 3160 wrote to memory of 4152	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	112
PID 3160 wrote to memory of 4152	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	112
PID 3160 wrote to memory of 4996	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	113
PID 3160 wrote to memory of 4996	3160	0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe	113

C:\Users\Admin\AppData\Local\Temp\0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0bc09363c41adb1590e8df9593db4521_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5196
- C:\Windows\System\CfYdNsv.exe
  C:\Windows\System\CfYdNsv.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\DoUsokW.exe
  C:\Windows\System\DoUsokW.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\qdbaeQk.exe
  C:\Windows\System\qdbaeQk.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\QxQnGCF.exe
  C:\Windows\System\QxQnGCF.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\ddJHKPj.exe
  C:\Windows\System\ddJHKPj.exe
  2⤵
  - Executes dropped EXE
  PID:6044
- C:\Windows\System\BthvIsT.exe
  C:\Windows\System\BthvIsT.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\VYLTXQe.exe
  C:\Windows\System\VYLTXQe.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\vXTzgqM.exe
  C:\Windows\System\vXTzgqM.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\szVYZPa.exe
  C:\Windows\System\szVYZPa.exe
  2⤵
  - Executes dropped EXE
  PID:5616
- C:\Windows\System\YhKMLnI.exe
  C:\Windows\System\YhKMLnI.exe
  2⤵
  - Executes dropped EXE
  PID:5348
- C:\Windows\System\xmgCPwZ.exe
  C:\Windows\System\xmgCPwZ.exe
  2⤵
  - Executes dropped EXE
  PID:6056
- C:\Windows\System\ZjyeLlO.exe
  C:\Windows\System\ZjyeLlO.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\YsElUUb.exe
  C:\Windows\System\YsElUUb.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\nndxLEu.exe
  C:\Windows\System\nndxLEu.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\VzeqoUi.exe
  C:\Windows\System\VzeqoUi.exe
  2⤵
  - Executes dropped EXE
  PID:5620
- C:\Windows\System\pkSWdYF.exe
  C:\Windows\System\pkSWdYF.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\ENeQfDc.exe
  C:\Windows\System\ENeQfDc.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\fcBRmDg.exe
  C:\Windows\System\fcBRmDg.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\MwIqCsV.exe
  C:\Windows\System\MwIqCsV.exe
  2⤵
  - Executes dropped EXE
  PID:6080
- C:\Windows\System\ktBDuqG.exe
  C:\Windows\System\ktBDuqG.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\IvAWQCL.exe
  C:\Windows\System\IvAWQCL.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\BgDxofM.exe
  C:\Windows\System\BgDxofM.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\lzuIJBe.exe
  C:\Windows\System\lzuIJBe.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\RJmpzIc.exe
  C:\Windows\System\RJmpzIc.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\XOwySpq.exe
  C:\Windows\System\XOwySpq.exe
  2⤵
  - Executes dropped EXE
  PID:5536
- C:\Windows\System\fUSkvPt.exe
  C:\Windows\System\fUSkvPt.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\DNmrBow.exe
  C:\Windows\System\DNmrBow.exe
  2⤵
  - Executes dropped EXE
  PID:5152
- C:\Windows\System\SLzUjBl.exe
  C:\Windows\System\SLzUjBl.exe
  2⤵
  - Executes dropped EXE
  PID:6088
- C:\Windows\System\mlPKiNT.exe
  C:\Windows\System\mlPKiNT.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\qMRxoLS.exe
  C:\Windows\System\qMRxoLS.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\pNbVlBL.exe
  C:\Windows\System\pNbVlBL.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\ndiopfD.exe
  C:\Windows\System\ndiopfD.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\snuzYMN.exe
  C:\Windows\System\snuzYMN.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\vNWkTrl.exe
  C:\Windows\System\vNWkTrl.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\McZHxXC.exe
  C:\Windows\System\McZHxXC.exe
  2⤵
  - Executes dropped EXE
  PID:5596
- C:\Windows\System\OyGJICn.exe
  C:\Windows\System\OyGJICn.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\DqmfWja.exe
  C:\Windows\System\DqmfWja.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\tJiLGqo.exe
  C:\Windows\System\tJiLGqo.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\AiHnJPw.exe
  C:\Windows\System\AiHnJPw.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\adBrFdc.exe
  C:\Windows\System\adBrFdc.exe
  2⤵
  - Executes dropped EXE
  PID:5756
- C:\Windows\System\EtWhSAN.exe
  C:\Windows\System\EtWhSAN.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\OkskCEW.exe
  C:\Windows\System\OkskCEW.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\xPkSznw.exe
  C:\Windows\System\xPkSznw.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\ZTISwDa.exe
  C:\Windows\System\ZTISwDa.exe
  2⤵
  - Executes dropped EXE
  PID:5728
- C:\Windows\System\ZZLzhrn.exe
  C:\Windows\System\ZZLzhrn.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\jpDPsKI.exe
  C:\Windows\System\jpDPsKI.exe
  2⤵
  - Executes dropped EXE
  PID:5748
- C:\Windows\System\ElnbXSu.exe
  C:\Windows\System\ElnbXSu.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\PRTFWgz.exe
  C:\Windows\System\PRTFWgz.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\Mtyvvby.exe
  C:\Windows\System\Mtyvvby.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\JYKXOMp.exe
  C:\Windows\System\JYKXOMp.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\EPHKdfF.exe
  C:\Windows\System\EPHKdfF.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\FmsyfZI.exe
  C:\Windows\System\FmsyfZI.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\SGaIkwN.exe
  C:\Windows\System\SGaIkwN.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\iMWKHgZ.exe
  C:\Windows\System\iMWKHgZ.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\fhlNjDm.exe
  C:\Windows\System\fhlNjDm.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\dyfTpiN.exe
  C:\Windows\System\dyfTpiN.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\CWTLNwV.exe
  C:\Windows\System\CWTLNwV.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\nAgpIFi.exe
  C:\Windows\System\nAgpIFi.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\YXObfAV.exe
  C:\Windows\System\YXObfAV.exe
  2⤵
  - Executes dropped EXE
  PID:5992
- C:\Windows\System\wAOHuQA.exe
  C:\Windows\System\wAOHuQA.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\gGdJxFF.exe
  C:\Windows\System\gGdJxFF.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\SmyFVFS.exe
  C:\Windows\System\SmyFVFS.exe
  2⤵
  PID:3928
- C:\Windows\System\KCtvmBe.exe
  C:\Windows\System\KCtvmBe.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\NpEltdj.exe
  C:\Windows\System\NpEltdj.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\LDccHrY.exe
  C:\Windows\System\LDccHrY.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\PhsiSbk.exe
  C:\Windows\System\PhsiSbk.exe
  2⤵
  PID:2232
- C:\Windows\System\hNDdaBU.exe
  C:\Windows\System\hNDdaBU.exe
  2⤵
  PID:4532
- C:\Windows\System\ssqhDIY.exe
  C:\Windows\System\ssqhDIY.exe
  2⤵
  PID:5704
- C:\Windows\System\NFlDSDg.exe
  C:\Windows\System\NFlDSDg.exe
  2⤵
  PID:5592
- C:\Windows\System\NKLNIOV.exe
  C:\Windows\System\NKLNIOV.exe
  2⤵
  PID:228
- C:\Windows\System\WbJdrHk.exe
  C:\Windows\System\WbJdrHk.exe
  2⤵
  PID:4228
- C:\Windows\System\fIFxwPV.exe
  C:\Windows\System\fIFxwPV.exe
  2⤵
  PID:1056
- C:\Windows\System\msgCIxo.exe
  C:\Windows\System\msgCIxo.exe
  2⤵
  PID:3396
- C:\Windows\System\GmbrfMC.exe
  C:\Windows\System\GmbrfMC.exe
  2⤵
  PID:1264
- C:\Windows\System\btzeSHm.exe
  C:\Windows\System\btzeSHm.exe
  2⤵
  PID:3020
- C:\Windows\System\seMjAOk.exe
  C:\Windows\System\seMjAOk.exe
  2⤵
  PID:5340
- C:\Windows\System\yJKlSiP.exe
  C:\Windows\System\yJKlSiP.exe
  2⤵
  PID:5336
- C:\Windows\System\oEdFDFw.exe
  C:\Windows\System\oEdFDFw.exe
  2⤵
  PID:2624
- C:\Windows\System\xRVaYEL.exe
  C:\Windows\System\xRVaYEL.exe
  2⤵
  PID:5280
- C:\Windows\System\TKpWVWR.exe
  C:\Windows\System\TKpWVWR.exe
  2⤵
  PID:2984
- C:\Windows\System\OzLzyGO.exe
  C:\Windows\System\OzLzyGO.exe
  2⤵
  PID:5432
- C:\Windows\System\JdaBRsk.exe
  C:\Windows\System\JdaBRsk.exe
  2⤵
  PID:216
- C:\Windows\System\mqvNOtc.exe
  C:\Windows\System\mqvNOtc.exe
  2⤵
  PID:3904
- C:\Windows\System\MCRBjNI.exe
  C:\Windows\System\MCRBjNI.exe
  2⤵
  PID:5508
- C:\Windows\System\JlYgRIw.exe
  C:\Windows\System\JlYgRIw.exe
  2⤵
  PID:4560
- C:\Windows\System\CeFPkxX.exe
  C:\Windows\System\CeFPkxX.exe
  2⤵
  PID:1008
- C:\Windows\System\rUpOIpq.exe
  C:\Windows\System\rUpOIpq.exe
  2⤵
  PID:5684
- C:\Windows\System\XakRsEO.exe
  C:\Windows\System\XakRsEO.exe
  2⤵
  PID:1720
- C:\Windows\System\AqExLVu.exe
  C:\Windows\System\AqExLVu.exe
  2⤵
  PID:932
- C:\Windows\System\natWdQy.exe
  C:\Windows\System\natWdQy.exe
  2⤵
  PID:3596
- C:\Windows\System\fEfuXXn.exe
  C:\Windows\System\fEfuXXn.exe
  2⤵
  PID:1968
- C:\Windows\System\XTmBCfs.exe
  C:\Windows\System\XTmBCfs.exe
  2⤵
  PID:2388
- C:\Windows\System\NzZcGpV.exe
  C:\Windows\System\NzZcGpV.exe
  2⤵
  PID:6040
- C:\Windows\System\xLlieRG.exe
  C:\Windows\System\xLlieRG.exe
  2⤵
  PID:2748
- C:\Windows\System\GDusqVs.exe
  C:\Windows\System\GDusqVs.exe
  2⤵
  PID:5572
- C:\Windows\System\WKVdGmP.exe
  C:\Windows\System\WKVdGmP.exe
  2⤵
  PID:1420
- C:\Windows\System\FElrSlS.exe
  C:\Windows\System\FElrSlS.exe
  2⤵
  PID:5948
- C:\Windows\System\MpCtqso.exe
  C:\Windows\System\MpCtqso.exe
  2⤵
  PID:2420
- C:\Windows\System\zJNNvrS.exe
  C:\Windows\System\zJNNvrS.exe
  2⤵
  PID:2360
- C:\Windows\System\SZmzjxR.exe
  C:\Windows\System\SZmzjxR.exe
  2⤵
  PID:2140
- C:\Windows\System\OZTUKwx.exe
  C:\Windows\System\OZTUKwx.exe
  2⤵
  PID:4652
- C:\Windows\System\CPSmiGK.exe
  C:\Windows\System\CPSmiGK.exe
  2⤵
  PID:2056
- C:\Windows\System\LrBokhT.exe
  C:\Windows\System\LrBokhT.exe
  2⤵
  PID:1436
- C:\Windows\System\HImfWhV.exe
  C:\Windows\System\HImfWhV.exe
  2⤵
  PID:4460
- C:\Windows\System\dEeHsSc.exe
  C:\Windows\System\dEeHsSc.exe
  2⤵
  PID:3036
- C:\Windows\System\TZLIlmn.exe
  C:\Windows\System\TZLIlmn.exe
  2⤵
  PID:1104
- C:\Windows\System\mxgyqHj.exe
  C:\Windows\System\mxgyqHj.exe
  2⤵
  PID:2344
- C:\Windows\System\SYmtDsV.exe
  C:\Windows\System\SYmtDsV.exe
  2⤵
  PID:3208
- C:\Windows\System\kAstNvc.exe
  C:\Windows\System\kAstNvc.exe
  2⤵
  PID:2992
- C:\Windows\System\moDjGTs.exe
  C:\Windows\System\moDjGTs.exe
  2⤵
  PID:4684
- C:\Windows\System\cnowQMW.exe
  C:\Windows\System\cnowQMW.exe
  2⤵
  PID:4520
- C:\Windows\System\ETXpDbh.exe
  C:\Windows\System\ETXpDbh.exe
  2⤵
  PID:4300
- C:\Windows\System\SvdXXrD.exe
  C:\Windows\System\SvdXXrD.exe
  2⤵
  PID:3644
- C:\Windows\System\kXbiDzh.exe
  C:\Windows\System\kXbiDzh.exe
  2⤵
  PID:2172
- C:\Windows\System\zVpTOSJ.exe
  C:\Windows\System\zVpTOSJ.exe
  2⤵
  PID:5356
- C:\Windows\System\gJruFnx.exe
  C:\Windows\System\gJruFnx.exe
  2⤵
  PID:1252
- C:\Windows\System\OUjOxyE.exe
  C:\Windows\System\OUjOxyE.exe
  2⤵
  PID:2680
- C:\Windows\System\YTWUMnr.exe
  C:\Windows\System\YTWUMnr.exe
  2⤵
  PID:4664
- C:\Windows\System\gBtjlyX.exe
  C:\Windows\System\gBtjlyX.exe
  2⤵
  PID:5528
- C:\Windows\System\wQVVgwb.exe
  C:\Windows\System\wQVVgwb.exe
  2⤵
  PID:4708
- C:\Windows\System\EgIxlLm.exe
  C:\Windows\System\EgIxlLm.exe
  2⤵
  PID:1940
- C:\Windows\System\feQQqmU.exe
  C:\Windows\System\feQQqmU.exe
  2⤵
  PID:1516
- C:\Windows\System\kegKIPy.exe
  C:\Windows\System\kegKIPy.exe
  2⤵
  PID:2436
- C:\Windows\System\fnOfcRl.exe
  C:\Windows\System\fnOfcRl.exe
  2⤵
  PID:3188
- C:\Windows\System\VlvmbcH.exe
  C:\Windows\System\VlvmbcH.exe
  2⤵
  PID:5096
- C:\Windows\System\TInFyCc.exe
  C:\Windows\System\TInFyCc.exe
  2⤵
  PID:4044
- C:\Windows\System\qZqfQbf.exe
  C:\Windows\System\qZqfQbf.exe
  2⤵
  PID:5608
- C:\Windows\System\CVEuvgS.exe
  C:\Windows\System\CVEuvgS.exe
  2⤵
  PID:2800
- C:\Windows\System\QZNZGRM.exe
  C:\Windows\System\QZNZGRM.exe
  2⤵
  PID:2144
- C:\Windows\System\yiPVvGX.exe
  C:\Windows\System\yiPVvGX.exe
  2⤵
  PID:2212
- C:\Windows\System\uDaxNix.exe
  C:\Windows\System\uDaxNix.exe
  2⤵
  PID:4556
- C:\Windows\System\kHNEzZu.exe
  C:\Windows\System\kHNEzZu.exe
  2⤵
  PID:408
- C:\Windows\System\zfnQGBC.exe
  C:\Windows\System\zfnQGBC.exe
  2⤵
  PID:2516
- C:\Windows\System\CdhFIoK.exe
  C:\Windows\System\CdhFIoK.exe
  2⤵
  PID:5956
- C:\Windows\System\izUVdlt.exe
  C:\Windows\System\izUVdlt.exe
  2⤵
  PID:5396
- C:\Windows\System\mlJADev.exe
  C:\Windows\System\mlJADev.exe
  2⤵
  PID:1328
- C:\Windows\System\IagDVfZ.exe
  C:\Windows\System\IagDVfZ.exe
  2⤵
  PID:5504
- C:\Windows\System\tTrvSyl.exe
  C:\Windows\System\tTrvSyl.exe
  2⤵
  PID:544
- C:\Windows\System\bTUShLb.exe
  C:\Windows\System\bTUShLb.exe
  2⤵
  PID:1916
- C:\Windows\System\jlLBOXR.exe
  C:\Windows\System\jlLBOXR.exe
  2⤵
  PID:4568
- C:\Windows\System\yaOpkRR.exe
  C:\Windows\System\yaOpkRR.exe
  2⤵
  PID:2404
- C:\Windows\System\QVJcoZF.exe
  C:\Windows\System\QVJcoZF.exe
  2⤵
  PID:3768
- C:\Windows\System\NDMbiEn.exe
  C:\Windows\System\NDMbiEn.exe
  2⤵
  PID:3192
- C:\Windows\System\abqiCtW.exe
  C:\Windows\System\abqiCtW.exe
  2⤵
  PID:4116
- C:\Windows\System\cCwXHcv.exe
  C:\Windows\System\cCwXHcv.exe
  2⤵
  PID:2208
- C:\Windows\System\JWVqJGN.exe
  C:\Windows\System\JWVqJGN.exe
  2⤵
  PID:3652
- C:\Windows\System\ueNtmfI.exe
  C:\Windows\System\ueNtmfI.exe
  2⤵
  PID:5140
- C:\Windows\System\vlGCWIR.exe
  C:\Windows\System\vlGCWIR.exe
  2⤵
  PID:2240
- C:\Windows\System\rWeuCzC.exe
  C:\Windows\System\rWeuCzC.exe
  2⤵
  PID:6160
- C:\Windows\System\jKsfiCs.exe
  C:\Windows\System\jKsfiCs.exe
  2⤵
  PID:6180
- C:\Windows\System\lSdHcUk.exe
  C:\Windows\System\lSdHcUk.exe
  2⤵
  PID:6200
- C:\Windows\System\DuCxddl.exe
  C:\Windows\System\DuCxddl.exe
  2⤵
  PID:6216
- C:\Windows\System\UaiWPHp.exe
  C:\Windows\System\UaiWPHp.exe
  2⤵
  PID:6240
- C:\Windows\System\dTeBrFm.exe
  C:\Windows\System\dTeBrFm.exe
  2⤵
  PID:6260
- C:\Windows\System\VDyBwKf.exe
  C:\Windows\System\VDyBwKf.exe
  2⤵
  PID:6276
- C:\Windows\System\oNWMPQC.exe
  C:\Windows\System\oNWMPQC.exe
  2⤵
  PID:6312
- C:\Windows\System\vfumWOY.exe
  C:\Windows\System\vfumWOY.exe
  2⤵
  PID:6336
- C:\Windows\System\DTrmtiY.exe
  C:\Windows\System\DTrmtiY.exe
  2⤵
  PID:6360
- C:\Windows\System\ujeBtsl.exe
  C:\Windows\System\ujeBtsl.exe
  2⤵
  PID:6376
- C:\Windows\System\haRDTfI.exe
  C:\Windows\System\haRDTfI.exe
  2⤵
  PID:6400
- C:\Windows\System\ejRNzch.exe
  C:\Windows\System\ejRNzch.exe
  2⤵
  PID:6424
- C:\Windows\System\LbQiVqX.exe
  C:\Windows\System\LbQiVqX.exe
  2⤵
  PID:6440
- C:\Windows\System\VtfykjH.exe
  C:\Windows\System\VtfykjH.exe
  2⤵
  PID:6464
- C:\Windows\System\CqncbQa.exe
  C:\Windows\System\CqncbQa.exe
  2⤵
  PID:6488
- C:\Windows\System\nnrBliJ.exe
  C:\Windows\System\nnrBliJ.exe
  2⤵
  PID:6516
- C:\Windows\System\KOnPDBK.exe
  C:\Windows\System\KOnPDBK.exe
  2⤵
  PID:6532
- C:\Windows\System\ZiobBXN.exe
  C:\Windows\System\ZiobBXN.exe
  2⤵
  PID:6552
- C:\Windows\System\aOizfer.exe
  C:\Windows\System\aOizfer.exe
  2⤵
  PID:6576
- C:\Windows\System\pdCKEgf.exe
  C:\Windows\System\pdCKEgf.exe
  2⤵
  PID:6596
- C:\Windows\System\xtMnQpI.exe
  C:\Windows\System\xtMnQpI.exe
  2⤵
  PID:6620
- C:\Windows\System\gqTWccW.exe
  C:\Windows\System\gqTWccW.exe
  2⤵
  PID:6676
- C:\Windows\System\XiWWgwT.exe
  C:\Windows\System\XiWWgwT.exe
  2⤵
  PID:6700
- C:\Windows\System\YDzDRBO.exe
  C:\Windows\System\YDzDRBO.exe
  2⤵
  PID:6724
- C:\Windows\System\oQIpWTK.exe
  C:\Windows\System\oQIpWTK.exe
  2⤵
  PID:6744
- C:\Windows\System\rmOTqRF.exe
  C:\Windows\System\rmOTqRF.exe
  2⤵
  PID:6768
- C:\Windows\System\ScFyjyc.exe
  C:\Windows\System\ScFyjyc.exe
  2⤵
  PID:6788
- C:\Windows\System\ITNQtSf.exe
  C:\Windows\System\ITNQtSf.exe
  2⤵
  PID:6812
- C:\Windows\System\EGNhFHm.exe
  C:\Windows\System\EGNhFHm.exe
  2⤵
  PID:6828
- C:\Windows\System\YvuZcHd.exe
  C:\Windows\System\YvuZcHd.exe
  2⤵
  PID:6852
- C:\Windows\System\foyjZXZ.exe
  C:\Windows\System\foyjZXZ.exe
  2⤵
  PID:6872
- C:\Windows\System\nZawNyk.exe
  C:\Windows\System\nZawNyk.exe
  2⤵
  PID:6900
- C:\Windows\System\VHntLSU.exe
  C:\Windows\System\VHntLSU.exe
  2⤵
  PID:6924
- C:\Windows\System\otlvpxS.exe
  C:\Windows\System\otlvpxS.exe
  2⤵
  PID:6944
- C:\Windows\System\JSivvbG.exe
  C:\Windows\System\JSivvbG.exe
  2⤵
  PID:6960
- C:\Windows\System\qrttLdW.exe
  C:\Windows\System\qrttLdW.exe
  2⤵
  PID:6984
- C:\Windows\System\TzTuoIT.exe
  C:\Windows\System\TzTuoIT.exe
  2⤵
  PID:7004
- C:\Windows\System\MkVZSkw.exe
  C:\Windows\System\MkVZSkw.exe
  2⤵
  PID:7020
- C:\Windows\System\OYHoAaU.exe
  C:\Windows\System\OYHoAaU.exe
  2⤵
  PID:7036
- C:\Windows\System\XXrSoMy.exe
  C:\Windows\System\XXrSoMy.exe
  2⤵
  PID:7056
- C:\Windows\System\bGpoYnI.exe
  C:\Windows\System\bGpoYnI.exe
  2⤵
  PID:7072
- C:\Windows\System\KlgJsAy.exe
  C:\Windows\System\KlgJsAy.exe
  2⤵
  PID:7100
- C:\Windows\System\cJqwPVd.exe
  C:\Windows\System\cJqwPVd.exe
  2⤵
  PID:7120
- C:\Windows\System\MMrknzz.exe
  C:\Windows\System\MMrknzz.exe
  2⤵
  PID:7140
- C:\Windows\System\NyAEMTz.exe
  C:\Windows\System\NyAEMTz.exe
  2⤵
  PID:7164
- C:\Windows\System\wBcBAem.exe
  C:\Windows\System\wBcBAem.exe
  2⤵
  PID:5752
- C:\Windows\System\vkguYyL.exe
  C:\Windows\System\vkguYyL.exe
  2⤵
  PID:3824
- C:\Windows\System\TRtahss.exe
  C:\Windows\System\TRtahss.exe
  2⤵
  PID:5300
- C:\Windows\System\ScEcSRu.exe
  C:\Windows\System\ScEcSRu.exe
  2⤵
  PID:2552
- C:\Windows\System\WEbzVek.exe
  C:\Windows\System\WEbzVek.exe
  2⤵
  PID:3296
- C:\Windows\System\qgUKBaV.exe
  C:\Windows\System\qgUKBaV.exe
  2⤵
  PID:4320
- C:\Windows\System\mJFVwMV.exe
  C:\Windows\System\mJFVwMV.exe
  2⤵
  PID:2376
- C:\Windows\System\fGWKYFU.exe
  C:\Windows\System\fGWKYFU.exe
  2⤵
  PID:5400
- C:\Windows\System\YnkWLVJ.exe
  C:\Windows\System\YnkWLVJ.exe
  2⤵
  PID:1500
- C:\Windows\System\xKTNKqE.exe
  C:\Windows\System\xKTNKqE.exe
  2⤵
  PID:760
- C:\Windows\System\zWASSOT.exe
  C:\Windows\System\zWASSOT.exe
  2⤵
  PID:2120
- C:\Windows\System\AUWRmUc.exe
  C:\Windows\System\AUWRmUc.exe
  2⤵
  PID:1340
- C:\Windows\System\QWdDtXN.exe
  C:\Windows\System\QWdDtXN.exe
  2⤵
  PID:6208
- C:\Windows\System\zwNnRdb.exe
  C:\Windows\System\zwNnRdb.exe
  2⤵
  PID:6268
- C:\Windows\System\SmmSRNK.exe
  C:\Windows\System\SmmSRNK.exe
  2⤵
  PID:4576
- C:\Windows\System\Cezffku.exe
  C:\Windows\System\Cezffku.exe
  2⤵
  PID:2972
- C:\Windows\System\MplBFGs.exe
  C:\Windows\System\MplBFGs.exe
  2⤵
  PID:2872
- C:\Windows\System\lNnpmDs.exe
  C:\Windows\System\lNnpmDs.exe
  2⤵
  PID:6604
- C:\Windows\System\nrboyzs.exe
  C:\Windows\System\nrboyzs.exe
  2⤵
  PID:3932
- C:\Windows\System\IfTUmzV.exe
  C:\Windows\System\IfTUmzV.exe
  2⤵
  PID:3452
- C:\Windows\System\bGGuaRN.exe
  C:\Windows\System\bGGuaRN.exe
  2⤵
  PID:7196
- C:\Windows\System\gxZiWLw.exe
  C:\Windows\System\gxZiWLw.exe
  2⤵
  PID:7216
- C:\Windows\System\DontsNy.exe
  C:\Windows\System\DontsNy.exe
  2⤵
  PID:7240
- C:\Windows\System\VkTwwIc.exe
  C:\Windows\System\VkTwwIc.exe
  2⤵
  PID:7256
- C:\Windows\System\tQochvT.exe
  C:\Windows\System\tQochvT.exe
  2⤵
  PID:7280
- C:\Windows\System\cgrRxQP.exe
  C:\Windows\System\cgrRxQP.exe
  2⤵
  PID:7296
- C:\Windows\System\mzhxNlj.exe
  C:\Windows\System\mzhxNlj.exe
  2⤵
  PID:7324
- C:\Windows\System\hgtreep.exe
  C:\Windows\System\hgtreep.exe
  2⤵
  PID:7356
- C:\Windows\System\izeUaHU.exe
  C:\Windows\System\izeUaHU.exe
  2⤵
  PID:7520
- C:\Windows\System\vGgMAcp.exe
  C:\Windows\System\vGgMAcp.exe
  2⤵
  PID:7536
- C:\Windows\System\rmFNADX.exe
  C:\Windows\System\rmFNADX.exe
  2⤵
  PID:7552
- C:\Windows\System\oYhzcZD.exe
  C:\Windows\System\oYhzcZD.exe
  2⤵
  PID:7568
- C:\Windows\System\MgsEhhx.exe
  C:\Windows\System\MgsEhhx.exe
  2⤵
  PID:7584
- C:\Windows\System\RvRitay.exe
  C:\Windows\System\RvRitay.exe
  2⤵
  PID:7600
- C:\Windows\System\mlpCUCm.exe
  C:\Windows\System\mlpCUCm.exe
  2⤵
  PID:7616
- C:\Windows\System\KmUzOvd.exe
  C:\Windows\System\KmUzOvd.exe
  2⤵
  PID:7632
- C:\Windows\System\utUcosm.exe
  C:\Windows\System\utUcosm.exe
  2⤵
  PID:7648
- C:\Windows\System\LvIMnwS.exe
  C:\Windows\System\LvIMnwS.exe
  2⤵
  PID:7664
- C:\Windows\System\UfnUJYo.exe
  C:\Windows\System\UfnUJYo.exe
  2⤵
  PID:7680
- C:\Windows\System\RMMfTNx.exe
  C:\Windows\System\RMMfTNx.exe
  2⤵
  PID:7696
- C:\Windows\System\YbgqiuH.exe
  C:\Windows\System\YbgqiuH.exe
  2⤵
  PID:7712
- C:\Windows\System\rxuyrnH.exe
  C:\Windows\System\rxuyrnH.exe
  2⤵
  PID:7728
- C:\Windows\System\nAlNYME.exe
  C:\Windows\System\nAlNYME.exe
  2⤵
  PID:7748
- C:\Windows\System\KWRBISb.exe
  C:\Windows\System\KWRBISb.exe
  2⤵
  PID:7768
- C:\Windows\System\GBMkehq.exe
  C:\Windows\System\GBMkehq.exe
  2⤵
  PID:7784
- C:\Windows\System\CYmGWTX.exe
  C:\Windows\System\CYmGWTX.exe
  2⤵
  PID:7800
- C:\Windows\System\BUBMEhm.exe
  C:\Windows\System\BUBMEhm.exe
  2⤵
  PID:7816
- C:\Windows\System\CXHURtr.exe
  C:\Windows\System\CXHURtr.exe
  2⤵
  PID:7852
- C:\Windows\System\WAKPQZJ.exe
  C:\Windows\System\WAKPQZJ.exe
  2⤵
  PID:8064
- C:\Windows\System\xpqgCDc.exe
  C:\Windows\System\xpqgCDc.exe
  2⤵
  PID:8084
- C:\Windows\System\GlAeNiZ.exe
  C:\Windows\System\GlAeNiZ.exe
  2⤵
  PID:8100
- C:\Windows\System\CJYAvcT.exe
  C:\Windows\System\CJYAvcT.exe
  2⤵
  PID:8116
- C:\Windows\System\HzyMuql.exe
  C:\Windows\System\HzyMuql.exe
  2⤵
  PID:8136
- C:\Windows\System\zzBtNYq.exe
  C:\Windows\System\zzBtNYq.exe
  2⤵
  PID:8152
- C:\Windows\System\DkHvzSd.exe
  C:\Windows\System\DkHvzSd.exe
  2⤵
  PID:8168
- C:\Windows\System\ebRtpUj.exe
  C:\Windows\System\ebRtpUj.exe
  2⤵
  PID:8184
- C:\Windows\System\rtkRzdP.exe
  C:\Windows\System\rtkRzdP.exe
  2⤵
  PID:3608
- C:\Windows\System\cNsRlyi.exe
  C:\Windows\System\cNsRlyi.exe
  2⤵
  PID:4592
- C:\Windows\System\vsxCVdW.exe
  C:\Windows\System\vsxCVdW.exe
  2⤵
  PID:3492
- C:\Windows\System\vSnUcCO.exe
  C:\Windows\System\vSnUcCO.exe
  2⤵
  PID:2076
- C:\Windows\System\KijytQF.exe
  C:\Windows\System\KijytQF.exe
  2⤵
  PID:2936
- C:\Windows\System\cMGtgnM.exe
  C:\Windows\System\cMGtgnM.exe
  2⤵
  PID:3688
- C:\Windows\System\RkFFGrE.exe
  C:\Windows\System\RkFFGrE.exe
  2⤵
  PID:3384
- C:\Windows\System\bxtjtgQ.exe
  C:\Windows\System\bxtjtgQ.exe
  2⤵
  PID:2064
- C:\Windows\System\oachLOI.exe
  C:\Windows\System\oachLOI.exe
  2⤵
  PID:4756
- C:\Windows\System\fiMNLlS.exe
  C:\Windows\System\fiMNLlS.exe
  2⤵
  PID:6252
- C:\Windows\System\oecDMIv.exe
  C:\Windows\System\oecDMIv.exe
  2⤵
  PID:6332
- C:\Windows\System\lFoQeMc.exe
  C:\Windows\System\lFoQeMc.exe
  2⤵
  PID:6484
- C:\Windows\System\lynvqLe.exe
  C:\Windows\System\lynvqLe.exe
  2⤵
  PID:6644
- C:\Windows\System\TbKwQHA.exe
  C:\Windows\System\TbKwQHA.exe
  2⤵
  PID:6708
- C:\Windows\System\nOKiQwL.exe
  C:\Windows\System\nOKiQwL.exe
  2⤵
  PID:6764
- C:\Windows\System\JBfifaA.exe
  C:\Windows\System\JBfifaA.exe
  2⤵
  PID:6836
- C:\Windows\System\rjHSpQc.exe
  C:\Windows\System\rjHSpQc.exe
  2⤵
  PID:2052
- C:\Windows\System\XMXoEVl.exe
  C:\Windows\System\XMXoEVl.exe
  2⤵
  PID:2092
- C:\Windows\System\ihOKLDl.exe
  C:\Windows\System\ihOKLDl.exe
  2⤵
  PID:7180
- C:\Windows\System\sUggLrz.exe
  C:\Windows\System\sUggLrz.exe
  2⤵
  PID:7332
- C:\Windows\System\erJhqBi.exe
  C:\Windows\System\erJhqBi.exe
  2⤵
  PID:6920
- C:\Windows\System\ukEoBvJ.exe
  C:\Windows\System\ukEoBvJ.exe
  2⤵
  PID:6980
- C:\Windows\System\zopnlCc.exe
  C:\Windows\System\zopnlCc.exe
  2⤵
  PID:7044
- C:\Windows\System\RlIoGsL.exe
  C:\Windows\System\RlIoGsL.exe
  2⤵
  PID:7112
- C:\Windows\System\DUcdrfd.exe
  C:\Windows\System\DUcdrfd.exe
  2⤵
  PID:4224
- C:\Windows\System\LCFmwQV.exe
  C:\Windows\System\LCFmwQV.exe
  2⤵
  PID:5272
- C:\Windows\System\dXiiScT.exe
  C:\Windows\System\dXiiScT.exe
  2⤵
  PID:2820
- C:\Windows\System\lVPpryD.exe
  C:\Windows\System\lVPpryD.exe
  2⤵
  PID:116
- C:\Windows\System\UqvnKih.exe
  C:\Windows\System\UqvnKih.exe
  2⤵
  PID:6192
- C:\Windows\System\DvMqSyU.exe
  C:\Windows\System\DvMqSyU.exe
  2⤵
  PID:6352
- C:\Windows\System\WzWiWiS.exe
  C:\Windows\System\WzWiWiS.exe
  2⤵
  PID:6060
- C:\Windows\System\mDKWCgK.exe
  C:\Windows\System\mDKWCgK.exe
  2⤵
  PID:7208
- C:\Windows\System\ylEbiJY.exe
  C:\Windows\System\ylEbiJY.exe
  2⤵
  PID:7248
- C:\Windows\System\EslUhHS.exe
  C:\Windows\System\EslUhHS.exe
  2⤵
  PID:7292
- C:\Windows\System\iOzPQAv.exe
  C:\Windows\System\iOzPQAv.exe
  2⤵
  PID:4104
- C:\Windows\System\rTPLJxt.exe
  C:\Windows\System\rTPLJxt.exe
  2⤵
  PID:8212
- C:\Windows\System\OxbyAkl.exe
  C:\Windows\System\OxbyAkl.exe
  2⤵
  PID:8236
- C:\Windows\System\Gcaqgnf.exe
  C:\Windows\System\Gcaqgnf.exe
  2⤵
  PID:8252
- C:\Windows\System\mjBsEpw.exe
  C:\Windows\System\mjBsEpw.exe
  2⤵
  PID:8272
- C:\Windows\System\ONoMvlY.exe
  C:\Windows\System\ONoMvlY.exe
  2⤵
  PID:8292
- C:\Windows\System\RaYaGQz.exe
  C:\Windows\System\RaYaGQz.exe
  2⤵
  PID:8312
- C:\Windows\System\wpfHFLN.exe
  C:\Windows\System\wpfHFLN.exe
  2⤵
  PID:8332
- C:\Windows\System\OturvGL.exe
  C:\Windows\System\OturvGL.exe
  2⤵
  PID:8348
- C:\Windows\System\dDuMDIi.exe
  C:\Windows\System\dDuMDIi.exe
  2⤵
  PID:8368
- C:\Windows\System\kmEEMHN.exe
  C:\Windows\System\kmEEMHN.exe
  2⤵
  PID:8388
- C:\Windows\System\aHJUTIl.exe
  C:\Windows\System\aHJUTIl.exe
  2⤵
  PID:8408
- C:\Windows\System\TSxskYY.exe
  C:\Windows\System\TSxskYY.exe
  2⤵
  PID:8432
- C:\Windows\System\fCTvtaH.exe
  C:\Windows\System\fCTvtaH.exe
  2⤵
  PID:8452
- C:\Windows\System\KGxqUhI.exe
  C:\Windows\System\KGxqUhI.exe
  2⤵
  PID:8656
- C:\Windows\System\PZGIQZO.exe
  C:\Windows\System\PZGIQZO.exe
  2⤵
  PID:8676
- C:\Windows\System\vtuADjH.exe
  C:\Windows\System\vtuADjH.exe
  2⤵
  PID:8692
- C:\Windows\System\UMjXboH.exe
  C:\Windows\System\UMjXboH.exe
  2⤵
  PID:8712
- C:\Windows\System\kboGodz.exe
  C:\Windows\System\kboGodz.exe
  2⤵
  PID:8732
- C:\Windows\System\bHGXFdr.exe
  C:\Windows\System\bHGXFdr.exe
  2⤵
  PID:8752
- C:\Windows\System\WiSqprv.exe
  C:\Windows\System\WiSqprv.exe
  2⤵
  PID:8772
- C:\Windows\System\qrPTWPV.exe
  C:\Windows\System\qrPTWPV.exe
  2⤵
  PID:8788
- C:\Windows\System\eAsBdob.exe
  C:\Windows\System\eAsBdob.exe
  2⤵
  PID:8812
- C:\Windows\System\juaixCB.exe
  C:\Windows\System\juaixCB.exe
  2⤵
  PID:8832
- C:\Windows\System\esVkcwC.exe
  C:\Windows\System\esVkcwC.exe
  2⤵
  PID:8848
- C:\Windows\System\GvydKxx.exe
  C:\Windows\System\GvydKxx.exe
  2⤵
  PID:8868
- C:\Windows\System\aGUAQPR.exe
  C:\Windows\System\aGUAQPR.exe
  2⤵
  PID:8916
- C:\Windows\System\bDOkDSn.exe
  C:\Windows\System\bDOkDSn.exe
  2⤵
  PID:8932
- C:\Windows\System\ERaDBTC.exe
  C:\Windows\System\ERaDBTC.exe
  2⤵
  PID:8956
- C:\Windows\System\qeBAOEL.exe
  C:\Windows\System\qeBAOEL.exe
  2⤵
  PID:8984
- C:\Windows\System\DVVocTC.exe
  C:\Windows\System\DVVocTC.exe
  2⤵
  PID:9020
- C:\Windows\System\VAenoxH.exe
  C:\Windows\System\VAenoxH.exe
  2⤵
  PID:9040
- C:\Windows\System\EdPrGju.exe
  C:\Windows\System\EdPrGju.exe
  2⤵
  PID:9068
- C:\Windows\System\mXmjFxv.exe
  C:\Windows\System\mXmjFxv.exe
  2⤵
  PID:9092
- C:\Windows\System\CNGgoPG.exe
  C:\Windows\System\CNGgoPG.exe
  2⤵
  PID:9128
- C:\Windows\System\GSFTUWN.exe
  C:\Windows\System\GSFTUWN.exe
  2⤵
  PID:9160
- C:\Windows\System\wVwdaqw.exe
  C:\Windows\System\wVwdaqw.exe
  2⤵
  PID:9188
- C:\Windows\System\qEjqFbV.exe
  C:\Windows\System\qEjqFbV.exe
  2⤵
  PID:8108
- C:\Windows\System\imfpCbO.exe
  C:\Windows\System\imfpCbO.exe
  2⤵
  PID:6292
- C:\Windows\System\VlVbXMD.exe
  C:\Windows\System\VlVbXMD.exe
  2⤵
  PID:6740
- C:\Windows\System\vmzQqhC.exe
  C:\Windows\System\vmzQqhC.exe
  2⤵
  PID:6956
- C:\Windows\System\tecfczB.exe
  C:\Windows\System\tecfczB.exe
  2⤵
  PID:9224
- C:\Windows\System\dpoCOSa.exe
  C:\Windows\System\dpoCOSa.exe
  2⤵
  PID:9240
- C:\Windows\System\voyPRRA.exe
  C:\Windows\System\voyPRRA.exe
  2⤵
  PID:9272
- C:\Windows\System\ozMdubg.exe
  C:\Windows\System\ozMdubg.exe
  2⤵
  PID:9296
- C:\Windows\System\uHbqdEw.exe
  C:\Windows\System\uHbqdEw.exe
  2⤵
  PID:9312
- C:\Windows\System\kWVrPvD.exe
  C:\Windows\System\kWVrPvD.exe
  2⤵
  PID:9336
- C:\Windows\System\ZXklrjq.exe
  C:\Windows\System\ZXklrjq.exe
  2⤵
  PID:9356
- C:\Windows\System\HXivrNw.exe
  C:\Windows\System\HXivrNw.exe
  2⤵
  PID:9380
- C:\Windows\System\IpWxNcL.exe
  C:\Windows\System\IpWxNcL.exe
  2⤵
  PID:9404
- C:\Windows\System\FVPRciN.exe
  C:\Windows\System\FVPRciN.exe
  2⤵
  PID:9420
- C:\Windows\System\KLlQoJX.exe
  C:\Windows\System\KLlQoJX.exe
  2⤵
  PID:9440
- C:\Windows\System\jyshHhg.exe
  C:\Windows\System\jyshHhg.exe
  2⤵
  PID:9456
- C:\Windows\System\BvcdYJm.exe
  C:\Windows\System\BvcdYJm.exe
  2⤵
  PID:9472
- C:\Windows\System\gZOpSsD.exe
  C:\Windows\System\gZOpSsD.exe
  2⤵
  PID:9488
- C:\Windows\System\ZZYWUQK.exe
  C:\Windows\System\ZZYWUQK.exe
  2⤵
  PID:9508
- C:\Windows\System\oVMxZyH.exe
  C:\Windows\System\oVMxZyH.exe
  2⤵
  PID:9532
- C:\Windows\System\NkbLWtR.exe
  C:\Windows\System\NkbLWtR.exe
  2⤵
  PID:9548
- C:\Windows\System\BgBSQTT.exe
  C:\Windows\System\BgBSQTT.exe
  2⤵
  PID:9572
- C:\Windows\System\YxhPtyp.exe
  C:\Windows\System\YxhPtyp.exe
  2⤵
  PID:9592
- C:\Windows\System\lKFWOGh.exe
  C:\Windows\System\lKFWOGh.exe
  2⤵
  PID:9656
- C:\Windows\System\xifxnlI.exe
  C:\Windows\System\xifxnlI.exe
  2⤵
  PID:9672
- C:\Windows\System\pJjargp.exe
  C:\Windows\System\pJjargp.exe
  2⤵
  PID:9696
- C:\Windows\System\nlfVbiQ.exe
  C:\Windows\System\nlfVbiQ.exe
  2⤵
  PID:9716
- C:\Windows\System\kkcqXtn.exe
  C:\Windows\System\kkcqXtn.exe
  2⤵
  PID:9732
- C:\Windows\System\oqTAVDE.exe
  C:\Windows\System\oqTAVDE.exe
  2⤵
  PID:9752
- C:\Windows\System\NEFhApR.exe
  C:\Windows\System\NEFhApR.exe
  2⤵
  PID:9772
- C:\Windows\System\aGvgAOS.exe
  C:\Windows\System\aGvgAOS.exe
  2⤵
  PID:9792
- C:\Windows\System\iAPUBmz.exe
  C:\Windows\System\iAPUBmz.exe
  2⤵
  PID:9808
- C:\Windows\System\ahSFlCS.exe
  C:\Windows\System\ahSFlCS.exe
  2⤵
  PID:9828
- C:\Windows\System\rImQyES.exe
  C:\Windows\System\rImQyES.exe
  2⤵
  PID:9848
- C:\Windows\System\PJiiOTi.exe
  C:\Windows\System\PJiiOTi.exe
  2⤵
  PID:9864
- C:\Windows\System\bBexFgw.exe
  C:\Windows\System\bBexFgw.exe
  2⤵
  PID:9880
- C:\Windows\System\AiZoRhy.exe
  C:\Windows\System\AiZoRhy.exe
  2⤵
  PID:9900
- C:\Windows\System\gQNdCWa.exe
  C:\Windows\System\gQNdCWa.exe
  2⤵
  PID:9916
- C:\Windows\System\eqJlTYF.exe
  C:\Windows\System\eqJlTYF.exe
  2⤵
  PID:9940
- C:\Windows\System\GyPSViq.exe
  C:\Windows\System\GyPSViq.exe
  2⤵
  PID:9968
- C:\Windows\System\mQwLKIe.exe
  C:\Windows\System\mQwLKIe.exe
  2⤵
  PID:9984
- C:\Windows\System\ZdbXlKV.exe
  C:\Windows\System\ZdbXlKV.exe
  2⤵
  PID:10012
- C:\Windows\System\qzgvuWA.exe
  C:\Windows\System\qzgvuWA.exe
  2⤵
  PID:10032
- C:\Windows\System\oNRjxQS.exe
  C:\Windows\System\oNRjxQS.exe
  2⤵
  PID:10056
- C:\Windows\System\FsJLQNB.exe
  C:\Windows\System\FsJLQNB.exe
  2⤵
  PID:10076
- C:\Windows\System\PtbIjrm.exe
  C:\Windows\System\PtbIjrm.exe
  2⤵
  PID:10100
- C:\Windows\System\iCMIozE.exe
  C:\Windows\System\iCMIozE.exe
  2⤵
  PID:10116
- C:\Windows\System\rBHerQL.exe
  C:\Windows\System\rBHerQL.exe
  2⤵
  PID:10140
- C:\Windows\System\nDWaujg.exe
  C:\Windows\System\nDWaujg.exe
  2⤵
  PID:10164
- C:\Windows\System\svBfNQZ.exe
  C:\Windows\System\svBfNQZ.exe
  2⤵
  PID:10192
- C:\Windows\System\hBTuFkB.exe
  C:\Windows\System\hBTuFkB.exe
  2⤵
  PID:10212
- C:\Windows\System\UnQnMbU.exe
  C:\Windows\System\UnQnMbU.exe
  2⤵
  PID:7176
- C:\Windows\System\efRddiS.exe
  C:\Windows\System\efRddiS.exe
  2⤵
  PID:8244
- C:\Windows\System\FySOZGJ.exe
  C:\Windows\System\FySOZGJ.exe
  2⤵
  PID:8324
- C:\Windows\System\FCPvdcQ.exe
  C:\Windows\System\FCPvdcQ.exe
  2⤵
  PID:8356
- C:\Windows\System\hnhqQSe.exe
  C:\Windows\System\hnhqQSe.exe
  2⤵
  PID:8384
- C:\Windows\System\owIrjaE.exe
  C:\Windows\System\owIrjaE.exe
  2⤵
  PID:8428
- C:\Windows\System\JJabMHa.exe
  C:\Windows\System\JJabMHa.exe
  2⤵
  PID:8460
- C:\Windows\System\GUoTEXC.exe
  C:\Windows\System\GUoTEXC.exe
  2⤵
  PID:8060
- C:\Windows\System\DMSkLia.exe
  C:\Windows\System\DMSkLia.exe
  2⤵
  PID:6476
- C:\Windows\System\FJxsZnr.exe
  C:\Windows\System\FJxsZnr.exe
  2⤵
  PID:6884
- C:\Windows\System\dgCxxOF.exe
  C:\Windows\System\dgCxxOF.exe
  2⤵
  PID:7092
- C:\Windows\System\abLJEiG.exe
  C:\Windows\System\abLJEiG.exe
  2⤵
  PID:5812
- C:\Windows\System\IQoioVq.exe
  C:\Windows\System\IQoioVq.exe
  2⤵
  PID:7028
- C:\Windows\System\zpBNRLz.exe
  C:\Windows\System\zpBNRLz.exe
  2⤵
  PID:3680
- C:\Windows\System\VdMxgqR.exe
  C:\Windows\System\VdMxgqR.exe
  2⤵
  PID:4716
- C:\Windows\System\EVKnxpw.exe
  C:\Windows\System\EVKnxpw.exe
  2⤵
  PID:9288
- C:\Windows\System\XZQmgXC.exe
  C:\Windows\System\XZQmgXC.exe
  2⤵
  PID:2196
- C:\Windows\System\ztRwvxM.exe
  C:\Windows\System\ztRwvxM.exe
  2⤵
  PID:7228
- C:\Windows\System\XulWKgd.exe
  C:\Windows\System\XulWKgd.exe
  2⤵
  PID:9348
- C:\Windows\System\jBpKTAM.exe
  C:\Windows\System\jBpKTAM.exe
  2⤵
  PID:9372
- C:\Windows\System\tOGiJyo.exe
  C:\Windows\System\tOGiJyo.exe
  2⤵
  PID:8224
- C:\Windows\System\QESayyp.exe
  C:\Windows\System\QESayyp.exe
  2⤵
  PID:8268
- C:\Windows\System\SdVrEYf.exe
  C:\Windows\System\SdVrEYf.exe
  2⤵
  PID:8284
- C:\Windows\System\CvxQMfB.exe
  C:\Windows\System\CvxQMfB.exe
  2⤵
  PID:9448
- C:\Windows\System\SFYcMBo.exe
  C:\Windows\System\SFYcMBo.exe
  2⤵
  PID:9468
- C:\Windows\System\DYAVEZT.exe
  C:\Windows\System\DYAVEZT.exe
  2⤵
  PID:9516
- C:\Windows\System\aHFzZqT.exe
  C:\Windows\System\aHFzZqT.exe
  2⤵
  PID:7528
- C:\Windows\System\YJsBDoa.exe
  C:\Windows\System\YJsBDoa.exe
  2⤵
  PID:7576
- C:\Windows\System\UCAHirf.exe
  C:\Windows\System\UCAHirf.exe
  2⤵
  PID:7624
- C:\Windows\System\jYuWyUd.exe
  C:\Windows\System\jYuWyUd.exe
  2⤵
  PID:7656
- C:\Windows\System\DqqJvPp.exe
  C:\Windows\System\DqqJvPp.exe
  2⤵
  PID:7704
- C:\Windows\System\aYIPRQh.exe
  C:\Windows\System\aYIPRQh.exe
  2⤵
  PID:7744
- C:\Windows\System\hHFzUSv.exe
  C:\Windows\System\hHFzUSv.exe
  2⤵
  PID:7796
- C:\Windows\System\tcUTPrl.exe
  C:\Windows\System\tcUTPrl.exe
  2⤵
  PID:8004
- C:\Windows\System\OOXrzCo.exe
  C:\Windows\System\OOXrzCo.exe
  2⤵
  PID:8032
- C:\Windows\System\iGgXdIS.exe
  C:\Windows\System\iGgXdIS.exe
  2⤵
  PID:8056
- C:\Windows\System\wbADcdS.exe
  C:\Windows\System\wbADcdS.exe
  2⤵
  PID:8164
- C:\Windows\System\CAzcLLs.exe
  C:\Windows\System\CAzcLLs.exe
  2⤵
  PID:4964
- C:\Windows\System\KIhKnwX.exe
  C:\Windows\System\KIhKnwX.exe
  2⤵
  PID:5436
- C:\Windows\System\GzBJGTV.exe
  C:\Windows\System\GzBJGTV.exe
  2⤵
  PID:9028
- C:\Windows\System\cFPRVvk.exe
  C:\Windows\System\cFPRVvk.exe
  2⤵
  PID:6524
- C:\Windows\System\hPuUnVV.exe
  C:\Windows\System\hPuUnVV.exe
  2⤵
  PID:6320
- C:\Windows\System\kEfTSxw.exe
  C:\Windows\System\kEfTSxw.exe
  2⤵
  PID:4324
- C:\Windows\System\hLyKkHR.exe
  C:\Windows\System\hLyKkHR.exe
  2⤵
  PID:6692
- C:\Windows\System\FjRLkPt.exe
  C:\Windows\System\FjRLkPt.exe
  2⤵
  PID:6820
- C:\Windows\System\kQPmSFs.exe
  C:\Windows\System\kQPmSFs.exe
  2⤵
  PID:9892
- C:\Windows\System\HciTWBF.exe
  C:\Windows\System\HciTWBF.exe
  2⤵
  PID:10028
- C:\Windows\System\ddNykSh.exe
  C:\Windows\System\ddNykSh.exe
  2⤵
  PID:10112
- C:\Windows\System\acMOfmP.exe
  C:\Windows\System\acMOfmP.exe
  2⤵
  PID:10180
- C:\Windows\System\fRgidht.exe
  C:\Windows\System\fRgidht.exe
  2⤵
  PID:10264
- C:\Windows\System\RXzJSYH.exe
  C:\Windows\System\RXzJSYH.exe
  2⤵
  PID:10280
- C:\Windows\System\AtrGGCu.exe
  C:\Windows\System\AtrGGCu.exe
  2⤵
  PID:10304
- C:\Windows\System\xfyKnQH.exe
  C:\Windows\System\xfyKnQH.exe
  2⤵
  PID:10328
- C:\Windows\System\jUobMLW.exe
  C:\Windows\System\jUobMLW.exe
  2⤵
  PID:10344
- C:\Windows\System\yOprunk.exe
  C:\Windows\System\yOprunk.exe
  2⤵
  PID:10368
- C:\Windows\System\pNNhxeY.exe
  C:\Windows\System\pNNhxeY.exe
  2⤵
  PID:10392
- C:\Windows\System\LsjZHri.exe
  C:\Windows\System\LsjZHri.exe
  2⤵
  PID:10416
- C:\Windows\System\eBYJuJS.exe
  C:\Windows\System\eBYJuJS.exe
  2⤵
  PID:10432
- C:\Windows\System\sAIngRX.exe
  C:\Windows\System\sAIngRX.exe
  2⤵
  PID:10456
- C:\Windows\System\frhNzsd.exe
  C:\Windows\System\frhNzsd.exe
  2⤵
  PID:10480
- C:\Windows\System\XBZAkwu.exe
  C:\Windows\System\XBZAkwu.exe
  2⤵
  PID:10504
- C:\Windows\System\iODlRQn.exe
  C:\Windows\System\iODlRQn.exe
  2⤵
  PID:10520
- C:\Windows\System\gGsJtyL.exe
  C:\Windows\System\gGsJtyL.exe
  2⤵
  PID:10548
- C:\Windows\System\mdtBYBT.exe
  C:\Windows\System\mdtBYBT.exe
  2⤵
  PID:10568
- C:\Windows\System\cIWlqrC.exe
  C:\Windows\System\cIWlqrC.exe
  2⤵
  PID:10592
- C:\Windows\System\anoantl.exe
  C:\Windows\System\anoantl.exe
  2⤵
  PID:10608
- C:\Windows\System\UcZHapf.exe
  C:\Windows\System\UcZHapf.exe
  2⤵
  PID:10632
- C:\Windows\System\gYBtmcF.exe
  C:\Windows\System\gYBtmcF.exe
  2⤵
  PID:10656
- C:\Windows\System\mzlGwxR.exe
  C:\Windows\System\mzlGwxR.exe
  2⤵
  PID:10680
- C:\Windows\System\DdFmvoC.exe
  C:\Windows\System\DdFmvoC.exe
  2⤵
  PID:10840
- C:\Windows\System\gDdPMMS.exe
  C:\Windows\System\gDdPMMS.exe
  2⤵
  PID:10864
- C:\Windows\System\nMLWqsE.exe
  C:\Windows\System\nMLWqsE.exe
  2⤵
  PID:10888
- C:\Windows\System\oThZXjo.exe
  C:\Windows\System\oThZXjo.exe
  2⤵
  PID:10908
- C:\Windows\System\wgKSNMl.exe
  C:\Windows\System\wgKSNMl.exe
  2⤵
  PID:10928
- C:\Windows\System\jRHMPrv.exe
  C:\Windows\System\jRHMPrv.exe
  2⤵
  PID:10952
- C:\Windows\System\bcQXzEv.exe
  C:\Windows\System\bcQXzEv.exe
  2⤵
  PID:10968
- C:\Windows\System\PncOQDv.exe
  C:\Windows\System\PncOQDv.exe
  2⤵
  PID:10988
- C:\Windows\System\FRlMtEl.exe
  C:\Windows\System\FRlMtEl.exe
  2⤵
  PID:11008
- C:\Windows\System\qzUJhhN.exe
  C:\Windows\System\qzUJhhN.exe
  2⤵
  PID:11032
- C:\Windows\System\KesFcOf.exe
  C:\Windows\System\KesFcOf.exe
  2⤵
  PID:11056
- C:\Windows\System\JEvHKqD.exe
  C:\Windows\System\JEvHKqD.exe
  2⤵
  PID:11072
- C:\Windows\System\axquMTu.exe
  C:\Windows\System\axquMTu.exe
  2⤵
  PID:11096
- C:\Windows\System\WXrlpmn.exe
  C:\Windows\System\WXrlpmn.exe
  2⤵
  PID:11116
- C:\Windows\System\iBHUocx.exe
  C:\Windows\System\iBHUocx.exe
  2⤵
  PID:11132
- C:\Windows\System\ZKGFGfO.exe
  C:\Windows\System\ZKGFGfO.exe
  2⤵
  PID:11152
- C:\Windows\System\sIvuDKb.exe
  C:\Windows\System\sIvuDKb.exe
  2⤵
  PID:11180
- C:\Windows\System\lyjIhmk.exe
  C:\Windows\System\lyjIhmk.exe
  2⤵
  PID:11200
- C:\Windows\System\DMwVWDa.exe
  C:\Windows\System\DMwVWDa.exe
  2⤵
  PID:11216
- C:\Windows\System\qdNoUml.exe
  C:\Windows\System\qdNoUml.exe
  2⤵
  PID:11240
- C:\Windows\System\OjoWSBd.exe
  C:\Windows\System\OjoWSBd.exe
  2⤵
  PID:7496
- C:\Windows\System\ArofiVA.exe
  C:\Windows\System\ArofiVA.exe
  2⤵
  PID:8480
- C:\Windows\System\PyCSRdC.exe
  C:\Windows\System\PyCSRdC.exe
  2⤵
  PID:8652
- C:\Windows\System\waQunxF.exe
  C:\Windows\System\waQunxF.exe
  2⤵
  PID:8688
- C:\Windows\System\HUqMbzk.exe
  C:\Windows\System\HUqMbzk.exe
  2⤵
  PID:8740
- C:\Windows\System\XOMhhLE.exe
  C:\Windows\System\XOMhhLE.exe
  2⤵
  PID:8768
- C:\Windows\System\PMMfoKb.exe
  C:\Windows\System\PMMfoKb.exe
  2⤵
  PID:8804
- C:\Windows\System\QgEezSb.exe
  C:\Windows\System\QgEezSb.exe
  2⤵
  PID:8864
- C:\Windows\System\AhqiBYj.exe
  C:\Windows\System\AhqiBYj.exe
  2⤵
  PID:8948
- C:\Windows\System\quyeXov.exe
  C:\Windows\System\quyeXov.exe
  2⤵
  PID:8996
- C:\Windows\System\iNSccSU.exe
  C:\Windows\System\iNSccSU.exe
  2⤵
  PID:9048
- C:\Windows\System\utFfUXq.exe
  C:\Windows\System\utFfUXq.exe
  2⤵
  PID:9144
- C:\Windows\System\MlCTnGT.exe
  C:\Windows\System\MlCTnGT.exe
  2⤵
  PID:9860
- C:\Windows\System\oSNdXtK.exe
  C:\Windows\System\oSNdXtK.exe
  2⤵
  PID:9912
- C:\Windows\System\RHJaDcY.exe
  C:\Windows\System\RHJaDcY.exe
  2⤵
  PID:9584
- C:\Windows\System\qVpTrSG.exe
  C:\Windows\System\qVpTrSG.exe
  2⤵
  PID:7264
- C:\Windows\System\ywzOjBV.exe
  C:\Windows\System\ywzOjBV.exe
  2⤵
  PID:6804
- C:\Windows\System\OdWzJIa.exe
  C:\Windows\System\OdWzJIa.exe
  2⤵
  PID:8280
- C:\Windows\System\QHMoTFF.exe
  C:\Windows\System\QHMoTFF.exe
  2⤵
  PID:11272
- C:\Windows\System\AnTUsGF.exe
  C:\Windows\System\AnTUsGF.exe
  2⤵
  PID:11296
- C:\Windows\System\PKmYgJL.exe
  C:\Windows\System\PKmYgJL.exe
  2⤵
  PID:11312
- C:\Windows\System\dwWhJXB.exe
  C:\Windows\System\dwWhJXB.exe
  2⤵
  PID:11344
- C:\Windows\System\PjNSxFI.exe
  C:\Windows\System\PjNSxFI.exe
  2⤵
  PID:11372
- C:\Windows\System\jlxMBua.exe
  C:\Windows\System\jlxMBua.exe
  2⤵
  PID:11400
- C:\Windows\System\lWUaLfK.exe
  C:\Windows\System\lWUaLfK.exe
  2⤵
  PID:11420
- C:\Windows\System\lXhzXFS.exe
  C:\Windows\System\lXhzXFS.exe
  2⤵
  PID:11460
- C:\Windows\System\LqEKBxr.exe
  C:\Windows\System\LqEKBxr.exe
  2⤵
  PID:11480
- C:\Windows\System\PqxsHpK.exe
  C:\Windows\System\PqxsHpK.exe
  2⤵
  PID:11504
- C:\Windows\System\GwuPlEC.exe
  C:\Windows\System\GwuPlEC.exe
  2⤵
  PID:11532
- C:\Windows\System\AzhwXhv.exe
  C:\Windows\System\AzhwXhv.exe
  2⤵
  PID:11552
- C:\Windows\System\AtApPiH.exe
  C:\Windows\System\AtApPiH.exe
  2⤵
  PID:11580
- C:\Windows\System\sOUsxyv.exe
  C:\Windows\System\sOUsxyv.exe
  2⤵
  PID:11608
- C:\Windows\System\mPUWmwp.exe
  C:\Windows\System\mPUWmwp.exe
  2⤵
  PID:11636
- C:\Windows\System\GNRQPCP.exe
  C:\Windows\System\GNRQPCP.exe
  2⤵
  PID:11660
- C:\Windows\System\pkMiVNX.exe
  C:\Windows\System\pkMiVNX.exe
  2⤵
  PID:11688
- C:\Windows\System\LCEIpvf.exe
  C:\Windows\System\LCEIpvf.exe
  2⤵
  PID:11708
- C:\Windows\System\DznlIZr.exe
  C:\Windows\System\DznlIZr.exe
  2⤵
  PID:11732
- C:\Windows\System\RLSgEoS.exe
  C:\Windows\System\RLSgEoS.exe
  2⤵
  PID:11748
- C:\Windows\System\HGbhjBw.exe
  C:\Windows\System\HGbhjBw.exe
  2⤵
  PID:11768
- C:\Windows\System\BZPoJIq.exe
  C:\Windows\System\BZPoJIq.exe
  2⤵
  PID:11792
- C:\Windows\System\ZVoSOPb.exe
  C:\Windows\System\ZVoSOPb.exe
  2⤵
  PID:11816
- C:\Windows\System\yiAVqbc.exe
  C:\Windows\System\yiAVqbc.exe
  2⤵
  PID:11836
- C:\Windows\System\QpzAndo.exe
  C:\Windows\System\QpzAndo.exe
  2⤵
  PID:11864
- C:\Windows\System\lrKJSvO.exe
  C:\Windows\System\lrKJSvO.exe
  2⤵
  PID:11888
- C:\Windows\System\MSGdXwk.exe
  C:\Windows\System\MSGdXwk.exe
  2⤵
  PID:11912
- C:\Windows\System\hlCineP.exe
  C:\Windows\System\hlCineP.exe
  2⤵
  PID:11936
- C:\Windows\System\QGXKScx.exe
  C:\Windows\System\QGXKScx.exe
  2⤵
  PID:11952
- C:\Windows\System\uAOlmYe.exe
  C:\Windows\System\uAOlmYe.exe
  2⤵
  PID:11980
- C:\Windows\System\HQqMggS.exe
  C:\Windows\System\HQqMggS.exe
  2⤵
  PID:12008
- C:\Windows\System\xGYQnMY.exe
  C:\Windows\System\xGYQnMY.exe
  2⤵
  PID:12052
- C:\Windows\System\RnfxCmh.exe
  C:\Windows\System\RnfxCmh.exe
  2⤵
  PID:12072
- C:\Windows\System\tURkNcz.exe
  C:\Windows\System\tURkNcz.exe
  2⤵
  PID:12088
- C:\Windows\System\lhAgYuQ.exe
  C:\Windows\System\lhAgYuQ.exe
  2⤵
  PID:12108
- C:\Windows\System\UwrWPOh.exe
  C:\Windows\System\UwrWPOh.exe
  2⤵
  PID:12144
- C:\Windows\System\EhSRaqE.exe
  C:\Windows\System\EhSRaqE.exe
  2⤵
  PID:12212
- C:\Windows\System\dBGtbDo.exe
  C:\Windows\System\dBGtbDo.exe
  2⤵
  PID:12228
- C:\Windows\System\oGorCDe.exe
  C:\Windows\System\oGorCDe.exe
  2⤵
  PID:12252
- C:\Windows\System\zmyCALr.exe
  C:\Windows\System\zmyCALr.exe
  2⤵
  PID:12272
- C:\Windows\System\SMrjddf.exe
  C:\Windows\System\SMrjddf.exe
  2⤵
  PID:7736
- C:\Windows\System\BbtHBMD.exe
  C:\Windows\System\BbtHBMD.exe
  2⤵
  PID:6908
- C:\Windows\System\pXLWIrl.exe
  C:\Windows\System\pXLWIrl.exe
  2⤵
  PID:10176
- C:\Windows\System\jOIUJBR.exe
  C:\Windows\System\jOIUJBR.exe
  2⤵
  PID:10312
- C:\Windows\System\zmKEaCC.exe
  C:\Windows\System\zmKEaCC.exe
  2⤵
  PID:10376
- C:\Windows\System\DNxVTbW.exe
  C:\Windows\System\DNxVTbW.exe
  2⤵
  PID:10580
- C:\Windows\System\gDcdosW.exe
  C:\Windows\System\gDcdosW.exe
  2⤵
  PID:10616
- C:\Windows\System\pUTGmbQ.exe
  C:\Windows\System\pUTGmbQ.exe
  2⤵
  PID:9612
- C:\Windows\System\RyXgjfW.exe
  C:\Windows\System\RyXgjfW.exe
  2⤵
  PID:9708
- C:\Windows\System\HoprOWm.exe
  C:\Windows\System\HoprOWm.exe
  2⤵
  PID:9836
- C:\Windows\System\RnqJsPY.exe
  C:\Windows\System\RnqJsPY.exe
  2⤵
  PID:1736
- C:\Windows\System\hRSWqYT.exe
  C:\Windows\System\hRSWqYT.exe
  2⤵
  PID:4956
- C:\Windows\System\gmwIdED.exe
  C:\Windows\System\gmwIdED.exe
  2⤵
  PID:6248
- C:\Windows\System\EFOFBMd.exe
  C:\Windows\System\EFOFBMd.exe
  2⤵
  PID:5100
- C:\Windows\System\fQYSpch.exe
  C:\Windows\System\fQYSpch.exe
  2⤵
  PID:9688
- C:\Windows\System\SjObmqp.exe
  C:\Windows\System\SjObmqp.exe
  2⤵
  PID:9744
- C:\Windows\System\nQbhGaD.exe
  C:\Windows\System\nQbhGaD.exe
  2⤵
  PID:9788
- C:\Windows\System\ktaNlMQ.exe
  C:\Windows\System\ktaNlMQ.exe
  2⤵
  PID:9840
- C:\Windows\System\UVkPvyI.exe
  C:\Windows\System\UVkPvyI.exe
  2⤵
  PID:10916
- C:\Windows\System\MzANCMZ.exe
  C:\Windows\System\MzANCMZ.exe
  2⤵
  PID:8288
- C:\Windows\System\Lvhuqca.exe
  C:\Windows\System\Lvhuqca.exe
  2⤵
  PID:11192
- C:\Windows\System\FRxqNiU.exe
  C:\Windows\System\FRxqNiU.exe
  2⤵
  PID:8724
- C:\Windows\System\ubQeIRn.exe
  C:\Windows\System\ubQeIRn.exe
  2⤵
  PID:7088
- C:\Windows\System\okltSOe.exe
  C:\Windows\System\okltSOe.exe
  2⤵
  PID:10136
- C:\Windows\System\CiYmCsV.exe
  C:\Windows\System\CiYmCsV.exe
  2⤵
  PID:9364
- C:\Windows\System\rIbmaYl.exe
  C:\Windows\System\rIbmaYl.exe
  2⤵
  PID:7000
- C:\Windows\System\MDYBthy.exe
  C:\Windows\System\MDYBthy.exe
  2⤵
  PID:8304
- C:\Windows\System\QLcfRCu.exe
  C:\Windows\System\QLcfRCu.exe
  2⤵
  PID:11268
- C:\Windows\System\UeaDLid.exe
  C:\Windows\System\UeaDLid.exe
  2⤵
  PID:7692
- C:\Windows\System\OyBeejl.exe
  C:\Windows\System\OyBeejl.exe
  2⤵
  PID:12312
- C:\Windows\System\XjwIepK.exe
  C:\Windows\System\XjwIepK.exe
  2⤵
  PID:12336
- C:\Windows\System\xoknKSQ.exe
  C:\Windows\System\xoknKSQ.exe
  2⤵
  PID:12360
- C:\Windows\System\kHcfTJM.exe
  C:\Windows\System\kHcfTJM.exe
  2⤵
  PID:12384
- C:\Windows\System\MVZIolM.exe
  C:\Windows\System\MVZIolM.exe
  2⤵
  PID:12408
- C:\Windows\System\qvrPZhG.exe
  C:\Windows\System\qvrPZhG.exe
  2⤵
  PID:12432
- C:\Windows\System\xPzhPli.exe
  C:\Windows\System\xPzhPli.exe
  2⤵
  PID:12456
- C:\Windows\System\uSjgmZZ.exe
  C:\Windows\System\uSjgmZZ.exe
  2⤵
  PID:12484
- C:\Windows\System\XLzrOOY.exe
  C:\Windows\System\XLzrOOY.exe
  2⤵
  PID:12500
- C:\Windows\System\CSMFobT.exe
  C:\Windows\System\CSMFobT.exe
  2⤵
  PID:12524
- C:\Windows\System\nGbfrGC.exe
  C:\Windows\System\nGbfrGC.exe
  2⤵
  PID:12548
- C:\Windows\System\JsSvLne.exe
  C:\Windows\System\JsSvLne.exe
  2⤵
  PID:12572
- C:\Windows\System\OgwSdpS.exe
  C:\Windows\System\OgwSdpS.exe
  2⤵
  PID:12596
- C:\Windows\System\VAmYTZA.exe
  C:\Windows\System\VAmYTZA.exe
  2⤵
  PID:12620
- C:\Windows\System\LMLiTkK.exe
  C:\Windows\System\LMLiTkK.exe
  2⤵
  PID:12644
- C:\Windows\System\joeQZcH.exe
  C:\Windows\System\joeQZcH.exe
  2⤵
  PID:12660
- C:\Windows\System\YIaffCh.exe
  C:\Windows\System\YIaffCh.exe
  2⤵
  PID:12684
- C:\Windows\System\IUdLKFo.exe
  C:\Windows\System\IUdLKFo.exe
  2⤵
  PID:12708
- C:\Windows\System\PWEhDsT.exe
  C:\Windows\System\PWEhDsT.exe
  2⤵
  PID:12732
- C:\Windows\System\vGnTLob.exe
  C:\Windows\System\vGnTLob.exe
  2⤵
  PID:12760
- C:\Windows\System\NtzaWcS.exe
  C:\Windows\System\NtzaWcS.exe
  2⤵
  PID:12776
- C:\Windows\System\ntcwvtj.exe
  C:\Windows\System\ntcwvtj.exe
  2⤵
  PID:12800
- C:\Windows\System\EpfGjIt.exe
  C:\Windows\System\EpfGjIt.exe
  2⤵
  PID:12824
- C:\Windows\System\IdzpvgM.exe
  C:\Windows\System\IdzpvgM.exe
  2⤵
  PID:12844
- C:\Windows\System\Whyrivs.exe
  C:\Windows\System\Whyrivs.exe
  2⤵
  PID:12868
- C:\Windows\System\RVsbcQG.exe
  C:\Windows\System\RVsbcQG.exe
  2⤵
  PID:12888
- C:\Windows\System\PhWzVrP.exe
  C:\Windows\System\PhWzVrP.exe
  2⤵
  PID:12908
- C:\Windows\System\OqdkpyA.exe
  C:\Windows\System\OqdkpyA.exe
  2⤵
  PID:12936
- C:\Windows\System\INjQokW.exe
  C:\Windows\System\INjQokW.exe
  2⤵
  PID:12952
- C:\Windows\System\XsVLWyA.exe
  C:\Windows\System\XsVLWyA.exe
  2⤵
  PID:12976
- C:\Windows\System\okYSnAe.exe
  C:\Windows\System\okYSnAe.exe
  2⤵
  PID:13004
- C:\Windows\System\NgdPkFB.exe
  C:\Windows\System\NgdPkFB.exe
  2⤵
  PID:13024
- C:\Windows\System\ixLnwEG.exe
  C:\Windows\System\ixLnwEG.exe
  2⤵
  PID:13044
- C:\Windows\System\eZXPWKe.exe
  C:\Windows\System\eZXPWKe.exe
  2⤵
  PID:13068
- C:\Windows\System\NdBZCKS.exe
  C:\Windows\System\NdBZCKS.exe
  2⤵
  PID:13092
- C:\Windows\System\YOiilQJ.exe
  C:\Windows\System\YOiilQJ.exe
  2⤵
  PID:13116
- C:\Windows\System\tlGClvS.exe
  C:\Windows\System\tlGClvS.exe
  2⤵
  PID:13132
- C:\Windows\System\wuhShKs.exe
  C:\Windows\System\wuhShKs.exe
  2⤵
  PID:13148
- C:\Windows\System\GmgNBdD.exe
  C:\Windows\System\GmgNBdD.exe
  2⤵
  PID:13180
- C:\Windows\System\jJWBcFN.exe
  C:\Windows\System\jJWBcFN.exe
  2⤵
  PID:13196
- C:\Windows\System\HjAaqKj.exe
  C:\Windows\System\HjAaqKj.exe
  2⤵
  PID:13216
- C:\Windows\System\qtcDJGp.exe
  C:\Windows\System\qtcDJGp.exe
  2⤵
  PID:13240
- C:\Windows\System\uKfqvdG.exe
  C:\Windows\System\uKfqvdG.exe
  2⤵
  PID:13260
- C:\Windows\System\nNKxYuz.exe
  C:\Windows\System\nNKxYuz.exe
  2⤵
  PID:13280
- C:\Windows\System\qLfSmdB.exe
  C:\Windows\System\qLfSmdB.exe
  2⤵
  PID:13296
- C:\Windows\System\MKADdpd.exe
  C:\Windows\System\MKADdpd.exe
  2⤵
  PID:11412
- C:\Windows\System\hdwHIzN.exe
  C:\Windows\System\hdwHIzN.exe
  2⤵
  PID:8828
- C:\Windows\System\oYwdZaL.exe
  C:\Windows\System\oYwdZaL.exe
  2⤵
  PID:9768
- C:\Windows\System\wcEitGq.exe
  C:\Windows\System\wcEitGq.exe
  2⤵
  PID:12464
- C:\Windows\System\BxGEdMY.exe
  C:\Windows\System\BxGEdMY.exe
  2⤵
  PID:11680
- C:\Windows\System\IHfgxpA.exe
  C:\Windows\System\IHfgxpA.exe
  2⤵
  PID:9568
- C:\Windows\System\przzjZc.exe
  C:\Windows\System\przzjZc.exe
  2⤵
  PID:6172
- C:\Windows\System\QvhciAD.exe
  C:\Windows\System\QvhciAD.exe
  2⤵
  PID:13140
- C:\Windows\System\tgSlMLX.exe
  C:\Windows\System\tgSlMLX.exe
  2⤵
  PID:12692
- C:\Windows\System\SZlkSMT.exe
  C:\Windows\System\SZlkSMT.exe
  2⤵
  PID:10832
- C:\Windows\System\UGryxsM.exe
  C:\Windows\System\UGryxsM.exe
  2⤵
  PID:10940
- C:\Windows\System\twcTDbE.exe
  C:\Windows\System\twcTDbE.exe
  2⤵
  PID:12060
- C:\Windows\System\ZlCTQeK.exe
  C:\Windows\System\ZlCTQeK.exe
  2⤵
  PID:12128
- C:\Windows\System\vLtfTlZ.exe
  C:\Windows\System\vLtfTlZ.exe
  2⤵
  PID:8644
- C:\Windows\System\eOmBrBi.exe
  C:\Windows\System\eOmBrBi.exe
  2⤵
  PID:11448
- C:\Windows\System\erLFfGK.exe
  C:\Windows\System\erLFfGK.exe
  2⤵
  PID:12000
- C:\Windows\System\aRosxsc.exe
  C:\Windows\System\aRosxsc.exe
  2⤵
  PID:11476
- C:\Windows\System\YGMbEru.exe
  C:\Windows\System\YGMbEru.exe
  2⤵
  PID:12448
- C:\Windows\System\plVBQuF.exe
  C:\Windows\System\plVBQuF.exe
  2⤵
  PID:4900
- C:\Windows\System\NBvVkrm.exe
  C:\Windows\System\NBvVkrm.exe
  2⤵
  PID:8380
- C:\Windows\System\hcNoenh.exe
  C:\Windows\System\hcNoenh.exe
  2⤵
  PID:12852
- C:\Windows\System\HdjNHpc.exe
  C:\Windows\System\HdjNHpc.exe
  2⤵
  PID:10708
- C:\Windows\System\IvoCbif.exe
  C:\Windows\System\IvoCbif.exe
  2⤵
  PID:9172
- C:\Windows\System\IdQXgNs.exe
  C:\Windows\System\IdQXgNs.exe
  2⤵
  PID:8248
- C:\Windows\System\fHYfEKO.exe
  C:\Windows\System\fHYfEKO.exe
  2⤵
  PID:12928
- C:\Windows\System\uJTycOz.exe
  C:\Windows\System\uJTycOz.exe
  2⤵
  PID:9780
- C:\Windows\System\ghyFSDY.exe
  C:\Windows\System\ghyFSDY.exe
  2⤵
  PID:11788
- C:\Windows\System\dVzSUGs.exe
  C:\Windows\System\dVzSUGs.exe
  2⤵
  PID:11128
- C:\Windows\System\pwwqmoR.exe
  C:\Windows\System\pwwqmoR.exe
  2⤵
  PID:12540
- C:\Windows\System\pNDgUNQ.exe
  C:\Windows\System\pNDgUNQ.exe
  2⤵
  PID:2740
- C:\Windows\System\eCKtrkf.exe
  C:\Windows\System\eCKtrkf.exe
  2⤵
  PID:13124
- C:\Windows\System\HfqZvPG.exe
  C:\Windows\System\HfqZvPG.exe
  2⤵
  PID:4860
- C:\Windows\System\Mezekih.exe
  C:\Windows\System\Mezekih.exe
  2⤵
  PID:11696
- C:\Windows\System\oHkpBvA.exe
  C:\Windows\System\oHkpBvA.exe
  2⤵
  PID:1444
- C:\Windows\System\mzZnmSA.exe
  C:\Windows\System\mzZnmSA.exe
  2⤵
  PID:8668
- C:\Windows\System\uscFMmX.exe
  C:\Windows\System\uscFMmX.exe
  2⤵
  PID:11948
- C:\Windows\System\helolEA.exe
  C:\Windows\System\helolEA.exe
  2⤵
  PID:1136
- C:\Windows\System\maAxfTk.exe
  C:\Windows\System\maAxfTk.exe
  2⤵
  PID:12808
- C:\Windows\System\DDEeWTH.exe
  C:\Windows\System\DDEeWTH.exe
  2⤵
  PID:8448
- C:\Windows\System\pxQpDMH.exe
  C:\Windows\System\pxQpDMH.exe
  2⤵
  PID:5644
- C:\Windows\System\FcQWGyM.exe
  C:\Windows\System\FcQWGyM.exe
  2⤵
  PID:6572
- C:\Windows\System\SqTwzYK.exe
  C:\Windows\System\SqTwzYK.exe
  2⤵
  PID:10600
- C:\Windows\System\ehWHzcV.exe
  C:\Windows\System\ehWHzcV.exe
  2⤵
  PID:12836
- C:\Windows\System\AonSOSt.exe
  C:\Windows\System\AonSOSt.exe
  2⤵
  PID:10336
- C:\Windows\System\itQSlZk.exe
  C:\Windows\System\itQSlZk.exe
  2⤵
  PID:11560
- C:\Windows\System\BAwdIkP.exe
  C:\Windows\System\BAwdIkP.exe
  2⤵
  PID:7792
- C:\Windows\System\OAgOmof.exe
  C:\Windows\System\OAgOmof.exe
  2⤵
  PID:10124
- C:\Windows\System\cpCYsnJ.exe
  C:\Windows\System\cpCYsnJ.exe
  2⤵
  PID:10948
- C:\Windows\System\gcjCKeA.exe
  C:\Windows\System\gcjCKeA.exe
  2⤵
  PID:11108
- C:\Windows\System\lQEIkvD.exe
  C:\Windows\System\lQEIkvD.exe
  2⤵
  PID:10820
- C:\Windows\System\ZeeIrQY.exe
  C:\Windows\System\ZeeIrQY.exe
  2⤵
  PID:8648
- C:\Windows\System\aBtAABa.exe
  C:\Windows\System\aBtAABa.exe
  2⤵
  PID:12508
- C:\Windows\System\wMNmoys.exe
  C:\Windows\System\wMNmoys.exe
  2⤵
  PID:11544
- C:\Windows\System\OdyCJpS.exe
  C:\Windows\System\OdyCJpS.exe
  2⤵
  PID:11644
- C:\Windows\System\TWVJtwC.exe
  C:\Windows\System\TWVJtwC.exe
  2⤵
  PID:12328
- C:\Windows\System\wvDZYCu.exe
  C:\Windows\System\wvDZYCu.exe
  2⤵
  PID:11928
- C:\Windows\System\uSLfMeL.exe
  C:\Windows\System\uSLfMeL.exe
  2⤵
  PID:6072
- C:\Windows\System\AwHHobu.exe
  C:\Windows\System\AwHHobu.exe
  2⤵
  PID:11812
- C:\Windows\System\VXLyOPG.exe
  C:\Windows\System\VXLyOPG.exe
  2⤵
  PID:12324
- C:\Windows\System\hGXbfrk.exe
  C:\Windows\System\hGXbfrk.exe
  2⤵
  PID:13036
- C:\Windows\System\KWiOTdp.exe
  C:\Windows\System\KWiOTdp.exe
  2⤵
  PID:10276
- C:\Windows\System\wZHhScb.exe
  C:\Windows\System\wZHhScb.exe
  2⤵
  PID:12356
- C:\Windows\System\klnOgTb.exe
  C:\Windows\System\klnOgTb.exe
  2⤵
  PID:13288
- C:\Windows\System\UbvurVv.exe
  C:\Windows\System\UbvurVv.exe
  2⤵
  PID:4832
- C:\Windows\System\LiDpsQz.exe
  C:\Windows\System\LiDpsQz.exe
  2⤵
  PID:10024
- C:\Windows\System\hrpxOdA.exe
  C:\Windows\System\hrpxOdA.exe
  2⤵
  PID:12696
- C:\Windows\System\lAGWtmA.exe
  C:\Windows\System\lAGWtmA.exe
  2⤵
  PID:11992
- C:\Windows\System\VOAABDL.exe
  C:\Windows\System\VOAABDL.exe
  2⤵
  PID:3040
- C:\Windows\System\vIYAWuI.exe
  C:\Windows\System\vIYAWuI.exe
  2⤵
  PID:13228
- C:\Windows\System\hrkctPh.exe
  C:\Windows\System\hrkctPh.exe
  2⤵
  PID:12880
- C:\Windows\System\HDXcCAS.exe
  C:\Windows\System\HDXcCAS.exe
  2⤵
  PID:5148
- C:\Windows\System\XaTJOom.exe
  C:\Windows\System\XaTJOom.exe
  2⤵
  PID:556
- C:\Windows\System\zIeVZMm.exe
  C:\Windows\System\zIeVZMm.exe
  2⤵
  PID:11628
- C:\Windows\System\OnkXqxY.exe
  C:\Windows\System\OnkXqxY.exe
  2⤵
  PID:1804
- C:\Windows\System\HqiLgPd.exe
  C:\Windows\System\HqiLgPd.exe
  2⤵
  PID:8124
- C:\Windows\System\QBnzAJb.exe
  C:\Windows\System\QBnzAJb.exe
  2⤵
  PID:11088
- C:\Windows\System\EJJhWUc.exe
  C:\Windows\System\EJJhWUc.exe
  2⤵
  PID:11064
- C:\Windows\System\jSmejiu.exe
  C:\Windows\System\jSmejiu.exe
  2⤵
  PID:11320
- C:\Windows\System\vQSPSlx.exe
  C:\Windows\System\vQSPSlx.exe
  2⤵
  PID:12468
- C:\Windows\System\UwOSnee.exe
  C:\Windows\System\UwOSnee.exe
  2⤵
  PID:12792
- C:\Windows\System\kukORnS.exe
  C:\Windows\System\kukORnS.exe
  2⤵
  PID:2540
- C:\Windows\System\fdAqMos.exe
  C:\Windows\System\fdAqMos.exe
  2⤵
  PID:10924
- C:\Windows\System\USjcSur.exe
  C:\Windows\System\USjcSur.exe
  2⤵
  PID:13252
- C:\Windows\System\fgCDDwG.exe
  C:\Windows\System\fgCDDwG.exe
  2⤵
  PID:4080
- C:\Windows\System\dzlkGuR.exe
  C:\Windows\System\dzlkGuR.exe
  2⤵
  PID:10900
- C:\Windows\System\OAOZPaU.exe
  C:\Windows\System\OAOZPaU.exe
  2⤵
  PID:5840
- C:\Windows\System\BbRzOwH.exe
  C:\Windows\System\BbRzOwH.exe
  2⤵
  PID:3464
- C:\Windows\System\HsiWKsX.exe
  C:\Windows\System\HsiWKsX.exe
  2⤵
  PID:2096
- C:\Windows\System\ggSDpIe.exe
  C:\Windows\System\ggSDpIe.exe
  2⤵
  PID:8308
- C:\Windows\System\xZwrgeI.exe
  C:\Windows\System\xZwrgeI.exe
  2⤵
  PID:224
- C:\Windows\System\eWNUpGx.exe
  C:\Windows\System\eWNUpGx.exe
  2⤵
  PID:2632
- C:\Windows\System\GFbIdcB.exe
  C:\Windows\System\GFbIdcB.exe
  2⤵
  PID:9124
- C:\Windows\System\XnVLQSj.exe
  C:\Windows\System\XnVLQSj.exe
  2⤵
  PID:1888
- C:\Windows\System\QXHgrcW.exe
  C:\Windows\System\QXHgrcW.exe
  2⤵
  PID:13352
- C:\Windows\System\JTDBugQ.exe
  C:\Windows\System\JTDBugQ.exe
  2⤵
  PID:13380
- C:\Windows\System\oKDrHvV.exe
  C:\Windows\System\oKDrHvV.exe
  2⤵
  PID:13404
- C:\Windows\System\KIoIRSz.exe
  C:\Windows\System\KIoIRSz.exe
  2⤵
  PID:13464
- C:\Windows\System\aDDwptZ.exe
  C:\Windows\System\aDDwptZ.exe
  2⤵
  PID:13508
- C:\Windows\System\vNjlfpW.exe
  C:\Windows\System\vNjlfpW.exe
  2⤵
  PID:13552
- C:\Windows\System\HINvbpK.exe
  C:\Windows\System\HINvbpK.exe
  2⤵
  PID:13652
- C:\Windows\System\RyiAosy.exe
  C:\Windows\System\RyiAosy.exe
  2⤵
  PID:13668
- C:\Windows\System\PERyqjL.exe
  C:\Windows\System\PERyqjL.exe
  2⤵
  PID:13720
- C:\Windows\System\KYpPaUU.exe
  C:\Windows\System\KYpPaUU.exe
  2⤵
  PID:13744
- C:\Windows\System\UMOJVSv.exe
  C:\Windows\System\UMOJVSv.exe
  2⤵
  PID:13884
- C:\Windows\System\ulQumZa.exe
  C:\Windows\System\ulQumZa.exe
  2⤵
  PID:13900
- C:\Windows\System\SvzbRff.exe
  C:\Windows\System\SvzbRff.exe
  2⤵
  PID:13924
- C:\Windows\System\FifnuVQ.exe
  C:\Windows\System\FifnuVQ.exe
  2⤵
  PID:14196
- C:\Windows\System\SNmugce.exe
  C:\Windows\System\SNmugce.exe
  2⤵
  PID:13800
- C:\Windows\System\bimTDWy.exe
  C:\Windows\System\bimTDWy.exe
  2⤵
  PID:13156
- C:\Windows\System\WHzmpIE.exe
  C:\Windows\System\WHzmpIE.exe
  2⤵
  PID:13940
- C:\Windows\System\wHudYEt.exe
  C:\Windows\System\wHudYEt.exe
  2⤵
  PID:11188
- C:\Windows\System\xScxnvJ.exe
  C:\Windows\System\xScxnvJ.exe
  2⤵
  PID:3356
- C:\Windows\System\uiMjsLh.exe
  C:\Windows\System\uiMjsLh.exe
  2⤵
  PID:13868
- C:\Windows\System\lPQrAlX.exe
  C:\Windows\System\lPQrAlX.exe
  2⤵
  PID:13856
- C:\Windows\System\ezKSWCx.exe
  C:\Windows\System\ezKSWCx.exe
  2⤵
  PID:13988
- C:\Windows\System\OYqFQLJ.exe
  C:\Windows\System\OYqFQLJ.exe
  2⤵
  PID:14016
- C:\Windows\System\iWwaOxj.exe
  C:\Windows\System\iWwaOxj.exe
  2⤵
  PID:14052
- C:\Windows\System\yvEEiVk.exe
  C:\Windows\System\yvEEiVk.exe
  2⤵
  PID:14096
- C:\Windows\System\hTCMoZk.exe
  C:\Windows\System\hTCMoZk.exe
  2⤵
  PID:14128
- C:\Windows\System\yovsnrT.exe
  C:\Windows\System\yovsnrT.exe
  2⤵
  PID:14168
- C:\Windows\System\FSMHADr.exe
  C:\Windows\System\FSMHADr.exe
  2⤵
  PID:14224
- C:\Windows\System\FBFIXTT.exe
  C:\Windows\System\FBFIXTT.exe
  2⤵
  PID:14280
- C:\Windows\System\yHfebDa.exe
  C:\Windows\System\yHfebDa.exe
  2⤵
  PID:14288
- C:\Windows\System\NGMfQDe.exe
  C:\Windows\System\NGMfQDe.exe
  2⤵
  PID:4760
- C:\Windows\System\PnpeOiu.exe
  C:\Windows\System\PnpeOiu.exe
  2⤵
  PID:2844
- C:\Windows\System\mwvLXxb.exe
  C:\Windows\System\mwvLXxb.exe
  2⤵
  PID:7304
- C:\Windows\System\PtiqXfM.exe
  C:\Windows\System\PtiqXfM.exe
  2⤵
  PID:12472
- C:\Windows\System\wGJNfNT.exe
  C:\Windows\System\wGJNfNT.exe
  2⤵
  PID:4836
- C:\Windows\System\BnURQRW.exe
  C:\Windows\System\BnURQRW.exe
  2⤵
  PID:5144
- C:\Windows\System\srIdqcy.exe
  C:\Windows\System\srIdqcy.exe
  2⤵
  PID:3348
- C:\Windows\System\yaUxABD.exe
  C:\Windows\System\yaUxABD.exe
  2⤵
  PID:4412
- C:\Windows\System\kdIBVTE.exe
  C:\Windows\System\kdIBVTE.exe
  2⤵
  PID:13484
- C:\Windows\System\vsqVkWl.exe
  C:\Windows\System\vsqVkWl.exe
  2⤵
  PID:13428
- C:\Windows\System\xDNdtuW.exe
  C:\Windows\System\xDNdtuW.exe
  2⤵
  PID:13616
- C:\Windows\System\RdrnDkw.exe
  C:\Windows\System\RdrnDkw.exe
  2⤵
  PID:13704
- C:\Windows\System\LFtCuXP.exe
  C:\Windows\System\LFtCuXP.exe
  2⤵
  PID:13712
- C:\Windows\System\lyzWahv.exe
  C:\Windows\System\lyzWahv.exe
  2⤵
  PID:13768
- C:\Windows\System\woGSUjD.exe
  C:\Windows\System\woGSUjD.exe
  2⤵
  PID:3264
- C:\Windows\System\kVdpkmV.exe
  C:\Windows\System\kVdpkmV.exe
  2⤵
  PID:13812
- C:\Windows\System\AfKoPbi.exe
  C:\Windows\System\AfKoPbi.exe
  2⤵
  PID:2512
- C:\Windows\System\JpGlKfy.exe
  C:\Windows\System\JpGlKfy.exe
  2⤵
  PID:2320
- C:\Windows\System\XMdcSoy.exe
  C:\Windows\System\XMdcSoy.exe
  2⤵
  PID:13716
- C:\Windows\System\fpZdbuN.exe
  C:\Windows\System\fpZdbuN.exe
  2⤵
  PID:14012
- C:\Windows\System\EWPuRDJ.exe
  C:\Windows\System\EWPuRDJ.exe
  2⤵
  PID:5564
- C:\Windows\System\SixKgip.exe
  C:\Windows\System\SixKgip.exe
  2⤵
  PID:14024
- C:\Windows\System\RtMPipl.exe
  C:\Windows\System\RtMPipl.exe
  2⤵
  PID:14156
- C:\Windows\System\vKVrgYN.exe
  C:\Windows\System\vKVrgYN.exe
  2⤵
  PID:14072
- C:\Windows\System\krSejnW.exe
  C:\Windows\System\krSejnW.exe
  2⤵
  PID:14132
- C:\Windows\System\MGafrtk.exe
  C:\Windows\System\MGafrtk.exe
  2⤵
  PID:3196
- C:\Windows\System\yEKTpmV.exe
  C:\Windows\System\yEKTpmV.exe
  2⤵
  PID:2816
- C:\Windows\System\ExsgcvD.exe
  C:\Windows\System\ExsgcvD.exe
  2⤵
  PID:8840
- C:\Windows\System\TjsJuzt.exe
  C:\Windows\System\TjsJuzt.exe
  2⤵
  PID:5220
- C:\Windows\System\mfazARx.exe
  C:\Windows\System\mfazARx.exe
  2⤵
  PID:14328
- C:\Windows\System\CzPPKzs.exe
  C:\Windows\System\CzPPKzs.exe
  2⤵
  PID:1512
- C:\Windows\System\caurnfp.exe
  C:\Windows\System\caurnfp.exe
  2⤵
  PID:5092
- C:\Windows\System\uByTexq.exe
  C:\Windows\System\uByTexq.exe
  2⤵
  PID:908
- C:\Windows\System\EWNXwOY.exe
  C:\Windows\System\EWNXwOY.exe
  2⤵
  PID:440
- C:\Windows\System\nDgOwSx.exe
  C:\Windows\System\nDgOwSx.exe
  2⤵
  PID:1232
- C:\Windows\System\LeFdPjF.exe
  C:\Windows\System\LeFdPjF.exe
  2⤵
  PID:13504
- C:\Windows\System\lzETDZN.exe
  C:\Windows\System\lzETDZN.exe
  2⤵
  PID:13548
- C:\Windows\System\qORotNt.exe
  C:\Windows\System\qORotNt.exe
  2⤵
  PID:4056
- C:\Windows\System\gVHThvu.exe
  C:\Windows\System\gVHThvu.exe
  2⤵
  PID:13612
- C:\Windows\System\JcTMohl.exe
  C:\Windows\System\JcTMohl.exe
  2⤵
  PID:13636
- C:\Windows\System\gAzGPBu.exe
  C:\Windows\System\gAzGPBu.exe
  2⤵
  PID:2732
- C:\Windows\System\gbtUonl.exe
  C:\Windows\System\gbtUonl.exe
  2⤵
  PID:2544
- C:\Windows\System\uQYrsKL.exe
  C:\Windows\System\uQYrsKL.exe
  2⤵
  PID:3012
- C:\Windows\System\krchHSg.exe
  C:\Windows\System\krchHSg.exe
  2⤵
  PID:3864
- C:\Windows\System\FydQWdi.exe
  C:\Windows\System\FydQWdi.exe
  2⤵
  PID:3988
- C:\Windows\System\VmYmGNq.exe
  C:\Windows\System\VmYmGNq.exe
  2⤵
  PID:4960
- C:\Windows\System\zOVBhWP.exe
  C:\Windows\System\zOVBhWP.exe
  2⤵
  PID:13880
- C:\Windows\System\prsTnHj.exe
  C:\Windows\System\prsTnHj.exe
  2⤵
  PID:6120
- C:\Windows\System\AEXXBaP.exe
  C:\Windows\System\AEXXBaP.exe
  2⤵
  PID:6512
- C:\Windows\System\aGRiovw.exe
  C:\Windows\System\aGRiovw.exe
  2⤵
  PID:3540
- C:\Windows\System\DMDLkZE.exe
  C:\Windows\System\DMDLkZE.exe
  2⤵
  PID:5652
- C:\Windows\System\mvATPOH.exe
  C:\Windows\System\mvATPOH.exe
  2⤵
  PID:5284
- C:\Windows\System\AaeKQJH.exe
  C:\Windows\System\AaeKQJH.exe
  2⤵
  PID:13916
- C:\Windows\System\kxcZqxz.exe
  C:\Windows\System\kxcZqxz.exe
  2⤵
  PID:6416
- C:\Windows\System\JGeVPHt.exe
  C:\Windows\System\JGeVPHt.exe
  2⤵
  PID:13996
- C:\Windows\System\buyuBFb.exe
  C:\Windows\System\buyuBFb.exe
  2⤵
  PID:3912
- C:\Windows\System\AyxYZIp.exe
  C:\Windows\System\AyxYZIp.exe
  2⤵
  PID:6660
- C:\Windows\System\hMXgnMU.exe
  C:\Windows\System\hMXgnMU.exe
  2⤵
  PID:5276
- C:\Windows\System\arWRUcV.exe
  C:\Windows\System\arWRUcV.exe
  2⤵
  PID:7192
- C:\Windows\System\CPApirN.exe
  C:\Windows\System\CPApirN.exe
  2⤵
  PID:14028
- C:\Windows\System\AbAZbCi.exe
  C:\Windows\System\AbAZbCi.exe
  2⤵
  PID:6880
- C:\Windows\System\dSnFoYS.exe
  C:\Windows\System\dSnFoYS.exe
  2⤵
  PID:7376
- C:\Windows\System\JAyCcUT.exe
  C:\Windows\System\JAyCcUT.exe
  2⤵
  PID:1936
- C:\Windows\System\vpONhgx.exe
  C:\Windows\System\vpONhgx.exe
  2⤵
  PID:7392
- C:\Windows\System\qQgtpby.exe
  C:\Windows\System\qQgtpby.exe
  2⤵
  PID:1484
- C:\Windows\System\hUGVbLj.exe
  C:\Windows\System\hUGVbLj.exe
  2⤵
  PID:5304
- C:\Windows\System\eOOkRiq.exe
  C:\Windows\System\eOOkRiq.exe
  2⤵
  PID:2012
- C:\Windows\System\VgSddHk.exe
  C:\Windows\System\VgSddHk.exe
  2⤵
  PID:4656
- C:\Windows\System\FWKBPJL.exe
  C:\Windows\System\FWKBPJL.exe
  2⤵
  PID:2804
- C:\Windows\System\XtetWQb.exe
  C:\Windows\System\XtetWQb.exe
  2⤵
  PID:2548
- C:\Windows\System\BNLwNSC.exe
  C:\Windows\System\BNLwNSC.exe
  2⤵
  PID:3968
- C:\Windows\System\NBtPdef.exe
  C:\Windows\System\NBtPdef.exe
  2⤵
  PID:7476
- C:\Windows\System\KkOLjrI.exe
  C:\Windows\System\KkOLjrI.exe
  2⤵
  PID:5544
- C:\Windows\System\iJAhGym.exe
  C:\Windows\System\iJAhGym.exe
  2⤵
  PID:2856
- C:\Windows\System\QQxeyoN.exe
  C:\Windows\System\QQxeyoN.exe
  2⤵
  PID:13740
- C:\Windows\System\MraVMfW.exe
  C:\Windows\System\MraVMfW.exe
  2⤵
  PID:4880
- C:\Windows\System\EmpTbbt.exe
  C:\Windows\System\EmpTbbt.exe
  2⤵
  PID:776
- C:\Windows\System\tGKWWhG.exe
  C:\Windows\System\tGKWWhG.exe
  2⤵
  PID:716
- C:\Windows\System\NVnrvwX.exe
  C:\Windows\System\NVnrvwX.exe
  2⤵
  PID:6480
- C:\Windows\System\VKDCDEc.exe
  C:\Windows\System\VKDCDEc.exe
  2⤵
  PID:13976
- C:\Windows\System\eHOKlfm.exe
  C:\Windows\System\eHOKlfm.exe
  2⤵
  PID:4748
- C:\Windows\System\FbwSpiQ.exe
  C:\Windows\System\FbwSpiQ.exe
  2⤵
  PID:8520
- C:\Windows\System\tuZHaMK.exe
  C:\Windows\System\tuZHaMK.exe
  2⤵
  PID:5440
- C:\Windows\System\ZldwzWm.exe
  C:\Windows\System\ZldwzWm.exe
  2⤵
  PID:7924
- C:\Windows\System\yqHDlFW.exe
  C:\Windows\System\yqHDlFW.exe
  2⤵
  PID:8632
- C:\Windows\System\FKElXgm.exe
  C:\Windows\System\FKElXgm.exe
  2⤵
  PID:8596
- C:\Windows\System\TyOowGE.exe
  C:\Windows\System\TyOowGE.exe
  2⤵
  PID:14080
- C:\Windows\System\qnwgpVE.exe
  C:\Windows\System\qnwgpVE.exe
  2⤵
  PID:14144
- C:\Windows\System\XQmAnDk.exe
  C:\Windows\System\XQmAnDk.exe
  2⤵
  PID:6288
- C:\Windows\System\ikrWgEL.exe
  C:\Windows\System\ikrWgEL.exe
  2⤵
  PID:6304
- C:\Windows\System\lDtEPeg.exe
  C:\Windows\System\lDtEPeg.exe
  2⤵
  PID:2136
- C:\Windows\System\TwHIAst.exe
  C:\Windows\System\TwHIAst.exe
  2⤵
  PID:5468
- C:\Windows\System\CTJUUBY.exe
  C:\Windows\System\CTJUUBY.exe
  2⤵
  PID:6888
- C:\Windows\System\oJKUzxJ.exe
  C:\Windows\System\oJKUzxJ.exe
  2⤵
  PID:9104
- C:\Windows\System\WTeqQGD.exe
  C:\Windows\System\WTeqQGD.exe
  2⤵
  PID:1856
- C:\Windows\System\DAqCFky.exe
  C:\Windows\System\DAqCFky.exe
  2⤵
  PID:7388
- C:\Windows\System\aQoyXjB.exe
  C:\Windows\System\aQoyXjB.exe
  2⤵
  PID:7288
- C:\Windows\System\jNyQiCe.exe
  C:\Windows\System\jNyQiCe.exe
  2⤵
  PID:7420
- C:\Windows\System\QbFNlhh.exe
  C:\Windows\System\QbFNlhh.exe
  2⤵
  PID:988
- C:\Windows\System\YlgeSpB.exe
  C:\Windows\System\YlgeSpB.exe
  2⤵
  PID:2928
- C:\Windows\System\BzaHTqM.exe
  C:\Windows\System\BzaHTqM.exe
  2⤵
  PID:7928
- C:\Windows\System\rpKNHJs.exe
  C:\Windows\System\rpKNHJs.exe
  2⤵
  PID:5944
- C:\Windows\System\PBbMaRP.exe
  C:\Windows\System\PBbMaRP.exe
  2⤵
  PID:8560
- C:\Windows\System\llnnrkx.exe
  C:\Windows\System\llnnrkx.exe
  2⤵
  PID:4940
- C:\Windows\System\MdGHwAL.exe
  C:\Windows\System\MdGHwAL.exe
  2⤵
  PID:13460
- C:\Windows\System\WXxUCQE.exe
  C:\Windows\System\WXxUCQE.exe
  2⤵
  PID:8504
- C:\Windows\System\jwKvFFY.exe
  C:\Windows\System\jwKvFFY.exe
  2⤵
  PID:7204
- C:\Windows\System\dMUtOIA.exe
  C:\Windows\System\dMUtOIA.exe
  2⤵
  PID:13600
- C:\Windows\System\HdszYvs.exe
  C:\Windows\System\HdszYvs.exe
  2⤵
  PID:8580
- C:\Windows\System\yUfaBEC.exe
  C:\Windows\System\yUfaBEC.exe
  2⤵
  PID:13632
- C:\Windows\System\koNvtoK.exe
  C:\Windows\System\koNvtoK.exe
  2⤵
  PID:3068
- C:\Windows\System\oEUUiKo.exe
  C:\Windows\System\oEUUiKo.exe
  2⤵
  PID:9008
- C:\Windows\System\OQBhjzq.exe
  C:\Windows\System\OQBhjzq.exe
  2⤵
  PID:5412
- C:\Windows\System\qMeRJRX.exe
  C:\Windows\System\qMeRJRX.exe
  2⤵
  PID:9176
- C:\Windows\System\iEqxSvU.exe
  C:\Windows\System\iEqxSvU.exe
  2⤵
  PID:6916
- C:\Windows\System\UMuPAgw.exe
  C:\Windows\System\UMuPAgw.exe
  2⤵
  PID:2272
- C:\Windows\System\ABsyFjO.exe
  C:\Windows\System\ABsyFjO.exe
  2⤵
  PID:5584
- C:\Windows\System\vhJaKJX.exe
  C:\Windows\System\vhJaKJX.exe
  2⤵
  PID:8476
- C:\Windows\System\zuJltLm.exe
  C:\Windows\System\zuJltLm.exe
  2⤵
  PID:13872
- C:\Windows\System\WswizQa.exe
  C:\Windows\System\WswizQa.exe
  2⤵
  PID:2920
- C:\Windows\System\OuptMDN.exe
  C:\Windows\System\OuptMDN.exe
  2⤵
  PID:9628
- C:\Windows\System\OxhvclZ.exe
  C:\Windows\System\OxhvclZ.exe
  2⤵
  PID:6584
- C:\Windows\System\oqjbhAW.exe
  C:\Windows\System\oqjbhAW.exe
  2⤵
  PID:9168
- C:\Windows\System\DkTgeYU.exe
  C:\Windows\System\DkTgeYU.exe
  2⤵
  PID:8148
- C:\Windows\System\XNUqjXZ.exe
  C:\Windows\System\XNUqjXZ.exe
  2⤵
  PID:6096
- C:\Windows\System\pOLpFMn.exe
  C:\Windows\System\pOLpFMn.exe
  2⤵
  PID:14276
- C:\Windows\System\xEbanlJ.exe
  C:\Windows\System\xEbanlJ.exe
  2⤵
  PID:4296
- C:\Windows\System\hDDdLep.exe
  C:\Windows\System\hDDdLep.exe
  2⤵
  PID:9956
- C:\Windows\System\eYwpTFA.exe
  C:\Windows\System\eYwpTFA.exe
  2⤵
  PID:14172
- C:\Windows\System\lZugnFd.exe
  C:\Windows\System\lZugnFd.exe
  2⤵
  PID:9000
- C:\Windows\System\wEXBbIS.exe
  C:\Windows\System\wEXBbIS.exe
  2⤵
  PID:7336
- C:\Windows\System\mdLrJrg.exe
  C:\Windows\System\mdLrJrg.exe
  2⤵
  PID:6684
- C:\Windows\System\MqhQPbA.exe
  C:\Windows\System\MqhQPbA.exe
  2⤵
  PID:6752
- C:\Windows\System\QVhDxKa.exe
  C:\Windows\System\QVhDxKa.exe
  2⤵
  PID:4368
- C:\Windows\System\GnPhMTV.exe
  C:\Windows\System\GnPhMTV.exe
  2⤵
  PID:6952
- C:\Windows\System\JHklyLr.exe
  C:\Windows\System\JHklyLr.exe
  2⤵
  PID:10184
- C:\Windows\System\TkxPaJH.exe
  C:\Windows\System\TkxPaJH.exe
  2⤵
  PID:1464
- C:\Windows\System\HFSZUgv.exe
  C:\Windows\System\HFSZUgv.exe
  2⤵
  PID:10084
- C:\Windows\System\oEXDewk.exe
  C:\Windows\System\oEXDewk.exe
  2⤵
  PID:7608
- C:\Windows\System\PGSBaQj.exe
  C:\Windows\System\PGSBaQj.exe
  2⤵
  PID:11392
- C:\Windows\System\zOvQyEQ.exe
  C:\Windows\System\zOvQyEQ.exe
  2⤵
  PID:8228
- C:\Windows\System\lrBhojz.exe
  C:\Windows\System\lrBhojz.exe
  2⤵
  PID:6228
- C:\Windows\System\mmVeDsa.exe
  C:\Windows\System\mmVeDsa.exe
  2⤵
  PID:8624
- C:\Windows\System\DfIrWrc.exe
  C:\Windows\System\DfIrWrc.exe
  2⤵
  PID:11616
- C:\Windows\System\XjamABQ.exe
  C:\Windows\System\XjamABQ.exe
  2⤵
  PID:7840
- C:\Windows\System\Gfxrrvf.exe
  C:\Windows\System\Gfxrrvf.exe
  2⤵
  PID:10256
- C:\Windows\System\MwyHCET.exe
  C:\Windows\System\MwyHCET.exe
  2⤵
  PID:8528
- C:\Windows\System\TjGZQta.exe
  C:\Windows\System\TjGZQta.exe
  2⤵
  PID:10380
- C:\Windows\System\ZkNoCMf.exe
  C:\Windows\System\ZkNoCMf.exe
  2⤵
  PID:13344
- C:\Windows\System\funTHaG.exe
  C:\Windows\System\funTHaG.exe
  2⤵
  PID:10532
- C:\Windows\System\XRFcUur.exe
  C:\Windows\System\XRFcUur.exe
  2⤵
  PID:13576
- C:\Windows\System\xDSqZff.exe
  C:\Windows\System\xDSqZff.exe
  2⤵
  PID:13532
- C:\Windows\System\bzOchGV.exe
  C:\Windows\System\bzOchGV.exe
  2⤵
  PID:13696
- C:\Windows\System\VtSxJli.exe
  C:\Windows\System\VtSxJli.exe
  2⤵
  PID:5264
- C:\Windows\System\aGUWIPc.exe
  C:\Windows\System\aGUWIPc.exe
  2⤵
  PID:13644
- C:\Windows\System\CPqezhl.exe
  C:\Windows\System\CPqezhl.exe
  2⤵
  PID:1852
- C:\Windows\System\SPITWJk.exe
  C:\Windows\System\SPITWJk.exe
  2⤵
  PID:8628
- C:\Windows\System\dASzvNI.exe
  C:\Windows\System\dASzvNI.exe
  2⤵
  PID:6912
- C:\Windows\System\OQiPsck.exe
  C:\Windows\System\OQiPsck.exe
  2⤵
  PID:2188
- C:\Windows\System\glVqnzc.exe
  C:\Windows\System\glVqnzc.exe
  2⤵
  PID:9060
- C:\Windows\System\TUTDmbq.exe
  C:\Windows\System\TUTDmbq.exe
  2⤵
  PID:6348
- C:\Windows\System\DPutwrY.exe
  C:\Windows\System\DPutwrY.exe
  2⤵
  PID:7824
- C:\Windows\System\nCSxdeV.exe
  C:\Windows\System\nCSxdeV.exe
  2⤵
  PID:6840
- C:\Windows\System\JqHZruo.exe
  C:\Windows\System\JqHZruo.exe
  2⤵
  PID:7084
- C:\Windows\System\nriGOEH.exe
  C:\Windows\System\nriGOEH.exe
  2⤵
  PID:10576
- C:\Windows\System\IpgEbtH.exe
  C:\Windows\System\IpgEbtH.exe
  2⤵
  PID:756
- C:\Windows\System\iSnosen.exe
  C:\Windows\System\iSnosen.exe
  2⤵
  PID:9268
- C:\Windows\System\iMprloh.exe
  C:\Windows\System\iMprloh.exe
  2⤵
  PID:9480
- C:\Windows\System\PLxOSeA.exe
  C:\Windows\System\PLxOSeA.exe
  2⤵
  PID:13416
- C:\Windows\System\OznEACQ.exe
  C:\Windows\System\OznEACQ.exe
  2⤵
  PID:11368
- C:\Windows\System\GsyIdxa.exe
  C:\Windows\System\GsyIdxa.exe
  2⤵
  PID:11452
- C:\Windows\System\leIULpK.exe
  C:\Windows\System\leIULpK.exe
  2⤵
  PID:3908
- C:\Windows\System\Tiiqqzn.exe
  C:\Windows\System\Tiiqqzn.exe
  2⤵
  PID:11548
- C:\Windows\System\InaLNqs.exe
  C:\Windows\System\InaLNqs.exe
  2⤵
  PID:13952
- C:\Windows\System\MiFsCmV.exe
  C:\Windows\System\MiFsCmV.exe
  2⤵
  PID:9528
- C:\Windows\System\NjqNlpS.exe
  C:\Windows\System\NjqNlpS.exe
  2⤵
  PID:6392
- C:\Windows\System\LBcODcM.exe
  C:\Windows\System\LBcODcM.exe
  2⤵
  PID:7460
- C:\Windows\System\UmqENsu.exe
  C:\Windows\System\UmqENsu.exe
  2⤵
  PID:8600
- C:\Windows\System\TXDCMap.exe
  C:\Windows\System\TXDCMap.exe
  2⤵
  PID:1492
- C:\Windows\System\qCteuVP.exe
  C:\Windows\System\qCteuVP.exe
  2⤵
  PID:8556
- C:\Windows\System\nPwnNvN.exe
  C:\Windows\System\nPwnNvN.exe
  2⤵
  PID:9636
- C:\Windows\System\pSrdzMy.exe
  C:\Windows\System\pSrdzMy.exe
  2⤵
  PID:4788
- C:\Windows\System\WLcQovq.exe
  C:\Windows\System\WLcQovq.exe
  2⤵
  PID:7564
- C:\Windows\System\HKCdytu.exe
  C:\Windows\System\HKCdytu.exe
  2⤵
  PID:7424
- C:\Windows\System\rDlRFKX.exe
  C:\Windows\System\rDlRFKX.exe
  2⤵
  PID:7764
- C:\Windows\System\YChiFyH.exe
  C:\Windows\System\YChiFyH.exe
  2⤵
  PID:10068
- C:\Windows\System\TgblSCQ.exe
  C:\Windows\System\TgblSCQ.exe
  2⤵
  PID:8612
- C:\Windows\System\PGOqTIu.exe
  C:\Windows\System\PGOqTIu.exe
  2⤵
  PID:12100
- C:\Windows\System\kKiXzmN.exe
  C:\Windows\System\kKiXzmN.exe
  2⤵
  PID:10728
- C:\Windows\System\EELDQjs.exe
  C:\Windows\System\EELDQjs.exe
  2⤵
  PID:12156
- C:\Windows\System\BuRovMG.exe
  C:\Windows\System\BuRovMG.exe
  2⤵
  PID:7876
- C:\Windows\System\QLvNIlt.exe
  C:\Windows\System\QLvNIlt.exe
  2⤵
  PID:12172
- C:\Windows\System\KYksynQ.exe
  C:\Windows\System\KYksynQ.exe
  2⤵
  PID:10800
- C:\Windows\System\OEZHvhY.exe
  C:\Windows\System\OEZHvhY.exe
  2⤵
  PID:10760
- C:\Windows\System\wdSjlIG.exe
  C:\Windows\System\wdSjlIG.exe
  2⤵
  PID:10784
- C:\Windows\System\fGULzJd.exe
  C:\Windows\System\fGULzJd.exe
  2⤵
  PID:13316
- C:\Windows\System\JFicSKR.exe
  C:\Windows\System\JFicSKR.exe
  2⤵
  PID:13104
- C:\Windows\System\NFNjNzk.exe
  C:\Windows\System\NFNjNzk.exe
  2⤵
  PID:10828
- C:\Windows\System\fibAyge.exe
  C:\Windows\System\fibAyge.exe
  2⤵
  PID:2060
- C:\Windows\System\PMWKueQ.exe
  C:\Windows\System\PMWKueQ.exe
  2⤵
  PID:7884
- C:\Windows\System\MxNZLXt.exe
  C:\Windows\System\MxNZLXt.exe
  2⤵
  PID:10356
- C:\Windows\System\uZilaup.exe
  C:\Windows\System\uZilaup.exe
  2⤵
  PID:7972
- C:\Windows\System\CXUIOxw.exe
  C:\Windows\System\CXUIOxw.exe
  2⤵
  PID:10408
- C:\Windows\System\FLGHFZW.exe
  C:\Windows\System\FLGHFZW.exe
  2⤵
  PID:8720
- C:\Windows\System\TFFhujf.exe
  C:\Windows\System\TFFhujf.exe
  2⤵
  PID:11252
- C:\Windows\System\IhMOzNr.exe
  C:\Windows\System\IhMOzNr.exe
  2⤵
  PID:10676
- C:\Windows\System\TpLcRXr.exe
  C:\Windows\System\TpLcRXr.exe
  2⤵
  PID:12180
- C:\Windows\System\rWrYMsc.exe
  C:\Windows\System\rWrYMsc.exe
  2⤵
  PID:10904
- C:\Windows\System\UpDHxbJ.exe
  C:\Windows\System\UpDHxbJ.exe
  2⤵
  PID:9464
- C:\Windows\System\NihcdtP.exe
  C:\Windows\System\NihcdtP.exe
  2⤵
  PID:6544
- C:\Windows\System\ZtmHSqY.exe
  C:\Windows\System\ZtmHSqY.exe
  2⤵
  PID:11780
- C:\Windows\System\BaLpgTw.exe
  C:\Windows\System\BaLpgTw.exe
  2⤵
  PID:10944
- C:\Windows\System\iinQewN.exe
  C:\Windows\System\iinQewN.exe
  2⤵
  PID:12968
- C:\Windows\System\NYPfeDE.exe
  C:\Windows\System\NYPfeDE.exe
  2⤵
  PID:13076
- C:\Windows\System\scthmFr.exe
  C:\Windows\System\scthmFr.exe
  2⤵
  PID:12124
- C:\Windows\System\byHUNaX.exe
  C:\Windows\System\byHUNaX.exe
  2⤵
  PID:7012
- C:\Windows\System\WajusMc.exe
  C:\Windows\System\WajusMc.exe
  2⤵
  PID:7396
- C:\Windows\System\yNbUlzC.exe
  C:\Windows\System\yNbUlzC.exe
  2⤵
  PID:11856
- C:\Windows\System\YkgcxVU.exe
  C:\Windows\System\YkgcxVU.exe
  2⤵
  PID:9980
- C:\Windows\System\QoRzHwp.exe
  C:\Windows\System\QoRzHwp.exe
  2⤵
  PID:12932
- C:\Windows\System\sCySzxV.exe
  C:\Windows\System\sCySzxV.exe
  2⤵
  PID:11048
- C:\Windows\System\mQqRIvG.exe
  C:\Windows\System\mQqRIvG.exe
  2⤵
  PID:7272
- C:\Windows\System\OySChZo.exe
  C:\Windows\System\OySChZo.exe
  2⤵
  PID:11900
- C:\Windows\System\uNKuEuL.exe
  C:\Windows\System\uNKuEuL.exe
  2⤵
  PID:7756
- C:\Windows\System\OxKyynq.exe
  C:\Windows\System\OxKyynq.exe
  2⤵
  PID:9640
- C:\Windows\System\GwUaSpb.exe
  C:\Windows\System\GwUaSpb.exe
  2⤵
  PID:10252
- C:\Windows\System\shVYEUt.exe
  C:\Windows\System\shVYEUt.exe
  2⤵
  PID:5032
- C:\Windows\System\asCKJix.exe
  C:\Windows\System\asCKJix.exe
  2⤵
  PID:12640
- C:\Windows\System\OphWJEf.exe
  C:\Windows\System\OphWJEf.exe
  2⤵
  PID:12756
- C:\Windows\System\ZGmpUgU.exe
  C:\Windows\System\ZGmpUgU.exe
  2⤵
  PID:10440
- C:\Windows\System\QcwTgKy.exe
  C:\Windows\System\QcwTgKy.exe
  2⤵
  PID:12984
- C:\Windows\System\dLXDjiG.exe
  C:\Windows\System\dLXDjiG.exe
  2⤵
  PID:10496
- C:\Windows\System\WDNPOrf.exe
  C:\Windows\System\WDNPOrf.exe
  2⤵
  PID:11808
- C:\Windows\System\LyEQWNo.exe
  C:\Windows\System\LyEQWNo.exe
  2⤵
  PID:368
- C:\Windows\System\HiIxVGI.exe
  C:\Windows\System\HiIxVGI.exe
  2⤵
  PID:12152
- C:\Windows\System\WBFdtpL.exe
  C:\Windows\System\WBFdtpL.exe
  2⤵
  PID:548
- C:\Windows\System\MbjRfQP.exe
  C:\Windows\System\MbjRfQP.exe
  2⤵
  PID:6076
- C:\Windows\System\lkSjLIJ.exe
  C:\Windows\System\lkSjLIJ.exe
  2⤵
  PID:13052
- C:\Windows\System\dBVzIHd.exe
  C:\Windows\System\dBVzIHd.exe
  2⤵
  PID:10092
- C:\Windows\System\cOnGrSV.exe
  C:\Windows\System\cOnGrSV.exe
  2⤵
  PID:13012
- C:\Windows\System\HIjlVzp.exe
  C:\Windows\System\HIjlVzp.exe
  2⤵
  PID:9304
- C:\Windows\System\szJfwBq.exe
  C:\Windows\System\szJfwBq.exe
  2⤵
  PID:9504
- C:\Windows\System\tRiwVnL.exe
  C:\Windows\System\tRiwVnL.exe
  2⤵
  PID:2484
- C:\Windows\System\nZtCGpZ.exe
  C:\Windows\System\nZtCGpZ.exe
  2⤵
  PID:13920
- C:\Windows\System\eRSIlsB.exe
  C:\Windows\System\eRSIlsB.exe
  2⤵
  PID:11436
- C:\Windows\System\rZVKufk.exe
  C:\Windows\System\rZVKufk.exe
  2⤵
  PID:8700
- C:\Windows\System\clcVweg.exe
  C:\Windows\System\clcVweg.exe
  2⤵
  PID:11016
- C:\Windows\System\xGldsbK.exe
  C:\Windows\System\xGldsbK.exe
  2⤵
  PID:12568
- C:\Windows\System\AcOuzQf.exe
  C:\Windows\System\AcOuzQf.exe
  2⤵
  PID:13084
- C:\Windows\System\cpAphIB.exe
  C:\Windows\System\cpAphIB.exe
  2⤵
  PID:11740
- C:\Windows\System\ceZPbYX.exe
  C:\Windows\System\ceZPbYX.exe
  2⤵
  PID:11652
- C:\Windows\System\ElSpODa.exe
  C:\Windows\System\ElSpODa.exe
  2⤵
  PID:9388
- C:\Windows\System\nTjUaJm.exe
  C:\Windows\System\nTjUaJm.exe
  2⤵
  PID:12080
- C:\Windows\System\nPQssBO.exe
  C:\Windows\System\nPQssBO.exe
  2⤵
  PID:12332
- C:\Windows\System\ogcENyF.exe
  C:\Windows\System\ogcENyF.exe
  2⤵
  PID:6324
- C:\Windows\System\BLdNBVW.exe
  C:\Windows\System\BLdNBVW.exe
  2⤵
  PID:14352
- C:\Windows\System\KOKEvtz.exe
  C:\Windows\System\KOKEvtz.exe
  2⤵
  PID:14376
- C:\Windows\System\hvmTOib.exe
  C:\Windows\System\hvmTOib.exe
  2⤵
  PID:14400
- C:\Windows\System\ixNFSEr.exe
  C:\Windows\System\ixNFSEr.exe
  2⤵
  PID:14448
- C:\Windows\System\zxqlWvS.exe
  C:\Windows\System\zxqlWvS.exe
  2⤵
  PID:14496
- C:\Windows\System\bvyQBKA.exe
  C:\Windows\System\bvyQBKA.exe
  2⤵
  PID:14532
- C:\Windows\System\VDtuozY.exe
  C:\Windows\System\VDtuozY.exe
  2⤵
  PID:14560
- C:\Windows\System\LzlFFju.exe
  C:\Windows\System\LzlFFju.exe
  2⤵
  PID:14596
- C:\Windows\System\PpboqSV.exe
  C:\Windows\System\PpboqSV.exe
  2⤵
  PID:14636
- C:\Windows\System\dLNpugp.exe
  C:\Windows\System\dLNpugp.exe
  2⤵
  PID:14688
- C:\Windows\System\uzYFjmg.exe
  C:\Windows\System\uzYFjmg.exe
  2⤵
  PID:14712
- C:\Windows\System\lJcRpHp.exe
  C:\Windows\System\lJcRpHp.exe
  2⤵
  PID:14736
- C:\Windows\System\bELTbNw.exe
  C:\Windows\System\bELTbNw.exe
  2⤵
  PID:14784
- C:\Windows\System\lbcKxOn.exe
  C:\Windows\System\lbcKxOn.exe
  2⤵
  PID:14820
- C:\Windows\System\rkspcWt.exe
  C:\Windows\System\rkspcWt.exe
  2⤵
  PID:14844
- C:\Windows\System\zlOoUlz.exe
  C:\Windows\System\zlOoUlz.exe
  2⤵
  PID:14888
- C:\Windows\System\NgJVmJx.exe
  C:\Windows\System\NgJVmJx.exe
  2⤵
  PID:14940
- C:\Windows\System\NQsfrYJ.exe
  C:\Windows\System\NQsfrYJ.exe
  2⤵
  PID:14980
- C:\Windows\System\xdrZPEz.exe
  C:\Windows\System\xdrZPEz.exe
  2⤵
  PID:15016
- C:\Windows\System\QRhSRlK.exe
  C:\Windows\System\QRhSRlK.exe
  2⤵
  PID:15060
- C:\Windows\System\WVBGgFV.exe
  C:\Windows\System\WVBGgFV.exe
  2⤵
  PID:15096
- C:\Windows\System\wHKteyH.exe
  C:\Windows\System\wHKteyH.exe
  2⤵
  PID:15132
- C:\Windows\System\WDEddoh.exe
  C:\Windows\System\WDEddoh.exe
  2⤵
  PID:15192
- C:\Windows\System\PVZBxcX.exe
  C:\Windows\System\PVZBxcX.exe
  2⤵
  PID:15248
- C:\Windows\System\yMWadLv.exe
  C:\Windows\System\yMWadLv.exe
  2⤵
  PID:15272
- C:\Windows\System\FOgTBym.exe
  C:\Windows\System\FOgTBym.exe
  2⤵
  PID:15320
- C:\Windows\System\tcHTiiD.exe
  C:\Windows\System\tcHTiiD.exe
  2⤵
  PID:12812
- C:\Windows\System\EhwCFct.exe
  C:\Windows\System\EhwCFct.exe
  2⤵
  PID:7544
- C:\Windows\System\GJSmMzu.exe
  C:\Windows\System\GJSmMzu.exe
  2⤵
  PID:11756
- C:\Windows\System\sIOdUfe.exe
  C:\Windows\System\sIOdUfe.exe
  2⤵
  PID:10856
- C:\Windows\System\HxsIPNm.exe
  C:\Windows\System\HxsIPNm.exe
  2⤵
  PID:14348
- C:\Windows\System\dZnXoFn.exe
  C:\Windows\System\dZnXoFn.exe
  2⤵
  PID:6004
- C:\Windows\System\KIOLpTe.exe
  C:\Windows\System\KIOLpTe.exe
  2⤵
  PID:8424
- C:\Windows\System\qrJsMxF.exe
  C:\Windows\System\qrJsMxF.exe
  2⤵
  PID:5016
- C:\Windows\System\FMRgYQP.exe
  C:\Windows\System\FMRgYQP.exe
  2⤵
  PID:14408
- C:\Windows\System\yGigPTH.exe
  C:\Windows\System\yGigPTH.exe
  2⤵
  PID:12944
- C:\Windows\System\ynSJhph.exe
  C:\Windows\System\ynSJhph.exe
  2⤵
  PID:14576
- C:\Windows\System\XHviQlf.exe
  C:\Windows\System\XHviQlf.exe
  2⤵
  PID:14624
- C:\Windows\System\mUYRAeU.exe
  C:\Windows\System\mUYRAeU.exe
  2⤵
  PID:14756
- C:\Windows\System\mLhTOlr.exe
  C:\Windows\System\mLhTOlr.exe
  2⤵
  PID:14704
- C:\Windows\System\eZGjpgM.exe
  C:\Windows\System\eZGjpgM.exe
  2⤵
  PID:14828
- C:\Windows\System\BclencU.exe
  C:\Windows\System\BclencU.exe
  2⤵
  PID:14792
- C:\Windows\System\bYcMbZt.exe
  C:\Windows\System\bYcMbZt.exe
  2⤵
  PID:6780
- C:\Windows\System\tsRikNX.exe
  C:\Windows\System\tsRikNX.exe
  2⤵
  PID:13164
- C:\Windows\System\FBewNMK.exe
  C:\Windows\System\FBewNMK.exe
  2⤵
  PID:8844
- C:\Windows\System\TbyQQaD.exe
  C:\Windows\System\TbyQQaD.exe
  2⤵
  PID:6420
- C:\Windows\System\NhbBXVl.exe
  C:\Windows\System\NhbBXVl.exe
  2⤵
  PID:15056
- C:\Windows\System\lVvbxeo.exe
  C:\Windows\System\lVvbxeo.exe
  2⤵
  PID:15024
- C:\Windows\System\ZwKQNst.exe
  C:\Windows\System\ZwKQNst.exe
  2⤵
  PID:15128
- C:\Windows\System\EXPeodY.exe
  C:\Windows\System\EXPeodY.exe
  2⤵
  PID:15144
- C:\Windows\System\xnSmwmX.exe
  C:\Windows\System\xnSmwmX.exe
  2⤵
  PID:10752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pcaa12ue.gkc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AiHnJPw.exe

Filesize
1.9MB

MD5
b9b52ee1f27ae348304464a6fc1792ad

SHA1
bfb6613e70b52e4bc841c9f3853882a0856724f0

SHA256
7ba2990f723b9dab013f4f67826fa04b9120355da2fab1c8d9c535587c3efde6

SHA512
7b66697e3002eefa617b9a332d596eaa12f02b652f5acddd1af703485d6830329abdd096362e4cef8bd58cd447ed57bd927cf85a9284f60ee35c00f2923f6005

Download Submit
C:\Windows\System\BgDxofM.exe

Filesize
1.8MB

MD5
169388e0745002b8a26e2c720237243e

SHA1
ac3f24f71d30663a2c446c09e51915acc7fea3b0

SHA256
ecf545827f9d527615b332b9fe641444ef354794fd2d64111bde6fb9fe897843

SHA512
762b7058f393815e683bbd278444f3b1a55dc514075a6d8790312db257fcaa030da4efc1ddd4ed9bf7149da8114cc151c6bbe1134ad093538e7c804128544a3e

Download Submit
C:\Windows\System\BthvIsT.exe

Filesize
1.8MB

MD5
d88dbc196302bbc9454c50e2678c5099

SHA1
ddb60978ab36210967a13fff4f6123aa333fc5fe

SHA256
9ec121ed8362168982b8791f135cdb5893493709b3960c08c60cb99181093f46

SHA512
61cfa9cce54d58fb716257a7abf416a54db52ef56800faefe360b4ce33fa59307f2771e14c40863489c0ef61f97871271f3a0faa060054e0c368f82ff7fcb06f

Download Submit
C:\Windows\System\CfYdNsv.exe

Filesize
1.8MB

MD5
1ec1f57988d8f1c0c3b44806c404a3ab

SHA1
2684ae1efa99233f350ea68ae18ade7dff279931

SHA256
d3fca5ba586616efbce803b579cbd941dcf07cb0cb221862414b0b96140acb90

SHA512
7b4c8378ed86bacc00b0344fd8e596140ff42ca86423314660e6d82ae9572dec1993f5eebd55b5c82f8a8ad3264e6028c1bb01b2b4eae572e2cad8fb53941002

Download Submit
C:\Windows\System\DNmrBow.exe

Filesize
1.8MB

MD5
ed40901c4dc66fa1023f28b155c22ef0

SHA1
0b33c86655d52c5d166cdf7bb0e2d5408229c318

SHA256
87f7aab185fcc637d618c5c5125dbeb682518893619f95f6f6ba07051b0d913c

SHA512
2174f90e68bcba213b0eaa4b7fe5fc8c20158de09a37f216f39c9cbed5e024858cd6f30168cdaa3bb27f3ccbf9ad624aab5949b6b5dbace1f5fad1f795915096

Download Submit
C:\Windows\System\DoUsokW.exe

Filesize
1.8MB

MD5
6814dd09375ca7815aee0259603e1b92

SHA1
9518410ed2b17816c1c660aa192447411274de29

SHA256
e8493627d5bc5d9a6eb91bba1bfecaf4b1d71ed9f6ffd292cd130bb59a1238e0

SHA512
a36bcc4a2a1ae3586a061c397231f33109c8df703a31e4ae2e4963b43dd33f7732f7c4a7491ed88eaf088fbc3650a32f09c115e8bee5d338e6e7528b70915e7d

Download Submit
C:\Windows\System\DqmfWja.exe

Filesize
1.9MB

MD5
138bb6d83139763e6e857c433e0762e0

SHA1
2417b9df7ec31f500518ea7eb02915bb9c8150a4

SHA256
35ac1a7225d59f6da734a95874bc45325485aa67ca03c34884b71bb6eed25e1f

SHA512
aafa2d65dede59de1ca96845f7a707480e706929ed248f810f3c64d0b3fb6e59ef8f06d588900208cfc1d5e7efb4ca2f3146b198f6a416c18fc26b96b9bd72b5

Download Submit
C:\Windows\System\ENeQfDc.exe

Filesize
1.8MB

MD5
36e129a481579a37888375bc6d9db8bc

SHA1
f5d0a317408761009c141bf85d5cd27de6b576bf

SHA256
74ac7284eb663e6d2e1dcccbb2fd66e9f58065d1c1ef03e67e4ad4390fc54d01

SHA512
459fb2cd5c33f5ac231bac458347d67064680e26197c83bbeff7cc9c63d6810d47bf0d097e7da1783d637dd4e0e9542fb87a661829e7f25a8a1f38c94e46bafb

Download Submit
C:\Windows\System\HQhxKCr.exe

Filesize
8B

MD5
3277aa72bb7d7f1eb1043502fbd1c406

SHA1
8712dca2f3fbc82bf0cbbeecdc5d6a26c87f443c

SHA256
e94b62f30c9ce8b0b5cea14d4367a52fe08005d1bd56ca932a1fd7fc15c61bc9

SHA512
9fb0369549dba8937fb796cbc4ade6bacf540f10f98e02675f1b04c615cbb49e396cdbd25cd29de56c7bfb889c8464199939a84fa31434a75c020caeb4f9f503

Download Submit
C:\Windows\System\IvAWQCL.exe

Filesize
1.8MB

MD5
44750b1b6be300cfbbd2595814778829

SHA1
dcb5cee9b5707269c3cc6f194ab7929cc4d83dd5

SHA256
16423245ba1a25a69e1deeedb4a1b4c9fbd89040ddfbcc4244fea1a76a5d73fb

SHA512
c117aeec4cc195bc5a98ba76c696ede59221dd02fa565eb1fa54201e7e68180db7a4605e98f6030f79431eb27929d97ad8dfeee04924185b1339bde7849b2ecf

Download Submit
C:\Windows\System\McZHxXC.exe

Filesize
1.9MB

MD5
4fb0a86e9a51d54d6f9181408796f43d

SHA1
b4124d15e5c4a0780d4661f9ed2e0f384863fbb3

SHA256
9a599d6923768d3ade140a3197c8597be10767030c8d7a86b5010af4a248e072

SHA512
7f7ae3d8133e33e01e030692a37be085a8ec8e222d966ef60a29f6c8195a7a2e33040a8b1032b0e87f63d32bb0feb56c15b4ac71328e2f4e6055b288a3456c30

Download Submit
C:\Windows\System\MwIqCsV.exe

Filesize
1.8MB

MD5
9c7ff712b569899215b174d77734dfd1

SHA1
e9a0dd26ff6652d478c25527d7ffccad7f6ad453

SHA256
ffb39b686a8f571d8333ca02bb7e1284035377ab05126b0068fffa388ec7f46e

SHA512
e9092754680d87658da939e51b326604e1f2592aebf57597e7929288026ee51122c892f12ecfb2ba319379e67ab656fb4e3282cbccceaa2475d4b5cc2d7364a2

Download Submit
C:\Windows\System\OyGJICn.exe

Filesize
1.9MB

MD5
79d9ffd46905dcf0528119de9a9d3233

SHA1
b28e8117ad3089d068d20dc5adf132496674d08a

SHA256
866af3ae583c3c84e446fdded553de15f8597f5c7aa1a83c95be43326a71ea7a

SHA512
2f96656832516d1f531b86eb15bb188de636b452f05829d15e561ccd77cdc596a2a085d79c5c55f99f764b7dc37893b0fdb6b33b84fd233a4d03f3309bb123d6

Download Submit
C:\Windows\System\QxQnGCF.exe

Filesize
1.8MB

MD5
44e795cae76f4c1ad7d7ccccfb220728

SHA1
e1ab8a807877ed3828e0b436f9792c315868c603

SHA256
65ee85644da4e8fe2dc14674b33f0a4b7fca4f446a868c5ae4023f3bfa954417

SHA512
0f984eb00070ce6daecc250f529236bb800ad7756d53b957111fb6c55f9ee88f4402a7f7c00e157bdde96fbdd697bf30f0188a74a083036a6f8490ac6c9bbf13

Download Submit
C:\Windows\System\RJmpzIc.exe

Filesize
1.8MB

MD5
013c26906375d341180ccdb077c941cd

SHA1
bb30b921e71e2ea39edbc2c9f5e271361576581e

SHA256
07274a9dc2298084f383e2023914c9771ee06ef7f54a29edf2407810d3a8755b

SHA512
2544103ff158f00c86835eb15a64535deb0754dd504967f40fa27c874b3f24189a9020e4e9172d6010f432b43a55dcc99ede4e4c80250b1611ed057932db0a61

Download Submit
C:\Windows\System\SLzUjBl.exe

Filesize
1.8MB

MD5
de57adfb8725304f0caf5c8ecee86d27

SHA1
44faf667c27172f740b2bd5ada9edc909fb30a6d

SHA256
ff4df38590e9babaa1b2c36260a304b0930a1fe24e7894baf0f733c30d12e542

SHA512
e4809118f54266a036c611de63b8cec9f303cdd3fdbcd52d29dccd257c5453d250cdc0edbc34c6b08c38a6454fdd8ff29f7ad1edff916c98d695a5cd997e2a16

Download Submit
C:\Windows\System\VYLTXQe.exe

Filesize
1.8MB

MD5
b3dd06504499d5faa90fa875b7aef6d5

SHA1
38f697ca7c3ba85c7c0222a25ea55eadc5218624

SHA256
0573cb2125e4e180e91d3ec38163f5134e95a887e419742d1fc0b2f1ea90d4f1

SHA512
79fd64c517c91e9ed974a0da1e9ddfc011df657e7e4c527d386fbcf04991e639796b1d2f642bd2097d8f11ec54b57d65bdb9db6c4a7241167a0acde21751a367

Download Submit
C:\Windows\System\VzeqoUi.exe

Filesize
1.8MB

MD5
873720963bd9a16d6a802282cb058a2e

SHA1
9909d79c04a793d59ace9a5e5bfaaf165a99de4d

SHA256
5829257bf20baa37094f115789aa57398f4ae6b814d7023c5363c11e8857b383

SHA512
7a16b15bd97f718e9be9cdcc3be276baaf0e31d5a6ebc20f4c263284cd53e3d37e406cf851b1bb94b81d2561f08f43d247bbc33b89d081576f9a050f82ae1abe

Download Submit
C:\Windows\System\XOwySpq.exe

Filesize
1.8MB

MD5
bb67fbfbd2de158034253d53e0d7f85b

SHA1
2b175ac575e77fb47e6c03b4d853f0dbf4704efb

SHA256
b2ef78333c99798f484026564910602165a9bedf16ff408b6757e7573325e045

SHA512
6a622505ecfeb92e9f02b0a2943e2624aaa1af7d17e0466cabb19301eb976364903b0ce71898d9a14d95bdb95acff369a00076e706b5ce79cbdc147dabc2c882

Download Submit
C:\Windows\System\YhKMLnI.exe

Filesize
1.8MB

MD5
a886e3df973fa775135357ec7088dc95

SHA1
97789f0002f42350a4b3d4b03b9f11a322043859

SHA256
5ecb2b432823e16d1bfd3335b8af531d2330d41583022820b79be4f5e7bdfdaa

SHA512
17acdd6978ab115768b11282dda2eb0e7fab8764312d4146545eedb25eaca937f2749d1a7712b5f7e8eb13f896c844b1f252dae24ae44406e77c5c25353a17ab

Download Submit
C:\Windows\System\YsElUUb.exe

Filesize
1.8MB

MD5
41f1c7c6a106b89671887a52293241ec

SHA1
dad8dcf4dd3966b3066501275f915ae6ff057333

SHA256
10a7304715978c012f549ad9681845d4ad1ca2e0ac17aebf0bb61aa1ff3d7412

SHA512
21c122fda142fbc09e598235648bfaa35394b96f272b213a064c1e4a408deb449da85954eca5633501178c7f4ee8b911e59a5e748c4253c49febd37905f9e17e

Download Submit
C:\Windows\System\ZjyeLlO.exe

Filesize
1.8MB

MD5
271e1a17c5199502f48ad2ad95579adb

SHA1
d1f25a9ee0fe1e24c82ceb7509c3c9d3a5181f32

SHA256
d19b5f2cfe81b10c785cbcba36666b0102214a6be92e05a9fe5fd4e1e4d0fd44

SHA512
91fa33866d398e652bd3a49af07344cb2c327033d4aa240eabea0963eedcabaf3d8161ef135211b4efa0901343e4fa1e5063443b1c769de920fade3753b4e7dd

Download Submit
C:\Windows\System\ddJHKPj.exe

Filesize
1.8MB

MD5
9407b17a1af7ae5c14355270faca370d

SHA1
42ac7d6e8bee1e5dcd893b7735eb052c572973c4

SHA256
1d585a3ed63cbf4727fbb0e9d111ab7c8fcafa0a316575a44752c54b81a64bb0

SHA512
5e28cd1ad2a8229332e930e8d041025855deba431322a59106ea6393e8b282daeb69aa846d477cb9f7f2b59dada89c78f1ed45145125998b853675b5c001ce1e

Download Submit
C:\Windows\System\fUSkvPt.exe

Filesize
1.8MB

MD5
2f0e75c6168128ac63cc21a4155aa313

SHA1
f045e400cd0d10a10000610adcde5825849ce54a

SHA256
7a7b8db4d42bce4c1c22fa4c92267b1aa870d2a8de01e3dcdbcdee02d58a1d5b

SHA512
600806289a82147c7c7e85a9d30f8a983009654bb68576ef5c7d82055d5a3f45673dd8f7c0c7893c102af737cf8925852b483261c722a81827e7e2ecedf16b44

Download Submit
C:\Windows\System\fcBRmDg.exe

Filesize
1.8MB

MD5
e12dd5fea82f0bb97f74f6b6438406dd

SHA1
38ad675eaa73b63bbb4e70682a705fa2b82c7b4f

SHA256
fd1f39c61f1938733c647ffdce52153f219cae3e7d8149e3625b6d4f15c768e9

SHA512
78ff13d40cd3f07bc74a11fe87b43bf1c779514e77e126e03b3f37d393619acda755270e95adfd035dd01e7c8d8894d115529228d6f1cd0e3b5ec31b096997f3

Download Submit
C:\Windows\System\ktBDuqG.exe

Filesize
1.8MB

MD5
1e17f49a23ab5a5c4270dc816fe284b7

SHA1
6bac1126f8ee63c9cf38234171923d862a25677d

SHA256
f7ee824ef436848c77f5cc1b8eb699c42050ee0844e336ca4b6bd34a20a2940f

SHA512
9ab2c4806c906392da1a24a4b1d14b1bffc098ada8fc77e6e83203a5177be7945212d83c1345b27274ce0a4c146bc438f11289d118f8002d2b276733aa8c3df0

Download Submit
C:\Windows\System\lzuIJBe.exe

Filesize
1.8MB

MD5
c306a72dc87efc9b876e54e32520c78e

SHA1
2ea4d75788cfd2e1b7a4bdf0208fdd2b6962ff7a

SHA256
2543e80280d14bafe63275637da9f39c0d7d05f50946cf1322e4e75a7518b98d

SHA512
70729253de880b3aaa5781c181f1f8f1c7caca2e6797e237c0f8f9185ed2832dfe70bdb23f37ce5562294e201dbef16d7e32c68a089db5ad34d7c570f8c0a82b

Download Submit
C:\Windows\System\mlPKiNT.exe

Filesize
1.8MB

MD5
4d9769b0570694b18919cf2b5720e01a

SHA1
a8d82d69a6dd4a4148e7acf9cc6edf4493b08e20

SHA256
210019305e1ee81f256994af5d65f512c7f586f9ca85fefcae695adf142d8750

SHA512
4c7172b8e361abfcc372f8b8fbd2c1fd871c7488f8a016dafb907036404bedf20fa81704e2e11f27d02f41d55c1089d110b6da088b7486eda9d5c192b7f530f0

Download Submit
C:\Windows\System\ndiopfD.exe

Filesize
1.8MB

MD5
8c1b5b120f69f17c2566d2eda5323a2d

SHA1
6a00ed837f9e135ead3578fd3b7da03c05ebd484

SHA256
03c610ef28a5eeddeca9c4f7c00ec4be13af3c5282520e07fbf67605368f58fb

SHA512
14ff54ce9eec6a04e7ad48bbed67e8efcb2d461efbe847d2b1f0a738acbaab7109c33dbc4e24935bee25fb56cdf883fbcaba5803b2e23f3b38740d3ba1fba807

Download Submit
C:\Windows\System\nndxLEu.exe

Filesize
1.8MB

MD5
9b198398574d719e95fc749c367ee126

SHA1
4eb0847c1cb8bfae7f313f4934edd8c39c9f0088

SHA256
c5b1565bb6b2e5fed04e695f62e98eef0f96f5eccac4befcf723d85bca135522

SHA512
e730b65a16bf60bb6287f3b1872527c862625ef1cc3a92dec75eda1fb7315b3a84b38f033103dff46a4abaea19cccf709f6040e71b5094ad8b26f39a86f5c155

Download Submit
C:\Windows\System\pNbVlBL.exe

Filesize
1.8MB

MD5
0da0d2476476cffbb63eaf5ac907b0a6

SHA1
49609fa97a1e89fd6e41bcb6dd7362f46002b463

SHA256
3191ea6b2e87484f63961608cfb8bbc7ef1847312c7b99f49e6712b1a4b84f3b

SHA512
06a7d66bb341ca8b9475664d1b9dccfb030fd1cc08d64a7076ad6a42f26799b940af0809e7e4a190becf4e6b10b47a460b76229fd6ce4f1529bf24bc62f84d72

Download Submit
C:\Windows\System\pkSWdYF.exe

Filesize
1.8MB

MD5
e761841ddd5c5f3549d6ffc52931ec63

SHA1
13330c458060099e48b58ca7596e5820d0f0f311

SHA256
d11d6f7a117565668479033338ca678f3bd51cac69dec0b0d465ef7575ca4185

SHA512
90effa2b6c93b50c691060d0837fe9c9f8a5b509fe93ed020151b0169e4307b3c6cb7d08eb6e55b7a658399ca5c03d9a80ab4bab1b6839d577bea0927d2c7334

Download Submit
C:\Windows\System\qMRxoLS.exe

Filesize
1.8MB

MD5
bcd75a993c8b53203ed42a80375b0608

SHA1
588296a7c17156438222630ca8ca8a1ed28f3658

SHA256
339a9525ee801e73f8d037aaa36d29cc6b512d575f0d5f42bbde6038ef5e5f7e

SHA512
7be7cc2f0bfd4a170e27748f5de7b7d8fb64d4406be3df18aaf3c9c34a4c3d617d95061a8437ac1ac0c999d687352242ca271e13f7a1b80c2e6ae47f8320621e

Download Submit
C:\Windows\System\qdbaeQk.exe

Filesize
1.8MB

MD5
a7fa0d34f367456667576ca9304ee40f

SHA1
7edb5a7e43be8d75db6402031b1147172d74e3a5

SHA256
df1dd0873a49e8c4761020c06ab8fb24b979a372dd9948547a5f4701beb5a276

SHA512
968330a3c3770458918c8efb5cc4c1b1d134632934641af12597661905a861f56b44e727e1c53cdc92b6cccf32b96c376fd2052bcaf3f9421e55a389d4b5c990

Download Submit
C:\Windows\System\snuzYMN.exe

Filesize
1.8MB

MD5
0fa1b9f6938602a23f8a3dcb122bb9f3

SHA1
78d45411bec55a3037a5e9d0d2903f9fd44904f7

SHA256
cbef34143b0cc7c514e19dc39eb7e20f390ff0e193eb752db151cb239cd0057f

SHA512
0ee06c6f59ad9b8c2e74e9485fbcf8f368ada468e88bfacba2fbce76b9f55aa3abe99a049ba2562cfa5ebca769fcee814750fdd762ccec04732a1278c068219b

Download Submit
C:\Windows\System\szVYZPa.exe

Filesize
1.8MB

MD5
2273fd64e3c62f82af57d1be2d704bda

SHA1
02ef4d9234817d83e1bd85e9b0b3b8e8c1e64baa

SHA256
a1155ceee5fb49cfd8f3acfc6038f1e46f46290fb30a79087395b685d9e514e6

SHA512
f07ea6e243a0cc39a4dc557bc0cc6addca99d122996ef0db8c95c5c4b26181a5d6ecdaf4708f5be8d16ccc327fafdb1b986a7e91a372d9682a46b9fd1cb00e77

Download Submit
C:\Windows\System\tJiLGqo.exe

Filesize
1.9MB

MD5
789275d4dc326575da2b8dc7760641c1

SHA1
fbcc63bc9d473931fd5c578ceb8fb35b1247cea6

SHA256
d9b16e4a094c872dd1a4d5615a1b7c5344402e707560cb50d8d9994fd6b3bba7

SHA512
2be5cbf877502f9ae15c08365abdb5f2210611825e49f2b894c9019c9be58a3f41f70567a305ea028be0dec9a1d993197ad48e2efaa2afc3bc1b2d07d7feebfb

Download Submit
C:\Windows\System\uWsdKAC.exe

Filesize
18B

MD5
245dee33bd0829fb0a14fffbb01cddca

SHA1
3098465efbb0ab58d084dea73fb53b7464aa2124

SHA256
42ab9954ae85f062ea70b5a38d7cb35251b9594624f80f499a57a579cabb5d86

SHA512
4a249b410305275b4e8f1049bfb6debe0c906ca24cdd1c084f91263bd1208ad51b8937135ff9506b71885993cc7bafe2c69d5ba8bf11fa3ad12e247f4d803429

Download Submit
C:\Windows\System\vNWkTrl.exe

Filesize
1.9MB

MD5
19e617d06d29705466549627d63bad6d

SHA1
37b6aac733cd98cc0bd9ac5f078700715311dd60

SHA256
cb7dac8b2cde384741847c96993315764d4010897b9caf151ffc9ab822ff7b86

SHA512
38ebdcfbb8aedd3f058fca869aa5836429ca618417da654a55c19ba7353ff46673cfd67c0c2a6df6de6faffbfa21a052ec150b7357e92951d277850b33b777cc

Download Submit
C:\Windows\System\vXTzgqM.exe

Filesize
1.8MB

MD5
2fd8f9d19db4e37e323bc034c71a1c70

SHA1
a5a41d3e5a8505733fcdc1493059f6bc06b220fd

SHA256
94f7cad6a21e73cfb7dc0297f3b9ec4580a2359c8cf9dd4f451a3eb4fc25b2f3

SHA512
a690b0dd86bb4db6654caea6ee0732c8a08384e79136632f0672701aedf541d5c9293b521a0052378d994ae8a7949228251a32bd176bbfac149dc54c5d8f0e44

Download Submit
C:\Windows\System\xmgCPwZ.exe

Filesize
1.8MB

MD5
d3f81941060053b377adf8ac52957ea6

SHA1
b3bf15b657cb6848619851203126b79d51eb9377

SHA256
b6edb2fc09787ebfee5cf8e8d5e76088a49f8f3d8b601295d65e8fbfb4d6600d

SHA512
a453391f74869c33c088e592c107a22975975539f994334f8d00b7fb0f848061f5e1e15e53fddb5273e227a333966682323c21036be9d66d63c89b3918c7458a

Download Submit
memory/64-6151-0x00007FF656070000-0x00007FF656462000-memory.dmp

Filesize
3.9MB

Download
memory/64-669-0x00007FF656070000-0x00007FF656462000-memory.dmp

Filesize
3.9MB

Download
memory/648-6178-0x00007FF6EAFC0000-0x00007FF6EB3B2000-memory.dmp

Filesize
3.9MB

Download
memory/648-409-0x00007FF6EAFC0000-0x00007FF6EB3B2000-memory.dmp

Filesize
3.9MB

Download
memory/672-6227-0x00007FF760360000-0x00007FF760752000-memory.dmp

Filesize
3.9MB

Download
memory/672-666-0x00007FF760360000-0x00007FF760752000-memory.dmp

Filesize
3.9MB

Download
memory/1000-6180-0x00007FF602C80000-0x00007FF603072000-memory.dmp

Filesize
3.9MB

Download
memory/1000-167-0x00007FF602C80000-0x00007FF603072000-memory.dmp

Filesize
3.9MB

Download
memory/1508-224-0x00007FF6B4020000-0x00007FF6B4412000-memory.dmp

Filesize
3.9MB

Download
memory/1508-6190-0x00007FF6B4020000-0x00007FF6B4412000-memory.dmp

Filesize
3.9MB

Download
memory/1528-20-0x00007FF77F380000-0x00007FF77F772000-memory.dmp

Filesize
3.9MB

Download
memory/1868-6184-0x00007FF6046B0000-0x00007FF604AA2000-memory.dmp

Filesize
3.9MB

Download
memory/1868-221-0x00007FF6046B0000-0x00007FF604AA2000-memory.dmp

Filesize
3.9MB

Download
memory/1964-667-0x00007FF734460000-0x00007FF734852000-memory.dmp

Filesize
3.9MB

Download
memory/1964-6202-0x00007FF734460000-0x00007FF734852000-memory.dmp

Filesize
3.9MB

Download
memory/3128-6173-0x00007FF61D1F0000-0x00007FF61D5E2000-memory.dmp

Filesize
3.9MB

Download
memory/3128-664-0x00007FF61D1F0000-0x00007FF61D5E2000-memory.dmp

Filesize
3.9MB

Download
memory/3160-0-0x00007FF6110A0000-0x00007FF611492000-memory.dmp

Filesize
3.9MB

Download
memory/3160-1-0x000001C2278A0000-0x000001C2278B0000-memory.dmp

Filesize
64KB

Download
memory/3272-6224-0x00007FF7F6200000-0x00007FF7F65F2000-memory.dmp

Filesize
3.9MB

Download
memory/3272-563-0x00007FF7F6200000-0x00007FF7F65F2000-memory.dmp

Filesize
3.9MB

Download
memory/3668-480-0x00007FF78D630000-0x00007FF78DA22000-memory.dmp

Filesize
3.9MB

Download
memory/3668-6159-0x00007FF78D630000-0x00007FF78DA22000-memory.dmp

Filesize
3.9MB

Download
memory/3836-668-0x00007FF70C9B0000-0x00007FF70CDA2000-memory.dmp

Filesize
3.9MB

Download
memory/3836-6208-0x00007FF70C9B0000-0x00007FF70CDA2000-memory.dmp

Filesize
3.9MB

Download
memory/3844-132-0x00007FF764830000-0x00007FF764C22000-memory.dmp

Filesize
3.9MB

Download
memory/4712-6163-0x00007FF670550000-0x00007FF670942000-memory.dmp

Filesize
3.9MB

Download
memory/4712-157-0x00007FF670550000-0x00007FF670942000-memory.dmp

Filesize
3.9MB

Download
memory/4888-6185-0x00007FF67EF30000-0x00007FF67F322000-memory.dmp

Filesize
3.9MB

Download
memory/4888-670-0x00007FF67EF30000-0x00007FF67F322000-memory.dmp

Filesize
3.9MB

Download
memory/5196-326-0x00000206CF210000-0x00000206CF232000-memory.dmp

Filesize
136KB

Download
memory/5196-85-0x00000206E7330000-0x00000206E7340000-memory.dmp

Filesize
64KB

Download
memory/5196-84-0x00007FFAA59E0000-0x00007FFAA64A1000-memory.dmp

Filesize
10.8MB

Download
memory/5348-283-0x00007FF76E770000-0x00007FF76EB62000-memory.dmp

Filesize
3.9MB

Download
memory/5348-6167-0x00007FF76E770000-0x00007FF76EB62000-memory.dmp

Filesize
3.9MB

Download
memory/5616-412-0x00007FF630930000-0x00007FF630D22000-memory.dmp

Filesize
3.9MB

Download
memory/5616-6175-0x00007FF630930000-0x00007FF630D22000-memory.dmp

Filesize
3.9MB

Download
memory/5620-566-0x00007FF7D1E00000-0x00007FF7D21F2000-memory.dmp

Filesize
3.9MB

Download
memory/5620-6171-0x00007FF7D1E00000-0x00007FF7D21F2000-memory.dmp

Filesize
3.9MB

Download
memory/6044-6156-0x00007FF6FB7D0000-0x00007FF6FBBC2000-memory.dmp

Filesize
3.9MB

Download
memory/6044-135-0x00007FF6FB7D0000-0x00007FF6FBBC2000-memory.dmp

Filesize
3.9MB

Download
memory/6056-342-0x00007FF638030000-0x00007FF638422000-memory.dmp

Filesize
3.9MB

Download
memory/6056-6188-0x00007FF638030000-0x00007FF638422000-memory.dmp

Filesize
3.9MB

Download
memory/6080-6199-0x00007FF660980000-0x00007FF660D72000-memory.dmp

Filesize
3.9MB

Download
memory/6080-665-0x00007FF660980000-0x00007FF660D72000-memory.dmp

Filesize
3.9MB

Download