xmrig | a93587f591803ea48e186afe57031285182f2fc723d76dcaeaff9fe1a4e8b6a0

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 12:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
Size

1.9MB
MD5

0bc4de4b0c4daa2826a458e5cf067f4e
SHA1

619e7adb16e3d4331331b361f07ea284b0556131
SHA256

a93587f591803ea48e186afe57031285182f2fc723d76dcaeaff9fe1a4e8b6a0
SHA512

bb7aaaf9cce3def70e025ccbe373c48224862cc8d8008463d8c6a0120348e0a02afa5d9460ec020ae399e451ee14cd0d0d5cc12c4c673e34acff5d06b33b261c
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1eL:NAB1

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/memory/1252-383-0x00007FF67DAA0000-0x00007FF67DE92000-memory.dmp	xmrig
behavioral2/memory/2020-351-0x00007FF6DDD10000-0x00007FF6DE102000-memory.dmp	xmrig
behavioral2/memory/680-350-0x00007FF740210000-0x00007FF740602000-memory.dmp	xmrig
behavioral2/memory/1140-332-0x00007FF66BB10000-0x00007FF66BF02000-memory.dmp	xmrig
behavioral2/memory/2424-311-0x00007FF640100000-0x00007FF6404F2000-memory.dmp	xmrig
behavioral2/memory/2116-280-0x00007FF6F0340000-0x00007FF6F0732000-memory.dmp	xmrig
behavioral2/memory/2900-251-0x00007FF6E4510000-0x00007FF6E4902000-memory.dmp	xmrig
behavioral2/memory/3616-244-0x00007FF7F42A0000-0x00007FF7F4692000-memory.dmp	xmrig
behavioral2/memory/1088-226-0x00007FF6BF4D0000-0x00007FF6BF8C2000-memory.dmp	xmrig
behavioral2/memory/948-217-0x00007FF7F6010000-0x00007FF7F6402000-memory.dmp	xmrig
behavioral2/memory/972-171-0x00007FF685710000-0x00007FF685B02000-memory.dmp	xmrig
behavioral2/memory/3608-138-0x00007FF6210C0000-0x00007FF6214B2000-memory.dmp	xmrig
behavioral2/memory/4264-114-0x00007FF6AAD20000-0x00007FF6AB112000-memory.dmp	xmrig
behavioral2/memory/3596-79-0x00007FF78CF40000-0x00007FF78D332000-memory.dmp	xmrig
behavioral2/memory/4972-483-0x00007FF7A29E0000-0x00007FF7A2DD2000-memory.dmp	xmrig
behavioral2/memory/3016-541-0x00007FF7BEB00000-0x00007FF7BEEF2000-memory.dmp	xmrig
behavioral2/memory/3976-475-0x00007FF62BB00000-0x00007FF62BEF2000-memory.dmp	xmrig
behavioral2/memory/5116-465-0x00007FF68ADE0000-0x00007FF68B1D2000-memory.dmp	xmrig
behavioral2/memory/5084-433-0x00007FF785A20000-0x00007FF785E12000-memory.dmp	xmrig
behavioral2/memory/4476-415-0x00007FF600260000-0x00007FF600652000-memory.dmp	xmrig
behavioral2/memory/4264-4867-0x00007FF6AAD20000-0x00007FF6AB112000-memory.dmp	xmrig
behavioral2/memory/3608-4884-0x00007FF6210C0000-0x00007FF6214B2000-memory.dmp	xmrig
behavioral2/memory/4972-4995-0x00007FF7A29E0000-0x00007FF7A2DD2000-memory.dmp	xmrig
behavioral2/memory/1140-5045-0x00007FF66BB10000-0x00007FF66BF02000-memory.dmp	xmrig
behavioral2/memory/2900-5034-0x00007FF6E4510000-0x00007FF6E4902000-memory.dmp	xmrig
behavioral2/memory/2424-5024-0x00007FF640100000-0x00007FF6404F2000-memory.dmp	xmrig
behavioral2/memory/4476-5057-0x00007FF600260000-0x00007FF600652000-memory.dmp	xmrig
behavioral2/memory/3976-5111-0x00007FF62BB00000-0x00007FF62BEF2000-memory.dmp	xmrig
behavioral2/memory/5116-5121-0x00007FF68ADE0000-0x00007FF68B1D2000-memory.dmp	xmrig
behavioral2/memory/3016-5116-0x00007FF7BEB00000-0x00007FF7BEEF2000-memory.dmp	xmrig
behavioral2/memory/5084-5108-0x00007FF785A20000-0x00007FF785E12000-memory.dmp	xmrig
behavioral2/memory/2020-5100-0x00007FF6DDD10000-0x00007FF6DE102000-memory.dmp	xmrig
behavioral2/memory/680-5073-0x00007FF740210000-0x00007FF740602000-memory.dmp	xmrig
behavioral2/memory/1252-5053-0x00007FF67DAA0000-0x00007FF67DE92000-memory.dmp	xmrig
behavioral2/memory/2944-5477-0x00007FF7099D0000-0x00007FF709DC2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2760	ASgKPDX.exe
3596	QJVeoXT.exe
4264	gJdTwgD.exe
3608	TloOwyT.exe
972	uoAlJjN.exe
948	iPFnSaH.exe
1088	tVjVKRU.exe
3616	zqOJkUV.exe
2900	qtQzilZ.exe
4972	AkjjNTB.exe
2116	vylIexS.exe
2424	dInvUCL.exe
1140	XBsekQL.exe
680	nNqtqGf.exe
2020	mZZDpGK.exe
1252	bESOFTZ.exe
4476	niYBPJZ.exe
3016	lEbJkXM.exe
5084	SUKnOpl.exe
5116	xxPsDhS.exe
3976	MwYYwwE.exe
892	XjLhZqG.exe
4980	DQGuBmw.exe
4528	KRNoEcD.exe
2256	Esaeofe.exe
5048	OGSGBcG.exe
2644	hqQGsnN.exe
4668	WBkhlVZ.exe
3644	GydeUIV.exe
4560	TiTRDap.exe
3740	cKnjvpb.exe
3312	HpiIpOV.exe
2044	lycqqJx.exe
3648	xGfRURE.exe
60	nSGUDPl.exe
2996	kVpAsdj.exe
4848	QDHNJHf.exe
2684	wZwqmfu.exe
4600	YZJoCLX.exe
3972	TONxbMs.exe
4512	MKEDKTN.exe
1272	sdlCgkX.exe
3752	YEzRcat.exe
4508	clrCWiE.exe
2924	wVOBEkm.exe
1012	mTyEKGC.exe
1600	FvSppCx.exe
4692	Jzdsknv.exe
3036	mwKRcJY.exe
2484	WFrzgsI.exe
436	vSBEYUQ.exe
4132	GSCxQxF.exe
716	OPhaauz.exe
720	hAULmBV.exe
4936	PzOyzXQ.exe
3532	ouOxkfN.exe
4288	mpAhPlJ.exe
1668	qHdcOqP.exe
2660	JimSMTf.exe
1588	XOWXjgS.exe
4212	LCAamuf.exe
2572	SavhPLg.exe
1504	uGOGWKU.exe
2972	gaMySwt.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2944-0-0x00007FF7099D0000-0x00007FF709DC2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb0-7.dat	upx
behavioral2/files/0x000c000000023b52-5.dat	upx
behavioral2/files/0x000b000000023bac-15.dat	upx
behavioral2/files/0x000a000000023bb2-23.dat	upx
behavioral2/files/0x000a000000023bb3-37.dat	upx
behavioral2/files/0x000a000000023bb9-61.dat	upx
behavioral2/files/0x000a000000023bbe-133.dat	upx
behavioral2/files/0x000a000000023bc8-193.dat	upx
behavioral2/memory/1252-383-0x00007FF67DAA0000-0x00007FF67DE92000-memory.dmp	upx
behavioral2/memory/2020-351-0x00007FF6DDD10000-0x00007FF6DE102000-memory.dmp	upx
behavioral2/memory/680-350-0x00007FF740210000-0x00007FF740602000-memory.dmp	upx
behavioral2/memory/1140-332-0x00007FF66BB10000-0x00007FF66BF02000-memory.dmp	upx
behavioral2/memory/2424-311-0x00007FF640100000-0x00007FF6404F2000-memory.dmp	upx
behavioral2/memory/2116-280-0x00007FF6F0340000-0x00007FF6F0732000-memory.dmp	upx
behavioral2/memory/2900-251-0x00007FF6E4510000-0x00007FF6E4902000-memory.dmp	upx
behavioral2/memory/3616-244-0x00007FF7F42A0000-0x00007FF7F4692000-memory.dmp	upx
behavioral2/memory/1088-226-0x00007FF6BF4D0000-0x00007FF6BF8C2000-memory.dmp	upx
behavioral2/memory/948-217-0x00007FF7F6010000-0x00007FF7F6402000-memory.dmp	upx
behavioral2/files/0x000a000000023bc5-190.dat	upx
behavioral2/files/0x000a000000023bc7-185.dat	upx
behavioral2/files/0x000a000000023bd3-184.dat	upx
behavioral2/files/0x000a000000023bd1-183.dat	upx
behavioral2/files/0x000a000000023bc6-181.dat	upx
behavioral2/files/0x000a000000023bc4-174.dat	upx
behavioral2/files/0x000a000000023bcd-172.dat	upx
behavioral2/memory/972-171-0x00007FF685710000-0x00007FF685B02000-memory.dmp	upx
behavioral2/files/0x000a000000023bcf-170.dat	upx
behavioral2/files/0x000a000000023bc2-163.dat	upx
behavioral2/files/0x000a000000023bc1-160.dat	upx
behavioral2/files/0x000a000000023bc0-155.dat	upx
behavioral2/files/0x000a000000023bce-152.dat	upx
behavioral2/files/0x000a000000023bc3-139.dat	upx
behavioral2/memory/3608-138-0x00007FF6210C0000-0x00007FF6214B2000-memory.dmp	upx
behavioral2/files/0x000a000000023bcc-137.dat	upx
behavioral2/files/0x000a000000023bca-132.dat	upx
behavioral2/files/0x000a000000023bc9-131.dat	upx
behavioral2/files/0x000a000000023bbf-126.dat	upx
behavioral2/files/0x000a000000023bbd-123.dat	upx
behavioral2/files/0x000a000000023bbc-118.dat	upx
behavioral2/memory/4264-114-0x00007FF6AAD20000-0x00007FF6AB112000-memory.dmp	upx
behavioral2/files/0x000a000000023bbb-110.dat	upx
behavioral2/files/0x000a000000023bcb-136.dat	upx
behavioral2/files/0x000a000000023bba-105.dat	upx
behavioral2/files/0x000a000000023bb5-90.dat	upx
behavioral2/files/0x0031000000023bb7-76.dat	upx
behavioral2/files/0x0031000000023bb6-72.dat	upx
behavioral2/files/0x0031000000023bb8-83.dat	upx
behavioral2/memory/3596-79-0x00007FF78CF40000-0x00007FF78D332000-memory.dmp	upx
behavioral2/memory/4972-483-0x00007FF7A29E0000-0x00007FF7A2DD2000-memory.dmp	upx
behavioral2/memory/3016-541-0x00007FF7BEB00000-0x00007FF7BEEF2000-memory.dmp	upx
behavioral2/memory/3976-475-0x00007FF62BB00000-0x00007FF62BEF2000-memory.dmp	upx
behavioral2/memory/5116-465-0x00007FF68ADE0000-0x00007FF68B1D2000-memory.dmp	upx
behavioral2/memory/5084-433-0x00007FF785A20000-0x00007FF785E12000-memory.dmp	upx
behavioral2/memory/4476-415-0x00007FF600260000-0x00007FF600652000-memory.dmp	upx
behavioral2/files/0x000a000000023bb4-41.dat	upx
behavioral2/files/0x000a000000023bb1-30.dat	upx
behavioral2/memory/2760-11-0x00007FF7DED00000-0x00007FF7DF0F2000-memory.dmp	upx
behavioral2/memory/4264-4867-0x00007FF6AAD20000-0x00007FF6AB112000-memory.dmp	upx
behavioral2/memory/3608-4884-0x00007FF6210C0000-0x00007FF6214B2000-memory.dmp	upx
behavioral2/memory/4972-4995-0x00007FF7A29E0000-0x00007FF7A2DD2000-memory.dmp	upx
behavioral2/memory/1140-5045-0x00007FF66BB10000-0x00007FF66BF02000-memory.dmp	upx
behavioral2/memory/2900-5034-0x00007FF6E4510000-0x00007FF6E4902000-memory.dmp	upx
behavioral2/memory/2424-5024-0x00007FF640100000-0x00007FF6404F2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QRjINDn.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\OFrdssf.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\CtkIYvq.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\SXfmlGm.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\SakNcAs.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\fGGDBXj.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\IBcqPXg.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\uvnotLv.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\zrtpfoU.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\rUjjtIi.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\oAXnoNJ.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\kHZWimW.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\DbUJEkf.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\gOkonpF.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\zuPNOrC.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\AFHgOFb.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\hLmBYbC.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\gQWEYME.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\HLhJiPY.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\yMMweWp.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\xwXsFdS.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\LINZFgh.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\zZrNLbl.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\YDpQQmv.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\ocNiddR.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\PBmbKwe.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\CqeZLcO.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\vDcXQHz.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\dQeYOUP.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\yAnEiZL.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\qVytlME.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\RLWhgpt.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\HpYemoH.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\qVITYzN.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\zIyLfsS.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\llQoZnu.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\VvdTiOp.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\wBADwCN.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\Xojjhwq.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\COgUOLk.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\VjQLsNF.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\jgGHvKN.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\FvdzBHY.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\NrKwXKb.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\vAzhWmx.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\rlRXAxU.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\qfmFwvI.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\ZmTRVQT.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\LbycZue.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\RyERZQf.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\wfGEadU.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\GXFsJTb.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\qFWjHwp.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\pYCfOCG.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\ghxrjcs.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\vTGAWEw.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\PscOndl.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\FQvkBQF.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\uaqJlfq.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\lZApQim.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\SThttel.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\DzqvgnV.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\lmTUTrx.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
File created	C:\Windows\System\elijDKS.exe	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
408	powershell.exe
408	powershell.exe
408	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
Token: SeDebugPrivilege	408	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2300	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 408	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	84
PID 2944 wrote to memory of 408	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	84
PID 2944 wrote to memory of 2760	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	85
PID 2944 wrote to memory of 2760	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	85
PID 2944 wrote to memory of 3596	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	86
PID 2944 wrote to memory of 3596	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	86
PID 2944 wrote to memory of 4264	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	87
PID 2944 wrote to memory of 4264	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	87
PID 2944 wrote to memory of 3608	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	88
PID 2944 wrote to memory of 3608	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	88
PID 2944 wrote to memory of 972	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	89
PID 2944 wrote to memory of 972	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	89
PID 2944 wrote to memory of 948	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	90
PID 2944 wrote to memory of 948	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	90
PID 2944 wrote to memory of 1088	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	91
PID 2944 wrote to memory of 1088	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	91
PID 2944 wrote to memory of 3616	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	92
PID 2944 wrote to memory of 3616	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	92
PID 2944 wrote to memory of 2900	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	93
PID 2944 wrote to memory of 2900	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	93
PID 2944 wrote to memory of 4972	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	94
PID 2944 wrote to memory of 4972	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	94
PID 2944 wrote to memory of 2116	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	95
PID 2944 wrote to memory of 2116	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	95
PID 2944 wrote to memory of 2424	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	96
PID 2944 wrote to memory of 2424	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	96
PID 2944 wrote to memory of 1140	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	97
PID 2944 wrote to memory of 1140	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	97
PID 2944 wrote to memory of 680	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	98
PID 2944 wrote to memory of 680	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	98
PID 2944 wrote to memory of 2020	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	99
PID 2944 wrote to memory of 2020	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	99
PID 2944 wrote to memory of 1252	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	100
PID 2944 wrote to memory of 1252	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	100
PID 2944 wrote to memory of 4476	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	101
PID 2944 wrote to memory of 4476	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	101
PID 2944 wrote to memory of 3016	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	102
PID 2944 wrote to memory of 3016	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	102
PID 2944 wrote to memory of 5084	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	103
PID 2944 wrote to memory of 5084	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	103
PID 2944 wrote to memory of 5116	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	104
PID 2944 wrote to memory of 5116	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	104
PID 2944 wrote to memory of 3976	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	105
PID 2944 wrote to memory of 3976	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	105
PID 2944 wrote to memory of 892	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	106
PID 2944 wrote to memory of 892	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	106
PID 2944 wrote to memory of 4980	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	107
PID 2944 wrote to memory of 4980	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	107
PID 2944 wrote to memory of 3740	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	108
PID 2944 wrote to memory of 3740	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	108
PID 2944 wrote to memory of 4528	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	109
PID 2944 wrote to memory of 4528	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	109
PID 2944 wrote to memory of 2256	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	110
PID 2944 wrote to memory of 2256	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	110
PID 2944 wrote to memory of 5048	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	111
PID 2944 wrote to memory of 5048	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	111
PID 2944 wrote to memory of 2644	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	112
PID 2944 wrote to memory of 2644	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	112
PID 2944 wrote to memory of 4668	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	113
PID 2944 wrote to memory of 4668	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	113
PID 2944 wrote to memory of 3644	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	114
PID 2944 wrote to memory of 3644	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	114
PID 2944 wrote to memory of 4560	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	115
PID 2944 wrote to memory of 4560	2944	0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe	115

C:\Users\Admin\AppData\Local\Temp\0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0bc4de4b0c4daa2826a458e5cf067f4e_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:408
- C:\Windows\System\ASgKPDX.exe
  C:\Windows\System\ASgKPDX.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\QJVeoXT.exe
  C:\Windows\System\QJVeoXT.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\gJdTwgD.exe
  C:\Windows\System\gJdTwgD.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\TloOwyT.exe
  C:\Windows\System\TloOwyT.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\uoAlJjN.exe
  C:\Windows\System\uoAlJjN.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\iPFnSaH.exe
  C:\Windows\System\iPFnSaH.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\tVjVKRU.exe
  C:\Windows\System\tVjVKRU.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\zqOJkUV.exe
  C:\Windows\System\zqOJkUV.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\qtQzilZ.exe
  C:\Windows\System\qtQzilZ.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\AkjjNTB.exe
  C:\Windows\System\AkjjNTB.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\vylIexS.exe
  C:\Windows\System\vylIexS.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\dInvUCL.exe
  C:\Windows\System\dInvUCL.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\XBsekQL.exe
  C:\Windows\System\XBsekQL.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\nNqtqGf.exe
  C:\Windows\System\nNqtqGf.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\mZZDpGK.exe
  C:\Windows\System\mZZDpGK.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\bESOFTZ.exe
  C:\Windows\System\bESOFTZ.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\niYBPJZ.exe
  C:\Windows\System\niYBPJZ.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\lEbJkXM.exe
  C:\Windows\System\lEbJkXM.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\SUKnOpl.exe
  C:\Windows\System\SUKnOpl.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\xxPsDhS.exe
  C:\Windows\System\xxPsDhS.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\MwYYwwE.exe
  C:\Windows\System\MwYYwwE.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\XjLhZqG.exe
  C:\Windows\System\XjLhZqG.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\DQGuBmw.exe
  C:\Windows\System\DQGuBmw.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\cKnjvpb.exe
  C:\Windows\System\cKnjvpb.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\KRNoEcD.exe
  C:\Windows\System\KRNoEcD.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\Esaeofe.exe
  C:\Windows\System\Esaeofe.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\OGSGBcG.exe
  C:\Windows\System\OGSGBcG.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\hqQGsnN.exe
  C:\Windows\System\hqQGsnN.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\WBkhlVZ.exe
  C:\Windows\System\WBkhlVZ.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\GydeUIV.exe
  C:\Windows\System\GydeUIV.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\TiTRDap.exe
  C:\Windows\System\TiTRDap.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\xGfRURE.exe
  C:\Windows\System\xGfRURE.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\HpiIpOV.exe
  C:\Windows\System\HpiIpOV.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\lycqqJx.exe
  C:\Windows\System\lycqqJx.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\YZJoCLX.exe
  C:\Windows\System\YZJoCLX.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\nSGUDPl.exe
  C:\Windows\System\nSGUDPl.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\kVpAsdj.exe
  C:\Windows\System\kVpAsdj.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\wVOBEkm.exe
  C:\Windows\System\wVOBEkm.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\QDHNJHf.exe
  C:\Windows\System\QDHNJHf.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\wZwqmfu.exe
  C:\Windows\System\wZwqmfu.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\TONxbMs.exe
  C:\Windows\System\TONxbMs.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\MKEDKTN.exe
  C:\Windows\System\MKEDKTN.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\sdlCgkX.exe
  C:\Windows\System\sdlCgkX.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\YEzRcat.exe
  C:\Windows\System\YEzRcat.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\clrCWiE.exe
  C:\Windows\System\clrCWiE.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\mTyEKGC.exe
  C:\Windows\System\mTyEKGC.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\FvSppCx.exe
  C:\Windows\System\FvSppCx.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\Jzdsknv.exe
  C:\Windows\System\Jzdsknv.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\mwKRcJY.exe
  C:\Windows\System\mwKRcJY.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\WFrzgsI.exe
  C:\Windows\System\WFrzgsI.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\vSBEYUQ.exe
  C:\Windows\System\vSBEYUQ.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\GSCxQxF.exe
  C:\Windows\System\GSCxQxF.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\OPhaauz.exe
  C:\Windows\System\OPhaauz.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\hAULmBV.exe
  C:\Windows\System\hAULmBV.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\PzOyzXQ.exe
  C:\Windows\System\PzOyzXQ.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\ouOxkfN.exe
  C:\Windows\System\ouOxkfN.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\mpAhPlJ.exe
  C:\Windows\System\mpAhPlJ.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\qHdcOqP.exe
  C:\Windows\System\qHdcOqP.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\JimSMTf.exe
  C:\Windows\System\JimSMTf.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\XOWXjgS.exe
  C:\Windows\System\XOWXjgS.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\LCAamuf.exe
  C:\Windows\System\LCAamuf.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\OJwNVnF.exe
  C:\Windows\System\OJwNVnF.exe
  2⤵
  PID:3944
- C:\Windows\System\SavhPLg.exe
  C:\Windows\System\SavhPLg.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\uGOGWKU.exe
  C:\Windows\System\uGOGWKU.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\gaMySwt.exe
  C:\Windows\System\gaMySwt.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\OFZCCul.exe
  C:\Windows\System\OFZCCul.exe
  2⤵
  PID:1480
- C:\Windows\System\FEIWraj.exe
  C:\Windows\System\FEIWraj.exe
  2⤵
  PID:4084
- C:\Windows\System\lmpbQER.exe
  C:\Windows\System\lmpbQER.exe
  2⤵
  PID:4164
- C:\Windows\System\qkfbpRc.exe
  C:\Windows\System\qkfbpRc.exe
  2⤵
  PID:3540
- C:\Windows\System\XyDyeRP.exe
  C:\Windows\System\XyDyeRP.exe
  2⤵
  PID:1676
- C:\Windows\System\TKqIbDo.exe
  C:\Windows\System\TKqIbDo.exe
  2⤵
  PID:3724
- C:\Windows\System\TtTxtgK.exe
  C:\Windows\System\TtTxtgK.exe
  2⤵
  PID:2360
- C:\Windows\System\HmLVicH.exe
  C:\Windows\System\HmLVicH.exe
  2⤵
  PID:2244
- C:\Windows\System\eLvhCIv.exe
  C:\Windows\System\eLvhCIv.exe
  2⤵
  PID:1292
- C:\Windows\System\wdjPcFf.exe
  C:\Windows\System\wdjPcFf.exe
  2⤵
  PID:1956
- C:\Windows\System\sTGPEgg.exe
  C:\Windows\System\sTGPEgg.exe
  2⤵
  PID:4812
- C:\Windows\System\xwVCXLZ.exe
  C:\Windows\System\xwVCXLZ.exe
  2⤵
  PID:4328
- C:\Windows\System\QYOMdLF.exe
  C:\Windows\System\QYOMdLF.exe
  2⤵
  PID:1560
- C:\Windows\System\HBMMgoc.exe
  C:\Windows\System\HBMMgoc.exe
  2⤵
  PID:1580
- C:\Windows\System\ZZHvnbk.exe
  C:\Windows\System\ZZHvnbk.exe
  2⤵
  PID:5124
- C:\Windows\System\ZqajEGL.exe
  C:\Windows\System\ZqajEGL.exe
  2⤵
  PID:5144
- C:\Windows\System\JsbDdCU.exe
  C:\Windows\System\JsbDdCU.exe
  2⤵
  PID:5160
- C:\Windows\System\OlIuXtl.exe
  C:\Windows\System\OlIuXtl.exe
  2⤵
  PID:5176
- C:\Windows\System\PffkeVt.exe
  C:\Windows\System\PffkeVt.exe
  2⤵
  PID:5196
- C:\Windows\System\sXSOzeE.exe
  C:\Windows\System\sXSOzeE.exe
  2⤵
  PID:5224
- C:\Windows\System\GODkqFp.exe
  C:\Windows\System\GODkqFp.exe
  2⤵
  PID:5248
- C:\Windows\System\ZGOivlR.exe
  C:\Windows\System\ZGOivlR.exe
  2⤵
  PID:5264
- C:\Windows\System\Zdggflt.exe
  C:\Windows\System\Zdggflt.exe
  2⤵
  PID:5280
- C:\Windows\System\fKKcmNN.exe
  C:\Windows\System\fKKcmNN.exe
  2⤵
  PID:5296
- C:\Windows\System\ocyuvlc.exe
  C:\Windows\System\ocyuvlc.exe
  2⤵
  PID:5312
- C:\Windows\System\KnpfEeO.exe
  C:\Windows\System\KnpfEeO.exe
  2⤵
  PID:5328
- C:\Windows\System\Hppkyum.exe
  C:\Windows\System\Hppkyum.exe
  2⤵
  PID:5360
- C:\Windows\System\actanpA.exe
  C:\Windows\System\actanpA.exe
  2⤵
  PID:5388
- C:\Windows\System\SxSXJtg.exe
  C:\Windows\System\SxSXJtg.exe
  2⤵
  PID:5412
- C:\Windows\System\bxXMHEO.exe
  C:\Windows\System\bxXMHEO.exe
  2⤵
  PID:5444
- C:\Windows\System\ftDeZVE.exe
  C:\Windows\System\ftDeZVE.exe
  2⤵
  PID:5524
- C:\Windows\System\qOzApdc.exe
  C:\Windows\System\qOzApdc.exe
  2⤵
  PID:5560
- C:\Windows\System\jgVfyzd.exe
  C:\Windows\System\jgVfyzd.exe
  2⤵
  PID:5584
- C:\Windows\System\SrSUrAx.exe
  C:\Windows\System\SrSUrAx.exe
  2⤵
  PID:5604
- C:\Windows\System\YkkVsbk.exe
  C:\Windows\System\YkkVsbk.exe
  2⤵
  PID:5624
- C:\Windows\System\bsfZEkN.exe
  C:\Windows\System\bsfZEkN.exe
  2⤵
  PID:5644
- C:\Windows\System\MtZrUxK.exe
  C:\Windows\System\MtZrUxK.exe
  2⤵
  PID:5668
- C:\Windows\System\POUxUVv.exe
  C:\Windows\System\POUxUVv.exe
  2⤵
  PID:5692
- C:\Windows\System\kpqGEKN.exe
  C:\Windows\System\kpqGEKN.exe
  2⤵
  PID:5772
- C:\Windows\System\pBetlUl.exe
  C:\Windows\System\pBetlUl.exe
  2⤵
  PID:5804
- C:\Windows\System\BlLwbNU.exe
  C:\Windows\System\BlLwbNU.exe
  2⤵
  PID:5820
- C:\Windows\System\EwrrGBH.exe
  C:\Windows\System\EwrrGBH.exe
  2⤵
  PID:5836
- C:\Windows\System\QPcTiMF.exe
  C:\Windows\System\QPcTiMF.exe
  2⤵
  PID:5852
- C:\Windows\System\zmBSyBn.exe
  C:\Windows\System\zmBSyBn.exe
  2⤵
  PID:5872
- C:\Windows\System\MRngUrf.exe
  C:\Windows\System\MRngUrf.exe
  2⤵
  PID:5892
- C:\Windows\System\izhiFrQ.exe
  C:\Windows\System\izhiFrQ.exe
  2⤵
  PID:5924
- C:\Windows\System\NnZDpsW.exe
  C:\Windows\System\NnZDpsW.exe
  2⤵
  PID:5952
- C:\Windows\System\spQipUz.exe
  C:\Windows\System\spQipUz.exe
  2⤵
  PID:6024
- C:\Windows\System\CbIBsDe.exe
  C:\Windows\System\CbIBsDe.exe
  2⤵
  PID:6044
- C:\Windows\System\EyzPuYG.exe
  C:\Windows\System\EyzPuYG.exe
  2⤵
  PID:6068
- C:\Windows\System\oxLBrzh.exe
  C:\Windows\System\oxLBrzh.exe
  2⤵
  PID:6088
- C:\Windows\System\wWyHZxn.exe
  C:\Windows\System\wWyHZxn.exe
  2⤵
  PID:6112
- C:\Windows\System\kIDTTeh.exe
  C:\Windows\System\kIDTTeh.exe
  2⤵
  PID:6132
- C:\Windows\System\aQswVOR.exe
  C:\Windows\System\aQswVOR.exe
  2⤵
  PID:3272
- C:\Windows\System\urcnSvy.exe
  C:\Windows\System\urcnSvy.exe
  2⤵
  PID:4652
- C:\Windows\System\MJkOEmn.exe
  C:\Windows\System\MJkOEmn.exe
  2⤵
  PID:4276
- C:\Windows\System\hfdLcGh.exe
  C:\Windows\System\hfdLcGh.exe
  2⤵
  PID:3612
- C:\Windows\System\rjQVveL.exe
  C:\Windows\System\rjQVveL.exe
  2⤵
  PID:8
- C:\Windows\System\qIqOjIu.exe
  C:\Windows\System\qIqOjIu.exe
  2⤵
  PID:2872
- C:\Windows\System\bXqwNSh.exe
  C:\Windows\System\bXqwNSh.exe
  2⤵
  PID:2252
- C:\Windows\System\krvYFBL.exe
  C:\Windows\System\krvYFBL.exe
  2⤵
  PID:3100
- C:\Windows\System\lHfznAz.exe
  C:\Windows\System\lHfznAz.exe
  2⤵
  PID:5484
- C:\Windows\System\vnBOebs.exe
  C:\Windows\System\vnBOebs.exe
  2⤵
  PID:5136
- C:\Windows\System\eBlefhm.exe
  C:\Windows\System\eBlefhm.exe
  2⤵
  PID:2380
- C:\Windows\System\RdYQYwX.exe
  C:\Windows\System\RdYQYwX.exe
  2⤵
  PID:5156
- C:\Windows\System\nQyTZqz.exe
  C:\Windows\System\nQyTZqz.exe
  2⤵
  PID:5272
- C:\Windows\System\KZPocOV.exe
  C:\Windows\System\KZPocOV.exe
  2⤵
  PID:5320
- C:\Windows\System\jnEGMqD.exe
  C:\Windows\System\jnEGMqD.exe
  2⤵
  PID:5784
- C:\Windows\System\XgmUKkM.exe
  C:\Windows\System\XgmUKkM.exe
  2⤵
  PID:5544
- C:\Windows\System\wxROExD.exe
  C:\Windows\System\wxROExD.exe
  2⤵
  PID:5512
- C:\Windows\System\UviWxaq.exe
  C:\Windows\System\UviWxaq.exe
  2⤵
  PID:5572
- C:\Windows\System\bdSKWsb.exe
  C:\Windows\System\bdSKWsb.exe
  2⤵
  PID:5636
- C:\Windows\System\BSRYbym.exe
  C:\Windows\System\BSRYbym.exe
  2⤵
  PID:5676
- C:\Windows\System\HpYemoH.exe
  C:\Windows\System\HpYemoH.exe
  2⤵
  PID:5716
- C:\Windows\System\lgNWkrb.exe
  C:\Windows\System\lgNWkrb.exe
  2⤵
  PID:5744
- C:\Windows\System\pvEbUdb.exe
  C:\Windows\System\pvEbUdb.exe
  2⤵
  PID:6080
- C:\Windows\System\wBGqtYJ.exe
  C:\Windows\System\wBGqtYJ.exe
  2⤵
  PID:5844
- C:\Windows\System\ErDOYvl.exe
  C:\Windows\System\ErDOYvl.exe
  2⤵
  PID:5884
- C:\Windows\System\naDNIaS.exe
  C:\Windows\System\naDNIaS.exe
  2⤵
  PID:6160
- C:\Windows\System\mcUsJPn.exe
  C:\Windows\System\mcUsJPn.exe
  2⤵
  PID:6188
- C:\Windows\System\tEheeZY.exe
  C:\Windows\System\tEheeZY.exe
  2⤵
  PID:6208
- C:\Windows\System\sHzOzAB.exe
  C:\Windows\System\sHzOzAB.exe
  2⤵
  PID:6228
- C:\Windows\System\xsQUvmW.exe
  C:\Windows\System\xsQUvmW.exe
  2⤵
  PID:6248
- C:\Windows\System\lVxBpar.exe
  C:\Windows\System\lVxBpar.exe
  2⤵
  PID:6268
- C:\Windows\System\dTqPIEi.exe
  C:\Windows\System\dTqPIEi.exe
  2⤵
  PID:6288
- C:\Windows\System\uWjnHoA.exe
  C:\Windows\System\uWjnHoA.exe
  2⤵
  PID:6312
- C:\Windows\System\bEyvjwU.exe
  C:\Windows\System\bEyvjwU.exe
  2⤵
  PID:6336
- C:\Windows\System\eKgDFSe.exe
  C:\Windows\System\eKgDFSe.exe
  2⤵
  PID:6352
- C:\Windows\System\iMdMgFy.exe
  C:\Windows\System\iMdMgFy.exe
  2⤵
  PID:6380
- C:\Windows\System\iIHJmeF.exe
  C:\Windows\System\iIHJmeF.exe
  2⤵
  PID:6396
- C:\Windows\System\sDTBxSe.exe
  C:\Windows\System\sDTBxSe.exe
  2⤵
  PID:6428
- C:\Windows\System\rvDYIkw.exe
  C:\Windows\System\rvDYIkw.exe
  2⤵
  PID:6444
- C:\Windows\System\OHEQnDs.exe
  C:\Windows\System\OHEQnDs.exe
  2⤵
  PID:6468
- C:\Windows\System\uXfOoPC.exe
  C:\Windows\System\uXfOoPC.exe
  2⤵
  PID:6500
- C:\Windows\System\iiZZQQE.exe
  C:\Windows\System\iiZZQQE.exe
  2⤵
  PID:6524
- C:\Windows\System\UyQsJdq.exe
  C:\Windows\System\UyQsJdq.exe
  2⤵
  PID:6552
- C:\Windows\System\HCBOMwC.exe
  C:\Windows\System\HCBOMwC.exe
  2⤵
  PID:6568
- C:\Windows\System\xMBOqDz.exe
  C:\Windows\System\xMBOqDz.exe
  2⤵
  PID:6588
- C:\Windows\System\xIaCdgA.exe
  C:\Windows\System\xIaCdgA.exe
  2⤵
  PID:6612
- C:\Windows\System\KZnmnCg.exe
  C:\Windows\System\KZnmnCg.exe
  2⤵
  PID:6632
- C:\Windows\System\YMTxhTt.exe
  C:\Windows\System\YMTxhTt.exe
  2⤵
  PID:6664
- C:\Windows\System\mVVyMrJ.exe
  C:\Windows\System\mVVyMrJ.exe
  2⤵
  PID:6688
- C:\Windows\System\tvisacP.exe
  C:\Windows\System\tvisacP.exe
  2⤵
  PID:6708
- C:\Windows\System\rEoUxdc.exe
  C:\Windows\System\rEoUxdc.exe
  2⤵
  PID:6732
- C:\Windows\System\bQgmjlD.exe
  C:\Windows\System\bQgmjlD.exe
  2⤵
  PID:6764
- C:\Windows\System\NgXZLps.exe
  C:\Windows\System\NgXZLps.exe
  2⤵
  PID:6780
- C:\Windows\System\bLKxaPa.exe
  C:\Windows\System\bLKxaPa.exe
  2⤵
  PID:6800
- C:\Windows\System\LTCkxmH.exe
  C:\Windows\System\LTCkxmH.exe
  2⤵
  PID:6932
- C:\Windows\System\WpVZjhX.exe
  C:\Windows\System\WpVZjhX.exe
  2⤵
  PID:6964
- C:\Windows\System\JWIkFwR.exe
  C:\Windows\System\JWIkFwR.exe
  2⤵
  PID:6980
- C:\Windows\System\zFAIOkp.exe
  C:\Windows\System\zFAIOkp.exe
  2⤵
  PID:7004
- C:\Windows\System\JMOHcMQ.exe
  C:\Windows\System\JMOHcMQ.exe
  2⤵
  PID:7020
- C:\Windows\System\DevmqpU.exe
  C:\Windows\System\DevmqpU.exe
  2⤵
  PID:7044
- C:\Windows\System\qOMAMuc.exe
  C:\Windows\System\qOMAMuc.exe
  2⤵
  PID:7064
- C:\Windows\System\tMnkEef.exe
  C:\Windows\System\tMnkEef.exe
  2⤵
  PID:7080
- C:\Windows\System\QRhFqDe.exe
  C:\Windows\System\QRhFqDe.exe
  2⤵
  PID:7108
- C:\Windows\System\KLPSukE.exe
  C:\Windows\System\KLPSukE.exe
  2⤵
  PID:7128
- C:\Windows\System\FbLOLlT.exe
  C:\Windows\System\FbLOLlT.exe
  2⤵
  PID:7148
- C:\Windows\System\BEXiXNa.exe
  C:\Windows\System\BEXiXNa.exe
  2⤵
  PID:4316
- C:\Windows\System\pcLTSoL.exe
  C:\Windows\System\pcLTSoL.exe
  2⤵
  PID:5068
- C:\Windows\System\CMmMGcf.exe
  C:\Windows\System\CMmMGcf.exe
  2⤵
  PID:5932
- C:\Windows\System\qsBqVze.exe
  C:\Windows\System\qsBqVze.exe
  2⤵
  PID:5256
- C:\Windows\System\ZmBZJwB.exe
  C:\Windows\System\ZmBZJwB.exe
  2⤵
  PID:5404
- C:\Windows\System\VENTYQH.exe
  C:\Windows\System\VENTYQH.exe
  2⤵
  PID:6096
- C:\Windows\System\pZfORET.exe
  C:\Windows\System\pZfORET.exe
  2⤵
  PID:4208
- C:\Windows\System\cJfBxJE.exe
  C:\Windows\System\cJfBxJE.exe
  2⤵
  PID:3828
- C:\Windows\System\sHKPNXo.exe
  C:\Windows\System\sHKPNXo.exe
  2⤵
  PID:5792
- C:\Windows\System\kyCSczt.exe
  C:\Windows\System\kyCSczt.exe
  2⤵
  PID:5612
- C:\Windows\System\VqUIUEF.exe
  C:\Windows\System\VqUIUEF.exe
  2⤵
  PID:6008
- C:\Windows\System\rYyBacI.exe
  C:\Windows\System\rYyBacI.exe
  2⤵
  PID:5864
- C:\Windows\System\OPAsPKy.exe
  C:\Windows\System\OPAsPKy.exe
  2⤵
  PID:6152
- C:\Windows\System\hcMaPRF.exe
  C:\Windows\System\hcMaPRF.exe
  2⤵
  PID:4804
- C:\Windows\System\GQMWMoY.exe
  C:\Windows\System\GQMWMoY.exe
  2⤵
  PID:5216
- C:\Windows\System\cjkcXHo.exe
  C:\Windows\System\cjkcXHo.exe
  2⤵
  PID:5192
- C:\Windows\System\aTXZDXz.exe
  C:\Windows\System\aTXZDXz.exe
  2⤵
  PID:6360
- C:\Windows\System\ynmjwBV.exe
  C:\Windows\System\ynmjwBV.exe
  2⤵
  PID:3116
- C:\Windows\System\aexVHkh.exe
  C:\Windows\System\aexVHkh.exe
  2⤵
  PID:3124
- C:\Windows\System\OSvEGxk.exe
  C:\Windows\System\OSvEGxk.exe
  2⤵
  PID:988
- C:\Windows\System\eQRSyWs.exe
  C:\Windows\System\eQRSyWs.exe
  2⤵
  PID:212
- C:\Windows\System\mHhWdKV.exe
  C:\Windows\System\mHhWdKV.exe
  2⤵
  PID:4608
- C:\Windows\System\TxRQuGs.exe
  C:\Windows\System\TxRQuGs.exe
  2⤵
  PID:664
- C:\Windows\System\bDinBmX.exe
  C:\Windows\System\bDinBmX.exe
  2⤵
  PID:3228
- C:\Windows\System\nIhlIAd.exe
  C:\Windows\System\nIhlIAd.exe
  2⤵
  PID:2140
- C:\Windows\System\LBeAQFF.exe
  C:\Windows\System\LBeAQFF.exe
  2⤵
  PID:5064
- C:\Windows\System\qNRnfaE.exe
  C:\Windows\System\qNRnfaE.exe
  2⤵
  PID:4244
- C:\Windows\System\PBZoCRa.exe
  C:\Windows\System\PBZoCRa.exe
  2⤵
  PID:4012
- C:\Windows\System\RQljkwR.exe
  C:\Windows\System\RQljkwR.exe
  2⤵
  PID:1816
- C:\Windows\System\spHfbVf.exe
  C:\Windows\System\spHfbVf.exe
  2⤵
  PID:924
- C:\Windows\System\vvOKvsp.exe
  C:\Windows\System\vvOKvsp.exe
  2⤵
  PID:5596
- C:\Windows\System\CkALcvx.exe
  C:\Windows\System\CkALcvx.exe
  2⤵
  PID:5732
- C:\Windows\System\CHifJpK.exe
  C:\Windows\System\CHifJpK.exe
  2⤵
  PID:2956
- C:\Windows\System\FIpKxwR.exe
  C:\Windows\System\FIpKxwR.exe
  2⤵
  PID:2628
- C:\Windows\System\pVlclAA.exe
  C:\Windows\System\pVlclAA.exe
  2⤵
  PID:6344
- C:\Windows\System\shasnFd.exe
  C:\Windows\System\shasnFd.exe
  2⤵
  PID:6388
- C:\Windows\System\IoYKSnb.exe
  C:\Windows\System\IoYKSnb.exe
  2⤵
  PID:6580
- C:\Windows\System\FvsAtaE.exe
  C:\Windows\System\FvsAtaE.exe
  2⤵
  PID:5356
- C:\Windows\System\FAGsPab.exe
  C:\Windows\System\FAGsPab.exe
  2⤵
  PID:6480
- C:\Windows\System\ozPoCPA.exe
  C:\Windows\System\ozPoCPA.exe
  2⤵
  PID:5780
- C:\Windows\System\CbppHZk.exe
  C:\Windows\System\CbppHZk.exe
  2⤵
  PID:6680
- C:\Windows\System\CkNQwJO.exe
  C:\Windows\System\CkNQwJO.exe
  2⤵
  PID:6204
- C:\Windows\System\oCnyWgy.exe
  C:\Windows\System\oCnyWgy.exe
  2⤵
  PID:6540
- C:\Windows\System\xbixRZi.exe
  C:\Windows\System\xbixRZi.exe
  2⤵
  PID:7012
- C:\Windows\System\kQnCMKP.exe
  C:\Windows\System\kQnCMKP.exe
  2⤵
  PID:7052
- C:\Windows\System\bBeWBLj.exe
  C:\Windows\System\bBeWBLj.exe
  2⤵
  PID:7184
- C:\Windows\System\iKufARK.exe
  C:\Windows\System\iKufARK.exe
  2⤵
  PID:7204
- C:\Windows\System\wSSNFml.exe
  C:\Windows\System\wSSNFml.exe
  2⤵
  PID:7232
- C:\Windows\System\YVQwWgu.exe
  C:\Windows\System\YVQwWgu.exe
  2⤵
  PID:7248
- C:\Windows\System\XhBaBuO.exe
  C:\Windows\System\XhBaBuO.exe
  2⤵
  PID:7276
- C:\Windows\System\ycrCHYe.exe
  C:\Windows\System\ycrCHYe.exe
  2⤵
  PID:7296
- C:\Windows\System\LVhhbIU.exe
  C:\Windows\System\LVhhbIU.exe
  2⤵
  PID:7320
- C:\Windows\System\lHHeGrq.exe
  C:\Windows\System\lHHeGrq.exe
  2⤵
  PID:7340
- C:\Windows\System\NxcTPqX.exe
  C:\Windows\System\NxcTPqX.exe
  2⤵
  PID:7360
- C:\Windows\System\nBnVHLg.exe
  C:\Windows\System\nBnVHLg.exe
  2⤵
  PID:7380
- C:\Windows\System\EcLpjiR.exe
  C:\Windows\System\EcLpjiR.exe
  2⤵
  PID:7548
- C:\Windows\System\lnJrRPI.exe
  C:\Windows\System\lnJrRPI.exe
  2⤵
  PID:7596
- C:\Windows\System\ZCQbrcr.exe
  C:\Windows\System\ZCQbrcr.exe
  2⤵
  PID:7616
- C:\Windows\System\VmknwVH.exe
  C:\Windows\System\VmknwVH.exe
  2⤵
  PID:7636
- C:\Windows\System\paSPQub.exe
  C:\Windows\System\paSPQub.exe
  2⤵
  PID:7656
- C:\Windows\System\hkgUmCc.exe
  C:\Windows\System\hkgUmCc.exe
  2⤵
  PID:7676
- C:\Windows\System\dVRVTvq.exe
  C:\Windows\System\dVRVTvq.exe
  2⤵
  PID:7696
- C:\Windows\System\zUvEqSg.exe
  C:\Windows\System\zUvEqSg.exe
  2⤵
  PID:7712
- C:\Windows\System\yJeEjxj.exe
  C:\Windows\System\yJeEjxj.exe
  2⤵
  PID:7732
- C:\Windows\System\ougkDKD.exe
  C:\Windows\System\ougkDKD.exe
  2⤵
  PID:7748
- C:\Windows\System\JCyzoek.exe
  C:\Windows\System\JCyzoek.exe
  2⤵
  PID:7768
- C:\Windows\System\LVSHiQB.exe
  C:\Windows\System\LVSHiQB.exe
  2⤵
  PID:7784
- C:\Windows\System\qGTsNAq.exe
  C:\Windows\System\qGTsNAq.exe
  2⤵
  PID:7804
- C:\Windows\System\zGpQoNx.exe
  C:\Windows\System\zGpQoNx.exe
  2⤵
  PID:7820
- C:\Windows\System\UXHUexh.exe
  C:\Windows\System\UXHUexh.exe
  2⤵
  PID:7836
- C:\Windows\System\GwvQkHV.exe
  C:\Windows\System\GwvQkHV.exe
  2⤵
  PID:7852
- C:\Windows\System\KzrLEfr.exe
  C:\Windows\System\KzrLEfr.exe
  2⤵
  PID:7872
- C:\Windows\System\HJmevGk.exe
  C:\Windows\System\HJmevGk.exe
  2⤵
  PID:7888
- C:\Windows\System\JOjFrCm.exe
  C:\Windows\System\JOjFrCm.exe
  2⤵
  PID:7916
- C:\Windows\System\ygbNvvD.exe
  C:\Windows\System\ygbNvvD.exe
  2⤵
  PID:7936
- C:\Windows\System\nBgtLuQ.exe
  C:\Windows\System\nBgtLuQ.exe
  2⤵
  PID:7960
- C:\Windows\System\dDasyNe.exe
  C:\Windows\System\dDasyNe.exe
  2⤵
  PID:7976
- C:\Windows\System\odJhwTc.exe
  C:\Windows\System\odJhwTc.exe
  2⤵
  PID:8008
- C:\Windows\System\EbXzPle.exe
  C:\Windows\System\EbXzPle.exe
  2⤵
  PID:8028
- C:\Windows\System\sPfWSej.exe
  C:\Windows\System\sPfWSej.exe
  2⤵
  PID:8048
- C:\Windows\System\xTaNRKc.exe
  C:\Windows\System\xTaNRKc.exe
  2⤵
  PID:8072
- C:\Windows\System\oHpbnfe.exe
  C:\Windows\System\oHpbnfe.exe
  2⤵
  PID:8092
- C:\Windows\System\EacYqQM.exe
  C:\Windows\System\EacYqQM.exe
  2⤵
  PID:8112
- C:\Windows\System\aTZbyhF.exe
  C:\Windows\System\aTZbyhF.exe
  2⤵
  PID:8148
- C:\Windows\System\lrMsOGX.exe
  C:\Windows\System\lrMsOGX.exe
  2⤵
  PID:8164
- C:\Windows\System\sXtOsuT.exe
  C:\Windows\System\sXtOsuT.exe
  2⤵
  PID:8184
- C:\Windows\System\lARecAw.exe
  C:\Windows\System\lARecAw.exe
  2⤵
  PID:7160
- C:\Windows\System\ZqxozGX.exe
  C:\Windows\System\ZqxozGX.exe
  2⤵
  PID:6576
- C:\Windows\System\gzFPjAA.exe
  C:\Windows\System\gzFPjAA.exe
  2⤵
  PID:6644
- C:\Windows\System\vNgcsMm.exe
  C:\Windows\System\vNgcsMm.exe
  2⤵
  PID:5232
- C:\Windows\System\NjsaqWk.exe
  C:\Windows\System\NjsaqWk.exe
  2⤵
  PID:6876
- C:\Windows\System\mAUPklW.exe
  C:\Windows\System\mAUPklW.exe
  2⤵
  PID:6808
- C:\Windows\System\FeBeHGj.exe
  C:\Windows\System\FeBeHGj.exe
  2⤵
  PID:6392
- C:\Windows\System\rdDFDaX.exe
  C:\Windows\System\rdDFDaX.exe
  2⤵
  PID:6972
- C:\Windows\System\MmJBTNb.exe
  C:\Windows\System\MmJBTNb.exe
  2⤵
  PID:7072
- C:\Windows\System\BdZKmoZ.exe
  C:\Windows\System\BdZKmoZ.exe
  2⤵
  PID:5900
- C:\Windows\System\bcNxzyp.exe
  C:\Windows\System\bcNxzyp.exe
  2⤵
  PID:7288
- C:\Windows\System\neasLqW.exe
  C:\Windows\System\neasLqW.exe
  2⤵
  PID:1632
- C:\Windows\System\hjExhGi.exe
  C:\Windows\System\hjExhGi.exe
  2⤵
  PID:6648
- C:\Windows\System\ygMqPTR.exe
  C:\Windows\System\ygMqPTR.exe
  2⤵
  PID:3348
- C:\Windows\System\IvmXrEH.exe
  C:\Windows\System\IvmXrEH.exe
  2⤵
  PID:1280
- C:\Windows\System\wTDuMyA.exe
  C:\Windows\System\wTDuMyA.exe
  2⤵
  PID:6884
- C:\Windows\System\jPMvkCM.exe
  C:\Windows\System\jPMvkCM.exe
  2⤵
  PID:6888
- C:\Windows\System\ZCjuiPg.exe
  C:\Windows\System\ZCjuiPg.exe
  2⤵
  PID:6816
- C:\Windows\System\noEDxxE.exe
  C:\Windows\System\noEDxxE.exe
  2⤵
  PID:7508
- C:\Windows\System\miuHDqg.exe
  C:\Windows\System\miuHDqg.exe
  2⤵
  PID:7076
- C:\Windows\System\hZywPKy.exe
  C:\Windows\System\hZywPKy.exe
  2⤵
  PID:5204
- C:\Windows\System\eqlGDuI.exe
  C:\Windows\System\eqlGDuI.exe
  2⤵
  PID:2624
- C:\Windows\System\jORGoAo.exe
  C:\Windows\System\jORGoAo.exe
  2⤵
  PID:7368
- C:\Windows\System\dTaHWiS.exe
  C:\Windows\System\dTaHWiS.exe
  2⤵
  PID:7312
- C:\Windows\System\saQITcB.exe
  C:\Windows\System\saQITcB.exe
  2⤵
  PID:6376
- C:\Windows\System\geXFTpD.exe
  C:\Windows\System\geXFTpD.exe
  2⤵
  PID:6752
- C:\Windows\System\EnQBWrd.exe
  C:\Windows\System\EnQBWrd.exe
  2⤵
  PID:4340
- C:\Windows\System\zBihbXV.exe
  C:\Windows\System\zBihbXV.exe
  2⤵
  PID:524
- C:\Windows\System\WpkYCZl.exe
  C:\Windows\System\WpkYCZl.exe
  2⤵
  PID:916
- C:\Windows\System\GLFbCxp.exe
  C:\Windows\System\GLFbCxp.exe
  2⤵
  PID:7612
- C:\Windows\System\qJBisQQ.exe
  C:\Windows\System\qJBisQQ.exe
  2⤵
  PID:3328
- C:\Windows\System\rcUJExw.exe
  C:\Windows\System\rcUJExw.exe
  2⤵
  PID:7684
- C:\Windows\System\nelIoJn.exe
  C:\Windows\System\nelIoJn.exe
  2⤵
  PID:7704
- C:\Windows\System\uBqVFsy.exe
  C:\Windows\System\uBqVFsy.exe
  2⤵
  PID:1352
- C:\Windows\System\FucvQlz.exe
  C:\Windows\System\FucvQlz.exe
  2⤵
  PID:6512
- C:\Windows\System\sXOHMRt.exe
  C:\Windows\System\sXOHMRt.exe
  2⤵
  PID:7832
- C:\Windows\System\oGwXFQh.exe
  C:\Windows\System\oGwXFQh.exe
  2⤵
  PID:7488
- C:\Windows\System\yXnnMyd.exe
  C:\Windows\System\yXnnMyd.exe
  2⤵
  PID:7896
- C:\Windows\System\hcZqxqC.exe
  C:\Windows\System\hcZqxqC.exe
  2⤵
  PID:7952
- C:\Windows\System\nWEjPyG.exe
  C:\Windows\System\nWEjPyG.exe
  2⤵
  PID:6920
- C:\Windows\System\oIGvnNW.exe
  C:\Windows\System\oIGvnNW.exe
  2⤵
  PID:8068
- C:\Windows\System\DdBJPKm.exe
  C:\Windows\System\DdBJPKm.exe
  2⤵
  PID:8204
- C:\Windows\System\RlcWqFo.exe
  C:\Windows\System\RlcWqFo.exe
  2⤵
  PID:8224
- C:\Windows\System\lPVMMxw.exe
  C:\Windows\System\lPVMMxw.exe
  2⤵
  PID:8248
- C:\Windows\System\CbMTGjL.exe
  C:\Windows\System\CbMTGjL.exe
  2⤵
  PID:8272
- C:\Windows\System\gNghNOm.exe
  C:\Windows\System\gNghNOm.exe
  2⤵
  PID:8300
- C:\Windows\System\EEcLwvk.exe
  C:\Windows\System\EEcLwvk.exe
  2⤵
  PID:8328
- C:\Windows\System\PRDGnYb.exe
  C:\Windows\System\PRDGnYb.exe
  2⤵
  PID:8348
- C:\Windows\System\abXZzbt.exe
  C:\Windows\System\abXZzbt.exe
  2⤵
  PID:8372
- C:\Windows\System\TfTVslw.exe
  C:\Windows\System\TfTVslw.exe
  2⤵
  PID:8396
- C:\Windows\System\nvkjNTs.exe
  C:\Windows\System\nvkjNTs.exe
  2⤵
  PID:8416
- C:\Windows\System\hQYgTRd.exe
  C:\Windows\System\hQYgTRd.exe
  2⤵
  PID:8432
- C:\Windows\System\tmsMupi.exe
  C:\Windows\System\tmsMupi.exe
  2⤵
  PID:8456
- C:\Windows\System\dWlXiSF.exe
  C:\Windows\System\dWlXiSF.exe
  2⤵
  PID:8476
- C:\Windows\System\DDEcumJ.exe
  C:\Windows\System\DDEcumJ.exe
  2⤵
  PID:8496
- C:\Windows\System\gHNlhTb.exe
  C:\Windows\System\gHNlhTb.exe
  2⤵
  PID:8520
- C:\Windows\System\WAGJPSq.exe
  C:\Windows\System\WAGJPSq.exe
  2⤵
  PID:8544
- C:\Windows\System\WCWTHGU.exe
  C:\Windows\System\WCWTHGU.exe
  2⤵
  PID:8560
- C:\Windows\System\lEXsnxJ.exe
  C:\Windows\System\lEXsnxJ.exe
  2⤵
  PID:8576
- C:\Windows\System\hmczkdY.exe
  C:\Windows\System\hmczkdY.exe
  2⤵
  PID:8596
- C:\Windows\System\LPAAhLY.exe
  C:\Windows\System\LPAAhLY.exe
  2⤵
  PID:8620
- C:\Windows\System\EVEnIAa.exe
  C:\Windows\System\EVEnIAa.exe
  2⤵
  PID:8640
- C:\Windows\System\wgcXGXE.exe
  C:\Windows\System\wgcXGXE.exe
  2⤵
  PID:8660
- C:\Windows\System\fEaMXEJ.exe
  C:\Windows\System\fEaMXEJ.exe
  2⤵
  PID:8688
- C:\Windows\System\TttPgTj.exe
  C:\Windows\System\TttPgTj.exe
  2⤵
  PID:8712
- C:\Windows\System\DolYGHW.exe
  C:\Windows\System\DolYGHW.exe
  2⤵
  PID:8740
- C:\Windows\System\WCziNOg.exe
  C:\Windows\System\WCziNOg.exe
  2⤵
  PID:8760
- C:\Windows\System\qjqMJrQ.exe
  C:\Windows\System\qjqMJrQ.exe
  2⤵
  PID:8784
- C:\Windows\System\hZUakcd.exe
  C:\Windows\System\hZUakcd.exe
  2⤵
  PID:8808
- C:\Windows\System\DQOdBAn.exe
  C:\Windows\System\DQOdBAn.exe
  2⤵
  PID:8832
- C:\Windows\System\MLmhmwW.exe
  C:\Windows\System\MLmhmwW.exe
  2⤵
  PID:8852
- C:\Windows\System\EyVaOyz.exe
  C:\Windows\System\EyVaOyz.exe
  2⤵
  PID:8872
- C:\Windows\System\YXFTAmG.exe
  C:\Windows\System\YXFTAmG.exe
  2⤵
  PID:8892
- C:\Windows\System\DBeZJJT.exe
  C:\Windows\System\DBeZJJT.exe
  2⤵
  PID:8912
- C:\Windows\System\AdGocMA.exe
  C:\Windows\System\AdGocMA.exe
  2⤵
  PID:8936
- C:\Windows\System\kJoiRJd.exe
  C:\Windows\System\kJoiRJd.exe
  2⤵
  PID:8960
- C:\Windows\System\CJdwwLc.exe
  C:\Windows\System\CJdwwLc.exe
  2⤵
  PID:8984
- C:\Windows\System\qLUBDDF.exe
  C:\Windows\System\qLUBDDF.exe
  2⤵
  PID:9000
- C:\Windows\System\CdYoqmA.exe
  C:\Windows\System\CdYoqmA.exe
  2⤵
  PID:9040
- C:\Windows\System\tBURLMF.exe
  C:\Windows\System\tBURLMF.exe
  2⤵
  PID:9056
- C:\Windows\System\lJWKlOr.exe
  C:\Windows\System\lJWKlOr.exe
  2⤵
  PID:9108
- C:\Windows\System\qXsXefW.exe
  C:\Windows\System\qXsXefW.exe
  2⤵
  PID:9136
- C:\Windows\System\ePxzavU.exe
  C:\Windows\System\ePxzavU.exe
  2⤵
  PID:9164
- C:\Windows\System\CVTtTzo.exe
  C:\Windows\System\CVTtTzo.exe
  2⤵
  PID:9180
- C:\Windows\System\wCAIkHP.exe
  C:\Windows\System\wCAIkHP.exe
  2⤵
  PID:9204
- C:\Windows\System\QeXJMJb.exe
  C:\Windows\System\QeXJMJb.exe
  2⤵
  PID:8172
- C:\Windows\System\cSHitHf.exe
  C:\Windows\System\cSHitHf.exe
  2⤵
  PID:5380
- C:\Windows\System\ndlWiEd.exe
  C:\Windows\System\ndlWiEd.exe
  2⤵
  PID:6304
- C:\Windows\System\RVDNcTm.exe
  C:\Windows\System\RVDNcTm.exe
  2⤵
  PID:6912
- C:\Windows\System\otoAnRP.exe
  C:\Windows\System\otoAnRP.exe
  2⤵
  PID:7256
- C:\Windows\System\xSusoEA.exe
  C:\Windows\System\xSusoEA.exe
  2⤵
  PID:7316
- C:\Windows\System\GTojWKX.exe
  C:\Windows\System\GTojWKX.exe
  2⤵
  PID:7260
- C:\Windows\System\wWLjEJc.exe
  C:\Windows\System\wWLjEJc.exe
  2⤵
  PID:7576
- C:\Windows\System\mhkfIRi.exe
  C:\Windows\System\mhkfIRi.exe
  2⤵
  PID:6812
- C:\Windows\System\GZeizpx.exe
  C:\Windows\System\GZeizpx.exe
  2⤵
  PID:7456
- C:\Windows\System\jTPfpKQ.exe
  C:\Windows\System\jTPfpKQ.exe
  2⤵
  PID:332
- C:\Windows\System\yXDTuhV.exe
  C:\Windows\System\yXDTuhV.exe
  2⤵
  PID:7588
- C:\Windows\System\QsuBtTa.exe
  C:\Windows\System\QsuBtTa.exe
  2⤵
  PID:7668
- C:\Windows\System\pBSdOdW.exe
  C:\Windows\System\pBSdOdW.exe
  2⤵
  PID:1892
- C:\Windows\System\DPoTpnA.exe
  C:\Windows\System\DPoTpnA.exe
  2⤵
  PID:7472
- C:\Windows\System\UKxshuU.exe
  C:\Windows\System\UKxshuU.exe
  2⤵
  PID:7484
- C:\Windows\System\ntqRHHc.exe
  C:\Windows\System\ntqRHHc.exe
  2⤵
  PID:7928
- C:\Windows\System\nCyBNjj.exe
  C:\Windows\System\nCyBNjj.exe
  2⤵
  PID:6220
- C:\Windows\System\uTeiyUa.exe
  C:\Windows\System\uTeiyUa.exe
  2⤵
  PID:8124
- C:\Windows\System\AfWcANL.exe
  C:\Windows\System\AfWcANL.exe
  2⤵
  PID:8360
- C:\Windows\System\LEkqNXT.exe
  C:\Windows\System\LEkqNXT.exe
  2⤵
  PID:7536
- C:\Windows\System\HcqHhvp.exe
  C:\Windows\System\HcqHhvp.exe
  2⤵
  PID:3044
- C:\Windows\System\zCxvFED.exe
  C:\Windows\System\zCxvFED.exe
  2⤵
  PID:5832
- C:\Windows\System\JpAAgdF.exe
  C:\Windows\System\JpAAgdF.exe
  2⤵
  PID:4896
- C:\Windows\System\ysLykwS.exe
  C:\Windows\System\ysLykwS.exe
  2⤵
  PID:9236
- C:\Windows\System\IWkBpxA.exe
  C:\Windows\System\IWkBpxA.exe
  2⤵
  PID:9260
- C:\Windows\System\NtZmLGZ.exe
  C:\Windows\System\NtZmLGZ.exe
  2⤵
  PID:9284
- C:\Windows\System\MovWbPT.exe
  C:\Windows\System\MovWbPT.exe
  2⤵
  PID:9304
- C:\Windows\System\uCwelNL.exe
  C:\Windows\System\uCwelNL.exe
  2⤵
  PID:9324
- C:\Windows\System\MhbFVHI.exe
  C:\Windows\System\MhbFVHI.exe
  2⤵
  PID:9352
- C:\Windows\System\AxCjotq.exe
  C:\Windows\System\AxCjotq.exe
  2⤵
  PID:9372
- C:\Windows\System\AhThIhB.exe
  C:\Windows\System\AhThIhB.exe
  2⤵
  PID:9400
- C:\Windows\System\IAfSpoW.exe
  C:\Windows\System\IAfSpoW.exe
  2⤵
  PID:9420
- C:\Windows\System\EgWnMzV.exe
  C:\Windows\System\EgWnMzV.exe
  2⤵
  PID:9440
- C:\Windows\System\OVuyFXW.exe
  C:\Windows\System\OVuyFXW.exe
  2⤵
  PID:9468
- C:\Windows\System\ShlJRsM.exe
  C:\Windows\System\ShlJRsM.exe
  2⤵
  PID:9488
- C:\Windows\System\ckhkBjf.exe
  C:\Windows\System\ckhkBjf.exe
  2⤵
  PID:9512
- C:\Windows\System\mdOrLJG.exe
  C:\Windows\System\mdOrLJG.exe
  2⤵
  PID:9532
- C:\Windows\System\lIITRLl.exe
  C:\Windows\System\lIITRLl.exe
  2⤵
  PID:9556
- C:\Windows\System\uNemmUb.exe
  C:\Windows\System\uNemmUb.exe
  2⤵
  PID:9576
- C:\Windows\System\nHZeeVj.exe
  C:\Windows\System\nHZeeVj.exe
  2⤵
  PID:9600
- C:\Windows\System\qssdnlf.exe
  C:\Windows\System\qssdnlf.exe
  2⤵
  PID:9624
- C:\Windows\System\DKCfxRE.exe
  C:\Windows\System\DKCfxRE.exe
  2⤵
  PID:9644
- C:\Windows\System\PZGAZvb.exe
  C:\Windows\System\PZGAZvb.exe
  2⤵
  PID:9664
- C:\Windows\System\QcgYvYr.exe
  C:\Windows\System\QcgYvYr.exe
  2⤵
  PID:9692
- C:\Windows\System\uRLeaAX.exe
  C:\Windows\System\uRLeaAX.exe
  2⤵
  PID:9716
- C:\Windows\System\XTccLbZ.exe
  C:\Windows\System\XTccLbZ.exe
  2⤵
  PID:9740
- C:\Windows\System\ysrkOBC.exe
  C:\Windows\System\ysrkOBC.exe
  2⤵
  PID:9764
- C:\Windows\System\JUyPutM.exe
  C:\Windows\System\JUyPutM.exe
  2⤵
  PID:8700
- C:\Windows\System\CmvfTXc.exe
  C:\Windows\System\CmvfTXc.exe
  2⤵
  PID:8776
- C:\Windows\System\BDtkFZP.exe
  C:\Windows\System\BDtkFZP.exe
  2⤵
  PID:8820
- C:\Windows\System\rnVUXIc.exe
  C:\Windows\System\rnVUXIc.exe
  2⤵
  PID:9176
- C:\Windows\System\BrXwWOS.exe
  C:\Windows\System\BrXwWOS.exe
  2⤵
  PID:8636
- C:\Windows\System\reYNkKz.exe
  C:\Windows\System\reYNkKz.exe
  2⤵
  PID:9476
- C:\Windows\System\UoRYFJa.exe
  C:\Windows\System\UoRYFJa.exe
  2⤵
  PID:8908
- C:\Windows\System\cMkYaaW.exe
  C:\Windows\System\cMkYaaW.exe
  2⤵
  PID:9872
- C:\Windows\System\jqCRpWR.exe
  C:\Windows\System\jqCRpWR.exe
  2⤵
  PID:9892
- C:\Windows\System\gaVrZJM.exe
  C:\Windows\System\gaVrZJM.exe
  2⤵
  PID:8424
- C:\Windows\System\SmTeQut.exe
  C:\Windows\System\SmTeQut.exe
  2⤵
  PID:8612
- C:\Windows\System\xdMFMns.exe
  C:\Windows\System\xdMFMns.exe
  2⤵
  PID:8572
- C:\Windows\System\xTsYAJz.exe
  C:\Windows\System\xTsYAJz.exe
  2⤵
  PID:8532
- C:\Windows\System\ByHcqIg.exe
  C:\Windows\System\ByHcqIg.exe
  2⤵
  PID:7172
- C:\Windows\System\xMYoZJe.exe
  C:\Windows\System\xMYoZJe.exe
  2⤵
  PID:6872
- C:\Windows\System\wPAezff.exe
  C:\Windows\System\wPAezff.exe
  2⤵
  PID:8992
- C:\Windows\System\QGuhIru.exe
  C:\Windows\System\QGuhIru.exe
  2⤵
  PID:3924
- C:\Windows\System\FJJNHeB.exe
  C:\Windows\System\FJJNHeB.exe
  2⤵
  PID:9960
- C:\Windows\System\LTRyxkw.exe
  C:\Windows\System\LTRyxkw.exe
  2⤵
  PID:7628
- C:\Windows\System\VLiyuLx.exe
  C:\Windows\System\VLiyuLx.exe
  2⤵
  PID:8676
- C:\Windows\System\gShCrWt.exe
  C:\Windows\System\gShCrWt.exe
  2⤵
  PID:9316
- C:\Windows\System\iyOtukf.exe
  C:\Windows\System\iyOtukf.exe
  2⤵
  PID:9480
- C:\Windows\System\jQJophu.exe
  C:\Windows\System\jQJophu.exe
  2⤵
  PID:9656
- C:\Windows\System\OcJAsMo.exe
  C:\Windows\System\OcJAsMo.exe
  2⤵
  PID:9980
- C:\Windows\System\rPsgakn.exe
  C:\Windows\System\rPsgakn.exe
  2⤵
  PID:6840
- C:\Windows\System\WsQejbz.exe
  C:\Windows\System\WsQejbz.exe
  2⤵
  PID:10028
- C:\Windows\System\cPYEoCc.exe
  C:\Windows\System\cPYEoCc.exe
  2⤵
  PID:7652
- C:\Windows\System\MmRapJF.exe
  C:\Windows\System\MmRapJF.exe
  2⤵
  PID:7760
- C:\Windows\System\gVJFmmU.exe
  C:\Windows\System\gVJFmmU.exe
  2⤵
  PID:6672
- C:\Windows\System\HNplTsS.exe
  C:\Windows\System\HNplTsS.exe
  2⤵
  PID:6564
- C:\Windows\System\ctrWwVe.exe
  C:\Windows\System\ctrWwVe.exe
  2⤵
  PID:10264
- C:\Windows\System\JkFPwCy.exe
  C:\Windows\System\JkFPwCy.exe
  2⤵
  PID:10284
- C:\Windows\System\CcrQBon.exe
  C:\Windows\System\CcrQBon.exe
  2⤵
  PID:10300
- C:\Windows\System\VPnTLBW.exe
  C:\Windows\System\VPnTLBW.exe
  2⤵
  PID:10324
- C:\Windows\System\ugZncci.exe
  C:\Windows\System\ugZncci.exe
  2⤵
  PID:10348
- C:\Windows\System\ykaCkVu.exe
  C:\Windows\System\ykaCkVu.exe
  2⤵
  PID:10364
- C:\Windows\System\GeIDshx.exe
  C:\Windows\System\GeIDshx.exe
  2⤵
  PID:10388
- C:\Windows\System\vYNlSQq.exe
  C:\Windows\System\vYNlSQq.exe
  2⤵
  PID:10408
- C:\Windows\System\Bjlnvcz.exe
  C:\Windows\System\Bjlnvcz.exe
  2⤵
  PID:10436
- C:\Windows\System\mZyLCJg.exe
  C:\Windows\System\mZyLCJg.exe
  2⤵
  PID:10456
- C:\Windows\System\WcIayQy.exe
  C:\Windows\System\WcIayQy.exe
  2⤵
  PID:10472
- C:\Windows\System\zJUHjoD.exe
  C:\Windows\System\zJUHjoD.exe
  2⤵
  PID:10492
- C:\Windows\System\vRCAivg.exe
  C:\Windows\System\vRCAivg.exe
  2⤵
  PID:10508
- C:\Windows\System\iscPFYn.exe
  C:\Windows\System\iscPFYn.exe
  2⤵
  PID:10528
- C:\Windows\System\OLsnrQJ.exe
  C:\Windows\System\OLsnrQJ.exe
  2⤵
  PID:10552
- C:\Windows\System\eUtZpdl.exe
  C:\Windows\System\eUtZpdl.exe
  2⤵
  PID:10580
- C:\Windows\System\vZfpqpV.exe
  C:\Windows\System\vZfpqpV.exe
  2⤵
  PID:10596
- C:\Windows\System\JwknpsD.exe
  C:\Windows\System\JwknpsD.exe
  2⤵
  PID:10616
- C:\Windows\System\Yncrndb.exe
  C:\Windows\System\Yncrndb.exe
  2⤵
  PID:10640
- C:\Windows\System\ghcuGtf.exe
  C:\Windows\System\ghcuGtf.exe
  2⤵
  PID:10660
- C:\Windows\System\ogqWgQF.exe
  C:\Windows\System\ogqWgQF.exe
  2⤵
  PID:10680
- C:\Windows\System\ePwiveR.exe
  C:\Windows\System\ePwiveR.exe
  2⤵
  PID:10704
- C:\Windows\System\sZMcdgV.exe
  C:\Windows\System\sZMcdgV.exe
  2⤵
  PID:10720
- C:\Windows\System\lXPxWln.exe
  C:\Windows\System\lXPxWln.exe
  2⤵
  PID:10736
- C:\Windows\System\VIQqHSg.exe
  C:\Windows\System\VIQqHSg.exe
  2⤵
  PID:10756
- C:\Windows\System\UTHmbwO.exe
  C:\Windows\System\UTHmbwO.exe
  2⤵
  PID:10772
- C:\Windows\System\rGdJntc.exe
  C:\Windows\System\rGdJntc.exe
  2⤵
  PID:10816
- C:\Windows\System\jeknWLI.exe
  C:\Windows\System\jeknWLI.exe
  2⤵
  PID:10832
- C:\Windows\System\VwwQCsa.exe
  C:\Windows\System\VwwQCsa.exe
  2⤵
  PID:10856
- C:\Windows\System\TvexyTS.exe
  C:\Windows\System\TvexyTS.exe
  2⤵
  PID:10916
- C:\Windows\System\YzEwkeO.exe
  C:\Windows\System\YzEwkeO.exe
  2⤵
  PID:10936
- C:\Windows\System\CmKtrAm.exe
  C:\Windows\System\CmKtrAm.exe
  2⤵
  PID:10968
- C:\Windows\System\dXjHLwQ.exe
  C:\Windows\System\dXjHLwQ.exe
  2⤵
  PID:11008
- C:\Windows\System\ooPYutO.exe
  C:\Windows\System\ooPYutO.exe
  2⤵
  PID:11052
- C:\Windows\System\lBgwpld.exe
  C:\Windows\System\lBgwpld.exe
  2⤵
  PID:11076
- C:\Windows\System\TQFZVDk.exe
  C:\Windows\System\TQFZVDk.exe
  2⤵
  PID:11108
- C:\Windows\System\EmkLDPr.exe
  C:\Windows\System\EmkLDPr.exe
  2⤵
  PID:11128
- C:\Windows\System\hGdlDrk.exe
  C:\Windows\System\hGdlDrk.exe
  2⤵
  PID:11152
- C:\Windows\System\tNByrgY.exe
  C:\Windows\System\tNByrgY.exe
  2⤵
  PID:11172
- C:\Windows\System\DsVsnOO.exe
  C:\Windows\System\DsVsnOO.exe
  2⤵
  PID:11192
- C:\Windows\System\zIfRhup.exe
  C:\Windows\System\zIfRhup.exe
  2⤵
  PID:11216
- C:\Windows\System\XrZCjvl.exe
  C:\Windows\System\XrZCjvl.exe
  2⤵
  PID:11236
- C:\Windows\System\xyuYrTR.exe
  C:\Windows\System\xyuYrTR.exe
  2⤵
  PID:11260
- C:\Windows\System\FVzXyAO.exe
  C:\Windows\System\FVzXyAO.exe
  2⤵
  PID:9368
- C:\Windows\System\pdNhdyW.exe
  C:\Windows\System\pdNhdyW.exe
  2⤵
  PID:9540
- C:\Windows\System\kAesoEo.exe
  C:\Windows\System\kAesoEo.exe
  2⤵
  PID:3092
- C:\Windows\System\YSVprbN.exe
  C:\Windows\System\YSVprbN.exe
  2⤵
  PID:8920
- C:\Windows\System\edAKacx.exe
  C:\Windows\System\edAKacx.exe
  2⤵
  PID:6996
- C:\Windows\System\iRSGjcT.exe
  C:\Windows\System\iRSGjcT.exe
  2⤵
  PID:9064
- C:\Windows\System\WdmthVw.exe
  C:\Windows\System\WdmthVw.exe
  2⤵
  PID:7120
- C:\Windows\System\gPEOsYd.exe
  C:\Windows\System\gPEOsYd.exe
  2⤵
  PID:8464
- C:\Windows\System\VrvoOKk.exe
  C:\Windows\System\VrvoOKk.exe
  2⤵
  PID:8180
- C:\Windows\System\xqUoIrD.exe
  C:\Windows\System\xqUoIrD.exe
  2⤵
  PID:3300
- C:\Windows\System\IPFCVsb.exe
  C:\Windows\System\IPFCVsb.exe
  2⤵
  PID:5708
- C:\Windows\System\ypeZFTi.exe
  C:\Windows\System\ypeZFTi.exe
  2⤵
  PID:9592
- C:\Windows\System\ZKtTvve.exe
  C:\Windows\System\ZKtTvve.exe
  2⤵
  PID:11292
- C:\Windows\System\MvrZSow.exe
  C:\Windows\System\MvrZSow.exe
  2⤵
  PID:11312
- C:\Windows\System\WDJqdtv.exe
  C:\Windows\System\WDJqdtv.exe
  2⤵
  PID:11336
- C:\Windows\System\FrDmatJ.exe
  C:\Windows\System\FrDmatJ.exe
  2⤵
  PID:11360
- C:\Windows\System\kCiaMRL.exe
  C:\Windows\System\kCiaMRL.exe
  2⤵
  PID:11380
- C:\Windows\System\ysPevBF.exe
  C:\Windows\System\ysPevBF.exe
  2⤵
  PID:11408
- C:\Windows\System\BUEAllz.exe
  C:\Windows\System\BUEAllz.exe
  2⤵
  PID:11432
- C:\Windows\System\nedxUrQ.exe
  C:\Windows\System\nedxUrQ.exe
  2⤵
  PID:11448
- C:\Windows\System\KuiGTFl.exe
  C:\Windows\System\KuiGTFl.exe
  2⤵
  PID:11472
- C:\Windows\System\pRlZMkC.exe
  C:\Windows\System\pRlZMkC.exe
  2⤵
  PID:11500
- C:\Windows\System\seSjKtZ.exe
  C:\Windows\System\seSjKtZ.exe
  2⤵
  PID:11520
- C:\Windows\System\CvyZGPq.exe
  C:\Windows\System\CvyZGPq.exe
  2⤵
  PID:11540
- C:\Windows\System\JSAxZLr.exe
  C:\Windows\System\JSAxZLr.exe
  2⤵
  PID:11564
- C:\Windows\System\QXCZFar.exe
  C:\Windows\System\QXCZFar.exe
  2⤵
  PID:11588
- C:\Windows\System\EUuzQen.exe
  C:\Windows\System\EUuzQen.exe
  2⤵
  PID:11608
- C:\Windows\System\UXPHkgy.exe
  C:\Windows\System\UXPHkgy.exe
  2⤵
  PID:11632
- C:\Windows\System\LMLQDAk.exe
  C:\Windows\System\LMLQDAk.exe
  2⤵
  PID:11648
- C:\Windows\System\yvYaDZB.exe
  C:\Windows\System\yvYaDZB.exe
  2⤵
  PID:11672
- C:\Windows\System\AQKEXQO.exe
  C:\Windows\System\AQKEXQO.exe
  2⤵
  PID:11692
- C:\Windows\System\SobLYTa.exe
  C:\Windows\System\SobLYTa.exe
  2⤵
  PID:11716
- C:\Windows\System\RMsIeEI.exe
  C:\Windows\System\RMsIeEI.exe
  2⤵
  PID:11736
- C:\Windows\System\KCssBaG.exe
  C:\Windows\System\KCssBaG.exe
  2⤵
  PID:11764
- C:\Windows\System\zywjfqe.exe
  C:\Windows\System\zywjfqe.exe
  2⤵
  PID:11784
- C:\Windows\System\MjNPXZE.exe
  C:\Windows\System\MjNPXZE.exe
  2⤵
  PID:11804
- C:\Windows\System\dEJXMaV.exe
  C:\Windows\System\dEJXMaV.exe
  2⤵
  PID:11824
- C:\Windows\System\gTZLhCb.exe
  C:\Windows\System\gTZLhCb.exe
  2⤵
  PID:11844
- C:\Windows\System\DFnrxKu.exe
  C:\Windows\System\DFnrxKu.exe
  2⤵
  PID:11872
- C:\Windows\System\RiiuEVU.exe
  C:\Windows\System\RiiuEVU.exe
  2⤵
  PID:11892
- C:\Windows\System\kkjVObI.exe
  C:\Windows\System\kkjVObI.exe
  2⤵
  PID:11908
- C:\Windows\System\ELISWZF.exe
  C:\Windows\System\ELISWZF.exe
  2⤵
  PID:11944
- C:\Windows\System\UdzKDVf.exe
  C:\Windows\System\UdzKDVf.exe
  2⤵
  PID:11960
- C:\Windows\System\EcYEdlE.exe
  C:\Windows\System\EcYEdlE.exe
  2⤵
  PID:11984
- C:\Windows\System\cejAlrY.exe
  C:\Windows\System\cejAlrY.exe
  2⤵
  PID:12000
- C:\Windows\System\bzINXuZ.exe
  C:\Windows\System\bzINXuZ.exe
  2⤵
  PID:12016
- C:\Windows\System\WqqbuLu.exe
  C:\Windows\System\WqqbuLu.exe
  2⤵
  PID:12036
- C:\Windows\System\slzLfnp.exe
  C:\Windows\System\slzLfnp.exe
  2⤵
  PID:12052
- C:\Windows\System\rEUEJtQ.exe
  C:\Windows\System\rEUEJtQ.exe
  2⤵
  PID:12072
- C:\Windows\System\bbYfKyN.exe
  C:\Windows\System\bbYfKyN.exe
  2⤵
  PID:12088
- C:\Windows\System\SwKhNQL.exe
  C:\Windows\System\SwKhNQL.exe
  2⤵
  PID:12108
- C:\Windows\System\TVUHnIr.exe
  C:\Windows\System\TVUHnIr.exe
  2⤵
  PID:12128
- C:\Windows\System\YPaliTG.exe
  C:\Windows\System\YPaliTG.exe
  2⤵
  PID:12148
- C:\Windows\System\ZtVpvdN.exe
  C:\Windows\System\ZtVpvdN.exe
  2⤵
  PID:12172
- C:\Windows\System\boONKDP.exe
  C:\Windows\System\boONKDP.exe
  2⤵
  PID:12188
- C:\Windows\System\RakusvW.exe
  C:\Windows\System\RakusvW.exe
  2⤵
  PID:12204
- C:\Windows\System\DFayUga.exe
  C:\Windows\System\DFayUga.exe
  2⤵
  PID:12224
- C:\Windows\System\Mocwfzw.exe
  C:\Windows\System\Mocwfzw.exe
  2⤵
  PID:12244
- C:\Windows\System\nveSTGe.exe
  C:\Windows\System\nveSTGe.exe
  2⤵
  PID:12260
- C:\Windows\System\VICgObo.exe
  C:\Windows\System\VICgObo.exe
  2⤵
  PID:12280
- C:\Windows\System\TTIZppm.exe
  C:\Windows\System\TTIZppm.exe
  2⤵
  PID:6256
- C:\Windows\System\ZERuPTD.exe
  C:\Windows\System\ZERuPTD.exe
  2⤵
  PID:7140
- C:\Windows\System\EzwuYED.exe
  C:\Windows\System\EzwuYED.exe
  2⤵
  PID:8680
- C:\Windows\System\dvoMszZ.exe
  C:\Windows\System\dvoMszZ.exe
  2⤵
  PID:10276
- C:\Windows\System\xrGCIAC.exe
  C:\Windows\System\xrGCIAC.exe
  2⤵
  PID:9276
- C:\Windows\System\BAUxZgy.exe
  C:\Windows\System\BAUxZgy.exe
  2⤵
  PID:10404
- C:\Windows\System\bGhGxSt.exe
  C:\Windows\System\bGhGxSt.exe
  2⤵
  PID:10480
- C:\Windows\System\RTKxHmW.exe
  C:\Windows\System\RTKxHmW.exe
  2⤵
  PID:9572
- C:\Windows\System\gpHnwWt.exe
  C:\Windows\System\gpHnwWt.exe
  2⤵
  PID:10628
- C:\Windows\System\fcQDfzh.exe
  C:\Windows\System\fcQDfzh.exe
  2⤵
  PID:10716
- C:\Windows\System\IHPxrmV.exe
  C:\Windows\System\IHPxrmV.exe
  2⤵
  PID:9748
- C:\Windows\System\CNHqSbo.exe
  C:\Windows\System\CNHqSbo.exe
  2⤵
  PID:9800
- C:\Windows\System\MzCeOXe.exe
  C:\Windows\System\MzCeOXe.exe
  2⤵
  PID:9088
- C:\Windows\System\jGlQBZW.exe
  C:\Windows\System\jGlQBZW.exe
  2⤵
  PID:6440
- C:\Windows\System\qiVyFxy.exe
  C:\Windows\System\qiVyFxy.exe
  2⤵
  PID:5496
- C:\Windows\System\rocLYpc.exe
  C:\Windows\System\rocLYpc.exe
  2⤵
  PID:9616
- C:\Windows\System\OfNfvEB.exe
  C:\Windows\System\OfNfvEB.exe
  2⤵
  PID:11084
- C:\Windows\System\YmNeBwo.exe
  C:\Windows\System\YmNeBwo.exe
  2⤵
  PID:8220
- C:\Windows\System\jCmysRf.exe
  C:\Windows\System\jCmysRf.exe
  2⤵
  PID:8472
- C:\Windows\System\pKUnOEe.exe
  C:\Windows\System\pKUnOEe.exe
  2⤵
  PID:9552
- C:\Windows\System\OngRaEi.exe
  C:\Windows\System\OngRaEi.exe
  2⤵
  PID:9816
- C:\Windows\System\xFIdEam.exe
  C:\Windows\System\xFIdEam.exe
  2⤵
  PID:8956
- C:\Windows\System\FEWunWT.exe
  C:\Windows\System\FEWunWT.exe
  2⤵
  PID:7728
- C:\Windows\System\aMNUMja.exe
  C:\Windows\System\aMNUMja.exe
  2⤵
  PID:12292
- C:\Windows\System\OfuZGxV.exe
  C:\Windows\System\OfuZGxV.exe
  2⤵
  PID:12316
- C:\Windows\System\UpALprU.exe
  C:\Windows\System\UpALprU.exe
  2⤵
  PID:12332
- C:\Windows\System\EcaCnGY.exe
  C:\Windows\System\EcaCnGY.exe
  2⤵
  PID:12360
- C:\Windows\System\DfzkuJp.exe
  C:\Windows\System\DfzkuJp.exe
  2⤵
  PID:12380
- C:\Windows\System\BoOmJWe.exe
  C:\Windows\System\BoOmJWe.exe
  2⤵
  PID:12396
- C:\Windows\System\miitiIr.exe
  C:\Windows\System\miitiIr.exe
  2⤵
  PID:12420
- C:\Windows\System\laLEVji.exe
  C:\Windows\System\laLEVji.exe
  2⤵
  PID:12440
- C:\Windows\System\hRfzJrd.exe
  C:\Windows\System\hRfzJrd.exe
  2⤵
  PID:12460
- C:\Windows\System\IlkpXex.exe
  C:\Windows\System\IlkpXex.exe
  2⤵
  PID:12484
- C:\Windows\System\qmchfKy.exe
  C:\Windows\System\qmchfKy.exe
  2⤵
  PID:12508
- C:\Windows\System\bVEXzWx.exe
  C:\Windows\System\bVEXzWx.exe
  2⤵
  PID:12528
- C:\Windows\System\UeNeIIL.exe
  C:\Windows\System\UeNeIIL.exe
  2⤵
  PID:12548
- C:\Windows\System\zVEFjAr.exe
  C:\Windows\System\zVEFjAr.exe
  2⤵
  PID:12580
- C:\Windows\System\SvNpqAF.exe
  C:\Windows\System\SvNpqAF.exe
  2⤵
  PID:12608
- C:\Windows\System\YHxffQW.exe
  C:\Windows\System\YHxffQW.exe
  2⤵
  PID:12628
- C:\Windows\System\tRqDfua.exe
  C:\Windows\System\tRqDfua.exe
  2⤵
  PID:12652
- C:\Windows\System\BRvmyBu.exe
  C:\Windows\System\BRvmyBu.exe
  2⤵
  PID:12672
- C:\Windows\System\gkuctUm.exe
  C:\Windows\System\gkuctUm.exe
  2⤵
  PID:12692
- C:\Windows\System\uxxsQWB.exe
  C:\Windows\System\uxxsQWB.exe
  2⤵
  PID:12712
- C:\Windows\System\HmPmkUB.exe
  C:\Windows\System\HmPmkUB.exe
  2⤵
  PID:12736
- C:\Windows\System\qOhfjei.exe
  C:\Windows\System\qOhfjei.exe
  2⤵
  PID:12756
- C:\Windows\System\FjgVjIo.exe
  C:\Windows\System\FjgVjIo.exe
  2⤵
  PID:12780
- C:\Windows\System\OBCVLVI.exe
  C:\Windows\System\OBCVLVI.exe
  2⤵
  PID:12796
- C:\Windows\System\bNDICMi.exe
  C:\Windows\System\bNDICMi.exe
  2⤵
  PID:12812
- C:\Windows\System\ZhMIuES.exe
  C:\Windows\System\ZhMIuES.exe
  2⤵
  PID:12828
- C:\Windows\System\ZYgQLbI.exe
  C:\Windows\System\ZYgQLbI.exe
  2⤵
  PID:12844
- C:\Windows\System\BOveJYa.exe
  C:\Windows\System\BOveJYa.exe
  2⤵
  PID:12864
- C:\Windows\System\eKCuygr.exe
  C:\Windows\System\eKCuygr.exe
  2⤵
  PID:12880
- C:\Windows\System\OjAliFS.exe
  C:\Windows\System\OjAliFS.exe
  2⤵
  PID:12896
- C:\Windows\System\HWikpif.exe
  C:\Windows\System\HWikpif.exe
  2⤵
  PID:12916
- C:\Windows\System\AYPJxJC.exe
  C:\Windows\System\AYPJxJC.exe
  2⤵
  PID:12932
- C:\Windows\System\hJrGDcW.exe
  C:\Windows\System\hJrGDcW.exe
  2⤵
  PID:12948
- C:\Windows\System\eQFiNcK.exe
  C:\Windows\System\eQFiNcK.exe
  2⤵
  PID:12976
- C:\Windows\System\gRgINzE.exe
  C:\Windows\System\gRgINzE.exe
  2⤵
  PID:12996
- C:\Windows\System\bBrYRQk.exe
  C:\Windows\System\bBrYRQk.exe
  2⤵
  PID:13020
- C:\Windows\System\XYPVCkH.exe
  C:\Windows\System\XYPVCkH.exe
  2⤵
  PID:13040
- C:\Windows\System\HsjrUNS.exe
  C:\Windows\System\HsjrUNS.exe
  2⤵
  PID:13064
- C:\Windows\System\lAbzHNI.exe
  C:\Windows\System\lAbzHNI.exe
  2⤵
  PID:13088
- C:\Windows\System\vOqPFKW.exe
  C:\Windows\System\vOqPFKW.exe
  2⤵
  PID:13108
- C:\Windows\System\UakeJvK.exe
  C:\Windows\System\UakeJvK.exe
  2⤵
  PID:13132
- C:\Windows\System\yMlbNtv.exe
  C:\Windows\System\yMlbNtv.exe
  2⤵
  PID:11164
- C:\Windows\System\vSsQRrD.exe
  C:\Windows\System\vSsQRrD.exe
  2⤵
  PID:8408
- C:\Windows\System\eobFktB.exe
  C:\Windows\System\eobFktB.exe
  2⤵
  PID:12432
- C:\Windows\System\TuTryne.exe
  C:\Windows\System\TuTryne.exe
  2⤵
  PID:12600
- C:\Windows\System\kxRbRKx.exe
  C:\Windows\System\kxRbRKx.exe
  2⤵
  PID:12028
- C:\Windows\System\uGwdxCT.exe
  C:\Windows\System\uGwdxCT.exe
  2⤵
  PID:12924
- C:\Windows\System\NYAUaiv.exe
  C:\Windows\System\NYAUaiv.exe
  2⤵
  PID:12892
- C:\Windows\System\iHqMizv.exe
  C:\Windows\System\iHqMizv.exe
  2⤵
  PID:9416
- C:\Windows\System\CywJvgW.exe
  C:\Windows\System\CywJvgW.exe
  2⤵
  PID:11580
- C:\Windows\System\LQWvKQn.exe
  C:\Windows\System\LQWvKQn.exe
  2⤵
  PID:4284
- C:\Windows\System\Nwqjgug.exe
  C:\Windows\System\Nwqjgug.exe
  2⤵
  PID:3708
- C:\Windows\System\xhONXjw.exe
  C:\Windows\System\xhONXjw.exe
  2⤵
  PID:12668
- C:\Windows\System\rsySDlw.exe
  C:\Windows\System\rsySDlw.exe
  2⤵
  PID:10952
- C:\Windows\System\CRKTwXu.exe
  C:\Windows\System\CRKTwXu.exe
  2⤵
  PID:12824
- C:\Windows\System\AjWeisn.exe
  C:\Windows\System\AjWeisn.exe
  2⤵
  PID:12468
- C:\Windows\System\EJsBDaV.exe
  C:\Windows\System\EJsBDaV.exe
  2⤵
  PID:11468
- C:\Windows\System\XdILoUq.exe
  C:\Windows\System\XdILoUq.exe
  2⤵
  PID:13236
- C:\Windows\System\nXtGubv.exe
  C:\Windows\System\nXtGubv.exe
  2⤵
  PID:12168
- C:\Windows\System\veQOCLG.exe
  C:\Windows\System\veQOCLG.exe
  2⤵
  PID:10416
- C:\Windows\System\BhAlFBP.exe
  C:\Windows\System\BhAlFBP.exe
  2⤵
  PID:9584
- C:\Windows\System\SKBPQuo.exe
  C:\Windows\System\SKBPQuo.exe
  2⤵
  PID:12728
- C:\Windows\System\lhVdZwx.exe
  C:\Windows\System\lhVdZwx.exe
  2⤵
  PID:12856
- C:\Windows\System\wuJsrJZ.exe
  C:\Windows\System\wuJsrJZ.exe
  2⤵
  PID:12940
- C:\Windows\System\iDQFWQE.exe
  C:\Windows\System\iDQFWQE.exe
  2⤵
  PID:10944
- C:\Windows\System\vuPWmPa.exe
  C:\Windows\System\vuPWmPa.exe
  2⤵
  PID:11016
- C:\Windows\System\RKapfCk.exe
  C:\Windows\System\RKapfCk.exe
  2⤵
  PID:8412
- C:\Windows\System\JgneXFu.exe
  C:\Windows\System\JgneXFu.exe
  2⤵
  PID:8632
- C:\Windows\System\PhKIxic.exe
  C:\Windows\System\PhKIxic.exe
  2⤵
  PID:12324
- C:\Windows\System\ePFpcIS.exe
  C:\Windows\System\ePFpcIS.exe
  2⤵
  PID:12456
- C:\Windows\System\fvMeNDl.exe
  C:\Windows\System\fvMeNDl.exe
  2⤵
  PID:10536
- C:\Windows\System\AYTNwwe.exe
  C:\Windows\System\AYTNwwe.exe
  2⤵
  PID:6424
- C:\Windows\System\jtRRRFg.exe
  C:\Windows\System\jtRRRFg.exe
  2⤵
  PID:12256
- C:\Windows\System\EOBXNMv.exe
  C:\Windows\System\EOBXNMv.exe
  2⤵
  PID:7816
- C:\Windows\System\PDhjOIe.exe
  C:\Windows\System\PDhjOIe.exe
  2⤵
  PID:12596
- C:\Windows\System\xgfssTj.exe
  C:\Windows\System\xgfssTj.exe
  2⤵
  PID:11888
- C:\Windows\System\IsyeCeJ.exe
  C:\Windows\System\IsyeCeJ.exe
  2⤵
  PID:11548
- C:\Windows\System\unKPvPY.exe
  C:\Windows\System\unKPvPY.exe
  2⤵
  PID:9596
- C:\Windows\System\KgMQvuS.exe
  C:\Windows\System\KgMQvuS.exe
  2⤵
  PID:11952
- C:\Windows\System\wGeBqFV.exe
  C:\Windows\System\wGeBqFV.exe
  2⤵
  PID:4352
- C:\Windows\System\AfTGeDQ.exe
  C:\Windows\System\AfTGeDQ.exe
  2⤵
  PID:11864
- C:\Windows\System\padQasD.exe
  C:\Windows\System\padQasD.exe
  2⤵
  PID:13156
- C:\Windows\System\dXKWDjz.exe
  C:\Windows\System\dXKWDjz.exe
  2⤵
  PID:13192
- C:\Windows\System\mydNSLK.exe
  C:\Windows\System\mydNSLK.exe
  2⤵
  PID:13272
- C:\Windows\System\cPjVNcm.exe
  C:\Windows\System\cPjVNcm.exe
  2⤵
  PID:11700
- C:\Windows\System\YngBZfU.exe
  C:\Windows\System\YngBZfU.exe
  2⤵
  PID:11604
- C:\Windows\System\iawDFfe.exe
  C:\Windows\System\iawDFfe.exe
  2⤵
  PID:11420
- C:\Windows\System\BoesWDb.exe
  C:\Windows\System\BoesWDb.exe
  2⤵
  PID:2076
- C:\Windows\System\cJARiNL.exe
  C:\Windows\System\cJARiNL.exe
  2⤵
  PID:9296
- C:\Windows\System\gPapEIp.exe
  C:\Windows\System\gPapEIp.exe
  2⤵
  PID:10696
- C:\Windows\System\tbSurmd.exe
  C:\Windows\System\tbSurmd.exe
  2⤵
  PID:10852
- C:\Windows\System\xNdcKRq.exe
  C:\Windows\System\xNdcKRq.exe
  2⤵
  PID:11900
- C:\Windows\System\EHqbmem.exe
  C:\Windows\System\EHqbmem.exe
  2⤵
  PID:12012
- C:\Windows\System\Orqsqaf.exe
  C:\Windows\System\Orqsqaf.exe
  2⤵
  PID:9732
- C:\Windows\System\UHqrKTv.exe
  C:\Windows\System\UHqrKTv.exe
  2⤵
  PID:12564
- C:\Windows\System\PzLKyZa.exe
  C:\Windows\System\PzLKyZa.exe
  2⤵
  PID:3104
- C:\Windows\System\wcuCPIs.exe
  C:\Windows\System\wcuCPIs.exe
  2⤵
  PID:600
- C:\Windows\System\VEIaOtL.exe
  C:\Windows\System\VEIaOtL.exe
  2⤵
  PID:8704
- C:\Windows\System\TfFOwyR.exe
  C:\Windows\System\TfFOwyR.exe
  2⤵
  PID:13260
- C:\Windows\System\yCfxmFc.exe
  C:\Windows\System\yCfxmFc.exe
  2⤵
  PID:12576
- C:\Windows\System\vYRgRXH.exe
  C:\Windows\System\vYRgRXH.exe
  2⤵
  PID:10764
- C:\Windows\System\VRhNlBG.exe
  C:\Windows\System\VRhNlBG.exe
  2⤵
  PID:13160
- C:\Windows\System\QRqKrzi.exe
  C:\Windows\System\QRqKrzi.exe
  2⤵
  PID:10636
- C:\Windows\System\fYSFwIz.exe
  C:\Windows\System\fYSFwIz.exe
  2⤵
  PID:9380
- C:\Windows\System\aGczTMv.exe
  C:\Windows\System\aGczTMv.exe
  2⤵
  PID:13048
- C:\Windows\System\ZYtVBVy.exe
  C:\Windows\System\ZYtVBVy.exe
  2⤵
  PID:12680
- C:\Windows\System\dGucoSi.exe
  C:\Windows\System\dGucoSi.exe
  2⤵
  PID:11684
- C:\Windows\System\FYgBhaW.exe
  C:\Windows\System\FYgBhaW.exe
  2⤵
  PID:12592
- C:\Windows\System\okfNANF.exe
  C:\Windows\System\okfNANF.exe
  2⤵
  PID:12180
- C:\Windows\System\QDEpSqz.exe
  C:\Windows\System\QDEpSqz.exe
  2⤵
  PID:12416
- C:\Windows\System\YLqFsJD.exe
  C:\Windows\System\YLqFsJD.exe
  2⤵
  PID:12820
- C:\Windows\System\ilHcAyA.exe
  C:\Windows\System\ilHcAyA.exe
  2⤵
  PID:11860
- C:\Windows\System\iIsIAun.exe
  C:\Windows\System\iIsIAun.exe
  2⤵
  PID:13052
- C:\Windows\System\TrAESdg.exe
  C:\Windows\System\TrAESdg.exe
  2⤵
  PID:13196
- C:\Windows\System\bvKzEeX.exe
  C:\Windows\System\bvKzEeX.exe
  2⤵
  PID:12776
- C:\Windows\System\cOmHihe.exe
  C:\Windows\System\cOmHihe.exe
  2⤵
  PID:13328
- C:\Windows\System\AKovtnN.exe
  C:\Windows\System\AKovtnN.exe
  2⤵
  PID:13348
- C:\Windows\System\jNBjfHK.exe
  C:\Windows\System\jNBjfHK.exe
  2⤵
  PID:13372
- C:\Windows\System\KdtHREd.exe
  C:\Windows\System\KdtHREd.exe
  2⤵
  PID:13400
- C:\Windows\System\jViMCHw.exe
  C:\Windows\System\jViMCHw.exe
  2⤵
  PID:13420
- C:\Windows\System\uSRXCqT.exe
  C:\Windows\System\uSRXCqT.exe
  2⤵
  PID:14116
- C:\Windows\System\GHVTYuA.exe
  C:\Windows\System\GHVTYuA.exe
  2⤵
  PID:14184
- C:\Windows\System\qeHNkRi.exe
  C:\Windows\System\qeHNkRi.exe
  2⤵
  PID:10588
- C:\Windows\System\CkgnPpw.exe
  C:\Windows\System\CkgnPpw.exe
  2⤵
  PID:13256
- C:\Windows\System\kmOQoKu.exe
  C:\Windows\System\kmOQoKu.exe
  2⤵
  PID:10688
- C:\Windows\System\HjbkJmH.exe
  C:\Windows\System\HjbkJmH.exe
  2⤵
  PID:13360
- C:\Windows\System\AGXUhpl.exe
  C:\Windows\System\AGXUhpl.exe
  2⤵
  PID:8728
- C:\Windows\System\exCzoij.exe
  C:\Windows\System\exCzoij.exe
  2⤵
  PID:4544
- C:\Windows\System\YewdKqr.exe
  C:\Windows\System\YewdKqr.exe
  2⤵
  PID:13672
- C:\Windows\System\gFrUyHs.exe
  C:\Windows\System\gFrUyHs.exe
  2⤵
  PID:13864
- C:\Windows\System\sJNDVfI.exe
  C:\Windows\System\sJNDVfI.exe
  2⤵
  PID:13828
- C:\Windows\System\jlKaCXd.exe
  C:\Windows\System\jlKaCXd.exe
  2⤵
  PID:13748
- C:\Windows\System\DpBYOJr.exe
  C:\Windows\System\DpBYOJr.exe
  2⤵
  PID:14084
- C:\Windows\System\uRBvlPU.exe
  C:\Windows\System\uRBvlPU.exe
  2⤵
  PID:13948
- C:\Windows\System\OTkTByO.exe
  C:\Windows\System\OTkTByO.exe
  2⤵
  PID:13888
- C:\Windows\System\qokBdAp.exe
  C:\Windows\System\qokBdAp.exe
  2⤵
  PID:14172
- C:\Windows\System\bfVTEKz.exe
  C:\Windows\System\bfVTEKz.exe
  2⤵
  PID:11440
- C:\Windows\System\OiYFYfB.exe
  C:\Windows\System\OiYFYfB.exe
  2⤵
  PID:3968
- C:\Windows\System\xPnrRzb.exe
  C:\Windows\System\xPnrRzb.exe
  2⤵
  PID:13936
- C:\Windows\System\JkVAeAp.exe
  C:\Windows\System\JkVAeAp.exe
  2⤵
  PID:9268
- C:\Windows\System\YmSLQNz.exe
  C:\Windows\System\YmSLQNz.exe
  2⤵
  PID:11032
- C:\Windows\System\fKhXjxT.exe
  C:\Windows\System\fKhXjxT.exe
  2⤵
  PID:13960
- C:\Windows\System\aMfMjmR.exe
  C:\Windows\System\aMfMjmR.exe
  2⤵
  PID:14028
- C:\Windows\System\UNpGpaE.exe
  C:\Windows\System\UNpGpaE.exe
  2⤵
  PID:11968
- C:\Windows\System\Nahwayz.exe
  C:\Windows\System\Nahwayz.exe
  2⤵
  PID:14152
- C:\Windows\System\mWccUyo.exe
  C:\Windows\System\mWccUyo.exe
  2⤵
  PID:13912
- C:\Windows\System\DGQWayZ.exe
  C:\Windows\System\DGQWayZ.exe
  2⤵
  PID:8736
- C:\Windows\System\ePZWYHb.exe
  C:\Windows\System\ePZWYHb.exe
  2⤵
  PID:13724
- C:\Windows\System\FKHWqgB.exe
  C:\Windows\System\FKHWqgB.exe
  2⤵
  PID:10956
- C:\Windows\System\nopQzXv.exe
  C:\Windows\System\nopQzXv.exe
  2⤵
  PID:2444
- C:\Windows\System\nKECaLz.exe
  C:\Windows\System\nKECaLz.exe
  2⤵
  PID:14292
- C:\Windows\System\nCvvOxJ.exe
  C:\Windows\System\nCvvOxJ.exe
  2⤵
  PID:11536
- C:\Windows\System\kVyOkqm.exe
  C:\Windows\System\kVyOkqm.exe
  2⤵
  PID:13680
- C:\Windows\System\guUlLeM.exe
  C:\Windows\System\guUlLeM.exe
  2⤵
  PID:11252
- C:\Windows\System\PtsJHYo.exe
  C:\Windows\System\PtsJHYo.exe
  2⤵
  PID:14252
- C:\Windows\System\djGwwUy.exe
  C:\Windows\System\djGwwUy.exe
  2⤵
  PID:14224
- C:\Windows\System\ZINEVxp.exe
  C:\Windows\System\ZINEVxp.exe
  2⤵
  PID:13408
- C:\Windows\System\rhNqpnZ.exe
  C:\Windows\System\rhNqpnZ.exe
  2⤵
  PID:13816
- C:\Windows\System\gGpXfzn.exe
  C:\Windows\System\gGpXfzn.exe
  2⤵
  PID:13788
- C:\Windows\System\aJYePIT.exe
  C:\Windows\System\aJYePIT.exe
  2⤵
  PID:3992
- C:\Windows\System\MGPOXiD.exe
  C:\Windows\System\MGPOXiD.exe
  2⤵
  PID:3188
- C:\Windows\System\yEcyZNz.exe
  C:\Windows\System\yEcyZNz.exe
  2⤵
  PID:14324
- C:\Windows\System\qdWuoJR.exe
  C:\Windows\System\qdWuoJR.exe
  2⤵
  PID:4792
- C:\Windows\System\ESaMogI.exe
  C:\Windows\System\ESaMogI.exe
  2⤵
  PID:13340
- C:\Windows\System\rAneaAi.exe
  C:\Windows\System\rAneaAi.exe
  2⤵
  PID:9784
- C:\Windows\System\FWptllL.exe
  C:\Windows\System\FWptllL.exe
  2⤵
  PID:13920
- C:\Windows\System\xoFBWSg.exe
  C:\Windows\System\xoFBWSg.exe
  2⤵
  PID:13532
- C:\Windows\System\tqluMBv.exe
  C:\Windows\System\tqluMBv.exe
  2⤵
  PID:13620
- C:\Windows\System\CTKAoUt.exe
  C:\Windows\System\CTKAoUt.exe
  2⤵
  PID:12184
- C:\Windows\System\pFyPhfD.exe
  C:\Windows\System\pFyPhfD.exe
  2⤵
  PID:640
- C:\Windows\System\touvrVL.exe
  C:\Windows\System\touvrVL.exe
  2⤵
  PID:4304
- C:\Windows\System\vWegzMH.exe
  C:\Windows\System\vWegzMH.exe
  2⤵
  PID:13640
- C:\Windows\System\fqsQgJc.exe
  C:\Windows\System\fqsQgJc.exe
  2⤵
  PID:13932
- C:\Windows\System\JLLjBpa.exe
  C:\Windows\System\JLLjBpa.exe
  2⤵
  PID:14300
- C:\Windows\System\PhMWNTC.exe
  C:\Windows\System\PhMWNTC.exe
  2⤵
  PID:8288
- C:\Windows\System\PbjPNgc.exe
  C:\Windows\System\PbjPNgc.exe
  2⤵
  PID:1180
- C:\Windows\System\hXnAYVi.exe
  C:\Windows\System\hXnAYVi.exe
  2⤵
  PID:13172
- C:\Windows\System\qUGPPSW.exe
  C:\Windows\System\qUGPPSW.exe
  2⤵
  PID:13356
- C:\Windows\System\YyYTgRg.exe
  C:\Windows\System\YyYTgRg.exe
  2⤵
  PID:1268
- C:\Windows\System\wYmJQzs.exe
  C:\Windows\System\wYmJQzs.exe
  2⤵
  PID:1744
- C:\Windows\System\BYmxHwj.exe
  C:\Windows\System\BYmxHwj.exe
  2⤵
  PID:13684
- C:\Windows\System\aQSpYZX.exe
  C:\Windows\System\aQSpYZX.exe
  2⤵
  PID:2008
- C:\Windows\System\FdtQsEq.exe
  C:\Windows\System\FdtQsEq.exe
  2⤵
  PID:13456
- C:\Windows\System\IRFxVIS.exe
  C:\Windows\System\IRFxVIS.exe
  2⤵
  PID:13732
- C:\Windows\System\xpeJgWB.exe
  C:\Windows\System\xpeJgWB.exe
  2⤵
  PID:13980
- C:\Windows\System\XmbeJNp.exe
  C:\Windows\System\XmbeJNp.exe
  2⤵
  PID:2524
- C:\Windows\System\euNCTgz.exe
  C:\Windows\System\euNCTgz.exe
  2⤵
  PID:13660
- C:\Windows\System\OVZkcpS.exe
  C:\Windows\System\OVZkcpS.exe
  2⤵
  PID:768
- C:\Windows\System\WAZIUoD.exe
  C:\Windows\System\WAZIUoD.exe
  2⤵
  PID:14156
- C:\Windows\System\WfUSvaK.exe
  C:\Windows\System\WfUSvaK.exe
  2⤵
  PID:14204
- C:\Windows\System\LbPHBub.exe
  C:\Windows\System\LbPHBub.exe
  2⤵
  PID:11304
- C:\Windows\System\cHkImHp.exe
  C:\Windows\System\cHkImHp.exe
  2⤵
  PID:12080
- C:\Windows\System\GJcFYSv.exe
  C:\Windows\System\GJcFYSv.exe
  2⤵
  PID:13540
- C:\Windows\System\PJBqLCD.exe
  C:\Windows\System\PJBqLCD.exe
  2⤵
  PID:3584
- C:\Windows\System\dUWgMsJ.exe
  C:\Windows\System\dUWgMsJ.exe
  2⤵
  PID:1672
- C:\Windows\System\lEgmSuW.exe
  C:\Windows\System\lEgmSuW.exe
  2⤵
  PID:12852
- C:\Windows\System\kMjtLLX.exe
  C:\Windows\System\kMjtLLX.exe
  2⤵
  PID:4376
- C:\Windows\System\TRqNTOQ.exe
  C:\Windows\System\TRqNTOQ.exe
  2⤵
  PID:4408
- C:\Windows\System\QaFXmkL.exe
  C:\Windows\System\QaFXmkL.exe
  2⤵
  PID:1980
- C:\Windows\System\nUAMHyG.exe
  C:\Windows\System\nUAMHyG.exe
  2⤵
  PID:12560
- C:\Windows\System\xCCrVZO.exe
  C:\Windows\System\xCCrVZO.exe
  2⤵
  PID:3772
- C:\Windows\System\bkrsTww.exe
  C:\Windows\System\bkrsTww.exe
  2⤵
  PID:2460
- C:\Windows\System\ieiIMua.exe
  C:\Windows\System\ieiIMua.exe
  2⤵
  PID:5212
- C:\Windows\System\TJBroKP.exe
  C:\Windows\System\TJBroKP.exe
  2⤵
  PID:2248
- C:\Windows\System\LVNuTbd.exe
  C:\Windows\System\LVNuTbd.exe
  2⤵
  PID:2800
- C:\Windows\System\vZKgtHn.exe
  C:\Windows\System\vZKgtHn.exe
  2⤵
  PID:5576
- C:\Windows\System\kffxfxj.exe
  C:\Windows\System\kffxfxj.exe
  2⤵
  PID:10840
- C:\Windows\System\LeKDKnK.exe
  C:\Windows\System\LeKDKnK.exe
  2⤵
  PID:5508
- C:\Windows\System\LVpYTZj.exe
  C:\Windows\System\LVpYTZj.exe
  2⤵
  PID:5372
- C:\Windows\System\cLSWuuG.exe
  C:\Windows\System\cLSWuuG.exe
  2⤵
  PID:5000
- C:\Windows\System\YqTTwEE.exe
  C:\Windows\System\YqTTwEE.exe
  2⤵
  PID:4224
- C:\Windows\System\tkdOFRH.exe
  C:\Windows\System\tkdOFRH.exe
  2⤵
  PID:5520
- C:\Windows\System\caRkCWs.exe
  C:\Windows\System\caRkCWs.exe
  2⤵
  PID:13772
- C:\Windows\System\VNLBbAI.exe
  C:\Windows\System\VNLBbAI.exe
  2⤵
  PID:5720
- C:\Windows\System\HbkihSO.exe
  C:\Windows\System\HbkihSO.exe
  2⤵
  PID:5240
- C:\Windows\System\wSOIHol.exe
  C:\Windows\System\wSOIHol.exe
  2⤵
  PID:5904
- C:\Windows\System\lOkjOkF.exe
  C:\Windows\System\lOkjOkF.exe
  2⤵
  PID:5964
- C:\Windows\System\kgIPLIW.exe
  C:\Windows\System\kgIPLIW.exe
  2⤵
  PID:4768
- C:\Windows\System\ixBINSH.exe
  C:\Windows\System\ixBINSH.exe
  2⤵
  PID:5728
- C:\Windows\System\YcPyKqd.exe
  C:\Windows\System\YcPyKqd.exe
  2⤵
  PID:13652
- C:\Windows\System\XIFetJO.exe
  C:\Windows\System\XIFetJO.exe
  2⤵
  PID:6084
- C:\Windows\System\mYjGMDh.exe
  C:\Windows\System\mYjGMDh.exe
  2⤵
  PID:4184
- C:\Windows\System\PKXlfDF.exe
  C:\Windows\System\PKXlfDF.exe
  2⤵
  PID:9672
- C:\Windows\System\YaiXWpT.exe
  C:\Windows\System\YaiXWpT.exe
  2⤵
  PID:13580
- C:\Windows\System\pupaXLt.exe
  C:\Windows\System\pupaXLt.exe
  2⤵
  PID:3996
- C:\Windows\System\AfRUQOM.exe
  C:\Windows\System\AfRUQOM.exe
  2⤵
  PID:6012
- C:\Windows\System\LlzMSzQ.exe
  C:\Windows\System\LlzMSzQ.exe
  2⤵
  PID:9608
- C:\Windows\System\HDSCYty.exe
  C:\Windows\System\HDSCYty.exe
  2⤵
  PID:3892
- C:\Windows\System\oJNbaGY.exe
  C:\Windows\System\oJNbaGY.exe
  2⤵
  PID:2936
- C:\Windows\System\dTkIkcV.exe
  C:\Windows\System\dTkIkcV.exe
  2⤵
  PID:5036
- C:\Windows\System\tOMFUrh.exe
  C:\Windows\System\tOMFUrh.exe
  2⤵
  PID:5992
- C:\Windows\System\qMEwALO.exe
  C:\Windows\System\qMEwALO.exe
  2⤵
  PID:5172
- C:\Windows\System\lrTVfxj.exe
  C:\Windows\System\lrTVfxj.exe
  2⤵
  PID:636
- C:\Windows\System\rSIpDJG.exe
  C:\Windows\System\rSIpDJG.exe
  2⤵
  PID:5308
- C:\Windows\System\PHCOGoq.exe
  C:\Windows\System\PHCOGoq.exe
  2⤵
  PID:5352
- C:\Windows\System\WXtOJFU.exe
  C:\Windows\System\WXtOJFU.exe
  2⤵
  PID:2284
- C:\Windows\System\nTNvpZp.exe
  C:\Windows\System\nTNvpZp.exe
  2⤵
  PID:3284
- C:\Windows\System\bSkStje.exe
  C:\Windows\System\bSkStje.exe
  2⤵
  PID:14344
- C:\Windows\System\czwpguk.exe
  C:\Windows\System\czwpguk.exe
  2⤵
  PID:14360
- C:\Windows\System\UvcSGYK.exe
  C:\Windows\System\UvcSGYK.exe
  2⤵
  PID:14400
- C:\Windows\System\xssNlyI.exe
  C:\Windows\System\xssNlyI.exe
  2⤵
  PID:14420
- C:\Windows\System\NUZYWNJ.exe
  C:\Windows\System\NUZYWNJ.exe
  2⤵
  PID:14560
- C:\Windows\System\pTaWWuh.exe
  C:\Windows\System\pTaWWuh.exe
  2⤵
  PID:15140
- C:\Windows\System\brMMaKb.exe
  C:\Windows\System\brMMaKb.exe
  2⤵
  PID:15332
- C:\Windows\System\AnSunOB.exe
  C:\Windows\System\AnSunOB.exe
  2⤵
  PID:14436
- C:\Windows\System\CEldzVP.exe
  C:\Windows\System\CEldzVP.exe
  2⤵
  PID:14568
- C:\Windows\System\rRgvUVy.exe
  C:\Windows\System\rRgvUVy.exe
  2⤵
  PID:14584
- C:\Windows\System\illxkSC.exe
  C:\Windows\System\illxkSC.exe
  2⤵
  PID:14632
- C:\Windows\System\pmtkWAK.exe
  C:\Windows\System\pmtkWAK.exe
  2⤵
  PID:14696
- C:\Windows\System\RqkRuwX.exe
  C:\Windows\System\RqkRuwX.exe
  2⤵
  PID:14816
- C:\Windows\System\ULfRkBo.exe
  C:\Windows\System\ULfRkBo.exe
  2⤵
  PID:14964
- C:\Windows\System\fzQHZvb.exe
  C:\Windows\System\fzQHZvb.exe
  2⤵
  PID:15000
- C:\Windows\System\SejIhzQ.exe
  C:\Windows\System\SejIhzQ.exe
  2⤵
  PID:15040
- C:\Windows\System\yICXakA.exe
  C:\Windows\System\yICXakA.exe
  2⤵
  PID:15104
- C:\Windows\System\lTIpBIf.exe
  C:\Windows\System\lTIpBIf.exe
  2⤵
  PID:15120
- C:\Windows\System\RoOlGdb.exe
  C:\Windows\System\RoOlGdb.exe
  2⤵
  PID:15172
- C:\Windows\System\CoyagHf.exe
  C:\Windows\System\CoyagHf.exe
  2⤵
  PID:15212
- C:\Windows\System\YedspfA.exe
  C:\Windows\System\YedspfA.exe
  2⤵
  PID:15244
- C:\Windows\System\fxmFUEa.exe
  C:\Windows\System\fxmFUEa.exe
  2⤵
  PID:15292
- C:\Windows\System\rQedqFT.exe
  C:\Windows\System\rQedqFT.exe
  2⤵
  PID:15324
- C:\Windows\System\wmORWyH.exe
  C:\Windows\System\wmORWyH.exe
  2⤵
  PID:14340
- C:\Windows\System\NMpKjLp.exe
  C:\Windows\System\NMpKjLp.exe
  2⤵
  PID:15348
- C:\Windows\System\WFhdJwi.exe
  C:\Windows\System\WFhdJwi.exe
  2⤵
  PID:14488
- C:\Windows\System\fgaxuFU.exe
  C:\Windows\System\fgaxuFU.exe
  2⤵
  PID:14484
- C:\Windows\System\oBYgNbH.exe
  C:\Windows\System\oBYgNbH.exe
  2⤵
  PID:14548
- C:\Windows\System\fFjDdmt.exe
  C:\Windows\System\fFjDdmt.exe
  2⤵
  PID:14608
- C:\Windows\System\VvKoEVs.exe
  C:\Windows\System\VvKoEVs.exe
  2⤵
  PID:5188
- C:\Windows\System\yPhIczd.exe
  C:\Windows\System\yPhIczd.exe
  2⤵
  PID:14652
- C:\Windows\System\EwpmflV.exe
  C:\Windows\System\EwpmflV.exe
  2⤵
  PID:14712
- C:\Windows\System\XweYALC.exe
  C:\Windows\System\XweYALC.exe
  2⤵
  PID:6820
- C:\Windows\System\VLymssj.exe
  C:\Windows\System\VLymssj.exe
  2⤵
  PID:14812
- C:\Windows\System\XrVNdxK.exe
  C:\Windows\System\XrVNdxK.exe
  2⤵
  PID:14836
- C:\Windows\System\uSOqqYL.exe
  C:\Windows\System\uSOqqYL.exe
  2⤵
  PID:14804
- C:\Windows\System\UXsfwXc.exe
  C:\Windows\System\UXsfwXc.exe
  2⤵
  PID:6544
- C:\Windows\System\yhfjaxx.exe
  C:\Windows\System\yhfjaxx.exe
  2⤵
  PID:14896
- C:\Windows\System\ceEZKck.exe
  C:\Windows\System\ceEZKck.exe
  2⤵
  PID:14808
- C:\Windows\System\pMCMhtC.exe
  C:\Windows\System\pMCMhtC.exe
  2⤵
  PID:748
- C:\Windows\System\ZPOIifp.exe
  C:\Windows\System\ZPOIifp.exe
  2⤵
  PID:14996
- C:\Windows\System\aQEShSj.exe
  C:\Windows\System\aQEShSj.exe
  2⤵
  PID:13916
- C:\Windows\System\FHCEurU.exe
  C:\Windows\System\FHCEurU.exe
  2⤵
  PID:7100
- C:\Windows\System\EkbIKnu.exe
  C:\Windows\System\EkbIKnu.exe
  2⤵
  PID:6032
- C:\Windows\System\ClJVAkn.exe
  C:\Windows\System\ClJVAkn.exe
  2⤵
  PID:15072
- C:\Windows\System\HIMHNTk.exe
  C:\Windows\System\HIMHNTk.exe
  2⤵
  PID:6908
- C:\Windows\System\RICGIni.exe
  C:\Windows\System\RICGIni.exe
  2⤵
  PID:6940
- C:\Windows\System\yRgfCnK.exe
  C:\Windows\System\yRgfCnK.exe
  2⤵
  PID:15188
- C:\Windows\System\JllIxCB.exe
  C:\Windows\System\JllIxCB.exe
  2⤵
  PID:7180
- C:\Windows\System\mHVgdHG.exe
  C:\Windows\System\mHVgdHG.exe
  2⤵
  PID:7224
- C:\Windows\System\RnyiNhc.exe
  C:\Windows\System\RnyiNhc.exe
  2⤵
  PID:15304
- C:\Windows\System\hMOInmS.exe
  C:\Windows\System\hMOInmS.exe
  2⤵
  PID:15340
- C:\Windows\System\YlXTyLo.exe
  C:\Windows\System\YlXTyLo.exe
  2⤵
  PID:14352
- C:\Windows\System\aXLJylp.exe
  C:\Windows\System\aXLJylp.exe
  2⤵
  PID:7432
- C:\Windows\System\ijtYpdP.exe
  C:\Windows\System\ijtYpdP.exe
  2⤵
  PID:14680
- C:\Windows\System\QNXSVtx.exe
  C:\Windows\System\QNXSVtx.exe
  2⤵
  PID:7500
- C:\Windows\System\pwqkakR.exe
  C:\Windows\System\pwqkakR.exe
  2⤵
  PID:6952
- C:\Windows\System\SZaAiZi.exe
  C:\Windows\System\SZaAiZi.exe
  2⤵
  PID:14756
- C:\Windows\System\dBkGwqO.exe
  C:\Windows\System\dBkGwqO.exe
  2⤵
  PID:14920
- C:\Windows\System\dWpBbBp.exe
  C:\Windows\System\dWpBbBp.exe
  2⤵
  PID:14884
- C:\Windows\System\xaMuuyu.exe
  C:\Windows\System\xaMuuyu.exe
  2⤵
  PID:6608
- C:\Windows\System\dPArSoz.exe
  C:\Windows\System\dPArSoz.exe
  2⤵
  PID:7564
- C:\Windows\System\fgrohip.exe
  C:\Windows\System\fgrohip.exe
  2⤵
  PID:15008
- C:\Windows\System\bhNIXue.exe
  C:\Windows\System\bhNIXue.exe
  2⤵
  PID:15096
- C:\Windows\System\CUffvxz.exe
  C:\Windows\System\CUffvxz.exe
  2⤵
  PID:6280
- C:\Windows\System\nOJSehI.exe
  C:\Windows\System\nOJSehI.exe
  2⤵
  PID:6856
- C:\Windows\System\mdvjiPW.exe
  C:\Windows\System\mdvjiPW.exe
  2⤵
  PID:15184
- C:\Windows\System\mWraaTm.exe
  C:\Windows\System\mWraaTm.exe
  2⤵
  PID:6412
- C:\Windows\System\YRJLsvZ.exe
  C:\Windows\System\YRJLsvZ.exe
  2⤵
  PID:6620
- C:\Windows\System\cwXALDc.exe
  C:\Windows\System\cwXALDc.exe
  2⤵
  PID:8484
- C:\Windows\System\PVIgkOK.exe
  C:\Windows\System\PVIgkOK.exe
  2⤵
  PID:6896
- C:\Windows\System\FPPbKvX.exe
  C:\Windows\System\FPPbKvX.exe
  2⤵
  PID:5132
- C:\Windows\System\GnlwNTA.exe
  C:\Windows\System\GnlwNTA.exe
  2⤵
  PID:8828
- C:\Windows\System\eBuvalR.exe
  C:\Windows\System\eBuvalR.exe
  2⤵
  PID:9068
- C:\Windows\System\SBCkeTh.exe
  C:\Windows\System\SBCkeTh.exe
  2⤵
  PID:9020
- C:\Windows\System\VNOuXru.exe
  C:\Windows\System\VNOuXru.exe
  2⤵
  PID:9012
- C:\Windows\System\TRfSTzX.exe
  C:\Windows\System\TRfSTzX.exe
  2⤵
  PID:14524
- C:\Windows\System\ktxJTOc.exe
  C:\Windows\System\ktxJTOc.exe
  2⤵
  PID:4384
- C:\Windows\System\wZXBqUm.exe
  C:\Windows\System\wZXBqUm.exe
  2⤵
  PID:14596
- C:\Windows\System\SlHXRlc.exe
  C:\Windows\System\SlHXRlc.exe
  2⤵
  PID:8240
- C:\Windows\System\GgwLMqF.exe
  C:\Windows\System\GgwLMqF.exe
  2⤵
  PID:7028
- C:\Windows\System\YRQrKxx.exe
  C:\Windows\System\YRQrKxx.exe
  2⤵
  PID:7144
- C:\Windows\System\XEMJfbm.exe
  C:\Windows\System\XEMJfbm.exe
  2⤵
  PID:14744
- C:\Windows\System\mSzPlVR.exe
  C:\Windows\System\mSzPlVR.exe
  2⤵
  PID:7200
- C:\Windows\System\KvRWDqD.exe
  C:\Windows\System\KvRWDqD.exe
  2⤵
  PID:6844
- C:\Windows\System\eCsxNuk.exe
  C:\Windows\System\eCsxNuk.exe
  2⤵
  PID:6716
- C:\Windows\System\gFZulNC.exe
  C:\Windows\System\gFZulNC.exe
  2⤵
  PID:13764
- C:\Windows\System\Zqclffn.exe
  C:\Windows\System\Zqclffn.exe
  2⤵
  PID:6108
- C:\Windows\System\EVsajEh.exe
  C:\Windows\System\EVsajEh.exe
  2⤵
  PID:14892
- C:\Windows\System\hGABBmZ.exe
  C:\Windows\System\hGABBmZ.exe
  2⤵
  PID:8656
- C:\Windows\System\vPAApVh.exe
  C:\Windows\System\vPAApVh.exe
  2⤵
  PID:2960
- C:\Windows\System\fRBWEao.exe
  C:\Windows\System\fRBWEao.exe
  2⤵
  PID:10144
- C:\Windows\System\NTtiMPX.exe
  C:\Windows\System\NTtiMPX.exe
  2⤵
  PID:10156
- C:\Windows\System\HkgUkSz.exe
  C:\Windows\System\HkgUkSz.exe
  2⤵
  PID:9528
- C:\Windows\System\PPKCWvM.exe
  C:\Windows\System\PPKCWvM.exe
  2⤵
  PID:8036
- C:\Windows\System\otQbnZP.exe
  C:\Windows\System\otQbnZP.exe
  2⤵
  PID:9612
- C:\Windows\System\OLqTMMw.exe
  C:\Windows\System\OLqTMMw.exe
  2⤵
  PID:13968
- C:\Windows\System\CavrJSE.exe
  C:\Windows\System\CavrJSE.exe
  2⤵
  PID:7996
- C:\Windows\System\sIpestZ.exe
  C:\Windows\System\sIpestZ.exe
  2⤵
  PID:9788
- C:\Windows\System\XStYimC.exe
  C:\Windows\System\XStYimC.exe
  2⤵
  PID:7780
- C:\Windows\System\MctxnaS.exe
  C:\Windows\System\MctxnaS.exe
  2⤵
  PID:10224
- C:\Windows\System\qjdKnNY.exe
  C:\Windows\System\qjdKnNY.exe
  2⤵
  PID:9876
- C:\Windows\System\PJDhmqr.exe
  C:\Windows\System\PJDhmqr.exe
  2⤵
  PID:15252
- C:\Windows\System\jWkYyZM.exe
  C:\Windows\System\jWkYyZM.exe
  2⤵
  PID:15288
- C:\Windows\System\wPMIxoK.exe
  C:\Windows\System\wPMIxoK.exe
  2⤵
  PID:15284
- C:\Windows\System\TwrwBYk.exe
  C:\Windows\System\TwrwBYk.exe
  2⤵
  PID:6704
- C:\Windows\System\YpBYrPU.exe
  C:\Windows\System\YpBYrPU.exe
  2⤵
  PID:14396
- C:\Windows\System\UEYjlCN.exe
  C:\Windows\System\UEYjlCN.exe
  2⤵
  PID:10064
- C:\Windows\System\UHRSZPu.exe
  C:\Windows\System\UHRSZPu.exe
  2⤵
  PID:7708
- C:\Windows\System\gVYZvdo.exe
  C:\Windows\System\gVYZvdo.exe
  2⤵
  PID:8268
- C:\Windows\System\XcjFaYf.exe
  C:\Windows\System\XcjFaYf.exe
  2⤵
  PID:8720
- C:\Windows\System\ZhQBvDE.exe
  C:\Windows\System\ZhQBvDE.exe
  2⤵
  PID:8216
- C:\Windows\System\aQjNRvl.exe
  C:\Windows\System\aQjNRvl.exe
  2⤵
  PID:11028
- C:\Windows\System\ghYGtxA.exe
  C:\Windows\System\ghYGtxA.exe
  2⤵
  PID:9072
- C:\Windows\System\BfSnIkC.exe
  C:\Windows\System\BfSnIkC.exe
  2⤵
  PID:8928
- C:\Windows\System\IWxUliN.exe
  C:\Windows\System\IWxUliN.exe
  2⤵
  PID:6348
- C:\Windows\System\lnjIhMg.exe
  C:\Windows\System\lnjIhMg.exe
  2⤵
  PID:9660
- C:\Windows\System\JxJkIex.exe
  C:\Windows\System\JxJkIex.exe
  2⤵
  PID:11136
- C:\Windows\System\JBjUrPu.exe
  C:\Windows\System\JBjUrPu.exe
  2⤵
  PID:8556
- C:\Windows\System\LsjnMCg.exe
  C:\Windows\System\LsjnMCg.exe
  2⤵
  PID:8724
- C:\Windows\System\iVAHGnV.exe
  C:\Windows\System\iVAHGnV.exe
  2⤵
  PID:2476
- C:\Windows\System\OIbBkyr.exe
  C:\Windows\System\OIbBkyr.exe
  2⤵
  PID:14684
- C:\Windows\System\aqScMIg.exe
  C:\Windows\System\aqScMIg.exe
  2⤵
  PID:9200
- C:\Windows\System\EsQUrqs.exe
  C:\Windows\System\EsQUrqs.exe
  2⤵
  PID:11616
- C:\Windows\System\lPcGjYE.exe
  C:\Windows\System\lPcGjYE.exe
  2⤵
  PID:11756
- C:\Windows\System\NLIRkJV.exe
  C:\Windows\System\NLIRkJV.exe
  2⤵
  PID:7088
- C:\Windows\System\VCencBa.exe
  C:\Windows\System\VCencBa.exe
  2⤵
  PID:13056
- C:\Windows\System\fbgqnvi.exe
  C:\Windows\System\fbgqnvi.exe
  2⤵
  PID:10040
- C:\Windows\System\ChHAxxC.exe
  C:\Windows\System\ChHAxxC.exe
  2⤵
  PID:14912
- C:\Windows\System\nJAuTZO.exe
  C:\Windows\System\nJAuTZO.exe
  2⤵
  PID:10912
- C:\Windows\System\ZeJmEbB.exe
  C:\Windows\System\ZeJmEbB.exe
  2⤵
  PID:11024
- C:\Windows\System\RXaTKeR.exe
  C:\Windows\System\RXaTKeR.exe
  2⤵
  PID:5660
- C:\Windows\System\MvaJgdY.exe
  C:\Windows\System\MvaJgdY.exe
  2⤵
  PID:14932
- C:\Windows\System\nLQSpNp.exe
  C:\Windows\System\nLQSpNp.exe
  2⤵
  PID:11160
- C:\Windows\System\dECXQJx.exe
  C:\Windows\System\dECXQJx.exe
  2⤵
  PID:10108
- C:\Windows\System\toLVevF.exe
  C:\Windows\System\toLVevF.exe
  2⤵
  PID:9840
- C:\Windows\System\cYmnsJW.exe
  C:\Windows\System\cYmnsJW.exe
  2⤵
  PID:7424
- C:\Windows\System\UDWlbvM.exe
  C:\Windows\System\UDWlbvM.exe
  2⤵
  PID:12344
- C:\Windows\System\ZVBwzBC.exe
  C:\Windows\System\ZVBwzBC.exe
  2⤵
  PID:7924
- C:\Windows\System\xvwyzqr.exe
  C:\Windows\System\xvwyzqr.exe
  2⤵
  PID:10076
- C:\Windows\System\XjyRKOm.exe
  C:\Windows\System\XjyRKOm.exe
  2⤵
  PID:11572
- C:\Windows\System\vdbZEEf.exe
  C:\Windows\System\vdbZEEf.exe
  2⤵
  PID:15152
- C:\Windows\System\PTRNdYd.exe
  C:\Windows\System\PTRNdYd.exe
  2⤵
  PID:7988
- C:\Windows\System\tabdfPf.exe
  C:\Windows\System\tabdfPf.exe
  2⤵
  PID:11832
- C:\Windows\System\nNTJmOD.exe
  C:\Windows\System\nNTJmOD.exe
  2⤵
  PID:11856
- C:\Windows\System\wPqoycT.exe
  C:\Windows\System\wPqoycT.exe
  2⤵
  PID:1800
- C:\Windows\System\jUHYtDz.exe
  C:\Windows\System\jUHYtDz.exe
  2⤵
  PID:10236
- C:\Windows\System\cISJqdU.exe
  C:\Windows\System\cISJqdU.exe
  2⤵
  PID:12068
- C:\Windows\System\GThPeGc.exe
  C:\Windows\System\GThPeGc.exe
  2⤵
  PID:6040
- C:\Windows\System\deWskRM.exe
  C:\Windows\System\deWskRM.exe
  2⤵
  PID:11388
- C:\Windows\System\CLCpnfe.exe
  C:\Windows\System\CLCpnfe.exe
  2⤵
  PID:8296
- C:\Windows\System\NASVxre.exe
  C:\Windows\System\NASVxre.exe
  2⤵
  PID:8404
- C:\Windows\System\YIdTqwZ.exe
  C:\Windows\System\YIdTqwZ.exe
  2⤵
  PID:15352
- C:\Windows\System\VHurATU.exe
  C:\Windows\System\VHurATU.exe
  2⤵
  PID:9916
- C:\Windows\System\bNDWapE.exe
  C:\Windows\System\bNDWapE.exe
  2⤵
  PID:10096
- C:\Windows\System\SpVWJPh.exe
  C:\Windows\System\SpVWJPh.exe
  2⤵
  PID:14476
- C:\Windows\System\jDbkXVs.exe
  C:\Windows\System\jDbkXVs.exe
  2⤵
  PID:7240
- C:\Windows\System\IfyIQXE.exe
  C:\Windows\System\IfyIQXE.exe
  2⤵
  PID:7492
- C:\Windows\System\lDyuLCs.exe
  C:\Windows\System\lDyuLCs.exe
  2⤵
  PID:12572
- C:\Windows\System\sgHAMJH.exe
  C:\Windows\System\sgHAMJH.exe
  2⤵
  PID:10908
- C:\Windows\System\rSXZgjR.exe
  C:\Windows\System\rSXZgjR.exe
  2⤵
  PID:12972
- C:\Windows\System\sZdyJXt.exe
  C:\Windows\System\sZdyJXt.exe
  2⤵
  PID:13016
- C:\Windows\System\FUpzVuz.exe
  C:\Windows\System\FUpzVuz.exe
  2⤵
  PID:11104
- C:\Windows\System\pzePFGm.exe
  C:\Windows\System\pzePFGm.exe
  2⤵
  PID:8860
- C:\Windows\System\sEyAgRD.exe
  C:\Windows\System\sEyAgRD.exe
  2⤵
  PID:14516
- C:\Windows\System\dkGwlGm.exe
  C:\Windows\System\dkGwlGm.exe
  2⤵
  PID:12240
- C:\Windows\System\sMVOVat.exe
  C:\Windows\System\sMVOVat.exe
  2⤵
  PID:4372
- C:\Windows\System\pjDLYtt.exe
  C:\Windows\System\pjDLYtt.exe
  2⤵
  PID:11516
- C:\Windows\System\QpQufnH.exe
  C:\Windows\System\QpQufnH.exe
  2⤵
  PID:14660
- C:\Windows\System\hxEHclh.exe
  C:\Windows\System\hxEHclh.exe
  2⤵
  PID:10180
- C:\Windows\System\XbxbgnH.exe
  C:\Windows\System\XbxbgnH.exe
  2⤵
  PID:12908
- C:\Windows\System\UYQwaUk.exe
  C:\Windows\System\UYQwaUk.exe
  2⤵
  PID:6720
- C:\Windows\System\GsJbnOP.exe
  C:\Windows\System\GsJbnOP.exe
  2⤵
  PID:10844
- C:\Windows\System\tdILufZ.exe
  C:\Windows\System\tdILufZ.exe
  2⤵
  PID:6956
- C:\Windows\System\iQGGicx.exe
  C:\Windows\System\iQGGicx.exe
  2⤵
  PID:9152
- C:\Windows\System\IYgrNrT.exe
  C:\Windows\System\IYgrNrT.exe
  2⤵
  PID:14952
- C:\Windows\System\gEsIwLY.exe
  C:\Windows\System\gEsIwLY.exe
  2⤵
  PID:2904
- C:\Windows\System\TvBBQqu.exe
  C:\Windows\System\TvBBQqu.exe
  2⤵
  PID:6740
- C:\Windows\System\riuUFsq.exe
  C:\Windows\System\riuUFsq.exe
  2⤵
  PID:8160
- C:\Windows\System\EgDWFQc.exe
  C:\Windows\System\EgDWFQc.exe
  2⤵
  PID:9252
- C:\Windows\System\VBfSVCK.exe
  C:\Windows\System\VBfSVCK.exe
  2⤵
  PID:12368
- C:\Windows\System\fhDbPPa.exe
  C:\Windows\System\fhDbPPa.exe
  2⤵
  PID:15060
- C:\Windows\System\OoWKlHW.exe
  C:\Windows\System\OoWKlHW.exe
  2⤵
  PID:10344
- C:\Windows\System\cJUFRbZ.exe
  C:\Windows\System\cJUFRbZ.exe
  2⤵
  PID:11668
- C:\Windows\System\owkPgUq.exe
  C:\Windows\System\owkPgUq.exe
  2⤵
  PID:12212
- C:\Windows\System\vzJbpWs.exe
  C:\Windows\System\vzJbpWs.exe
  2⤵
  PID:10504
- C:\Windows\System\lVZKpjM.exe
  C:\Windows\System\lVZKpjM.exe
  2⤵
  PID:9928
- C:\Windows\System\QusAjTD.exe
  C:\Windows\System\QusAjTD.exe
  2⤵
  PID:10432
- C:\Windows\System\oPQzlbY.exe
  C:\Windows\System\oPQzlbY.exe
  2⤵
  PID:1624
- C:\Windows\System\HhUPXLp.exe
  C:\Windows\System\HhUPXLp.exe
  2⤵
  PID:9132
- C:\Windows\System\fQSvXPY.exe
  C:\Windows\System\fQSvXPY.exe
  2⤵
  PID:12436
- C:\Windows\System\rrTrNWr.exe
  C:\Windows\System\rrTrNWr.exe
  2⤵
  PID:2932
- C:\Windows\System\ArOCRQG.exe
  C:\Windows\System\ArOCRQG.exe
  2⤵
  PID:12408
- C:\Windows\System\gJCsTrL.exe
  C:\Windows\System\gJCsTrL.exe
  2⤵
  PID:8232
- C:\Windows\System\fxfRPIx.exe
  C:\Windows\System\fxfRPIx.exe
  2⤵
  PID:10320
- C:\Windows\System\VoCslTZ.exe
  C:\Windows\System\VoCslTZ.exe
  2⤵
  PID:11060
- C:\Windows\System\nswwVPS.exe
  C:\Windows\System\nswwVPS.exe
  2⤵
  PID:10280
- C:\Windows\System\yiicHdL.exe
  C:\Windows\System\yiicHdL.exe
  2⤵
  PID:12348
- C:\Windows\System\kUvnSLQ.exe
  C:\Windows\System\kUvnSLQ.exe
  2⤵
  PID:9160
- C:\Windows\System\ZsoWvrg.exe
  C:\Windows\System\ZsoWvrg.exe
  2⤵
  PID:8628
- C:\Windows\System\mJBPVmz.exe
  C:\Windows\System\mJBPVmz.exe
  2⤵
  PID:12328
- C:\Windows\System\CPsdwPf.exe
  C:\Windows\System\CPsdwPf.exe
  2⤵
  PID:11820
- C:\Windows\System\jXknuIK.exe
  C:\Windows\System\jXknuIK.exe
  2⤵
  PID:12968
- C:\Windows\System\OyQwWLc.exe
  C:\Windows\System\OyQwWLc.exe
  2⤵
  PID:8752
- C:\Windows\System\GbcrTtW.exe
  C:\Windows\System\GbcrTtW.exe
  2⤵
  PID:11276
- C:\Windows\System\uFKtNLI.exe
  C:\Windows\System\uFKtNLI.exe
  2⤵
  PID:8980
- C:\Windows\System\WNFvbjF.exe
  C:\Windows\System\WNFvbjF.exe
  2⤵
  PID:8648
- C:\Windows\System\PnbfhJE.exe
  C:\Windows\System\PnbfhJE.exe
  2⤵
  PID:11036
- C:\Windows\System\GDBlDOM.exe
  C:\Windows\System\GDBlDOM.exe
  2⤵
  PID:12620
- C:\Windows\System\RmGOZup.exe
  C:\Windows\System\RmGOZup.exe
  2⤵
  PID:11976
- C:\Windows\System\XJZHoTb.exe
  C:\Windows\System\XJZHoTb.exe
  2⤵
  PID:11124
- C:\Windows\System\HaOOVwD.exe
  C:\Windows\System\HaOOVwD.exe
  2⤵
  PID:12352
- C:\Windows\System\WdNoPuD.exe
  C:\Windows\System\WdNoPuD.exe
  2⤵
  PID:10312
- C:\Windows\System\uUJfzkW.exe
  C:\Windows\System\uUJfzkW.exe
  2⤵
  PID:13368
- C:\Windows\System\WWJuhIG.exe
  C:\Windows\System\WWJuhIG.exe
  2⤵
  PID:13432
- C:\Windows\System\cYFQAVS.exe
  C:\Windows\System\cYFQAVS.exe
  2⤵
  PID:4704
- C:\Windows\System\dyBXEeS.exe
  C:\Windows\System\dyBXEeS.exe
  2⤵
  PID:11328
- C:\Windows\System\royOHij.exe
  C:\Windows\System\royOHij.exe
  2⤵
  PID:13524
- C:\Windows\System\WpZUDad.exe
  C:\Windows\System\WpZUDad.exe
  2⤵
  PID:10048
- C:\Windows\System\DyLzSny.exe
  C:\Windows\System\DyLzSny.exe
  2⤵
  PID:13592
- C:\Windows\System\wymewMf.exe
  C:\Windows\System\wymewMf.exe
  2⤵
  PID:10464
- C:\Windows\System\sldkGtU.exe
  C:\Windows\System\sldkGtU.exe
  2⤵
  PID:11688
- C:\Windows\System\wHzfPrP.exe
  C:\Windows\System\wHzfPrP.exe
  2⤵
  PID:12992
- C:\Windows\System\TuSZSuJ.exe
  C:\Windows\System\TuSZSuJ.exe
  2⤵
  PID:10124
- C:\Windows\System\VeHoyRD.exe
  C:\Windows\System\VeHoyRD.exe
  2⤵
  PID:11300
- C:\Windows\System\cpqGJvf.exe
  C:\Windows\System\cpqGJvf.exe
  2⤵
  PID:13472

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d5txkkby.pww.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ASgKPDX.exe

Filesize
1.9MB

MD5
ccb033f3b505eac94a252a660da6836a

SHA1
73e53cd5878785deadbc192f01a23a74e4d26c85

SHA256
906278daab842c0bdfb3cfc8fcf523f75069471af1be1359876d0aec5fd9ddcc

SHA512
ef4a6f1ee258d46fb2c4f4b37ec23cf85c497803c376ffd37f430f186d0219d960f936a3aa38ca0700268e31c6e11c8a2f8ca27d2612a2ff94dadad40390701a

Download Submit
C:\Windows\System\AkjjNTB.exe

Filesize
1.9MB

MD5
410d7397b67069d3a07cefc42de3c6f5

SHA1
fd492f88eae4d7af2046ff3821f4a911455ce66c

SHA256
823b9bb935be57c2130034aa8eaedc951c825f929537d63b4c4fd7d92be04cb5

SHA512
4898176c68ba2c4a852ee82ba38130b3d4e7c7897587d9eebd55d5a50f29205def4d4f1def3ab985af6eb24a050dd98c754e93be7c69fab5fe1f0d4c9ff9990a

Download Submit
C:\Windows\System\DQGuBmw.exe

Filesize
1.9MB

MD5
054daad500c51b103b499c3ff48b4fce

SHA1
f9e9c460bfc3eed2cc476e3c9e69184873433545

SHA256
675bb0c33d2c2bab7ec271d1a40a2406a5c10c00dd11d8c6f572d6f4861f2b84

SHA512
99332f42cbbc2a9af47aa66a077fa64a720e6899e36783f2469cea9e39ddb2e328243fdcc38c80121d069ff49bc94c5d593502b1bed5581a1462c607668a831b

Download Submit
C:\Windows\System\Esaeofe.exe

Filesize
1.9MB

MD5
67a70f45f6d7ed94aed1e9fd71729e8a

SHA1
4b7368c86a81ad49c3682a88d99af97c3d80f1ee

SHA256
d08a6865a4d72f5345af279ff7aebe8641837acd230bbbff2ecba0727f254d81

SHA512
cb52b395273da9010e709a707c11ea70b18772561fcccceb0bef0a676b1abd01d641c9ee80dd338fef3acf14425b9ffbb36ca4f70e94c8f53150d99bd6d22d37

Download Submit
C:\Windows\System\GydeUIV.exe

Filesize
1.9MB

MD5
dfa67b65285b91434e5953f28d98a5d4

SHA1
128ff6b371f3c65dd6feac7d38387fa8be9fe3de

SHA256
ee2694d98d343addabd8ebf0731c015b8929bd391b4abdd2c5048e506eb6e2c1

SHA512
2fed7072bd2fd39a0323286cc011a0ca9c9706c370ae9bf929183f91ea8923f1e47d1f49f8da33dbd9125eae76a5ef78677f0c8ae4397ed0cabd2ea65148a9bc

Download Submit
C:\Windows\System\HpiIpOV.exe

Filesize
1.9MB

MD5
dd2c4b0a0153fa31a87f086542ef7fab

SHA1
3838d82cc6c0f9dc85fa3527b9ad9c0d20accaac

SHA256
e3408f065bb9ae8006ed7eb41986776910c971500f90939fa6c62f346c5e87ec

SHA512
a6d2e33d755c13cb8a92e82274efe8ad55cb528caad208a9305a98df9749cade1b0fed5a6125e8e21f333855b61cc749dcb6ff531f883bfe132433b0bca6e52d

Download Submit
C:\Windows\System\KRNoEcD.exe

Filesize
1.9MB

MD5
b0230950c7ef8646057a3f8a2be1f6f8

SHA1
bc71ad894f6758b43a0cb79b937ff6e991326cd0

SHA256
c8f2db2974c08ba2a49d58fdb99fb3a493cbbc9a7d2e1d6da1351a8434e6e565

SHA512
2af5f06552d87ecbc70cee124ce0f5e8d9ff0fcb32339ec821beb239859834b5101a22198750c3a55769283bba638e52753cbebbba1361a1f2a066ba737e4b28

Download Submit
C:\Windows\System\MwYYwwE.exe

Filesize
1.9MB

MD5
c275d76929c246a90ad3f6e82680107a

SHA1
e4d59967914d43e7c5e2f5b8cf02fa227fae1499

SHA256
24b572650c2db026694dc5738ceb1279db0ab4be104dc328b7082e58229cf3da

SHA512
47b7a9ad9d523ecebbd4760998bb93f03c1e08bea51e5f4c90be20b7f2560d3cc593ac67a2e1d5d1b20adca10f8203d7671f9d9a106eaa60158e93b53f7a6256

Download Submit
C:\Windows\System\OGSGBcG.exe

Filesize
1.9MB

MD5
5560747d1ca1b908bb8bd6c34c92db1e

SHA1
36c2e8d74b83669192e0325ebbb186be55ed892c

SHA256
cef6d83569061adedb40b5745f9c32e2590360194bd3c57cce1dcbb0e073f8e4

SHA512
f0f1a5e830cdcce1fb6e9bdafe6f779d2b97b64bbd19fd188dd56d91a27a26cd928df0b1607eb0075d180c29654bb2b620adeb6bbe4d8c348102ae56d35078b1

Download Submit
C:\Windows\System\QJVeoXT.exe

Filesize
1.9MB

MD5
15d725b316de029acb51639c28486ab8

SHA1
096242773d6275457a83f58fe2fea432a5d74a88

SHA256
e5dfb3bb447687a37156baf33f5479df951d3115a719c0660240d8007f3440b9

SHA512
48d00b78d35ad049528406ee6528a285164917996f6c26f17aad70423fe42e70f05c8d06411b71f2e0be4949068375d41e10b843726b5d13d585a858ddad4a6e

Download Submit
C:\Windows\System\SUKnOpl.exe

Filesize
1.9MB

MD5
abe5cdf47369626fa8b1d4ce57358290

SHA1
4fe9f5cf54bde9ff0e102e39467ff55e9ff756d6

SHA256
5f4f51ddff2f0de8587dd82150b24a11a09d5608a576f430f689c3509c9d8aa6

SHA512
50902e04beeb7f0e726bedac2081765ca0b37c4b9d25d9b777ec8d6ebe403e548f1b5430f176d610612eeda7b43180285c120874e6000e4161b400f1dddf4799

Download Submit
C:\Windows\System\SdmLIGu.exe

Filesize
18B

MD5
b5af15b91ef901dbbad280bf2ec97d3f

SHA1
b8fc44effcf94c604b3a330099fdd05d70ca2290

SHA256
4b241b0358bbe69bc40fb7c8558ef0dacf7a7dd595b9974e7ee1287f6f6a57a6

SHA512
77e9e1cd7604d29efe33ea37dfc85035465c8eb4a6b1edf396f009c9427a6171460e7b24fac454a276653572360ea48634eb43a059b68dd9d91460bd58c1ddf1

Download Submit
C:\Windows\System\TiTRDap.exe

Filesize
1.9MB

MD5
d190283d72c40642ea9a5d7ec70259d9

SHA1
8e82683044f221537eb76dd489e40a9bc64f10f9

SHA256
b2d8d9516575ce12b94997741e28382e6d6b9bc94d8ece0e02a895a819a413a6

SHA512
40c6689ecd37a7e22fa456e9090642816010ee4b65b9e8b2098719d4035ed8331de7920a7bbe3f1aa1d89fa75e2931473bc6ff3f3d703705b7dacb1ec4655e0c

Download Submit
C:\Windows\System\TloOwyT.exe

Filesize
1.9MB

MD5
fd11dfc227f7deea4a8ea0121bcbc28f

SHA1
615034a632cfdbac5d8099336ba89e98b8a62a91

SHA256
20f033d9771bbb6058e5435df2a462c341406c3d2f70a347cd64a321172338c1

SHA512
6c0e26134f3ee24c0b2d344f1b31294192ba8399ffd2b1ecbb88a1ca582c6acaa2cf0440bc76ff1b108c8787d467cfb6791764205f33304f1503c307025278e7

Download Submit
C:\Windows\System\WBkhlVZ.exe

Filesize
1.9MB

MD5
453446f526ac61e02bf8e31db25b508c

SHA1
7d23d905df09e64d3a639d94da7b4589f415222a

SHA256
5764f13cd7705307aa7195c16040f0c4ee97b25f73fc0e5fb5e61bb81a9f3f63

SHA512
70a9e204bf5f01236fbf38f0d6ae9a9b34d73ff9e4de4be1fd6e991b1c7f64d469db84ea8e9a7b45fcbc51cbb515b06df8af9fb2aa0d43879aa30f0246233177

Download Submit
C:\Windows\System\XBsekQL.exe

Filesize
1.9MB

MD5
51b02c52ba1f2476204cf4364a76078b

SHA1
7b413841a247faed86e8cf12660a9555749fe2ae

SHA256
b7630eb4fdeb30b63c33a250fc5e7cf90f73c4367bb2167758e13789e7083415

SHA512
4c804b1e78b07cb8ae3fbdac5c920fbb10db57b6a280e441f5e2bc4182bc49cf6710f387a1ab489967d7adf1bfa2eb8a6f29abb54120fc4ff18eb2fb01fbc3d3

Download Submit
C:\Windows\System\XjLhZqG.exe

Filesize
1.9MB

MD5
bf26e128694b19d9df162a8a9c7ce59b

SHA1
dceb6d41279c9ee57803affc0e27163c18143771

SHA256
b6368d39cc843226b971422ed209d858c3bd3f3f3353dcf1337f1b1179716732

SHA512
15761414362ddadcda6eb907807c9811539443685f55fe6d5c2c7775c634b5c49f2b658a5d17bc070a41dbfec44b32c2a92e5c6e8e7106491bb732227631866e

Download Submit
C:\Windows\System\bESOFTZ.exe

Filesize
1.9MB

MD5
6fe3ee20bbc3957f6b95bc21092f93f0

SHA1
5cce0738ca7c53e286633bd008de134a4308c7bc

SHA256
9527748c2192bdd5ce85cfa47d8c906e9280394e14a0928b68523925979a45fb

SHA512
859afee596316209dafa17fd257523080ecd91a7a565b5a16435b40f5559cd8451767eab2a8af125d468b99661fb3920202d4da50648318904337a3829b6e713

Download Submit
C:\Windows\System\cKnjvpb.exe

Filesize
1.9MB

MD5
f564c1e9260c32efac1ff5b00d47f8aa

SHA1
7f460d0ada09e512b47440f852d3b9d3275fbcf7

SHA256
4582ec0ab45f90666b4d5bdd4b04be747c93958c00920b97ff19386ccce8805b

SHA512
84bfde5d8b84d204ab190c5b8ba4099e2e5a8c58a354795dde6fafcaea4519af424473e563975c5a4076829f41274fc9e4e470efd76f30fcf046481359bcdef8

Download Submit
C:\Windows\System\dInvUCL.exe

Filesize
1.9MB

MD5
a46e3e34c760a43d8ea84d32f88ef5f1

SHA1
eb7c3db67a7b049af9c7fd826ada7f8a0630841c

SHA256
3c6de895b7bafc15094dc61223bac2d79bc8e521a8bc40334b02c46118cb3c8c

SHA512
a8acdb9fd481fc6defe4233fa0529088821844f9156702cd770ddba2a66c129d58a946bb20a27752ee070a1a819af2a845886fb434ac237b03aae4e47c1044d5

Download Submit
C:\Windows\System\gJdTwgD.exe

Filesize
1.9MB

MD5
353bb5228ca93351fd2ccdef14d5f9b9

SHA1
8d3e9bf3003cb3407f602478798a1088ceaf0c4b

SHA256
2c494e69f8fa8cfb6a42f80de97b5ac582d87b7af108ba87470601ea1ad598d3

SHA512
d47a415abaebe921c6980e4986278b268bba1cbb8a2412afcdb06cbe6dd2ee30fc098f6d2d04b0d73c4483122aad2370718c044efe57744bddeb126c166f6409

Download Submit
C:\Windows\System\hqQGsnN.exe

Filesize
1.9MB

MD5
0751883a48d08ec5230e7978f3b9c9ad

SHA1
751271a63d57f21f87d8f21956f46067634acd5d

SHA256
613f426c9507847bbecf8a62246aef22b6bc3ec1227c25f87eea24e837f45eb3

SHA512
653942bf7cbc1644a04ce3a744c974da259f3a40c5356c4c78b721b0cd5a50a12c8e4ec192a53048af08852f2495327d515ed463553a3014cafad4552c572262

Download Submit
C:\Windows\System\iPFnSaH.exe

Filesize
1.9MB

MD5
ca067cb87574e52f8defefbb8710c4ca

SHA1
c570d8c04f6b441e23d6f92be8cd2d629142d572

SHA256
e18801685eacdc0b43f2d131fe290e7527a233ad6a8f6fb05d326c733b5314e6

SHA512
ad30b2d7a0bce8d5f219d5539946c921f6a75bdad8b5f2215d4e11f3d5e42f3181db2decff5ba6a41cdddefdd34a6bfcfebd275756ab09cf6aac5de4bfad6534

Download Submit
C:\Windows\System\iaAQIXE.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\kVpAsdj.exe

Filesize
1.9MB

MD5
21499bd445018e617536f6ce0415dea2

SHA1
e76730de2141ce0944016e399da5c2c6c4dc1070

SHA256
b954b34594d92ecaf8b9a07acd5c88a62dc41031fabb63b236c3317173e31e63

SHA512
f99772122ea18e23f4340d0d5f4e5837f53a0a67938d7aa99fcc216043bc1bd17be2fdf3fa14f2cb7acadd961f3e29604621bd74d2de297188101b2c57a1dd51

Download Submit
C:\Windows\System\lEbJkXM.exe

Filesize
1.9MB

MD5
337d1048477857ac46f292cea2e12e2c

SHA1
003646a33fbcbaf4b2266b03dfba4b1fbdb2f030

SHA256
27803f327fb549f093ea5f91581386d63982bde95feeda13633f968e967f8510

SHA512
15c873121cba54e417d292d356ca29ec73808a4ad959c76828f5b637ef871fc1e46f20618a419713882cbad464c0bfc1d58ffb560e2c0da8e6ffb13b9455e5d4

Download Submit
C:\Windows\System\lycqqJx.exe

Filesize
1.9MB

MD5
d0a0f6c3842eba2413d4bdf28c6398e6

SHA1
d17cb97f4004cb28f12b0b7ce208c34bf7f87896

SHA256
f429bb7111344e3f9fa522e83effa06cbde48a57137b3e13ef55620c3af4190d

SHA512
ecd123f06f596b7e41c38a44bf3c1146b414b0068708a1f328807bbf76cf72b0f905dac696bfb77389590db6a871f3d2b8ef5578cea8f6da49647ad70b6c7f97

Download Submit
C:\Windows\System\mZZDpGK.exe

Filesize
1.9MB

MD5
5cb1bfd0e0efe48aa05d4fd2cd93b037

SHA1
3c5a25a3d6e43fd3c0a3e6cd343d2d70c889ef93

SHA256
e0f982f8a1ef4ef1caf4284e9f8f22826fae008dafa29e0ee93b0592cfb253bb

SHA512
3f8960d43559539b88802c19008a109d29217be82e97514512ad67a1f9463cd467704ef3c8a3885d47a121eca8073056d5ba351bdfa8fe635ae13b1bdf3a0a7c

Download Submit
C:\Windows\System\nNqtqGf.exe

Filesize
1.9MB

MD5
87c29b53ba2452e60c2c2792f8d81d58

SHA1
09017e6e15b59e5bc0549bd8195c9dfe388d5275

SHA256
0a9791b9d9bc2e4fe3946472aa8ef5518977da5b4e95c0cdeb4314b8555e3a0c

SHA512
d7665556c238ccc9832b1138073abea60cef6791bff0929d4909fa983f04b5fd7b1d53dbeef1844191fbe03647974177a26bfaabb481274736d3134ce3c43d38

Download Submit
C:\Windows\System\nSGUDPl.exe

Filesize
1.9MB

MD5
85269bcd3d1246a8df04d4f43c1780bb

SHA1
afe5e6bece66a89b4ffefb10df9fcea911dd70c5

SHA256
6c8add0bb0b62a466f2ff49455eef12fb72896aadaa99c5ebd1c68c9392afab2

SHA512
c08336a302344c6cd29bf7374bf60700730e193109c8c0ed36385707b732eb3d156fdd7340b00ee0547259bc6e04802699ec51d8778834205f7a29f81bc89710

Download Submit
C:\Windows\System\niYBPJZ.exe

Filesize
1.9MB

MD5
8e6e4b37f9394bea137edc19bc87b691

SHA1
513d9ce9a94467b0cf18f453449ec8229e57cbd5

SHA256
ef7910147c972ba0ead284fb4b46383635d89a9b061c95f370fa62be883f51cc

SHA512
ffd8d5020b8db1d8092c9631e2277010280b0e9ec46f4fcda99ad03674c02a8ff708b36be40deaedb71d4e83ae8b700c9860eee48a1034e4336ed9ffbc13aa47

Download Submit
C:\Windows\System\qtQzilZ.exe

Filesize
1.9MB

MD5
6a12e6d4892dcc973de5f7bc408a5cdd

SHA1
afaeabeb76bbab256df94d92e4ddafcb5e690314

SHA256
e9c32e5f6ed6d1baa9d72a998d0a3cb0d6daa1c33a915a9c682c13ca62c33bc4

SHA512
57e246cfe697a11c1a603f856ce8c208e4cb218f9599527a0121497b4b8b07b2ba493869efffd9302eeed15c730df8e8891020f1030d1ddf0c346e7767fd61bc

Download Submit
C:\Windows\System\tVjVKRU.exe

Filesize
1.9MB

MD5
b8b0e17082d103b236ca96a9ef63cb38

SHA1
39016544568e308ad2fc2031bfb9311c01bc1311

SHA256
826fd8c3b71dac23673096b3fdda0ce0b6674d14fa71648aff95d622083a87bb

SHA512
87f94106b7a6598735723629fffcb1496c29efff32dd4a1827e9d545bb96f5bd0a5cdf0f7af9eae790459db3f80e7d55a2039b237b91404f723836050d87848e

Download Submit
C:\Windows\System\uoAlJjN.exe

Filesize
1.9MB

MD5
37cacc8ba48bf146b2bd1215d6e28a20

SHA1
13679822c3c9fd4f8c01fc0945a2d8c857727706

SHA256
e78e3d2b5ee5fd75b3541b88377f33796dd7b4006d8a072bbdb2eff1efa48662

SHA512
7b5f09c529c4e45a09b8a4d36aa0421e37c78b8a981c8446c70465d12a044b8f73719e0f174e3f8c0510e416fd678cfd5f2f43ae5275394b3df07534a0d27162

Download Submit
C:\Windows\System\vylIexS.exe

Filesize
1.9MB

MD5
223e748f5e6b89e324dd730fd85b781e

SHA1
035994f90738ae852e470f8945e14be8620a408c

SHA256
bdd531620e558d2f0681935c626c515c941e4846ae3c57b0f3525536e4e9d091

SHA512
7fe91d0b31350446415dc03263a80dd454fdf8b0b648ce56d19a549e8a921817ec9aa0a3f94027571658c645691e0816103bd1d6db1156eca888047c324567bc

Download Submit
C:\Windows\System\xGfRURE.exe

Filesize
1.9MB

MD5
9176d7d732ae5ff5c2f49d526148e2f9

SHA1
6c0fcdce19acfd46ec7acef100e29c0aba42dca1

SHA256
119f8ff3e3cb3ab3f1e4ed3ebfea6e98091f84092d623921a1a53a897633f647

SHA512
502984729fb676f5bff499c58fbc41cc7b9c776628f59c7b9852bf202743be7a4019c7887056b4e98b8f46afb95f028682f97aef78bcab2b2a732b113f846734

Download Submit
C:\Windows\System\xxPsDhS.exe

Filesize
1.9MB

MD5
27fbcce95a246e3074ac94170d26181e

SHA1
72e2ff1d1d9ebe6d3d0cdcc593238904cb24420b

SHA256
b8fd556aa27bb9af90809d526ed59d35b1364a15c61d6fc923ffa3884ec43aed

SHA512
24df394ea8b8789d325a3a8d34ebdbe0057c920fcfcf8f9437680e4de6850fdcf51ee0e40f6bb63cc78ec01083116bf40cf0053143e8ea06235787eda8d73a6e

Download Submit
C:\Windows\System\zqOJkUV.exe

Filesize
1.9MB

MD5
ca8d3f5d3361a65efd9952252b9ca7af

SHA1
397f0412d63d084bc49903cebfe942ab1c9f80c2

SHA256
958a83dec672fb8c4ba7d98c844ea776f733a75a6e9a402cc4cc3c06bad2b45e

SHA512
112164c097b13068b7c2c69162e275e608ac53b892a6d622e8ca0d3782ec42bcce826e378ac46b7e75178dd2f5ba93a05d8a1ca49b8ff8255d3f30cdf9a8d448

Download Submit
memory/408-208-0x0000024DA24C0000-0x0000024DA24E2000-memory.dmp

Filesize
136KB

Download
memory/408-55-0x00007FFAE6EB0000-0x00007FFAE7971000-memory.dmp

Filesize
10.8MB

Download
memory/408-2177-0x00007FFAE6EB0000-0x00007FFAE7971000-memory.dmp

Filesize
10.8MB

Download
memory/408-56-0x0000024DA1EC0000-0x0000024DA1ED0000-memory.dmp

Filesize
64KB

Download
memory/680-5073-0x00007FF740210000-0x00007FF740602000-memory.dmp

Filesize
3.9MB

Download
memory/680-350-0x00007FF740210000-0x00007FF740602000-memory.dmp

Filesize
3.9MB

Download
memory/948-217-0x00007FF7F6010000-0x00007FF7F6402000-memory.dmp

Filesize
3.9MB

Download
memory/972-171-0x00007FF685710000-0x00007FF685B02000-memory.dmp

Filesize
3.9MB

Download
memory/1088-226-0x00007FF6BF4D0000-0x00007FF6BF8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1140-5045-0x00007FF66BB10000-0x00007FF66BF02000-memory.dmp

Filesize
3.9MB

Download
memory/1140-332-0x00007FF66BB10000-0x00007FF66BF02000-memory.dmp

Filesize
3.9MB

Download
memory/1252-5053-0x00007FF67DAA0000-0x00007FF67DE92000-memory.dmp

Filesize
3.9MB

Download
memory/1252-383-0x00007FF67DAA0000-0x00007FF67DE92000-memory.dmp

Filesize
3.9MB

Download
memory/2020-5100-0x00007FF6DDD10000-0x00007FF6DE102000-memory.dmp

Filesize
3.9MB

Download
memory/2020-351-0x00007FF6DDD10000-0x00007FF6DE102000-memory.dmp

Filesize
3.9MB

Download
memory/2116-280-0x00007FF6F0340000-0x00007FF6F0732000-memory.dmp

Filesize
3.9MB

Download
memory/2424-5024-0x00007FF640100000-0x00007FF6404F2000-memory.dmp

Filesize
3.9MB

Download
memory/2424-311-0x00007FF640100000-0x00007FF6404F2000-memory.dmp

Filesize
3.9MB

Download
memory/2760-11-0x00007FF7DED00000-0x00007FF7DF0F2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-5034-0x00007FF6E4510000-0x00007FF6E4902000-memory.dmp

Filesize
3.9MB

Download
memory/2900-251-0x00007FF6E4510000-0x00007FF6E4902000-memory.dmp

Filesize
3.9MB

Download
memory/2944-0-0x00007FF7099D0000-0x00007FF709DC2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-5477-0x00007FF7099D0000-0x00007FF709DC2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-1-0x000001BA13750000-0x000001BA13760000-memory.dmp

Filesize
64KB

Download
memory/3016-5116-0x00007FF7BEB00000-0x00007FF7BEEF2000-memory.dmp

Filesize
3.9MB

Download
memory/3016-541-0x00007FF7BEB00000-0x00007FF7BEEF2000-memory.dmp

Filesize
3.9MB

Download
memory/3596-79-0x00007FF78CF40000-0x00007FF78D332000-memory.dmp

Filesize
3.9MB

Download
memory/3608-138-0x00007FF6210C0000-0x00007FF6214B2000-memory.dmp

Filesize
3.9MB

Download
memory/3608-4884-0x00007FF6210C0000-0x00007FF6214B2000-memory.dmp

Filesize
3.9MB

Download
memory/3616-244-0x00007FF7F42A0000-0x00007FF7F4692000-memory.dmp

Filesize
3.9MB

Download
memory/3976-475-0x00007FF62BB00000-0x00007FF62BEF2000-memory.dmp

Filesize
3.9MB

Download
memory/3976-5111-0x00007FF62BB00000-0x00007FF62BEF2000-memory.dmp

Filesize
3.9MB

Download
memory/4264-4867-0x00007FF6AAD20000-0x00007FF6AB112000-memory.dmp

Filesize
3.9MB

Download
memory/4264-114-0x00007FF6AAD20000-0x00007FF6AB112000-memory.dmp

Filesize
3.9MB

Download
memory/4476-415-0x00007FF600260000-0x00007FF600652000-memory.dmp

Filesize
3.9MB

Download
memory/4476-5057-0x00007FF600260000-0x00007FF600652000-memory.dmp

Filesize
3.9MB

Download
memory/4972-4995-0x00007FF7A29E0000-0x00007FF7A2DD2000-memory.dmp

Filesize
3.9MB

Download
memory/4972-483-0x00007FF7A29E0000-0x00007FF7A2DD2000-memory.dmp

Filesize
3.9MB

Download
memory/5084-5108-0x00007FF785A20000-0x00007FF785E12000-memory.dmp

Filesize
3.9MB

Download
memory/5084-433-0x00007FF785A20000-0x00007FF785E12000-memory.dmp

Filesize
3.9MB

Download
memory/5116-5121-0x00007FF68ADE0000-0x00007FF68B1D2000-memory.dmp

Filesize
3.9MB

Download
memory/5116-465-0x00007FF68ADE0000-0x00007FF68B1D2000-memory.dmp

Filesize
3.9MB

Download