xmrig | 5459a7e094139469b83d3d91ee30b252aab16f73a6edfc52f093e5b3fcfe1958

Analysis

max time kernel
71s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
Size

1.9MB
MD5

0f3af9b8212a83e8a74ad92db5753122
SHA1

10f965891b376c37b088b37c961048b40e1a7562
SHA256

5459a7e094139469b83d3d91ee30b252aab16f73a6edfc52f093e5b3fcfe1958
SHA512

1750ca9d093dec483a2cba2cc2fd5156562886963e0f2713dd3d845d5d0ae5ec317a227c9de15dc4d2cc6af342352696216b95137f49b8fa1e8842cfcb7e2f4a
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+UJ:NAB2

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/memory/4932-72-0x00007FF704770000-0x00007FF704B62000-memory.dmp	xmrig
behavioral2/memory/3104-146-0x00007FF60F650000-0x00007FF60FA42000-memory.dmp	xmrig
behavioral2/memory/1192-150-0x00007FF625DE0000-0x00007FF6261D2000-memory.dmp	xmrig
behavioral2/memory/2176-155-0x00007FF6FB7E0000-0x00007FF6FBBD2000-memory.dmp	xmrig
behavioral2/memory/640-158-0x00007FF6EA380000-0x00007FF6EA772000-memory.dmp	xmrig
behavioral2/memory/436-157-0x00007FF633FA0000-0x00007FF634392000-memory.dmp	xmrig
behavioral2/memory/900-156-0x00007FF6645A0000-0x00007FF664992000-memory.dmp	xmrig
behavioral2/memory/832-154-0x00007FF63EA60000-0x00007FF63EE52000-memory.dmp	xmrig
behavioral2/memory/3084-153-0x00007FF7DEB30000-0x00007FF7DEF22000-memory.dmp	xmrig
behavioral2/memory/4508-152-0x00007FF6F2EC0000-0x00007FF6F32B2000-memory.dmp	xmrig
behavioral2/memory/1080-151-0x00007FF6A35A0000-0x00007FF6A3992000-memory.dmp	xmrig
behavioral2/memory/924-147-0x00007FF660080000-0x00007FF660472000-memory.dmp	xmrig
behavioral2/memory/3508-141-0x00007FF681060000-0x00007FF681452000-memory.dmp	xmrig
behavioral2/memory/5116-115-0x00007FF766A60000-0x00007FF766E52000-memory.dmp	xmrig
behavioral2/memory/4740-59-0x00007FF7A2730000-0x00007FF7A2B22000-memory.dmp	xmrig
behavioral2/memory/1080-2159-0x00007FF6A35A0000-0x00007FF6A3992000-memory.dmp	xmrig
behavioral2/memory/2236-2162-0x00007FF753690000-0x00007FF753A82000-memory.dmp	xmrig
behavioral2/memory/1892-2216-0x00007FF77EFC0000-0x00007FF77F3B2000-memory.dmp	xmrig
behavioral2/memory/3668-2208-0x00007FF702D60000-0x00007FF703152000-memory.dmp	xmrig
behavioral2/memory/2644-2160-0x00007FF7AB090000-0x00007FF7AB482000-memory.dmp	xmrig
behavioral2/memory/4740-2157-0x00007FF7A2730000-0x00007FF7A2B22000-memory.dmp	xmrig
behavioral2/memory/4932-2155-0x00007FF704770000-0x00007FF704B62000-memory.dmp	xmrig
behavioral2/memory/1192-2153-0x00007FF625DE0000-0x00007FF6261D2000-memory.dmp	xmrig
behavioral2/memory/4508-2151-0x00007FF6F2EC0000-0x00007FF6F32B2000-memory.dmp	xmrig
behavioral2/memory/3084-2149-0x00007FF7DEB30000-0x00007FF7DEF22000-memory.dmp	xmrig
behavioral2/memory/3652-2136-0x00007FF6459B0000-0x00007FF645DA2000-memory.dmp	xmrig
behavioral2/memory/436-2170-0x00007FF633FA0000-0x00007FF634392000-memory.dmp	xmrig
behavioral2/memory/1668-2165-0x00007FF7B1070000-0x00007FF7B1462000-memory.dmp	xmrig
behavioral2/memory/832-2147-0x00007FF63EA60000-0x00007FF63EE52000-memory.dmp	xmrig
behavioral2/memory/1376-2145-0x00007FF66E0D0000-0x00007FF66E4C2000-memory.dmp	xmrig
behavioral2/memory/900-2143-0x00007FF6645A0000-0x00007FF664992000-memory.dmp	xmrig
behavioral2/memory/5116-2141-0x00007FF766A60000-0x00007FF766E52000-memory.dmp	xmrig
behavioral2/memory/2176-2139-0x00007FF6FB7E0000-0x00007FF6FBBD2000-memory.dmp	xmrig
behavioral2/memory/684-2134-0x00007FF6EF9F0000-0x00007FF6EFDE2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	3980	powershell.exe
11	3980	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3980	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2236	qHFJamE.exe
3668	xGqaMql.exe
2644	dDIyIWZ.exe
1192	fBZNzmg.exe
1668	sKSnUmI.exe
1080	FsHavxr.exe
4740	bdYPQCX.exe
4508	ksccqfL.exe
4932	tgWUmwQ.exe
3084	izSNEhm.exe
832	qQueSzq.exe
1376	rZrATuZ.exe
2176	NEVeRhk.exe
900	sbbDYge.exe
1188	aVjsvQq.exe
3652	kJZjxHI.exe
5116	sBiDNYY.exe
436	UpxplXX.exe
684	ygVAZbW.exe
640	JEvncBU.exe
3508	hGUnVLH.exe
3104	dmcCLLz.exe
924	oxqVYLD.exe
1892	iWZZnPh.exe
3628	HGceKjO.exe
2108	GGogtcW.exe
1204	YhhQPDu.exe
4072	OsDFFYb.exe
2428	cTegkxu.exe
4476	bTMElXL.exe
5036	CtrvGTl.exe
1068	UOrNZqc.exe
3096	sigDtQG.exe
3264	QdfraEG.exe
4308	UjRbViG.exe
4880	jbcSjEg.exe
4104	LkmNGRd.exe
1900	qARrQzE.exe
4756	dXmyFrC.exe
1836	hPoLsHs.exe
2292	XBlpEOl.exe
2432	QiLrBeM.exe
3936	IBtbFAd.exe
3804	wnjnVVW.exe
4388	aZEcpiZ.exe
3976	bzdjGNp.exe
3300	yzKVeQB.exe
4360	yClUtZC.exe
4460	MhMZPXo.exe
1860	eRIcOJJ.exe
2072	dyNjtgM.exe
4472	dAWZvUf.exe
4108	sUUDPSt.exe
3520	QTuEbSC.exe
4412	LlyIeJr.exe
4952	hFfmNry.exe
5132	gbPGzoK.exe
5148	rBbPNgo.exe
5172	gByVRym.exe
5196	GFJzFNX.exe
5212	UNiXjva.exe
5236	CfWMDGt.exe
5252	RJrmpnf.exe
5268	zrtObra.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4848-0-0x00007FF6CE620000-0x00007FF6CEA12000-memory.dmp	upx
behavioral2/files/0x0008000000023257-5.dat	upx
behavioral2/files/0x000700000002325d-7.dat	upx
behavioral2/files/0x000700000002325f-24.dat	upx
behavioral2/files/0x0007000000023262-45.dat	upx
behavioral2/memory/4932-72-0x00007FF704770000-0x00007FF704B62000-memory.dmp	upx
behavioral2/files/0x0007000000023265-84.dat	upx
behavioral2/files/0x000700000002326a-96.dat	upx
behavioral2/files/0x0007000000023269-103.dat	upx
behavioral2/files/0x0007000000023270-139.dat	upx
behavioral2/memory/3104-146-0x00007FF60F650000-0x00007FF60FA42000-memory.dmp	upx
behavioral2/memory/1192-150-0x00007FF625DE0000-0x00007FF6261D2000-memory.dmp	upx
behavioral2/memory/2176-155-0x00007FF6FB7E0000-0x00007FF6FBBD2000-memory.dmp	upx
behavioral2/memory/640-158-0x00007FF6EA380000-0x00007FF6EA772000-memory.dmp	upx
behavioral2/memory/436-157-0x00007FF633FA0000-0x00007FF634392000-memory.dmp	upx
behavioral2/memory/900-156-0x00007FF6645A0000-0x00007FF664992000-memory.dmp	upx
behavioral2/files/0x0007000000023271-161.dat	upx
behavioral2/files/0x0007000000023276-181.dat	upx
behavioral2/files/0x000700000002327b-199.dat	upx
behavioral2/files/0x000700000002327c-204.dat	upx
behavioral2/files/0x000700000002327a-198.dat	upx
behavioral2/files/0x0007000000023279-194.dat	upx
behavioral2/files/0x0008000000023278-187.dat	upx
behavioral2/files/0x0007000000023275-168.dat	upx
behavioral2/files/0x0007000000023274-165.dat	upx
behavioral2/files/0x0007000000023272-163.dat	upx
behavioral2/memory/832-154-0x00007FF63EA60000-0x00007FF63EE52000-memory.dmp	upx
behavioral2/memory/3084-153-0x00007FF7DEB30000-0x00007FF7DEF22000-memory.dmp	upx
behavioral2/memory/4508-152-0x00007FF6F2EC0000-0x00007FF6F32B2000-memory.dmp	upx
behavioral2/memory/1080-151-0x00007FF6A35A0000-0x00007FF6A3992000-memory.dmp	upx
behavioral2/memory/1892-148-0x00007FF77EFC0000-0x00007FF77F3B2000-memory.dmp	upx
behavioral2/memory/924-147-0x00007FF660080000-0x00007FF660472000-memory.dmp	upx
behavioral2/files/0x0007000000023273-145.dat	upx
behavioral2/files/0x000700000002326d-143.dat	upx
behavioral2/memory/3508-141-0x00007FF681060000-0x00007FF681452000-memory.dmp	upx
behavioral2/files/0x000700000002326f-136.dat	upx
behavioral2/memory/684-133-0x00007FF6EF9F0000-0x00007FF6EFDE2000-memory.dmp	upx
behavioral2/files/0x000700000002326e-124.dat	upx
behavioral2/files/0x000700000002326c-122.dat	upx
behavioral2/files/0x000700000002326b-117.dat	upx
behavioral2/memory/5116-115-0x00007FF766A60000-0x00007FF766E52000-memory.dmp	upx
behavioral2/files/0x0007000000023268-99.dat	upx
behavioral2/memory/3652-98-0x00007FF6459B0000-0x00007FF645DA2000-memory.dmp	upx
behavioral2/files/0x0007000000023267-104.dat	upx
behavioral2/memory/1188-92-0x00007FF61DA80000-0x00007FF61DE72000-memory.dmp	upx
behavioral2/files/0x000800000002325b-91.dat	upx
behavioral2/memory/1376-75-0x00007FF66E0D0000-0x00007FF66E4C2000-memory.dmp	upx
behavioral2/files/0x0007000000023266-86.dat	upx
behavioral2/files/0x0007000000023264-58.dat	upx
behavioral2/memory/4740-59-0x00007FF7A2730000-0x00007FF7A2B22000-memory.dmp	upx
behavioral2/memory/1668-51-0x00007FF7B1070000-0x00007FF7B1462000-memory.dmp	upx
behavioral2/files/0x0007000000023263-50.dat	upx
behavioral2/files/0x0007000000023261-46.dat	upx
behavioral2/memory/2644-41-0x00007FF7AB090000-0x00007FF7AB482000-memory.dmp	upx
behavioral2/files/0x000700000002325e-37.dat	upx
behavioral2/files/0x0007000000023260-35.dat	upx
behavioral2/memory/3668-27-0x00007FF702D60000-0x00007FF703152000-memory.dmp	upx
behavioral2/memory/2236-18-0x00007FF753690000-0x00007FF753A82000-memory.dmp	upx
behavioral2/files/0x000900000002325c-17.dat	upx
behavioral2/memory/1080-2159-0x00007FF6A35A0000-0x00007FF6A3992000-memory.dmp	upx
behavioral2/memory/2236-2162-0x00007FF753690000-0x00007FF753A82000-memory.dmp	upx
behavioral2/memory/1892-2216-0x00007FF77EFC0000-0x00007FF77F3B2000-memory.dmp	upx
behavioral2/memory/3668-2208-0x00007FF702D60000-0x00007FF703152000-memory.dmp	upx
behavioral2/memory/2644-2160-0x00007FF7AB090000-0x00007FF7AB482000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
6	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AeadQvJ.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\TMVzeOC.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\xVYQROl.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\YybUvNa.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\EmJvDZI.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\YEBAWmN.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\uwbgKNo.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\jGRNmHm.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\AcsMaur.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\TCwwMnL.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\phYIyae.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\GjKhOfd.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\BjEEIkc.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\fhDqVkU.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\FWCAJLS.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\qgvKjXr.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\UOpFCAu.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\LGCnuNw.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\AQCyMFh.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\SInAQoD.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\hauITwb.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\aHSJiIt.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\aYcAfXc.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\VHOiGWN.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\mXVCXsm.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\SqyVwxs.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\lmjwhEf.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\gyXCjCt.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\syzcwJB.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\HEMjlYk.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\hoGZZyO.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\xQfXTvC.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\pbaYbmX.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\pykEAAM.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\YjaPvse.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\gTxEtpc.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\LCgiBHO.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\ranleZH.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\dXNPNmb.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\VNkEcAE.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\taIhXUb.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\FxxSLit.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\lfFkMaX.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\mPtAbKl.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\ggUJYSA.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\VKJDwKU.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\hCPezpb.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\gblgUmc.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\sbbDYge.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\RyzGsLn.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\vuOEemj.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\MGtZguF.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\aOvBYYd.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\HoDIQPM.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\dJJiwgi.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\GzWrrQS.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\HRxZDHx.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\UJmJFsn.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\fylkIFr.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\tTyHSGG.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\ZiSmDGt.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\HsRCgme.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\cQBXxNl.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
File created	C:\Windows\System\ganzLVk.exe	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3980	powershell.exe
3980	powershell.exe
3980	powershell.exe
3980	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
Token: SeDebugPrivilege	3980	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 3980	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	91
PID 4848 wrote to memory of 3980	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	91
PID 4848 wrote to memory of 2236	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	92
PID 4848 wrote to memory of 2236	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	92
PID 4848 wrote to memory of 3668	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	93
PID 4848 wrote to memory of 3668	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	93
PID 4848 wrote to memory of 2644	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	94
PID 4848 wrote to memory of 2644	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	94
PID 4848 wrote to memory of 1192	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	95
PID 4848 wrote to memory of 1192	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	95
PID 4848 wrote to memory of 1668	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	96
PID 4848 wrote to memory of 1668	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	96
PID 4848 wrote to memory of 1080	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	97
PID 4848 wrote to memory of 1080	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	97
PID 4848 wrote to memory of 4740	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	98
PID 4848 wrote to memory of 4740	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	98
PID 4848 wrote to memory of 4508	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	99
PID 4848 wrote to memory of 4508	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	99
PID 4848 wrote to memory of 4932	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	100
PID 4848 wrote to memory of 4932	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	100
PID 4848 wrote to memory of 3084	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	101
PID 4848 wrote to memory of 3084	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	101
PID 4848 wrote to memory of 832	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	102
PID 4848 wrote to memory of 832	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	102
PID 4848 wrote to memory of 1376	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	103
PID 4848 wrote to memory of 1376	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	103
PID 4848 wrote to memory of 900	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	104
PID 4848 wrote to memory of 900	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	104
PID 4848 wrote to memory of 3652	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	105
PID 4848 wrote to memory of 3652	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	105
PID 4848 wrote to memory of 2176	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	106
PID 4848 wrote to memory of 2176	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	106
PID 4848 wrote to memory of 1188	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	107
PID 4848 wrote to memory of 1188	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	107
PID 4848 wrote to memory of 5116	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	108
PID 4848 wrote to memory of 5116	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	108
PID 4848 wrote to memory of 436	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	109
PID 4848 wrote to memory of 436	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	109
PID 4848 wrote to memory of 684	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	110
PID 4848 wrote to memory of 684	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	110
PID 4848 wrote to memory of 640	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	111
PID 4848 wrote to memory of 640	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	111
PID 4848 wrote to memory of 3508	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	112
PID 4848 wrote to memory of 3508	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	112
PID 4848 wrote to memory of 3104	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	113
PID 4848 wrote to memory of 3104	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	113
PID 4848 wrote to memory of 924	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	114
PID 4848 wrote to memory of 924	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	114
PID 4848 wrote to memory of 1892	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	115
PID 4848 wrote to memory of 1892	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	115
PID 4848 wrote to memory of 3628	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	116
PID 4848 wrote to memory of 3628	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	116
PID 4848 wrote to memory of 2108	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	117
PID 4848 wrote to memory of 2108	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	117
PID 4848 wrote to memory of 1204	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	118
PID 4848 wrote to memory of 1204	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	118
PID 4848 wrote to memory of 4072	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	119
PID 4848 wrote to memory of 4072	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	119
PID 4848 wrote to memory of 2428	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	120
PID 4848 wrote to memory of 2428	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	120
PID 4848 wrote to memory of 4476	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	121
PID 4848 wrote to memory of 4476	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	121
PID 4848 wrote to memory of 5036	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	122
PID 4848 wrote to memory of 5036	4848	0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe	122

C:\Users\Admin\AppData\Local\Temp\0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f3af9b8212a83e8a74ad92db5753122_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3980
- C:\Windows\System\qHFJamE.exe
  C:\Windows\System\qHFJamE.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\xGqaMql.exe
  C:\Windows\System\xGqaMql.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\dDIyIWZ.exe
  C:\Windows\System\dDIyIWZ.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\fBZNzmg.exe
  C:\Windows\System\fBZNzmg.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\sKSnUmI.exe
  C:\Windows\System\sKSnUmI.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\FsHavxr.exe
  C:\Windows\System\FsHavxr.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\bdYPQCX.exe
  C:\Windows\System\bdYPQCX.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\ksccqfL.exe
  C:\Windows\System\ksccqfL.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\tgWUmwQ.exe
  C:\Windows\System\tgWUmwQ.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\izSNEhm.exe
  C:\Windows\System\izSNEhm.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\qQueSzq.exe
  C:\Windows\System\qQueSzq.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\rZrATuZ.exe
  C:\Windows\System\rZrATuZ.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\sbbDYge.exe
  C:\Windows\System\sbbDYge.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\kJZjxHI.exe
  C:\Windows\System\kJZjxHI.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\NEVeRhk.exe
  C:\Windows\System\NEVeRhk.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\aVjsvQq.exe
  C:\Windows\System\aVjsvQq.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\sBiDNYY.exe
  C:\Windows\System\sBiDNYY.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\UpxplXX.exe
  C:\Windows\System\UpxplXX.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\ygVAZbW.exe
  C:\Windows\System\ygVAZbW.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\JEvncBU.exe
  C:\Windows\System\JEvncBU.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\hGUnVLH.exe
  C:\Windows\System\hGUnVLH.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\dmcCLLz.exe
  C:\Windows\System\dmcCLLz.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\oxqVYLD.exe
  C:\Windows\System\oxqVYLD.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\iWZZnPh.exe
  C:\Windows\System\iWZZnPh.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\HGceKjO.exe
  C:\Windows\System\HGceKjO.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\GGogtcW.exe
  C:\Windows\System\GGogtcW.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\YhhQPDu.exe
  C:\Windows\System\YhhQPDu.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\OsDFFYb.exe
  C:\Windows\System\OsDFFYb.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\cTegkxu.exe
  C:\Windows\System\cTegkxu.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\bTMElXL.exe
  C:\Windows\System\bTMElXL.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\CtrvGTl.exe
  C:\Windows\System\CtrvGTl.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\UOrNZqc.exe
  C:\Windows\System\UOrNZqc.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\sigDtQG.exe
  C:\Windows\System\sigDtQG.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\QdfraEG.exe
  C:\Windows\System\QdfraEG.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\UjRbViG.exe
  C:\Windows\System\UjRbViG.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\jbcSjEg.exe
  C:\Windows\System\jbcSjEg.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\LkmNGRd.exe
  C:\Windows\System\LkmNGRd.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\qARrQzE.exe
  C:\Windows\System\qARrQzE.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\dXmyFrC.exe
  C:\Windows\System\dXmyFrC.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\hPoLsHs.exe
  C:\Windows\System\hPoLsHs.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\XBlpEOl.exe
  C:\Windows\System\XBlpEOl.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\QiLrBeM.exe
  C:\Windows\System\QiLrBeM.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\IBtbFAd.exe
  C:\Windows\System\IBtbFAd.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\wnjnVVW.exe
  C:\Windows\System\wnjnVVW.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\aZEcpiZ.exe
  C:\Windows\System\aZEcpiZ.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\bzdjGNp.exe
  C:\Windows\System\bzdjGNp.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\yzKVeQB.exe
  C:\Windows\System\yzKVeQB.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\yClUtZC.exe
  C:\Windows\System\yClUtZC.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\MhMZPXo.exe
  C:\Windows\System\MhMZPXo.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\eRIcOJJ.exe
  C:\Windows\System\eRIcOJJ.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\dyNjtgM.exe
  C:\Windows\System\dyNjtgM.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\dAWZvUf.exe
  C:\Windows\System\dAWZvUf.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\sUUDPSt.exe
  C:\Windows\System\sUUDPSt.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\QTuEbSC.exe
  C:\Windows\System\QTuEbSC.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\LlyIeJr.exe
  C:\Windows\System\LlyIeJr.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\hFfmNry.exe
  C:\Windows\System\hFfmNry.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\gbPGzoK.exe
  C:\Windows\System\gbPGzoK.exe
  2⤵
  - Executes dropped EXE
  PID:5132
- C:\Windows\System\rBbPNgo.exe
  C:\Windows\System\rBbPNgo.exe
  2⤵
  - Executes dropped EXE
  PID:5148
- C:\Windows\System\gByVRym.exe
  C:\Windows\System\gByVRym.exe
  2⤵
  - Executes dropped EXE
  PID:5172
- C:\Windows\System\GFJzFNX.exe
  C:\Windows\System\GFJzFNX.exe
  2⤵
  - Executes dropped EXE
  PID:5196
- C:\Windows\System\UNiXjva.exe
  C:\Windows\System\UNiXjva.exe
  2⤵
  - Executes dropped EXE
  PID:5212
- C:\Windows\System\CfWMDGt.exe
  C:\Windows\System\CfWMDGt.exe
  2⤵
  - Executes dropped EXE
  PID:5236
- C:\Windows\System\RJrmpnf.exe
  C:\Windows\System\RJrmpnf.exe
  2⤵
  - Executes dropped EXE
  PID:5252
- C:\Windows\System\zrtObra.exe
  C:\Windows\System\zrtObra.exe
  2⤵
  - Executes dropped EXE
  PID:5268
- C:\Windows\System\vEfbnwt.exe
  C:\Windows\System\vEfbnwt.exe
  2⤵
  PID:5328
- C:\Windows\System\mPtAbKl.exe
  C:\Windows\System\mPtAbKl.exe
  2⤵
  PID:5344
- C:\Windows\System\GBEkMbN.exe
  C:\Windows\System\GBEkMbN.exe
  2⤵
  PID:5360
- C:\Windows\System\ZZPpUMl.exe
  C:\Windows\System\ZZPpUMl.exe
  2⤵
  PID:5384
- C:\Windows\System\jwGrxlS.exe
  C:\Windows\System\jwGrxlS.exe
  2⤵
  PID:5400
- C:\Windows\System\wQwjPvN.exe
  C:\Windows\System\wQwjPvN.exe
  2⤵
  PID:5628
- C:\Windows\System\wkHVipK.exe
  C:\Windows\System\wkHVipK.exe
  2⤵
  PID:5644
- C:\Windows\System\ZyrYbas.exe
  C:\Windows\System\ZyrYbas.exe
  2⤵
  PID:5660
- C:\Windows\System\UYuVlol.exe
  C:\Windows\System\UYuVlol.exe
  2⤵
  PID:5680
- C:\Windows\System\RZxnamR.exe
  C:\Windows\System\RZxnamR.exe
  2⤵
  PID:5696
- C:\Windows\System\PkXwpUa.exe
  C:\Windows\System\PkXwpUa.exe
  2⤵
  PID:5728
- C:\Windows\System\hfMngdL.exe
  C:\Windows\System\hfMngdL.exe
  2⤵
  PID:5744
- C:\Windows\System\ySvKYSC.exe
  C:\Windows\System\ySvKYSC.exe
  2⤵
  PID:5768
- C:\Windows\System\cyTOvet.exe
  C:\Windows\System\cyTOvet.exe
  2⤵
  PID:5796
- C:\Windows\System\vEtsLPs.exe
  C:\Windows\System\vEtsLPs.exe
  2⤵
  PID:5824
- C:\Windows\System\QWRyDpJ.exe
  C:\Windows\System\QWRyDpJ.exe
  2⤵
  PID:5840
- C:\Windows\System\ELqQxRM.exe
  C:\Windows\System\ELqQxRM.exe
  2⤵
  PID:5856
- C:\Windows\System\gBnZkZG.exe
  C:\Windows\System\gBnZkZG.exe
  2⤵
  PID:5872
- C:\Windows\System\okglunL.exe
  C:\Windows\System\okglunL.exe
  2⤵
  PID:5984
- C:\Windows\System\gGxgqjx.exe
  C:\Windows\System\gGxgqjx.exe
  2⤵
  PID:6000
- C:\Windows\System\CCBpova.exe
  C:\Windows\System\CCBpova.exe
  2⤵
  PID:6024
- C:\Windows\System\GHCCiNH.exe
  C:\Windows\System\GHCCiNH.exe
  2⤵
  PID:6048
- C:\Windows\System\dugeeKd.exe
  C:\Windows\System\dugeeKd.exe
  2⤵
  PID:6072
- C:\Windows\System\tbmXUbN.exe
  C:\Windows\System\tbmXUbN.exe
  2⤵
  PID:6096
- C:\Windows\System\JzWoVCT.exe
  C:\Windows\System\JzWoVCT.exe
  2⤵
  PID:6120
- C:\Windows\System\lMSVnIM.exe
  C:\Windows\System\lMSVnIM.exe
  2⤵
  PID:6136
- C:\Windows\System\UEFojCV.exe
  C:\Windows\System\UEFojCV.exe
  2⤵
  PID:5248
- C:\Windows\System\EbDMFOR.exe
  C:\Windows\System\EbDMFOR.exe
  2⤵
  PID:5280
- C:\Windows\System\RopxnBR.exe
  C:\Windows\System\RopxnBR.exe
  2⤵
  PID:5320
- C:\Windows\System\lyYaWGv.exe
  C:\Windows\System\lyYaWGv.exe
  2⤵
  PID:5352
- C:\Windows\System\GNDoHJD.exe
  C:\Windows\System\GNDoHJD.exe
  2⤵
  PID:5380
- C:\Windows\System\cNazHos.exe
  C:\Windows\System\cNazHos.exe
  2⤵
  PID:5452
- C:\Windows\System\YfHlCmi.exe
  C:\Windows\System\YfHlCmi.exe
  2⤵
  PID:5424
- C:\Windows\System\djsmvCa.exe
  C:\Windows\System\djsmvCa.exe
  2⤵
  PID:5496
- C:\Windows\System\FCPSlwi.exe
  C:\Windows\System\FCPSlwi.exe
  2⤵
  PID:5556
- C:\Windows\System\lTMqPWc.exe
  C:\Windows\System\lTMqPWc.exe
  2⤵
  PID:5868
- C:\Windows\System\UJmJFsn.exe
  C:\Windows\System\UJmJFsn.exe
  2⤵
  PID:5624
- C:\Windows\System\zUXYMic.exe
  C:\Windows\System\zUXYMic.exe
  2⤵
  PID:3112
- C:\Windows\System\sMBRJsZ.exe
  C:\Windows\System\sMBRJsZ.exe
  2⤵
  PID:5676
- C:\Windows\System\JepEPEM.exe
  C:\Windows\System\JepEPEM.exe
  2⤵
  PID:5716
- C:\Windows\System\HPUINwT.exe
  C:\Windows\System\HPUINwT.exe
  2⤵
  PID:5752
- C:\Windows\System\BPixuXQ.exe
  C:\Windows\System\BPixuXQ.exe
  2⤵
  PID:5784
- C:\Windows\System\efWJkoj.exe
  C:\Windows\System\efWJkoj.exe
  2⤵
  PID:5816
- C:\Windows\System\zNIsvSp.exe
  C:\Windows\System\zNIsvSp.exe
  2⤵
  PID:5852
- C:\Windows\System\IETptSc.exe
  C:\Windows\System\IETptSc.exe
  2⤵
  PID:4348
- C:\Windows\System\vuOEemj.exe
  C:\Windows\System\vuOEemj.exe
  2⤵
  PID:5936
- C:\Windows\System\HumQkyo.exe
  C:\Windows\System\HumQkyo.exe
  2⤵
  PID:5960
- C:\Windows\System\eCnFAOX.exe
  C:\Windows\System\eCnFAOX.exe
  2⤵
  PID:6148
- C:\Windows\System\fbeSyIC.exe
  C:\Windows\System\fbeSyIC.exe
  2⤵
  PID:6204
- C:\Windows\System\hdIYOlP.exe
  C:\Windows\System\hdIYOlP.exe
  2⤵
  PID:6228
- C:\Windows\System\GefuXKB.exe
  C:\Windows\System\GefuXKB.exe
  2⤵
  PID:6252
- C:\Windows\System\COmHxny.exe
  C:\Windows\System\COmHxny.exe
  2⤵
  PID:6268
- C:\Windows\System\LztAIeG.exe
  C:\Windows\System\LztAIeG.exe
  2⤵
  PID:6292
- C:\Windows\System\oAusuIQ.exe
  C:\Windows\System\oAusuIQ.exe
  2⤵
  PID:6320
- C:\Windows\System\JYwfOzd.exe
  C:\Windows\System\JYwfOzd.exe
  2⤵
  PID:6336
- C:\Windows\System\kLCgWZy.exe
  C:\Windows\System\kLCgWZy.exe
  2⤵
  PID:6360
- C:\Windows\System\Xqlekmz.exe
  C:\Windows\System\Xqlekmz.exe
  2⤵
  PID:6384
- C:\Windows\System\kWKHycL.exe
  C:\Windows\System\kWKHycL.exe
  2⤵
  PID:6400
- C:\Windows\System\GrKZAJv.exe
  C:\Windows\System\GrKZAJv.exe
  2⤵
  PID:6424
- C:\Windows\System\QaYkwWZ.exe
  C:\Windows\System\QaYkwWZ.exe
  2⤵
  PID:6448
- C:\Windows\System\xTjpjBk.exe
  C:\Windows\System\xTjpjBk.exe
  2⤵
  PID:6468
- C:\Windows\System\pcahyEl.exe
  C:\Windows\System\pcahyEl.exe
  2⤵
  PID:6532
- C:\Windows\System\UpVgupU.exe
  C:\Windows\System\UpVgupU.exe
  2⤵
  PID:6552
- C:\Windows\System\VNkEcAE.exe
  C:\Windows\System\VNkEcAE.exe
  2⤵
  PID:6576
- C:\Windows\System\CVURDfM.exe
  C:\Windows\System\CVURDfM.exe
  2⤵
  PID:6600
- C:\Windows\System\qtdstyA.exe
  C:\Windows\System\qtdstyA.exe
  2⤵
  PID:6620
- C:\Windows\System\WcUZlzY.exe
  C:\Windows\System\WcUZlzY.exe
  2⤵
  PID:6640
- C:\Windows\System\mgEhQyv.exe
  C:\Windows\System\mgEhQyv.exe
  2⤵
  PID:6660
- C:\Windows\System\KjHGzfK.exe
  C:\Windows\System\KjHGzfK.exe
  2⤵
  PID:6684
- C:\Windows\System\UwTHHbo.exe
  C:\Windows\System\UwTHHbo.exe
  2⤵
  PID:6716
- C:\Windows\System\UjCTUYF.exe
  C:\Windows\System\UjCTUYF.exe
  2⤵
  PID:6736
- C:\Windows\System\peeaPYY.exe
  C:\Windows\System\peeaPYY.exe
  2⤵
  PID:6764
- C:\Windows\System\laUOgIH.exe
  C:\Windows\System\laUOgIH.exe
  2⤵
  PID:6784
- C:\Windows\System\YEBAWmN.exe
  C:\Windows\System\YEBAWmN.exe
  2⤵
  PID:6804
- C:\Windows\System\jMZhTIY.exe
  C:\Windows\System\jMZhTIY.exe
  2⤵
  PID:6832
- C:\Windows\System\trwSEQC.exe
  C:\Windows\System\trwSEQC.exe
  2⤵
  PID:6848
- C:\Windows\System\UdkQBTE.exe
  C:\Windows\System\UdkQBTE.exe
  2⤵
  PID:6876
- C:\Windows\System\BCDdwOj.exe
  C:\Windows\System\BCDdwOj.exe
  2⤵
  PID:6896
- C:\Windows\System\KbnnBWq.exe
  C:\Windows\System\KbnnBWq.exe
  2⤵
  PID:6916
- C:\Windows\System\KQIOoRr.exe
  C:\Windows\System\KQIOoRr.exe
  2⤵
  PID:6932
- C:\Windows\System\pxMhkDw.exe
  C:\Windows\System\pxMhkDw.exe
  2⤵
  PID:6956
- C:\Windows\System\fSxuVjr.exe
  C:\Windows\System\fSxuVjr.exe
  2⤵
  PID:6976
- C:\Windows\System\pEsdxnu.exe
  C:\Windows\System\pEsdxnu.exe
  2⤵
  PID:6992
- C:\Windows\System\YktZrTf.exe
  C:\Windows\System\YktZrTf.exe
  2⤵
  PID:7008
- C:\Windows\System\ncjEASA.exe
  C:\Windows\System\ncjEASA.exe
  2⤵
  PID:7024
- C:\Windows\System\oHwhNQU.exe
  C:\Windows\System\oHwhNQU.exe
  2⤵
  PID:7040
- C:\Windows\System\HjxcIek.exe
  C:\Windows\System\HjxcIek.exe
  2⤵
  PID:7056
- C:\Windows\System\oWHPnLE.exe
  C:\Windows\System\oWHPnLE.exe
  2⤵
  PID:7076
- C:\Windows\System\RQXRIrA.exe
  C:\Windows\System\RQXRIrA.exe
  2⤵
  PID:7100
- C:\Windows\System\kohorzA.exe
  C:\Windows\System\kohorzA.exe
  2⤵
  PID:7124
- C:\Windows\System\YtujxJc.exe
  C:\Windows\System\YtujxJc.exe
  2⤵
  PID:7144
- C:\Windows\System\jRuXBOL.exe
  C:\Windows\System\jRuXBOL.exe
  2⤵
  PID:4636
- C:\Windows\System\VPUwPAC.exe
  C:\Windows\System\VPUwPAC.exe
  2⤵
  PID:6132
- C:\Windows\System\uQLJnSU.exe
  C:\Windows\System\uQLJnSU.exe
  2⤵
  PID:6064
- C:\Windows\System\bpHOTzP.exe
  C:\Windows\System\bpHOTzP.exe
  2⤵
  PID:6032
- C:\Windows\System\buKEHxA.exe
  C:\Windows\System\buKEHxA.exe
  2⤵
  PID:5992
- C:\Windows\System\xzFLHmq.exe
  C:\Windows\System\xzFLHmq.exe
  2⤵
  PID:2312
- C:\Windows\System\qlKjRPA.exe
  C:\Windows\System\qlKjRPA.exe
  2⤵
  PID:5736
- C:\Windows\System\hKCAEqs.exe
  C:\Windows\System\hKCAEqs.exe
  2⤵
  PID:564
- C:\Windows\System\YxivLhg.exe
  C:\Windows\System\YxivLhg.exe
  2⤵
  PID:1136
- C:\Windows\System\BXPHeyx.exe
  C:\Windows\System\BXPHeyx.exe
  2⤵
  PID:5336
- C:\Windows\System\CzQwkep.exe
  C:\Windows\System\CzQwkep.exe
  2⤵
  PID:1336
- C:\Windows\System\wwSxUyV.exe
  C:\Windows\System\wwSxUyV.exe
  2⤵
  PID:5884
- C:\Windows\System\VqGPzrs.exe
  C:\Windows\System\VqGPzrs.exe
  2⤵
  PID:5740
- C:\Windows\System\cvGHGDJ.exe
  C:\Windows\System\cvGHGDJ.exe
  2⤵
  PID:5812
- C:\Windows\System\uVOMhjO.exe
  C:\Windows\System\uVOMhjO.exe
  2⤵
  PID:5108
- C:\Windows\System\oKPcsgT.exe
  C:\Windows\System\oKPcsgT.exe
  2⤵
  PID:4444
- C:\Windows\System\LkslxAE.exe
  C:\Windows\System\LkslxAE.exe
  2⤵
  PID:4500
- C:\Windows\System\KwmwXJe.exe
  C:\Windows\System\KwmwXJe.exe
  2⤵
  PID:1812
- C:\Windows\System\NoatVBR.exe
  C:\Windows\System\NoatVBR.exe
  2⤵
  PID:552
- C:\Windows\System\BFdbNqr.exe
  C:\Windows\System\BFdbNqr.exe
  2⤵
  PID:1120
- C:\Windows\System\hqSAEdS.exe
  C:\Windows\System\hqSAEdS.exe
  2⤵
  PID:6380
- C:\Windows\System\GgxzGbV.exe
  C:\Windows\System\GgxzGbV.exe
  2⤵
  PID:4516
- C:\Windows\System\tzILAYc.exe
  C:\Windows\System\tzILAYc.exe
  2⤵
  PID:6408
- C:\Windows\System\zLxznfo.exe
  C:\Windows\System\zLxznfo.exe
  2⤵
  PID:6668
- C:\Windows\System\GnQUOsH.exe
  C:\Windows\System\GnQUOsH.exe
  2⤵
  PID:6464
- C:\Windows\System\yLnyEQd.exe
  C:\Windows\System\yLnyEQd.exe
  2⤵
  PID:6220
- C:\Windows\System\pHsXRkT.exe
  C:\Windows\System\pHsXRkT.exe
  2⤵
  PID:6260
- C:\Windows\System\cuEXpNU.exe
  C:\Windows\System\cuEXpNU.exe
  2⤵
  PID:6300
- C:\Windows\System\mrOhCus.exe
  C:\Windows\System\mrOhCus.exe
  2⤵
  PID:6732
- C:\Windows\System\UkJlohF.exe
  C:\Windows\System\UkJlohF.exe
  2⤵
  PID:6612
- C:\Windows\System\gUdZtKN.exe
  C:\Windows\System\gUdZtKN.exe
  2⤵
  PID:6908
- C:\Windows\System\QunzRPD.exe
  C:\Windows\System\QunzRPD.exe
  2⤵
  PID:6984
- C:\Windows\System\YSqxRlf.exe
  C:\Windows\System\YSqxRlf.exe
  2⤵
  PID:6476
- C:\Windows\System\JiMGMtk.exe
  C:\Windows\System\JiMGMtk.exe
  2⤵
  PID:2696
- C:\Windows\System\bbouduK.exe
  C:\Windows\System\bbouduK.exe
  2⤵
  PID:6540
- C:\Windows\System\EECqLMu.exe
  C:\Windows\System\EECqLMu.exe
  2⤵
  PID:6568
- C:\Windows\System\LkQHnVA.exe
  C:\Windows\System\LkQHnVA.exe
  2⤵
  PID:6760
- C:\Windows\System\qYPzgHa.exe
  C:\Windows\System\qYPzgHa.exe
  2⤵
  PID:6800
- C:\Windows\System\jMlqIFB.exe
  C:\Windows\System\jMlqIFB.exe
  2⤵
  PID:1744
- C:\Windows\System\CdxvgGC.exe
  C:\Windows\System\CdxvgGC.exe
  2⤵
  PID:5548
- C:\Windows\System\AWMSYye.exe
  C:\Windows\System\AWMSYye.exe
  2⤵
  PID:6972
- C:\Windows\System\VQMXiIM.exe
  C:\Windows\System\VQMXiIM.exe
  2⤵
  PID:7176
- C:\Windows\System\hauITwb.exe
  C:\Windows\System\hauITwb.exe
  2⤵
  PID:7200
- C:\Windows\System\QtXwpBx.exe
  C:\Windows\System\QtXwpBx.exe
  2⤵
  PID:7224
- C:\Windows\System\AKJWfJD.exe
  C:\Windows\System\AKJWfJD.exe
  2⤵
  PID:7240
- C:\Windows\System\HQBPqFp.exe
  C:\Windows\System\HQBPqFp.exe
  2⤵
  PID:7264
- C:\Windows\System\OBJWHBV.exe
  C:\Windows\System\OBJWHBV.exe
  2⤵
  PID:7288
- C:\Windows\System\OJHLODC.exe
  C:\Windows\System\OJHLODC.exe
  2⤵
  PID:7304
- C:\Windows\System\OffazpC.exe
  C:\Windows\System\OffazpC.exe
  2⤵
  PID:7328
- C:\Windows\System\VdeQsgp.exe
  C:\Windows\System\VdeQsgp.exe
  2⤵
  PID:7348
- C:\Windows\System\nqqcJzB.exe
  C:\Windows\System\nqqcJzB.exe
  2⤵
  PID:7372
- C:\Windows\System\nlnuGmQ.exe
  C:\Windows\System\nlnuGmQ.exe
  2⤵
  PID:7388
- C:\Windows\System\XQjcDgn.exe
  C:\Windows\System\XQjcDgn.exe
  2⤵
  PID:7424
- C:\Windows\System\MRVCjSl.exe
  C:\Windows\System\MRVCjSl.exe
  2⤵
  PID:7448
- C:\Windows\System\qgvKjXr.exe
  C:\Windows\System\qgvKjXr.exe
  2⤵
  PID:7472
- C:\Windows\System\aeFDqlt.exe
  C:\Windows\System\aeFDqlt.exe
  2⤵
  PID:7488
- C:\Windows\System\TpFnMgm.exe
  C:\Windows\System\TpFnMgm.exe
  2⤵
  PID:7512
- C:\Windows\System\oyVNiUg.exe
  C:\Windows\System\oyVNiUg.exe
  2⤵
  PID:7532
- C:\Windows\System\Nucdswq.exe
  C:\Windows\System\Nucdswq.exe
  2⤵
  PID:7552
- C:\Windows\System\gGlehvn.exe
  C:\Windows\System\gGlehvn.exe
  2⤵
  PID:7572
- C:\Windows\System\PmtsnSp.exe
  C:\Windows\System\PmtsnSp.exe
  2⤵
  PID:7596
- C:\Windows\System\PTfCuQN.exe
  C:\Windows\System\PTfCuQN.exe
  2⤵
  PID:7612
- C:\Windows\System\uBFZNRr.exe
  C:\Windows\System\uBFZNRr.exe
  2⤵
  PID:7640
- C:\Windows\System\Xnzstzp.exe
  C:\Windows\System\Xnzstzp.exe
  2⤵
  PID:7656
- C:\Windows\System\IzMGZny.exe
  C:\Windows\System\IzMGZny.exe
  2⤵
  PID:7680
- C:\Windows\System\aajOGei.exe
  C:\Windows\System\aajOGei.exe
  2⤵
  PID:7700
- C:\Windows\System\MVYIIkx.exe
  C:\Windows\System\MVYIIkx.exe
  2⤵
  PID:7724
- C:\Windows\System\vwVwYTb.exe
  C:\Windows\System\vwVwYTb.exe
  2⤵
  PID:7744
- C:\Windows\System\bMqbAkO.exe
  C:\Windows\System\bMqbAkO.exe
  2⤵
  PID:7764
- C:\Windows\System\xGOxLqf.exe
  C:\Windows\System\xGOxLqf.exe
  2⤵
  PID:7780
- C:\Windows\System\GlRWFbJ.exe
  C:\Windows\System\GlRWFbJ.exe
  2⤵
  PID:7804
- C:\Windows\System\JrdTAOl.exe
  C:\Windows\System\JrdTAOl.exe
  2⤵
  PID:7824
- C:\Windows\System\BjfHDls.exe
  C:\Windows\System\BjfHDls.exe
  2⤵
  PID:7844
- C:\Windows\System\CqJjcrg.exe
  C:\Windows\System\CqJjcrg.exe
  2⤵
  PID:7864
- C:\Windows\System\CJwxAvb.exe
  C:\Windows\System\CJwxAvb.exe
  2⤵
  PID:7884
- C:\Windows\System\FEfFHht.exe
  C:\Windows\System\FEfFHht.exe
  2⤵
  PID:7908
- C:\Windows\System\AnIUJOW.exe
  C:\Windows\System\AnIUJOW.exe
  2⤵
  PID:7928
- C:\Windows\System\gWWeWng.exe
  C:\Windows\System\gWWeWng.exe
  2⤵
  PID:7948
- C:\Windows\System\OoGWRez.exe
  C:\Windows\System\OoGWRez.exe
  2⤵
  PID:7972
- C:\Windows\System\NWWWOmh.exe
  C:\Windows\System\NWWWOmh.exe
  2⤵
  PID:7988
- C:\Windows\System\CdOfGXY.exe
  C:\Windows\System\CdOfGXY.exe
  2⤵
  PID:8008
- C:\Windows\System\DxWRfjW.exe
  C:\Windows\System\DxWRfjW.exe
  2⤵
  PID:8028
- C:\Windows\System\QRAmrUb.exe
  C:\Windows\System\QRAmrUb.exe
  2⤵
  PID:8052
- C:\Windows\System\QybWzzT.exe
  C:\Windows\System\QybWzzT.exe
  2⤵
  PID:8068
- C:\Windows\System\cUOdNEz.exe
  C:\Windows\System\cUOdNEz.exe
  2⤵
  PID:8092
- C:\Windows\System\ggUJYSA.exe
  C:\Windows\System\ggUJYSA.exe
  2⤵
  PID:8112
- C:\Windows\System\rqVwryD.exe
  C:\Windows\System\rqVwryD.exe
  2⤵
  PID:8128
- C:\Windows\System\MGYSYTR.exe
  C:\Windows\System\MGYSYTR.exe
  2⤵
  PID:8172
- C:\Windows\System\bkEqeRI.exe
  C:\Windows\System\bkEqeRI.exe
  2⤵
  PID:788
- C:\Windows\System\gNmCdiu.exe
  C:\Windows\System\gNmCdiu.exe
  2⤵
  PID:2376
- C:\Windows\System\YCSTzgH.exe
  C:\Windows\System\YCSTzgH.exe
  2⤵
  PID:6940
- C:\Windows\System\FHXbcJc.exe
  C:\Windows\System\FHXbcJc.exe
  2⤵
  PID:6496
- C:\Windows\System\RfycnqE.exe
  C:\Windows\System\RfycnqE.exe
  2⤵
  PID:6820
- C:\Windows\System\bJssUdr.exe
  C:\Windows\System\bJssUdr.exe
  2⤵
  PID:6892
- C:\Windows\System\lLtRGUG.exe
  C:\Windows\System\lLtRGUG.exe
  2⤵
  PID:3036
- C:\Windows\System\CjBHbRl.exe
  C:\Windows\System\CjBHbRl.exe
  2⤵
  PID:7068
- C:\Windows\System\OYjjLAO.exe
  C:\Windows\System\OYjjLAO.exe
  2⤵
  PID:7116
- C:\Windows\System\yHKYThL.exe
  C:\Windows\System\yHKYThL.exe
  2⤵
  PID:4640
- C:\Windows\System\VKJDwKU.exe
  C:\Windows\System\VKJDwKU.exe
  2⤵
  PID:6040
- C:\Windows\System\OXNgLYR.exe
  C:\Windows\System\OXNgLYR.exe
  2⤵
  PID:4960
- C:\Windows\System\MkFpbYX.exe
  C:\Windows\System\MkFpbYX.exe
  2⤵
  PID:5312
- C:\Windows\System\kzRhvoK.exe
  C:\Windows\System\kzRhvoK.exe
  2⤵
  PID:5672
- C:\Windows\System\OsCTwbp.exe
  C:\Windows\System\OsCTwbp.exe
  2⤵
  PID:4152
- C:\Windows\System\lDOUlYC.exe
  C:\Windows\System\lDOUlYC.exe
  2⤵
  PID:7996
- C:\Windows\System\fDmKcLt.exe
  C:\Windows\System\fDmKcLt.exe
  2⤵
  PID:1300
- C:\Windows\System\XdOmkNt.exe
  C:\Windows\System\XdOmkNt.exe
  2⤵
  PID:6244
- C:\Windows\System\NAKROVX.exe
  C:\Windows\System\NAKROVX.exe
  2⤵
  PID:7000
- C:\Windows\System\viuquzO.exe
  C:\Windows\System\viuquzO.exe
  2⤵
  PID:7164
- C:\Windows\System\QIuBSpA.exe
  C:\Windows\System\QIuBSpA.exe
  2⤵
  PID:7960
- C:\Windows\System\LNZVowE.exe
  C:\Windows\System\LNZVowE.exe
  2⤵
  PID:4336
- C:\Windows\System\kCeHecf.exe
  C:\Windows\System\kCeHecf.exe
  2⤵
  PID:8204
- C:\Windows\System\CINcjxS.exe
  C:\Windows\System\CINcjxS.exe
  2⤵
  PID:8228
- C:\Windows\System\Jdwhzqm.exe
  C:\Windows\System\Jdwhzqm.exe
  2⤵
  PID:8244
- C:\Windows\System\abwywDh.exe
  C:\Windows\System\abwywDh.exe
  2⤵
  PID:8288
- C:\Windows\System\cUffxdQ.exe
  C:\Windows\System\cUffxdQ.exe
  2⤵
  PID:8332
- C:\Windows\System\RySdnTC.exe
  C:\Windows\System\RySdnTC.exe
  2⤵
  PID:8384
- C:\Windows\System\kszUDCK.exe
  C:\Windows\System\kszUDCK.exe
  2⤵
  PID:8404
- C:\Windows\System\klVXGDK.exe
  C:\Windows\System\klVXGDK.exe
  2⤵
  PID:8424
- C:\Windows\System\pcesXLi.exe
  C:\Windows\System\pcesXLi.exe
  2⤵
  PID:8444
- C:\Windows\System\OtjfMLC.exe
  C:\Windows\System\OtjfMLC.exe
  2⤵
  PID:8460
- C:\Windows\System\OUvNRqV.exe
  C:\Windows\System\OUvNRqV.exe
  2⤵
  PID:8492
- C:\Windows\System\kycVOyn.exe
  C:\Windows\System\kycVOyn.exe
  2⤵
  PID:8528
- C:\Windows\System\aICReFs.exe
  C:\Windows\System\aICReFs.exe
  2⤵
  PID:8564
- C:\Windows\System\WVPoKWX.exe
  C:\Windows\System\WVPoKWX.exe
  2⤵
  PID:8608
- C:\Windows\System\xHIsBrh.exe
  C:\Windows\System\xHIsBrh.exe
  2⤵
  PID:8648
- C:\Windows\System\eCJAgjs.exe
  C:\Windows\System\eCJAgjs.exe
  2⤵
  PID:8688
- C:\Windows\System\MGtZguF.exe
  C:\Windows\System\MGtZguF.exe
  2⤵
  PID:8732
- C:\Windows\System\XeNXOMA.exe
  C:\Windows\System\XeNXOMA.exe
  2⤵
  PID:8752
- C:\Windows\System\KPsKgld.exe
  C:\Windows\System\KPsKgld.exe
  2⤵
  PID:8780
- C:\Windows\System\lHwZNTY.exe
  C:\Windows\System\lHwZNTY.exe
  2⤵
  PID:8796
- C:\Windows\System\zCVDYSr.exe
  C:\Windows\System\zCVDYSr.exe
  2⤵
  PID:8812
- C:\Windows\System\cySGQHc.exe
  C:\Windows\System\cySGQHc.exe
  2⤵
  PID:8108
- C:\Windows\System\OODQnTm.exe
  C:\Windows\System\OODQnTm.exe
  2⤵
  PID:6652
- C:\Windows\System\NQlbOER.exe
  C:\Windows\System\NQlbOER.exe
  2⤵
  PID:5652
- C:\Windows\System\ptEwGjE.exe
  C:\Windows\System\ptEwGjE.exe
  2⤵
  PID:6168
- C:\Windows\System\wVEtZmV.exe
  C:\Windows\System\wVEtZmV.exe
  2⤵
  PID:7340
- C:\Windows\System\bXWYiby.exe
  C:\Windows\System\bXWYiby.exe
  2⤵
  PID:1164
- C:\Windows\System\OarBQbP.exe
  C:\Windows\System\OarBQbP.exe
  2⤵
  PID:7548
- C:\Windows\System\ZiSmDGt.exe
  C:\Windows\System\ZiSmDGt.exe
  2⤵
  PID:8276
- C:\Windows\System\NKZRSKu.exe
  C:\Windows\System\NKZRSKu.exe
  2⤵
  PID:8400
- C:\Windows\System\HNbEYzG.exe
  C:\Windows\System\HNbEYzG.exe
  2⤵
  PID:8588
- C:\Windows\System\gVtyqEP.exe
  C:\Windows\System\gVtyqEP.exe
  2⤵
  PID:8476
- C:\Windows\System\mkwiDUi.exe
  C:\Windows\System\mkwiDUi.exe
  2⤵
  PID:8804
- C:\Windows\System\bvtJVwr.exe
  C:\Windows\System\bvtJVwr.exe
  2⤵
  PID:7364
- C:\Windows\System\ZFWIwnl.exe
  C:\Windows\System\ZFWIwnl.exe
  2⤵
  PID:7836
- C:\Windows\System\UjLsUAt.exe
  C:\Windows\System\UjLsUAt.exe
  2⤵
  PID:7956
- C:\Windows\System\llRXGpO.exe
  C:\Windows\System\llRXGpO.exe
  2⤵
  PID:9196
- C:\Windows\System\NLsFgYg.exe
  C:\Windows\System\NLsFgYg.exe
  2⤵
  PID:9172
- C:\Windows\System\zUCdJyX.exe
  C:\Windows\System\zUCdJyX.exe
  2⤵
  PID:8160
- C:\Windows\System\TXJyvbw.exe
  C:\Windows\System\TXJyvbw.exe
  2⤵
  PID:7316
- C:\Windows\System\mCPSEXJ.exe
  C:\Windows\System\mCPSEXJ.exe
  2⤵
  PID:7400
- C:\Windows\System\UtIzDGC.exe
  C:\Windows\System\UtIzDGC.exe
  2⤵
  PID:7460
- C:\Windows\System\arIsbgl.exe
  C:\Windows\System\arIsbgl.exe
  2⤵
  PID:3992
- C:\Windows\System\uzldfLK.exe
  C:\Windows\System\uzldfLK.exe
  2⤵
  PID:7092
- C:\Windows\System\ccWnlGs.exe
  C:\Windows\System\ccWnlGs.exe
  2⤵
  PID:7900
- C:\Windows\System\IUFneac.exe
  C:\Windows\System\IUFneac.exe
  2⤵
  PID:8084
- C:\Windows\System\rhTpuSb.exe
  C:\Windows\System\rhTpuSb.exe
  2⤵
  PID:4492
- C:\Windows\System\byCgMex.exe
  C:\Windows\System\byCgMex.exe
  2⤵
  PID:5160
- C:\Windows\System\MfhAMdl.exe
  C:\Windows\System\MfhAMdl.exe
  2⤵
  PID:8200
- C:\Windows\System\LknBvhe.exe
  C:\Windows\System\LknBvhe.exe
  2⤵
  PID:7664
- C:\Windows\System\RmaIclW.exe
  C:\Windows\System\RmaIclW.exe
  2⤵
  PID:8824
- C:\Windows\System\dshRMMB.exe
  C:\Windows\System\dshRMMB.exe
  2⤵
  PID:8776
- C:\Windows\System\uIkIGfi.exe
  C:\Windows\System\uIkIGfi.exe
  2⤵
  PID:9176
- C:\Windows\System\SMPvqRI.exe
  C:\Windows\System\SMPvqRI.exe
  2⤵
  PID:8212
- C:\Windows\System\AeadQvJ.exe
  C:\Windows\System\AeadQvJ.exe
  2⤵
  PID:7776
- C:\Windows\System\wliUveO.exe
  C:\Windows\System\wliUveO.exe
  2⤵
  PID:2844
- C:\Windows\System\GJUBaIo.exe
  C:\Windows\System\GJUBaIo.exe
  2⤵
  PID:7892
- C:\Windows\System\lmEykFd.exe
  C:\Windows\System\lmEykFd.exe
  2⤵
  PID:7440
- C:\Windows\System\kTnHzto.exe
  C:\Windows\System\kTnHzto.exe
  2⤵
  PID:7716
- C:\Windows\System\VAITzQF.exe
  C:\Windows\System\VAITzQF.exe
  2⤵
  PID:8380
- C:\Windows\System\KseJZoU.exe
  C:\Windows\System\KseJZoU.exe
  2⤵
  PID:9240
- C:\Windows\System\zuUcjSj.exe
  C:\Windows\System\zuUcjSj.exe
  2⤵
  PID:9256
- C:\Windows\System\jjPdGME.exe
  C:\Windows\System\jjPdGME.exe
  2⤵
  PID:9276
- C:\Windows\System\klvCank.exe
  C:\Windows\System\klvCank.exe
  2⤵
  PID:9296
- C:\Windows\System\qBbSvGM.exe
  C:\Windows\System\qBbSvGM.exe
  2⤵
  PID:9336
- C:\Windows\System\EQAKRLc.exe
  C:\Windows\System\EQAKRLc.exe
  2⤵
  PID:9356
- C:\Windows\System\yrUJtdz.exe
  C:\Windows\System\yrUJtdz.exe
  2⤵
  PID:9380
- C:\Windows\System\npvWeSz.exe
  C:\Windows\System\npvWeSz.exe
  2⤵
  PID:9400
- C:\Windows\System\yyzSNsz.exe
  C:\Windows\System\yyzSNsz.exe
  2⤵
  PID:9416
- C:\Windows\System\xSEZIqR.exe
  C:\Windows\System\xSEZIqR.exe
  2⤵
  PID:9436
- C:\Windows\System\lCjPtHX.exe
  C:\Windows\System\lCjPtHX.exe
  2⤵
  PID:9456
- C:\Windows\System\KbndwsY.exe
  C:\Windows\System\KbndwsY.exe
  2⤵
  PID:9488
- C:\Windows\System\zQSQVCL.exe
  C:\Windows\System\zQSQVCL.exe
  2⤵
  PID:9504
- C:\Windows\System\GZVSMER.exe
  C:\Windows\System\GZVSMER.exe
  2⤵
  PID:9524
- C:\Windows\System\YbXuZhh.exe
  C:\Windows\System\YbXuZhh.exe
  2⤵
  PID:9544
- C:\Windows\System\YDwzAmI.exe
  C:\Windows\System\YDwzAmI.exe
  2⤵
  PID:9564
- C:\Windows\System\OmkVYzX.exe
  C:\Windows\System\OmkVYzX.exe
  2⤵
  PID:9588
- C:\Windows\System\BzAmiFn.exe
  C:\Windows\System\BzAmiFn.exe
  2⤵
  PID:9608
- C:\Windows\System\fhDqVkU.exe
  C:\Windows\System\fhDqVkU.exe
  2⤵
  PID:9628
- C:\Windows\System\rsahdvf.exe
  C:\Windows\System\rsahdvf.exe
  2⤵
  PID:9648
- C:\Windows\System\FRVGhXd.exe
  C:\Windows\System\FRVGhXd.exe
  2⤵
  PID:9680
- C:\Windows\System\lmjwhEf.exe
  C:\Windows\System\lmjwhEf.exe
  2⤵
  PID:9708
- C:\Windows\System\aHSJiIt.exe
  C:\Windows\System\aHSJiIt.exe
  2⤵
  PID:9728
- C:\Windows\System\lhtPPwB.exe
  C:\Windows\System\lhtPPwB.exe
  2⤵
  PID:9752
- C:\Windows\System\xxTCAit.exe
  C:\Windows\System\xxTCAit.exe
  2⤵
  PID:9768
- C:\Windows\System\CHtBjJJ.exe
  C:\Windows\System\CHtBjJJ.exe
  2⤵
  PID:9788
- C:\Windows\System\cqZXTep.exe
  C:\Windows\System\cqZXTep.exe
  2⤵
  PID:9804
- C:\Windows\System\ImPiBfX.exe
  C:\Windows\System\ImPiBfX.exe
  2⤵
  PID:9828
- C:\Windows\System\EPAjVBy.exe
  C:\Windows\System\EPAjVBy.exe
  2⤵
  PID:9848
- C:\Windows\System\nUIApgn.exe
  C:\Windows\System\nUIApgn.exe
  2⤵
  PID:9876
- C:\Windows\System\rvNNdBU.exe
  C:\Windows\System\rvNNdBU.exe
  2⤵
  PID:9892
- C:\Windows\System\erhFSCU.exe
  C:\Windows\System\erhFSCU.exe
  2⤵
  PID:9912
- C:\Windows\System\UWXvlFU.exe
  C:\Windows\System\UWXvlFU.exe
  2⤵
  PID:9932
- C:\Windows\System\agntEsk.exe
  C:\Windows\System\agntEsk.exe
  2⤵
  PID:9968
- C:\Windows\System\GpattUR.exe
  C:\Windows\System\GpattUR.exe
  2⤵
  PID:9992
- C:\Windows\System\yuviZGP.exe
  C:\Windows\System\yuviZGP.exe
  2⤵
  PID:10012
- C:\Windows\System\RlVcWtQ.exe
  C:\Windows\System\RlVcWtQ.exe
  2⤵
  PID:10080
- C:\Windows\System\LKcLjBf.exe
  C:\Windows\System\LKcLjBf.exe
  2⤵
  PID:10208
- C:\Windows\System\vcyaAIu.exe
  C:\Windows\System\vcyaAIu.exe
  2⤵
  PID:10228
- C:\Windows\System\cmMlSUT.exe
  C:\Windows\System\cmMlSUT.exe
  2⤵
  PID:7212
- C:\Windows\System\wUUYQPS.exe
  C:\Windows\System\wUUYQPS.exe
  2⤵
  PID:7984
- C:\Windows\System\UrTkkDO.exe
  C:\Windows\System\UrTkkDO.exe
  2⤵
  PID:7396
- C:\Windows\System\NYCytfu.exe
  C:\Windows\System\NYCytfu.exe
  2⤵
  PID:9288
- C:\Windows\System\wRpjNdE.exe
  C:\Windows\System\wRpjNdE.exe
  2⤵
  PID:7192
- C:\Windows\System\IbVHyru.exe
  C:\Windows\System\IbVHyru.exe
  2⤵
  PID:9452
- C:\Windows\System\EiJugBV.exe
  C:\Windows\System\EiJugBV.exe
  2⤵
  PID:9228
- C:\Windows\System\WGJlbDr.exe
  C:\Windows\System\WGJlbDr.exe
  2⤵
  PID:9316
- C:\Windows\System\gHZWTvx.exe
  C:\Windows\System\gHZWTvx.exe
  2⤵
  PID:1416
- C:\Windows\System\apQrSxV.exe
  C:\Windows\System\apQrSxV.exe
  2⤵
  PID:9724
- C:\Windows\System\IblPlQJ.exe
  C:\Windows\System\IblPlQJ.exe
  2⤵
  PID:9476
- C:\Windows\System\cvwACod.exe
  C:\Windows\System\cvwACod.exe
  2⤵
  PID:9864
- C:\Windows\System\oJakLhc.exe
  C:\Windows\System\oJakLhc.exe
  2⤵
  PID:9688
- C:\Windows\System\IZiEMVO.exe
  C:\Windows\System\IZiEMVO.exe
  2⤵
  PID:9800
- C:\Windows\System\LveRVJC.exe
  C:\Windows\System\LveRVJC.exe
  2⤵
  PID:9840
- C:\Windows\System\hsUaMmH.exe
  C:\Windows\System\hsUaMmH.exe
  2⤵
  PID:9924
- C:\Windows\System\xaAAeaN.exe
  C:\Windows\System\xaAAeaN.exe
  2⤵
  PID:9960
- C:\Windows\System\cZyBEah.exe
  C:\Windows\System\cZyBEah.exe
  2⤵
  PID:10200
- C:\Windows\System\TFUliPP.exe
  C:\Windows\System\TFUliPP.exe
  2⤵
  PID:10252
- C:\Windows\System\JssfYIG.exe
  C:\Windows\System\JssfYIG.exe
  2⤵
  PID:10272
- C:\Windows\System\tCtCCpy.exe
  C:\Windows\System\tCtCCpy.exe
  2⤵
  PID:10288
- C:\Windows\System\tYqCWkF.exe
  C:\Windows\System\tYqCWkF.exe
  2⤵
  PID:10312
- C:\Windows\System\gKejAhT.exe
  C:\Windows\System\gKejAhT.exe
  2⤵
  PID:10328
- C:\Windows\System\jDLIqgp.exe
  C:\Windows\System\jDLIqgp.exe
  2⤵
  PID:10348
- C:\Windows\System\TcDXznw.exe
  C:\Windows\System\TcDXznw.exe
  2⤵
  PID:10424
- C:\Windows\System\sYIOPEF.exe
  C:\Windows\System\sYIOPEF.exe
  2⤵
  PID:10444
- C:\Windows\System\dJReXyd.exe
  C:\Windows\System\dJReXyd.exe
  2⤵
  PID:10468
- C:\Windows\System\lfFkMaX.exe
  C:\Windows\System\lfFkMaX.exe
  2⤵
  PID:10600
- C:\Windows\System\vwYkTQF.exe
  C:\Windows\System\vwYkTQF.exe
  2⤵
  PID:10620
- C:\Windows\System\DJCntWj.exe
  C:\Windows\System\DJCntWj.exe
  2⤵
  PID:10656
- C:\Windows\System\DtwrxPR.exe
  C:\Windows\System\DtwrxPR.exe
  2⤵
  PID:10680
- C:\Windows\System\sYXUEBN.exe
  C:\Windows\System\sYXUEBN.exe
  2⤵
  PID:10700
- C:\Windows\System\TViZdQM.exe
  C:\Windows\System\TViZdQM.exe
  2⤵
  PID:10720
- C:\Windows\System\RPixFBH.exe
  C:\Windows\System\RPixFBH.exe
  2⤵
  PID:10744
- C:\Windows\System\DpMcMpt.exe
  C:\Windows\System\DpMcMpt.exe
  2⤵
  PID:10760
- C:\Windows\System\BloLVck.exe
  C:\Windows\System\BloLVck.exe
  2⤵
  PID:10788
- C:\Windows\System\NhIqGPn.exe
  C:\Windows\System\NhIqGPn.exe
  2⤵
  PID:10808
- C:\Windows\System\RyzGsLn.exe
  C:\Windows\System\RyzGsLn.exe
  2⤵
  PID:10840
- C:\Windows\System\evPmlYU.exe
  C:\Windows\System\evPmlYU.exe
  2⤵
  PID:10856
- C:\Windows\System\ztiMoSd.exe
  C:\Windows\System\ztiMoSd.exe
  2⤵
  PID:10884
- C:\Windows\System\HVoXPhA.exe
  C:\Windows\System\HVoXPhA.exe
  2⤵
  PID:10908
- C:\Windows\System\vyPxJTW.exe
  C:\Windows\System\vyPxJTW.exe
  2⤵
  PID:10924
- C:\Windows\System\uwbgKNo.exe
  C:\Windows\System\uwbgKNo.exe
  2⤵
  PID:10940
- C:\Windows\System\kwXGOVt.exe
  C:\Windows\System\kwXGOVt.exe
  2⤵
  PID:10960
- C:\Windows\System\Kpqvasq.exe
  C:\Windows\System\Kpqvasq.exe
  2⤵
  PID:10984
- C:\Windows\System\rNnWwWY.exe
  C:\Windows\System\rNnWwWY.exe
  2⤵
  PID:11000
- C:\Windows\System\UzywZDv.exe
  C:\Windows\System\UzywZDv.exe
  2⤵
  PID:11028
- C:\Windows\System\bJIVNwK.exe
  C:\Windows\System\bJIVNwK.exe
  2⤵
  PID:11056
- C:\Windows\System\cwynKbF.exe
  C:\Windows\System\cwynKbF.exe
  2⤵
  PID:11072
- C:\Windows\System\QMlaYnR.exe
  C:\Windows\System\QMlaYnR.exe
  2⤵
  PID:11092
- C:\Windows\System\OTPfmwn.exe
  C:\Windows\System\OTPfmwn.exe
  2⤵
  PID:11112
- C:\Windows\System\KcrgFfX.exe
  C:\Windows\System\KcrgFfX.exe
  2⤵
  PID:11128
- C:\Windows\System\MacQceC.exe
  C:\Windows\System\MacQceC.exe
  2⤵
  PID:11152
- C:\Windows\System\jGRNmHm.exe
  C:\Windows\System\jGRNmHm.exe
  2⤵
  PID:11172
- C:\Windows\System\ORJitOY.exe
  C:\Windows\System\ORJitOY.exe
  2⤵
  PID:11196
- C:\Windows\System\AGKyUFC.exe
  C:\Windows\System\AGKyUFC.exe
  2⤵
  PID:11212
- C:\Windows\System\NetACQA.exe
  C:\Windows\System\NetACQA.exe
  2⤵
  PID:11232
- C:\Windows\System\yGiQoOE.exe
  C:\Windows\System\yGiQoOE.exe
  2⤵
  PID:11256
- C:\Windows\System\kZztWyy.exe
  C:\Windows\System\kZztWyy.exe
  2⤵
  PID:10020
- C:\Windows\System\ABiRnEz.exe
  C:\Windows\System\ABiRnEz.exe
  2⤵
  PID:8196
- C:\Windows\System\ePzyshA.exe
  C:\Windows\System\ePzyshA.exe
  2⤵
  PID:9760
- C:\Windows\System\gwksjZt.exe
  C:\Windows\System\gwksjZt.exe
  2⤵
  PID:9784
- C:\Windows\System\UZxTJVF.exe
  C:\Windows\System\UZxTJVF.exe
  2⤵
  PID:10152
- C:\Windows\System\izYAZPU.exe
  C:\Windows\System\izYAZPU.exe
  2⤵
  PID:10184
- C:\Windows\System\wiJZjIf.exe
  C:\Windows\System\wiJZjIf.exe
  2⤵
  PID:10236
- C:\Windows\System\cHGZtGW.exe
  C:\Windows\System\cHGZtGW.exe
  2⤵
  PID:7380
- C:\Windows\System\pykEAAM.exe
  C:\Windows\System\pykEAAM.exe
  2⤵
  PID:60
- C:\Windows\System\kxoWQHs.exe
  C:\Windows\System\kxoWQHs.exe
  2⤵
  PID:9248
- C:\Windows\System\STPNzBR.exe
  C:\Windows\System\STPNzBR.exe
  2⤵
  PID:9620
- C:\Windows\System\qJAzSyJ.exe
  C:\Windows\System\qJAzSyJ.exe
  2⤵
  PID:9520
- C:\Windows\System\IsKkWPG.exe
  C:\Windows\System\IsKkWPG.exe
  2⤵
  PID:9596
- C:\Windows\System\gHCXyoy.exe
  C:\Windows\System\gHCXyoy.exe
  2⤵
  PID:10436
- C:\Windows\System\Vnmxhuy.exe
  C:\Windows\System\Vnmxhuy.exe
  2⤵
  PID:9700
- C:\Windows\System\yNZbodD.exe
  C:\Windows\System\yNZbodD.exe
  2⤵
  PID:2836
- C:\Windows\System\eSUHGPy.exe
  C:\Windows\System\eSUHGPy.exe
  2⤵
  PID:2216
- C:\Windows\System\qvaZAKy.exe
  C:\Windows\System\qvaZAKy.exe
  2⤵
  PID:10248
- C:\Windows\System\UwhcygQ.exe
  C:\Windows\System\UwhcygQ.exe
  2⤵
  PID:10420
- C:\Windows\System\XHQbusP.exe
  C:\Windows\System\XHQbusP.exe
  2⤵
  PID:10608
- C:\Windows\System\kCVMsEQ.exe
  C:\Windows\System\kCVMsEQ.exe
  2⤵
  PID:10676
- C:\Windows\System\wQdTglE.exe
  C:\Windows\System\wQdTglE.exe
  2⤵
  PID:10864
- C:\Windows\System\IuYxibg.exe
  C:\Windows\System\IuYxibg.exe
  2⤵
  PID:10568
- C:\Windows\System\QervlNd.exe
  C:\Windows\System\QervlNd.exe
  2⤵
  PID:11104
- C:\Windows\System\mIzbBzv.exe
  C:\Windows\System\mIzbBzv.exe
  2⤵
  PID:11164
- C:\Windows\System\tkaYApF.exe
  C:\Windows\System\tkaYApF.exe
  2⤵
  PID:10740
- C:\Windows\System\cCTVtaD.exe
  C:\Windows\System\cCTVtaD.exe
  2⤵
  PID:11208
- C:\Windows\System\jnJUsrZ.exe
  C:\Windows\System\jnJUsrZ.exe
  2⤵
  PID:11244
- C:\Windows\System\ivKqJYD.exe
  C:\Windows\System\ivKqJYD.exe
  2⤵
  PID:10848
- C:\Windows\System\PpBJcIF.exe
  C:\Windows\System\PpBJcIF.exe
  2⤵
  PID:10880
- C:\Windows\System\sNrkNtd.exe
  C:\Windows\System\sNrkNtd.exe
  2⤵
  PID:10932
- C:\Windows\System\hbJEmmP.exe
  C:\Windows\System\hbJEmmP.exe
  2⤵
  PID:10168
- C:\Windows\System\YrVNeoE.exe
  C:\Windows\System\YrVNeoE.exe
  2⤵
  PID:10588
- C:\Windows\System\rAbtvkg.exe
  C:\Windows\System\rAbtvkg.exe
  2⤵
  PID:11068
- C:\Windows\System\UzEKAmu.exe
  C:\Windows\System\UzEKAmu.exe
  2⤵
  PID:11276
- C:\Windows\System\UGMjJWZ.exe
  C:\Windows\System\UGMjJWZ.exe
  2⤵
  PID:11304
- C:\Windows\System\xntaPbd.exe
  C:\Windows\System\xntaPbd.exe
  2⤵
  PID:11596
- C:\Windows\System\AcsMaur.exe
  C:\Windows\System\AcsMaur.exe
  2⤵
  PID:11616
- C:\Windows\System\LGOFPFk.exe
  C:\Windows\System\LGOFPFk.exe
  2⤵
  PID:11644
- C:\Windows\System\OPcYAiw.exe
  C:\Windows\System\OPcYAiw.exe
  2⤵
  PID:11664
- C:\Windows\System\iQDMMma.exe
  C:\Windows\System\iQDMMma.exe
  2⤵
  PID:11684
- C:\Windows\System\JFZiKDG.exe
  C:\Windows\System\JFZiKDG.exe
  2⤵
  PID:11708
- C:\Windows\System\TCwwMnL.exe
  C:\Windows\System\TCwwMnL.exe
  2⤵
  PID:11736
- C:\Windows\System\HZUihQK.exe
  C:\Windows\System\HZUihQK.exe
  2⤵
  PID:11768
- C:\Windows\System\KdDcEIF.exe
  C:\Windows\System\KdDcEIF.exe
  2⤵
  PID:11912
- C:\Windows\System\krgucri.exe
  C:\Windows\System\krgucri.exe
  2⤵
  PID:12092
- C:\Windows\System\OFVUDoj.exe
  C:\Windows\System\OFVUDoj.exe
  2⤵
  PID:12116
- C:\Windows\System\xmiZWXu.exe
  C:\Windows\System\xmiZWXu.exe
  2⤵
  PID:12144
- C:\Windows\System\JYtqKji.exe
  C:\Windows\System\JYtqKji.exe
  2⤵
  PID:12168
- C:\Windows\System\dsPBwYR.exe
  C:\Windows\System\dsPBwYR.exe
  2⤵
  PID:12236
- C:\Windows\System\KNIxfSO.exe
  C:\Windows\System\KNIxfSO.exe
  2⤵
  PID:12260
- C:\Windows\System\DndcsdO.exe
  C:\Windows\System\DndcsdO.exe
  2⤵
  PID:12280
- C:\Windows\System\WhqpHGL.exe
  C:\Windows\System\WhqpHGL.exe
  2⤵
  PID:11084
- C:\Windows\System\vjfVbBI.exe
  C:\Windows\System\vjfVbBI.exe
  2⤵
  PID:9560
- C:\Windows\System\HYgVyWP.exe
  C:\Windows\System\HYgVyWP.exe
  2⤵
  PID:10712
- C:\Windows\System\kuZtjVl.exe
  C:\Windows\System\kuZtjVl.exe
  2⤵
  PID:11180
- C:\Windows\System\kqcyNYx.exe
  C:\Windows\System\kqcyNYx.exe
  2⤵
  PID:10264
- C:\Windows\System\gSNTdvT.exe
  C:\Windows\System\gSNTdvT.exe
  2⤵
  PID:10652
- C:\Windows\System\panDHjS.exe
  C:\Windows\System\panDHjS.exe
  2⤵
  PID:10916
- C:\Windows\System\SmWooEa.exe
  C:\Windows\System\SmWooEa.exe
  2⤵
  PID:10900
- C:\Windows\System\gzTWUDE.exe
  C:\Windows\System\gzTWUDE.exe
  2⤵
  PID:9260
- C:\Windows\System\TMVzeOC.exe
  C:\Windows\System\TMVzeOC.exe
  2⤵
  PID:4592
- C:\Windows\System\EdhgflS.exe
  C:\Windows\System\EdhgflS.exe
  2⤵
  PID:11376
- C:\Windows\System\pQsJtIA.exe
  C:\Windows\System\pQsJtIA.exe
  2⤵
  PID:9408
- C:\Windows\System\VBWRsWJ.exe
  C:\Windows\System\VBWRsWJ.exe
  2⤵
  PID:11204
- C:\Windows\System\mPvTnPE.exe
  C:\Windows\System\mPvTnPE.exe
  2⤵
  PID:9624
- C:\Windows\System\wTCNLVN.exe
  C:\Windows\System\wTCNLVN.exe
  2⤵
  PID:10176
- C:\Windows\System\LfzGqps.exe
  C:\Windows\System\LfzGqps.exe
  2⤵
  PID:10224
- C:\Windows\System\UOpFCAu.exe
  C:\Windows\System\UOpFCAu.exe
  2⤵
  PID:11124
- C:\Windows\System\qRINhDD.exe
  C:\Windows\System\qRINhDD.exe
  2⤵
  PID:9736
- C:\Windows\System\UvASZuy.exe
  C:\Windows\System\UvASZuy.exe
  2⤵
  PID:10188
- C:\Windows\System\WYPnuGz.exe
  C:\Windows\System\WYPnuGz.exe
  2⤵
  PID:11560
- C:\Windows\System\bslHQhK.exe
  C:\Windows\System\bslHQhK.exe
  2⤵
  PID:11144
- C:\Windows\System\RUJgYSc.exe
  C:\Windows\System\RUJgYSc.exe
  2⤵
  PID:10768
- C:\Windows\System\yXEjcFb.exe
  C:\Windows\System\yXEjcFb.exe
  2⤵
  PID:1040
- C:\Windows\System\PZjUIFD.exe
  C:\Windows\System\PZjUIFD.exe
  2⤵
  PID:10220
- C:\Windows\System\vDnfmrv.exe
  C:\Windows\System\vDnfmrv.exe
  2⤵
  PID:7880
- C:\Windows\System\vUJFxGd.exe
  C:\Windows\System\vUJFxGd.exe
  2⤵
  PID:11292
- C:\Windows\System\uFjeRES.exe
  C:\Windows\System\uFjeRES.exe
  2⤵
  PID:11336
- C:\Windows\System\MARzQaF.exe
  C:\Windows\System\MARzQaF.exe
  2⤵
  PID:11416
- C:\Windows\System\ebZMIHM.exe
  C:\Windows\System\ebZMIHM.exe
  2⤵
  PID:11008
- C:\Windows\System\SQZUPnl.exe
  C:\Windows\System\SQZUPnl.exe
  2⤵
  PID:11920
- C:\Windows\System\RJjcBRx.exe
  C:\Windows\System\RJjcBRx.exe
  2⤵
  PID:11604
- C:\Windows\System\tHKkRSq.exe
  C:\Windows\System\tHKkRSq.exe
  2⤵
  PID:11636
- C:\Windows\System\HrlsRtp.exe
  C:\Windows\System\HrlsRtp.exe
  2⤵
  PID:11720
- C:\Windows\System\oTAdUVq.exe
  C:\Windows\System\oTAdUVq.exe
  2⤵
  PID:12140
- C:\Windows\System\WiwIjkK.exe
  C:\Windows\System\WiwIjkK.exe
  2⤵
  PID:11976
- C:\Windows\System\FVmoitt.exe
  C:\Windows\System\FVmoitt.exe
  2⤵
  PID:6420
- C:\Windows\System\bbpSUPE.exe
  C:\Windows\System\bbpSUPE.exe
  2⤵
  PID:11956
- C:\Windows\System\QBFyDhb.exe
  C:\Windows\System\QBFyDhb.exe
  2⤵
  PID:12156
- C:\Windows\System\wKUHXHN.exe
  C:\Windows\System\wKUHXHN.exe
  2⤵
  PID:12060
- C:\Windows\System\GMNdrBw.exe
  C:\Windows\System\GMNdrBw.exe
  2⤵
  PID:10368
- C:\Windows\System\AVxrVHO.exe
  C:\Windows\System\AVxrVHO.exe
  2⤵
  PID:10876
- C:\Windows\System\tPeuytr.exe
  C:\Windows\System\tPeuytr.exe
  2⤵
  PID:12080
- C:\Windows\System\dfTERmQ.exe
  C:\Windows\System\dfTERmQ.exe
  2⤵
  PID:12084
- C:\Windows\System\KBoVvcO.exe
  C:\Windows\System\KBoVvcO.exe
  2⤵
  PID:12124
- C:\Windows\System\NNjvGSP.exe
  C:\Windows\System\NNjvGSP.exe
  2⤵
  PID:11108
- C:\Windows\System\FeKvcIU.exe
  C:\Windows\System\FeKvcIU.exe
  2⤵
  PID:11412
- C:\Windows\System\KoiQlVj.exe
  C:\Windows\System\KoiQlVj.exe
  2⤵
  PID:12300
- C:\Windows\System\hIsUXVe.exe
  C:\Windows\System\hIsUXVe.exe
  2⤵
  PID:12316
- C:\Windows\System\LGCnuNw.exe
  C:\Windows\System\LGCnuNw.exe
  2⤵
  PID:12332
- C:\Windows\System\NAQcIsq.exe
  C:\Windows\System\NAQcIsq.exe
  2⤵
  PID:12348
- C:\Windows\System\zwbgNdK.exe
  C:\Windows\System\zwbgNdK.exe
  2⤵
  PID:12364
- C:\Windows\System\hSYAztV.exe
  C:\Windows\System\hSYAztV.exe
  2⤵
  PID:12380
- C:\Windows\System\DWlLYIf.exe
  C:\Windows\System\DWlLYIf.exe
  2⤵
  PID:12408
- C:\Windows\System\QuYfxuU.exe
  C:\Windows\System\QuYfxuU.exe
  2⤵
  PID:12428
- C:\Windows\System\heSKRXb.exe
  C:\Windows\System\heSKRXb.exe
  2⤵
  PID:12448
- C:\Windows\System\YpKofcH.exe
  C:\Windows\System\YpKofcH.exe
  2⤵
  PID:12468
- C:\Windows\System\tlLBxug.exe
  C:\Windows\System\tlLBxug.exe
  2⤵
  PID:12492
- C:\Windows\System\GLtNHSs.exe
  C:\Windows\System\GLtNHSs.exe
  2⤵
  PID:12512
- C:\Windows\System\JVHtVmM.exe
  C:\Windows\System\JVHtVmM.exe
  2⤵
  PID:12536
- C:\Windows\System\pBnxfRT.exe
  C:\Windows\System\pBnxfRT.exe
  2⤵
  PID:12556
- C:\Windows\System\BzGEpOJ.exe
  C:\Windows\System\BzGEpOJ.exe
  2⤵
  PID:12580
- C:\Windows\System\WiMlBSr.exe
  C:\Windows\System\WiMlBSr.exe
  2⤵
  PID:12608
- C:\Windows\System\oodTMxv.exe
  C:\Windows\System\oodTMxv.exe
  2⤵
  PID:12624
- C:\Windows\System\sZrDmLu.exe
  C:\Windows\System\sZrDmLu.exe
  2⤵
  PID:12644
- C:\Windows\System\YxWNrTl.exe
  C:\Windows\System\YxWNrTl.exe
  2⤵
  PID:12664
- C:\Windows\System\kAmJBsG.exe
  C:\Windows\System\kAmJBsG.exe
  2⤵
  PID:12684
- C:\Windows\System\ZJvJcwA.exe
  C:\Windows\System\ZJvJcwA.exe
  2⤵
  PID:12700
- C:\Windows\System\mfbhKkx.exe
  C:\Windows\System\mfbhKkx.exe
  2⤵
  PID:12720
- C:\Windows\System\HIHsMlx.exe
  C:\Windows\System\HIHsMlx.exe
  2⤵
  PID:12736
- C:\Windows\System\NZBcOba.exe
  C:\Windows\System\NZBcOba.exe
  2⤵
  PID:12756
- C:\Windows\System\wVlmhyK.exe
  C:\Windows\System\wVlmhyK.exe
  2⤵
  PID:12780
- C:\Windows\System\EMcCAPj.exe
  C:\Windows\System\EMcCAPj.exe
  2⤵
  PID:12796
- C:\Windows\System\yphEQnG.exe
  C:\Windows\System\yphEQnG.exe
  2⤵
  PID:12820
- C:\Windows\System\EBbQMvu.exe
  C:\Windows\System\EBbQMvu.exe
  2⤵
  PID:12844
- C:\Windows\System\HuxftKX.exe
  C:\Windows\System\HuxftKX.exe
  2⤵
  PID:12860
- C:\Windows\System\tWJPTnB.exe
  C:\Windows\System\tWJPTnB.exe
  2⤵
  PID:12884
- C:\Windows\System\WQjCFDR.exe
  C:\Windows\System\WQjCFDR.exe
  2⤵
  PID:12904
- C:\Windows\System\IqUTRBP.exe
  C:\Windows\System\IqUTRBP.exe
  2⤵
  PID:12920
- C:\Windows\System\jSXWNDD.exe
  C:\Windows\System\jSXWNDD.exe
  2⤵
  PID:12944
- C:\Windows\System\RYnnCbK.exe
  C:\Windows\System\RYnnCbK.exe
  2⤵
  PID:12964
- C:\Windows\System\DTXJEqa.exe
  C:\Windows\System\DTXJEqa.exe
  2⤵
  PID:12984
- C:\Windows\System\ARXrQvK.exe
  C:\Windows\System\ARXrQvK.exe
  2⤵
  PID:13004
- C:\Windows\System\DerWcgo.exe
  C:\Windows\System\DerWcgo.exe
  2⤵
  PID:13020
- C:\Windows\System\ChqUrfV.exe
  C:\Windows\System\ChqUrfV.exe
  2⤵
  PID:13040
- C:\Windows\System\jNAbbrq.exe
  C:\Windows\System\jNAbbrq.exe
  2⤵
  PID:13060
- C:\Windows\System\OosAKUO.exe
  C:\Windows\System\OosAKUO.exe
  2⤵
  PID:13076
- C:\Windows\System\gLjtZKx.exe
  C:\Windows\System\gLjtZKx.exe
  2⤵
  PID:13096
- C:\Windows\System\ZdndFpD.exe
  C:\Windows\System\ZdndFpD.exe
  2⤵
  PID:13280
- C:\Windows\System\HBBKfvj.exe
  C:\Windows\System\HBBKfvj.exe
  2⤵
  PID:12872
- C:\Windows\System\PvHtugq.exe
  C:\Windows\System\PvHtugq.exe
  2⤵
  PID:9796
- C:\Windows\System\fzkmLje.exe
  C:\Windows\System\fzkmLje.exe
  2⤵
  PID:13012
- C:\Windows\System\FcdklSj.exe
  C:\Windows\System\FcdklSj.exe
  2⤵
  PID:12104
- C:\Windows\System\lhIlAit.exe
  C:\Windows\System\lhIlAit.exe
  2⤵
  PID:12404
- C:\Windows\System\tpnZfut.exe
  C:\Windows\System\tpnZfut.exe
  2⤵
  PID:13144
- C:\Windows\System\dzvgqCP.exe
  C:\Windows\System\dzvgqCP.exe
  2⤵
  PID:13168
- C:\Windows\System\YPraeRL.exe
  C:\Windows\System\YPraeRL.exe
  2⤵
  PID:13200
- C:\Windows\System\rUdWMkP.exe
  C:\Windows\System\rUdWMkP.exe
  2⤵
  PID:7160
- C:\Windows\System\jZdWaoq.exe
  C:\Windows\System\jZdWaoq.exe
  2⤵
  PID:12976
- C:\Windows\System\msWKwdC.exe
  C:\Windows\System\msWKwdC.exe
  2⤵
  PID:11504
- C:\Windows\System\ooUafMp.exe
  C:\Windows\System\ooUafMp.exe
  2⤵
  PID:13204
- C:\Windows\System\hbrsLBN.exe
  C:\Windows\System\hbrsLBN.exe
  2⤵
  PID:13232
- C:\Windows\System\TplHZrO.exe
  C:\Windows\System\TplHZrO.exe
  2⤵
  PID:4148
- C:\Windows\System\lvHHIgo.exe
  C:\Windows\System\lvHHIgo.exe
  2⤵
  PID:628
- C:\Windows\System\rNCHRwf.exe
  C:\Windows\System\rNCHRwf.exe
  2⤵
  PID:12464
- C:\Windows\System\YbrqtfJ.exe
  C:\Windows\System\YbrqtfJ.exe
  2⤵
  PID:13288
- C:\Windows\System\EvDTaUo.exe
  C:\Windows\System\EvDTaUo.exe
  2⤵
  PID:9940
- C:\Windows\System\IyfrUfD.exe
  C:\Windows\System\IyfrUfD.exe
  2⤵
  PID:12752
- C:\Windows\System\jXmzpOY.exe
  C:\Windows\System\jXmzpOY.exe
  2⤵
  PID:13304
- C:\Windows\System\oPxsVwD.exe
  C:\Windows\System\oPxsVwD.exe
  2⤵
  PID:12604
- C:\Windows\System\ragRHEv.exe
  C:\Windows\System\ragRHEv.exe
  2⤵
  PID:12504
- C:\Windows\System\hdaylyH.exe
  C:\Windows\System\hdaylyH.exe
  2⤵
  PID:11536
- C:\Windows\System\vuNxddI.exe
  C:\Windows\System\vuNxddI.exe
  2⤵
  PID:10536
- C:\Windows\System\TrHvjvZ.exe
  C:\Windows\System\TrHvjvZ.exe
  2⤵
  PID:12340
- C:\Windows\System\oiIYfax.exe
  C:\Windows\System\oiIYfax.exe
  2⤵
  PID:2676
- C:\Windows\System\YoUzudx.exe
  C:\Windows\System\YoUzudx.exe
  2⤵
  PID:13164
- C:\Windows\System\WCzbHFP.exe
  C:\Windows\System\WCzbHFP.exe
  2⤵
  PID:12356
- C:\Windows\System\gTxEtpc.exe
  C:\Windows\System\gTxEtpc.exe
  2⤵
  PID:12484
- C:\Windows\System\nYGsWJF.exe
  C:\Windows\System\nYGsWJF.exe
  2⤵
  PID:11052
- C:\Windows\System\ZMgQjqk.exe
  C:\Windows\System\ZMgQjqk.exe
  2⤵
  PID:10380
- C:\Windows\System\bFAXhSS.exe
  C:\Windows\System\bFAXhSS.exe
  2⤵
  PID:260
- C:\Windows\System\bdRmazy.exe
  C:\Windows\System\bdRmazy.exe
  2⤵
  PID:4724
- C:\Windows\System\qKtiFYa.exe
  C:\Windows\System\qKtiFYa.exe
  2⤵
  PID:13180
- C:\Windows\System\XlASUgT.exe
  C:\Windows\System\XlASUgT.exe
  2⤵
  PID:12732
- C:\Windows\System\hIdvnfu.exe
  C:\Windows\System\hIdvnfu.exe
  2⤵
  PID:4204
- C:\Windows\System\pigEpfA.exe
  C:\Windows\System\pigEpfA.exe
  2⤵
  PID:2044
- C:\Windows\System\jpGTKLN.exe
  C:\Windows\System\jpGTKLN.exe
  2⤵
  PID:3560
- C:\Windows\System\UrTqeNN.exe
  C:\Windows\System\UrTqeNN.exe
  2⤵
  PID:3224
- C:\Windows\System\ADdRqra.exe
  C:\Windows\System\ADdRqra.exe
  2⤵
  PID:732
- C:\Windows\System\pSEKXZm.exe
  C:\Windows\System\pSEKXZm.exe
  2⤵
  PID:4100
- C:\Windows\System\UiebjMk.exe
  C:\Windows\System\UiebjMk.exe
  2⤵
  PID:2208
- C:\Windows\System\jJZRnEh.exe
  C:\Windows\System\jJZRnEh.exe
  2⤵
  PID:4856
- C:\Windows\System\QFSQFCF.exe
  C:\Windows\System\QFSQFCF.exe
  2⤵
  PID:13000
- C:\Windows\System\oezSIRq.exe
  C:\Windows\System\oezSIRq.exe
  2⤵
  PID:1256
- C:\Windows\System\kpnQaGF.exe
  C:\Windows\System\kpnQaGF.exe
  2⤵
  PID:12956
- C:\Windows\System\hKbfGlg.exe
  C:\Windows\System\hKbfGlg.exe
  2⤵
  PID:1648
- C:\Windows\System\fVsFics.exe
  C:\Windows\System\fVsFics.exe
  2⤵
  PID:3312
- C:\Windows\System\GWxPfWs.exe
  C:\Windows\System\GWxPfWs.exe
  2⤵
  PID:2136
- C:\Windows\System\ISnRhKM.exe
  C:\Windows\System\ISnRhKM.exe
  2⤵
  PID:13328
- C:\Windows\System\xtVDaLd.exe
  C:\Windows\System\xtVDaLd.exe
  2⤵
  PID:13344
- C:\Windows\System\LCgiBHO.exe
  C:\Windows\System\LCgiBHO.exe
  2⤵
  PID:13360
- C:\Windows\System\MVJXRER.exe
  C:\Windows\System\MVJXRER.exe
  2⤵
  PID:13380
- C:\Windows\System\tYbYFDY.exe
  C:\Windows\System\tYbYFDY.exe
  2⤵
  PID:13400
- C:\Windows\System\dzagbeF.exe
  C:\Windows\System\dzagbeF.exe
  2⤵
  PID:13420
- C:\Windows\System\hpJbNrW.exe
  C:\Windows\System\hpJbNrW.exe
  2⤵
  PID:13444
- C:\Windows\System\XoMaJpQ.exe
  C:\Windows\System\XoMaJpQ.exe
  2⤵
  PID:13460
- C:\Windows\System\KehZMfW.exe
  C:\Windows\System\KehZMfW.exe
  2⤵
  PID:13476
- C:\Windows\System\zzoMPjE.exe
  C:\Windows\System\zzoMPjE.exe
  2⤵
  PID:13492
- C:\Windows\System\VvZOFPs.exe
  C:\Windows\System\VvZOFPs.exe
  2⤵
  PID:13528
- C:\Windows\System\wYyKERf.exe
  C:\Windows\System\wYyKERf.exe
  2⤵
  PID:13544
- C:\Windows\System\yUxIxxG.exe
  C:\Windows\System\yUxIxxG.exe
  2⤵
  PID:13568
- C:\Windows\System\Folxcpz.exe
  C:\Windows\System\Folxcpz.exe
  2⤵
  PID:13584
- C:\Windows\System\arcvUmI.exe
  C:\Windows\System\arcvUmI.exe
  2⤵
  PID:13600
- C:\Windows\System\PVxmdol.exe
  C:\Windows\System\PVxmdol.exe
  2⤵
  PID:13620
- C:\Windows\System\IaAhKCR.exe
  C:\Windows\System\IaAhKCR.exe
  2⤵
  PID:13660
- C:\Windows\System\sXPLVlI.exe
  C:\Windows\System\sXPLVlI.exe
  2⤵
  PID:13676
- C:\Windows\System\PxhZIgY.exe
  C:\Windows\System\PxhZIgY.exe
  2⤵
  PID:13692
- C:\Windows\System\uBaPJHK.exe
  C:\Windows\System\uBaPJHK.exe
  2⤵
  PID:13708
- C:\Windows\System\DvgqECe.exe
  C:\Windows\System\DvgqECe.exe
  2⤵
  PID:13724
- C:\Windows\System\FyScqUJ.exe
  C:\Windows\System\FyScqUJ.exe
  2⤵
  PID:13972
- C:\Windows\System\gCvtXzT.exe
  C:\Windows\System\gCvtXzT.exe
  2⤵
  PID:14128
- C:\Windows\System\GMrafai.exe
  C:\Windows\System\GMrafai.exe
  2⤵
  PID:14164
- C:\Windows\System\IobGVCT.exe
  C:\Windows\System\IobGVCT.exe
  2⤵
  PID:14332
- C:\Windows\System\kAeoYkU.exe
  C:\Windows\System\kAeoYkU.exe
  2⤵
  PID:3844
- C:\Windows\System\TaLiCwb.exe
  C:\Windows\System\TaLiCwb.exe
  2⤵
  PID:4688
- C:\Windows\System\HCJMYOo.exe
  C:\Windows\System\HCJMYOo.exe
  2⤵
  PID:3260
- C:\Windows\System\wEXEvtm.exe
  C:\Windows\System\wEXEvtm.exe
  2⤵
  PID:13068
- C:\Windows\System\jQnMmWz.exe
  C:\Windows\System\jQnMmWz.exe
  2⤵
  PID:13376
- C:\Windows\System\REBjfuq.exe
  C:\Windows\System\REBjfuq.exe
  2⤵
  PID:4956
- C:\Windows\System\aHvpOWI.exe
  C:\Windows\System\aHvpOWI.exe
  2⤵
  PID:13456
- C:\Windows\System\aHYRcKI.exe
  C:\Windows\System\aHYRcKI.exe
  2⤵
  PID:13488
- C:\Windows\System\seuHdzE.exe
  C:\Windows\System\seuHdzE.exe
  2⤵
  PID:13520
- C:\Windows\System\SrdddDF.exe
  C:\Windows\System\SrdddDF.exe
  2⤵
  PID:4976
- C:\Windows\System\QuFeuVG.exe
  C:\Windows\System\QuFeuVG.exe
  2⤵
  PID:4364
- C:\Windows\System\czvKNfg.exe
  C:\Windows\System\czvKNfg.exe
  2⤵
  PID:13700
- C:\Windows\System\upYXgiB.exe
  C:\Windows\System\upYXgiB.exe
  2⤵
  PID:13352
- C:\Windows\System\FPvwqTj.exe
  C:\Windows\System\FPvwqTj.exe
  2⤵
  PID:12440
- C:\Windows\System\SbPLApk.exe
  C:\Windows\System\SbPLApk.exe
  2⤵
  PID:1688
- C:\Windows\System\ZCgYZEI.exe
  C:\Windows\System\ZCgYZEI.exe
  2⤵
  PID:2416
- C:\Windows\System\rWFaiZA.exe
  C:\Windows\System\rWFaiZA.exe
  2⤵
  PID:13628
- C:\Windows\System\dCOfJQR.exe
  C:\Windows\System\dCOfJQR.exe
  2⤵
  PID:14088
- C:\Windows\System\SxkNOVf.exe
  C:\Windows\System\SxkNOVf.exe
  2⤵
  PID:14188
- C:\Windows\System\fCvGvlT.exe
  C:\Windows\System\fCvGvlT.exe
  2⤵
  PID:14224
- C:\Windows\System\dHtuefo.exe
  C:\Windows\System\dHtuefo.exe
  2⤵
  PID:14240
- C:\Windows\System\PkNtRqE.exe
  C:\Windows\System\PkNtRqE.exe
  2⤵
  PID:1104
- C:\Windows\System\YsLuLND.exe
  C:\Windows\System\YsLuLND.exe
  2⤵
  PID:14316
- C:\Windows\System\LIzdcjS.exe
  C:\Windows\System\LIzdcjS.exe
  2⤵
  PID:2140
- C:\Windows\System\SxcZyHL.exe
  C:\Windows\System\SxcZyHL.exe
  2⤵
  PID:12524
- C:\Windows\System\TqnWQHO.exe
  C:\Windows\System\TqnWQHO.exe
  2⤵
  PID:4332
- C:\Windows\System\pwWzAub.exe
  C:\Windows\System\pwWzAub.exe
  2⤵
  PID:13392
- C:\Windows\System\RIddnqb.exe
  C:\Windows\System\RIddnqb.exe
  2⤵
  PID:13644
- C:\Windows\System\xFvFKWn.exe
  C:\Windows\System\xFvFKWn.exe
  2⤵
  PID:4052
- C:\Windows\System\hBlurAo.exe
  C:\Windows\System\hBlurAo.exe
  2⤵
  PID:2908
- C:\Windows\System\bermUas.exe
  C:\Windows\System\bermUas.exe
  2⤵
  PID:13812
- C:\Windows\System\HpyOwhO.exe
  C:\Windows\System\HpyOwhO.exe
  2⤵
  PID:1156
- C:\Windows\System\XoOfzev.exe
  C:\Windows\System\XoOfzev.exe
  2⤵
  PID:3680
- C:\Windows\System\xFSpeYA.exe
  C:\Windows\System\xFSpeYA.exe
  2⤵
  PID:3656
- C:\Windows\System\jKylNSg.exe
  C:\Windows\System\jKylNSg.exe
  2⤵
  PID:4568
- C:\Windows\System\uylmeCu.exe
  C:\Windows\System\uylmeCu.exe
  2⤵
  PID:12852
- C:\Windows\System\azMhSGv.exe
  C:\Windows\System\azMhSGv.exe
  2⤵
  PID:4772
- C:\Windows\System\ytiHZtQ.exe
  C:\Windows\System\ytiHZtQ.exe
  2⤵
  PID:13596
- C:\Windows\System\VHOiGWN.exe
  C:\Windows\System\VHOiGWN.exe
  2⤵
  PID:6092
- C:\Windows\System\PmHhMda.exe
  C:\Windows\System\PmHhMda.exe
  2⤵
  PID:1396
- C:\Windows\System\zLclSyy.exe
  C:\Windows\System\zLclSyy.exe
  2⤵
  PID:13500
- C:\Windows\System\FOAqGXX.exe
  C:\Windows\System\FOAqGXX.exe
  2⤵
  PID:2112
- C:\Windows\System\SxQDHWj.exe
  C:\Windows\System\SxQDHWj.exe
  2⤵
  PID:5428
- C:\Windows\System\BBwYmpz.exe
  C:\Windows\System\BBwYmpz.exe
  2⤵
  PID:2788
- C:\Windows\System\plVPMuP.exe
  C:\Windows\System\plVPMuP.exe
  2⤵
  PID:13776
- C:\Windows\System\SprrhKs.exe
  C:\Windows\System\SprrhKs.exe
  2⤵
  PID:13992
- C:\Windows\System\WsvrREN.exe
  C:\Windows\System\WsvrREN.exe
  2⤵
  PID:1220
- C:\Windows\System\SknfMtL.exe
  C:\Windows\System\SknfMtL.exe
  2⤵
  PID:13772
- C:\Windows\System\mmAtNmU.exe
  C:\Windows\System\mmAtNmU.exe
  2⤵
  PID:14252
- C:\Windows\System\voitsuA.exe
  C:\Windows\System\voitsuA.exe
  2⤵
  PID:5224
- C:\Windows\System\EmJvDZI.exe
  C:\Windows\System\EmJvDZI.exe
  2⤵
  PID:13896
- C:\Windows\System\DjGsezR.exe
  C:\Windows\System\DjGsezR.exe
  2⤵
  PID:13988
- C:\Windows\System\xVinhSo.exe
  C:\Windows\System\xVinhSo.exe
  2⤵
  PID:13656
- C:\Windows\System\LfXVqun.exe
  C:\Windows\System\LfXVqun.exe
  2⤵
  PID:376
- C:\Windows\System\DYtXdPR.exe
  C:\Windows\System\DYtXdPR.exe
  2⤵
  PID:13932
- C:\Windows\System\sYHmhIa.exe
  C:\Windows\System\sYHmhIa.exe
  2⤵
  PID:5920
- C:\Windows\System\EJWJaue.exe
  C:\Windows\System\EJWJaue.exe
  2⤵
  PID:5724
- C:\Windows\System\AjuTlGK.exe
  C:\Windows\System\AjuTlGK.exe
  2⤵
  PID:14100
- C:\Windows\System\CWQZvrm.exe
  C:\Windows\System\CWQZvrm.exe
  2⤵
  PID:712
- C:\Windows\System\SZQZxMY.exe
  C:\Windows\System\SZQZxMY.exe
  2⤵
  PID:3504
- C:\Windows\System\wadOIJa.exe
  C:\Windows\System\wadOIJa.exe
  2⤵
  PID:6812
- C:\Windows\System\tEtAnfZ.exe
  C:\Windows\System\tEtAnfZ.exe
  2⤵
  PID:5520
- C:\Windows\System\GEyCRjR.exe
  C:\Windows\System\GEyCRjR.exe
  2⤵
  PID:5512
- C:\Windows\System\cQBXxNl.exe
  C:\Windows\System\cQBXxNl.exe
  2⤵
  PID:5516
- C:\Windows\System\MeUUmlG.exe
  C:\Windows\System\MeUUmlG.exe
  2⤵
  PID:5536
- C:\Windows\System\IqHprfU.exe
  C:\Windows\System\IqHprfU.exe
  2⤵
  PID:5316
- C:\Windows\System\IWgzKer.exe
  C:\Windows\System\IWgzKer.exe
  2⤵
  PID:13416
- C:\Windows\System\ViLWHNA.exe
  C:\Windows\System\ViLWHNA.exe
  2⤵
  PID:2548
- C:\Windows\System\LLNtvgd.exe
  C:\Windows\System\LLNtvgd.exe
  2⤵
  PID:5756
- C:\Windows\System\eyWBPih.exe
  C:\Windows\System\eyWBPih.exe
  2⤵
  PID:14044
- C:\Windows\System\qdJaBsO.exe
  C:\Windows\System\qdJaBsO.exe
  2⤵
  PID:404
- C:\Windows\System\shTyJmb.exe
  C:\Windows\System\shTyJmb.exe
  2⤵
  PID:13156
- C:\Windows\System\pEYntkx.exe
  C:\Windows\System\pEYntkx.exe
  2⤵
  PID:13372
- C:\Windows\System\Jarqdmd.exe
  C:\Windows\System\Jarqdmd.exe
  2⤵
  PID:13608
- C:\Windows\System\uRvCgMR.exe
  C:\Windows\System\uRvCgMR.exe
  2⤵
  PID:3368
- C:\Windows\System\gyXCjCt.exe
  C:\Windows\System\gyXCjCt.exe
  2⤵
  PID:5956
- C:\Windows\System\HaFVSrp.exe
  C:\Windows\System\HaFVSrp.exe
  2⤵
  PID:13952
- C:\Windows\System\jqpJghx.exe
  C:\Windows\System\jqpJghx.exe
  2⤵
  PID:14232
- C:\Windows\System\CKcYXnA.exe
  C:\Windows\System\CKcYXnA.exe
  2⤵
  PID:13272
- C:\Windows\System\kIpceWa.exe
  C:\Windows\System\kIpceWa.exe
  2⤵
  PID:5588
- C:\Windows\System\UsDmUWR.exe
  C:\Windows\System\UsDmUWR.exe
  2⤵
  PID:4124
- C:\Windows\System\veUxwAU.exe
  C:\Windows\System\veUxwAU.exe
  2⤵
  PID:2480
- C:\Windows\System\AaqaICd.exe
  C:\Windows\System\AaqaICd.exe
  2⤵
  PID:13884
- C:\Windows\System\MWLWqfV.exe
  C:\Windows\System\MWLWqfV.exe
  2⤵
  PID:5932
- C:\Windows\System\qkSooNm.exe
  C:\Windows\System\qkSooNm.exe
  2⤵
  PID:5508
- C:\Windows\System\KxXFpya.exe
  C:\Windows\System\KxXFpya.exe
  2⤵
  PID:6492
- C:\Windows\System\raOeCjs.exe
  C:\Windows\System\raOeCjs.exe
  2⤵
  PID:4620
- C:\Windows\System\JitdQsS.exe
  C:\Windows\System\JitdQsS.exe
  2⤵
  PID:6108
- C:\Windows\System\vzDuIFs.exe
  C:\Windows\System\vzDuIFs.exe
  2⤵
  PID:5232
- C:\Windows\System\zPAngxn.exe
  C:\Windows\System\zPAngxn.exe
  2⤵
  PID:12652
- C:\Windows\System\ECNcZJW.exe
  C:\Windows\System\ECNcZJW.exe
  2⤵
  PID:14328
- C:\Windows\System\dbFDREE.exe
  C:\Windows\System\dbFDREE.exe
  2⤵
  PID:12936
- C:\Windows\System\rGtYbKE.exe
  C:\Windows\System\rGtYbKE.exe
  2⤵
  PID:1100
- C:\Windows\System\SRSoIhF.exe
  C:\Windows\System\SRSoIhF.exe
  2⤵
  PID:13052
- C:\Windows\System\uhgyLuk.exe
  C:\Windows\System\uhgyLuk.exe
  2⤵
  PID:1596
- C:\Windows\System\mBIVPtX.exe
  C:\Windows\System\mBIVPtX.exe
  2⤵
  PID:6436
- C:\Windows\System\wJPOQvI.exe
  C:\Windows\System\wJPOQvI.exe
  2⤵
  PID:6240
- C:\Windows\System\kszsxyQ.exe
  C:\Windows\System\kszsxyQ.exe
  2⤵
  PID:3896
- C:\Windows\System\hvWHKDi.exe
  C:\Windows\System\hvWHKDi.exe
  2⤵
  PID:6160
- C:\Windows\System\OLvCCJF.exe
  C:\Windows\System\OLvCCJF.exe
  2⤵
  PID:6432
- C:\Windows\System\iTmDRfX.exe
  C:\Windows\System\iTmDRfX.exe
  2⤵
  PID:6704
- C:\Windows\System\VHiFHei.exe
  C:\Windows\System\VHiFHei.exe
  2⤵
  PID:12812
- C:\Windows\System\LHWteOP.exe
  C:\Windows\System\LHWteOP.exe
  2⤵
  PID:12692
- C:\Windows\System\UDZhciA.exe
  C:\Windows\System\UDZhciA.exe
  2⤵
  PID:9676
- C:\Windows\System\HlZbReu.exe
  C:\Windows\System\HlZbReu.exe
  2⤵
  PID:13244
- C:\Windows\System\RrMlNXn.exe
  C:\Windows\System\RrMlNXn.exe
  2⤵
  PID:7420
- C:\Windows\System\CjHbSmF.exe
  C:\Windows\System\CjHbSmF.exe
  2⤵
  PID:7020
- C:\Windows\System\SZvMdhJ.exe
  C:\Windows\System\SZvMdhJ.exe
  2⤵
  PID:4088
- C:\Windows\System\DauNGoB.exe
  C:\Windows\System\DauNGoB.exe
  2⤵
  PID:5448
- C:\Windows\System\FEKAFwf.exe
  C:\Windows\System\FEKAFwf.exe
  2⤵
  PID:7964
- C:\Windows\System\cetcjfP.exe
  C:\Windows\System\cetcjfP.exe
  2⤵
  PID:8104
- C:\Windows\System\jbzZofL.exe
  C:\Windows\System\jbzZofL.exe
  2⤵
  PID:8080
- C:\Windows\System\LDzOpaz.exe
  C:\Windows\System\LDzOpaz.exe
  2⤵
  PID:8016
- C:\Windows\System\nColnaf.exe
  C:\Windows\System\nColnaf.exe
  2⤵
  PID:7624
- C:\Windows\System\HVwZeUj.exe
  C:\Windows\System\HVwZeUj.exe
  2⤵
  PID:8152
- C:\Windows\System\RHKdmaE.exe
  C:\Windows\System\RHKdmaE.exe
  2⤵
  PID:3316
- C:\Windows\System\OyhHPjE.exe
  C:\Windows\System\OyhHPjE.exe
  2⤵
  PID:7188
- C:\Windows\System\YfGlAOc.exe
  C:\Windows\System\YfGlAOc.exe
  2⤵
  PID:4092
- C:\Windows\System\rfwAxcr.exe
  C:\Windows\System\rfwAxcr.exe
  2⤵
  PID:14280
- C:\Windows\System\xvXnopc.exe
  C:\Windows\System\xvXnopc.exe
  2⤵
  PID:13688
- C:\Windows\System\sygftcZ.exe
  C:\Windows\System\sygftcZ.exe
  2⤵
  PID:6184
- C:\Windows\System\nknYPXA.exe
  C:\Windows\System\nknYPXA.exe
  2⤵
  PID:6008
- C:\Windows\System\SXoKSNc.exe
  C:\Windows\System\SXoKSNc.exe
  2⤵
  PID:5616
- C:\Windows\System\THjImjH.exe
  C:\Windows\System\THjImjH.exe
  2⤵
  PID:5528
- C:\Windows\System\ddwNOxN.exe
  C:\Windows\System\ddwNOxN.exe
  2⤵
  PID:5208
- C:\Windows\System\ErOxuxL.exe
  C:\Windows\System\ErOxuxL.exe
  2⤵
  PID:5564
- C:\Windows\System\PXqprzf.exe
  C:\Windows\System\PXqprzf.exe
  2⤵
  PID:4576
- C:\Windows\System\NiaQUSw.exe
  C:\Windows\System\NiaQUSw.exe
  2⤵
  PID:8168
- C:\Windows\System\cEqLvAw.exe
  C:\Windows\System\cEqLvAw.exe
  2⤵
  PID:6844
- C:\Windows\System\iMLzomD.exe
  C:\Windows\System\iMLzomD.exe
  2⤵
  PID:456
- C:\Windows\System\AJHingq.exe
  C:\Windows\System\AJHingq.exe
  2⤵
  PID:4916
- C:\Windows\System\LZMmWRG.exe
  C:\Windows\System\LZMmWRG.exe
  2⤵
  PID:8764
- C:\Windows\System\kvKiLDd.exe
  C:\Windows\System\kvKiLDd.exe
  2⤵
  PID:3852
- C:\Windows\System\RvTbaMI.exe
  C:\Windows\System\RvTbaMI.exe
  2⤵
  PID:8224
- C:\Windows\System\oirnHSA.exe
  C:\Windows\System\oirnHSA.exe
  2⤵
  PID:13336
- C:\Windows\System\sirtSZC.exe
  C:\Windows\System\sirtSZC.exe
  2⤵
  PID:6728
- C:\Windows\System\rFfmoiH.exe
  C:\Windows\System\rFfmoiH.exe
  2⤵
  PID:6372
- C:\Windows\System\lHlsecl.exe
  C:\Windows\System\lHlsecl.exe
  2⤵
  PID:12248
- C:\Windows\System\JSyRlgz.exe
  C:\Windows\System\JSyRlgz.exe
  2⤵
  PID:6012
- C:\Windows\System\HatVNOM.exe
  C:\Windows\System\HatVNOM.exe
  2⤵
  PID:5804
- C:\Windows\System\pFcnGhh.exe
  C:\Windows\System\pFcnGhh.exe
  2⤵
  PID:7632
- C:\Windows\System\yvyigiM.exe
  C:\Windows\System\yvyigiM.exe
  2⤵
  PID:8412
- C:\Windows\System\GtDPKGb.exe
  C:\Windows\System\GtDPKGb.exe
  2⤵
  PID:13828
- C:\Windows\System\OhKxIBx.exe
  C:\Windows\System\OhKxIBx.exe
  2⤵
  PID:7896
- C:\Windows\System\oURUNGi.exe
  C:\Windows\System\oURUNGi.exe
  2⤵
  PID:7320
- C:\Windows\System\VvpDiXz.exe
  C:\Windows\System\VvpDiXz.exe
  2⤵
  PID:14348
- C:\Windows\System\OiivlIv.exe
  C:\Windows\System\OiivlIv.exe
  2⤵
  PID:14376
- C:\Windows\System\THZNwAC.exe
  C:\Windows\System\THZNwAC.exe
  2⤵
  PID:14392
- C:\Windows\System\WQDcQyO.exe
  C:\Windows\System\WQDcQyO.exe
  2⤵
  PID:14416
- C:\Windows\System\hgcECSC.exe
  C:\Windows\System\hgcECSC.exe
  2⤵
  PID:14444
- C:\Windows\System\lirontt.exe
  C:\Windows\System\lirontt.exe
  2⤵
  PID:14480
- C:\Windows\System\XqvXVci.exe
  C:\Windows\System\XqvXVci.exe
  2⤵
  PID:14896
- C:\Windows\System\pTSVOmE.exe
  C:\Windows\System\pTSVOmE.exe
  2⤵
  PID:14916
- C:\Windows\System\dXNPNmb.exe
  C:\Windows\System\dXNPNmb.exe
  2⤵
  PID:14936
- C:\Windows\System\FOvEKnK.exe
  C:\Windows\System\FOvEKnK.exe
  2⤵
  PID:14960
- C:\Windows\System\OuCdnaf.exe
  C:\Windows\System\OuCdnaf.exe
  2⤵
  PID:14976
- C:\Windows\System\rvzKIgR.exe
  C:\Windows\System\rvzKIgR.exe
  2⤵
  PID:14992
- C:\Windows\System\vbxqJby.exe
  C:\Windows\System\vbxqJby.exe
  2⤵
  PID:15008
- C:\Windows\System\qeXGQzy.exe
  C:\Windows\System\qeXGQzy.exe
  2⤵
  PID:15024
- C:\Windows\System\KqyhjjD.exe
  C:\Windows\System\KqyhjjD.exe
  2⤵
  PID:15040
- C:\Windows\System\TRPsWgh.exe
  C:\Windows\System\TRPsWgh.exe
  2⤵
  PID:15056
- C:\Windows\System\TCpyXLQ.exe
  C:\Windows\System\TCpyXLQ.exe
  2⤵
  PID:15072
- C:\Windows\System\zPTIaKp.exe
  C:\Windows\System\zPTIaKp.exe
  2⤵
  PID:15088
- C:\Windows\System\qUXKUqP.exe
  C:\Windows\System\qUXKUqP.exe
  2⤵
  PID:15104
- C:\Windows\System\eTDeEZy.exe
  C:\Windows\System\eTDeEZy.exe
  2⤵
  PID:15120
- C:\Windows\System\CMxhUAC.exe
  C:\Windows\System\CMxhUAC.exe
  2⤵
  PID:15136
- C:\Windows\System\cIjcpvG.exe
  C:\Windows\System\cIjcpvG.exe
  2⤵
  PID:15152
- C:\Windows\System\tpuEaJn.exe
  C:\Windows\System\tpuEaJn.exe
  2⤵
  PID:15168
- C:\Windows\System\qNNtsDi.exe
  C:\Windows\System\qNNtsDi.exe
  2⤵
  PID:15184
- C:\Windows\System\KXMpaxM.exe
  C:\Windows\System\KXMpaxM.exe
  2⤵
  PID:15200
- C:\Windows\System\PYNiSRY.exe
  C:\Windows\System\PYNiSRY.exe
  2⤵
  PID:15216
- C:\Windows\System\ysLyYQV.exe
  C:\Windows\System\ysLyYQV.exe
  2⤵
  PID:15232
- C:\Windows\System\dzaLmYu.exe
  C:\Windows\System\dzaLmYu.exe
  2⤵
  PID:15248
- C:\Windows\System\jrWfJQE.exe
  C:\Windows\System\jrWfJQE.exe
  2⤵
  PID:15264
- C:\Windows\System\SInAQoD.exe
  C:\Windows\System\SInAQoD.exe
  2⤵
  PID:15280
- C:\Windows\System\TYSUPAy.exe
  C:\Windows\System\TYSUPAy.exe
  2⤵
  PID:15300
- C:\Windows\System\EPmrjnm.exe
  C:\Windows\System\EPmrjnm.exe
  2⤵
  PID:15320
- C:\Windows\System\HbDCNmP.exe
  C:\Windows\System\HbDCNmP.exe
  2⤵
  PID:15344
- C:\Windows\System\flFNfCw.exe
  C:\Windows\System\flFNfCw.exe
  2⤵
  PID:6680
- C:\Windows\System\leiaOBs.exe
  C:\Windows\System\leiaOBs.exe
  2⤵
  PID:1988
- C:\Windows\System\tMQrvLX.exe
  C:\Windows\System\tMQrvLX.exe
  2⤵
  PID:6700
- C:\Windows\System\wxecMtX.exe
  C:\Windows\System\wxecMtX.exe
  2⤵
  PID:7620
- C:\Windows\System\vDDVMQO.exe
  C:\Windows\System\vDDVMQO.exe
  2⤵
  PID:8144
- C:\Windows\System\UuxXiKy.exe
  C:\Windows\System\UuxXiKy.exe
  2⤵
  PID:7924
- C:\Windows\System\GToxyjX.exe
  C:\Windows\System\GToxyjX.exe
  2⤵
  PID:8972
- C:\Windows\System\sTfykYR.exe
  C:\Windows\System\sTfykYR.exe
  2⤵
  PID:7560
- C:\Windows\System\MKAOWGM.exe
  C:\Windows\System\MKAOWGM.exe
  2⤵
  PID:13760
- C:\Windows\System\nYTwUEj.exe
  C:\Windows\System\nYTwUEj.exe
  2⤵
  PID:8768
- C:\Windows\System\WpjadUQ.exe
  C:\Windows\System\WpjadUQ.exe
  2⤵
  PID:13556
- C:\Windows\System\toOREQR.exe
  C:\Windows\System\toOREQR.exe
  2⤵
  PID:6756
- C:\Windows\System\SPBaLEa.exe
  C:\Windows\System\SPBaLEa.exe
  2⤵
  PID:8308
- C:\Windows\System\LlyYkWM.exe
  C:\Windows\System\LlyYkWM.exe
  2⤵
  PID:5416
- C:\Windows\System\rWtjIUa.exe
  C:\Windows\System\rWtjIUa.exe
  2⤵
  PID:8928
- C:\Windows\System\asaZEoq.exe
  C:\Windows\System\asaZEoq.exe
  2⤵
  PID:3100
- C:\Windows\System\hKcZnkq.exe
  C:\Windows\System\hKcZnkq.exe
  2⤵
  PID:5928
- C:\Windows\System\ojuKWUS.exe
  C:\Windows\System\ojuKWUS.exe
  2⤵
  PID:14544
- C:\Windows\System\mENGtIP.exe
  C:\Windows\System\mENGtIP.exe
  2⤵
  PID:14036
- C:\Windows\System\TfFHmqY.exe
  C:\Windows\System\TfFHmqY.exe
  2⤵
  PID:14612
- C:\Windows\System\nzWtUwF.exe
  C:\Windows\System\nzWtUwF.exe
  2⤵
  PID:14656
- C:\Windows\System\ahJDdhe.exe
  C:\Windows\System\ahJDdhe.exe
  2⤵
  PID:9108
- C:\Windows\System\kmRfxku.exe
  C:\Windows\System\kmRfxku.exe
  2⤵
  PID:8704
- C:\Windows\System\FmYVDaX.exe
  C:\Windows\System\FmYVDaX.exe
  2⤵
  PID:14340
- C:\Windows\System\fIPIcOK.exe
  C:\Windows\System\fIPIcOK.exe
  2⤵
  PID:8216
- C:\Windows\System\OXpsAAV.exe
  C:\Windows\System\OXpsAAV.exe
  2⤵
  PID:5128
- C:\Windows\System\fylkIFr.exe
  C:\Windows\System\fylkIFr.exe
  2⤵
  PID:8264
- C:\Windows\System\tefXyqu.exe
  C:\Windows\System\tefXyqu.exe
  2⤵
  PID:6676
- C:\Windows\System\ISgTfrH.exe
  C:\Windows\System\ISgTfrH.exe
  2⤵
  PID:14768
- C:\Windows\System\JAbEGhc.exe
  C:\Windows\System\JAbEGhc.exe
  2⤵
  PID:14468
- C:\Windows\System\wTjDgzp.exe
  C:\Windows\System\wTjDgzp.exe
  2⤵
  PID:1196
- C:\Windows\System\qmuHKUm.exe
  C:\Windows\System\qmuHKUm.exe
  2⤵
  PID:1372
- C:\Windows\System\LeLQXbN.exe
  C:\Windows\System\LeLQXbN.exe
  2⤵
  PID:7172
- C:\Windows\System\cLPpmJJ.exe
  C:\Windows\System\cLPpmJJ.exe
  2⤵
  PID:14832
- C:\Windows\System\XDkwbIq.exe
  C:\Windows\System\XDkwbIq.exe
  2⤵
  PID:8996
- C:\Windows\System\fMWPNoN.exe
  C:\Windows\System\fMWPNoN.exe
  2⤵
  PID:14852
- C:\Windows\System\lnTJoDj.exe
  C:\Windows\System\lnTJoDj.exe
  2⤵
  PID:8892
- C:\Windows\System\uxetASq.exe
  C:\Windows\System\uxetASq.exe
  2⤵
  PID:14760
- C:\Windows\System\thLzNzi.exe
  C:\Windows\System\thLzNzi.exe
  2⤵
  PID:6236
- C:\Windows\System\qUJFJHd.exe
  C:\Windows\System\qUJFJHd.exe
  2⤵
  PID:3636
- C:\Windows\System\FWCAJLS.exe
  C:\Windows\System\FWCAJLS.exe
  2⤵
  PID:7676
- C:\Windows\System\uiTGdjT.exe
  C:\Windows\System\uiTGdjT.exe
  2⤵
  PID:9144
- C:\Windows\System\QjjVMoZ.exe
  C:\Windows\System\QjjVMoZ.exe
  2⤵
  PID:8328
- C:\Windows\System\FkRFQMF.exe
  C:\Windows\System\FkRFQMF.exe
  2⤵
  PID:7184
- C:\Windows\System\JBesULt.exe
  C:\Windows\System\JBesULt.exe
  2⤵
  PID:8644
- C:\Windows\System\byOFyaz.exe
  C:\Windows\System\byOFyaz.exe
  2⤵
  PID:14568
- C:\Windows\System\AbGwzQP.exe
  C:\Windows\System\AbGwzQP.exe
  2⤵
  PID:14572
- C:\Windows\System\gShXKHB.exe
  C:\Windows\System\gShXKHB.exe
  2⤵
  PID:7740
- C:\Windows\System\MwWqjeD.exe
  C:\Windows\System\MwWqjeD.exe
  2⤵
  PID:14596
- C:\Windows\System\Bfvqmbu.exe
  C:\Windows\System\Bfvqmbu.exe
  2⤵
  PID:15100
- C:\Windows\System\nmdOFMc.exe
  C:\Windows\System\nmdOFMc.exe
  2⤵
  PID:6884
- C:\Windows\System\GyiNfgW.exe
  C:\Windows\System\GyiNfgW.exe
  2⤵
  PID:14644
- C:\Windows\System\cDLdIee.exe
  C:\Windows\System\cDLdIee.exe
  2⤵
  PID:8664
- C:\Windows\System\iksIHuZ.exe
  C:\Windows\System\iksIHuZ.exe
  2⤵
  PID:6968
- C:\Windows\System\kzYpzHY.exe
  C:\Windows\System\kzYpzHY.exe
  2⤵
  PID:8640
- C:\Windows\System\VVvDYjP.exe
  C:\Windows\System\VVvDYjP.exe
  2⤵
  PID:8708
- C:\Windows\System\HgIdDCO.exe
  C:\Windows\System\HgIdDCO.exe
  2⤵
  PID:15272
- C:\Windows\System\wQurmOH.exe
  C:\Windows\System\wQurmOH.exe
  2⤵
  PID:15312
- C:\Windows\System\SsaOxxq.exe
  C:\Windows\System\SsaOxxq.exe
  2⤵
  PID:14688
- C:\Windows\System\ShjKsiP.exe
  C:\Windows\System\ShjKsiP.exe
  2⤵
  PID:8748
- C:\Windows\System\jfcGORn.exe
  C:\Windows\System\jfcGORn.exe
  2⤵
  PID:14488
- C:\Windows\System\AIdYAEV.exe
  C:\Windows\System\AIdYAEV.exe
  2⤵
  PID:14724
- C:\Windows\System\cJEzmZp.exe
  C:\Windows\System\cJEzmZp.exe
  2⤵
  PID:8680
- C:\Windows\System\xrxJDmE.exe
  C:\Windows\System\xrxJDmE.exe
  2⤵
  PID:8908
- C:\Windows\System\wMjRbuj.exe
  C:\Windows\System\wMjRbuj.exe
  2⤵
  PID:7508
- C:\Windows\System\zuxuuQJ.exe
  C:\Windows\System\zuxuuQJ.exe
  2⤵
  PID:1852
- C:\Windows\System\YpUwYBm.exe
  C:\Windows\System\YpUwYBm.exe
  2⤵
  PID:14636
- C:\Windows\System\xqDAuuy.exe
  C:\Windows\System\xqDAuuy.exe
  2⤵
  PID:13320
- C:\Windows\System\gVwNDMv.exe
  C:\Windows\System\gVwNDMv.exe
  2⤵
  PID:11608
- C:\Windows\System\WNVPewQ.exe
  C:\Windows\System\WNVPewQ.exe
  2⤵
  PID:500
- C:\Windows\System\TyDuLCH.exe
  C:\Windows\System\TyDuLCH.exe
  2⤵
  PID:14848
- C:\Windows\System\zffewVH.exe
  C:\Windows\System\zffewVH.exe
  2⤵
  PID:14932
- C:\Windows\System\HwOaslb.exe
  C:\Windows\System\HwOaslb.exe
  2⤵
  PID:15016
- C:\Windows\System\iToWeuI.exe
  C:\Windows\System\iToWeuI.exe
  2⤵
  PID:15052
- C:\Windows\System\SFzzBgO.exe
  C:\Windows\System\SFzzBgO.exe
  2⤵
  PID:692
- C:\Windows\System\HeevZZq.exe
  C:\Windows\System\HeevZZq.exe
  2⤵
  PID:15148
- C:\Windows\System\bhXWLEm.exe
  C:\Windows\System\bhXWLEm.exe
  2⤵
  PID:15176
- C:\Windows\System\mroxpAQ.exe
  C:\Windows\System\mroxpAQ.exe
  2⤵
  PID:15224
- C:\Windows\System\LzENudt.exe
  C:\Windows\System\LzENudt.exe
  2⤵
  PID:7820
- C:\Windows\System\gUopIit.exe
  C:\Windows\System\gUopIit.exe
  2⤵
  PID:6444
- C:\Windows\System\XWAGGlq.exe
  C:\Windows\System\XWAGGlq.exe
  2⤵
  PID:13084
- C:\Windows\System\kbLNeXX.exe
  C:\Windows\System\kbLNeXX.exe
  2⤵
  PID:7608
- C:\Windows\System\Bliakmw.exe
  C:\Windows\System\Bliakmw.exe
  2⤵
  PID:13324
- C:\Windows\System\WCgkoFE.exe
  C:\Windows\System\WCgkoFE.exe
  2⤵
  PID:8940
- C:\Windows\System\AffmBCs.exe
  C:\Windows\System\AffmBCs.exe
  2⤵
  PID:8300
- C:\Windows\System\DPvpPDG.exe
  C:\Windows\System\DPvpPDG.exe
  2⤵
  PID:8836
- C:\Windows\System\aweaOjH.exe
  C:\Windows\System\aweaOjH.exe
  2⤵
  PID:5972
- C:\Windows\System\HjjUNIq.exe
  C:\Windows\System\HjjUNIq.exe
  2⤵
  PID:9332
- C:\Windows\System\OWdkldP.exe
  C:\Windows\System\OWdkldP.exe
  2⤵
  PID:15308
- C:\Windows\System\HfDOTHf.exe
  C:\Windows\System\HfDOTHf.exe
  2⤵
  PID:9660
- C:\Windows\System\wbmRbXd.exe
  C:\Windows\System\wbmRbXd.exe
  2⤵
  PID:7036
- C:\Windows\System\rUMJqxr.exe
  C:\Windows\System\rUMJqxr.exe
  2⤵
  PID:7468
- C:\Windows\System\kopLBYU.exe
  C:\Windows\System\kopLBYU.exe
  2⤵
  PID:14464
- C:\Windows\System\oaRomoy.exe
  C:\Windows\System\oaRomoy.exe
  2⤵
  PID:12672
- C:\Windows\System\jsEZmEd.exe
  C:\Windows\System\jsEZmEd.exe
  2⤵
  PID:8880
- C:\Windows\System\lWOVzGq.exe
  C:\Windows\System\lWOVzGq.exe
  2⤵
  PID:8852
- C:\Windows\System\vBxbHgm.exe
  C:\Windows\System\vBxbHgm.exe
  2⤵
  PID:8636
- C:\Windows\System\LkAFgZE.exe
  C:\Windows\System\LkAFgZE.exe
  2⤵
  PID:6636
- C:\Windows\System\AODhjFw.exe
  C:\Windows\System\AODhjFw.exe
  2⤵
  PID:8508
- C:\Windows\System\Bzibajf.exe
  C:\Windows\System\Bzibajf.exe
  2⤵
  PID:15380
- C:\Windows\System\jJnsdgC.exe
  C:\Windows\System\jJnsdgC.exe
  2⤵
  PID:15400
- C:\Windows\System\gsWThhC.exe
  C:\Windows\System\gsWThhC.exe
  2⤵
  PID:15420
- C:\Windows\System\KtjzEvg.exe
  C:\Windows\System\KtjzEvg.exe
  2⤵
  PID:15440
- C:\Windows\System\sssXWgb.exe
  C:\Windows\System\sssXWgb.exe
  2⤵
  PID:15468
- C:\Windows\System\GiHhzFc.exe
  C:\Windows\System\GiHhzFc.exe
  2⤵
  PID:15492
- C:\Windows\System\DbyxvgB.exe
  C:\Windows\System\DbyxvgB.exe
  2⤵
  PID:15512
- C:\Windows\System\lSwEdxx.exe
  C:\Windows\System\lSwEdxx.exe
  2⤵
  PID:15532
- C:\Windows\System\XFCdWGk.exe
  C:\Windows\System\XFCdWGk.exe
  2⤵
  PID:15560
- C:\Windows\System\defZZHd.exe
  C:\Windows\System\defZZHd.exe
  2⤵
  PID:15580
- C:\Windows\System\IqSHOWW.exe
  C:\Windows\System\IqSHOWW.exe
  2⤵
  PID:15604
- C:\Windows\System\AGAABBj.exe
  C:\Windows\System\AGAABBj.exe
  2⤵
  PID:15628
- C:\Windows\System\nHFecGX.exe
  C:\Windows\System\nHFecGX.exe
  2⤵
  PID:15652
- C:\Windows\System\CcmojRs.exe
  C:\Windows\System\CcmojRs.exe
  2⤵
  PID:15680
- C:\Windows\System\hsaIYPl.exe
  C:\Windows\System\hsaIYPl.exe
  2⤵
  PID:15700
- C:\Windows\System\ctseQdl.exe
  C:\Windows\System\ctseQdl.exe
  2⤵
  PID:15724
- C:\Windows\System\XjUedyF.exe
  C:\Windows\System\XjUedyF.exe
  2⤵
  PID:15744
- C:\Windows\System\ibSODGf.exe
  C:\Windows\System\ibSODGf.exe
  2⤵
  PID:15772
- C:\Windows\System\IlTVOxm.exe
  C:\Windows\System\IlTVOxm.exe
  2⤵
  PID:15796
- C:\Windows\System\vSSgGDP.exe
  C:\Windows\System\vSSgGDP.exe
  2⤵
  PID:15828
- C:\Windows\System\CwcQNRi.exe
  C:\Windows\System\CwcQNRi.exe
  2⤵
  PID:15844
- C:\Windows\System\EThhvMn.exe
  C:\Windows\System\EThhvMn.exe
  2⤵
  PID:15864
- C:\Windows\System\knRtpVG.exe
  C:\Windows\System\knRtpVG.exe
  2⤵
  PID:16096
- C:\Windows\System\fMhHHHr.exe
  C:\Windows\System\fMhHHHr.exe
  2⤵
  PID:16116
- C:\Windows\System\AnFqJOv.exe
  C:\Windows\System\AnFqJOv.exe
  2⤵
  PID:16132
- C:\Windows\System\gncvCdx.exe
  C:\Windows\System\gncvCdx.exe
  2⤵
  PID:16148
- C:\Windows\System\JYzbNvt.exe
  C:\Windows\System\JYzbNvt.exe
  2⤵
  PID:16168
- C:\Windows\System\AZPbJgh.exe
  C:\Windows\System\AZPbJgh.exe
  2⤵
  PID:16188
- C:\Windows\System\guJabuO.exe
  C:\Windows\System\guJabuO.exe
  2⤵
  PID:16212
- C:\Windows\System\xXCMuKl.exe
  C:\Windows\System\xXCMuKl.exe
  2⤵
  PID:14620
- C:\Windows\System\weXLVWA.exe
  C:\Windows\System\weXLVWA.exe
  2⤵
  PID:6712
- C:\Windows\System\YvwUKqJ.exe
  C:\Windows\System\YvwUKqJ.exe
  2⤵
  PID:9868
- C:\Windows\System\uIKlrys.exe
  C:\Windows\System\uIKlrys.exe
  2⤵
  PID:7544
- C:\Windows\System\rstWfKK.exe
  C:\Windows\System\rstWfKK.exe
  2⤵
  PID:14360
- C:\Windows\System\JFYVQuz.exe
  C:\Windows\System\JFYVQuz.exe
  2⤵
  PID:8684
- C:\Windows\System\baPLdgl.exe
  C:\Windows\System\baPLdgl.exe
  2⤵
  PID:8468
- C:\Windows\System\iWkWTvQ.exe
  C:\Windows\System\iWkWTvQ.exe
  2⤵
  PID:8700
- C:\Windows\System\fqyLEyV.exe
  C:\Windows\System\fqyLEyV.exe
  2⤵
  PID:16316
- C:\Windows\System\Igvzljw.exe
  C:\Windows\System\Igvzljw.exe
  2⤵
  PID:16280
- C:\Windows\System\pwxmAEa.exe
  C:\Windows\System\pwxmAEa.exe
  2⤵
  PID:16244
- C:\Windows\System\iWuXEhw.exe
  C:\Windows\System\iWuXEhw.exe
  2⤵
  PID:16068
- C:\Windows\System\EPmtHEe.exe
  C:\Windows\System\EPmtHEe.exe
  2⤵
  PID:9464
- C:\Windows\System\jMCATJC.exe
  C:\Windows\System\jMCATJC.exe
  2⤵
  PID:15600
- C:\Windows\System\lytUwai.exe
  C:\Windows\System\lytUwai.exe
  2⤵
  PID:15688
- C:\Windows\System\fmgmGKZ.exe
  C:\Windows\System\fmgmGKZ.exe
  2⤵
  PID:10388
- C:\Windows\System\sAVhYJZ.exe
  C:\Windows\System\sAVhYJZ.exe
  2⤵
  PID:10540
- C:\Windows\System\EcEpXLa.exe
  C:\Windows\System\EcEpXLa.exe
  2⤵
  PID:9600
- C:\Windows\System\lWbGTaZ.exe
  C:\Windows\System\lWbGTaZ.exe
  2⤵
  PID:11640
- C:\Windows\System\zvrAIQR.exe
  C:\Windows\System\zvrAIQR.exe
  2⤵
  PID:16128
- C:\Windows\System\XKzKeTK.exe
  C:\Windows\System\XKzKeTK.exe
  2⤵
  PID:11484
- C:\Windows\System\FGdJlef.exe
  C:\Windows\System\FGdJlef.exe
  2⤵
  PID:11532
- C:\Windows\System\rZbKLyN.exe
  C:\Windows\System\rZbKLyN.exe
  2⤵
  PID:10796
- C:\Windows\System\VOHuFdJ.exe
  C:\Windows\System\VOHuFdJ.exe
  2⤵
  PID:9704
- C:\Windows\System\woHjrEr.exe
  C:\Windows\System\woHjrEr.exe
  2⤵
  PID:7636
- C:\Windows\System\GzaUAex.exe
  C:\Windows\System\GzaUAex.exe
  2⤵
  PID:16008
- C:\Windows\System\keEWIlM.exe
  C:\Windows\System\keEWIlM.exe
  2⤵
  PID:16040
- C:\Windows\System\zYdLQAW.exe
  C:\Windows\System\zYdLQAW.exe
  2⤵
  PID:16072
- C:\Windows\System\HYnxOxz.exe
  C:\Windows\System\HYnxOxz.exe
  2⤵
  PID:9328
- C:\Windows\System\yFAWeCK.exe
  C:\Windows\System\yFAWeCK.exe
  2⤵
  PID:16324
- C:\Windows\System\hAJgaBn.exe
  C:\Windows\System\hAJgaBn.exe
  2⤵
  PID:16160
- C:\Windows\System\GxzvlGH.exe
  C:\Windows\System\GxzvlGH.exe
  2⤵
  PID:16104
- C:\Windows\System\ulUbAZP.exe
  C:\Windows\System\ulUbAZP.exe
  2⤵
  PID:10364
- C:\Windows\System\eFvOhqO.exe
  C:\Windows\System\eFvOhqO.exe
  2⤵
  PID:9432
- C:\Windows\System\TzsuZfQ.exe
  C:\Windows\System\TzsuZfQ.exe
  2⤵
  PID:5708
- C:\Windows\System\VQTXtEr.exe
  C:\Windows\System\VQTXtEr.exe
  2⤵
  PID:9268
- C:\Windows\System\eUpLcwH.exe
  C:\Windows\System\eUpLcwH.exe
  2⤵
  PID:15132
- C:\Windows\System\gCvKFIb.exe
  C:\Windows\System\gCvKFIb.exe
  2⤵
  PID:15648
- C:\Windows\System\xRqsuXD.exe
  C:\Windows\System\xRqsuXD.exe
  2⤵
  PID:14460
- C:\Windows\System\BaWojwO.exe
  C:\Windows\System\BaWojwO.exe
  2⤵
  PID:8828
- C:\Windows\System\hLKetmI.exe
  C:\Windows\System\hLKetmI.exe
  2⤵
  PID:16036
- C:\Windows\System\euTRmbR.exe
  C:\Windows\System\euTRmbR.exe
  2⤵
  PID:14820
- C:\Windows\System\wedewTo.exe
  C:\Windows\System\wedewTo.exe
  2⤵
  PID:1132
- C:\Windows\System\XPYiUpl.exe
  C:\Windows\System\XPYiUpl.exe
  2⤵
  PID:9188
- C:\Windows\System\rAJwMnA.exe
  C:\Windows\System\rAJwMnA.exe
  2⤵
  PID:15456
- C:\Windows\System\bvKeHHm.exe
  C:\Windows\System\bvKeHHm.exe
  2⤵
  PID:14600
- C:\Windows\System\oANeFsu.exe
  C:\Windows\System\oANeFsu.exe
  2⤵
  PID:15636
- C:\Windows\System\baBFoEM.exe
  C:\Windows\System\baBFoEM.exe
  2⤵
  PID:7464
- C:\Windows\System\KcSKlNL.exe
  C:\Windows\System\KcSKlNL.exe
  2⤵
  PID:9344
- C:\Windows\System\MvOkEOE.exe
  C:\Windows\System\MvOkEOE.exe
  2⤵
  PID:4696
- C:\Windows\System\IMTdYGt.exe
  C:\Windows\System\IMTdYGt.exe
  2⤵
  PID:9836
- C:\Windows\System\tgjwAjP.exe
  C:\Windows\System\tgjwAjP.exe
  2⤵
  PID:8304
- C:\Windows\System\LSeMwvx.exe
  C:\Windows\System\LSeMwvx.exe
  2⤵
  PID:14408
- C:\Windows\System\FjsdDPK.exe
  C:\Windows\System\FjsdDPK.exe
  2⤵
  PID:13260
- C:\Windows\System\DvulBWN.exe
  C:\Windows\System\DvulBWN.exe
  2⤵
  PID:11372
- C:\Windows\System\VUPEAlI.exe
  C:\Windows\System\VUPEAlI.exe
  2⤵
  PID:9376
- C:\Windows\System\BLuyRLR.exe
  C:\Windows\System\BLuyRLR.exe
  2⤵
  PID:11396
- C:\Windows\System\bvbVlqy.exe
  C:\Windows\System\bvbVlqy.exe
  2⤵
  PID:11296
- C:\Windows\System\aqwLFES.exe
  C:\Windows\System\aqwLFES.exe
  2⤵
  PID:12676
- C:\Windows\System\hNrSftv.exe
  C:\Windows\System\hNrSftv.exe
  2⤵
  PID:12932
- C:\Windows\System\pcqfBAt.exe
  C:\Windows\System\pcqfBAt.exe
  2⤵
  PID:12252
- C:\Windows\System\vWbsfjg.exe
  C:\Windows\System\vWbsfjg.exe
  2⤵
  PID:11868
- C:\Windows\System\yJBetkY.exe
  C:\Windows\System\yJBetkY.exe
  2⤵
  PID:12208
- C:\Windows\System\pMkXUYO.exe
  C:\Windows\System\pMkXUYO.exe
  2⤵
  PID:12192
- C:\Windows\System\LipIffB.exe
  C:\Windows\System\LipIffB.exe
  2⤵
  PID:15808
- C:\Windows\System\ZWXukUL.exe
  C:\Windows\System\ZWXukUL.exe
  2⤵
  PID:11012
- C:\Windows\System\eKHbnuA.exe
  C:\Windows\System\eKHbnuA.exe
  2⤵
  PID:11936
- C:\Windows\System\JwvhNvO.exe
  C:\Windows\System\JwvhNvO.exe
  2⤵
  PID:10668
- C:\Windows\System\WAcWDCA.exe
  C:\Windows\System\WAcWDCA.exe
  2⤵
  PID:16372
- C:\Windows\System\aukrrae.exe
  C:\Windows\System\aukrrae.exe
  2⤵
  PID:1528
- C:\Windows\System\LHBfnlT.exe
  C:\Windows\System\LHBfnlT.exe
  2⤵
  PID:11428
- C:\Windows\System\erQNtZY.exe
  C:\Windows\System\erQNtZY.exe
  2⤵
  PID:2336
- C:\Windows\System\nbiPWPI.exe
  C:\Windows\System\nbiPWPI.exe
  2⤵
  PID:11192
- C:\Windows\System\LoPgiVq.exe
  C:\Windows\System\LoPgiVq.exe
  2⤵
  PID:15672
- C:\Windows\System\WGKlvon.exe
  C:\Windows\System\WGKlvon.exe
  2⤵
  PID:11700
- C:\Windows\System\zdTTgRm.exe
  C:\Windows\System\zdTTgRm.exe
  2⤵
  PID:12520
- C:\Windows\System\FvKccBk.exe
  C:\Windows\System\FvKccBk.exe
  2⤵
  PID:11364
- C:\Windows\System\dVPayuS.exe
  C:\Windows\System\dVPayuS.exe
  2⤵
  PID:8772
- C:\Windows\System\ZOwIeoq.exe
  C:\Windows\System\ZOwIeoq.exe
  2⤵
  PID:11928

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 368 -p 3844 -ip 3844
1⤵
PID:13952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0owjjax3.anr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CtrvGTl.exe

Filesize
1.9MB

MD5
9425bec03c870200b55c0ea5e254282f

SHA1
120cecd7239b2cc9c39ab5af8ea8e4e288a18df6

SHA256
112d14b6d5fe044ba0b1242c5361d15042b086a13799fb25da6414e4d15737f6

SHA512
279de2b7312480d5d6cf4cc2478b8fb8aa92ffb41ca289e44ed7947c26616198cd2a2514aa057c66cdbbef0d4043b36c295e4cd320c093e8640d750a4dd67f7c

Download Submit
C:\Windows\System\FsHavxr.exe

Filesize
1.9MB

MD5
d7c91c1eaea0c1efef1dac3e1a6742d8

SHA1
6d742a430a3894fe71120e98f1c9a30b7c445b7d

SHA256
e11f8b058afcd9940bb46d814af0a05633c68fe3583608f3870d1c1a3fda3b75

SHA512
22c96380f444cd7025c5fae1a157aeedf6ab4ef70149945864d6a9787d82bcdc6fbe81f24b3212b84b9a14fda1de040fcfab0d680042b10af7661c3f983ee3f6

Download Submit
C:\Windows\System\GGogtcW.exe

Filesize
1.9MB

MD5
1c0fa7105b559975396af9a71075de83

SHA1
a61b4526e00df6ea1127b993d8dbdee152497327

SHA256
04c3edc274d49279252200fbb9b26de7f1d8d1fbf4ebdf818f0f684fe98e1665

SHA512
dd7241977238e4c19273739b0f2f36cd8d98ca84c9b9f5e3a94d1a151376035a0411c86f8d9c4d9dd1292818a0976c0dfb58a89cb07693ea5bae45e22c3b3115

Download Submit
C:\Windows\System\HGceKjO.exe

Filesize
1.9MB

MD5
4813b53262a9fa95dfd8792d5ecba2af

SHA1
8fe4bdd167891a5ba5eee9bd9d5239c1802f5761

SHA256
68e712a3a2163828b190a5a16e51d2953fa1481a928c20da830637ef6826ab19

SHA512
4671dd824c3ae4e26d9ff6583353d39f7b1f151b70d6046a04c4427aa89952f281070317a24a6d10dcb89db34aac7f75ce361712cc5875c1e2c2eb3372459f0d

Download Submit
C:\Windows\System\JEvncBU.exe

Filesize
1.9MB

MD5
ce84b8bd6c1c8c66907ed3311b548f2d

SHA1
54b7640312b4ab30330868dc6674f53be184bdb0

SHA256
fe7c1d5dfe23493345c887b162a962a1d2d881068020363702788c5ab2d50614

SHA512
ebf5751d0bd96a432556293bbd8a82838a91857656fab3ff4c2d8e03639ac8902c913097ab110f11eab70bb351fccdab324cc7bdc792537beef147297bf7f04f

Download Submit
C:\Windows\System\NEVeRhk.exe

Filesize
1.9MB

MD5
5d0336b559b20fd8168aac4ea4555022

SHA1
e547f1a62b924be7bff96c5ca0c93d8da2ec094f

SHA256
87f4b96ec57fe720a2205fb56a9bd3dc0724cf6f32c3dbe6cf500d2916a6f37b

SHA512
cbbf1c2529087cefa253b09657e779b1d1f690a2e2c66b2a16ac3e899d45dba1ee052d5ee8078b519b1acd149850113dd1f12a57c2101164e54243762c587af7

Download Submit
C:\Windows\System\OsDFFYb.exe

Filesize
1.9MB

MD5
31a34468b37acaa514ab7590d2a9f3a1

SHA1
914610e11c94430fe2fb24b4777ffaade324964e

SHA256
4ac109fdbc308b8c2fd9c4f1ad7004a0aa2419791d9acc99ad5b1e49c5eaf687

SHA512
f687bbd84bf2d203a503e01231cf766841f69188cbccfa6f6d2bcf0b0f882b0b762ec52953e2d37b59047d1b504d591eae4629f153074697e529d3c1c8e6227c

Download Submit
C:\Windows\System\QdfraEG.exe

Filesize
1.9MB

MD5
9ddcd331dcd982e4fbe5cb5d53af7baa

SHA1
70c812710f7ecd9d25e64185fa876911b0efdf3f

SHA256
56cfe5139f3a0d22f573023a71b608fe32268e7bcdcd3608c78cecde0c78a514

SHA512
2e327a16623d1b4859afdcbadaf15ce90dc5e1a18d0cdd40a787d36bac60bb29ad70333aeb7ea1d1d91fca692b0bd6822dfb572c5bf0e21e3639ae18371bda7c

Download Submit
C:\Windows\System\UOrNZqc.exe

Filesize
1.9MB

MD5
e1f296309b6f19cc8a0749e8354b527d

SHA1
8fccc582bdfc5a986ad7a281d462efbe16d297a1

SHA256
43fe1229c95d7b40bce6735a4f215a02090ec36ba4e43d3df5681678ee990584

SHA512
f0c68e3a1d6c6cba669015ab1ffbe6bce610f11facb6412c2b146fcc6f6db926927dfa0680a9e0bfdf3fbb496964030dee44c5eb00de5d71890468ddf7cb8648

Download Submit
C:\Windows\System\UpxplXX.exe

Filesize
1.9MB

MD5
bcc68ab8f212895f374fff8fabf1c6da

SHA1
912fd4ef933f1be7b3385b40b3783e01d2d03285

SHA256
4af071f36174545b77fcd970e21f1a6272921e8b0d6433d1116fed973df3b06b

SHA512
10a55cc14b9556d79d098daa27d39b98c85dd6c6cbf92abccc4fd22b35dfad8171dd20228492e62b6bc0a41416ca5c2083e500bfac9d6f1625adf421e83a6e27

Download Submit
C:\Windows\System\YhhQPDu.exe

Filesize
1.9MB

MD5
bb08d55661fe566f52ed545da7dc88d3

SHA1
5c293a16417bdb09d30dcf3a75401a533ff1df9e

SHA256
26e926c27e887ebd753291d0cc48b06c4e7adb0eed1023443c3d757e033297f9

SHA512
b14f53223eb33d6a92e69220e8f421560a32db060b6e0c653f7c8adbe33168e56cc481b3099b7553ecd4bc8f97f4051bdf6f65bb1d0f999f84153edd893b8b53

Download Submit
C:\Windows\System\aVjsvQq.exe

Filesize
1.9MB

MD5
c4e7cff4cb9c0a857d48fd9e38c8f124

SHA1
fbe4b879fa14c321490c459aab7451fa9340cc46

SHA256
49579091f803b6309e695c16e2c5f1af723e036836cd1bdf3c31259aaadf01dc

SHA512
71e9ccc678a5d2efd2d8165a92e4b3794f66b8e77ba7263aa166356cf439e9d39181364d75873905d1874b348d2e6624b9766805d6211b402b9461094626146f

Download Submit
C:\Windows\System\bTMElXL.exe

Filesize
1.9MB

MD5
ba972e5706bb665d58c5df6b0a472baf

SHA1
7180f532cebd69d3bcfd550088ce516be2743000

SHA256
1ca7981c187135a0caca3cce65446e2c5e061ef3a5d7f96f385591404c95ef9e

SHA512
98a8961384f013efcf11a1123b9246c164f94b5d322d1f984c761d78d84ac0093dab2fc2ee37be36bb29d44d21b03539a6af0a011d8d9c63096cd17d0cccf5c2

Download Submit
C:\Windows\System\bdYPQCX.exe

Filesize
1.9MB

MD5
34ee3e6834b064a01fc0cb6cd0c5fd18

SHA1
70b9133a633375cfc5ed8c5aa69b0ee5d229b3c3

SHA256
ccecb8c01c34010ad4f75b156d753d5cc40e2b16fd9a47c15e82496f5ecffb0d

SHA512
1ece39f250206054e6299195aea6d93fe559d510f6794daba8357864b11e0dcfa31244896aca2d41bdf0174711dcd9530584bb550a2af7c03dde941baa9c0958

Download Submit
C:\Windows\System\cTegkxu.exe

Filesize
1.9MB

MD5
55d945ebc7164647dec0ce0c960fad08

SHA1
508dc4dbecd231d7dd340ac303d48842ce8c4a3a

SHA256
fc4517f74e7e069519043e4adea82008ce540dd11fe23978d195f71c3f22b555

SHA512
953415d95c76b7a21fdb49a001a619772787f178ca2b7cb54c68e61cff02c7e2e9f145d6a2149b3b58da997bada291d6bd04df085360ab53958e04d813f8ab48

Download Submit
C:\Windows\System\dDIyIWZ.exe

Filesize
1.9MB

MD5
9f114821297956aa61045d480e4e8f6b

SHA1
8993a7c1ecbaa419390a5bcc2381e9490afa788d

SHA256
98959efbd6e10d2d14970684d544e9714aadb059c77d2e6e94d616f22f63b2f8

SHA512
7a522c0b023d0faa51f9cece5d7b30c86c1338ab6607276f3db3fa462870c6c1c237bf60f75cac2952edc5e351c9c4fd79c06dd1d60c3a5d84e3d583d85b1849

Download Submit
C:\Windows\System\dmcCLLz.exe

Filesize
1.9MB

MD5
9572d8eeb93c2c21260867f658483015

SHA1
587360ce18b60e916ea209c94c6ad5c284e94e42

SHA256
268c824de94763630341dd0a9feb69e4cd22a07ec684c8ffa5a072a769825dd4

SHA512
57ac449287f42b403c264592582104f03a6dcd7f7eaaca35bf42f00bc791f66e259a1d8ad98d9e9ff01260114c3d8925ef76c11f803214e2eef715e035cb4e8f

Download Submit
C:\Windows\System\fBZNzmg.exe

Filesize
1.9MB

MD5
dafbb8352643f1e3da342a6f23b378a6

SHA1
4d97fbfb6b5006a1d6636da97ed87e624fae471b

SHA256
7b1a772dfc5d0335d476fde1c3662e2d6a2e2e741725c9245a7ef645a11decac

SHA512
c26162c251e1dd824b5be6063820e9f56900a5da568ddb077b9d276fc5c99ef5cb61add393fbd5ebdfc7914379e4e05911d30f0dfa3d507e6d23b1f4c11dde22

Download Submit
C:\Windows\System\hGUnVLH.exe

Filesize
1.9MB

MD5
f22725db0ac56560e2a5f13526daec4b

SHA1
5204f3d03a11788dfbc42bc08da5cba331ef0201

SHA256
b9e171b29b11546433c6df48fd2de2699fb6a99dc1ad6db7aba5e3443439f944

SHA512
d1ced6b30c83e5c106dc5eb5846fb3a44c78c32e16292fefaffaeb9fc76d49f29d34e99da4ae762bb6c91c2e43cdf0c68fcf1585adb4407948034cab58984b42

Download Submit
C:\Windows\System\iWZZnPh.exe

Filesize
1.9MB

MD5
873b28583791f0da9ea92410e469695c

SHA1
117bd0c8f1cfdcc051e9992c934f847bd6e7f2ef

SHA256
2d5332162dd708ed5c43cd22ceaf814d451ba9ac13cf652284c509a2084a915a

SHA512
035033404dc1e5ec5a750c76f2a759dfedcc7ced917115cf81a0aae32aaeceb8f48a0196308080647e3ffedf119e9748dfdc61bf65d45a2d372e2dea9098e047

Download Submit
C:\Windows\System\izSNEhm.exe

Filesize
1.9MB

MD5
59a4a9f2e53b7d874080fee6bbc2a515

SHA1
d7f534c7fd79a219c17373d5bdc6b3d54cea6125

SHA256
5078724cad82a0e4def818c048cb4f367d24565f993f8189722e252b054b011a

SHA512
d0b46e15264d82c720b6fb8a615d11c14baad4280e68d24986b4d44046ae8974c1a3009272a0d46c58726848817c05303c16992a57326f8c46655502a219d977

Download Submit
C:\Windows\System\kJZjxHI.exe

Filesize
1.9MB

MD5
478cf384c7edb018f93f9d2d650e6c1c

SHA1
6ed89e09d6d64f15678db65069dcf4d641afda95

SHA256
b87dd85ba731a933d9f21e65b5fd6f3abec520a254e4d359f7902959d957cf45

SHA512
9156c93e8c1897554200fd2106d2fad8378109c739521b4c94b014437bf0415e028b558f6994cf0832b93d667bd610fa15af78c4bb5273e8a9a898fb547e67d1

Download Submit
C:\Windows\System\ksccqfL.exe

Filesize
1.9MB

MD5
87d0ebf35f64e3cdc7d63c57c6ef3490

SHA1
756131513c289bfd9aa49df43d390a6844b69bb6

SHA256
bb5f6a269fb1027621ebeab5c9651adde3b1841e1c8b419163f0b1dca14e140c

SHA512
3484e70bb745446281cd326cd1df0dde895eab43a536c05f18cb08f22589aa05c27933f0425090bdbd7141fc76e1249929d375ecdcfec974b4a2d00db7d13c86

Download Submit
C:\Windows\System\oxqVYLD.exe

Filesize
1.9MB

MD5
49735e23b8cc94446a65b7a5dd518c16

SHA1
0041b9eb7024fdaaf8423d577053d1ea4530c6e1

SHA256
d24e80113bf21be4a1745a8b2d3e997a8b765dfb6e3d2b4a9fc4d2b769f90d9a

SHA512
e3d93652beb201f549d6d4b0f2e355ad38416a17ca2a30e9fe7e31bc566310ef5d7e6092a4ddfa7721540e71735bd31864446d1ed64bf9330961d135e44792b5

Download Submit
C:\Windows\System\qHFJamE.exe

Filesize
1.9MB

MD5
bb148b77fa3e11b8817cc6fc1d52365a

SHA1
0e98d55efb7f76ee898bb8a16e42bf62f2ff85f4

SHA256
9aeb81c17f6913cda1e047a27061ac78e4dafc772a420b4db7b22551ca5a1408

SHA512
9cb20656b7554deac281f6fa915bf373c4b9f782af0ea7fd22f3c930c37f82398548e6373db2574301a8a96afd908f9cb20d72b15886d5b80fc81bd3de2a289e

Download Submit
C:\Windows\System\qQueSzq.exe

Filesize
1.9MB

MD5
e560e0e3b179c07be7f65c2f7deb812c

SHA1
7162229731a550d14cd50b0487a22e1546945b64

SHA256
b834d9f8e5f1b0e4c8ddcc4fc26669e598d674aa0f318aa6c4c83f4a318cbba1

SHA512
39a03cfbe410b44cdbd3247771d316f7b52d9e47a3a760bb56292982a4386e149b1996e0c6987c0a83794cec6a842219f5da8975e86535a7d888b9c511b777bc

Download Submit
C:\Windows\System\rZrATuZ.exe

Filesize
1.9MB

MD5
dabb40cd9140965c0740026f0690dae8

SHA1
824466ffef022356a54acb33561772d9c49a8071

SHA256
9d3cf714d9a58f76ae01506203b11600d43f711f139d9e2c44668c25695f992a

SHA512
5deccc320565dfe020b7a1b1ed798327af325838406bdb334cd82625a8d6059933318f47fe5193f753b1d528b653cdb13b12a67135fab1b1c033d6cb28486881

Download Submit
C:\Windows\System\sBiDNYY.exe

Filesize
1.9MB

MD5
77d39a38965bab726875754e9451351d

SHA1
266a419e2535f9b0b2ea54a8ea104a39eb1c9fed

SHA256
e0c1e9b8f85018381e750860d0bf28062c84dff8f758a8fb7e482550a5bf6f2a

SHA512
9317b26df5231e3de6b03f39501f9cfa249f3ec081fbfd629706b80b145f6e9e019eadb93e85b6117c4e334e72539f18af8b47a69cb0e94a203c39300e6dd548

Download Submit
C:\Windows\System\sKSnUmI.exe

Filesize
1.9MB

MD5
df19a8fae1233e86c5a277a27618f7db

SHA1
c5e1aff4bd9769696112e6513bb98d98a13d6eb5

SHA256
f59aa419601cfaad373fb7708819ceafb413e6f1679b671b353596c79e76dac5

SHA512
7ce8360857fafd3a9c5f4fc97c51700c2968cccab0610e17c47b28ac6b2433788b6c2d2c09bc0c3394adce7cd06a984731140401e0d590221bf9c0851cadd2e5

Download Submit
C:\Windows\System\sbbDYge.exe

Filesize
1.9MB

MD5
44c01a61ff2f21a4b88593e8400f08e2

SHA1
ece7f017a69f93ca739b748da268bedc41998ef8

SHA256
51995869af6dcf7ef3fb7e28973753ad00b412623c742d0dc09dee762ba7cc0d

SHA512
3b03c2f88d40bcf47b3cd21c8beb9dc1ae0b7a028d4e5f02ee66835a8d039483f3ef838db3cf9e403b987f81c11545abf03a2a0fa4cab48ca142a3fc8ea987fc

Download Submit
C:\Windows\System\sigDtQG.exe

Filesize
1.9MB

MD5
42c3a71eb2d55c4c1953075e262971cb

SHA1
8f3a563b5c9f835b4af672f3d880129c8437bf3e

SHA256
04fa17b1922f0bed69e72d23d96cf2c0bdb023a8093b94ef464bad6596958e4c

SHA512
8c71ee6e8c84218ac87d974d5a4e403cb6b711191c42ad4cb4f88587fa899519f158591ea507ef136f0f07e82e4accc4bf379cbdff4026fff4c75702669fa164

Download Submit
C:\Windows\System\tgWUmwQ.exe

Filesize
1.9MB

MD5
a96290b9ebd91f148d9152e631559536

SHA1
306dc037e2194c198d3df271d62c8f261fac8c6c

SHA256
8dfdaeffd4d4ba806bd5f69fd417c0c014c5aac95020aac43bfa61e7504e79ea

SHA512
30489a81e61b0726073fa6aea72772577ad083283d55b61a9e58d2bbfb94f2c2d83d3550cca9e12dabebe538bd561db02e38f5f691367bc9a759db1e7e9a04b7

Download Submit
C:\Windows\System\xGqaMql.exe

Filesize
1.9MB

MD5
08b4d47fcfd00ab9c12aecdc75f034fb

SHA1
a89f871cbefa56a5d150926c7316438108a3514d

SHA256
3ddb609cd93079a1ca3e1d78db1fc3368fc0f0ebe15c72e81bfbe2ec87d150a6

SHA512
213300ebd8ca3bee2f4e697453c0235d9aae6ae686997fbcb7a11b18ca767f2abc90e27c826513cc6c90ea5c867e9672b7907cbdad0d2ca14a65003e34dbb8b1

Download Submit
C:\Windows\System\ygVAZbW.exe

Filesize
1.9MB

MD5
3de6bf3b6baafbe42ed9969c93689bdc

SHA1
cfe7990b66a189e695a15a72f1365d42facab2d8

SHA256
daf1c68405383196aa3bbc8fb0f851c7ba3bc2134947083d96283924a9daf8b9

SHA512
6c2404ff1f223582c37cf9d17e8873a0f1044d6bbbdf64ec9f78dfbfc0092015cd34186fa48a38d782d9d7bf27503d6703ae5e0794353ec4d46d981ab7b76c8f

Download Submit
memory/436-157-0x00007FF633FA0000-0x00007FF634392000-memory.dmp

Filesize
3.9MB

Download
memory/436-2170-0x00007FF633FA0000-0x00007FF634392000-memory.dmp

Filesize
3.9MB

Download
memory/640-158-0x00007FF6EA380000-0x00007FF6EA772000-memory.dmp

Filesize
3.9MB

Download
memory/684-133-0x00007FF6EF9F0000-0x00007FF6EFDE2000-memory.dmp

Filesize
3.9MB

Download
memory/684-2134-0x00007FF6EF9F0000-0x00007FF6EFDE2000-memory.dmp

Filesize
3.9MB

Download
memory/832-154-0x00007FF63EA60000-0x00007FF63EE52000-memory.dmp

Filesize
3.9MB

Download
memory/832-2147-0x00007FF63EA60000-0x00007FF63EE52000-memory.dmp

Filesize
3.9MB

Download
memory/900-2143-0x00007FF6645A0000-0x00007FF664992000-memory.dmp

Filesize
3.9MB

Download
memory/900-156-0x00007FF6645A0000-0x00007FF664992000-memory.dmp

Filesize
3.9MB

Download
memory/924-147-0x00007FF660080000-0x00007FF660472000-memory.dmp

Filesize
3.9MB

Download
memory/1080-2159-0x00007FF6A35A0000-0x00007FF6A3992000-memory.dmp

Filesize
3.9MB

Download
memory/1080-151-0x00007FF6A35A0000-0x00007FF6A3992000-memory.dmp

Filesize
3.9MB

Download
memory/1188-92-0x00007FF61DA80000-0x00007FF61DE72000-memory.dmp

Filesize
3.9MB

Download
memory/1192-2153-0x00007FF625DE0000-0x00007FF6261D2000-memory.dmp

Filesize
3.9MB

Download
memory/1192-150-0x00007FF625DE0000-0x00007FF6261D2000-memory.dmp

Filesize
3.9MB

Download
memory/1376-75-0x00007FF66E0D0000-0x00007FF66E4C2000-memory.dmp

Filesize
3.9MB

Download
memory/1376-2145-0x00007FF66E0D0000-0x00007FF66E4C2000-memory.dmp

Filesize
3.9MB

Download
memory/1668-2165-0x00007FF7B1070000-0x00007FF7B1462000-memory.dmp

Filesize
3.9MB

Download
memory/1668-51-0x00007FF7B1070000-0x00007FF7B1462000-memory.dmp

Filesize
3.9MB

Download
memory/1892-148-0x00007FF77EFC0000-0x00007FF77F3B2000-memory.dmp

Filesize
3.9MB

Download
memory/1892-2216-0x00007FF77EFC0000-0x00007FF77F3B2000-memory.dmp

Filesize
3.9MB

Download
memory/2176-155-0x00007FF6FB7E0000-0x00007FF6FBBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2176-2139-0x00007FF6FB7E0000-0x00007FF6FBBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2236-18-0x00007FF753690000-0x00007FF753A82000-memory.dmp

Filesize
3.9MB

Download
memory/2236-2162-0x00007FF753690000-0x00007FF753A82000-memory.dmp

Filesize
3.9MB

Download
memory/2644-41-0x00007FF7AB090000-0x00007FF7AB482000-memory.dmp

Filesize
3.9MB

Download
memory/2644-2160-0x00007FF7AB090000-0x00007FF7AB482000-memory.dmp

Filesize
3.9MB

Download
memory/3084-2149-0x00007FF7DEB30000-0x00007FF7DEF22000-memory.dmp

Filesize
3.9MB

Download
memory/3084-153-0x00007FF7DEB30000-0x00007FF7DEF22000-memory.dmp

Filesize
3.9MB

Download
memory/3104-146-0x00007FF60F650000-0x00007FF60FA42000-memory.dmp

Filesize
3.9MB

Download
memory/3508-141-0x00007FF681060000-0x00007FF681452000-memory.dmp

Filesize
3.9MB

Download
memory/3652-2136-0x00007FF6459B0000-0x00007FF645DA2000-memory.dmp

Filesize
3.9MB

Download
memory/3652-98-0x00007FF6459B0000-0x00007FF645DA2000-memory.dmp

Filesize
3.9MB

Download
memory/3668-27-0x00007FF702D60000-0x00007FF703152000-memory.dmp

Filesize
3.9MB

Download
memory/3668-2208-0x00007FF702D60000-0x00007FF703152000-memory.dmp

Filesize
3.9MB

Download
memory/3980-131-0x000001FF35130000-0x000001FF35152000-memory.dmp

Filesize
136KB

Download
memory/3980-149-0x00007FFE6DE93000-0x00007FFE6DE95000-memory.dmp

Filesize
8KB

Download
memory/3980-19-0x000001FF35210000-0x000001FF35220000-memory.dmp

Filesize
64KB

Download
memory/3980-20-0x000001FF35210000-0x000001FF35220000-memory.dmp

Filesize
64KB

Download
memory/3980-1143-0x000001FF37E80000-0x000001FF38626000-memory.dmp

Filesize
7.6MB

Download
memory/4508-2151-0x00007FF6F2EC0000-0x00007FF6F32B2000-memory.dmp

Filesize
3.9MB

Download
memory/4508-152-0x00007FF6F2EC0000-0x00007FF6F32B2000-memory.dmp

Filesize
3.9MB

Download
memory/4740-2157-0x00007FF7A2730000-0x00007FF7A2B22000-memory.dmp

Filesize
3.9MB

Download
memory/4740-59-0x00007FF7A2730000-0x00007FF7A2B22000-memory.dmp

Filesize
3.9MB

Download
memory/4848-0-0x00007FF6CE620000-0x00007FF6CEA12000-memory.dmp

Filesize
3.9MB

Download
memory/4848-1-0x000001CA87070000-0x000001CA87080000-memory.dmp

Filesize
64KB

Download
memory/4932-72-0x00007FF704770000-0x00007FF704B62000-memory.dmp

Filesize
3.9MB

Download
memory/4932-2155-0x00007FF704770000-0x00007FF704B62000-memory.dmp

Filesize
3.9MB

Download
memory/5116-2141-0x00007FF766A60000-0x00007FF766E52000-memory.dmp

Filesize
3.9MB

Download
memory/5116-115-0x00007FF766A60000-0x00007FF766E52000-memory.dmp

Filesize
3.9MB

Download