xmrig | 3c6b09f8c486c812cd4c77f4a30660aab7a1b8d0dd93b6377037357eba86bb25

Analysis

max time kernel
22s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
Size

1.3MB
MD5

1fb57d036bbee6902c17193afe015ed3
SHA1

b99aee472efadc0c4528813c540a960906bc3692
SHA256

3c6b09f8c486c812cd4c77f4a30660aab7a1b8d0dd93b6377037357eba86bb25
SHA512

ab19e6ab5e2bd0fe59cfbf0078ce5f0d53e7dabbbd9545e09e55c2323fed0171cf14c4607c4bf515565fbcc135cc3749f35029e97cca00a4cb4cd81bf291937c
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/Vxf:Lz071uv4BPMkibTIA5CJB

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral2/memory/3592-126-0x00007FF73FC90000-0x00007FF740082000-memory.dmp	xmrig
behavioral2/memory/3620-142-0x00007FF77B040000-0x00007FF77B432000-memory.dmp	xmrig
behavioral2/memory/1708-156-0x00007FF726AD0000-0x00007FF726EC2000-memory.dmp	xmrig
behavioral2/memory/4996-163-0x00007FF660230000-0x00007FF660622000-memory.dmp	xmrig
behavioral2/memory/3404-2117-0x00007FF626BD0000-0x00007FF626FC2000-memory.dmp	xmrig
behavioral2/memory/4960-168-0x00007FF7E64E0000-0x00007FF7E68D2000-memory.dmp	xmrig
behavioral2/memory/3740-167-0x00007FF6B3C90000-0x00007FF6B4082000-memory.dmp	xmrig
behavioral2/memory/4588-161-0x00007FF7C41F0000-0x00007FF7C45E2000-memory.dmp	xmrig
behavioral2/memory/2404-157-0x00007FF6185A0000-0x00007FF618992000-memory.dmp	xmrig
behavioral2/memory/2544-155-0x00007FF623C30000-0x00007FF624022000-memory.dmp	xmrig
behavioral2/memory/4420-154-0x00007FF69EB60000-0x00007FF69EF52000-memory.dmp	xmrig
behavioral2/memory/4312-143-0x00007FF6ED780000-0x00007FF6EDB72000-memory.dmp	xmrig
behavioral2/memory/3152-138-0x00007FF727F00000-0x00007FF7282F2000-memory.dmp	xmrig
behavioral2/memory/4668-131-0x00007FF7F5310000-0x00007FF7F5702000-memory.dmp	xmrig
behavioral2/memory/3088-124-0x00007FF691770000-0x00007FF691B62000-memory.dmp	xmrig
behavioral2/memory/1520-109-0x00007FF6077F0000-0x00007FF607BE2000-memory.dmp	xmrig
behavioral2/memory/4940-99-0x00007FF7141B0000-0x00007FF7145A2000-memory.dmp	xmrig
behavioral2/memory/1264-92-0x00007FF6A7660000-0x00007FF6A7A52000-memory.dmp	xmrig
behavioral2/memory/3404-86-0x00007FF626BD0000-0x00007FF626FC2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1688	powershell.exe
9	1688	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1688	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3160	zRmlVlF.exe
4016	PVtRwKr.exe
404	hZZwuCQ.exe
2724	mIhxttk.exe
3404	OHlcKqu.exe
4420	yiCMohT.exe
1264	XrdGsPE.exe
4940	KcPDtyh.exe
1520	gmXcEGu.exe
2544	JxNzZsL.exe
3088	bOTvviU.exe
3592	vKRdXJH.exe
4668	jeKVmwc.exe
1708	TmNiPPy.exe
2404	WzUZHhp.exe
3152	uzvjdKZ.exe
4588	hNCwTVh.exe
4996	cvFXCrl.exe
3620	qWqjoaO.exe
4312	oYiVgkN.exe
2852	eJvmyBg.exe
3740	AyYhPAd.exe
2224	XAqUGby.exe
4960	tmPYojT.exe
2444	tCkyhrR.exe
1344	JEhfUjT.exe
4400	EOsLYdT.exe
4036	BByhmfs.exe
5024	FIZRsSs.exe
2520	FDzAsqq.exe
3556	tzNdIgQ.exe
1432	fgnNHSb.exe
712	TvjtYzY.exe
4568	LXsGAEC.exe
1576	yfOmrMe.exe
3752	lBwpGvB.exe
764	ZOeRccq.exe
3344	Uremkwk.exe
4488	kKdRegX.exe
4068	WrhZXIy.exe
2800	nmyfLlm.exe
1436	wQxuhdc.exe
32	kyHpgYO.exe
212	MRALBMr.exe
2180	LUhoINc.exe
2236	PNihIgs.exe
5064	ANdyKmP.exe
3372	rwWlEWf.exe
3604	zYhNzEc.exe
1076	JNNNzAv.exe
5124	OJxLEdU.exe
5144	aeFpkfB.exe
5260	IoyjvOc.exe
5288	iPquUnz.exe
5316	zsvTYss.exe
5332	OxeWjgD.exe
5356	mBSbSki.exe
5400	uYOBrFM.exe
5416	vsdhrxQ.exe
5432	dYwRxYq.exe
5456	eKqtgCT.exe
5488	qfTXdZJ.exe
5548	bSwVtSq.exe
5564	XwQgNQZ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2332-0-0x00007FF7DFA60000-0x00007FF7DFE52000-memory.dmp	upx
behavioral2/files/0x000800000002324f-5.dat	upx
behavioral2/files/0x0008000000023252-9.dat	upx
behavioral2/memory/3160-10-0x00007FF647B10000-0x00007FF647F02000-memory.dmp	upx
behavioral2/files/0x0008000000023256-7.dat	upx
behavioral2/files/0x0008000000023257-22.dat	upx
behavioral2/files/0x0007000000023258-31.dat	upx
behavioral2/files/0x0007000000023259-35.dat	upx
behavioral2/memory/2724-29-0x00007FF720E10000-0x00007FF721202000-memory.dmp	upx
behavioral2/memory/404-20-0x00007FF6001E0000-0x00007FF6005D2000-memory.dmp	upx
behavioral2/memory/4016-16-0x00007FF602A70000-0x00007FF602E62000-memory.dmp	upx
behavioral2/files/0x000700000002325a-51.dat	upx
behavioral2/files/0x0008000000023253-56.dat	upx
behavioral2/files/0x000700000002325f-75.dat	upx
behavioral2/files/0x000700000002325e-74.dat	upx
behavioral2/files/0x0007000000023262-95.dat	upx
behavioral2/files/0x0007000000023263-100.dat	upx
behavioral2/memory/3592-126-0x00007FF73FC90000-0x00007FF740082000-memory.dmp	upx
behavioral2/files/0x0007000000023269-136.dat	upx
behavioral2/memory/3620-142-0x00007FF77B040000-0x00007FF77B432000-memory.dmp	upx
behavioral2/memory/2224-147-0x00007FF7681A0000-0x00007FF768592000-memory.dmp	upx
behavioral2/files/0x000700000002326a-151.dat	upx
behavioral2/files/0x000700000002326b-149.dat	upx
behavioral2/memory/1708-156-0x00007FF726AD0000-0x00007FF726EC2000-memory.dmp	upx
behavioral2/memory/4996-163-0x00007FF660230000-0x00007FF660622000-memory.dmp	upx
behavioral2/files/0x000700000002326f-185.dat	upx
behavioral2/files/0x0007000000023271-192.dat	upx
behavioral2/files/0x0007000000023271-191.dat	upx
behavioral2/files/0x0007000000023272-196.dat	upx
behavioral2/files/0x0007000000023270-187.dat	upx
behavioral2/memory/4016-2113-0x00007FF602A70000-0x00007FF602E62000-memory.dmp	upx
behavioral2/memory/404-2115-0x00007FF6001E0000-0x00007FF6005D2000-memory.dmp	upx
behavioral2/memory/3404-2117-0x00007FF626BD0000-0x00007FF626FC2000-memory.dmp	upx
behavioral2/memory/4420-2119-0x00007FF69EB60000-0x00007FF69EF52000-memory.dmp	upx
behavioral2/memory/2724-2114-0x00007FF720E10000-0x00007FF721202000-memory.dmp	upx
behavioral2/memory/3160-2111-0x00007FF647B10000-0x00007FF647F02000-memory.dmp	upx
behavioral2/memory/1264-2121-0x00007FF6A7660000-0x00007FF6A7A52000-memory.dmp	upx
behavioral2/memory/4940-2153-0x00007FF7141B0000-0x00007FF7145A2000-memory.dmp	upx
behavioral2/memory/1708-2197-0x00007FF726AD0000-0x00007FF726EC2000-memory.dmp	upx
behavioral2/memory/3152-2223-0x00007FF727F00000-0x00007FF7282F2000-memory.dmp	upx
behavioral2/memory/4312-2343-0x00007FF6ED780000-0x00007FF6EDB72000-memory.dmp	upx
behavioral2/memory/4960-2340-0x00007FF7E64E0000-0x00007FF7E68D2000-memory.dmp	upx
behavioral2/memory/4996-2228-0x00007FF660230000-0x00007FF660622000-memory.dmp	upx
behavioral2/memory/2404-2220-0x00007FF6185A0000-0x00007FF618992000-memory.dmp	upx
behavioral2/memory/4588-2214-0x00007FF7C41F0000-0x00007FF7C45E2000-memory.dmp	upx
behavioral2/memory/4668-2196-0x00007FF7F5310000-0x00007FF7F5702000-memory.dmp	upx
behavioral2/memory/3088-2193-0x00007FF691770000-0x00007FF691B62000-memory.dmp	upx
behavioral2/memory/3592-2191-0x00007FF73FC90000-0x00007FF740082000-memory.dmp	upx
behavioral2/memory/2544-2186-0x00007FF623C30000-0x00007FF624022000-memory.dmp	upx
behavioral2/memory/1520-2161-0x00007FF6077F0000-0x00007FF607BE2000-memory.dmp	upx
behavioral2/files/0x000700000002326e-177.dat	upx
behavioral2/files/0x000700000002326d-172.dat	upx
behavioral2/memory/4960-168-0x00007FF7E64E0000-0x00007FF7E68D2000-memory.dmp	upx
behavioral2/memory/3740-167-0x00007FF6B3C90000-0x00007FF6B4082000-memory.dmp	upx
behavioral2/files/0x000700000002326c-165.dat	upx
behavioral2/memory/2852-164-0x00007FF786030000-0x00007FF786422000-memory.dmp	upx
behavioral2/memory/4588-161-0x00007FF7C41F0000-0x00007FF7C45E2000-memory.dmp	upx
behavioral2/memory/2404-157-0x00007FF6185A0000-0x00007FF618992000-memory.dmp	upx
behavioral2/memory/2544-155-0x00007FF623C30000-0x00007FF624022000-memory.dmp	upx
behavioral2/memory/4420-154-0x00007FF69EB60000-0x00007FF69EF52000-memory.dmp	upx
behavioral2/files/0x0007000000023268-145.dat	upx
behavioral2/memory/4312-143-0x00007FF6ED780000-0x00007FF6EDB72000-memory.dmp	upx
behavioral2/memory/3152-138-0x00007FF727F00000-0x00007FF7282F2000-memory.dmp	upx
behavioral2/memory/4668-131-0x00007FF7F5310000-0x00007FF7F5702000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ySUbbVR.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\MRYfFmt.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\EpKLfxQ.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\NtpUDaO.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\kyHpgYO.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\LUhoINc.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\HYfayNI.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\aShVdMe.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\KOMfVJq.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\flnsHAh.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\XrdGsPE.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\ZDdSeEo.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\uYOBrFM.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\ZcWTCON.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\ooaHmvr.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\grHcKro.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\eJvmyBg.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\zYhNzEc.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\HbYaCWg.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\zPoBlny.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\PDZXqQA.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\pfUxqIc.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\iBAliLO.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\mkqkaus.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\OdwuCan.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\oFbnMpw.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\dYwRxYq.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\kmMUrYc.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\ggxfXEz.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\HnSqfzl.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\Dlfvess.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\hZZwuCQ.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\OKmvOfz.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\GgbjBYL.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\FBoZlBm.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\ruggSFl.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\bcOQoXe.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\IqHwcpH.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\eKqtgCT.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\QrwdoCr.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\lcLvHsR.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\zaZsJMn.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\jeKVmwc.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\CLNkXQG.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\GsDiKSr.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\hhuYJpL.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\eVPTvtC.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\rFsvBtg.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\yzbFCMr.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\yiXkDxG.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\FWPlctC.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\tzNdIgQ.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\Elzffia.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\zsvTYss.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\UlGJJcz.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\cWqRHGw.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\NFJSVhS.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\neUkQKo.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\dRXKWlA.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\tCkyhrR.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\aeFpkfB.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\ZKUvdTj.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\MRALBMr.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
File created	C:\Windows\System\qfTXdZJ.exe	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1688	powershell.exe
1688	powershell.exe
1688	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeLockMemoryPrivilege	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1688	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	93
PID 2332 wrote to memory of 1688	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	93
PID 2332 wrote to memory of 3160	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	94
PID 2332 wrote to memory of 3160	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	94
PID 2332 wrote to memory of 4016	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	95
PID 2332 wrote to memory of 4016	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	95
PID 2332 wrote to memory of 404	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	96
PID 2332 wrote to memory of 404	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	96
PID 2332 wrote to memory of 2724	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	97
PID 2332 wrote to memory of 2724	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	97
PID 2332 wrote to memory of 3404	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	98
PID 2332 wrote to memory of 3404	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	98
PID 2332 wrote to memory of 4420	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	99
PID 2332 wrote to memory of 4420	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	99
PID 2332 wrote to memory of 1264	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	100
PID 2332 wrote to memory of 1264	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	100
PID 2332 wrote to memory of 4940	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	101
PID 2332 wrote to memory of 4940	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	101
PID 2332 wrote to memory of 1520	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	102
PID 2332 wrote to memory of 1520	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	102
PID 2332 wrote to memory of 2544	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	103
PID 2332 wrote to memory of 2544	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	103
PID 2332 wrote to memory of 3088	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	104
PID 2332 wrote to memory of 3088	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	104
PID 2332 wrote to memory of 3592	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	105
PID 2332 wrote to memory of 3592	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	105
PID 2332 wrote to memory of 4668	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	106
PID 2332 wrote to memory of 4668	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	106
PID 2332 wrote to memory of 2404	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	107
PID 2332 wrote to memory of 2404	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	107
PID 2332 wrote to memory of 1708	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	108
PID 2332 wrote to memory of 1708	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	108
PID 2332 wrote to memory of 3152	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	109
PID 2332 wrote to memory of 3152	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	109
PID 2332 wrote to memory of 4588	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	110
PID 2332 wrote to memory of 4588	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	110
PID 2332 wrote to memory of 4996	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	111
PID 2332 wrote to memory of 4996	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	111
PID 2332 wrote to memory of 3620	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	112
PID 2332 wrote to memory of 3620	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	112
PID 2332 wrote to memory of 4312	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	113
PID 2332 wrote to memory of 4312	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	113
PID 2332 wrote to memory of 2852	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	114
PID 2332 wrote to memory of 2852	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	114
PID 2332 wrote to memory of 3740	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	115
PID 2332 wrote to memory of 3740	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	115
PID 2332 wrote to memory of 2224	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	116
PID 2332 wrote to memory of 2224	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	116
PID 2332 wrote to memory of 4960	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	117
PID 2332 wrote to memory of 4960	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	117
PID 2332 wrote to memory of 2444	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	118
PID 2332 wrote to memory of 2444	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	118
PID 2332 wrote to memory of 1344	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	119
PID 2332 wrote to memory of 1344	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	119
PID 2332 wrote to memory of 4400	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	120
PID 2332 wrote to memory of 4400	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	120
PID 2332 wrote to memory of 4036	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	121
PID 2332 wrote to memory of 4036	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	121
PID 2332 wrote to memory of 5024	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	122
PID 2332 wrote to memory of 5024	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	122
PID 2332 wrote to memory of 2520	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	123
PID 2332 wrote to memory of 2520	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	123
PID 2332 wrote to memory of 3556	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	124
PID 2332 wrote to memory of 3556	2332	1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe	124

C:\Users\Admin\AppData\Local\Temp\1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1fb57d036bbee6902c17193afe015ed3_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1688
- C:\Windows\System\zRmlVlF.exe
  C:\Windows\System\zRmlVlF.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\PVtRwKr.exe
  C:\Windows\System\PVtRwKr.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\hZZwuCQ.exe
  C:\Windows\System\hZZwuCQ.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\mIhxttk.exe
  C:\Windows\System\mIhxttk.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\OHlcKqu.exe
  C:\Windows\System\OHlcKqu.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\yiCMohT.exe
  C:\Windows\System\yiCMohT.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\XrdGsPE.exe
  C:\Windows\System\XrdGsPE.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\KcPDtyh.exe
  C:\Windows\System\KcPDtyh.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\gmXcEGu.exe
  C:\Windows\System\gmXcEGu.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\JxNzZsL.exe
  C:\Windows\System\JxNzZsL.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\bOTvviU.exe
  C:\Windows\System\bOTvviU.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\vKRdXJH.exe
  C:\Windows\System\vKRdXJH.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\jeKVmwc.exe
  C:\Windows\System\jeKVmwc.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\WzUZHhp.exe
  C:\Windows\System\WzUZHhp.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\TmNiPPy.exe
  C:\Windows\System\TmNiPPy.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\uzvjdKZ.exe
  C:\Windows\System\uzvjdKZ.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\hNCwTVh.exe
  C:\Windows\System\hNCwTVh.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\cvFXCrl.exe
  C:\Windows\System\cvFXCrl.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\qWqjoaO.exe
  C:\Windows\System\qWqjoaO.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\oYiVgkN.exe
  C:\Windows\System\oYiVgkN.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\eJvmyBg.exe
  C:\Windows\System\eJvmyBg.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\AyYhPAd.exe
  C:\Windows\System\AyYhPAd.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\XAqUGby.exe
  C:\Windows\System\XAqUGby.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\tmPYojT.exe
  C:\Windows\System\tmPYojT.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\tCkyhrR.exe
  C:\Windows\System\tCkyhrR.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\JEhfUjT.exe
  C:\Windows\System\JEhfUjT.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\EOsLYdT.exe
  C:\Windows\System\EOsLYdT.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\BByhmfs.exe
  C:\Windows\System\BByhmfs.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\FIZRsSs.exe
  C:\Windows\System\FIZRsSs.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\FDzAsqq.exe
  C:\Windows\System\FDzAsqq.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\tzNdIgQ.exe
  C:\Windows\System\tzNdIgQ.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\fgnNHSb.exe
  C:\Windows\System\fgnNHSb.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\TvjtYzY.exe
  C:\Windows\System\TvjtYzY.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\LXsGAEC.exe
  C:\Windows\System\LXsGAEC.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\yfOmrMe.exe
  C:\Windows\System\yfOmrMe.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\lBwpGvB.exe
  C:\Windows\System\lBwpGvB.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\ZOeRccq.exe
  C:\Windows\System\ZOeRccq.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\Uremkwk.exe
  C:\Windows\System\Uremkwk.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\kKdRegX.exe
  C:\Windows\System\kKdRegX.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\WrhZXIy.exe
  C:\Windows\System\WrhZXIy.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\nmyfLlm.exe
  C:\Windows\System\nmyfLlm.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\wQxuhdc.exe
  C:\Windows\System\wQxuhdc.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\kyHpgYO.exe
  C:\Windows\System\kyHpgYO.exe
  2⤵
  - Executes dropped EXE
  PID:32
- C:\Windows\System\MRALBMr.exe
  C:\Windows\System\MRALBMr.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\LUhoINc.exe
  C:\Windows\System\LUhoINc.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\PNihIgs.exe
  C:\Windows\System\PNihIgs.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\ANdyKmP.exe
  C:\Windows\System\ANdyKmP.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\rwWlEWf.exe
  C:\Windows\System\rwWlEWf.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\zYhNzEc.exe
  C:\Windows\System\zYhNzEc.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\JNNNzAv.exe
  C:\Windows\System\JNNNzAv.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\OJxLEdU.exe
  C:\Windows\System\OJxLEdU.exe
  2⤵
  - Executes dropped EXE
  PID:5124
- C:\Windows\System\aeFpkfB.exe
  C:\Windows\System\aeFpkfB.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\IoyjvOc.exe
  C:\Windows\System\IoyjvOc.exe
  2⤵
  - Executes dropped EXE
  PID:5260
- C:\Windows\System\iPquUnz.exe
  C:\Windows\System\iPquUnz.exe
  2⤵
  - Executes dropped EXE
  PID:5288
- C:\Windows\System\zsvTYss.exe
  C:\Windows\System\zsvTYss.exe
  2⤵
  - Executes dropped EXE
  PID:5316
- C:\Windows\System\OxeWjgD.exe
  C:\Windows\System\OxeWjgD.exe
  2⤵
  - Executes dropped EXE
  PID:5332
- C:\Windows\System\mBSbSki.exe
  C:\Windows\System\mBSbSki.exe
  2⤵
  - Executes dropped EXE
  PID:5356
- C:\Windows\System\uYOBrFM.exe
  C:\Windows\System\uYOBrFM.exe
  2⤵
  - Executes dropped EXE
  PID:5400
- C:\Windows\System\vsdhrxQ.exe
  C:\Windows\System\vsdhrxQ.exe
  2⤵
  - Executes dropped EXE
  PID:5416
- C:\Windows\System\dYwRxYq.exe
  C:\Windows\System\dYwRxYq.exe
  2⤵
  - Executes dropped EXE
  PID:5432
- C:\Windows\System\eKqtgCT.exe
  C:\Windows\System\eKqtgCT.exe
  2⤵
  - Executes dropped EXE
  PID:5456
- C:\Windows\System\qfTXdZJ.exe
  C:\Windows\System\qfTXdZJ.exe
  2⤵
  - Executes dropped EXE
  PID:5488
- C:\Windows\System\bSwVtSq.exe
  C:\Windows\System\bSwVtSq.exe
  2⤵
  - Executes dropped EXE
  PID:5548
- C:\Windows\System\XwQgNQZ.exe
  C:\Windows\System\XwQgNQZ.exe
  2⤵
  - Executes dropped EXE
  PID:5564
- C:\Windows\System\HnSqfzl.exe
  C:\Windows\System\HnSqfzl.exe
  2⤵
  PID:5584
- C:\Windows\System\fOneBAg.exe
  C:\Windows\System\fOneBAg.exe
  2⤵
  PID:5604
- C:\Windows\System\fftzpmf.exe
  C:\Windows\System\fftzpmf.exe
  2⤵
  PID:5620
- C:\Windows\System\kzOFQmi.exe
  C:\Windows\System\kzOFQmi.exe
  2⤵
  PID:5640
- C:\Windows\System\rFsvBtg.exe
  C:\Windows\System\rFsvBtg.exe
  2⤵
  PID:5656
- C:\Windows\System\kmMUrYc.exe
  C:\Windows\System\kmMUrYc.exe
  2⤵
  PID:5672
- C:\Windows\System\sGDzmEj.exe
  C:\Windows\System\sGDzmEj.exe
  2⤵
  PID:5692
- C:\Windows\System\IFFPDcd.exe
  C:\Windows\System\IFFPDcd.exe
  2⤵
  PID:5744
- C:\Windows\System\ySUbbVR.exe
  C:\Windows\System\ySUbbVR.exe
  2⤵
  PID:5816
- C:\Windows\System\lbOAjxB.exe
  C:\Windows\System\lbOAjxB.exe
  2⤵
  PID:5868
- C:\Windows\System\sMgJIFa.exe
  C:\Windows\System\sMgJIFa.exe
  2⤵
  PID:5896
- C:\Windows\System\MRYfFmt.exe
  C:\Windows\System\MRYfFmt.exe
  2⤵
  PID:5920
- C:\Windows\System\OjwjPdn.exe
  C:\Windows\System\OjwjPdn.exe
  2⤵
  PID:5952
- C:\Windows\System\ZDdSeEo.exe
  C:\Windows\System\ZDdSeEo.exe
  2⤵
  PID:5972
- C:\Windows\System\bcOQoXe.exe
  C:\Windows\System\bcOQoXe.exe
  2⤵
  PID:5992
- C:\Windows\System\pSQEUFC.exe
  C:\Windows\System\pSQEUFC.exe
  2⤵
  PID:6008
- C:\Windows\System\uOJnCpB.exe
  C:\Windows\System\uOJnCpB.exe
  2⤵
  PID:6044
- C:\Windows\System\IqHwcpH.exe
  C:\Windows\System\IqHwcpH.exe
  2⤵
  PID:6080
- C:\Windows\System\PDZXqQA.exe
  C:\Windows\System\PDZXqQA.exe
  2⤵
  PID:6120
- C:\Windows\System\CLNkXQG.exe
  C:\Windows\System\CLNkXQG.exe
  2⤵
  PID:5020
- C:\Windows\System\rgVUxbx.exe
  C:\Windows\System\rgVUxbx.exe
  2⤵
  PID:940
- C:\Windows\System\edZFCRO.exe
  C:\Windows\System\edZFCRO.exe
  2⤵
  PID:4556
- C:\Windows\System\JGRLKKG.exe
  C:\Windows\System\JGRLKKG.exe
  2⤵
  PID:1844
- C:\Windows\System\ggxfXEz.exe
  C:\Windows\System\ggxfXEz.exe
  2⤵
  PID:4224
- C:\Windows\System\VhpwfwV.exe
  C:\Windows\System\VhpwfwV.exe
  2⤵
  PID:2320
- C:\Windows\System\fAKBVhz.exe
  C:\Windows\System\fAKBVhz.exe
  2⤵
  PID:5152
- C:\Windows\System\rSKRIoa.exe
  C:\Windows\System\rSKRIoa.exe
  2⤵
  PID:4300
- C:\Windows\System\EpWFimg.exe
  C:\Windows\System\EpWFimg.exe
  2⤵
  PID:5308
- C:\Windows\System\oiMyuzU.exe
  C:\Windows\System\oiMyuzU.exe
  2⤵
  PID:948
- C:\Windows\System\FPpWtrC.exe
  C:\Windows\System\FPpWtrC.exe
  2⤵
  PID:5248
- C:\Windows\System\VrJYTxs.exe
  C:\Windows\System\VrJYTxs.exe
  2⤵
  PID:4660
- C:\Windows\System\yzbFCMr.exe
  C:\Windows\System\yzbFCMr.exe
  2⤵
  PID:5556
- C:\Windows\System\TdAjeiy.exe
  C:\Windows\System\TdAjeiy.exe
  2⤵
  PID:5592
- C:\Windows\System\iBAliLO.exe
  C:\Windows\System\iBAliLO.exe
  2⤵
  PID:5632
- C:\Windows\System\gytKnWM.exe
  C:\Windows\System\gytKnWM.exe
  2⤵
  PID:4288
- C:\Windows\System\XrbqWxq.exe
  C:\Windows\System\XrbqWxq.exe
  2⤵
  PID:5736
- C:\Windows\System\UHNXOvx.exe
  C:\Windows\System\UHNXOvx.exe
  2⤵
  PID:5780
- C:\Windows\System\pfUxqIc.exe
  C:\Windows\System\pfUxqIc.exe
  2⤵
  PID:5804
- C:\Windows\System\aqrcWcm.exe
  C:\Windows\System\aqrcWcm.exe
  2⤵
  PID:5932
- C:\Windows\System\okySKoS.exe
  C:\Windows\System\okySKoS.exe
  2⤵
  PID:3876
- C:\Windows\System\VPdJkOd.exe
  C:\Windows\System\VPdJkOd.exe
  2⤵
  PID:6088
- C:\Windows\System\HYfayNI.exe
  C:\Windows\System\HYfayNI.exe
  2⤵
  PID:6112
- C:\Windows\System\fuAigDB.exe
  C:\Windows\System\fuAigDB.exe
  2⤵
  PID:6128
- C:\Windows\System\yeyTRsm.exe
  C:\Windows\System\yeyTRsm.exe
  2⤵
  PID:1828
- C:\Windows\System\VKKfGDm.exe
  C:\Windows\System\VKKfGDm.exe
  2⤵
  PID:5364
- C:\Windows\System\OXLkJlL.exe
  C:\Windows\System\OXLkJlL.exe
  2⤵
  PID:5324
- C:\Windows\System\KGvrcmt.exe
  C:\Windows\System\KGvrcmt.exe
  2⤵
  PID:5424
- C:\Windows\System\fZzxecZ.exe
  C:\Windows\System\fZzxecZ.exe
  2⤵
  PID:5140
- C:\Windows\System\PkOfaEf.exe
  C:\Windows\System\PkOfaEf.exe
  2⤵
  PID:4404
- C:\Windows\System\ZcWTCON.exe
  C:\Windows\System\ZcWTCON.exe
  2⤵
  PID:5732
- C:\Windows\System\vLWEjkR.exe
  C:\Windows\System\vLWEjkR.exe
  2⤵
  PID:5824
- C:\Windows\System\WdJprIw.exe
  C:\Windows\System\WdJprIw.exe
  2⤵
  PID:5892
- C:\Windows\System\vdEctbn.exe
  C:\Windows\System\vdEctbn.exe
  2⤵
  PID:228
- C:\Windows\System\AWwzXsu.exe
  C:\Windows\System\AWwzXsu.exe
  2⤵
  PID:1552
- C:\Windows\System\mkqkaus.exe
  C:\Windows\System\mkqkaus.exe
  2⤵
  PID:5572
- C:\Windows\System\VkXjbnT.exe
  C:\Windows\System\VkXjbnT.exe
  2⤵
  PID:5704
- C:\Windows\System\OKmvOfz.exe
  C:\Windows\System\OKmvOfz.exe
  2⤵
  PID:6064
- C:\Windows\System\PLlSSvl.exe
  C:\Windows\System\PLlSSvl.exe
  2⤵
  PID:5100
- C:\Windows\System\vqPaHgx.exe
  C:\Windows\System\vqPaHgx.exe
  2⤵
  PID:4764
- C:\Windows\System\Elzffia.exe
  C:\Windows\System\Elzffia.exe
  2⤵
  PID:4704
- C:\Windows\System\RpnEXoy.exe
  C:\Windows\System\RpnEXoy.exe
  2⤵
  PID:6152
- C:\Windows\System\OwEMzcJ.exe
  C:\Windows\System\OwEMzcJ.exe
  2⤵
  PID:6168
- C:\Windows\System\mSOjwYt.exe
  C:\Windows\System\mSOjwYt.exe
  2⤵
  PID:6192
- C:\Windows\System\QdALbBn.exe
  C:\Windows\System\QdALbBn.exe
  2⤵
  PID:6212
- C:\Windows\System\GxUIhCP.exe
  C:\Windows\System\GxUIhCP.exe
  2⤵
  PID:6236
- C:\Windows\System\ekdKjoY.exe
  C:\Windows\System\ekdKjoY.exe
  2⤵
  PID:6268
- C:\Windows\System\darcRBx.exe
  C:\Windows\System\darcRBx.exe
  2⤵
  PID:6284
- C:\Windows\System\Fpeqngx.exe
  C:\Windows\System\Fpeqngx.exe
  2⤵
  PID:6304
- C:\Windows\System\TRkVSPw.exe
  C:\Windows\System\TRkVSPw.exe
  2⤵
  PID:6320
- C:\Windows\System\VRgLWYO.exe
  C:\Windows\System\VRgLWYO.exe
  2⤵
  PID:6340
- C:\Windows\System\OAoVFPr.exe
  C:\Windows\System\OAoVFPr.exe
  2⤵
  PID:6356
- C:\Windows\System\yzQNnFw.exe
  C:\Windows\System\yzQNnFw.exe
  2⤵
  PID:6372
- C:\Windows\System\xorPukN.exe
  C:\Windows\System\xorPukN.exe
  2⤵
  PID:6392
- C:\Windows\System\yiXkDxG.exe
  C:\Windows\System\yiXkDxG.exe
  2⤵
  PID:6408
- C:\Windows\System\hbuhofv.exe
  C:\Windows\System\hbuhofv.exe
  2⤵
  PID:6424
- C:\Windows\System\LwuuvUp.exe
  C:\Windows\System\LwuuvUp.exe
  2⤵
  PID:6440
- C:\Windows\System\AyLDSZV.exe
  C:\Windows\System\AyLDSZV.exe
  2⤵
  PID:6644
- C:\Windows\System\ZKUvdTj.exe
  C:\Windows\System\ZKUvdTj.exe
  2⤵
  PID:6660
- C:\Windows\System\QltVJDy.exe
  C:\Windows\System\QltVJDy.exe
  2⤵
  PID:6680
- C:\Windows\System\nuibtHx.exe
  C:\Windows\System\nuibtHx.exe
  2⤵
  PID:6696
- C:\Windows\System\FWPlctC.exe
  C:\Windows\System\FWPlctC.exe
  2⤵
  PID:6720
- C:\Windows\System\EpKLfxQ.exe
  C:\Windows\System\EpKLfxQ.exe
  2⤵
  PID:6736
- C:\Windows\System\kdIJWME.exe
  C:\Windows\System\kdIJWME.exe
  2⤵
  PID:6756
- C:\Windows\System\UmKcxin.exe
  C:\Windows\System\UmKcxin.exe
  2⤵
  PID:6772
- C:\Windows\System\TwYYPot.exe
  C:\Windows\System\TwYYPot.exe
  2⤵
  PID:6872
- C:\Windows\System\HbYaCWg.exe
  C:\Windows\System\HbYaCWg.exe
  2⤵
  PID:6888
- C:\Windows\System\ooaHmvr.exe
  C:\Windows\System\ooaHmvr.exe
  2⤵
  PID:6908
- C:\Windows\System\SjxhAxX.exe
  C:\Windows\System\SjxhAxX.exe
  2⤵
  PID:6928
- C:\Windows\System\pHlFPKn.exe
  C:\Windows\System\pHlFPKn.exe
  2⤵
  PID:6944
- C:\Windows\System\NtpUDaO.exe
  C:\Windows\System\NtpUDaO.exe
  2⤵
  PID:6964
- C:\Windows\System\BwtaqvE.exe
  C:\Windows\System\BwtaqvE.exe
  2⤵
  PID:6988
- C:\Windows\System\gvMeGjg.exe
  C:\Windows\System\gvMeGjg.exe
  2⤵
  PID:7008
- C:\Windows\System\TObinbj.exe
  C:\Windows\System\TObinbj.exe
  2⤵
  PID:7028
- C:\Windows\System\aShVdMe.exe
  C:\Windows\System\aShVdMe.exe
  2⤵
  PID:7052
- C:\Windows\System\bfFrdHN.exe
  C:\Windows\System\bfFrdHN.exe
  2⤵
  PID:7068
- C:\Windows\System\VPTqHNO.exe
  C:\Windows\System\VPTqHNO.exe
  2⤵
  PID:7088
- C:\Windows\System\sOwZzqu.exe
  C:\Windows\System\sOwZzqu.exe
  2⤵
  PID:7112
- C:\Windows\System\NshydZm.exe
  C:\Windows\System\NshydZm.exe
  2⤵
  PID:7128
- C:\Windows\System\duIAMCJ.exe
  C:\Windows\System\duIAMCJ.exe
  2⤵
  PID:7152
- C:\Windows\System\GgbjBYL.exe
  C:\Windows\System\GgbjBYL.exe
  2⤵
  PID:4592
- C:\Windows\System\mqVgdsT.exe
  C:\Windows\System\mqVgdsT.exe
  2⤵
  PID:4424
- C:\Windows\System\UlGJJcz.exe
  C:\Windows\System\UlGJJcz.exe
  2⤵
  PID:3732
- C:\Windows\System\lyfMixO.exe
  C:\Windows\System\lyfMixO.exe
  2⤵
  PID:6148
- C:\Windows\System\uLAVquf.exe
  C:\Windows\System\uLAVquf.exe
  2⤵
  PID:6180
- C:\Windows\System\psPfxcV.exe
  C:\Windows\System\psPfxcV.exe
  2⤵
  PID:2128
- C:\Windows\System\FBoZlBm.exe
  C:\Windows\System\FBoZlBm.exe
  2⤵
  PID:6232
- C:\Windows\System\RQGpLRj.exe
  C:\Windows\System\RQGpLRj.exe
  2⤵
  PID:6176
- C:\Windows\System\KOHQgsB.exe
  C:\Windows\System\KOHQgsB.exe
  2⤵
  PID:6300
- C:\Windows\System\HxXcuRY.exe
  C:\Windows\System\HxXcuRY.exe
  2⤵
  PID:6544
- C:\Windows\System\zQKrdTD.exe
  C:\Windows\System\zQKrdTD.exe
  2⤵
  PID:6556
- C:\Windows\System\CjIJhXg.exe
  C:\Windows\System\CjIJhXg.exe
  2⤵
  PID:6656
- C:\Windows\System\woFDVqJ.exe
  C:\Windows\System\woFDVqJ.exe
  2⤵
  PID:4712
- C:\Windows\System\lUtChVX.exe
  C:\Windows\System\lUtChVX.exe
  2⤵
  PID:7136
- C:\Windows\System\lcLvHsR.exe
  C:\Windows\System\lcLvHsR.exe
  2⤵
  PID:7148
- C:\Windows\System\zWMrYuZ.exe
  C:\Windows\System\zWMrYuZ.exe
  2⤵
  PID:6972
- C:\Windows\System\QrwdoCr.exe
  C:\Windows\System\QrwdoCr.exe
  2⤵
  PID:5084
- C:\Windows\System\xsLotgo.exe
  C:\Windows\System\xsLotgo.exe
  2⤵
  PID:5720
- C:\Windows\System\zLJTaCe.exe
  C:\Windows\System\zLJTaCe.exe
  2⤵
  PID:6596
- C:\Windows\System\jjrKPtJ.exe
  C:\Windows\System\jjrKPtJ.exe
  2⤵
  PID:6296
- C:\Windows\System\cvZhdai.exe
  C:\Windows\System\cvZhdai.exe
  2⤵
  PID:6692
- C:\Windows\System\DKNTgDw.exe
  C:\Windows\System\DKNTgDw.exe
  2⤵
  PID:6752
- C:\Windows\System\XmotXfJ.exe
  C:\Windows\System\XmotXfJ.exe
  2⤵
  PID:7096
- C:\Windows\System\cWqRHGw.exe
  C:\Windows\System\cWqRHGw.exe
  2⤵
  PID:6228
- C:\Windows\System\NFJSVhS.exe
  C:\Windows\System\NFJSVhS.exe
  2⤵
  PID:7084
- C:\Windows\System\neUkQKo.exe
  C:\Windows\System\neUkQKo.exe
  2⤵
  PID:6224
- C:\Windows\System\ldDpaMe.exe
  C:\Windows\System\ldDpaMe.exe
  2⤵
  PID:3364
- C:\Windows\System\PCSCSqw.exe
  C:\Windows\System\PCSCSqw.exe
  2⤵
  PID:7176
- C:\Windows\System\UUVjuCf.exe
  C:\Windows\System\UUVjuCf.exe
  2⤵
  PID:7196
- C:\Windows\System\KRdZmug.exe
  C:\Windows\System\KRdZmug.exe
  2⤵
  PID:7220
- C:\Windows\System\xUQAfAz.exe
  C:\Windows\System\xUQAfAz.exe
  2⤵
  PID:7240
- C:\Windows\System\quliHnN.exe
  C:\Windows\System\quliHnN.exe
  2⤵
  PID:7256
- C:\Windows\System\vyoLyUE.exe
  C:\Windows\System\vyoLyUE.exe
  2⤵
  PID:7276
- C:\Windows\System\XuslsMP.exe
  C:\Windows\System\XuslsMP.exe
  2⤵
  PID:7292
- C:\Windows\System\mrajslA.exe
  C:\Windows\System\mrajslA.exe
  2⤵
  PID:7308
- C:\Windows\System\OdwuCan.exe
  C:\Windows\System\OdwuCan.exe
  2⤵
  PID:7328
- C:\Windows\System\MeMZABJ.exe
  C:\Windows\System\MeMZABJ.exe
  2⤵
  PID:7344
- C:\Windows\System\KOMfVJq.exe
  C:\Windows\System\KOMfVJq.exe
  2⤵
  PID:7368
- C:\Windows\System\dGhNwpO.exe
  C:\Windows\System\dGhNwpO.exe
  2⤵
  PID:7384
- C:\Windows\System\lrMKZwq.exe
  C:\Windows\System\lrMKZwq.exe
  2⤵
  PID:7408
- C:\Windows\System\wquJpgs.exe
  C:\Windows\System\wquJpgs.exe
  2⤵
  PID:7428
- C:\Windows\System\xxeNuEW.exe
  C:\Windows\System\xxeNuEW.exe
  2⤵
  PID:7448
- C:\Windows\System\GFOUzwj.exe
  C:\Windows\System\GFOUzwj.exe
  2⤵
  PID:7464
- C:\Windows\System\jRrDSpf.exe
  C:\Windows\System\jRrDSpf.exe
  2⤵
  PID:7488
- C:\Windows\System\dDAoXFH.exe
  C:\Windows\System\dDAoXFH.exe
  2⤵
  PID:7508
- C:\Windows\System\eyIkHfA.exe
  C:\Windows\System\eyIkHfA.exe
  2⤵
  PID:7528
- C:\Windows\System\zaZsJMn.exe
  C:\Windows\System\zaZsJMn.exe
  2⤵
  PID:7544
- C:\Windows\System\MpIdkMg.exe
  C:\Windows\System\MpIdkMg.exe
  2⤵
  PID:7568
- C:\Windows\System\NkmIiZE.exe
  C:\Windows\System\NkmIiZE.exe
  2⤵
  PID:7588
- C:\Windows\System\Dlfvess.exe
  C:\Windows\System\Dlfvess.exe
  2⤵
  PID:7608
- C:\Windows\System\JwerxMm.exe
  C:\Windows\System\JwerxMm.exe
  2⤵
  PID:7632
- C:\Windows\System\dRXKWlA.exe
  C:\Windows\System\dRXKWlA.exe
  2⤵
  PID:7648
- C:\Windows\System\VUlheFs.exe
  C:\Windows\System\VUlheFs.exe
  2⤵
  PID:7672
- C:\Windows\System\oFbnMpw.exe
  C:\Windows\System\oFbnMpw.exe
  2⤵
  PID:7692
- C:\Windows\System\zTEGTGj.exe
  C:\Windows\System\zTEGTGj.exe
  2⤵
  PID:7708
- C:\Windows\System\ruggSFl.exe
  C:\Windows\System\ruggSFl.exe
  2⤵
  PID:7728
- C:\Windows\System\WBRPlAR.exe
  C:\Windows\System\WBRPlAR.exe
  2⤵
  PID:7748
- C:\Windows\System\hDaHYqA.exe
  C:\Windows\System\hDaHYqA.exe
  2⤵
  PID:7772
- C:\Windows\System\BVnctHX.exe
  C:\Windows\System\BVnctHX.exe
  2⤵
  PID:7788
- C:\Windows\System\GavCHKe.exe
  C:\Windows\System\GavCHKe.exe
  2⤵
  PID:7808
- C:\Windows\System\jlZGdNb.exe
  C:\Windows\System\jlZGdNb.exe
  2⤵
  PID:7828
- C:\Windows\System\TOKilzC.exe
  C:\Windows\System\TOKilzC.exe
  2⤵
  PID:7844
- C:\Windows\System\IcfJaKo.exe
  C:\Windows\System\IcfJaKo.exe
  2⤵
  PID:7864
- C:\Windows\System\LysjXiV.exe
  C:\Windows\System\LysjXiV.exe
  2⤵
  PID:7884
- C:\Windows\System\flnsHAh.exe
  C:\Windows\System\flnsHAh.exe
  2⤵
  PID:7904
- C:\Windows\System\YZdMahD.exe
  C:\Windows\System\YZdMahD.exe
  2⤵
  PID:7920
- C:\Windows\System\YjaVDKw.exe
  C:\Windows\System\YjaVDKw.exe
  2⤵
  PID:7936
- C:\Windows\System\tAKgljX.exe
  C:\Windows\System\tAKgljX.exe
  2⤵
  PID:7956
- C:\Windows\System\bzeWYMA.exe
  C:\Windows\System\bzeWYMA.exe
  2⤵
  PID:7980
- C:\Windows\System\zPoBlny.exe
  C:\Windows\System\zPoBlny.exe
  2⤵
  PID:8000
- C:\Windows\System\vXjNFsT.exe
  C:\Windows\System\vXjNFsT.exe
  2⤵
  PID:8024
- C:\Windows\System\fGgSnFH.exe
  C:\Windows\System\fGgSnFH.exe
  2⤵
  PID:8044
- C:\Windows\System\XGPQAOq.exe
  C:\Windows\System\XGPQAOq.exe
  2⤵
  PID:8064
- C:\Windows\System\oupbjeL.exe
  C:\Windows\System\oupbjeL.exe
  2⤵
  PID:8084
- C:\Windows\System\GsDiKSr.exe
  C:\Windows\System\GsDiKSr.exe
  2⤵
  PID:8100
- C:\Windows\System\svrLapD.exe
  C:\Windows\System\svrLapD.exe
  2⤵
  PID:8124
- C:\Windows\System\grHcKro.exe
  C:\Windows\System\grHcKro.exe
  2⤵
  PID:8144
- C:\Windows\System\UjXVTTj.exe
  C:\Windows\System\UjXVTTj.exe
  2⤵
  PID:8164
- C:\Windows\System\IiIuBBf.exe
  C:\Windows\System\IiIuBBf.exe
  2⤵
  PID:8188
- C:\Windows\System\TWKIunA.exe
  C:\Windows\System\TWKIunA.exe
  2⤵
  PID:4896
- C:\Windows\System\TtxVutr.exe
  C:\Windows\System\TtxVutr.exe
  2⤵
  PID:6572
- C:\Windows\System\asrOHPw.exe
  C:\Windows\System\asrOHPw.exe
  2⤵
  PID:6260
- C:\Windows\System\oAckVVX.exe
  C:\Windows\System\oAckVVX.exe
  2⤵
  PID:6920
- C:\Windows\System\hhuYJpL.exe
  C:\Windows\System\hhuYJpL.exe
  2⤵
  PID:6712
- C:\Windows\System\WxjuIPj.exe
  C:\Windows\System\WxjuIPj.exe
  2⤵
  PID:7172
- C:\Windows\System\eVPTvtC.exe
  C:\Windows\System\eVPTvtC.exe
  2⤵
  PID:7356
- C:\Windows\System\mDvSWzo.exe
  C:\Windows\System\mDvSWzo.exe
  2⤵
  PID:7404
- C:\Windows\System\fPOyGwm.exe
  C:\Windows\System\fPOyGwm.exe
  2⤵
  PID:6264
- C:\Windows\System\YEtBCNg.exe
  C:\Windows\System\YEtBCNg.exe
  2⤵
  PID:6256
- C:\Windows\System\irGHrnt.exe
  C:\Windows\System\irGHrnt.exe
  2⤵
  PID:7584
- C:\Windows\System\oxxXYKb.exe
  C:\Windows\System\oxxXYKb.exe
  2⤵
  PID:7664
- C:\Windows\System\tkdpDCv.exe
  C:\Windows\System\tkdpDCv.exe
  2⤵
  PID:7272
- C:\Windows\System\MUrmclG.exe
  C:\Windows\System\MUrmclG.exe
  2⤵
  PID:7784
- C:\Windows\System\PZBjbTu.exe
  C:\Windows\System\PZBjbTu.exe
  2⤵
  PID:7552
- C:\Windows\System\nskglbo.exe
  C:\Windows\System\nskglbo.exe
  2⤵
  PID:7320
- C:\Windows\System\DPTvvkY.exe
  C:\Windows\System\DPTvvkY.exe
  2⤵
  PID:8200
- C:\Windows\System\bmtoEUY.exe
  C:\Windows\System\bmtoEUY.exe
  2⤵
  PID:8216
- C:\Windows\System\TfhTMQF.exe
  C:\Windows\System\TfhTMQF.exe
  2⤵
  PID:8236
- C:\Windows\System\ypQjVnf.exe
  C:\Windows\System\ypQjVnf.exe
  2⤵
  PID:8256
- C:\Windows\System\jRuUkOg.exe
  C:\Windows\System\jRuUkOg.exe
  2⤵
  PID:8272
- C:\Windows\System\ZuVjLIt.exe
  C:\Windows\System\ZuVjLIt.exe
  2⤵
  PID:8292
- C:\Windows\System\MvMXrTf.exe
  C:\Windows\System\MvMXrTf.exe
  2⤵
  PID:8320
- C:\Windows\System\ZuUNTvV.exe
  C:\Windows\System\ZuUNTvV.exe
  2⤵
  PID:8340
- C:\Windows\System\JMXGQcH.exe
  C:\Windows\System\JMXGQcH.exe
  2⤵
  PID:8360
- C:\Windows\System\CqFfSIV.exe
  C:\Windows\System\CqFfSIV.exe
  2⤵
  PID:8380
- C:\Windows\System\DqjxcSR.exe
  C:\Windows\System\DqjxcSR.exe
  2⤵
  PID:8396
- C:\Windows\System\ienNpNz.exe
  C:\Windows\System\ienNpNz.exe
  2⤵
  PID:8412
- C:\Windows\System\TgYxzkV.exe
  C:\Windows\System\TgYxzkV.exe
  2⤵
  PID:8428
- C:\Windows\System\zxrzmFL.exe
  C:\Windows\System\zxrzmFL.exe
  2⤵
  PID:8448
- C:\Windows\System\AozHFNz.exe
  C:\Windows\System\AozHFNz.exe
  2⤵
  PID:8464
- C:\Windows\System\TEVsUjl.exe
  C:\Windows\System\TEVsUjl.exe
  2⤵
  PID:8488
- C:\Windows\System\UFZgfXZ.exe
  C:\Windows\System\UFZgfXZ.exe
  2⤵
  PID:8512
- C:\Windows\System\rJsAjsK.exe
  C:\Windows\System\rJsAjsK.exe
  2⤵
  PID:8532
- C:\Windows\System\ujvYSnB.exe
  C:\Windows\System\ujvYSnB.exe
  2⤵
  PID:7928
- C:\Windows\System\NgfYYkN.exe
  C:\Windows\System\NgfYYkN.exe
  2⤵
  PID:7212
- C:\Windows\System\UwOOxHK.exe
  C:\Windows\System\UwOOxHK.exe
  2⤵
  PID:7860
- C:\Windows\System\jWxmiIN.exe
  C:\Windows\System\jWxmiIN.exe
  2⤵
  PID:7912
- C:\Windows\System\IJQmcNW.exe
  C:\Windows\System\IJQmcNW.exe
  2⤵
  PID:8016
- C:\Windows\System\laYmMdb.exe
  C:\Windows\System\laYmMdb.exe
  2⤵
  PID:8056
- C:\Windows\System\hucUHOA.exe
  C:\Windows\System\hucUHOA.exe
  2⤵
  PID:6956
- C:\Windows\System\SFNcQLv.exe
  C:\Windows\System\SFNcQLv.exe
  2⤵
  PID:8108
- C:\Windows\System\EVzTMYU.exe
  C:\Windows\System\EVzTMYU.exe
  2⤵
  PID:8460
- C:\Windows\System\qKJUVbV.exe
  C:\Windows\System\qKJUVbV.exe
  2⤵
  PID:8528
- C:\Windows\System\zwHRIuQ.exe
  C:\Windows\System\zwHRIuQ.exe
  2⤵
  PID:8212
- C:\Windows\System\cHDQSgT.exe
  C:\Windows\System\cHDQSgT.exe
  2⤵
  PID:8268
- C:\Windows\System\zZLUxZu.exe
  C:\Windows\System\zZLUxZu.exe
  2⤵
  PID:7188
- C:\Windows\System\eNlGEuw.exe
  C:\Windows\System\eNlGEuw.exe
  2⤵
  PID:8792
- C:\Windows\System\cUZpotg.exe
  C:\Windows\System\cUZpotg.exe
  2⤵
  PID:8744
- C:\Windows\System\yVxVtxD.exe
  C:\Windows\System\yVxVtxD.exe
  2⤵
  PID:8948
- C:\Windows\System\hpSpVlW.exe
  C:\Windows\System\hpSpVlW.exe
  2⤵
  PID:8880
- C:\Windows\System\iUotgNV.exe
  C:\Windows\System\iUotgNV.exe
  2⤵
  PID:9004
- C:\Windows\System\UiczNas.exe
  C:\Windows\System\UiczNas.exe
  2⤵
  PID:7216
- C:\Windows\System\cshBPFj.exe
  C:\Windows\System\cshBPFj.exe
  2⤵
  PID:8540
- C:\Windows\System\OtwrhTw.exe
  C:\Windows\System\OtwrhTw.exe
  2⤵
  PID:8520
- C:\Windows\System\snCgTar.exe
  C:\Windows\System\snCgTar.exe
  2⤵
  PID:8264
- C:\Windows\System\teExsJi.exe
  C:\Windows\System\teExsJi.exe
  2⤵
  PID:7800
- C:\Windows\System\SoJxWRe.exe
  C:\Windows\System\SoJxWRe.exe
  2⤵
  PID:9028
- C:\Windows\System\NbTRaGi.exe
  C:\Windows\System\NbTRaGi.exe
  2⤵
  PID:9124
- C:\Windows\System\eLDBdWM.exe
  C:\Windows\System\eLDBdWM.exe
  2⤵
  PID:9112
- C:\Windows\System\HNWtitk.exe
  C:\Windows\System\HNWtitk.exe
  2⤵
  PID:6688
- C:\Windows\System\rwaqcrW.exe
  C:\Windows\System\rwaqcrW.exe
  2⤵
  PID:8
- C:\Windows\System\lVXvwWM.exe
  C:\Windows\System\lVXvwWM.exe
  2⤵
  PID:7668
- C:\Windows\System\foTOxxc.exe
  C:\Windows\System\foTOxxc.exe
  2⤵
  PID:7192
- C:\Windows\System\jDZcaYN.exe
  C:\Windows\System\jDZcaYN.exe
  2⤵
  PID:7720
- C:\Windows\System\Exgpjmn.exe
  C:\Windows\System\Exgpjmn.exe
  2⤵
  PID:7796
- C:\Windows\System\bkfpCyL.exe
  C:\Windows\System\bkfpCyL.exe
  2⤵
  PID:5352
- C:\Windows\System\HsnNcJw.exe
  C:\Windows\System\HsnNcJw.exe
  2⤵
  PID:7336
- C:\Windows\System\gnNBuPx.exe
  C:\Windows\System\gnNBuPx.exe
  2⤵
  PID:8012
- C:\Windows\System\ILepdcn.exe
  C:\Windows\System\ILepdcn.exe
  2⤵
  PID:8288
- C:\Windows\System\HbLPxoR.exe
  C:\Windows\System\HbLPxoR.exe
  2⤵
  PID:8580
- C:\Windows\System\aVfVqBx.exe
  C:\Windows\System\aVfVqBx.exe
  2⤵
  PID:4256
- C:\Windows\System\vdaSKsj.exe
  C:\Windows\System\vdaSKsj.exe
  2⤵
  PID:8444
- C:\Windows\System\IiYIbey.exe
  C:\Windows\System\IiYIbey.exe
  2⤵
  PID:8596
- C:\Windows\System\oilUvSs.exe
  C:\Windows\System\oilUvSs.exe
  2⤵
  PID:8784
- C:\Windows\System\KIWcuIN.exe
  C:\Windows\System\KIWcuIN.exe
  2⤵
  PID:8776
- C:\Windows\System\gGvQZmT.exe
  C:\Windows\System\gGvQZmT.exe
  2⤵
  PID:8960
- C:\Windows\System\PNVbvkD.exe
  C:\Windows\System\PNVbvkD.exe
  2⤵
  PID:8388
- C:\Windows\System\TbDZISl.exe
  C:\Windows\System\TbDZISl.exe
  2⤵
  PID:7840
- C:\Windows\System\tmdiMUs.exe
  C:\Windows\System\tmdiMUs.exe
  2⤵
  PID:8020
- C:\Windows\System\gyCGVQa.exe
  C:\Windows\System\gyCGVQa.exe
  2⤵
  PID:7580
- C:\Windows\System\ApAtimd.exe
  C:\Windows\System\ApAtimd.exe
  2⤵
  PID:8856
- C:\Windows\System\OXmYaMd.exe
  C:\Windows\System\OXmYaMd.exe
  2⤵
  PID:7988
- C:\Windows\System\nJjvHPa.exe
  C:\Windows\System\nJjvHPa.exe
  2⤵
  PID:5876
- C:\Windows\System\eAXutIK.exe
  C:\Windows\System\eAXutIK.exe
  2⤵
  PID:9228
- C:\Windows\System\NAeMvWT.exe
  C:\Windows\System\NAeMvWT.exe
  2⤵
  PID:9244
- C:\Windows\System\BWDHZOd.exe
  C:\Windows\System\BWDHZOd.exe
  2⤵
  PID:9276
- C:\Windows\System\olniUAG.exe
  C:\Windows\System\olniUAG.exe
  2⤵
  PID:9292
- C:\Windows\System\sTWMIAs.exe
  C:\Windows\System\sTWMIAs.exe
  2⤵
  PID:9316
- C:\Windows\System\WSniWaK.exe
  C:\Windows\System\WSniWaK.exe
  2⤵
  PID:9332
- C:\Windows\System\IMfHkEr.exe
  C:\Windows\System\IMfHkEr.exe
  2⤵
  PID:9356
- C:\Windows\System\HXfCfcZ.exe
  C:\Windows\System\HXfCfcZ.exe
  2⤵
  PID:9372
- C:\Windows\System\ZOcvfID.exe
  C:\Windows\System\ZOcvfID.exe
  2⤵
  PID:9396
- C:\Windows\System\UkGgsoS.exe
  C:\Windows\System\UkGgsoS.exe
  2⤵
  PID:9412
- C:\Windows\System\XiBWeBm.exe
  C:\Windows\System\XiBWeBm.exe
  2⤵
  PID:9436
- C:\Windows\System\mLShsEm.exe
  C:\Windows\System\mLShsEm.exe
  2⤵
  PID:9456
- C:\Windows\System\wPqwgla.exe
  C:\Windows\System\wPqwgla.exe
  2⤵
  PID:9472
- C:\Windows\System\zlBQYdx.exe
  C:\Windows\System\zlBQYdx.exe
  2⤵
  PID:9488
- C:\Windows\System\RXkuIVh.exe
  C:\Windows\System\RXkuIVh.exe
  2⤵
  PID:9512
- C:\Windows\System\WfLZyQI.exe
  C:\Windows\System\WfLZyQI.exe
  2⤵
  PID:9532
- C:\Windows\System\NDXucvB.exe
  C:\Windows\System\NDXucvB.exe
  2⤵
  PID:9552
- C:\Windows\System\coCesGM.exe
  C:\Windows\System\coCesGM.exe
  2⤵
  PID:9568
- C:\Windows\System\dpDwwWJ.exe
  C:\Windows\System\dpDwwWJ.exe
  2⤵
  PID:9588
- C:\Windows\System\yvRdbfi.exe
  C:\Windows\System\yvRdbfi.exe
  2⤵
  PID:9604
- C:\Windows\System\eeNTquG.exe
  C:\Windows\System\eeNTquG.exe
  2⤵
  PID:9620
- C:\Windows\System\nRTFynN.exe
  C:\Windows\System\nRTFynN.exe
  2⤵
  PID:9748
- C:\Windows\System\BwkxlRm.exe
  C:\Windows\System\BwkxlRm.exe
  2⤵
  PID:9772
- C:\Windows\System\MqxHpUP.exe
  C:\Windows\System\MqxHpUP.exe
  2⤵
  PID:9796
- C:\Windows\System\BleslHS.exe
  C:\Windows\System\BleslHS.exe
  2⤵
  PID:9820
- C:\Windows\System\lHtoTuG.exe
  C:\Windows\System\lHtoTuG.exe
  2⤵
  PID:9840
- C:\Windows\System\RkSmikE.exe
  C:\Windows\System\RkSmikE.exe
  2⤵
  PID:9868
- C:\Windows\System\ATcVMaQ.exe
  C:\Windows\System\ATcVMaQ.exe
  2⤵
  PID:9896
- C:\Windows\System\ArPKuip.exe
  C:\Windows\System\ArPKuip.exe
  2⤵
  PID:9916
- C:\Windows\System\yIiCTTa.exe
  C:\Windows\System\yIiCTTa.exe
  2⤵
  PID:9940
- C:\Windows\System\GjMcWAT.exe
  C:\Windows\System\GjMcWAT.exe
  2⤵
  PID:9960
- C:\Windows\System\ywlJlNf.exe
  C:\Windows\System\ywlJlNf.exe
  2⤵
  PID:9976
- C:\Windows\System\vnwLbSm.exe
  C:\Windows\System\vnwLbSm.exe
  2⤵
  PID:9996
- C:\Windows\System\YyEKdBp.exe
  C:\Windows\System\YyEKdBp.exe
  2⤵
  PID:10012
- C:\Windows\System\TbyJdBW.exe
  C:\Windows\System\TbyJdBW.exe
  2⤵
  PID:10032
- C:\Windows\System\dHBwOXl.exe
  C:\Windows\System\dHBwOXl.exe
  2⤵
  PID:10052
- C:\Windows\System\aTPSXIA.exe
  C:\Windows\System\aTPSXIA.exe
  2⤵
  PID:10068
- C:\Windows\System\vqKCpdU.exe
  C:\Windows\System\vqKCpdU.exe
  2⤵
  PID:10104
- C:\Windows\System\exSUShf.exe
  C:\Windows\System\exSUShf.exe
  2⤵
  PID:10120
- C:\Windows\System\oJaodrm.exe
  C:\Windows\System\oJaodrm.exe
  2⤵
  PID:10144
- C:\Windows\System\ozyHaSs.exe
  C:\Windows\System\ozyHaSs.exe
  2⤵
  PID:10160
- C:\Windows\System\CiqCBia.exe
  C:\Windows\System\CiqCBia.exe
  2⤵
  PID:10176
- C:\Windows\System\HWbOqmR.exe
  C:\Windows\System\HWbOqmR.exe
  2⤵
  PID:10192
- C:\Windows\System\KUutKkI.exe
  C:\Windows\System\KUutKkI.exe
  2⤵
  PID:10212
- C:\Windows\System\WthNIbU.exe
  C:\Windows\System\WthNIbU.exe
  2⤵
  PID:10232
- C:\Windows\System\XVDekLI.exe
  C:\Windows\System\XVDekLI.exe
  2⤵
  PID:7564
- C:\Windows\System\saoHnoU.exe
  C:\Windows\System\saoHnoU.exe
  2⤵
  PID:9368
- C:\Windows\System\vzfemuy.exe
  C:\Windows\System\vzfemuy.exe
  2⤵
  PID:9708
- C:\Windows\System\anJPXdg.exe
  C:\Windows\System\anJPXdg.exe
  2⤵
  PID:9720
- C:\Windows\System\NmGuEDd.exe
  C:\Windows\System\NmGuEDd.exe
  2⤵
  PID:9236
- C:\Windows\System\OgtXqLw.exe
  C:\Windows\System\OgtXqLw.exe
  2⤵
  PID:9668
- C:\Windows\System\pEAeord.exe
  C:\Windows\System\pEAeord.exe
  2⤵
  PID:9312
- C:\Windows\System\qgDcHAS.exe
  C:\Windows\System\qgDcHAS.exe
  2⤵
  PID:9936
- C:\Windows\System\bzpLXJc.exe
  C:\Windows\System\bzpLXJc.exe
  2⤵
  PID:9992
- C:\Windows\System\huYzpRe.exe
  C:\Windows\System\huYzpRe.exe
  2⤵
  PID:9580
- C:\Windows\System\hGptPkE.exe
  C:\Windows\System\hGptPkE.exe
  2⤵
  PID:9740
- C:\Windows\System\xCYzJAo.exe
  C:\Windows\System\xCYzJAo.exe
  2⤵
  PID:7740
- C:\Windows\System\KskWvSP.exe
  C:\Windows\System\KskWvSP.exe
  2⤵
  PID:4480
- C:\Windows\System\bJoPIat.exe
  C:\Windows\System\bJoPIat.exe
  2⤵
  PID:10008
- C:\Windows\System\eZeaxVj.exe
  C:\Windows\System\eZeaxVj.exe
  2⤵
  PID:10064
- C:\Windows\System\slqXkXz.exe
  C:\Windows\System\slqXkXz.exe
  2⤵
  PID:8524
- C:\Windows\System\rwazoxa.exe
  C:\Windows\System\rwazoxa.exe
  2⤵
  PID:10256
- C:\Windows\System\xvEKFeA.exe
  C:\Windows\System\xvEKFeA.exe
  2⤵
  PID:10276
- C:\Windows\System\BZmDAny.exe
  C:\Windows\System\BZmDAny.exe
  2⤵
  PID:10436
- C:\Windows\System\buHwhXI.exe
  C:\Windows\System\buHwhXI.exe
  2⤵
  PID:10472
- C:\Windows\System\muvaFsA.exe
  C:\Windows\System\muvaFsA.exe
  2⤵
  PID:10628
- C:\Windows\System\yyEUeGv.exe
  C:\Windows\System\yyEUeGv.exe
  2⤵
  PID:10684
- C:\Windows\System\LYHqKJt.exe
  C:\Windows\System\LYHqKJt.exe
  2⤵
  PID:10756
- C:\Windows\System\TeikWai.exe
  C:\Windows\System\TeikWai.exe
  2⤵
  PID:10772
- C:\Windows\System\bFLtPgY.exe
  C:\Windows\System\bFLtPgY.exe
  2⤵
  PID:10792
- C:\Windows\System\ELxDVxT.exe
  C:\Windows\System\ELxDVxT.exe
  2⤵
  PID:10816
- C:\Windows\System\pHhAsEv.exe
  C:\Windows\System\pHhAsEv.exe
  2⤵
  PID:10836
- C:\Windows\System\RYelfta.exe
  C:\Windows\System\RYelfta.exe
  2⤵
  PID:10856
- C:\Windows\System\ZxGkPTg.exe
  C:\Windows\System\ZxGkPTg.exe
  2⤵
  PID:10880
- C:\Windows\System\NSdljKy.exe
  C:\Windows\System\NSdljKy.exe
  2⤵
  PID:10900
- C:\Windows\System\UrDtXFl.exe
  C:\Windows\System\UrDtXFl.exe
  2⤵
  PID:10924
- C:\Windows\System\HSsPeON.exe
  C:\Windows\System\HSsPeON.exe
  2⤵
  PID:10940
- C:\Windows\System\cMlxlLR.exe
  C:\Windows\System\cMlxlLR.exe
  2⤵
  PID:10960
- C:\Windows\System\YTxzQSg.exe
  C:\Windows\System\YTxzQSg.exe
  2⤵
  PID:10980
- C:\Windows\System\NaBuIqh.exe
  C:\Windows\System\NaBuIqh.exe
  2⤵
  PID:11000
- C:\Windows\System\rSzOeQA.exe
  C:\Windows\System\rSzOeQA.exe
  2⤵
  PID:11016
- C:\Windows\System\ekQQcPO.exe
  C:\Windows\System\ekQQcPO.exe
  2⤵
  PID:11036
- C:\Windows\System\QQpCrcB.exe
  C:\Windows\System\QQpCrcB.exe
  2⤵
  PID:11056
- C:\Windows\System\akelkNb.exe
  C:\Windows\System\akelkNb.exe
  2⤵
  PID:11076
- C:\Windows\System\PEKAmGb.exe
  C:\Windows\System\PEKAmGb.exe
  2⤵
  PID:11092
- C:\Windows\System\GssiRwo.exe
  C:\Windows\System\GssiRwo.exe
  2⤵
  PID:11116
- C:\Windows\System\vtJBkur.exe
  C:\Windows\System\vtJBkur.exe
  2⤵
  PID:11132
- C:\Windows\System\sSwGoKW.exe
  C:\Windows\System\sSwGoKW.exe
  2⤵
  PID:11156
- C:\Windows\System\tJgPeKt.exe
  C:\Windows\System\tJgPeKt.exe
  2⤵
  PID:11172
- C:\Windows\System\uYESfHX.exe
  C:\Windows\System\uYESfHX.exe
  2⤵
  PID:11200
- C:\Windows\System\xRwkqYh.exe
  C:\Windows\System\xRwkqYh.exe
  2⤵
  PID:11216
- C:\Windows\System\RinmiQN.exe
  C:\Windows\System\RinmiQN.exe
  2⤵
  PID:11236
- C:\Windows\System\gLRgmnQ.exe
  C:\Windows\System\gLRgmnQ.exe
  2⤵
  PID:9352
- C:\Windows\System\gqdbQiC.exe
  C:\Windows\System\gqdbQiC.exe
  2⤵
  PID:4832
- C:\Windows\System\nemWISg.exe
  C:\Windows\System\nemWISg.exe
  2⤵
  PID:9520
- C:\Windows\System\ksdZSyF.exe
  C:\Windows\System\ksdZSyF.exe
  2⤵
  PID:10156
- C:\Windows\System\NfPjuPU.exe
  C:\Windows\System\NfPjuPU.exe
  2⤵
  PID:10252
- C:\Windows\System\hBgeQQN.exe
  C:\Windows\System\hBgeQQN.exe
  2⤵
  PID:9340
- C:\Windows\System\SrnjUIw.exe
  C:\Windows\System\SrnjUIw.exe
  2⤵
  PID:5652
- C:\Windows\System\CFpXLrS.exe
  C:\Windows\System\CFpXLrS.exe
  2⤵
  PID:10312
- C:\Windows\System\TRsNseo.exe
  C:\Windows\System\TRsNseo.exe
  2⤵
  PID:9968
- C:\Windows\System\xutrjCi.exe
  C:\Windows\System\xutrjCi.exe
  2⤵
  PID:10284
- C:\Windows\System\mViRJzf.exe
  C:\Windows\System\mViRJzf.exe
  2⤵
  PID:10768
- C:\Windows\System\XjPUcyU.exe
  C:\Windows\System\XjPUcyU.exe
  2⤵
  PID:10592
- C:\Windows\System\PIymODm.exe
  C:\Windows\System\PIymODm.exe
  2⤵
  PID:10812
- C:\Windows\System\RNuVGcV.exe
  C:\Windows\System\RNuVGcV.exe
  2⤵
  PID:10852
- C:\Windows\System\HGkGHYr.exe
  C:\Windows\System\HGkGHYr.exe
  2⤵
  PID:10692
- C:\Windows\System\cAxetvn.exe
  C:\Windows\System\cAxetvn.exe
  2⤵
  PID:10524
- C:\Windows\System\FpRdLej.exe
  C:\Windows\System\FpRdLej.exe
  2⤵
  PID:10560
- C:\Windows\System\jEUCwya.exe
  C:\Windows\System\jEUCwya.exe
  2⤵
  PID:4388
- C:\Windows\System\hpinOww.exe
  C:\Windows\System\hpinOww.exe
  2⤵
  PID:11244
- C:\Windows\System\dFTQwcc.exe
  C:\Windows\System\dFTQwcc.exe
  2⤵
  PID:11248
- C:\Windows\System\xXhtXtw.exe
  C:\Windows\System\xXhtXtw.exe
  2⤵
  PID:10656
- C:\Windows\System\WrWFAyC.exe
  C:\Windows\System\WrWFAyC.exe
  2⤵
  PID:10724
- C:\Windows\System\uUvEHsY.exe
  C:\Windows\System\uUvEHsY.exe
  2⤵
  PID:11024
- C:\Windows\System\nUNNTIo.exe
  C:\Windows\System\nUNNTIo.exe
  2⤵
  PID:11152
- C:\Windows\System\pNRfqPo.exe
  C:\Windows\System\pNRfqPo.exe
  2⤵
  PID:10936
- C:\Windows\System\moRWHMb.exe
  C:\Windows\System\moRWHMb.exe
  2⤵
  PID:11100
- C:\Windows\System\qWoIRPG.exe
  C:\Windows\System\qWoIRPG.exe
  2⤵
  PID:11224
- C:\Windows\System\ibHXwQn.exe
  C:\Windows\System\ibHXwQn.exe
  2⤵
  PID:11108
- C:\Windows\System\UKDrGbi.exe
  C:\Windows\System\UKDrGbi.exe
  2⤵
  PID:11008
- C:\Windows\System\tbXPxrK.exe
  C:\Windows\System\tbXPxrK.exe
  2⤵
  PID:10932
- C:\Windows\System\CyDVIal.exe
  C:\Windows\System\CyDVIal.exe
  2⤵
  PID:10132
- C:\Windows\System\gJIdLeE.exe
  C:\Windows\System\gJIdLeE.exe
  2⤵
  PID:9464
- C:\Windows\System\gWLLMKR.exe
  C:\Windows\System\gWLLMKR.exe
  2⤵
  PID:9828
- C:\Windows\System\MSfQdoU.exe
  C:\Windows\System\MSfQdoU.exe
  2⤵
  PID:10048
- C:\Windows\System\ngrjGgO.exe
  C:\Windows\System\ngrjGgO.exe
  2⤵
  PID:11292
- C:\Windows\System\BQHgcZH.exe
  C:\Windows\System\BQHgcZH.exe
  2⤵
  PID:11308
- C:\Windows\System\dQNmNPP.exe
  C:\Windows\System\dQNmNPP.exe
  2⤵
  PID:11332
- C:\Windows\System\BSGndAw.exe
  C:\Windows\System\BSGndAw.exe
  2⤵
  PID:11348
- C:\Windows\System\qEQYDXi.exe
  C:\Windows\System\qEQYDXi.exe
  2⤵
  PID:11372
- C:\Windows\System\lYgYaJQ.exe
  C:\Windows\System\lYgYaJQ.exe
  2⤵
  PID:11396
- C:\Windows\System\mXfzmUM.exe
  C:\Windows\System\mXfzmUM.exe
  2⤵
  PID:11420
- C:\Windows\System\qYSBaAe.exe
  C:\Windows\System\qYSBaAe.exe
  2⤵
  PID:11456
- C:\Windows\System\AjfOktO.exe
  C:\Windows\System\AjfOktO.exe
  2⤵
  PID:11472
- C:\Windows\System\luBlBhF.exe
  C:\Windows\System\luBlBhF.exe
  2⤵
  PID:11492
- C:\Windows\System\ihScSAO.exe
  C:\Windows\System\ihScSAO.exe
  2⤵
  PID:11512
- C:\Windows\System\WrWavpw.exe
  C:\Windows\System\WrWavpw.exe
  2⤵
  PID:11536
- C:\Windows\System\TSgEQoa.exe
  C:\Windows\System\TSgEQoa.exe
  2⤵
  PID:11552
- C:\Windows\System\eUxDeJD.exe
  C:\Windows\System\eUxDeJD.exe
  2⤵
  PID:11572
- C:\Windows\System\iqXgqfS.exe
  C:\Windows\System\iqXgqfS.exe
  2⤵
  PID:11588
- C:\Windows\System\XjrxpWx.exe
  C:\Windows\System\XjrxpWx.exe
  2⤵
  PID:11612
- C:\Windows\System\KhnCFbF.exe
  C:\Windows\System\KhnCFbF.exe
  2⤵
  PID:11628
- C:\Windows\System\SDWLFZR.exe
  C:\Windows\System\SDWLFZR.exe
  2⤵
  PID:11648
- C:\Windows\System\rHSOIjg.exe
  C:\Windows\System\rHSOIjg.exe
  2⤵
  PID:11664
- C:\Windows\System\mRDMFEC.exe
  C:\Windows\System\mRDMFEC.exe
  2⤵
  PID:11684
- C:\Windows\System\FiqtmYR.exe
  C:\Windows\System\FiqtmYR.exe
  2⤵
  PID:11700
- C:\Windows\System\vvfHelj.exe
  C:\Windows\System\vvfHelj.exe
  2⤵
  PID:11720
- C:\Windows\System\vrAvEIK.exe
  C:\Windows\System\vrAvEIK.exe
  2⤵
  PID:11736
- C:\Windows\System\fSHHaur.exe
  C:\Windows\System\fSHHaur.exe
  2⤵
  PID:11756
- C:\Windows\System\kqjbwJT.exe
  C:\Windows\System\kqjbwJT.exe
  2⤵
  PID:11772
- C:\Windows\System\KpdaTua.exe
  C:\Windows\System\KpdaTua.exe
  2⤵
  PID:11788
- C:\Windows\System\jhUuitZ.exe
  C:\Windows\System\jhUuitZ.exe
  2⤵
  PID:11804
- C:\Windows\System\DZEWcoP.exe
  C:\Windows\System\DZEWcoP.exe
  2⤵
  PID:11824
- C:\Windows\System\CKFLyRY.exe
  C:\Windows\System\CKFLyRY.exe
  2⤵
  PID:11840
- C:\Windows\System\WXfqNme.exe
  C:\Windows\System\WXfqNme.exe
  2⤵
  PID:11856
- C:\Windows\System\klscHnu.exe
  C:\Windows\System\klscHnu.exe
  2⤵
  PID:11872
- C:\Windows\System\zTrthfO.exe
  C:\Windows\System\zTrthfO.exe
  2⤵
  PID:11888
- C:\Windows\System\rOpZszy.exe
  C:\Windows\System\rOpZszy.exe
  2⤵
  PID:11908
- C:\Windows\System\zGXKLsg.exe
  C:\Windows\System\zGXKLsg.exe
  2⤵
  PID:11924
- C:\Windows\System\oGIzQKn.exe
  C:\Windows\System\oGIzQKn.exe
  2⤵
  PID:11940
- C:\Windows\System\gBZIECs.exe
  C:\Windows\System\gBZIECs.exe
  2⤵
  PID:11968
- C:\Windows\System\iXOavTc.exe
  C:\Windows\System\iXOavTc.exe
  2⤵
  PID:11984
- C:\Windows\System\uoaIKeS.exe
  C:\Windows\System\uoaIKeS.exe
  2⤵
  PID:12004
- C:\Windows\System\rwFurjf.exe
  C:\Windows\System\rwFurjf.exe
  2⤵
  PID:12020
- C:\Windows\System\FGLRVts.exe
  C:\Windows\System\FGLRVts.exe
  2⤵
  PID:12036
- C:\Windows\System\aimZkVN.exe
  C:\Windows\System\aimZkVN.exe
  2⤵
  PID:12052
- C:\Windows\System\svXYmxb.exe
  C:\Windows\System\svXYmxb.exe
  2⤵
  PID:12072
- C:\Windows\System\LYIcZSL.exe
  C:\Windows\System\LYIcZSL.exe
  2⤵
  PID:12092
- C:\Windows\System\gJPuCRH.exe
  C:\Windows\System\gJPuCRH.exe
  2⤵
  PID:12112
- C:\Windows\System\xKdxHfm.exe
  C:\Windows\System\xKdxHfm.exe
  2⤵
  PID:12140
- C:\Windows\System\SeRhGcI.exe
  C:\Windows\System\SeRhGcI.exe
  2⤵
  PID:12156
- C:\Windows\System\opWjcoo.exe
  C:\Windows\System\opWjcoo.exe
  2⤵
  PID:12172
- C:\Windows\System\dygnUVF.exe
  C:\Windows\System\dygnUVF.exe
  2⤵
  PID:12192
- C:\Windows\System\JhMNKgj.exe
  C:\Windows\System\JhMNKgj.exe
  2⤵
  PID:12212
- C:\Windows\System\oCtthYn.exe
  C:\Windows\System\oCtthYn.exe
  2⤵
  PID:12236
- C:\Windows\System\ZSvofuw.exe
  C:\Windows\System\ZSvofuw.exe
  2⤵
  PID:12252
- C:\Windows\System\zQTqyEi.exe
  C:\Windows\System\zQTqyEi.exe
  2⤵
  PID:12272
- C:\Windows\System\PYfIoqA.exe
  C:\Windows\System\PYfIoqA.exe
  2⤵
  PID:8476
- C:\Windows\System\JVTfoIN.exe
  C:\Windows\System\JVTfoIN.exe
  2⤵
  PID:11044
- C:\Windows\System\DuzdrVE.exe
  C:\Windows\System\DuzdrVE.exe
  2⤵
  PID:10828
- C:\Windows\System\YHchHlz.exe
  C:\Windows\System\YHchHlz.exe
  2⤵
  PID:10788
- C:\Windows\System\XIcXSMV.exe
  C:\Windows\System\XIcXSMV.exe
  2⤵
  PID:11484
- C:\Windows\System\YLwEYCP.exe
  C:\Windows\System\YLwEYCP.exe
  2⤵
  PID:11748
- C:\Windows\System\ZxYyCQQ.exe
  C:\Windows\System\ZxYyCQQ.exe
  2⤵
  PID:10896
- C:\Windows\System\kzrSdLb.exe
  C:\Windows\System\kzrSdLb.exe
  2⤵
  PID:11932
- C:\Windows\System\GPhUXoq.exe
  C:\Windows\System\GPhUXoq.exe
  2⤵
  PID:11048
- C:\Windows\System\UCapvxU.exe
  C:\Windows\System\UCapvxU.exe
  2⤵
  PID:10892
- C:\Windows\System\QsAoPQD.exe
  C:\Windows\System\QsAoPQD.exe
  2⤵
  PID:9168
- C:\Windows\System\eqSuuJP.exe
  C:\Windows\System\eqSuuJP.exe
  2⤵
  PID:9780
- C:\Windows\System\xGiphpe.exe
  C:\Windows\System\xGiphpe.exe
  2⤵
  PID:11316
- C:\Windows\System\jubspjU.exe
  C:\Windows\System\jubspjU.exe
  2⤵
  PID:11340
- C:\Windows\System\hQuQhoG.exe
  C:\Windows\System\hQuQhoG.exe
  2⤵
  PID:11432
- C:\Windows\System\FDFteYC.exe
  C:\Windows\System\FDFteYC.exe
  2⤵
  PID:11448
- C:\Windows\System\nNvpMhh.exe
  C:\Windows\System\nNvpMhh.exe
  2⤵
  PID:11488
- C:\Windows\System\XVxkwkk.exe
  C:\Windows\System\XVxkwkk.exe
  2⤵
  PID:9768
- C:\Windows\System\wVlzfhI.exe
  C:\Windows\System\wVlzfhI.exe
  2⤵
  PID:11656
- C:\Windows\System\rhXIGZd.exe
  C:\Windows\System\rhXIGZd.exe
  2⤵
  PID:11692
- C:\Windows\System\spdzlDo.exe
  C:\Windows\System\spdzlDo.exe
  2⤵
  PID:11732
- C:\Windows\System\TUZDVPc.exe
  C:\Windows\System\TUZDVPc.exe
  2⤵
  PID:11848
- C:\Windows\System\hkGCxzq.exe
  C:\Windows\System\hkGCxzq.exe
  2⤵
  PID:11880
- C:\Windows\System\apMlCyz.exe
  C:\Windows\System\apMlCyz.exe
  2⤵
  PID:11952
- C:\Windows\System\EFykJnb.exe
  C:\Windows\System\EFykJnb.exe
  2⤵
  PID:12068
- C:\Windows\System\YWPPkIT.exe
  C:\Windows\System\YWPPkIT.exe
  2⤵
  PID:12220
- C:\Windows\System\QXyfAay.exe
  C:\Windows\System\QXyfAay.exe
  2⤵
  PID:12264
- C:\Windows\System\IMwKBTO.exe
  C:\Windows\System\IMwKBTO.exe
  2⤵
  PID:10652
- C:\Windows\System\UfdkYOR.exe
  C:\Windows\System\UfdkYOR.exe
  2⤵
  PID:4944
- C:\Windows\System\EUtlupf.exe
  C:\Windows\System\EUtlupf.exe
  2⤵
  PID:11416
- C:\Windows\System\YjvCSCF.exe
  C:\Windows\System\YjvCSCF.exe
  2⤵
  PID:12304
- C:\Windows\System\TPKLTvp.exe
  C:\Windows\System\TPKLTvp.exe
  2⤵
  PID:12320
- C:\Windows\System\sLJfBwm.exe
  C:\Windows\System\sLJfBwm.exe
  2⤵
  PID:12336
- C:\Windows\System\HOCESpG.exe
  C:\Windows\System\HOCESpG.exe
  2⤵
  PID:12352
- C:\Windows\System\EjzrEaQ.exe
  C:\Windows\System\EjzrEaQ.exe
  2⤵
  PID:12368
- C:\Windows\System\dbJogZf.exe
  C:\Windows\System\dbJogZf.exe
  2⤵
  PID:12384
- C:\Windows\System\kdyHqkt.exe
  C:\Windows\System\kdyHqkt.exe
  2⤵
  PID:12400
- C:\Windows\System\ZHtaJaa.exe
  C:\Windows\System\ZHtaJaa.exe
  2⤵
  PID:12416
- C:\Windows\System\KzHyWSu.exe
  C:\Windows\System\KzHyWSu.exe
  2⤵
  PID:12436
- C:\Windows\System\HtwkucO.exe
  C:\Windows\System\HtwkucO.exe
  2⤵
  PID:12456
- C:\Windows\System\Flwptcv.exe
  C:\Windows\System\Flwptcv.exe
  2⤵
  PID:12656
- C:\Windows\System\TFgfmHR.exe
  C:\Windows\System\TFgfmHR.exe
  2⤵
  PID:13044
- C:\Windows\System\vznLezn.exe
  C:\Windows\System\vznLezn.exe
  2⤵
  PID:13068
- C:\Windows\System\AjwKqEn.exe
  C:\Windows\System\AjwKqEn.exe
  2⤵
  PID:13088
- C:\Windows\System\NWtqTGx.exe
  C:\Windows\System\NWtqTGx.exe
  2⤵
  PID:12200
- C:\Windows\System\GgzbeNf.exe
  C:\Windows\System\GgzbeNf.exe
  2⤵
  PID:13204
- C:\Windows\System\lNtONCg.exe
  C:\Windows\System\lNtONCg.exe
  2⤵
  PID:12896
- C:\Windows\System\wiWBkyu.exe
  C:\Windows\System\wiWBkyu.exe
  2⤵
  PID:12964
- C:\Windows\System\QeDeFAl.exe
  C:\Windows\System\QeDeFAl.exe
  2⤵
  PID:11180
- C:\Windows\System\ZNPvyfk.exe
  C:\Windows\System\ZNPvyfk.exe
  2⤵
  PID:13236
- C:\Windows\System\pskTXxc.exe
  C:\Windows\System\pskTXxc.exe
  2⤵
  PID:12312
- C:\Windows\System\BfLQWUq.exe
  C:\Windows\System\BfLQWUq.exe
  2⤵
  PID:11580
- C:\Windows\System\MEQmICM.exe
  C:\Windows\System\MEQmICM.exe
  2⤵
  PID:12064
- C:\Windows\System\KKakmyf.exe
  C:\Windows\System\KKakmyf.exe
  2⤵
  PID:3148
- C:\Windows\System\qOGwYJB.exe
  C:\Windows\System\qOGwYJB.exe
  2⤵
  PID:10848
- C:\Windows\System\cUYCwAa.exe
  C:\Windows\System\cUYCwAa.exe
  2⤵
  PID:11920
- C:\Windows\System\iKgBTRr.exe
  C:\Windows\System\iKgBTRr.exe
  2⤵
  PID:12328
- C:\Windows\System\QubshhG.exe
  C:\Windows\System\QubshhG.exe
  2⤵
  PID:10152
- C:\Windows\System\UnlpHWC.exe
  C:\Windows\System\UnlpHWC.exe
  2⤵
  PID:13212
- C:\Windows\System\aBZdSKn.exe
  C:\Windows\System\aBZdSKn.exe
  2⤵
  PID:12316
- C:\Windows\System\YkWhIUP.exe
  C:\Windows\System\YkWhIUP.exe
  2⤵
  PID:9628
- C:\Windows\System\NifLlrd.exe
  C:\Windows\System\NifLlrd.exe
  2⤵
  PID:12848
- C:\Windows\System\DRDXSuS.exe
  C:\Windows\System\DRDXSuS.exe
  2⤵
  PID:11832
- C:\Windows\System\iGpyonS.exe
  C:\Windows\System\iGpyonS.exe
  2⤵
  PID:13024
- C:\Windows\System\ZRttukj.exe
  C:\Windows\System\ZRttukj.exe
  2⤵
  PID:12048
- C:\Windows\System\CZtzrjt.exe
  C:\Windows\System\CZtzrjt.exe
  2⤵
  PID:13252
- C:\Windows\System\eThTtBK.exe
  C:\Windows\System\eThTtBK.exe
  2⤵
  PID:12808
- C:\Windows\System\XcZZzdA.exe
  C:\Windows\System\XcZZzdA.exe
  2⤵
  PID:13036
- C:\Windows\System\daDfSyX.exe
  C:\Windows\System\daDfSyX.exe
  2⤵
  PID:12664
- C:\Windows\System\NHHiSsI.exe
  C:\Windows\System\NHHiSsI.exe
  2⤵
  PID:2272
- C:\Windows\System\yyFLYZu.exe
  C:\Windows\System\yyFLYZu.exe
  2⤵
  PID:5944
- C:\Windows\System\YrLAOhl.exe
  C:\Windows\System\YrLAOhl.exe
  2⤵
  PID:4120
- C:\Windows\System\XIJCasD.exe
  C:\Windows\System\XIJCasD.exe
  2⤵
  PID:12168
- C:\Windows\System\gifXxsC.exe
  C:\Windows\System\gifXxsC.exe
  2⤵
  PID:13276
- C:\Windows\System\ojnCVze.exe
  C:\Windows\System\ojnCVze.exe
  2⤵
  PID:12720
- C:\Windows\System\VzZZDXJ.exe
  C:\Windows\System\VzZZDXJ.exe
  2⤵
  PID:4908
- C:\Windows\System\LYDjnUm.exe
  C:\Windows\System\LYDjnUm.exe
  2⤵
  PID:4208
- C:\Windows\System\lGgDvwr.exe
  C:\Windows\System\lGgDvwr.exe
  2⤵
  PID:4856
- C:\Windows\System\wrCblmq.exe
  C:\Windows\System\wrCblmq.exe
  2⤵
  PID:3436
- C:\Windows\System\tbbGhqA.exe
  C:\Windows\System\tbbGhqA.exe
  2⤵
  PID:11980
- C:\Windows\System\XDKAjDQ.exe
  C:\Windows\System\XDKAjDQ.exe
  2⤵
  PID:2428
- C:\Windows\System\nosFtvs.exe
  C:\Windows\System\nosFtvs.exe
  2⤵
  PID:5168
- C:\Windows\System\GEuDxGn.exe
  C:\Windows\System\GEuDxGn.exe
  2⤵
  PID:928
- C:\Windows\System\rXtTvPY.exe
  C:\Windows\System\rXtTvPY.exe
  2⤵
  PID:4332
- C:\Windows\System\hJrKFuD.exe
  C:\Windows\System\hJrKFuD.exe
  2⤵
  PID:4872
- C:\Windows\System\UvLEelS.exe
  C:\Windows\System\UvLEelS.exe
  2⤵
  PID:13172
- C:\Windows\System\MIroVDB.exe
  C:\Windows\System\MIroVDB.exe
  2⤵
  PID:3432
- C:\Windows\System\pGOeAvp.exe
  C:\Windows\System\pGOeAvp.exe
  2⤵
  PID:5668
- C:\Windows\System\yLLUXjn.exe
  C:\Windows\System\yLLUXjn.exe
  2⤵
  PID:5752
- C:\Windows\System\vQiqZTj.exe
  C:\Windows\System\vQiqZTj.exe
  2⤵
  PID:5852
- C:\Windows\System\MRuzuZm.exe
  C:\Windows\System\MRuzuZm.exe
  2⤵
  PID:3112
- C:\Windows\System\KKJCBgY.exe
  C:\Windows\System\KKJCBgY.exe
  2⤵
  PID:11356
- C:\Windows\System\gnLlpVJ.exe
  C:\Windows\System\gnLlpVJ.exe
  2⤵
  PID:10580
- C:\Windows\System\GvCqNbb.exe
  C:\Windows\System\GvCqNbb.exe
  2⤵
  PID:2644
- C:\Windows\System\GRqsXSp.exe
  C:\Windows\System\GRqsXSp.exe
  2⤵
  PID:412
- C:\Windows\System\rVBFZNi.exe
  C:\Windows\System\rVBFZNi.exe
  2⤵
  PID:12912
- C:\Windows\System\jXeTGWW.exe
  C:\Windows\System\jXeTGWW.exe
  2⤵
  PID:12712
- C:\Windows\System\DtQUYPV.exe
  C:\Windows\System\DtQUYPV.exe
  2⤵
  PID:13484
- C:\Windows\System\bZNhUhQ.exe
  C:\Windows\System\bZNhUhQ.exe
  2⤵
  PID:13500
- C:\Windows\System\IAZcVwx.exe
  C:\Windows\System\IAZcVwx.exe
  2⤵
  PID:13524
- C:\Windows\System\maeexqB.exe
  C:\Windows\System\maeexqB.exe
  2⤵
  PID:13544
- C:\Windows\System\RRXTcsa.exe
  C:\Windows\System\RRXTcsa.exe
  2⤵
  PID:13564
- C:\Windows\System\TSRufBq.exe
  C:\Windows\System\TSRufBq.exe
  2⤵
  PID:13592
- C:\Windows\System\HPSFVkJ.exe
  C:\Windows\System\HPSFVkJ.exe
  2⤵
  PID:13696
- C:\Windows\System\YhWnXzE.exe
  C:\Windows\System\YhWnXzE.exe
  2⤵
  PID:13736
- C:\Windows\System\ySzZqRr.exe
  C:\Windows\System\ySzZqRr.exe
  2⤵
  PID:13752
- C:\Windows\System\ceedIpJ.exe
  C:\Windows\System\ceedIpJ.exe
  2⤵
  PID:13772
- C:\Windows\System\kasuCGH.exe
  C:\Windows\System\kasuCGH.exe
  2⤵
  PID:13796
- C:\Windows\System\aGzcqIi.exe
  C:\Windows\System\aGzcqIi.exe
  2⤵
  PID:13812
- C:\Windows\System\TKHFtDN.exe
  C:\Windows\System\TKHFtDN.exe
  2⤵
  PID:13836
- C:\Windows\System\QctMzEK.exe
  C:\Windows\System\QctMzEK.exe
  2⤵
  PID:13876
- C:\Windows\System\dpDrUFi.exe
  C:\Windows\System\dpDrUFi.exe
  2⤵
  PID:14036
- C:\Windows\System\OoKClub.exe
  C:\Windows\System\OoKClub.exe
  2⤵
  PID:14052
- C:\Windows\System\LAYzJoM.exe
  C:\Windows\System\LAYzJoM.exe
  2⤵
  PID:14072
- C:\Windows\System\nLawRtW.exe
  C:\Windows\System\nLawRtW.exe
  2⤵
  PID:10712
- C:\Windows\System\YixCOxK.exe
  C:\Windows\System\YixCOxK.exe
  2⤵
  PID:13336
- C:\Windows\System\HFKEaQH.exe
  C:\Windows\System\HFKEaQH.exe
  2⤵
  PID:2244
- C:\Windows\System\tzppweT.exe
  C:\Windows\System\tzppweT.exe
  2⤵
  PID:13424
- C:\Windows\System\DkRxQdJ.exe
  C:\Windows\System\DkRxQdJ.exe
  2⤵
  PID:13436
- C:\Windows\System\HKUDLVE.exe
  C:\Windows\System\HKUDLVE.exe
  2⤵
  PID:1820
- C:\Windows\System\wAljeYt.exe
  C:\Windows\System\wAljeYt.exe
  2⤵
  PID:1540
- C:\Windows\System\YtCpZNL.exe
  C:\Windows\System\YtCpZNL.exe
  2⤵
  PID:13472
- C:\Windows\System\JWOoFqz.exe
  C:\Windows\System\JWOoFqz.exe
  2⤵
  PID:13408
- C:\Windows\System\PYSpyQd.exe
  C:\Windows\System\PYSpyQd.exe
  2⤵
  PID:1064
- C:\Windows\System\BjkjAVb.exe
  C:\Windows\System\BjkjAVb.exe
  2⤵
  PID:13448
- C:\Windows\System\zKDBQsh.exe
  C:\Windows\System\zKDBQsh.exe
  2⤵
  PID:13540
- C:\Windows\System\MarKLIH.exe
  C:\Windows\System\MarKLIH.exe
  2⤵
  PID:13480
- C:\Windows\System\oJTRQcy.exe
  C:\Windows\System\oJTRQcy.exe
  2⤵
  PID:12600
- C:\Windows\System\YubkFxA.exe
  C:\Windows\System\YubkFxA.exe
  2⤵
  PID:13728
- C:\Windows\System\WpgANfT.exe
  C:\Windows\System\WpgANfT.exe
  2⤵
  PID:13748
- C:\Windows\System\spFnJJo.exe
  C:\Windows\System\spFnJJo.exe
  2⤵
  PID:13952
- C:\Windows\System\efkSQuR.exe
  C:\Windows\System\efkSQuR.exe
  2⤵
  PID:13980
- C:\Windows\System\UrHwpgD.exe
  C:\Windows\System\UrHwpgD.exe
  2⤵
  PID:13912
- C:\Windows\System\aZCPsyd.exe
  C:\Windows\System\aZCPsyd.exe
  2⤵
  PID:13576
- C:\Windows\System\PVDCtVZ.exe
  C:\Windows\System\PVDCtVZ.exe
  2⤵
  PID:13948
- C:\Windows\System\DBnFxmR.exe
  C:\Windows\System\DBnFxmR.exe
  2⤵
  PID:13844
- C:\Windows\System\WFSdDdi.exe
  C:\Windows\System\WFSdDdi.exe
  2⤵
  PID:13856
- C:\Windows\System\XqJURSP.exe
  C:\Windows\System\XqJURSP.exe
  2⤵
  PID:14008
- C:\Windows\System\ThxzMri.exe
  C:\Windows\System\ThxzMri.exe
  2⤵
  PID:14124
- C:\Windows\System\gZCJeZq.exe
  C:\Windows\System\gZCJeZq.exe
  2⤵
  PID:14020
- C:\Windows\System\TEUBgXQ.exe
  C:\Windows\System\TEUBgXQ.exe
  2⤵
  PID:14184
- C:\Windows\System\TauCYUr.exe
  C:\Windows\System\TauCYUr.exe
  2⤵
  PID:14100
- C:\Windows\System\LpMAnyi.exe
  C:\Windows\System\LpMAnyi.exe
  2⤵
  PID:14308
- C:\Windows\System\GFtPLMM.exe
  C:\Windows\System\GFtPLMM.exe
  2⤵
  PID:14168
- C:\Windows\System\PcCQZwV.exe
  C:\Windows\System\PcCQZwV.exe
  2⤵
  PID:13376
- C:\Windows\System\eshQpDd.exe
  C:\Windows\System\eshQpDd.exe
  2⤵
  PID:5272
- C:\Windows\System\mPXBPHa.exe
  C:\Windows\System\mPXBPHa.exe
  2⤵
  PID:13428
- C:\Windows\System\fidcTxS.exe
  C:\Windows\System\fidcTxS.exe
  2⤵
  PID:5028
- C:\Windows\System\EPuaRcS.exe
  C:\Windows\System\EPuaRcS.exe
  2⤵
  PID:4684
- C:\Windows\System\yYDKalO.exe
  C:\Windows\System\yYDKalO.exe
  2⤵
  PID:1592
- C:\Windows\System\DrjbrCt.exe
  C:\Windows\System\DrjbrCt.exe
  2⤵
  PID:13388
- C:\Windows\System\QmxRBmy.exe
  C:\Windows\System\QmxRBmy.exe
  2⤵
  PID:3020
- C:\Windows\System\eATOkev.exe
  C:\Windows\System\eATOkev.exe
  2⤵
  PID:13492
- C:\Windows\System\lMgTNpd.exe
  C:\Windows\System\lMgTNpd.exe
  2⤵
  PID:4356
- C:\Windows\System\uKCoujQ.exe
  C:\Windows\System\uKCoujQ.exe
  2⤵
  PID:13556
- C:\Windows\System\cKzQrvT.exe
  C:\Windows\System\cKzQrvT.exe
  2⤵
  PID:2072
- C:\Windows\System\mONqKCP.exe
  C:\Windows\System\mONqKCP.exe
  2⤵
  PID:13712
- C:\Windows\System\inFlIcV.exe
  C:\Windows\System\inFlIcV.exe
  2⤵
  PID:13832
- C:\Windows\System\OdXXTZh.exe
  C:\Windows\System\OdXXTZh.exe
  2⤵
  PID:13692
- C:\Windows\System\nWaFhFB.exe
  C:\Windows\System\nWaFhFB.exe
  2⤵
  PID:13964
- C:\Windows\System\BwYTcRC.exe
  C:\Windows\System\BwYTcRC.exe
  2⤵
  PID:14260
- C:\Windows\System\nEjKBYv.exe
  C:\Windows\System\nEjKBYv.exe
  2⤵
  PID:14144
- C:\Windows\System\yXvxWeU.exe
  C:\Windows\System\yXvxWeU.exe
  2⤵
  PID:12392
- C:\Windows\System\XoGtKkF.exe
  C:\Windows\System\XoGtKkF.exe
  2⤵
  PID:14328
- C:\Windows\System\ljYSgSD.exe
  C:\Windows\System\ljYSgSD.exe
  2⤵
  PID:3852
- C:\Windows\System\IxfWkwI.exe
  C:\Windows\System\IxfWkwI.exe
  2⤵
  PID:13432
- C:\Windows\System\tzPYMRC.exe
  C:\Windows\System\tzPYMRC.exe
  2⤵
  PID:5380
- C:\Windows\System\NTXGLvZ.exe
  C:\Windows\System\NTXGLvZ.exe
  2⤵
  PID:13352
- C:\Windows\System\GVBXFMP.exe
  C:\Windows\System\GVBXFMP.exe
  2⤵
  PID:5112
- C:\Windows\System\AmQIGNL.exe
  C:\Windows\System\AmQIGNL.exe
  2⤵
  PID:13052
- C:\Windows\System\lVcukZg.exe
  C:\Windows\System\lVcukZg.exe
  2⤵
  PID:552
- C:\Windows\System\blPeEJl.exe
  C:\Windows\System\blPeEJl.exe
  2⤵
  PID:1684
- C:\Windows\System\kgGzwSt.exe
  C:\Windows\System\kgGzwSt.exe
  2⤵
  PID:5528
- C:\Windows\System\LmGjRiP.exe
  C:\Windows\System\LmGjRiP.exe
  2⤵
  PID:13552
- C:\Windows\System\djBlXBc.exe
  C:\Windows\System\djBlXBc.exe
  2⤵
  PID:13668
- C:\Windows\System\zklBsYA.exe
  C:\Windows\System\zklBsYA.exe
  2⤵
  PID:13764
- C:\Windows\System\RTlxrdT.exe
  C:\Windows\System\RTlxrdT.exe
  2⤵
  PID:13516
- C:\Windows\System\wSmvPae.exe
  C:\Windows\System\wSmvPae.exe
  2⤵
  PID:13664
- C:\Windows\System\ZXobloX.exe
  C:\Windows\System\ZXobloX.exe
  2⤵
  PID:13744
- C:\Windows\System\CSTAeEp.exe
  C:\Windows\System\CSTAeEp.exe
  2⤵
  PID:5544
- C:\Windows\System\nnArqrz.exe
  C:\Windows\System\nnArqrz.exe
  2⤵
  PID:13780
- C:\Windows\System\vejpEmY.exe
  C:\Windows\System\vejpEmY.exe
  2⤵
  PID:5212
- C:\Windows\System\HVmMVjF.exe
  C:\Windows\System\HVmMVjF.exe
  2⤵
  PID:14188
- C:\Windows\System\aBBAVgQ.exe
  C:\Windows\System\aBBAVgQ.exe
  2⤵
  PID:13848
- C:\Windows\System\DEahDKh.exe
  C:\Windows\System\DEahDKh.exe
  2⤵
  PID:14208
- C:\Windows\System\nZjGZha.exe
  C:\Windows\System\nZjGZha.exe
  2⤵
  PID:14192
- C:\Windows\System\hcKxSMm.exe
  C:\Windows\System\hcKxSMm.exe
  2⤵
  PID:14152
- C:\Windows\System\oDwhjuR.exe
  C:\Windows\System\oDwhjuR.exe
  2⤵
  PID:5760
- C:\Windows\System\fUeXZDO.exe
  C:\Windows\System\fUeXZDO.exe
  2⤵
  PID:5832
- C:\Windows\System\eXAzZWn.exe
  C:\Windows\System\eXAzZWn.exe
  2⤵
  PID:13384
- C:\Windows\System\oxjlmKF.exe
  C:\Windows\System\oxjlmKF.exe
  2⤵
  PID:5276
- C:\Windows\System\okGVVkk.exe
  C:\Windows\System\okGVVkk.exe
  2⤵
  PID:5988
- C:\Windows\System\rYknVyL.exe
  C:\Windows\System\rYknVyL.exe
  2⤵
  PID:5864
- C:\Windows\System\KDLaqdX.exe
  C:\Windows\System\KDLaqdX.exe
  2⤵
  PID:6104
- C:\Windows\System\BBJfDvL.exe
  C:\Windows\System\BBJfDvL.exe
  2⤵
  PID:4384
- C:\Windows\System\kbCzsnI.exe
  C:\Windows\System\kbCzsnI.exe
  2⤵
  PID:13328
- C:\Windows\System\iGQkpBz.exe
  C:\Windows\System\iGQkpBz.exe
  2⤵
  PID:14240
- C:\Windows\System\QkEEEjq.exe
  C:\Windows\System\QkEEEjq.exe
  2⤵
  PID:5132
- C:\Windows\System\oUUmqAn.exe
  C:\Windows\System\oUUmqAn.exe
  2⤵
  PID:5396
- C:\Windows\System\rllvmqg.exe
  C:\Windows\System\rllvmqg.exe
  2⤵
  PID:5388
- C:\Windows\System\aLcmpRC.exe
  C:\Windows\System\aLcmpRC.exe
  2⤵
  PID:560
- C:\Windows\System\ofyIdYq.exe
  C:\Windows\System\ofyIdYq.exe
  2⤵
  PID:500
- C:\Windows\System\dyERXVo.exe
  C:\Windows\System\dyERXVo.exe
  2⤵
  PID:13180
- C:\Windows\System\ELbYGex.exe
  C:\Windows\System\ELbYGex.exe
  2⤵
  PID:4432
- C:\Windows\System\aGPwFIX.exe
  C:\Windows\System\aGPwFIX.exe
  2⤵
  PID:7736
- C:\Windows\System\skTWBTJ.exe
  C:\Windows\System\skTWBTJ.exe
  2⤵
  PID:5520
- C:\Windows\System\xpIUYUH.exe
  C:\Windows\System\xpIUYUH.exe
  2⤵
  PID:5476
- C:\Windows\System\otasYqw.exe
  C:\Windows\System\otasYqw.exe
  2⤵
  PID:13452
- C:\Windows\System\mHPGPqZ.exe
  C:\Windows\System\mHPGPqZ.exe
  2⤵
  PID:5196
- C:\Windows\System\qpVjkoB.exe
  C:\Windows\System\qpVjkoB.exe
  2⤵
  PID:13676
- C:\Windows\System\eGLAPNF.exe
  C:\Windows\System\eGLAPNF.exe
  2⤵
  PID:4292
- C:\Windows\System\ROCLnEx.exe
  C:\Windows\System\ROCLnEx.exe
  2⤵
  PID:13784
- C:\Windows\System\nEbCCJD.exe
  C:\Windows\System\nEbCCJD.exe
  2⤵
  PID:5984
- C:\Windows\System\SfZehav.exe
  C:\Windows\System\SfZehav.exe
  2⤵
  PID:13724
- C:\Windows\System\XrQjHtA.exe
  C:\Windows\System\XrQjHtA.exe
  2⤵
  PID:6704
- C:\Windows\System\qhgkBcN.exe
  C:\Windows\System\qhgkBcN.exe
  2⤵
  PID:5968
- C:\Windows\System\LThRRoW.exe
  C:\Windows\System\LThRRoW.exe
  2⤵
  PID:5844
- C:\Windows\System\IFxHxBr.exe
  C:\Windows\System\IFxHxBr.exe
  2⤵
  PID:14160
- C:\Windows\System\SUKhoeD.exe
  C:\Windows\System\SUKhoeD.exe
  2⤵
  PID:14216
- C:\Windows\System\ZWoCroJ.exe
  C:\Windows\System\ZWoCroJ.exe
  2⤵
  PID:6020
- C:\Windows\System\GgEVTNP.exe
  C:\Windows\System\GgEVTNP.exe
  2⤵
  PID:5204
- C:\Windows\System\AnBzBWn.exe
  C:\Windows\System\AnBzBWn.exe
  2⤵
  PID:5860
- C:\Windows\System\vcfPXFR.exe
  C:\Windows\System\vcfPXFR.exe
  2⤵
  PID:14224
- C:\Windows\System\yyohZdS.exe
  C:\Windows\System\yyohZdS.exe
  2⤵
  PID:3948
- C:\Windows\System\rMCATnA.exe
  C:\Windows\System\rMCATnA.exe
  2⤵
  PID:5576
- C:\Windows\System\aUrhzHz.exe
  C:\Windows\System\aUrhzHz.exe
  2⤵
  PID:6744
- C:\Windows\System\PIJLOgf.exe
  C:\Windows\System\PIJLOgf.exe
  2⤵
  PID:14284
- C:\Windows\System\RqDmfHx.exe
  C:\Windows\System\RqDmfHx.exe
  2⤵
  PID:6532
- C:\Windows\System\tendRbe.exe
  C:\Windows\System\tendRbe.exe
  2⤵
  PID:5940
- C:\Windows\System\GfJuuNl.exe
  C:\Windows\System\GfJuuNl.exe
  2⤵
  PID:12468
- C:\Windows\System\jpDumaJ.exe
  C:\Windows\System\jpDumaJ.exe
  2⤵
  PID:2312
- C:\Windows\System\xmYtJJR.exe
  C:\Windows\System\xmYtJJR.exe
  2⤵
  PID:6796
- C:\Windows\System\qnRgTcf.exe
  C:\Windows\System\qnRgTcf.exe
  2⤵
  PID:6716
- C:\Windows\System\cAKeovB.exe
  C:\Windows\System\cAKeovB.exe
  2⤵
  PID:5392
- C:\Windows\System\yqMXtAj.exe
  C:\Windows\System\yqMXtAj.exe
  2⤵
  PID:6528
- C:\Windows\System\DaqgGaw.exe
  C:\Windows\System\DaqgGaw.exe
  2⤵
  PID:3868
- C:\Windows\System\SlZRYBX.exe
  C:\Windows\System\SlZRYBX.exe
  2⤵
  PID:6488
- C:\Windows\System\bUofczP.exe
  C:\Windows\System\bUofczP.exe
  2⤵
  PID:6584
- C:\Windows\System\JwEBBHM.exe
  C:\Windows\System\JwEBBHM.exe
  2⤵
  PID:6368
- C:\Windows\System\ihLXsMl.exe
  C:\Windows\System\ihLXsMl.exe
  2⤵
  PID:432
- C:\Windows\System\UrTilZE.exe
  C:\Windows\System\UrTilZE.exe
  2⤵
  PID:6708
- C:\Windows\System\bXaiivZ.exe
  C:\Windows\System\bXaiivZ.exe
  2⤵
  PID:7160
- C:\Windows\System\gnZywQm.exe
  C:\Windows\System\gnZywQm.exe
  2⤵
  PID:6840
- C:\Windows\System\wRiLeOi.exe
  C:\Windows\System\wRiLeOi.exe
  2⤵
  PID:3984
- C:\Windows\System\ObBxWHB.exe
  C:\Windows\System\ObBxWHB.exe
  2⤵
  PID:13468
- C:\Windows\System\jmmnhTF.exe
  C:\Windows\System\jmmnhTF.exe
  2⤵
  PID:2292
- C:\Windows\System\cLAAHFv.exe
  C:\Windows\System\cLAAHFv.exe
  2⤵
  PID:1668
- C:\Windows\System\rUVzezX.exe
  C:\Windows\System\rUVzezX.exe
  2⤵
  PID:12728
- C:\Windows\System\REkOKia.exe
  C:\Windows\System\REkOKia.exe
  2⤵
  PID:216
- C:\Windows\System\dGjQgnC.exe
  C:\Windows\System\dGjQgnC.exe
  2⤵
  PID:5776
- C:\Windows\System\rXdqMtq.exe
  C:\Windows\System\rXdqMtq.exe
  2⤵
  PID:6188
- C:\Windows\System\MqmXdxD.exe
  C:\Windows\System\MqmXdxD.exe
  2⤵
  PID:6384
- C:\Windows\System\RQSNzQz.exe
  C:\Windows\System\RQSNzQz.exe
  2⤵
  PID:14272
- C:\Windows\System\DfwUuyr.exe
  C:\Windows\System\DfwUuyr.exe
  2⤵
  PID:12632
- C:\Windows\System\hTNgQNo.exe
  C:\Windows\System\hTNgQNo.exe
  2⤵
  PID:6580
- C:\Windows\System\aoQrOmd.exe
  C:\Windows\System\aoQrOmd.exe
  2⤵
  PID:6808
- C:\Windows\System\clwpYDe.exe
  C:\Windows\System\clwpYDe.exe
  2⤵
  PID:6560
- C:\Windows\System\ieQOisO.exe
  C:\Windows\System\ieQOisO.exe
  2⤵
  PID:5428
- C:\Windows\System\sdAMJfi.exe
  C:\Windows\System\sdAMJfi.exe
  2⤵
  PID:6600
- C:\Windows\System\hITSqiy.exe
  C:\Windows\System\hITSqiy.exe
  2⤵
  PID:5372
- C:\Windows\System\KKmPFvl.exe
  C:\Windows\System\KKmPFvl.exe
  2⤵
  PID:2920
- C:\Windows\System\vgAxsJi.exe
  C:\Windows\System\vgAxsJi.exe
  2⤵
  PID:14340
- C:\Windows\System\GASdWfn.exe
  C:\Windows\System\GASdWfn.exe
  2⤵
  PID:14356
- C:\Windows\System\LMPFJcG.exe
  C:\Windows\System\LMPFJcG.exe
  2⤵
  PID:14376
- C:\Windows\System\jiSjxWg.exe
  C:\Windows\System\jiSjxWg.exe
  2⤵
  PID:14396
- C:\Windows\System\emeyeTG.exe
  C:\Windows\System\emeyeTG.exe
  2⤵
  PID:14412
- C:\Windows\System\ZOjYxgn.exe
  C:\Windows\System\ZOjYxgn.exe
  2⤵
  PID:14436
- C:\Windows\System\ZIpBBwR.exe
  C:\Windows\System\ZIpBBwR.exe
  2⤵
  PID:14456
- C:\Windows\System\EVPnVtf.exe
  C:\Windows\System\EVPnVtf.exe
  2⤵
  PID:14476
- C:\Windows\System\dcVwbdR.exe
  C:\Windows\System\dcVwbdR.exe
  2⤵
  PID:14492
- C:\Windows\System\lyRiHyH.exe
  C:\Windows\System\lyRiHyH.exe
  2⤵
  PID:14524
- C:\Windows\System\ffllxvC.exe
  C:\Windows\System\ffllxvC.exe
  2⤵
  PID:14548
- C:\Windows\System\JyrbnGX.exe
  C:\Windows\System\JyrbnGX.exe
  2⤵
  PID:14568
- C:\Windows\System\nTYDMGe.exe
  C:\Windows\System\nTYDMGe.exe
  2⤵
  PID:14596
- C:\Windows\System\wrGHaZy.exe
  C:\Windows\System\wrGHaZy.exe
  2⤵
  PID:14820
- C:\Windows\System\ABEruAZ.exe
  C:\Windows\System\ABEruAZ.exe
  2⤵
  PID:14872
- C:\Windows\System\eUXYIQp.exe
  C:\Windows\System\eUXYIQp.exe
  2⤵
  PID:15044
- C:\Windows\System\PnnXaXb.exe
  C:\Windows\System\PnnXaXb.exe
  2⤵
  PID:15060
- C:\Windows\System\ZaNPqmD.exe
  C:\Windows\System\ZaNPqmD.exe
  2⤵
  PID:15300
- C:\Windows\System\qHeHFFD.exe
  C:\Windows\System\qHeHFFD.exe
  2⤵
  PID:7120
- C:\Windows\System\lbvjweP.exe
  C:\Windows\System\lbvjweP.exe
  2⤵
  PID:6004
- C:\Windows\System\pOlZgUv.exe
  C:\Windows\System\pOlZgUv.exe
  2⤵
  PID:7016
- C:\Windows\System\GeLeoWW.exe
  C:\Windows\System\GeLeoWW.exe
  2⤵
  PID:5836
- C:\Windows\System\rOHKzjT.exe
  C:\Windows\System\rOHKzjT.exe
  2⤵
  PID:6512
- C:\Windows\System\JeAbhsL.exe
  C:\Windows\System\JeAbhsL.exe
  2⤵
  PID:7716
- C:\Windows\System\wVYaBMo.exe
  C:\Windows\System\wVYaBMo.exe
  2⤵
  PID:5784
- C:\Windows\System\UBXyPtD.exe
  C:\Windows\System\UBXyPtD.exe
  2⤵
  PID:6832
- C:\Windows\System\AHNDIsX.exe
  C:\Windows\System\AHNDIsX.exe
  2⤵
  PID:14368
- C:\Windows\System\bBEzoTX.exe
  C:\Windows\System\bBEzoTX.exe
  2⤵
  PID:14424
- C:\Windows\System\pfTDzpJ.exe
  C:\Windows\System\pfTDzpJ.exe
  2⤵
  PID:14576
- C:\Windows\System\NmIAnGn.exe
  C:\Windows\System\NmIAnGn.exe
  2⤵
  PID:5740
- C:\Windows\System\duPtUZB.exe
  C:\Windows\System\duPtUZB.exe
  2⤵
  PID:6564
- C:\Windows\System\rILkMVw.exe
  C:\Windows\System\rILkMVw.exe
  2⤵
  PID:7060
- C:\Windows\System\dUcXZCa.exe
  C:\Windows\System\dUcXZCa.exe
  2⤵
  PID:6800
- C:\Windows\System\gUWEWwL.exe
  C:\Windows\System\gUWEWwL.exe
  2⤵
  PID:14500
- C:\Windows\System\TQWLEzE.exe
  C:\Windows\System\TQWLEzE.exe
  2⤵
  PID:14904
- C:\Windows\System\tCLLTTQ.exe
  C:\Windows\System\tCLLTTQ.exe
  2⤵
  PID:14896
- C:\Windows\System\qIOGnfJ.exe
  C:\Windows\System\qIOGnfJ.exe
  2⤵
  PID:14664
- C:\Windows\System\lsHYqAU.exe
  C:\Windows\System\lsHYqAU.exe
  2⤵
  PID:14608
- C:\Windows\System\WvzxAox.exe
  C:\Windows\System\WvzxAox.exe
  2⤵
  PID:15240
- C:\Windows\System\fBqQGej.exe
  C:\Windows\System\fBqQGej.exe
  2⤵
  PID:5884
- C:\Windows\System\tivSnho.exe
  C:\Windows\System\tivSnho.exe
  2⤵
  PID:7076
- C:\Windows\System\bzHANhC.exe
  C:\Windows\System\bzHANhC.exe
  2⤵
  PID:5856
- C:\Windows\System\FmZHewJ.exe
  C:\Windows\System\FmZHewJ.exe
  2⤵
  PID:8892
- C:\Windows\System\AIGjavf.exe
  C:\Windows\System\AIGjavf.exe
  2⤵
  PID:5192
- C:\Windows\System\UcBVwmC.exe
  C:\Windows\System\UcBVwmC.exe
  2⤵
  PID:8244
- C:\Windows\System\ItimWGW.exe
  C:\Windows\System\ItimWGW.exe
  2⤵
  PID:8368
- C:\Windows\System\ulJAQGz.exe
  C:\Windows\System\ulJAQGz.exe
  2⤵
  PID:964
- C:\Windows\System\wrZbLge.exe
  C:\Windows\System\wrZbLge.exe
  2⤵
  PID:7724
- C:\Windows\System\PjIlalo.exe
  C:\Windows\System\PjIlalo.exe
  2⤵
  PID:8820
- C:\Windows\System\bYgkbLq.exe
  C:\Windows\System\bYgkbLq.exe
  2⤵
  PID:8624
- C:\Windows\System\AcbJBnP.exe
  C:\Windows\System\AcbJBnP.exe
  2⤵
  PID:7396
- C:\Windows\System\KNTmCBx.exe
  C:\Windows\System\KNTmCBx.exe
  2⤵
  PID:13608
- C:\Windows\System\ZHTvmxD.exe
  C:\Windows\System\ZHTvmxD.exe
  2⤵
  PID:9060
- C:\Windows\System\EEjMsdT.exe
  C:\Windows\System\EEjMsdT.exe
  2⤵
  PID:14464
- C:\Windows\System\dAdntix.exe
  C:\Windows\System\dAdntix.exe
  2⤵
  PID:8336
- C:\Windows\System\XAzbebM.exe
  C:\Windows\System\XAzbebM.exe
  2⤵
  PID:9148
- C:\Windows\System\yinZIfW.exe
  C:\Windows\System\yinZIfW.exe
  2⤵
  PID:14532
- C:\Windows\System\CFKYche.exe
  C:\Windows\System\CFKYche.exe
  2⤵
  PID:8672
- C:\Windows\System\OLlOzmK.exe
  C:\Windows\System\OLlOzmK.exe
  2⤵
  PID:7352
- C:\Windows\System\dPADFFP.exe
  C:\Windows\System\dPADFFP.exe
  2⤵
  PID:5136
- C:\Windows\System\ArTILpD.exe
  C:\Windows\System\ArTILpD.exe
  2⤵
  PID:9424
- C:\Windows\System\jvhqNqg.exe
  C:\Windows\System\jvhqNqg.exe
  2⤵
  PID:4816
- C:\Windows\System\tLomljX.exe
  C:\Windows\System\tLomljX.exe
  2⤵
  PID:7252
- C:\Windows\System\FxNMbsh.exe
  C:\Windows\System\FxNMbsh.exe
  2⤵
  PID:9680
- C:\Windows\System\ogyOdLK.exe
  C:\Windows\System\ogyOdLK.exe
  2⤵
  PID:9984
- C:\Windows\System\MvCpQwI.exe
  C:\Windows\System\MvCpQwI.exe
  2⤵
  PID:14776
- C:\Windows\System\NqJvTHe.exe
  C:\Windows\System\NqJvTHe.exe
  2⤵
  PID:14504
- C:\Windows\System\ujOIBzG.exe
  C:\Windows\System\ujOIBzG.exe
  2⤵
  PID:7380
- C:\Windows\System\qYUrzpS.exe
  C:\Windows\System\qYUrzpS.exe
  2⤵
  PID:7688
- C:\Windows\System\mqGjZBe.exe
  C:\Windows\System\mqGjZBe.exe
  2⤵
  PID:8032
- C:\Windows\System\WcLWTsd.exe
  C:\Windows\System\WcLWTsd.exe
  2⤵
  PID:7640
- C:\Windows\System\GFYnGOw.exe
  C:\Windows\System\GFYnGOw.exe
  2⤵
  PID:8500
- C:\Windows\System\UJOlCQL.exe
  C:\Windows\System\UJOlCQL.exe
  2⤵
  PID:2756
- C:\Windows\System\VHDypzr.exe
  C:\Windows\System\VHDypzr.exe
  2⤵
  PID:9012
- C:\Windows\System\vvILVpY.exe
  C:\Windows\System\vvILVpY.exe
  2⤵
  PID:8952
- C:\Windows\System\YAHkIWm.exe
  C:\Windows\System\YAHkIWm.exe
  2⤵
  PID:8172
- C:\Windows\System\KEFkOGN.exe
  C:\Windows\System\KEFkOGN.exe
  2⤵
  PID:8932
- C:\Windows\System\XnvpgfB.exe
  C:\Windows\System\XnvpgfB.exe
  2⤵
  PID:8876
- C:\Windows\System\DOyQCaD.exe
  C:\Windows\System\DOyQCaD.exe
  2⤵
  PID:9268
- C:\Windows\System\CUtPSBW.exe
  C:\Windows\System\CUtPSBW.exe
  2⤵
  PID:6784
- C:\Windows\System\ZBkYpyE.exe
  C:\Windows\System\ZBkYpyE.exe
  2⤵
  PID:5328
- C:\Windows\System\RzcSnZA.exe
  C:\Windows\System\RzcSnZA.exe
  2⤵
  PID:9672
- C:\Windows\System\FiqWGej.exe
  C:\Windows\System\FiqWGej.exe
  2⤵
  PID:9684
- C:\Windows\System\uvVMSEr.exe
  C:\Windows\System\uvVMSEr.exe
  2⤵
  PID:8132
- C:\Windows\System\tTDBSJq.exe
  C:\Windows\System\tTDBSJq.exe
  2⤵
  PID:7100
- C:\Windows\System\PCuqYET.exe
  C:\Windows\System\PCuqYET.exe
  2⤵
  PID:14404
- C:\Windows\System\PyBMoOe.exe
  C:\Windows\System\PyBMoOe.exe
  2⤵
  PID:9836
- C:\Windows\System\BRFHNlP.exe
  C:\Windows\System\BRFHNlP.exe
  2⤵
  PID:9664
- C:\Windows\System\jHEZUKM.exe
  C:\Windows\System\jHEZUKM.exe
  2⤵
  PID:6108
- C:\Windows\System\ViofciL.exe
  C:\Windows\System\ViofciL.exe
  2⤵
  PID:14908
- C:\Windows\System\BbZCRUj.exe
  C:\Windows\System\BbZCRUj.exe
  2⤵
  PID:8440
- C:\Windows\System\qxMfDLn.exe
  C:\Windows\System\qxMfDLn.exe
  2⤵
  PID:9728
- C:\Windows\System\WdmWVdt.exe
  C:\Windows\System\WdmWVdt.exe
  2⤵
  PID:6936
- C:\Windows\System\ADnacMc.exe
  C:\Windows\System\ADnacMc.exe
  2⤵
  PID:9808
- C:\Windows\System\GHQULok.exe
  C:\Windows\System\GHQULok.exe
  2⤵
  PID:12944
- C:\Windows\System\JQpsweS.exe
  C:\Windows\System\JQpsweS.exe
  2⤵
  PID:8656
- C:\Windows\System\uZaytpu.exe
  C:\Windows\System\uZaytpu.exe
  2⤵
  PID:15116
- C:\Windows\System\znexndw.exe
  C:\Windows\System\znexndw.exe
  2⤵
  PID:15180
- C:\Windows\System\ArerkcV.exe
  C:\Windows\System\ArerkcV.exe
  2⤵
  PID:9116
- C:\Windows\System\traMfKU.exe
  C:\Windows\System\traMfKU.exe
  2⤵
  PID:9716
- C:\Windows\System\LwquMDJ.exe
  C:\Windows\System\LwquMDJ.exe
  2⤵
  PID:8436
- C:\Windows\System\gYLkXTM.exe
  C:\Windows\System\gYLkXTM.exe
  2⤵
  PID:6788
- C:\Windows\System\gCxKxbu.exe
  C:\Windows\System\gCxKxbu.exe
  2⤵
  PID:9508
- C:\Windows\System\riOTcmH.exe
  C:\Windows\System\riOTcmH.exe
  2⤵
  PID:6480
- C:\Windows\System\gIlnsEQ.exe
  C:\Windows\System\gIlnsEQ.exe
  2⤵
  PID:14116
- C:\Windows\System\HhUjXMh.exe
  C:\Windows\System\HhUjXMh.exe
  2⤵
  PID:7624
- C:\Windows\System\mpQeaML.exe
  C:\Windows\System\mpQeaML.exe
  2⤵
  PID:8840
- C:\Windows\System\NWbfNau.exe
  C:\Windows\System\NWbfNau.exe
  2⤵
  PID:9080
- C:\Windows\System\fWGyOLE.exe
  C:\Windows\System\fWGyOLE.exe
  2⤵
  PID:10328
- C:\Windows\System\PHniCVM.exe
  C:\Windows\System\PHniCVM.exe
  2⤵
  PID:14444
- C:\Windows\System\gItqSDE.exe
  C:\Windows\System\gItqSDE.exe
  2⤵
  PID:10300
- C:\Windows\System\slkRgPf.exe
  C:\Windows\System\slkRgPf.exe
  2⤵
  PID:6624
- C:\Windows\System\oWVHtHa.exe
  C:\Windows\System\oWVHtHa.exe
  2⤵
  PID:10696
- C:\Windows\System\kRasiaD.exe
  C:\Windows\System\kRasiaD.exe
  2⤵
  PID:14692
- C:\Windows\System\lBIlHiZ.exe
  C:\Windows\System\lBIlHiZ.exe
  2⤵
  PID:10416
- C:\Windows\System\zzBvRxC.exe
  C:\Windows\System\zzBvRxC.exe
  2⤵
  PID:15276
- C:\Windows\System\NgNKzvi.exe
  C:\Windows\System\NgNKzvi.exe
  2⤵
  PID:8844
- C:\Windows\System\QiirsOV.exe
  C:\Windows\System\QiirsOV.exe
  2⤵
  PID:8116
- C:\Windows\System\XTNSBSn.exe
  C:\Windows\System\XTNSBSn.exe
  2⤵
  PID:8060
- C:\Windows\System\cBqPoDv.exe
  C:\Windows\System\cBqPoDv.exe
  2⤵
  PID:832
- C:\Windows\System\ubliypd.exe
  C:\Windows\System\ubliypd.exe
  2⤵
  PID:8628
- C:\Windows\System\WTVrNEK.exe
  C:\Windows\System\WTVrNEK.exe
  2⤵
  PID:6880
- C:\Windows\System\JjUrHjz.exe
  C:\Windows\System\JjUrHjz.exe
  2⤵
  PID:7616
- C:\Windows\System\yCSNWFz.exe
  C:\Windows\System\yCSNWFz.exe
  2⤵
  PID:8944
- C:\Windows\System\qzmgidZ.exe
  C:\Windows\System\qzmgidZ.exe
  2⤵
  PID:7340
- C:\Windows\System\bMhKgZY.exe
  C:\Windows\System\bMhKgZY.exe
  2⤵
  PID:6952
- C:\Windows\System\KaxmkEA.exe
  C:\Windows\System\KaxmkEA.exe
  2⤵
  PID:10028
- C:\Windows\System\lWuHDWD.exe
  C:\Windows\System\lWuHDWD.exe
  2⤵
  PID:15308
- C:\Windows\System\sWRwKpH.exe
  C:\Windows\System\sWRwKpH.exe
  2⤵
  PID:14384
- C:\Windows\System\fYzrLAH.exe
  C:\Windows\System\fYzrLAH.exe
  2⤵
  PID:7360
- C:\Windows\System\DDdgdQF.exe
  C:\Windows\System\DDdgdQF.exe
  2⤵
  PID:9864
- C:\Windows\System\mBtNZwX.exe
  C:\Windows\System\mBtNZwX.exe
  2⤵
  PID:10344
- C:\Windows\System\ZIwqMOO.exe
  C:\Windows\System\ZIwqMOO.exe
  2⤵
  PID:9088
- C:\Windows\System\xbqwzyU.exe
  C:\Windows\System\xbqwzyU.exe
  2⤵
  PID:8008
- C:\Windows\System\ptuFrfR.exe
  C:\Windows\System\ptuFrfR.exe
  2⤵
  PID:10376
- C:\Windows\System\GJMPGNu.exe
  C:\Windows\System\GJMPGNu.exe
  2⤵
  PID:10408
- C:\Windows\System\gSicKLz.exe
  C:\Windows\System\gSicKLz.exe
  2⤵
  PID:14756
- C:\Windows\System\MhTsLga.exe
  C:\Windows\System\MhTsLga.exe
  2⤵
  PID:11272
- C:\Windows\System\PGCpMSS.exe
  C:\Windows\System\PGCpMSS.exe
  2⤵
  PID:10548
- C:\Windows\System\yauSSpc.exe
  C:\Windows\System\yauSSpc.exe
  2⤵
  PID:10552
- C:\Windows\System\aVAOqie.exe
  C:\Windows\System\aVAOqie.exe
  2⤵
  PID:10604
- C:\Windows\System\fFpjuWi.exe
  C:\Windows\System\fFpjuWi.exe
  2⤵
  PID:7184
- C:\Windows\System\lXquMqN.exe
  C:\Windows\System\lXquMqN.exe
  2⤵
  PID:9120
- C:\Windows\System\YmmQWti.exe
  C:\Windows\System\YmmQWti.exe
  2⤵
  PID:10888
- C:\Windows\System\lpGJJai.exe
  C:\Windows\System\lpGJJai.exe
  2⤵
  PID:796
- C:\Windows\System\IWDDIwj.exe
  C:\Windows\System\IWDDIwj.exe
  2⤵
  PID:13808
- C:\Windows\System\aSsSRVy.exe
  C:\Windows\System\aSsSRVy.exe
  2⤵
  PID:9220
- C:\Windows\System\LrrAyjO.exe
  C:\Windows\System\LrrAyjO.exe
  2⤵
  PID:11600
- C:\Windows\System\bEgaTMl.exe
  C:\Windows\System\bEgaTMl.exe
  2⤵
  PID:5296
- C:\Windows\System\XUqxBba.exe
  C:\Windows\System\XUqxBba.exe
  2⤵
  PID:9692
- C:\Windows\System\hwLMaur.exe
  C:\Windows\System\hwLMaur.exe
  2⤵
  PID:15332
- C:\Windows\System\jpZsdRT.exe
  C:\Windows\System\jpZsdRT.exe
  2⤵
  PID:9876
- C:\Windows\System\NXsAtgG.exe
  C:\Windows\System\NXsAtgG.exe
  2⤵
  PID:14892
- C:\Windows\System\kHWpRKj.exe
  C:\Windows\System\kHWpRKj.exe
  2⤵
  PID:14852
- C:\Windows\System\zIbKRLU.exe
  C:\Windows\System\zIbKRLU.exe
  2⤵
  PID:8052
- C:\Windows\System\dvxLDTq.exe
  C:\Windows\System\dvxLDTq.exe
  2⤵
  PID:11636
- C:\Windows\System\xsCXKQl.exe
  C:\Windows\System\xsCXKQl.exe
  2⤵
  PID:10460
- C:\Windows\System\dEpguyM.exe
  C:\Windows\System\dEpguyM.exe
  2⤵
  PID:9908
- C:\Windows\System\bzhHuAK.exe
  C:\Windows\System\bzhHuAK.exe
  2⤵
  PID:11976
- C:\Windows\System\oBhhQln.exe
  C:\Windows\System\oBhhQln.exe
  2⤵
  PID:9756
- C:\Windows\System\iQdNulA.exe
  C:\Windows\System\iQdNulA.exe
  2⤵
  PID:11280
- C:\Windows\System\uSBfMox.exe
  C:\Windows\System\uSBfMox.exe
  2⤵
  PID:8704
- C:\Windows\System\KmnJQTv.exe
  C:\Windows\System\KmnJQTv.exe
  2⤵
  PID:11480
- C:\Windows\System\hWNJzlW.exe
  C:\Windows\System\hWNJzlW.exe
  2⤵
  PID:8920
- C:\Windows\System\VkpLvmR.exe
  C:\Windows\System\VkpLvmR.exe
  2⤵
  PID:9132
- C:\Windows\System\aDDZNyj.exe
  C:\Windows\System\aDDZNyj.exe
  2⤵
  PID:6676
- C:\Windows\System\UTDbkyO.exe
  C:\Windows\System\UTDbkyO.exe
  2⤵
  PID:9252
- C:\Windows\System\EwLoVhU.exe
  C:\Windows\System\EwLoVhU.exe
  2⤵
  PID:12128
- C:\Windows\System\JBbknAT.exe
  C:\Windows\System\JBbknAT.exe
  2⤵
  PID:9760
- C:\Windows\System\IUXEoCw.exe
  C:\Windows\System\IUXEoCw.exe
  2⤵
  PID:9832
- C:\Windows\System\YptvROR.exe
  C:\Windows\System\YptvROR.exe
  2⤵
  PID:8660
- C:\Windows\System\ZHYvueD.exe
  C:\Windows\System\ZHYvueD.exe
  2⤵
  PID:10876
- C:\Windows\System\jZmwvPW.exe
  C:\Windows\System\jZmwvPW.exe
  2⤵
  PID:11440
- C:\Windows\System\MgbyatB.exe
  C:\Windows\System\MgbyatB.exe
  2⤵
  PID:9660
- C:\Windows\System\CWZgotz.exe
  C:\Windows\System\CWZgotz.exe
  2⤵
  PID:3560
- C:\Windows\System\pXkJsLE.exe
  C:\Windows\System\pXkJsLE.exe
  2⤵
  PID:8612
- C:\Windows\System\tyLYRgp.exe
  C:\Windows\System\tyLYRgp.exe
  2⤵
  PID:9200
- C:\Windows\System\PGKSYxw.exe
  C:\Windows\System\PGKSYxw.exe
  2⤵
  PID:9036
- C:\Windows\System\eTYiwNq.exe
  C:\Windows\System\eTYiwNq.exe
  2⤵
  PID:10004
- C:\Windows\System\HXTWtjC.exe
  C:\Windows\System\HXTWtjC.exe
  2⤵
  PID:15008
- C:\Windows\System\RKQycoZ.exe
  C:\Windows\System\RKQycoZ.exe
  2⤵
  PID:9172
- C:\Windows\System\jqdDaTF.exe
  C:\Windows\System\jqdDaTF.exe
  2⤵
  PID:14048
- C:\Windows\System\HllwleD.exe
  C:\Windows\System\HllwleD.exe
  2⤵
  PID:10184
- C:\Windows\System\vfjGoqx.exe
  C:\Windows\System\vfjGoqx.exe
  2⤵
  PID:8404
- C:\Windows\System\ybPmpDu.exe
  C:\Windows\System\ybPmpDu.exe
  2⤵
  PID:10732
- C:\Windows\System\XdmAVtO.exe
  C:\Windows\System\XdmAVtO.exe
  2⤵
  PID:7880
- C:\Windows\System\mQJCvvP.exe
  C:\Windows\System\mQJCvvP.exe
  2⤵
  PID:8632
- C:\Windows\System\eYBWVOg.exe
  C:\Windows\System\eYBWVOg.exe
  2⤵
  PID:11640
- C:\Windows\System\hwwaFfT.exe
  C:\Windows\System\hwwaFfT.exe
  2⤵
  PID:10544
- C:\Windows\System\GLCedMf.exe
  C:\Windows\System\GLCedMf.exe
  2⤵
  PID:1508
- C:\Windows\System\qbWckOK.exe
  C:\Windows\System\qbWckOK.exe
  2⤵
  PID:12812
- C:\Windows\System\azVTeHs.exe
  C:\Windows\System\azVTeHs.exe
  2⤵
  PID:12764
- C:\Windows\System\jDkLbuG.exe
  C:\Windows\System\jDkLbuG.exe
  2⤵
  PID:12016
- C:\Windows\System\TxTOaLe.exe
  C:\Windows\System\TxTOaLe.exe
  2⤵
  PID:10540
- C:\Windows\System\mlQWyzV.exe
  C:\Windows\System\mlQWyzV.exe
  2⤵
  PID:14628
- C:\Windows\System\ZNYNWhH.exe
  C:\Windows\System\ZNYNWhH.exe
  2⤵
  PID:13260
- C:\Windows\System\GpmubuS.exe
  C:\Windows\System\GpmubuS.exe
  2⤵
  PID:11428
- C:\Windows\System\PjfYiPT.exe
  C:\Windows\System\PjfYiPT.exe
  2⤵
  PID:10640
- C:\Windows\System\cJuAgWc.exe
  C:\Windows\System\cJuAgWc.exe
  2⤵
  PID:12952
- C:\Windows\System\klXgtOY.exe
  C:\Windows\System\klXgtOY.exe
  2⤵
  PID:12292
- C:\Windows\System\wuyCzqw.exe
  C:\Windows\System\wuyCzqw.exe
  2⤵
  PID:13280
- C:\Windows\System\LstUfDZ.exe
  C:\Windows\System\LstUfDZ.exe
  2⤵
  PID:12552
- C:\Windows\System\gjJIntY.exe
  C:\Windows\System\gjJIntY.exe
  2⤵
  PID:14732
- C:\Windows\System\EuMrVJM.exe
  C:\Windows\System\EuMrVJM.exe
  2⤵
  PID:10736
- C:\Windows\System\aqRtAVm.exe
  C:\Windows\System\aqRtAVm.exe
  2⤵
  PID:15040
- C:\Windows\System\eVIINOR.exe
  C:\Windows\System\eVIINOR.exe
  2⤵
  PID:9432
- C:\Windows\System\ipSUfid.exe
  C:\Windows\System\ipSUfid.exe
  2⤵
  PID:12892
- C:\Windows\System\gxWfCrv.exe
  C:\Windows\System\gxWfCrv.exe
  2⤵
  PID:12876
- C:\Windows\System\OvMfuiH.exe
  C:\Windows\System\OvMfuiH.exe
  2⤵
  PID:12872
- C:\Windows\System\jRUdwxW.exe
  C:\Windows\System\jRUdwxW.exe
  2⤵
  PID:8552
- C:\Windows\System\JKQowCm.exe
  C:\Windows\System\JKQowCm.exe
  2⤵
  PID:10172
- C:\Windows\System\zslDXPz.exe
  C:\Windows\System\zslDXPz.exe
  2⤵
  PID:10320
- C:\Windows\System\OyuBTyQ.exe
  C:\Windows\System\OyuBTyQ.exe
  2⤵
  PID:12492
- C:\Windows\System\JeFgTav.exe
  C:\Windows\System\JeFgTav.exe
  2⤵
  PID:12884
- C:\Windows\System\jllVGGa.exe
  C:\Windows\System\jllVGGa.exe
  2⤵
  PID:12604
- C:\Windows\System\yFgvfvU.exe
  C:\Windows\System\yFgvfvU.exe
  2⤵
  PID:9092
- C:\Windows\System\uCIKyDq.exe
  C:\Windows\System\uCIKyDq.exe
  2⤵
  PID:12692
- C:\Windows\System\caytNhP.exe
  C:\Windows\System\caytNhP.exe
  2⤵
  PID:10996
- C:\Windows\System\GBzYwcV.exe
  C:\Windows\System\GBzYwcV.exe
  2⤵
  PID:8040
- C:\Windows\System\WoCKFsu.exe
  C:\Windows\System\WoCKFsu.exe
  2⤵
  PID:15012
- C:\Windows\System\tbNejZq.exe
  C:\Windows\System\tbNejZq.exe
  2⤵
  PID:6200
- C:\Windows\System\WucVxxp.exe
  C:\Windows\System\WucVxxp.exe
  2⤵
  PID:12452
- C:\Windows\System\bVTKfEZ.exe
  C:\Windows\System\bVTKfEZ.exe
  2⤵
  PID:12136
- C:\Windows\System\gHLsKPt.exe
  C:\Windows\System\gHLsKPt.exe
  2⤵
  PID:8728
- C:\Windows\System\oSUvEFs.exe
  C:\Windows\System\oSUvEFs.exe
  2⤵
  PID:10520
- C:\Windows\System\XKhfkaC.exe
  C:\Windows\System\XKhfkaC.exe
  2⤵
  PID:12740
- C:\Windows\System\SnPEbCk.exe
  C:\Windows\System\SnPEbCk.exe
  2⤵
  PID:13112
- C:\Windows\System\MvQKFBa.exe
  C:\Windows\System\MvQKFBa.exe
  2⤵
  PID:13284
- C:\Windows\System\IiTiqHp.exe
  C:\Windows\System\IiTiqHp.exe
  2⤵
  PID:12516
- C:\Windows\System\wIcxIdA.exe
  C:\Windows\System\wIcxIdA.exe
  2⤵
  PID:12680
- C:\Windows\System\AqFPcFn.exe
  C:\Windows\System\AqFPcFn.exe
  2⤵
  PID:12568
- C:\Windows\System\mLTPBiw.exe
  C:\Windows\System\mLTPBiw.exe
  2⤵
  PID:12100
- C:\Windows\System\WpVEann.exe
  C:\Windows\System\WpVEann.exe
  2⤵
  PID:12108
- C:\Windows\System\eLIGxmX.exe
  C:\Windows\System\eLIGxmX.exe
  2⤵
  PID:12940
- C:\Windows\System\XWPNebX.exe
  C:\Windows\System\XWPNebX.exe
  2⤵
  PID:8688
- C:\Windows\System\wLQqIOC.exe
  C:\Windows\System\wLQqIOC.exe
  2⤵
  PID:12748
- C:\Windows\System\ooNlXhk.exe
  C:\Windows\System\ooNlXhk.exe
  2⤵
  PID:15348
- C:\Windows\System\locRMGX.exe
  C:\Windows\System\locRMGX.exe
  2⤵
  PID:12592
- C:\Windows\System\HuVdRok.exe
  C:\Windows\System\HuVdRok.exe
  2⤵
  PID:12976
- C:\Windows\System\wOPygLE.exe
  C:\Windows\System\wOPygLE.exe
  2⤵
  PID:12232
- C:\Windows\System\siZpyuf.exe
  C:\Windows\System\siZpyuf.exe
  2⤵
  PID:11676
- C:\Windows\System\HQMRSJG.exe
  C:\Windows\System\HQMRSJG.exe
  2⤵
  PID:2572
- C:\Windows\System\ZSVYliE.exe
  C:\Windows\System\ZSVYliE.exe
  2⤵
  PID:5848
- C:\Windows\System\repqWRo.exe
  C:\Windows\System\repqWRo.exe
  2⤵
  PID:9008
- C:\Windows\System\qwebkLU.exe
  C:\Windows\System\qwebkLU.exe
  2⤵
  PID:11864
- C:\Windows\System\VAlyoNY.exe
  C:\Windows\System\VAlyoNY.exe
  2⤵
  PID:15380
- C:\Windows\System\ylNyDjh.exe
  C:\Windows\System\ylNyDjh.exe
  2⤵
  PID:15400
- C:\Windows\System\iGmREsn.exe
  C:\Windows\System\iGmREsn.exe
  2⤵
  PID:15424
- C:\Windows\System\pVZrkXt.exe
  C:\Windows\System\pVZrkXt.exe
  2⤵
  PID:15452
- C:\Windows\System\CDWHYFW.exe
  C:\Windows\System\CDWHYFW.exe
  2⤵
  PID:15472
- C:\Windows\System\TGdbJVc.exe
  C:\Windows\System\TGdbJVc.exe
  2⤵
  PID:15492
- C:\Windows\System\JgoXafU.exe
  C:\Windows\System\JgoXafU.exe
  2⤵
  PID:15516
- C:\Windows\System\pKQWrwd.exe
  C:\Windows\System\pKQWrwd.exe
  2⤵
  PID:15540
- C:\Windows\System\RZHJrDI.exe
  C:\Windows\System\RZHJrDI.exe
  2⤵
  PID:15560
- C:\Windows\System\KyHjeJr.exe
  C:\Windows\System\KyHjeJr.exe
  2⤵
  PID:15580
- C:\Windows\System\RRvZUme.exe
  C:\Windows\System\RRvZUme.exe
  2⤵
  PID:15604
- C:\Windows\System\imWdaFv.exe
  C:\Windows\System\imWdaFv.exe
  2⤵
  PID:15624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X0OFMNIL\site-d059d883a114[1].css

Filesize
66KB

MD5
06ad9bc6321c6fed15c64dd375c36d90

SHA1
2abef97ab0621a1d832c6ca784721adad5bc8315

SHA256
74439e916848a6d30f2933b4e7c5a88b41d8ca3a1593f68a82596379806d4ae6

SHA512
d059d883a114193dd05c54c9d3db4f1552bba29320d529b3abed354152a17bcd773dfdec46afc8c2f2d7fd7f13ff85042fa697d761cb7a3447a8488349c81e2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0ce2q0lx.1ok.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AyYhPAd.exe

Filesize
1.4MB

MD5
c38a2f225011ffbd599c05a998ef8a7b

SHA1
067106b4a497f9634eb80d9bd7bb966483e2aeff

SHA256
57f0602ebaa8ad3856a313eadcaf45bff68753c39f1cf4d93f6f6f5be04d7dc8

SHA512
1e7d2cf408e70fb918ec5a389a1eed77d86e47791cb5f07b340dcadff3a7028e775f0db6e78264afa33c8964a9400e4f0eb3430e91ade29c2af3bd87fed19c8a

Download Submit
C:\Windows\System\BByhmfs.exe

Filesize
1.4MB

MD5
a5eac6e84957ba105235afa363c8beab

SHA1
dc784d975720b8303993d2bf2eb402822fb6bfc4

SHA256
e42e567ef359ae8006bdc8fa8cb7650c25e54ca7e9553ee75da20e709b528411

SHA512
eca534c5a28b320c467306568b2003a7a24ba6b14ef3f9607fe48611fa9449a2f8b973848ef5e3c31451c730289b88125886ea7c59b2389e85485e8e703808c1

Download Submit
C:\Windows\System\EOsLYdT.exe

Filesize
1.4MB

MD5
ff7e2c03f43faa525e193dd3221afd4c

SHA1
aa6b0ea16b2775cf6aa158febb6e68aff9e1396c

SHA256
32e521e20bf489438d819b6392f7c3e073d5d9b3c91dad34c1a316b4f7f3d66c

SHA512
4cae0b1ffaf45d97c531c0610441f4cf5c3e67b1bfe973e2ab88965c012e2eb0db69c8499f5eb73bcf5674c2b0085a037a3acee503886c8d90fd7320c5d11e43

Download Submit
C:\Windows\System\FDzAsqq.exe

Filesize
1.4MB

MD5
dfb895a11c1aa585f7e76a36023b0e53

SHA1
efdd5584ed0a3701e868a397a6d9305e07d41aab

SHA256
93d1ca336d83de0a1a10d87eb4e8686829b7f0b594161418612b8beb1971b99e

SHA512
bd24d6f679179cdf2f3d3ccf1ba6d594d4624cca12f6ae5052b84d9c6dfdfa3ccd4c4309b04cbe8352500e48e0b5d70c289d0ef4abfb5d317a1339d2472ca6d1

Download Submit
C:\Windows\System\FIZRsSs.exe

Filesize
1.4MB

MD5
32579babcdb812a08b26a52674763332

SHA1
f16964528eeb2c809d863e992ad6c083ab9a9fab

SHA256
15682840b144566f6d607398d094b3169c23b12f6bc83db8d1025cfe87368876

SHA512
85c6a1e259f3d4102aa304f5fa100f596499cc9e90a915a4e715f9b560662ad28f7b92f80fc5ecb6b2b2d9b05283428f46f411f49d876bd52dd5bb120a4e9e04

Download Submit
C:\Windows\System\JEhfUjT.exe

Filesize
1.4MB

MD5
0b67ca5b625a395cf4207aa322669c87

SHA1
fe1027c9c116a75eb4e0bf6cb6ac985b0de2ad36

SHA256
7d9296e9006028ca99f3e683f4f25e4261d4e10e88c5ad11771cb285210a50b2

SHA512
8675fb14cdd44d7fe49b09eaab53a1a132dff32f54b569526904bd824bb0b9232faa25948cfe793834984e0ab7aea522d8fd3cdceee8beca0333b5a79f537502

Download Submit
C:\Windows\System\JxNzZsL.exe

Filesize
1.2MB

MD5
e3cd8d2f8647c903aebe916658c7c412

SHA1
19ef0e873c161066ac256fd09412dad55639e1e0

SHA256
11c06cf80d4a1453b8a5d8797d9d0dc6d00d33687001ba7c76c277280e55652d

SHA512
f7a854e3bc9bb017332df614559e92b30012666bbb0062c230506bbb23b9213499a0fcbe707722ed1a083cd828f379d03ed622bffd4793824393805e9ba2b3b2

Download Submit
C:\Windows\System\JxNzZsL.exe

Filesize
1.4MB

MD5
214ba5babf073933a49a14d644ab57b5

SHA1
05383abe5bd0cd4bbe5309e872ed8aa4536276ae

SHA256
886a661da32ad5f9f9b649d54d12d2ab5dac6e4da0944eef633c7f4eb319b949

SHA512
93dfe2d8b192555f7dbc5141b5a07d8ab64074bdb98609290c543453f9bf164afffbbef63d0c2453d48cde26f471509ab7071d46173d50839af47d4066e3251c

Download Submit
C:\Windows\System\KcPDtyh.exe

Filesize
1.4MB

MD5
445348dfeb05f2213cb0878a3187e05d

SHA1
a3fbbbec8470af92e53b8678fdc9061699122a0b

SHA256
1243f975b3cd3603630566c94e6e9c6891e81e167565c5b184af453d1ddeb08b

SHA512
8ad473d3046640d05d39e55f0e1852e1b26ac2f90fc27712da3049361845d3ab709bc5cc783cc578f2b701f3d57a0f558884005fb09503a794bcf67fcbeec4cd

Download Submit
C:\Windows\System\MPeCfZC.exe

Filesize
8B

MD5
2d0c2c2eeafda1eefbc846623106a651

SHA1
ebe1d12cc7355840b98bff551fa1e9b6ea05149b

SHA256
315fe12e8506c9a5679018a241c22762f38597a85e3d6906984d2cd8e0eb0749

SHA512
4747f2fca75d2722dc6b7850f1cf2e05f5ebac7e64d54a9f03247ac705b6e7fd5e4086e67fbc0da577c026e6cfc06192b9232b3f0c023c488535fb6f948376dc

Download Submit
C:\Windows\System\OHlcKqu.exe

Filesize
1.3MB

MD5
b3acbab6ced97cb8ab19401374fe3503

SHA1
07768bb8df7095733a7e8edbb6922d4a7ea1f2a8

SHA256
b535a26117b7d6a8cfb4387dd33d4f6d50127f93b7c0310cfa69e24d81a890e4

SHA512
1386156c3571bc1204c6da36809db09d22355cb531175f8ab611dd5f1717f8c9215a12ec90e01c4803c7415c01e2098147e29a9d7cf2aabd624c12943b8fb937

Download Submit
C:\Windows\System\PVtRwKr.exe

Filesize
1.3MB

MD5
a067305f5c1c018910a6c1dab73a1ca3

SHA1
dae284527ebaea7bf5912335ff50b475ba2d6c79

SHA256
eca301607b8ad4550da500463ac0330d32b21cf17bc2a93f82546e94899089c0

SHA512
25a0877f163bcf83267a0142c318a09b148295eb8509f93391fb2e0b65bc77cbddbb99c264749aa87dce0f28ebc42333735634101ba9f1e670bc02d6c5a640ff

Download Submit
C:\Windows\System\TmNiPPy.exe

Filesize
1.4MB

MD5
606ca764d33488276d00591171fa1306

SHA1
c7b63a1097096309d04f916c4e140ff34aeda38f

SHA256
cc6a495637cb2a6da97e6bd288cd54d8a94ebb6dead9e18143ed2e7876889f17

SHA512
3c394428dda98cbeaaa742536b7ba4624ed9c60f73e7bbe5ef478dd14a0b5e29aa2f9c7069689f52b21019d5a86d7e22af3f78bbd934cb4863cab91fde0f92e3

Download Submit
C:\Windows\System\WzUZHhp.exe

Filesize
1.4MB

MD5
fadf8b95bda7830e8fb0bd7b9de492a1

SHA1
eb510ac000c11e71901133554c9afca4534506ce

SHA256
40508efc10d2e83abba47d8cdd98f30c9b493970dc9fcb8256dc9f14bf02dbf4

SHA512
8f62ae06a75d70151d02cd9004b8802e41d2110440f912ab63e3e63ce6cb3d40edf42931b8d941476974117571bbe4d13b0fe855081e1c2675837bff969a338a

Download Submit
C:\Windows\System\XAqUGby.exe

Filesize
1.4MB

MD5
267a8e72b0299e87efcf906120966071

SHA1
a8dc329e822b937b51eb1f5b2c564d1ebd56ba0c

SHA256
f39ea0476bff7cc03ba13299e5ccba8a61dc86a79e73a6002f64cad0a327ce18

SHA512
d32cd824d05bf55b580a5cbc222b6134db559901a49888e99d6d1379ef64e01380891120a5c470d3db2e6366608d2f4df1e60dae7098ec7cdeeef3406f42b4b0

Download Submit
C:\Windows\System\XrdGsPE.exe

Filesize
1.4MB

MD5
64b2bfc818a76d36862003532e5f679b

SHA1
6cb1583ce22a8a3983377938b2f3ab6246c8e13c

SHA256
592b4da2dcb7601b08e3797944d40621d8b74bee34cd6bc3bd0ae75b554db15a

SHA512
dc823b60bdc96a0961e6816c7daacdf58dfc7435caa75e3d4c0d933a4a56cda32bbcf986340b7e34c639c5d246136db0ca718be19b4e14ca43cf2b9a5f8ceb40

Download Submit
C:\Windows\System\bOTvviU.exe

Filesize
1.4MB

MD5
375b6f822b4c603dd68a4cd97151f213

SHA1
498210b496afdb76cc718582a1600ff4f78cb124

SHA256
3e49deebf259a8b555b8465c257e4e447920fed95e3d7317568cffb7e8eaf088

SHA512
e34cc2d59453da1d2467989af06a4045981527f25a581093a3e420bd5b301fb969c80384a63ec8e3e3a4acd3606ccd3fe92a8653ad68b8da8e62572382b6b2d0

Download Submit
C:\Windows\System\cvFXCrl.exe

Filesize
1.4MB

MD5
861a36a27119dacd35077e8144c096a3

SHA1
401bdea3cf50e2fa0d98952796ce2819f35006cb

SHA256
77f49af31cc4c6fbc3c01ee07ae6100138c4968bf4f37fafeecdcad5078c8398

SHA512
22c62ec02e64e87e50800b86daa72b4e281aa5e514950e811eaa06c5350149e1b33b6ab79b4e03e24ba15f02531cd3e2fbeb7d54a2e70db3c874293f0c65266c

Download Submit
C:\Windows\System\eJvmyBg.exe

Filesize
1.4MB

MD5
f87c50145aa6ee8f7f0ede09144462a7

SHA1
b8456418dba386237f4c23eea1fe6e621b28c1e3

SHA256
0608f33e19df11f9f97ae4441bc09930739abdc824a84671e08b919655d537e6

SHA512
8a80adcf43c2f2e805970f2ab808a9cb7f0ef2b891b1a2afcda12ad035576db7ad96bde71791470cf62551a2cc71f8bf95c61a0ddee8ce0601e6575385f0fe58

Download Submit
C:\Windows\System\fgnNHSb.exe

Filesize
832KB

MD5
5a44f7cdb1383926341c50c0b001559c

SHA1
072604877b2958c577c586d14139d39f012c00dc

SHA256
b75baa9dc61a064a9b06da3e5924cf08262f544320736d419b68b7e009465f5a

SHA512
30a6a06711e9a2cdc19340bf113bead6e9cba8ddda330cd10bd1e6eff2082327b1e5ffa8ccbfcf381b643fb74eb238f08dbcab8fcd9bf4de72412df3047a6c30

Download Submit
C:\Windows\System\gmXcEGu.exe

Filesize
1.4MB

MD5
6f91604b7bc8ca5d1b102ac1fcddea9e

SHA1
bd791e5025ab28d33b91af5da087b730f442d1f8

SHA256
9435bd913e516b1a42e75d3cb3f8e8b0771900e8d3c990718578d13b2aee8d0e

SHA512
965a714a73edb80b78c4a63b984c84b8a81248e3a65e977e37cca8f8f74075f6e1e3b9464bcf74375c0d5226586d7c8a60b291ca40d3af225c9681334a4e1d4d

Download Submit
C:\Windows\System\hNCwTVh.exe

Filesize
1.4MB

MD5
8277c3989c0dbfeb11bc8797897924d5

SHA1
324a7e9fa5d3aa10dd9cc09e142fd2f70232a0a2

SHA256
6c3a89b8a747f34ad06ef6bd10235c1cc90cf4a973a477ec94ff3982cc613883

SHA512
a78b8913a24ffc79fb5bca51552fbca59bfb67f012a7d64a84dbbf1cf504ca5bc61aa476e432d284f12e32cb98d9768d2946c4858c8089d0a7f8a8292067abaf

Download Submit
C:\Windows\System\hZZwuCQ.exe

Filesize
1.3MB

MD5
280be738bf6b140c178fa2a85e88659b

SHA1
18ce631ce76445bf33c6c6b82b4180e7807e8b8d

SHA256
c3851b0bd5e3b1cb89639fdc91d1741628e7a2bd87a3f1f97ba4d166410aada2

SHA512
e4403d2b231303eded9ecc9defc1aa3666f7fabc5f2a37fc1a1f993034dee1f31a2baf1e69e1dfaaf14a32983b599c6420b6e0b6d9cfdcd5a89478deb7837d40

Download Submit
C:\Windows\System\jeKVmwc.exe

Filesize
1.4MB

MD5
3f9fc852e6ee39ca1da05c1ca278de52

SHA1
a722898907bc7bf00bcba4cbcfc63a3e65fc85f8

SHA256
63984f76b0015236ffb42cb1f21ae88136ec45c3fdd7cd05ed32c85365af6ef3

SHA512
27b067c618fc46f21a1d425642d3583a2cd55b94ef89bc09512dffdb593b9271e0522022f866495cce6f082cb49eb605f1fb511d92fb73462e8cf2c1077b1f14

Download Submit
C:\Windows\System\mIhxttk.exe

Filesize
1.3MB

MD5
702bb8cf5e1c2ecd7bbb2334d3c8c73a

SHA1
52390241acb18e21e906c5d6555e05d988f94303

SHA256
cb3acf668e50d7380f1f8142b8bdbaee1f7c77826be8597888b6b3c04e6da83e

SHA512
583e3333f41e356d2fdb7bdf6acc3c8f24d34533654453104040001ed559967ed6ed08be8376b8d26199bf7955cda2a690e546dd1e431d471d2a2ff8f1b477fe

Download Submit
C:\Windows\System\oYiVgkN.exe

Filesize
1.4MB

MD5
003a1024b7a10eba8f28564d4d626706

SHA1
bda832fff72cd19943dcb06d4b5d60af1a5a9f88

SHA256
a0340ef99655fad674b715d667962ea4c7a1aede1e3739df70f2ae7c06598aa5

SHA512
3e8b80a6d879bb0eacdbdcb6d33c39dde39037aa645daae961b208cfd4b40f4d8e370da29b696db29df62355ce879e1956ca95dee24cb9a84a6c1de9d80f45bf

Download Submit
C:\Windows\System\qWqjoaO.exe

Filesize
1.4MB

MD5
fcbe102b51de505d6aefebbf545ff167

SHA1
04a93991fc8f99d423e2a1443b6f5da45f7a3cec

SHA256
6fa174ad1ae4c7127b9e2da1ac1405070c5c3ec1c5fb81afa279f0f823f10a19

SHA512
a1d491d7061f42efb5e5e7b6ba7b0f78efe648aa68a582c316c918e16fe86c766eef7977584c42cd4ef73b533bb49915a449d0c05cdac3de0196c58492aded60

Download Submit
C:\Windows\System\tCkyhrR.exe

Filesize
1.4MB

MD5
1df9ce47412e20363bab87f76c515e4f

SHA1
4e96312dd7b34fdf3bbf0dfd3186bf22b2e43fb5

SHA256
a0ebd86f4d3f3537a8c7808291d2c79dc0d7f8142d221da3bd076b2f97db5fa1

SHA512
6ab6e0263d3db020a982aab82c77954cb03973ecb03e5427119f0c2892306966bf87afabb45000bfa8e626c24f4ca6946b6797ceb3ab37028ea5cd4d53864625

Download Submit
C:\Windows\System\tmPYojT.exe

Filesize
1.1MB

MD5
0ce2bb4ce3dbf333d3c95d3e41eb4e4b

SHA1
73e21fb87cb41407a0f78d942022a6812aab4118

SHA256
0135b427fe854e8961ec0cc981af68d46dae6ca467223ee1bba68ad995fb0dde

SHA512
17b60d3750c4db63a04c42114e7c1b6019a4e11ca4ddf903b8ef611ef2644a822b0e8838fcb222993a4220099c8f0ffcc45c1b1358328f13f2cb799bd7b4be73

Download Submit
C:\Windows\System\tzNdIgQ.exe

Filesize
1.4MB

MD5
297b48dc5fc8251a715060fc1a78293c

SHA1
2335038814bf56d60da04eb2ae10431e68443f39

SHA256
0ee1b2a4486c12d07f9f6a4e4b784fd883c05d5db6dba91bed0e1a4c3c68431e

SHA512
9209e00c8e1f83fba8845b84e3dd98f7d85bc7cfc980bbf7adfa56b4046f90a7cc59e10c53900c13a0dc6ca01e911e85b87510c17c0c6767db2f19f31b5e333e

Download Submit
C:\Windows\System\tzNdIgQ.exe

Filesize
1.2MB

MD5
74569c1058ee8219d693618199a357ad

SHA1
dc1b5927108fe68c2839af69311c3b0ef0263d30

SHA256
52356f3b45373b0ff1150867f1c6c8ea9e30c6ead9f93e493aa1a3a501f5db52

SHA512
2576c5a7c1e2de7dec18caf5e638d76b011ab4671e6fa37e1721db3e3533695a2370aecb906b8679fa6950af68826486b45245fcde435cdf0e51ad8bc1f0d122

Download Submit
C:\Windows\System\uzvjdKZ.exe

Filesize
1.4MB

MD5
568be56c835368cd2b2ecc52588cf00b

SHA1
e9b86d099b0920eda527f30d382cce4e3037d16a

SHA256
86dc1f3b3dba42750136ae378cb71eb54d2836f0e88c3ad62e26275023fcb81c

SHA512
11a1d713fd02cc3ca5f1d2b379847edc3629c48cb26024b3dd47d9020d6b778434c6e3dc19de563053507ab12c1e1f38d0a3fe8833c077a3a4996baccd6c2657

Download Submit
C:\Windows\System\vKRdXJH.exe

Filesize
1.4MB

MD5
61560a0ebeaa28927d369fe3f61b0ea3

SHA1
73c093b0d64947d2c1d6de85d02997f1480ee97f

SHA256
7ef33af41345a97e41fd899b3d7c2c06b9e88c303d88a151fdb0950f4a8d3db3

SHA512
86a74704cbb1f3b59500024a65a32ca20c00a85d8b5e83f69dba77a1c5ad465bd152b8bdb16acad86be334f313202243290648ff177eb722fad8ea8d2d2d95c5

Download Submit
C:\Windows\System\yiCMohT.exe

Filesize
1.3MB

MD5
7b9aa1598fffedd926f96387ed9503c4

SHA1
255058b8322fe198f00b170f96e56c956a83767b

SHA256
73973302b6158d9fc0f4848d063d48daf6ed924caa1767da88295fc1d6e31b2a

SHA512
7adba3d08bd3211ca2c7423894eccb6d74a9138af9daccd85c9365a971f8585745c62daee5fa8387ace2832f263f242b04eb80cd052bf2630e6a9ed4bda0eca0

Download Submit
C:\Windows\System\zRmlVlF.exe

Filesize
1.3MB

MD5
a18ef4f1f7405a115eaf6829eaf46f8f

SHA1
04556a30e559d4baee5030b5775e948bd5345055

SHA256
3bbe8b96a343fe7da9ea8988d0ae767a0ad8e07d495f9f1c909dd61d05a63cd8

SHA512
20061120b9529eea7fceb62d616f943d43af68aaf7aba669df1e823c016a55f73b48b7d60866ead11de0855a9bf192ddb5fc3ca7756c5db5c5092e24831cbd86

Download Submit
memory/404-2115-0x00007FF6001E0000-0x00007FF6005D2000-memory.dmp

Filesize
3.9MB

Download
memory/404-20-0x00007FF6001E0000-0x00007FF6005D2000-memory.dmp

Filesize
3.9MB

Download
memory/1264-92-0x00007FF6A7660000-0x00007FF6A7A52000-memory.dmp

Filesize
3.9MB

Download
memory/1264-2121-0x00007FF6A7660000-0x00007FF6A7A52000-memory.dmp

Filesize
3.9MB

Download
memory/1520-2161-0x00007FF6077F0000-0x00007FF607BE2000-memory.dmp

Filesize
3.9MB

Download
memory/1520-109-0x00007FF6077F0000-0x00007FF607BE2000-memory.dmp

Filesize
3.9MB

Download
memory/1688-67-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/1688-30-0x00007FFED7BA3000-0x00007FFED7BA5000-memory.dmp

Filesize
8KB

Download
memory/1688-153-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/1688-8171-0x00007FFED7BA3000-0x00007FFED7BA5000-memory.dmp

Filesize
8KB

Download
memory/1688-47-0x0000013EA5300000-0x0000013EA5322000-memory.dmp

Filesize
136KB

Download
memory/1688-389-0x0000013EA8130000-0x0000013EA88D6000-memory.dmp

Filesize
7.6MB

Download
memory/1708-156-0x00007FF726AD0000-0x00007FF726EC2000-memory.dmp

Filesize
3.9MB

Download
memory/1708-2197-0x00007FF726AD0000-0x00007FF726EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-147-0x00007FF7681A0000-0x00007FF768592000-memory.dmp

Filesize
3.9MB

Download
memory/2332-0-0x00007FF7DFA60000-0x00007FF7DFE52000-memory.dmp

Filesize
3.9MB

Download
memory/2332-1-0x000001F1298B0000-0x000001F1298C0000-memory.dmp

Filesize
64KB

Download
memory/2404-157-0x00007FF6185A0000-0x00007FF618992000-memory.dmp

Filesize
3.9MB

Download
memory/2404-2220-0x00007FF6185A0000-0x00007FF618992000-memory.dmp

Filesize
3.9MB

Download
memory/2544-2186-0x00007FF623C30000-0x00007FF624022000-memory.dmp

Filesize
3.9MB

Download
memory/2544-155-0x00007FF623C30000-0x00007FF624022000-memory.dmp

Filesize
3.9MB

Download
memory/2724-29-0x00007FF720E10000-0x00007FF721202000-memory.dmp

Filesize
3.9MB

Download
memory/2724-2114-0x00007FF720E10000-0x00007FF721202000-memory.dmp

Filesize
3.9MB

Download
memory/2852-164-0x00007FF786030000-0x00007FF786422000-memory.dmp

Filesize
3.9MB

Download
memory/3088-2193-0x00007FF691770000-0x00007FF691B62000-memory.dmp

Filesize
3.9MB

Download
memory/3088-124-0x00007FF691770000-0x00007FF691B62000-memory.dmp

Filesize
3.9MB

Download
memory/3152-2223-0x00007FF727F00000-0x00007FF7282F2000-memory.dmp

Filesize
3.9MB

Download
memory/3152-138-0x00007FF727F00000-0x00007FF7282F2000-memory.dmp

Filesize
3.9MB

Download
memory/3160-10-0x00007FF647B10000-0x00007FF647F02000-memory.dmp

Filesize
3.9MB

Download
memory/3160-2111-0x00007FF647B10000-0x00007FF647F02000-memory.dmp

Filesize
3.9MB

Download
memory/3404-86-0x00007FF626BD0000-0x00007FF626FC2000-memory.dmp

Filesize
3.9MB

Download
memory/3404-2117-0x00007FF626BD0000-0x00007FF626FC2000-memory.dmp

Filesize
3.9MB

Download
memory/3592-2191-0x00007FF73FC90000-0x00007FF740082000-memory.dmp

Filesize
3.9MB

Download
memory/3592-126-0x00007FF73FC90000-0x00007FF740082000-memory.dmp

Filesize
3.9MB

Download
memory/3620-142-0x00007FF77B040000-0x00007FF77B432000-memory.dmp

Filesize
3.9MB

Download
memory/3740-167-0x00007FF6B3C90000-0x00007FF6B4082000-memory.dmp

Filesize
3.9MB

Download
memory/4016-16-0x00007FF602A70000-0x00007FF602E62000-memory.dmp

Filesize
3.9MB

Download
memory/4016-2113-0x00007FF602A70000-0x00007FF602E62000-memory.dmp

Filesize
3.9MB

Download
memory/4312-143-0x00007FF6ED780000-0x00007FF6EDB72000-memory.dmp

Filesize
3.9MB

Download
memory/4312-2343-0x00007FF6ED780000-0x00007FF6EDB72000-memory.dmp

Filesize
3.9MB

Download
memory/4420-154-0x00007FF69EB60000-0x00007FF69EF52000-memory.dmp

Filesize
3.9MB

Download
memory/4420-2119-0x00007FF69EB60000-0x00007FF69EF52000-memory.dmp

Filesize
3.9MB

Download
memory/4588-161-0x00007FF7C41F0000-0x00007FF7C45E2000-memory.dmp

Filesize
3.9MB

Download
memory/4588-2214-0x00007FF7C41F0000-0x00007FF7C45E2000-memory.dmp

Filesize
3.9MB

Download
memory/4668-2196-0x00007FF7F5310000-0x00007FF7F5702000-memory.dmp

Filesize
3.9MB

Download
memory/4668-131-0x00007FF7F5310000-0x00007FF7F5702000-memory.dmp

Filesize
3.9MB

Download
memory/4940-2153-0x00007FF7141B0000-0x00007FF7145A2000-memory.dmp

Filesize
3.9MB

Download
memory/4940-99-0x00007FF7141B0000-0x00007FF7145A2000-memory.dmp

Filesize
3.9MB

Download
memory/4960-2340-0x00007FF7E64E0000-0x00007FF7E68D2000-memory.dmp

Filesize
3.9MB

Download
memory/4960-168-0x00007FF7E64E0000-0x00007FF7E68D2000-memory.dmp

Filesize
3.9MB

Download
memory/4996-2228-0x00007FF660230000-0x00007FF660622000-memory.dmp

Filesize
3.9MB

Download
memory/4996-163-0x00007FF660230000-0x00007FF660622000-memory.dmp

Filesize
3.9MB

Download